FireEye APT28

APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.

CHOPSTICK provides access to the Windows Registry, which can be used to gather information.

CORESHELL obfuscates strings using a custom stream cipher.

OLDBAIT obfuscates internal strings and unpacks them at startup.

CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.

CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.

OLDBAIT installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o."

APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.

CORESHELL can communicate over HTTP for C2.

OLDBAIT can use HTTP for C2.

Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.

CORESHELL can communicate over SMTP and POP3 for C2.

APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.

OLDBAIT can use SMTP for C2.

CORESHELL collects hostname and OS version data from the victim and sends the information to its C2 server.

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.

Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.

Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.

CORESHELL downloads another dropper from its C2 server.

CHOPSTICK may modify Registry keys to store RC4 encrypted configuration information.

CORESHELL C2 messages are Base64-encoded.

APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.

CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it.

CHOPSTICK checks for antivirus and forensics software.

OLDBAIT collects credentials from several email clients.

OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.

CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.

APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.

CORESHELL collects the volume serial number from the victim and sends the information to its C2 server.