Breaking the Code on Russian Malware

November 20, 2014 • Jennifer

Russia poses a serious cyber threat to industrial control systems (ICS), pharmaceutical, defense, aviation, and petroleum companies. Russian government cyber operations aim to use malware to steal information on files, persist on ICS equipment, and commit espionage. According to a 2014 GData Red Paper, Uroburos malware’s “modular structure allows extending it with new features easily, which makes it not only highly sophisticated but also highly flexible and dangerous.” Understanding these threats posed by the malware and Russia’s objectives will go a long way to securing networks.

There is nothing quick about studying Russian cyber operations. Beyond understanding the complexities of the malware itself, one must also match up the names of several families of malware, some which have evolved over time and have had different names, as well as to link together the names given to specific groups by a number of private security companies. As many as five different codewords have been given to Russian Federation sponsored cyber campaigns by companies such as Kaspersky, iSIGHT Partners, Symantec, FireEye/Mandiant.

To further complicate research and analysis, the codewords represent different facets of the malware problem, some are grouped by signatures, some by actors, others by tools. Before understanding the cyber threat posed by Russia one must make sense of the tremendous amount of documentation on the problem and connect the codewords to unlock potentially missed data and trends when conducting threat analysis.

Malware rooted in Russia has been attacking a variety of political, military, and economic targets for a least the past seven years.

Click image for larger view

Russian Malware Analysis

There are primarily three families of Russian malware: Uroburos, Energetic Bear, and APT28. This analysis will lay out the various names given to these threats by the security community as well as provide the malware’s access delivery mechanism, such as spear-phishing and watering hole attacks. Additionally, each group has its unique access vector, exploit/vulnerability, and toolkit.

In examining each in combination it appears each Russian malware group has been designed with different cyber objectives in mind. The three goals include using cyber intrusions to conduct espionage, pre-position Russian accesses for future cyber warfare, and to meddle and monitor geopolitical threat’s in Russia’s backyard. Behind the scenes these goals may provide clues into the organizations and actors that conduct these nefarious attacks.

Uroburos Malware

The earliest reported attacks involved Agent.BTZ malware intrusion into DoD networks in 2008.

Click image for larger view

Since that time, Agent.BTZ evolved into Uroburos. According to the aforementioned G Data 2014 Red Paper, “Due to many technical details (file name, encryption keys, behavior and more details mentioned in this report), we assume that the group behind Uroburos is the same group that performed a cyber attack against the United States of America in 2008 with a malware called Agent.BTZ. Uroburos checks for the presence of Agent.BTZ and remains inactive if it is installed.” Based on the targets of this malware, both political and economic espionage seem to be at the root of the Uroburos attackers.

A targeted user receives an email with an attachment containing an executable RAR self-extracting archive (SFX). After opening the executable with an .SCR extension, the RAR SFX archive unpacks the malware and installs it into the appropriate location and then runs the malware. This attack relies heavily on user deception, not technical sophistication. Russian operators likely have had to resort to the .SCR exploitation option when they have lacked usable available exploits (i.e. when exploits have been patched).

Energetic Bear Malware

Click image for larger view

The Energetic Bear group is unique in that its target objective is to maintain long-term persistent access to the energy industry, ICS manufacturers, aviation, and defense. This is further evident by Energetic Bear’s focus on ICS manufacturers and not just deployed ICS assets. This may be the work of a military group pre-positioning itself for a computer network attack as a tool to fulfill military or political goals. Parallels can be drawn between Energetic Bear and Stuxnet in terms of its victimology and focus on ICS equipment.

APT28 Malware

Click image for larger view

As far back as 2007, APT28 has been targeting Eastern European organizations that appear to be a direct threat to the current Russian government. According to AlienVault, this group “uses phishing campaigns to redirect victims to Outlook Web Access (OWA) portals designed to impersonate the legitimate OWA site of the victim’s company.” APT28 has also focused on intrusions into Georgia’s Ministry of Defense further exemplifying their focus on regional geopolitical threats.

Conclusions

Russia’s three major malware groups each have distinct operational objectives. From espionage, cyber warfare, and tracking regional geopolitical foes, Russia continues to build a cyber capability with the potential to impact organizations worldwide. The scope of Russian cyber operations has only recently been discovered by cyber security firms. In contrast, Chinese cyber operations have been known for over a decade due to their sloppy operational procedures and direct attribution. Russia however, continues to lead the way in stealthier malware and operations making their efforts harder to identify and analyze.

Although these intrusions have been identified and are widely attributed to Russia’s government, there are several others whose attribution to the Russian Federation is less clear like MiniDuke, CosmicDuke, BlackEnergy Bot, Sandworm, and Quedagh.

Each of these groups have disparate targets despite using similar delivery mechanisms. While all of these intrusions utilize user behavior in order to facilitate access to their victims, the varying objectives of each group indicates a strategic level of planning. Furthermore, the lack of cohabitation of the different malware families in the wild is notable. This indicates coordination at the tactical, operational, and strategic level. This kind of coordination is indicative of Russia’s well-known reputation as an advanced cyber threat.

—

If you’re interested in researching malware using threat intelligence from the open web, we can help. Get started by requesting a demo of Recorded Future.