Pawn Storm Group Uses the New York Attack in its Latest Cyberespionage Campaign

Pawn Storm (a.k.a. Fancy Bear, APT28, Sofacy, and STRONTIUM) made headlines again after security researchers shed light on its latest cyberespionage campaign. The group’s latest spear phishing campaign involves the use of a malware-ridden Word document that uses the recent incident in New York last October 31 as a social engineering hook.

The report noted the abuse of Microsoft Office’s Dynamic Data Exchange (DDE) to invoke the command prompt to run PowerShell commands that retrieve and help execute a payload that profiles the affected machine. If it’s a target of interest, it is further infected with a backdoor (X-Agent or Sedreco).

[TrendLabs Security Intelligence Blog: REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography]

DDE provides a way for data to be shared between various applications. When abused, it can allow attackers to implant instructions such as launching the command prompt, or running malicious code, regardless if macros are enabled or not. While not a novel technique, the misuse of DDE is gathering steam not only among cyberespionage groups, but even with financially motivated cybercrooks. Even Locky ransomware and its long-time partner in crime the Necurs botnet were recently seen employing the same technique.

[READ: Cyberespionage group Turla mounted a campaign ahead of the G20 Task Force Summit]

But more than the traction that DDE’s misuse is gaining is also the recent spate of cyberespionage- and cyberpropaganda-related operations. The Council on Foreign Relations (CFR), for instance, has so far cited 26 separate campaigns this year. And indeed, the past weeks alone saw a bevy of hacking groups looking to capitalize on various activities in the socio-political landscape. Some of them include:

• Keyboy, which also abuses DDE to distribute its information-stealing payloads
• Sowbug, which targeted diplomatic corps and foreign policy institutions in South America and Southeast Asia
• OceanLotus/APT32, which was seen mounting campaigns ahead of high-profile summit meetings of the Association of Southeast Asian Nations (ASEAN)
• ChessMaster, which was seen with new tools and tactics for further anonymizing their activities
• BlackOasis, which employed a zero-day vulnerability in Adobe Flash to distribute its spyware, targeting Middle Eastern politicians and United Nations officers

[Security 101: Security 101: The rise of threats that abuse PowerShell, and what can be done to mitigate them]

For organizations, these incidents highlight the importance of securing their perimeter—from gateways, networks, and servers to endpoints—as no platform is immune to these attacks. Here are some defense-in-depth measures that can help significantly reduce the enterprise’s attack surface:

• Mind your security gaps: keep the system, its applications, and the networks updated, or consider virtual patching for legacy systems, and accordingly create stronger patch management policies
• Enforce the principle of least privilege: implement URL categorization, network segmentation, and data categorization
• Proactively monitor your infrastructure: deploy firewalls as well as intrusion detection and prevention systems
• Regularly back up data and ensure its integrity
• Restrict or securely use the tools (i.e., PowerShell) used by your organization’s system administrators to deter their misuse