Threat Signal Report

New SpearPhishing Attacks Attributed to NOBELIUM, the Group Behind SolarWinds

Description

FortiGuard Labs is aware of new campaign by the threat actors known as NOBELIUM (aka APT29/Cozy Bear). This recent campaign discovered by Microsoft Security Researchers, appears to be targeting over 150 unique organizations and 3,000 individuals in what is a global spearphishing campaign. Microsoft has previously identified NOBELIUM as the threat actor group behind the SolarWinds attack of December 2020. The attackers have been observed abusing Constant Contact, a popular email sending service based in the U.S. but used by many organizations and companies worldwide. Multiple campaigns have been observed sending various spearphishing emails with an HTML file attachment that contains JavaScript code to call an attacker controlled server. From there, several malicious files would be downloaded and installed unknowingly by the victim, enabling surveillance and reconnaissance by the threat actor.


Is NOBELLIUM APT 29/Cozy Bear/Duke etc.?

Yes. NOBELLIUM is Microsoft's designation for the threat actor known as APT29, etc. Because of the lack of standardization and nomenclature for APT groups, various actors are known under various names with different vendors.


Why is APT29/Cozy Bear/Duke Significant?

APT29/Cozy Bear/Duke has been in operation since 2008. Previous attacks attributed to this threat actor have targeted various companies, governmental agencies, research institutions, non-governmental organizations, and think tanks across multiple countries. Other high profile attacks attributed to this group are the attacks on the United States Pentagon in 2015, the Democratic National Committee (DNC) email leaks in 2016, and against various U.S.-based think tanks and NGOS in 2017.


Although APT29 is attributed to Russia, it is not to be confused with APT28/Fancy Bear/Pawn Storm, which is another group attributed to Russia. APT28 was responsible for the World Anti-Doping Agency (WADA) attacks before the Rio Olympics (2016) and was also responsible for the DNC attacks in 2016 as well.


What are the Technical Details?

The campaign uses a novel spearphishing email that ultimately leads to the installation of an ISO file. ISO files historically allowed system administrators to install operating system software directly onto machines manually (via CD ROM, USB, etc.) where the file would be recognized as an ISO file by the motherboard BIOS after reboot and continue installing needed operating system files. As networks became more advanced (PXE boot) and cloud installations have become more common, ISO images have become less used, but are still widely popular with hobbyists and are still currently supported. More recent uses for ISO files include the installation of ISO images such as Linux, that are used to install operating system software to a virtual machine.


This new spearphishing technique involves the usage of a link within the attacker created email. When the target clicks on the link, the link will first direct to a Constant Contact URL, which will then redirect to an attacker controlled URL that contains a reference to an ISO file download. The ISO contains several files:

  • a shortcut file LNK (Reports) which is a Cobalt Strike beacon downloader;
  • a PDF document that is displayed to the target that is actually a decoy;
  • and a hidden DLL file that is actually a custom Cobalt Strike beacon loader named NativeZone.
Once the Reports shortcut file is clicked on by the intended victim, the hidden NativeZone DLL file would be executed allowing for the compromise.


Is This Limited to Targeted Attacks?

No.


How Serious of an Issue is This?

High.


What is the Status of Protections for this Event?

FortiGuard Labs has AV coverage in place for publicly available samples as:


W32/Cobalt.DTI!tr

W64/Rozena.KA!tr

W32/Khalesi.JAQC!tr

LNK/Agent.KT!tr

W32/Cobalt.DTI!tr

W32/Khalesi.JAQC!tr


For FortiEDR protections, all published IOC's were added to our Cloud intelligence and will be blocked if executed on customer systems.


All network IOC's are blocked by the Web Filtering client.


Any Other Suggested Mitigation?

Due to the ease of disruption and due to the disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.]


It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine risk.


Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.


Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.