Fancy Bear Dons Plain Clothes to Try to Defeat Machine Learning

The APT28 cyber-espionage group, often called "Fancy Bear" and linked to Russia, has stripped much of the malicious functionality from its initial infector, hiding it in a sea of benign code, according to an analysis published today by Cylance, a subsidiary of Blackberry.

The approach shows that the group has developed greater operational sophistication, says Josh Lemos, vice president of research and intelligence at Cylance (and no relation to the author). The authors of the implant appear to be trying to hide in plain site by using well-known libraries, such as OpenSSL, and a widely used compiler, POCO C++, resulting in 99% of the more than 3 megabytes of code being classified as benign, according to Cylance's analysis.

Those steps, taken along with other newly adopted tactics, suggest the group is trying a different approach to dodge evolving defenses, Lemos says.

"It would be odd for them to shift tactics without a reason," he says. "That is what is giving us the belief that this is a response to a lot of players in the industry having shifted to static ML and even the heuristics engines and traditional AV scanners — those are going to have challenges keying in on malicious bits of this code."

Attackers have used a variety of ways to dodge host-based defenses in the past, most often involving encrypting, or "packing," parts of the file to prevent antivirus (AV) scanners from recognizing the malicious parts of the code. In addition, attackers have used domain generation algorithms (DGAs) to download code at a later date from hard-to-predict locations, defeating initial scans that look for malicious code, the report says.

Camouflaging malware as legitimate code is old hat for cybercriminals. Deception is a key part of their toolkits. Attempting to deceive machine-learning (ML) algorithms designed to spot malicious code features is more difficult.

"Machine learning is going to look at the static code and say, 'Almost all of this is good code,'" Lemos says. "That may bias [the algorithm] toward labeling it 'good' in the machine-learning decision."

APT28 has operated since at least 2007, according to an initial 2014 analysis by FireEye. The group has largely not focused on intellectual property theft, as some Chinese APT groups do, but instead steals government secrets, the company says in its report.

"Since at least 2007, APT28 has been targeting privileged information related to governments, militaries and security organizations that would likely benefit the Russian government," the analysis states. "APT28 has systematically evolved its malware since 2007, using flexible and lasting platforms indicative of plans for long-term use and sophisticated coding practices that suggest an interest in complicating reverse engineering efforts."

The US Cyber Command (USCYBERCOM) submitted the sample for the implant in May to the VirusTotal scanning service, which is run by Google. The action is part of an initiative, which started in November 2018, where the agency issues a sample to VirusTotal and then sends a tweet directing analysts to the sample. The initiative essentially notifies the industry of significant threats and results in a great deal of crowdsourced research into the code.

Almost all of the malware submitted to VirusTotal came from Russian-linked operations, according to security experts. The notable exceptions: On July 3, the cybersecurity agency warned that a group — identified as Iranian by security firms — was using an Outlook vulnerability to exploit targets.

Cylance is the latest security firm to take a look at the tools used by the Russian cyber-espionage group, which is blamed for cyberattacks on the nation of Georgia prior to Russia's 2008 invasion, and for compromising computers at the US Democratic National Committee to steal e-mails and other sensitive data prior to the 2016 presidential election

In 2019, for example, security firm ESET published an analysis of the Zebrocy malware, one of the payloads of the APT28/Fancy Bear group, which had more than 30 commands that could be used for network and system reconnaissance. Unlike Cylance, ESET used active telemetry to gain insight into what the malware did once it was on a system.

While the latest techniques could cause problems for detection approaches based on machine-learning and heuristics, active approaches — such as watching for malicious behavior — are less likely to be fooled, Cylance's Lemos says.

"Looking at code in multiple ways — that is very purposeful," he says. "It does take a very blended approach for good defense these days."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The Right to Be Patched: How Sentient Robots Will Change InfoSec Management."