• We’re Hiring
  • Request Demo
  • Support
  • Log In
  • Product keyboard_arrow_down
  • Solutions keyboard_arrow_down
  • Customers
  • Partners
  • Blog
  • Resources keyboard_arrow_down
  • Get started arrow_forward
  • Product
  • apps
    Overview
    Learn more about threat intelligence powered by machine learning
  • blur_on
    Technology
    See how collection from an unrivaled breadth of sources powers risk insights
  • developer_board
    Integrations
    Combine threat intelligence with your existing security technology
  • announcement
    Services
    Let our team of world-class analysts help you apply threat intelligence
  • device_hub
    API
    Connect to our real-time threat data through a flexible rest API
  • create
    Training
    Become an expert in threat intelligence through our educational programs
  • Solutions
    people By Role
  • Incident Response
  • Security Leadership
  • Security Operations
  • Threat Analysis
  • Vulnerability Management
  • extension By Need
  • Brand Monitoring
  • Dark Web Monitoring
  • Indicator Enrichment
  • Third-Party Risk
  • Threat Hunting
  • Threat Intelligence Platform
  • Threat Intelligence Feeds
  • business By Industry
  • Energy
  • Financial Services
  • Government
  • Healthcare
  • Retail
  • Resources
  • email
    Cyber Daily™
    Join over 35,000 subscribers who get daily threat insights by email
  • mic
    Podcasts
    Listen to our podcast to supercharge your threat intelligence knowledge
  • book
    The Book
    Download our new book to learn everything about threat intelligence
  • ondemand_video
    Webinars
    Watch live and on-demand webinars to hear from industry experts
  • how_to_reg
    Grader
    Take this short survey to assess your threat intelligence maturity
  • chrome_reader_mode
    White Papers
    Read our white papers to keep up with the latest threat intelligence advice
  • video_library
    Videos
    Watch our videos to see firsthand the power of threat intelligence
  • menu
    close
    • Product
      • Overview
      • Technology
      • Services
      • Integrations
      • API
      • Training
    • Solutions
      • Threat Analysis
      • Security Operations
      • Incident Response
      • Vulnerability Management
      • Security Leadership
      • Indicator Enrichment
      • Brand Monitoring
      • Threat Hunting
      • Cyber Risk Trends
      • Threat Intelligence Feeds
      • Financial Services
      • Healthcare
      • Retail
      • Energy
      • Government
    • Customers
    • Partners
    • Resources
      • Cyber Daily
      • Webinars
      • Podcasts
      • White Papers
    • Login
    Breaking the Code on Russian Malware
    Recorded Future Blog

    Breaking the Code on Russian Malware

    By Jennifer on November 20, 2014

    Russia poses a serious cyber threat to industrial control systems (ICS), pharmaceutical, defense, aviation, and petroleum companies. Russian government cyber operations aim to use malware to steal information on files, persist on ICS equipment, and commit espionage. According to a 2014 GData Red Paper, Uroburos malware’s “modular structure allows extending it with new features easily, which makes it not only highly sophisticated but also highly flexible and dangerous.” Understanding these threats posed by the malware and Russia’s objectives will go a long way to securing networks.

    There is nothing quick about studying Russian cyber operations. Beyond understanding the complexities of the malware itself, one must also match up the names of several families of malware, some which have evolved over time and have had different names, as well as to link together the names given to specific groups by a number of private security companies. As many as five different codewords have been given to Russian Federation sponsored cyber campaigns by companies such as Kaspersky, iSIGHT Partners, Symantec, FireEye/Mandiant.

    To further complicate research and analysis, the codewords represent different facets of the malware problem, some are grouped by signatures, some by actors, others by tools. Before understanding the cyber threat posed by Russia one must make sense of the tremendous amount of documentation on the problem and connect the codewords to unlock potentially missed data and trends when conducting threat analysis.

    Malware rooted in Russia has been attacking a variety of political, military, and economic targets for a least the past seven years.

    Russian Malware Attacks Timeline

    Click image for larger view

    Russian Malware Analysis

    There are primarily three families of Russian malware: Uroburos, Energetic Bear, and APT28. This analysis will lay out the various names given to these threats by the security community as well as provide the malware’s access delivery mechanism, such as spear-phishing and watering hole attacks. Additionally, each group has its unique access vector, exploit/vulnerability, and toolkit.

    In examining each in combination it appears each Russian malware group has been designed with different cyber objectives in mind. The three goals include using cyber intrusions to conduct espionage, pre-position Russian accesses for future cyber warfare, and to meddle and monitor geopolitical threat’s in Russia’s backyard. Behind the scenes these goals may provide clues into the organizations and actors that conduct these nefarious attacks.

