Fancy Tools From Fancy Bear, Another Proxy Network Takedown, and A Look Ahead

Caitlin's a lot of fun. So other ways you can find us on Twitter and Blue Sky, it's at Deciphersec. I mentioned YouTube and if you want to e-mail us, you can get me a Dennis at Decipher dot SC and Lindsay is Lindsay with an EY at Decipher dot SC Lindsay will be back soon. Her leave is almost over. So she's she's going to be back in the game very soon. So we're looking forward to that. All right, let's dive into the news. So two big stories that we have on the site this week. First one is the re emergence of APT 28, which is one of the more notorious Russian APT groups, also known as Sednit, also known as fancy bear forest Blizzard, all kinds of fun monikers for that group.

Been around a really long time. They are linked to Russia's Gru which is a military intelligence branch and very active group and highly capable, as you might imagine, being connected to Russian intelligence. The group knows what it's doing, but they have been a little bit quiet in recent years. No one's totally sure why, but one of the things that this group is known for is developing its own exploits, its own malware, its own tools, obviously has a a ton of funding and capabilities to draw from in house.

They don't have to outsource this stuff. And some new research from ESET this week found that the advanced development team inside Sednet, which had been pretty quiet as I mentioned, had actually been working at least since about April 2024 with some new tools and had been deploying those against Ukrainian targets in support of their the Russian invasion of Ukraine. And Eset's research, I'll just quote from what they wrote in their analysis, says our account of modern Senate activities begins with Slim Agent, an espionage implant discovered on a Ukrainian governmental machine by CERT UA. That's the CERT Ukrainian CERT in April 2024. Slim Agent is a simple yet efficient spying tool capable of logging keystrokes, capturing screenshots, collecting clipboard data.

You know, typical espionage implant backdoor type thing. But this is a new one that has had not been really seen too much it, but it's got some code overlap, which with other tools that had been deployed way back and you know, like almost 10 years ago. So that's one of the the kind of hallmarks of this group is that their their tools, you know, often have code overlaps and and similarities for obvious reasons. I mean, why develop new tools if you can kind of steal from the ones you've already developed?

But Sidnet also has two new tools in its arsenal. 2 new implants, one called Beard Shell, which is an implant that executes PowerShell commands and it abuses the legitimate cloud storage service ICE Drive for C2, you know that kind of thing. Using, you know, legitimate commercial cloud services for C2 is not new. It's something that AB TS do quite a lot. And so the other tool in the arsenal now is Covenant, which is a modified version of an open source.net post exploitation framework.

And Sednet has reworked this framework and replaced its original architecture with features adapted for long term cyber espionage. Cyber espionage. And this is, you know, this is one of those things where you see an advanced group like this that has these really high end capabilities and can, you know, take legitimate tools and legitimate services and bend them to their own purposes.

Common tactics for AP TS, you know, they're it's expensive to develop your own tools and implants and all of that. Even with, you know, the budget that you would assume this group has, you know, it's more efficient and probably more time effective and cost effective to take something that's already out in the marketplace and modify it and use it for your own purposes. So that's the lowdown on the new research. Again, the story is up on the on the site APT 28. You know, Sednit Fancy Bear is a group that has attracted plenty of attention from researchers and law enforcement. The DOJ indicted more than a dozen alleged members of APT28 back in 2018.

If you go read that indictment, you'll get a good a good look, some insights into the group's activities and some of their targets. This is the group that's believed to be responsible for hacking the DNC all those years ago, which we talked about the ripple effects of that all day long, but we don't want to get into that. So yeah, I would encourage you guys to go read the the story we have on the site as well as Eset's research, which is very well done as usual. Next story I wanted to mention is a crackdown that came down at the end of this week by U.S. law enforcement and Europol, which took down a residential proxy network known as Sox escort. This is the second one of these residential proxy network takedowns that we've seen in the last couple months. There was one at the end of January for a network called IP Idea that, you know, we, we

wrote about at the time and we talked about on the podcast at the time. In this one, it's, it's kind of the, you know, the typical framework of these takedowns that you see. They seized a bunch of domains. the US seized or froze $3.5 million in cryptocurrency, seized 34 domains, 23 servers in seven countries. So it's a pretty international takedown. And the, you know, these residential proxy networks, so they're in a weird Gray area. Like, there are legit residential proxy services that allow you to sort of, you know, hide your location, hide your IP address for, you know, legitimate reasons. Activists, journalists, dissidents, people like that use networks like this because they're at risk. But cyber criminals use these networks for all the reasons you might imagine.

