SolarWinds Hackers Target Think Tanks With New ‘NativeZone’ Backdoor

Microsoft on Thursday disclosed that the threat actor behind the
SolarWinds supply chain hack^[1] returned to the threat
landscape to target government agencies, think tanks, consultants,
and non-governmental organizations located across 24 countries,
including the U.S.

“This wave of attacks targeted approximately 3,000 email
accounts at more than 150 different organizations,” Tom Burt,
Microsoft’s Corporate Vice President for Customer Security and
Trust, said^[2]. “At least a quarter of
the targeted organizations were involved in international
development, humanitarian, and human rights work.”

Microsoft attributed the intrusions to the Russian threat actor
it tracks as Nobelium, and by the wider cybersecurity community
under the monikers APT29, UNC2452 (FireEye), SolarStorm (Unit 42),
StellarParticle (Crowdstrike), and Dark Halo (Volexity).

The latest wave^[3]
in a series of intrusions is said to have begun in January 2021,
before reaching a new level of escalation on May 25. The attack
leverages a legitimate mass-mailing service called Constant Contact
to conceal its malicious activity and masquerade as USAID, a
U.S.-based development organization, for a wide-scale phishing
campaign that distributes phishing emails to a wide variety of
organizations and industry verticals.

These seemingly authentic emails include a link that, when
clicked, delivers a malicious optical disc image file
(“ICA-declass.iso”) to inject a custom Cobalt Strike Beacon implant
dubbed NativeZone (“Documents.dll”) that comes equipped with
capabilities to maintain persistent access, conduct lateral
movement, exfiltrate data, and install additional malware.

In another variation of the targeted attacks, Nobelium
experimented with profiling the target machine after the email
recipient clicked the link. In the event the underlying operating
system turned out to be iOS, the victim was redirected to a second
remote server to dispatch an exploit for the then zero-day CVE-2021-1879^[4]. Apple addressed the
flaw on March 26, acknowledging that “this issue may have been
actively exploited.”

Cybersecurity firm Volexity, which corroborated^[5]
the findings, said the campaign singled out non-governmental
organizations (NGOs), research institutions, government entities,
and international agencies situated in the U.S. and Europe.

The latest attacks add to evidence of the threat actor’s
recurring pattern of using unique infrastructure^[6]
and tooling for each target, thereby giving the attackers a high
level of stealth and remain undetected for extended periods of
time.

The ever-evolving nature of Nobelium’s tradecraft is also likely
to be a direct response to the highly publicized SolarWinds
incident, suggesting the attackers could further continue to
experiment with their methods to meet their objectives.

“When coupled with the attack on SolarWinds, it’s clear that
part of Nobelium’s playbook is to gain access to trusted technology
providers and infect their customers,” Burt said. “By piggybacking
on software updates and now mass email providers, Nobelium
increases the chances of collateral damage in espionage operations
and undermines trust in the technology ecosystem.”