Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/28/2019
02:30 PM
50%
50%

Fancy Bear Dons Plain Clothes to Try to Defeat Machine Learning

An analysis of a sample published by the US government shows Russian espionage group APT28, also known as Fancy Bear, has stripped down its initial infector in an attempt to defeat ML-based defenses.

The APT28 cyber-espionage group, often called "Fancy Bear" and linked to Russia, has stripped much of the malicious functionality from its initial infector, hiding it in a sea of benign code, according to an analysis published today by Cylance, a subsidiary of Blackberry.

The approach shows that the group has developed greater operational sophistication, says Josh Lemos, vice president of research and intelligence at Cylance (and no relation to the author). The authors of the implant appear to be trying to hide in plain site by using well-known libraries, such as OpenSSL, and a widely used compiler, POCO C++, resulting in 99% of the more than 3 megabytes of code being classified as benign, according to Cylance's analysis.

Those steps, taken along with other newly adopted tactics, suggest the group is trying a different approach to dodge evolving defenses, Lemos says.

"It would be odd for them to shift tactics without a reason," he says. "That is what is giving us the belief that this is a response to a lot of players in the industry having shifted to static ML and even the heuristics engines and traditional AV scanners — those are going to have challenges keying in on malicious bits of this code."

Attackers have used a variety of ways to dodge host-based defenses in the past, most often involving encrypting, or "packing," parts of the file to prevent antivirus (AV) scanners from recognizing the malicious parts of the code. In addition, attackers have used domain generation algorithms (DGAs) to download code at a later date from hard-to-predict locations, defeating initial scans that look for malicious code, the report says.

Camouflaging malware as legitimate code is old hat for cybercriminals. Deception is a key part of their toolkits. Attempting to deceive machine-learning (ML) algorithms designed to spot malicious code features is more difficult.

"Machine learning is going to look at the static code and say, 'Almost all of this is good code,'" Lemos says. "That may bias [the algorithm] toward labeling it 'good' in the machine-learning decision."

APT28 has operated since at least 2007, according to an initial 2014 analysis by FireEye. The group has largely not focused on intellectual property theft, as some Chinese APT groups do, but instead steals government secrets, the company says in its report.

"Since at least 2007, APT28 has been targeting privileged information related to governments, militaries and security organizations that would likely benefit the Russian government," the analysis states. "APT28 has systematically evolved its malware since 2007, using flexible and lasting platforms indicative of plans for long-term use and sophisticated coding practices that suggest an interest in complicating reverse engineering efforts."

The US Cyber Command (USCYBERCOM) submitted the sample for the implant in May to the VirusTotal scanning service, which is run by Google. The action is part of an initiative, which started in November 2018, where the agency issues a sample to VirusTotal and then sends a tweet directing analysts to the sample. The initiative essentially notifies the industry of significant threats and results in a great deal of crowdsourced research into the code.

Almost all of the malware submitted to VirusTotal came from Russian-linked operations, according to security experts. The notable exceptions: On July 3, the cybersecurity agency warned that a group — identified as Iranian by security firms — was using an Outlook vulnerability to exploit targets.

Cylance is the latest security firm to take a look at the tools used by the Russian cyber-espionage group, which is blamed for cyberattacks on the nation of Georgia prior to Russia's 2008 invasion, and for compromising computers at the US Democratic National Committee to steal e-mails and other sensitive data prior to the 2016 presidential election

In 2019, for example, security firm ESET published an analysis of the Zebrocy malware, one of the payloads of the APT28/Fancy Bear group, which had more than 30 commands that could be used for network and system reconnaissance. Unlike Cylance, ESET used active telemetry to gain insight into what the malware did once it was on a system.

While the latest techniques could cause problems for detection approaches based on machine-learning and heuristics, active approaches — such as watching for malicious behavior — are less likely to be fooled, Cylance's Lemos says.

"Looking at code in multiple ways — that is very purposeful," he says. "It does take a very blended approach for good defense these days."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The Right to Be Patched: How Sentient Robots Will Change InfoSec Management."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13871
PUBLISHED: 2020-06-06
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
CVE-2020-11696
PUBLISHED: 2020-06-05
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
CVE-2020-11697
PUBLISHED: 2020-06-05
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.