The Plot to Hack America

Russia didn’t sit on its laurels by stealing American scientific data. For more than ten years, volunteer militia hackers and cyber criminals carried out limited, and on occasion, full-scale cyber warfare on its neighbors in Europe. There is an arms race in the cyber weapons world as nation-state and freelance hackers seek to push the technology envelope. By 2016 the history of Russia’s attacks showed proficiency at destroying enemies with cyber strikes.

First Steps in Cyber Campaigns

The first step is to establish a target organization or individual. Second would be to find out how and where to compromise the target’s IT systems with the least amount of effort possible and without being detected. This will most often start with examining the publicly-posted employee rosters at a company, organization, or government office. Next will be a scour on social media sites like Facebook, LinkedIn, Twitter, Google, or even simply within the agency of the target.⁷

The target or targets are subjected to an email spear-phishing campaign. Spearphishing is a technique that seeks to fool a target into clicking on links or opening email attachments in emails the target would expect to receive. For example, if a State Department official was expected to attend a conference on a UN refugee program, they might receive an email with the title “Schedule for the Refugee Committee” with an attached document or link. If it is a link instead of an attachment, the target might take a look at the link before clicking, but the reasonable-looking link will lead to a spoofed site that has just returned malware back to their computer. Once that malware is installed, it may do a number of things depending on the intent of its coding. The first function it is likely to perform is to breach.

The APT countermeasure system tracks not only the malware toolkits themselves, but the source of origin and related resources, including IP addresses of the remote Command-and-Control servers (C2), or in some cases metadata found in the compiled tools used by the threat actors. In addition, a pattern of behavior in what the hackers steal can help indicate further distinctions on the group behind the malware infection. For instance, nation-state hackers acting on behalf of Russia and China do not typically engage in financial theft but focus on espionage targets, even if that target is a private enterprise.

In the case of the attacks on the DNC, the company CrowdStrike identified two actors in separate breaches on the servers used. The two found were identified as “FancyBear” and “CozyBear” by CrowdStrike, but elsewhere they have other names depending on the security firm who encounters their activities. FancyBear is also commonly known as APT28 or Sofacy. CozyBear is commonly known as APT29.

APT 28—FANCY BEAR Russian State Security/Covert External Intelligence (FSB/SVR)

APT28 is a group that goes by many names, depending on who has discovered them. In order to learn the character of this group it helps to look at all the cases investigated on the range of names the group gets assigned. Along with the naming of the group, different firms also name the malware and conflicting names can occur for the same toolset. FireEye calls them APT28, CrowdStrike named them FancyBear, Trend Micro has called them Operation Pawn Storm, Microsoft Security Intelligence Report calls them STRONTIUM,⁸ Secure Works tagged them as TG-4127. They’ve also been called Sednit (by Eset), Tsar Team (iSight) and Sofacy Group. Despite these names the methodology and toolset is distinct and shows a deployment sophistication that truly qualifies as an advanced and persistent threat; it is considered one of the most potent threats in the list of known APTs.

Security authorities first discovered the group in 2007. Their attacks have included a range of Eastern European countries including Ukraine, Georgia, Poland, to the south at Pakistan and further west to the United States and France. They have been linked to the GRU. They were even tied to attacks on the Russian all-girl band Pussy Riot.⁹

Typosquatters and Watering Holes