![](\"https:\/\/media.wired.com\/photos\/5bf3653712a65909dc06160a\/master\/pass\/new_phishing-FA.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Lily Hay Newman| Date: Tue, 20 Nov 2018 14:16:13 +0000<\/strong><\/p>\n A major question <\/span>hanging over the United States midterm election<\/a> season: Where was Russia<\/a>? But while GRU hackers<\/a> didn't directly interfere, they appear to be as active as ever. New research from two threat intelligence firms indicates that two prominent Russia-linked groups have been developing some clever phishing innovations, and are working purposefully to expand their reach.<\/p>\n "There\u2019s a lot of ramping up from this particular nation state in general," says Jen Miller-Osborn, deputy director of threat intelligence in Palo Alto Networks' Unit 42 research team.<\/p>\n The prolific hacking group APT 28\u2014also known as Fancy Bear or Sofacy\u2014which memorably hacked the Democratic National Committee<\/a> in 2016, has a new phishing tool in its arsenal, according to findings<\/a> from security firm Palo Alto Networks. The trojan, concealed in a malicious document attachment, uses some classic techniques to send information about a target system back to a remote server, but the tool has been reworked for current use.<\/p>\n "It's not uncommon to see them come out with a new variant or a totally new malware family."<\/p>\n Jen Miller-Osborn, Palo Alto Networks<\/p>\n APT 28 is known for constantly evolving its tools, and drawing on methods that have fallen out of fashion to create something new that flies under the radar. Its newly minted "Cannon" trojan, which Palo Alto spotted during attacks in late October and early November, does both. The malware communicates with its command and control server via emails sent over an encrypted connection, so they can't be read on the way. Hackers use all sorts of communication schemes for command and control, including hiding communications in a victim's regular network traffic, piggybacking on compromised web services, or manipulating normal internet protocol requests. Using email for this communication is a technique that was widely popular several years ago, but had largely faded until its reappearance here.<\/p>\n "Actors shifted away likely because the technique got more well known," Miller-Osborn says. "It fits in with Sofacy's constant retooling. It's not uncommon to see them come out with a new variant or a totally new malware family."<\/p>\n Palo Alto Networks researchers have only found one sample of the special Cannon-laced malicious document so far, but it was part of a broader APT 28 phishing campaign they observed that focused on government targets in North America, Europe, and a former USSR state that the company declined to name.<\/p>\n Meanwhile, investigators at FireEye observed<\/a> an extensive phishing campaign launched last week that appears to come from APT 29 hackers, also called Cozy Bear. The group participated in the DNC and other hacks<\/a> during the 2016 US presidential election, and went on to other international government hacking after that, but has seemed to be dormant since sometime in 2017.<\/p>\n Partly because of that long stretch of inactivity, it's difficult to tell for sure that it\u2019s the same group reemerging now. But after digging into the wave of attacks, FireEye says it is probable that Cozy Bear is behind it.<\/p>\n \u201cIt\u2019s been so long since we\u2019ve seen them that this caught me by surprise,\u201d says Matthew Dunwoody, a principal security researcher at FireEye, who had previously on eight APT 29 remediations as a threat responder. \u201cThis is a group that historically has been very innovative in the way they\u2019ve gone about things. Some other groups try to be very low and slow about how they launch an attack. But sometimes being very noisy and using that as cover for your more discreet activities can work as well, especially if you\u2019re Russia and you\u2019re not as worried necessarily about the repercussions.\u201d<\/p>\n APT 29 has used this boisterous style to go after a number of international targets in recent weeks, including think tanks, media outlets, transportation, pharmaceutical groups, law enforcement agencies, defense contractors, and US military groups. The attackers are focused on many victims, both groups and individual people, that they have targeted in the past, and their phishes in this campaign are tailored to individuals, rather than reaching out randomly to people within an organization.<\/p>\n "This is a group that historically has been very innovative in the way they\u2019ve gone about things."<\/p>\n Matthew Dunwoody, FireEye<\/p>\n The phishing messages are designed to appear to come from the US State Department, though FireEye emphasizes that the there\u2019s no evidence of compromised State Department accounts. The messages contain malicious links that initiate the download of a Windows backdoor\u2014the popular defense tool turned malware called Cobalt Strike that is abused by numerous different hacking groups. Dunwoody says that APT 29 traditionally relies on custom malware, but could be moving to off-the-shelf exploits as part of a larger criminal trend toward using more generic tools that are already available.<\/p>\n \u201cThey definitely prepared this carefully and took their time, and it does seem as though they are hand-picking targets,\u201d Dunwoody says. \u201cA lot of attackers will go after the person they think is most likely to click a link, whereas APT 29 has a history of going after specific individuals to increase the odds of actually getting the data they\u2019re looking for.\u201d<\/p>\n It\u2019s possible that the similarities between the phishing campaign FireEye observed and the past movements of APT 29 are false flags<\/a>, planted to make the activity seem like Russian state-sponsored hacking when it\u2019s really something else. But Dunwoody says FireEye wanted to publish its evidence so other researchers can weigh in on the attribution to APT 29.<\/p>\n Taken together, the two reports suggest that despite recent US efforts to tamp down Russian hacking activity in the wake of the 2016 election\u2014including a detailed indictment<\/a> related to their activities, and telling individual hackers to knock it off<\/a>\u2014have not entirely deterred the GRU.<\/p>\n \u201cWe\u2019re seeing APT 28 continuing to do their phishing,\u201d Dunwoody says. \u201cThat shouldn\u2019t surprise anyone.\u201d<\/p>\n