Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Sofacy Group’s Parallel Attacks

Summary: Unit 42 reports that the Sofacy group ran parallel campaigns in 2018 using the Zebrocy tool, delivered mainly through phishing emails with macro-laden Office documents and executable attachments, targeting government and foreign-affairs organizations in North America, Europe, and a large Central Asian nation. Unlike Sofacy's usual focus-fire approach of a handful of victims per organization, the Zebrocy attacks emailed an exponentially larger number of individuals whose addresses were found through web search engines, and the group also used DDE to deliver Zebrocy and the open-source Koadic penetration testing toolkit.

Bottom line: Sofacy widened from a handful of carefully chosen victims per organization to mass phishing against easily found addresses, so a single employee opening a document is now the exposure path - and the group's use of the free, publicly available Koadic toolkit means the payload costs the attacker nothing to obtain.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related