Russian Hackers Behind DNC Breach Wage Post-US Election Attacks

  /     /     /  
Publicated : 22/11/2024   Category : security


Russian Hackers Behind DNC Breach Wage Post-US Election Attacks


Less than six hours after Donald Trump was named President-Elect of the US, Cozy Bear/APT29/CozyDuke nation-state hackers kicked off waves of spearphishing attacks.



Russias cyber-spying machine was in full force within six hours of the final US Presidential election results with at least five different waves of spear-phishing campaigns targeting users associated with US think-tanks and non-governmental organizations.
Researchers with Volexity posted their findings surrounding a jump in spearphishing activity by the so-called Russian hacking group known as Cozy Bear, APT29, and CozyDuke, best known for its recent breach of the Democratic National Committee (DNC). There were five different spearphishing campaigns spotted by Volexity, including attacks posing as emails forwarded from the Clinton Foundation, and two others posing as eFax URLs or documents.
These e-mails came from a mix of attacker-created Google Gmail accounts and what appears to be compromised e-mail accounts at Harvard’s Faculty of Arts and Sciences (FAS). These e-mails were sent in large quantities to different individuals across many organizations and individuals focusing in national security, defense, international affairs, public policy, and European and Asian studies, said Steven Adair, founder at Volexity, in a post yesterday.
Think-tanks and NGOs have been common targets of the group, also known as The Dukes, since July of 2015.
The Dukes continue to launch well-crafted and clever attack campaigns. They have had tremendous success evading anti-virus and anti-malware solutions at both the desktop and mail gateway levels, Adair wrote.
The group employs anti-VM macros and PowerShell scripts that help them bypass sandboxes that could detect them, for instance. This combined with their use of steganography to hide their backdoor within PNG files that are downloaded remotely and loaded in memory only or via alternate data streams (ADS) is quite novel in its approach, he said. Volexity believes that the Dukes are likely working to gain long-term access into think tanks and NGOs and will continue to launch new attacks for the foreseeable future.
The first spear-phishing attack wave uses a lure of the The Shocking Truth About Election-Rigging in the United States. The email is purportedly an electronic fax from Secure Fax Corp., and contains a link to a ZIP file. That file has a Microsoft .LNK file that houses PowerShell commands, which execute anti-virtual machine checks and install a backdoor onto the victims machine.
The PowerDuke backdoor boasts a pretty extensive list of features that allow the Dukes to examine and control a system. Volexity suspects the feature set that has been built into PowerDuke is an extension of their anti-VM capabilities in the initial dropper files, Adair wrote. Several commands supported by PowerDuke facilitate getting information about the system.
 

Dark Readings all-day virtual event Nov. 15 offers an in-depth look at
myths surrounding data defense
and how to put business on a more effective security path. 
 
In the second attack wave, the hackers uses a Word document with a malicious macro that checks for anti-VM features, and appears to come from
[email protected].
The subject line is Incoming eFax: Elections Outcome Could Be revised [Facts of Elections Fraud].
The most widespread attack was the third one, which uses an email purportedly from Harvards PDF Mobile Service, which doesn’t actually exist. (There appears to be a typo in the message as well, calling it PFD Mobile Service as well). The subject line: Why American Elections Are Flawed. This one uses a ZIP file to mask the malicious executable.
The Clinton Foundation is the lure for the fourth and fifth waves of spearphishing campaigns by the hacking group. The first one uses Clinton Foundation FYI #1 in its subject line, and deploys a Word document with a malicious embedded macro. The macro checks for anti-VM features. The email purportedly comes from the fictitious Harvard PDF Mobile Service.
Then theres the Clinton Foundation FYI #2 email wave from the same Harvard email address, which contains a link to a ZIP file with an LNK file embedded. It contains the signature PowerShell commands that look for anti-VM, and installs a backdoor on the victims machine.
Like Attack Wave #3, this e-mail message also purported to be forwarded from Laura Graham at the Clinton Foundation. The message body contained dozens of e-mail addresses to which the message originally claims to have been sent, with organizations similar to Attack Wave #3, Adair wrote.
Volexitys post includes screenshots
of the emails and code snippets.
Related Content:
US Think Tanks Involved In Russia Research Allegedly Hacked
Russian Cyberspies Leaked Hacks Could Herald New Normal
Obama Issues Federal Government Policy For Cyberattack Response
Cant Touch This: Hammertoss Russian Cyberspies Hide In Plain Sight
 
Save

Last News

▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂
Discovered: 23/12/2024
Category: security

▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂
Discovered: 23/12/2024
Category: security

▸ Nigerian scammers now turning into mediocre malware pushers. ◂
Discovered: 23/12/2024
Category: security


Cyber Security Categories
Google Dorks Database
Exploits Vulnerability
Exploit Shellcodes

CVE List
Tools/Apps
News/Aarticles

Phishing Database
Deepfake Detection
Trends/Statistics & Live Infos



Tags:
Russian Hackers Behind DNC Breach Wage Post-US Election Attacks