Russian APT28 Hackers Using COVID-19 as Bait to Deliver Zebrocy Malware

A Russian threat actor known for its malware campaigns has
reappeared in the threat landscape with yet another attack
leveraging COVID-19 as phishing lures, once again indicating how
adversaries are adept at repurposing the current world events to
their advantage.

Linking the operation to a sub-group of APT28 (aka Sofacy,
Sednit, Fancy Bear, or STRONTIUM), cybersecurity firm Intezer said
the pandemic-themed phishing emails were employed to deliver the Go
version of Zebrocy^[1]
(or Zekapab) malware.

The cybersecurity firm told The Hacker News that the campaigns
were observed late last month.

Zebrocy is delivered primarily via phishing attacks that contain
decoy Microsoft Office documents with macros as well as executable
file attachments.

First spotted in the wild in 2015^[2], the operators behind
the malware have been found to overlap with GreyEnergy^[3], a threat group believed
to be the successor of BlackEnergy aka Sandworm^[4], suggesting its role as
a sub-group with links to Sofacy and GreyEnergy.

It operates as a backdoor and downloader capable of collecting
system information, file manipulation, capturing screenshots, and
executing malicious commands that are then exfiltrated to an
attacker-controlled server.

While Zebrocy was originally written in Delphi (called
Delphocy), it has since been implemented in half a dozen languages,
including AutoIT, C++, C#, Go, Python, and VB.NET.

This specific campaign spotted by Intezer uses the Go version of
the malware, first documented by Palo Alto Networks^[5]
in October 2018 and later by Kaspersky^[6]
in early 2019, with the lure delivered as part of a Virtual Hard
Drive (VHD) file that requires victims to use Windows 10 to access
the files.

Once mounted, the VHD file appears as an external drive with two
files, one a PDF document that purports to contain presentation
slides about Sinopharm International Corporation, a China-based
pharmaceutical company whose COVID-19 vaccine^[7]
has been found to be 86% effective against the virus in late-stage
clinical trials.

The second file is an executable that masquerades as a Word
document that, when opened, runs the Zebrocy malware.

Intezer said it also observed a separate attack likely targeting
Kazakhstan with phishing lures impersonating an evacuation letter
from India’s Directorate General of Civil Aviation.

Phishing campaigns delivering Zebrocy have been spotted several
times in the wild in recent months.

In September last year, ESET^[8]
detailed Sofacy’s intrusive activities targeting the Ministries of
Foreign Affairs in Eastern European and Central Asian
countries.

Then earlier this August, QuoIntelligence^[9]
uncovered a separate campaign aimed at a government body in
Azerbaijan under the pretense of sharing NATO training courses to
distribute the Zebrocy Delphi variant.

The Golang version of the Zebrocy backdoor also caught the
attention of the US Cybersecurity and Infrastructure Security
Agency (CISA), which released an advisory^[10] in late October,
cautioning that the malware is “designed to allow a remote operator
to perform various functions on the compromised system.”

To thwart such attacks, CISA recommends exercising caution when
using removable media and opening emails and attachments from
unknown senders, and scanning for suspicious email attachments, and
ensuring the extension of the scanned attachment matches the file
header.