Russian APT28 Hackers Using COVID-19 as Bait to Deliver Zebrocy Malware

A Russian danger actor recognized for its malware campaigns has reappeared in the risk landscape with but yet another attack leveraging COVID-19 as phishing lures, at the time again indicating how adversaries are adept at repurposing the present planet gatherings to their benefit.

Linking the procedure to a sub-team of APT28 (aka Sofacy, Sednit, Extravagant Bear, or STRONTIUM), cybersecurity organization Intezer stated the pandemic-themed phishing email messages were employed to provide the Go variation of Zebrocy (or Zekapab) malware.

The cybersecurity company told The Hacker News that the strategies were observed late past thirty day period.

Zebrocy is delivered primarily by means of phishing attacks that consist of decoy Microsoft Workplace files with macros as effectively as executable file attachments.

Very first noticed in the wild in 2015, the operators powering the malware have been found to overlap with GreyEnergy, a threat group believed to be the successor of BlackEnergy aka Sandworm, suggesting its function as a sub-team with back links to Sofacy and GreyEnergy.

It operates as a backdoor and downloader able of accumulating program data, file manipulation, capturing screenshots, and executing destructive commands that are then exfiltrated to an attacker-managed server.

Whilst Zebrocy was originally created in Delphi (named Delphocy), it has since been carried out in half a dozen languages, like AutoIT, C++, C#, Go, Python, and VB.NET.

This particular campaign spotted by Intezer takes advantage of the Go variation of the malware, initial documented by Palo Alto Networks in October 2018 and afterwards by Kaspersky in early 2019, with the lure sent as element of a Virtual Difficult Generate (VHD) file that demands victims to use Windows 10 to entry the files.

When mounted, the VHD file seems as an external push with two data files, one particular a PDF document that purports to contain presentation slides about Sinopharm Global Company, a China-based pharmaceutical corporation whose COVID-19 vaccine has been located to be 86% effective towards the virus in late-phase scientific trials.

The 2nd file is an executable that masquerades as a Word doc that, when opened, runs the Zebrocy malware.

Intezer said it also observed a separate attack probably targeting Kazakhstan with phishing lures impersonating an evacuation letter from India’s Directorate Common of Civil Aviation.

Phishing campaigns offering Zebrocy have been noticed various periods in the wild in the latest months.

In September past calendar year, ESET in depth Sofacy’s intrusive things to do concentrating on the Ministries of Foreign Affairs in Japanese European and Central Asian nations.

Then before this August, QuoIntelligence uncovered a individual campaign aimed at a federal government body in Azerbaijan underneath the pretense of sharing NATO coaching classes to distribute the Zebrocy Delphi variant.

The Golang edition of the Zebrocy backdoor also caught the awareness of the US Cybersecurity and Infrastructure Security Agency (CISA), which produced an advisory in late October, cautioning that the malware is “created to permit a remote operator to complete a variety of features on the compromised procedure.”

To thwart these attacks, CISA recommends working out caution when utilizing removable media and opening emails and attachments from unknown senders, and scanning for suspicious email attachments, and ensuring the extension of the scanned attachment matches the file header.

Found this short article exciting? Comply with THN on Fb, Twitter  and LinkedIn to read through much more special content we put up.

Some elements of this article are sourced from:
thehackernews.com