THREAT WHACKERS at Palo Alto Networks have reported that a hacking outfit called the Sofacy group has wreaked havoc on the US Ministry of Foreign Affairs following a phishing attack.
Palo Alto said in a blog post that the Sofacy group, which is also known as APT28, is well known for cyber espionage campaigns. We knew that already as we reported on the Russian group when FireEye flagged it as being this kind of threat.
FireEye said last year that the group’s goal is to find information about government, military and security organisations that is “likely to benefit the Russian government”.
The latest news about Sofacy has a twist to it, according to Palo Alto. “The Sofacy group is a well known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing email from the group that targeted the US government,” the firm said.
“The email carried the Carberp variant of the Sofacy trojan. The developer implemented a clever persistence mechanism in the trojan which had not been observed in previous attacks.”
Falling for spear phishing is not great, so for a government worker to get suckered in is a shame. But these things happen, and the email was reportedly compelling and convincing.
“On May 28, 2016, attackers sent a spear phishing email to a US government entity using an email address belonging to the Ministry of Foreign Affairs of another country,” said Palo Alto.
“Analysis of the attack revealed a high likelihood that the sender’s email address was not spoofed and is instead a result of a compromised host or account belonging to that ministry.
“The targeted email had a subject … which is a reference to a joint NATO training effort between the US and Georgia. The email contained an RTF file as an attachment. The RTF file is a weaponised document that attempts to exploit CVE-2015-1641 to drop two files onto the system, btecache.dll and svchost.dll.”
Neither of these would be welcome on a secure system. The INQUIRER recommends that if you work for a government agency, and this is particularly pertinent for foreign ministries, you should treat emails about NATO training with all necessary precautions.
Mark James, a security specialist at ESET, confirmed this stance, explaining that spear phishing only ever works when someone falls for it and that companies should be ready to beat such things off.
“Make sure your users and staff are very aware of the dangers of opening attachments and or clicking links in emails; it’s the very basics of securing your network. Policies and rules will help to keep the danger to a minimum, but ultimately the user is the biggest threat,” he said.
“Good regular updating of internet security software, along with fully patched operating systems and applications, will help to keep you safe. Putting off upgrading operating systems may not actually save you money. One mistake, and the few thousand pounds you may have saved may cost you hundreds of thousands or, even more importantly, your good name.” µ
<!–