Cold lures, hot targets.

Dave Bittner: Hello, everyone, and welcome to the CyberWire's "Research Saturday." I'm Dave Bittner, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems, and protecting ourselves in a rapidly evolving cyberspace. Thanks for joining us. [ Music ]

Ondrej Kubovic: What we can say, their goals are aligned with Belarus. They're active since at least 2016, and their primary targets in the area they are focusing on geographically is typically around Belarus, which is also playing into that alignment that I have been mentioning before. They are targeting Poland, Lithuania, and Ukraine the most, but we have seen also other countries in Europe.

Dave Bittner: That's Ondrej Kubovic, Security Awareness Specialist from ESET. The research we're discussing today is titled, "FrostyNeighbor: Fresh Mischief and Digital Shenanigans." [ Music ] What does it seem like they're after here? Are they financially motivated or is it an espionage motivation?

Ondrej Kubovic: It's definitely espionage motivation, and they are looking at different sectors based on the country that they are targeting because in Ukraine, we see they are mostly after military, defense, governmental stuff, and in Poland and Lithuania and some of the other European countries, it was also some maybe more opportunistic stuff, such as manufacturing, healthcare, pharma, even logistics. Of course, governmental is always in the mix if there is the opportunity, but also other sectors that were not seen in Ukraine.

Dave Bittner: Well, let's walk through the attack chain together here. How would someone find themselves targeted here, and then what would happen next?

Ondrej Kubovic: The first main condition in this campaign that we documented was that you are from Ukraine because the whole chain doesn't work if you are -- they are doing this check. You receive a spear phishing email that has a PDF attached. You open it, and instead of showing you the PDF, it's some blurry version of it, and you need to click on something so that you get the full visible, readable version. Now, before that happens, when you click, the thing is there is a geographical check. If your IP is Ukrainian or any type of selected region, because maybe they are interested in specific regions in Ukraine, it will not give you the content. It will show you the same decoy PDF as you would see when you are targeted, but the malicious stuff in the background is not happening. That's the main thing that they are doing in the beginning. So that's the first check, but if it's correct, if your IP is from Ukraine, it downloads a RAR file, so an archive, that will drop a JavaScript. That JavaScript is basically the first or maybe let's say second stage of attack, and that's PicassoLoader, which is actually something that we know to be a tooling of this group. This is something that they have been developing and working on for years now.

Dave Bittner: Well, PicassoLoader has an interesting history here. What can you tell us about that?

Ondrej Kubovic: We have seen it, actually, on several campaigns. It has been first documented by the Ukrainian CERT, and they have given it this name because PicassoLoader, as the name suggests, has some connection with pictures. It's actually -- it looks like it's downloading a renderable image. Now, I was actually very curious about this and was asking this with the researchers, and what I've been told, it's not a specific topic of these pictures. Don't imagine something that is going to be very catchy for the eye. It's random. We have seen games. We have seen drawings. We have seen different topics of these pictures, and it wasn't AI generated, which is also something maybe interesting today that we see. Yeah, I mean, the fact is that they are using this PicassoLoader to get to the final stage -- to the final payload, and that final payload is Cobalt Strike, which is a known tooling for red teamers.

Dave Bittner: Now, FrostyNeighbor, they have this reputation for keeping their tooling up to date for updates along the way. What's the importance of that for a threat actor who's out there trying to do long-term espionage?

Ondrej Kubovic: The main thing is if your tooling is documented and well documented, the problem is that it gets detected. You need to work on your evasion techniques. You need to figure out how to sidestep the detection. Of course, that's what's behind the update cycle that you need to run. Of course, you're also trying to avoid being spotted during the operation because cyber espionage is stealthy by design. That's what they are trying to achieve by changing their tooling as much as possible. We have seen this, of course, with any sophisticated actor that they are trying to figure out ways how to stay under the radar. As I say, the updates are one of the ways how to do it.

Dave Bittner: They seem to be pretty careful about validating their victims before they deliver that final payload. Tell us about this group's operational discipline.

Ondrej Kubovic: There are two -- except for the check for the geography, there are also two other things that they are doing during the attack chain. The first one is that the victim's computer is fingerprinted every 10 minutes. I mean, it's getting a lot of information on the victim, including username, computer name, even the current time, so that they know where the victim actually is located. Of course, stuff like process IDs, so that they can see what's running on the machine, and that information is then reported to the command-and-control server. Only victims that are probably manually decided by the operators actually get the final payload of Cobalt Strike. They are actually running, let's say, a level of automated checks, and then the final decision sits probably with the operator. [ Music ]

Dave Bittner: We'll be right back. [ Music ] Now, from the victim's perspective, what does an attack look like?

