Visiting The Bear Den - A Journey in the Land of (Cyber-)Espionage

No ratings

Presented at BsidesOttawa 2016 by

Jessy Campos

Sednit, a.k.a Fancy Bear/APT28/Sofacy, is a group of attackers operating since at least 2004 and whose main objective is to steal confidential information from specific targets. Over the past two years, this group's activity increased significantly, in particular with numerous attacks against foreign affairs ministries and embassies all over the world. Among their most notable recent targets were the Democratic National Committee, the German parliament, and the French media network TV5 Monde. This talk presents the results of a two-year hunt after Sednit, during which we dug up and analyzed many of their software. In particular, we will delve into technical details of their most impressive components: - DOWNDELPH, a mysterious downloader deployed in rare cases and with advanced persistence methods. - XTUNNEL, a network proxy tool able to transform an infected machine into a pivot to contact computers normally unreachable from theInternet. - XAGENT, the flagship Sednit backdoor, for which Windows, Linux and iOS versions have been developed. - SEDKIT, a full-fledged exploit-kit, which depending on the target's configuration may drop 0-day exploits or revamped exploits. During our tracking, we also gained a great visibility on Sednit post-infection modus operandi, a world full of Mimikatz and various custom hacking tools.