Cozy Bear Emerges from Hibernation to Hack EU Ministries

Following its compromise of the network and servers of the Democratic National Committee (DNC) in 2016, the Russia-linked espionage group Cozy Bear, also known as APT29 and the Dukes, has focused on staying off the radar of intelligence services and security companies.

Yet the group has remained active, using covert communications — such as hiding information and commands in images, a technique known as steganography — to remain largely undetected. According to a report published today by security firm ESET, the group has compromised three European ministries of foreign affairs and the Washington, DC, embassy of an EU member. The report suggests that even after Cozy Bear was in the spotlight following the DNC breach, it recovered and rebuilt most of its tools and operations.

"Even if the group has managed to avoid public scrutiny for several years, they actually were very active compromising high-value targets and developing new tools," says Matthieu Faou, a malware researcher with ESET. "They have been operational for around 10 years, starting around 2008 [or] 2009. Since then, they have been active almost all the time."

As the United States starts another election cycle, this one promising to be even more chaotic than the last, signs of cyberattacks have garnered increasing attention. Cozy Bear has typically targeted Western countries or nations that had been part of the former USSR.

"Besides governments, the group also has targeted various organizations linked to NATO, think tanks, and political parties," ESET stated in the report. "This targeting suggests a clear interest in collecting information allowing a better understanding of future international political decisions, which would seem of most interest to a government."

The ESET report is not the only research to attribute attacks to the group. In 2018, security and incident-response firm FireEye linked phishing attacks purporting to be from the US Department of State to APT29 — its monicker for the Cozy Bear group. The attacks attempted to compromise systems in the government, defense, pharmaceutical, and transportation sectors, the company said at the time.

The connection to Cozy Bear, however, was circumstantial. The attackers used some tools and techniques that were hallmarks of the Cozy Bear group but could have been co-opted by another attacker as part of a "false flag" operation. In the current investigation, the group tracked by ESET used a spear-phishing campaign to kick off the attacks — a technique linked to Cozy Bear.

This time around, Cozy Bear — which ESET refers to as The Dukes — has used a variety of covert and public channels for communication in an attempt to escape detection. 

The group has used Twitter, Imgur, and Reddit as a primary way to issue commands to systems immediately after compromise. Cozy Bear generates new Twitter handles using an algorithm generator, from which compromised machines will fetch encrypted URLs.

The group also has used public cloud services, such as OneDrive, to hide communications in legitimate services. Often, the group hides data inside of images, which is very hard to detect, says ESET's Faou.

"[Steganography] is quite complex to implement, so it is not that common," he says. "It's hard to detect because even after the image is altered to contain commands or payloads, it is still valid. So by looking at the network traffic only, it is hard to detect that something suspicious is ongoing."

In addition, the group is using three new malware families in its current operations, dubbed by ESET as PolyglotDuke, RegDuke, and FatDuke. ESET also discovered a fourth malware sample, LiteDuke, used in older campaigns that had not previously been described.

PolyglotDuke uses Twitter and other websites to fetch the address of the command-and-control server. RegDuke establishes persistance by hiding in the registry and using Dropbox to reconstitute a connection back to an attacker-controlled server. FatDuke is a client that is installed after the MiniDuke backdoor, offers a great deal of functionality, and uses obfuscation to make its code difficult to decipher.

The previously known MiniDuke is a backdoor that gets installed after the initial infection and allows the attacker to issue commands to the infected system. In the past, LiteDuke was used to further compromise systems after MiniDuke, but it is seems to be outdated, ESET stated.  

The group also widely uses credentials to move throughout a network, compromising additional systems and reinfecting systems while a company is still responding to an incident.

"When responding to a Dukes compromise, it is important to make sure to remove every implant in a short period of time," ESET stated in the report. "Otherwise, the attackers will use any remaining implant to compromise the cleaned systems again."

While ESET based its attribution on an accumulation of evidence, the company also stressed that it comes with a caveat and that the company does not link attacks to specific actors.

"We cannot discount the possibility of a false flag operation," the company stated in the report. "However, this campaign started while only a small portion of the Dukes' arsenal was known. In 2013, at the first known compilation date of PolyglotDuke, only MiniDuke had been documented and threat analysts were not yet aware of the importance of this threat actor."

Related Content

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Build a Rock-Solid Cybersecurity Culture."