New Sofacy Attacks Against US Government Agency
Summary: On May 28, 2016, Unit 42 identified a Sofacy (APT28) spear-phishing email sent to a U.S. government entity from an address belonging to another country's Ministry of Foreign Affairs, likely compromised rather than spoofed, carrying an RTF attachment named "Exercise_Noble_Partner_16.rtf" that exploits CVE-2015-1641 to drop btecache.dll and svchost.dll, a Carberp variant of the Sofacy Trojan. The Trojan uses a previously unseen persistence mechanism, adding its DLL path to the registry key Software\Microsoft\Office test\Special\Perf so the payload loads only when a user opens a Microsoft Office application, and it beacons system information to C2 at 191.101.31.6 while also sending decoy traffic to google.com.
What's compelling: The persistence mechanism requires a user to open Word or Excel, which the report notes can defeat automated sandboxes, and the beacon data - running processes and storage device name - lets the actors filter out researchers before deciding to push secondary payloads.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2015-1641
- Related
- CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021