Prolific Cyberespionage Group Sofacy Shifts Focus To The Far East, Warns Kaspersky Lab

Sofacy shifts focus to include Far East defense and diplomacy, overlaps with advanced cyberespionage groups

Kaspersky Lab researchers have observed that the Russian-speaking threat actor Sofacy, also known as APT28 or Fancy Bear is shifting its targeting to the Far East, with a strong interest in military, defence and diplomatic organisations – in addition to its traditional NATO-related targets. The researchers discovered that Sofacy sometimes overlaps with other threat actors when targeting victims, including with the Russian-speaking Turla and the Chinese-speaking Danti, Most intriguingly of all, they found Sofacy backdoors on a server previously compromised by the English-language threat actor behind the Lamberts. The server belongs to a military and aerospace conglomerate in China.

Sofacy is a highly active and prolific cyberespionage group that Kaspersky Lab’s researchers have been tracking for many years. In February, Kaspersky Lab published an overview of Sofacy’s activities in 2017, revealing a gradual move away from NATO-related targets towards the Middle East, Central Asia, and beyond. Sofacy uses spear-phishing and sometimes water-holing to steal information, including account credentials, sensitive communications and documents. It is also suspected of delivering destructive payloads to various targets.

The new findings show that Sofacy is not the only predator stalking these regions, and that this sometimes results in a target overlap between very different threat actors. In the case of Sofacy, researchers found scenarios where its Zebrocy malware competed for victim access with Russian-speaking Mosquito Turla clusters; and where its SPLM backdoor competed with traditional Turla and Chinese-speaking Danti attacks. The shared targets included government administration, technology, science and military-related organisations in or from Central Asia.

In some cases, targets appeared to be subjected simultaneously to separate attacks from both SPLM and Zebrocy. However, the most intriguing overlap is probably that between Sofacy and the English-speaking threat actor behind the Lamberts. The connection was discovered after researchers detected the presence of Sofacy on a server that threat intelligence had previously identified as compromised by Grey Lambert malware.  The server belongs to a Chinese conglomerate that designs and manufactures aerospace and air defense technologies.

However, in this example the original SPLM delivery vector for Sofacy remains unknown. That raises a number of hypothetical possibilities, including the fact that Sofacy could be using a new and as yet undetected exploit or a new strain of its backdoor; or that Sofacy had somehow managed to harness Grey Lambert’s communication channels to download its malware. It could even mean that the Sofacy indicators could be a false flag, planted by the previous Lambert presence. Researchers believe the most likely answer is that an unknown new PowerShell script or legitimate but vulnerable web app was exploited to load and execute the SPLM code in this instance. Research is ongoing.

“Sofacy is sometimes portrayed as wild and reckless, but as seen under our visibility, the group can be pragmatic, measured, and agile. Their activity in the East has been largely under-reported, but they are clearly not the only threat actor interested in this region, or even in the same targets.  As the threat landscape grows ever more crowded and complex, we may encounter more examples of target overlap – and it could explain why many threat actors check victim systems for the presence of other intruders before fully launching their attacks,” said Kurt Baumgartner, Principal Security Researcher, Kaspersky Lab.

Researchers also found that Sofacy now maintains distinct subdivisions for each of its main tools, with clusters for the coding, development and targeting of SPLM (also known as CHOPSTICK and Xagent), GAMEFISH, and Zebrocy.  SPLM is considered to be Sofacy’s primary and most selective second stage tool, while Zebrocy is used for high volume attacks. According to researchers, in early 2018 Sofacy targeted large air-defense related commercial organisations in China with SPLM, while deploying Zebrocy more widely across Armenia, Turkey, Kazahkstan, Tajikistan, Afghanistan, Mongolia, China, and Japan.

All Kaspersky Lab products successfully detect and block all known Sofacy attacks, and some more challenging disinfections may require a reboot.

For organisations with military, defense and foreign affairs-related operations in the regions affected, Kaspersky Lab recommends implementing the following measures to avoid falling victim to an advanced targeted attack:

• Use a proven corporate grade security solution in combination with anti-targeted attack technologies and threat intelligence, like Kaspersky Threat Management and Defense These are capable of spotting and catching advanced targeted attacks by analysing network anomalies and give cybersecurity teams full visibility over the network and response automation;

• Provide security staff with access to the latest threat intelligence data, which will arm them with helpful tools for targeted attack research and prevention, such as indicators of compromise (IOC), YARA and customised advanced threat reporting;

• If you spot early indicators of a targeted attack, consider managed protection services that will allow you to proactively detect advanced threats, reduce dwell time and arrange timely incident response.