Ondrej Kubovic: As I said, you receive a spear phishing email that has the PDF attached. The PDF shows you the decoy and drops the second stage and third stage of the attack. In the end, when you're infected by Cobalt Strike, what happens is that they get effectively access to your device and basically full control, because that's what the red teaming tools are allowing you to. That's what they are trying to achieve. For you, most of that chain is, of course, invisible, because, again, espionage needs to be as stealthy as possible. In the end, when you're infected, the information is being pilfered out of your machine and sent to the CNC of the attackers. For you, you saw the documents, so that's basically where it ends for you.

Dave Bittner: Were there any technical details in this campaign that you and your colleagues found particularly interesting or maybe even surprising?

Ondrej Kubovic: I mean, even the fact that there has been an update cycle to this whole thing is interesting, because we see that they are continuously active, developing their tooling, trying to evade detection, implementing these checks. That's also something that can be of interest, and they were also trying to achieve persistence. They're modifying registries to run the malware at every startup and trying to use Viber as cover, the desktop version of the communication app as cover. I would say some of those things might be interesting. It depends on -- the beauty is in the eye of the beholder, so there are several things that could catch your attention.

Dave Bittner: Yeah, what does this campaign say about the current state of things in Eastern Europe? Is this the type of thing, the typical type of thing, that researchers see in that part of the world?

Ondrej Kubovic: I would say to a level, yes, because we have seen similar techniques that they have been using in the past campaigns, but even in this one also being used by Russia-aligned actors. I'm not saying the same one. For example, we have seen a very similar tactic being used but exploiting a specific CVE. It was trying to abuse Roundcube, which is a quite popular webmail application, and what they were trying to achieve was to attack the victim during the email opening phase. When you open the email, they are trying to harvest your credentials and use that to spy on you and get information from your emails. We have seen similar campaign or similar approach by other actors in the region, but they were using a different CVE, which again probably shows that these guys are technically very capable and showing that they know how to run similar campaigns.

Dave Bittner: Yeah, I mean, it strikes me that this seems to be a fairly sophisticated group. Is that a fair assessment?

Ondrej Kubovic: Yes. Yes, that's a fair assessment because we have seen different approaches deployed in their attacks. For example, we can say that the main downloader, the PicassoLoader has multiple variants, so they are quite capable with different languages,.NET, PowerShell, JavaScript. This case was JavaScript, the recent one, C++. They are capable of rewriting and updating the tooling in different languages. They are also capable of abusing known vulnerabilities and finding ways how to abuse them for their own campaigns. Again, they seem to be also quite fluid in what's being used, what makes them invisible in the targeted environment. For example, they are trying to also blend in with the web traffic that we typically see. Some web-associated file types they are abusing, because your computer is typically processing a lot of those during the day. This blends in with the traffic and it's quite complicated for you to detect. So, yes, they seem to be quite technically skilled.

Dave Bittner: Swinging back around, you mentioned that the final payload is Cobalt Strike. For folks who may not be familiar with that, how do you describe that?

Ondrej Kubovic: It's a legitimate security tool, which is typically used by pen testers and professionals in cybersecurity to test how good your defenses are and if there is anything vulnerable in your environment. Using that tool gives you all the, like, touch. You can try to touch different parts of your system and figure out what's wrong. Of course, if this falls in the wrong hands, or if that type of tool can be dropped on a system, it gives you quite a powerful framework or tool in your hands, which you can use for remote access and some serious intrusion.

Dave Bittner: What are your recommendations for the defenders in our audience to protect themselves against this sort of thing?

Ondrej Kubovic: I'll start at the basics. As I mentioned, there were some CVEs and stuff that's being abused. So, of course, patching your systems is something that will always go a long way. In this case, you would have to be capable of actually seeing that communication with the server, but based on threat intelligence, you can actually detect for that and block dropping of those second and third stages of this attack. Of course, Cobalt Strike when it's active, it has some communication that's going to the servers of the attacker. So, again, something that can be detected is the network communication. All of this can be quite helpful for a skilled defender to block and detect. [ Music ]

Dave Bittner: Our thanks to Ondrej Kubovic from ESET for joining us. The research is titled, "FrostyNeighbor: Fresh Mischief and Digital Shenanigans." We'll have a link in the show notes. That's "Research Saturday." We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com. This episode is produced by Liz Stokes. We're mixed by Elliott Peltzman and Tré Hester. Our Executive Producer is Jennifer Eiben. Peter Kilpe is our Publisher. I'm Dave Bittner. Thanks for listening. We'll see you back here next time. [ Music ]