APT28-linked trojan being developed in multiple programming languages, research shows

Zebrocy is increasingly seen as a go-to tool for APT28, and it's being written in several coding languages.

An elite Russia-linked hacking group is creating multiple versions of one of its go-to malicious tools in an apparent attempt to make its activity harder to detect, according to research published Tuesday by Palo Alto Networks.

The company’s Unit42 threat intelligence team says that the hacker group Sofacy, also known as APT28, Fancy Bear and many other names, has been spotted using a version of the Zebrocy trojan written in the “Go” programming language in multiple phishing campaigns. The findings add to a list of Zebrocy variants written in different types of code.

Researchers and Western governments have largely attributed APT28 to Russian intelligence services.

“The use of a different programming language to create a functionally similar Trojan is not new to this group, as past Zebrocy variants have been developed in AutoIt, Delphi, VB.NET, C# and Visual C++,” the researchers wrote. “While we cannot be certain the impetus for this, we believe the threat group uses multiple languages to create their Trojans to make them differ structurally and visually to make detection more difficult.”

Zebrocy is piece of malware that creates a backdoor on a victim’s computer that can then be used to deploy further capabilities, usually for espionage. Researchers with a number of cybersecurity  companies have noted APT28’s increased use of Zebrocy as of late.

Unit 42 researchers said that the newly discovered Go version of Zebrocy was detected in two different APT28-linked campaigns. In one of them, a Russian language email sent on Oct. 11 purports to be about the “effects of U.S. sanctions on the Russian economy.” The email attempts to deliver a malicious attachment that would ultimately deploy Zebrocy. However, the infection was not successful in this case because of a coding error on the part of the attackers, the researchers said.

Researchers said the attackers also used the Go version of Zebrocy in a previously observed campaign targeting government entities in North America, Europe and a former Soviet state. The campaign involved the use of Microsoft Word documents that are based on current events and prompt the victim to enable macros, resulting in a Zebrocy infection. Palo Alto Networks said that in this particular case, a shortened link that was found in the document was accessed from Turkey 75 times as of Dec. 5.

“Regardless of the attack’s effectiveness, the techniques and indicators we observed still provide analytical points for correlation and should be included in an organization’s security defenses as the group may use the payload and infrastructure in future attacks,” the report says.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems