HackingFireEye: Kremlin-backed hackers used Twitter to mask attacks on U.S.

Published 31 July 2015

FireEye the other day released a new Threat Intelligence report which analyzes the functionality and obfuscation tactics of an advanced piece of malware employed by the likely Russian government-backed Advanced Persistent Threat (APT) group APT29. APT29 combines steganography, cloud storage, and social media services to fly under the radar of network defenders.

Kremlin-based hackers alleged to use Twitter feed to penetrate a network // Source: commons.wikimedia.com

FireEye the other day released a new Threat Intelligence report titled HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group: Uncovering a Malware Backdoor that Uses Twitter. The report analyzes the functionality and obfuscation tactics of an advanced piece of malware employed by the likely Russian government-backed Advanced Persistent Threat (APT) group APT29.

FireEye notes that bAPT29, operating in its current form since at least 2014, has demonstrated strong capabilities to adapt to, and obfuscate their activities from, network defense measures — including aggressively monitoring network defenders and forensic investigators and attempting to subvert them. “Their discipline in operational security sets them apart even from other Russian APT groups FireEye tracks,” FieEye says.

“The novel approach APT29 takes to carry out its attacks and maintain their persistence in networks represents a level of difficulty that security professionals could see trickle down into their own network security operations,” said Laura Galante, director, threat intelligence at FireEye. “As we continue to track APT29, we will be able to bring more intelligence to light that will help our customers improve their defenses against advanced attacks.”

APT29’s HAMMERTOSS is composed of multiple malware tactics to achieve its unique obfuscation goals. HAMMERTOSS follows a step-by-step retrieval of commands via common web services that would typically evade initial detection, including:

  • Beaconing each day to a different, algorithmically-matched Twitter handle for links and hashtags with commands;
  • Following social media links to sites like GitHub that host images with commands hidden within them using a practice known as steganography; and
  • Executing commands and extracting data from the victims’ machines before uploading them to cloud storage services.

The full report includes examples of APT29’s attack lifecycle using HAMMERTOSS.

— Read more in HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group: Uncovering a Malware Backdoor that Uses Twitter (FireEye, July 2015)