CERT Polska warns of a large-scale malware campaign against Polish government institutions conducted by Russia-linked APT28.<\/h2>\n\n\n\n
CERT Polska and CSIRT MON teams issued a warning about a large-scale malware campaign targeting Polish government institutions, allegedly orchestrated by the Russia-linked APT28<\/a> group.<\/p>\n\n\n\n
The attribution of the attacks to the Russian APT is based on similarities with TTPs employed by APT28 in attacks against Ukrainian entities<\/a>.<\/p>\n\n\n\n
“the CERT Polska (CSIRT NASK) and CSIRT MON teams observed a large-scale malware campaign targeting Polish government institutions.” reads the alert<\/a>. “Based on technical indicators and similarity to attacks described in the past (e.g. on Ukrainian entities)<\/a>, the campaign can be associated with the APT28 activity set, which is associated with Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).”<\/em>
![\"APT28\"](\"https:\/\/i0.wp.com\/securityaffairs.com\/wp-content\/uploads\/2024\/05\/image-8.png?ssl=1\")
<\/a><\/figure><\/div>\n\n\nUpon clicking on the link, the victims are redirected to the domain run.mocky[.]io, which is a free service used by developers to create and test APIs. The domain, in turn, redirects to another legitimate site named webhook[.]site which allows logging all queries to the generated address and configuring responses.<\/p>\n\n\n\n
Threat actors in the wild increasingly rely on popular services in the IT community to evade detection and speed up operations.
The attack chain includes the download of a ZIP archive file from webhook[.]site, which contains:<\/p>\n\n\n\n
- \n
- a Windows calculator with a changed name, e.g.
IMG-238279780.jpg.exe<\/code>, which pretends to be a photo and is used to trick the recipient into clicking on it, script.bat<\/code> (hidden file),<\/li>\n\n\n\nfake libraryWindowsCodecs.dll<\/code> (hidden file).<\/li>\n<\/ul>\n\n\n\nIf the victim runs the file fake image file, which is a harmless calculator, the DLL file is side-loaded to run the batch file.<\/p>\n\n\n\n
The BAT script launches the Microsoft Edge browser and loads a base64-encoded page content to download another batch script from webhook.site. Meanwhile, the browser shows photos of a woman in a swimsuit with links to her genuine social media accounts, aiming to appear credible and lower the recipient’s guard. The downloaded file, initially saved as .jpg, is converted to .cmd and executed.<\/p>\n\n\n\n
Finally, the code retrieves the final-stage script that gathers information about the compromised host and sends it back.
“This script constitutes the main loop of the program. In the loop
for \/l %n in ()<\/code> it first waits for 5 minutes, and then, similarly as before, downloads another script using the Microsoft Edge browser and the reference towebhook.site<\/code> and executes it. This time, the file with the extension.css<\/code> is downloaded, then its extension is changed to.cmd<\/code> and launched.” continues the report. “The script we finally received collects only information about the computer (IP address and list of files in selected folders) on which they were launched, and then send them to the C2 server. Probably computers of the victims selected by the attackers receive a different set of the endpoint scripts.”<\/em>\n![\"APT28\"](\"https:\/\/i0.wp.com\/securityaffairs.com\/wp-content\/uploads\/2024\/05\/image-9.png?resize=611%2C479&ssl=1\")
<\/a><\/figure><\/div>\n\n\nRegardless of whether your organization uses these websites, it’s also advised to filter emails for links to webhook.site and run.mocky.io, as legitimate use of these links in email content is very rare.<\/p>\n\n\n\n
Last week, NATO and the European Union condemned cyber espionage operations<\/strong><\/a> carried out by the Russia-linked threat actor APT28<\/a> (aka \u201cForest Blizzard<\/a>\u201d, \u201cFancybear<\/a>\u201d or \u201cStrontium<\/a>\u201d) against European countries.<\/p>\n\n\n\n
\u201cThe Federal Government\u2019s national attribution procedure regarding this campaign has concluded that, for a relatively long period, the cyber actor APT28 used a critical vulnerability in Microsoft Outlook that remained unidentified at the time to compromise numerous email accounts.\u201d reads the announcement<\/strong><\/a> published by the German Bundesregierung.<\/em><\/p>\n\n\n\n
The nation-state actor exploited the zero-day flaw CVE-2023-23397<\/a> in attacks against European entities since April 2022. The Russia-linked APT also targeted NATO entities<\/a> and Ukrainian government agencies.
The APT28<\/a> group (aka Fancy Bear<\/a>, Pawn Storm<\/a>, Sofacy Group<\/a>, Sednit<\/a>, BlueDelta, and STRONTIUM<\/a>) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. The group was involved also in the string of attacks that targeted 2016 Presidential election<\/a>.<\/p>\n\n\n\n
Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n
Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n
(<\/strong>SecurityAffairs<\/strong><\/a> \u2013<\/strong> hacking, malware)<\/strong><\/p>\n\n\n\n
![\"APT28\"](\"https:\/\/i0.wp.com\/securityaffairs.com\/wp-content\/uploads\/2024\/05\/image-9.png?ssl=1\")
<\/a><\/figure><\/div>\n\n\n