And they've become a big problem in the last, I don't know, 3-4, five years. They've always been around, but they've become a much bigger, bigger problem in recent years. So, you know, cyber criminals love these things. They're they're all over. They're all over the world, obviously, and some of them are very, very big. Black Lotus Labs was one of the cooperating security vendors in this takedown. And their research found that this this particular residential proxy network was kind of powered by the AV Recon malware, which has been around for about 3 years. And more than half of the Sox escort victims were located in the US or the UK.

In this case, you know, although there were victims spread all over the map, these were the two largest, largest, largest victim victim sets geographically. So here's a a good quote from the director of your executive director of Europol from this takedown. It says cybercrime thrives on anonymity. Proxy services like Sox Escort provide criminals with the digital cover they need to launch attacks, distribute illegal content, innovate detection. By dismantling this infrastructure, law enforcement has disrupted a service that enabled enabled cybercrime on a global, global scale.

Europol has been doing a lot of this in the last, you know, probably decade, but the last I would say five years. They've really ramped up their takedown efforts and disruption efforts on cybercrime networks, especially going after the payment infrastructure and the cloud infrastructure that these services thrive on. You know, without a way to move money, they can't operate and without, you know, the C2 infrastructure, they can't operate.

So those seem to be the two pillars that they often go after. And it's, it's been effective, You know, like bot Nets. A lot of times these things pop back up under different names or in different ways. But it's always nice to see these disruption efforts target these kind of networks. You know, like I said, there's still others out there. There's plenty more of these out there. If you want some good insight into how exactly they work and what kind of scale they have, go check out the research that Census has done on this.

They've done a ton of good research on this. They have a lot of really good global data on the scale of these things. I'll, I'll try and post some links in the show notes so people can see exactly what they've done. But Census has, you know, some of the best visibility in the world on these, on these kind of networks specifically and the Internet in general. So you can, you can have a good look there. So those are the two big stories I wanted to hit this week.

As I mentioned, I would encourage everybody to go check out the podcasts we have up this week with Caitlin Condon from Bolt Check. We have another Hacker movie podcasts coming out next week. As I mentioned, not sure exactly what day we're going to post that yet. We haven't recorded it yet, so we'll see. But aside from that, we're going to have a preview episode for RSA, which is a week and 1/2 from now. The conference is a week and 1/2 from now.

We'll post that towards the end of next week. Lindsay and I are going to look ahead at the show. Some of the sessions with the major themes are going to be maybe have a little fun with some of the over the top silliness that goes on at RSA in terms of like vendor hype and I the AI theme this year is just like completely out of hand. I knew it would be crazy, but just judging from the volume and the volume of pitches I've gotten for meetings and interviews and the number of those that are connected to AI in one way or another, I would say it's got to be upwards of 95% of the total is 1 AI thing or another.

And I'm going to. I usually try to avoid the show floor, like at all costs. I almost never go down there unless somebody is forcing me to for some reason, but I might just do it for like a 10 or 15 minute spin through to go see what the AI hype cycle is like. I'm sure it's going to be completely absurd. Maybe take some video or pictures of like what exactly is happening down there. It's going to be pretty wild. If you've never actually, if you've never been to RSA, congratulations.

If you have never been on the show floor, major congratulations. It is really one of those things that you just kind of sensory overload doesn't even cut it. It's actually calmed down there. There used to be a lot of, you know, very questionable things happening on the show floor in terms of like ways to attract people to booths. That's gone away in recent years. Now you'll just see like, you know, like C list celebrities standing around or, you know, maybe an F1 car at somebody's booth or you know, somebody from Mythbusters hanging at a booth, which is cool. But you know, it's just a lot of hype and a lot of vaporware and a lot of that kind of thing.

So we'll try and cut through some of that with the RSA preview. And then after after RSA, we'll talk more about what actually happened there after I actually see what what it turned out to be on the ground. So those are all the things we have coming for y'all. Look forward to all of that. And that's it for this week. Have a great weekend. Talk to you next week.