When Fancy Bear isn’t so Fancy: APT group’s ‘crude’ methods continue to work

Why waste a prized hacking tool when email will do just fine?

While the cybersecurity industry marvels at the sophistication of the suspected Russian hackers who breached contractor SolarWinds and multiple federal agencies, another set of alleged Russian operatives continues to succeed with far less advanced techniques in their espionage campaigns.

Fancy Bear, the hacking group linked with Russia’s GRU military intelligence agency, is showing a penchant for using blunt digital instruments to break into computers and try to steal data, according to analysts. It’s an example of how so-called advanced persistent threats don’t actually need advanced tools to accomplish their goals. Instead, they often rely on defensive weaknesses that plague the internet.

“It looks like this is all part of a strategy: commit crude and aggressive attacks on infrastructure worldwide,” said Feike Hacquebord, a researcher a security firm Trend Micro.

The hacking campaign involving tampered SolarWinds software, which the Washington Post has linked to another Russian intelligence service, the SVR, used such stealth that it went on for at least nine months before it was discovered. By contrast, the Fancy Bear operatives seem to have opted for efficiency over anonymity.

The most notable recent example of Fancy Bear’s simplicity came when it allegedly compromised the email accounts of Norwegian lawmakers by “brute forcing” them with password guesses. But Trend Micro on Thursday published research showing how this fondness for unsophisticated methods is more than a one-off for Fancy Bear, which is also known as APT28 and Pawn Storm.

Fancy Bear has in recent months been using a remote hacking tool, spread through Google Drive and the popular IMAP protocol, to target military organizations and embassies in various locations, according to Trend Micro. The so-called remote access trojan (RAT) was at first “so simple” that it didn’t account for international keyboards, making it difficult for the attackers to sort out what was on victims’ computer, the researchers said in a blog.

“This mistake was corrected swiftly, but it shows the relative inexperience of this particular Pawn Storm operator,” Hacquebord and his colleague Lord Alfred Remorin wrote. The group certainly has access to the so-called zero-day exploits that spies covet, but there’s little use in burning such prized tools if simpler tactics are effective.  

Fancy Bear is perhaps best known for infiltrating the Democratic National Committee in 2016 in an effort to interfere in the U.S. election. That history of disruption makes it important for network defenders to sort the group’s tactics from others less capable of damage, analysts say.

“It looks like they are more focused on the end result (compromise a system or steal data) than hiding their tracks,” Hacquebord said of Fancy Bear.

Ironically, the use of a run-of-the-mill RAT may have had a disarming effect on victims who might think they’re the target of simple crooks rather than a powerful intelligence agency.

“When a defender finds a simple RAT in his network he would probably just clean the machine and not be alarmed,” Hacquebord said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure