Experts Uncover Several C&C Servers Linked to WellMess Malware

Cybersecurity researchers on Friday unmasked new
command-and-control (C2) infrastructure belonging to the Russian
threat actor tracked as APT29, aka Cozy Bear, that has been spotted
actively serving WellMess malware as part of an ongoing attack
campaign.

More than 30 C2 servers operated by the Russian foreign
intelligence have been uncovered, Microsoft-owned cybersecurity
subsidiary RiskIQ said^[1]
in a report shared with The Hacker News.

APT29, the moniker assigned to government operatives working for
Russia’s Foreign Intelligence Service (SVR), is believed to have
been the mastermind behind the massive SolarWinds
supply chain attack^[2]
that came to light late last year, with the U.K. and U.S.
governments formally pinning the intrusions on Russia earlier this
April.

The activity is being tracked by the cybersecurity community
under various codenames, including UNC2452 (FireEye), Nobelium
(Microsoft), SolarStorm (Unit 42), StellarParticle (Crowdstrike),
Dark Halo (Volexity), and Iron Ritual (Secureworks), citing
differences in the tactics, techniques, and procedures (TTPs)
employed by the adversary with that of known attacker profiles,
counting APT29.

First identified by Japan’s JPCERT/CC^[3]
in 2018, WellMess (aka WellMail) has been previously deployed in
espionage campaigns^[4]
undertaken by the threat actor to plunder intellectual property
from multiple organizations involved in COVID-19 research and
vaccine development in the U.K., U.S., and Canada.

“The group uses a variety of tools and techniques to
predominantly target governmental, diplomatic, think-tank,
healthcare and energy targets for intelligence gain,” the U.K.’s
National Cyber Security Centre (NCSC) noted^[5]
in an advisory published in July 2020.

RiskIQ said it began its investigation into APT29’s attack
infrastructure following a public disclosure^[6]
about a new WellMess C2 server on June 11, leading to the discovery
of a cluster of no fewer than 30 active C2 servers. One of the
servers is believed to have been active as early as October 9,
2020, although it’s not clear how these servers are being used or
who the targets are.

This is not the first time RiskIQ has identified the
command-and-control footprint associated with the SolarWinds
hackers. In April, it unearthed an additional set of 18 servers^[7] with high confidence
that likely communicated with the targeted, secondary Cobalt Strike
payloads delivered via the TEARDROP and RAINDROP malware deployed
in the attacks.

“RiskIQ’s Team Atlas assesses with high confidence that these IP
addresses and certificates are in active use by APT29,” said Kevin
Livelli, RiskIQ’s director of threat intelligence. “We were unable
to locate any malware which communicated with this infrastructure,
but we suspect it is likely similar to previously identified
samples.”