The Plot to Hack America

Many hackers establish typosquatting websites. These are where a false “squatter” website is installed on the actual location of a known website or where they buy a URL that is nearly identical to a well known website but where fat-fingered “typos” occur (e.g. Microsift.com, Amaxon.com). Hence “Typosquatter.” Another technique to gather login, password or financial information from a targeted victim is to establish or insert malicious viruses into a targeted site. Many typosquatters are Watering Hole sites—decoy or fraudulent websites that are loaded with malware and used to lure targets via spear-phishing emails to download their payload. To fool computer users into following these links, the site would need to look relevant or identical to the target’s working interest, and include very up-to-date information, whether it be a bombing attack in Iraq mentioned in an email to the Vatican Embassy in Iraq, or schedule and coordination information sent to Hungary. In many cases, the malicious domain is very similar to the real domain.

Trend Micro examined four cases in the “Operation Pawn Storm” attacks and found these examples.

Hackers sent a series of emails to the Hungarian Ministry of Defense supposedly inviting them to the world’s largest Defense exhibit held in Paris each year, Eurosatory. The hacker’s email included links to “eurosatory2014.com.” The link led to a false site that stole the user’s information. So the technique is to deceive the employee into thinking the website is legitimate if they have attended the conference before or are aware of upcoming participation.¹⁰

A staff member of the Organization for Security and Cooperation in Europe in Vienna was victim of an attempt at phishing. A link in an email sent to employees was to “vice-news.com” even though Vice News is found at “news.vice.com.” To lure an employee at SAIC, hackers used a link aimed at “Future Forces 2014” which pointed to “natoexhibitionff14.com” when the real exhibition website is “natoexhibition.org”¹¹ The purpose was to lure the personnel to give up their webmail log in credentials so the hackers can walk through the front door. For instance, the OSCE’s real OWA domain is “login-in.osce.org” an extension of “osce.org”. The phishing account purchased to steal credentials was “login-in-osce.org” In the case of SAIC, the OWA domain was “webmail.saic.com” related to “saic.com”. The phishing account purchased was “webmail-saic.com.”¹²

Fancy Bear also targeted Academi, the infamous company formerly known as Blackwater. The link sent to them was meant to look like it came from “tolonews.com,” when in fact it came from “tolonevvs.com,” which was infected and part of the phishing campaign. As with the pattern above, the real email server was a very close misspelling that may have passed a casual glance, “academl” instead of “academi.com.”

In the case of a German company, attackers went so far as to buy an SSL certificate to mask their heist. SSL certificates are sold to allow a vendor to establish a secure connection to the buyer’s browser. Trend Micro says they were able to warn the target and avoid attack only because of early detection.¹³ Trend Micro engaged the attackers by sending fake credentials through these webmail login pages. Attackers responded “within minutes” of the intentional “leaking” of these fake accounts and began attempting unauthorized access. After an initial login check came from the site itself, they noticed additional login attempts that came next from Latvia (46.166.162.90) and the United States (192.154.110.244).¹⁴

Once the hackers are in they deploy a range of tools to take control of the infected computer and begin efforts to gain data to download—credit cards, photos, or bitcoins, they steal it all.

In a Trend Micro assessment from August 2015, APT28, aka “Pawn Storm,” focused 25 percent of its targeting efforts on the Ukraine, followed by the United States at 19 percent. When it came to attacks by sector, the emphasis shifted depending on the country. In Russia 23 percent of attacks targeted Media, followed by 17 percent on Diplomacy, then Activism at 15 percent. By contrast, the Ukrainian sectors struck were 18 percent Military, 18 percent Media, 16 percent Government. For the United States the sectors were even clearer, with Military at 35 percent, Defense at 22 percent, and Government at 8 percent. Attacks on American media were at 7 percent.¹⁵

APT 29—COZY BEAR Russian Military Intelligence (GRU)