Cybersecurity Advisory GRU Brute Force Campaign July 2021

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.

APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.

APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.

APT28 has mapped network drives using Net and administrator credentials.

APT28 has split archived exfiltration files into chunks smaller than 1MB.

APT28 has renamed the WinRAR utility to avoid detection.

APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.

APT28 has collected files from network shared drives.

APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.

APT28 downloads and executes PowerShell scripts and performs PowerShell commands.

Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.

APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.

APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.

APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.

APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.

APT28 has used a Powershell cmdlet to grant the ApplicationImpersonation role to a compromised account.

APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.

APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.

APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.

APT28 has collected emails from victim Microsoft Exchange servers.

APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.

APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.

APT28 has collected files from various information repositories.

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.

APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.

APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.