    Uroburos Malware

    Uroburos Malware

    The earliest reported attacks involved Agent.BTZ malware intrusion into DoD networks in 2008.

    Agent.BTZ Malware Timeline

    Click image for larger view

    Since that time, Agent.BTZ evolved into Uroburos. According to the aforementioned G Data 2014 Red Paper, “Due to many technical details (file name, encryption keys, behavior and more details mentioned in this report), we assume that the group behind Uroburos is the same group that performed a cyber attack against the United States of America in 2008 with a malware called Agent.BTZ. Uroburos checks for the presence of Agent.BTZ and remains inactive if it is installed.” Based on the targets of this malware, both political and economic espionage seem to be at the root of the Uroburos attackers.

    A targeted user receives an email with an attachment containing an executable RAR self-extracting archive (SFX). After opening the executable with an .SCR extension, the RAR SFX archive unpacks the malware and installs it into the appropriate location and then runs the malware. This attack relies heavily on user deception, not technical sophistication. Russian operators likely have had to resort to the .SCR exploitation option when they have lacked usable available exploits (i.e. when exploits have been patched).

    Energetic Bear Malware

    Energetic Bear Malware

    Energetic Bear Malware Timeline

    Click image for larger view

    The Energetic Bear group is unique in that its target objective is to maintain long-term persistent access to the energy industry, ICS manufacturers, aviation, and defense. This is further evident by Energetic Bear’s focus on ICS manufacturers and not just deployed ICS assets. This may be the work of a military group pre-positioning itself for a computer network attack as a tool to fulfill military or political goals. Parallels can be drawn between Energetic Bear and Stuxnet in terms of its victimology and focus on ICS equipment.

    APT28 Malware

    APT28 Malware

    APT28 Malware Timeline

    Click image for larger view

    As far back as 2007, APT28 has been targeting Eastern European organizations that appear to be a direct threat to the current Russian government. According to AlienVault, this group “uses phishing campaigns to redirect victims to Outlook Web Access (OWA) portals designed to impersonate the legitimate OWA site of the victim’s company.” APT28 has also focused on intrusions into Georgia’s Ministry of Defense further exemplifying their focus on regional geopolitical threats.

    Russian Malware Georgia Map

    Conclusions

    Russia’s three major malware groups each have distinct operational objectives. From espionage, cyber warfare, and tracking regional geopolitical foes, Russia continues to build a cyber capability with the potential to impact organizations worldwide. The scope of Russian cyber operations has only recently been discovered by cyber security firms. In contrast, Chinese cyber operations have been known for over a decade due to their sloppy operational procedures and direct attribution. Russia however, continues to lead the way in stealthier malware and operations making their efforts harder to identify and analyze.

    Although these intrusions have been identified and are widely attributed to Russia’s government, there are several others whose attribution to the Russian Federation is less clear like MiniDuke, CosmicDuke, BlackEnergy Bot, Sandworm, and Quedagh.

    Each of these groups have disparate targets despite using similar delivery mechanisms. While all of these intrusions utilize user behavior in order to facilitate access to their victims, the varying objectives of each group indicates a strategic level of planning. Furthermore, the lack of cohabitation of the different malware families in the wild is notable. This indicates coordination at the tactical, operational, and strategic level. This kind of coordination is indicative of Russia’s well-known reputation as an advanced cyber threat.

    —

    If you’re interested in researching malware using threat intelligence from the open web, we can help. Get started by requesting a demo of Recorded Future.

    Up next:
    New Malicious Networks Discovered in Dark Hotel Malware Campaign

    Recorded Future analysis reveals the Dark Hotel malware campaign has links to long-standing malicious networks.

    4 years AGO
    Rodrigo
    Cyber Daily Banner
    listRecent Posts
    • How to Build Comprehensive Security Processes With Threat Intelligence

      By Andrew Scott

      on February 15, 2019

    • Third-Party Risk: Keeping Your Friends Close and Your Enemies Not as Close

      By Zane Pokorny

      on February 14, 2019

    • 4 Ransomware Trends to Watch in 2019

      By Allan Liska

      on February 13, 2019

    • How Dragos Protects Industrial Control Systems With Threat Hunting

      By The Recorded Future Team

      on February 12, 2019

    • The Value Proposition of Finished Intelligence

      By Zane Pokorny

      on February 11, 2019

    Copyright © 2019 Recorded Future, INC.
    Product
  • Overview
  • Technology
  • Integrations
  • Services
  • API
  • Resources
  • Blog
  • Cyber Daily
  • Podcasts
  • Webinars
  • White Papers
  • Company
  • About
  • Events
  • Press
  • Contact
  • Jobs
  • Information
  • Support
  • FAQ
  • Terms
  • Privacy
  • Cookies
  • Copyright © 2019 Recorded Future, INC.
    closeclose