Sarah Chen — Malware Reverse Engineer
Key Takeaways
- APT29 has refined its intrusion techniques to focus on leveraging legitimate software for delivery and persistence
- The use of the EVA-01 implant highlights a shift towards more modular malware for stealthy long-term access
- Our analysis revealed sophisticated lateral movement strategies that utilize T1071.001 (Application Layer Protocol) for C2 communication
Executive Summary
In our recent investigation into an ongoing campaign attributed to APT29, we uncovered a sophisticated intrusion technique that involves the use of the EVA-01 malware. The actor executed their attack chain by leveraging trusted applications and exploiting various vulnerabilities in target environments. Our detailed analysis reveals how APT29 modifies its approach for stealth and persistence while achieving their mission objectives.
Initial Access
APT29’s initial foothold typically begins with spear-phishing campaigns that employ familiar tactics. During the investigation, we observed a phishing email containing a malicious document. This document exploited the CVE-2021-40444 vulnerability in Microsoft Office. Upon opening the document, macros triggered the download of the dropper component, which we identified as an initial payload aimed at fetching the EVA-01 implant.
Execution & Persistence
After initial execution, the dropper dropped EVA-01 into the system’s temporary directory at %TEMP%\eva01.dll and executed it via a DllHost.exe method, exploiting Windows’ legitimate processes to avoid detection. Our analysis revealed the implant employs various persistence mechanisms, including the modification of the registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\Current\Run, ensuring its execution on every system startup.
Command and Control
The communication pattern of EVA-01 is particularly noteworthy. We identified that it utilized HTTPS requests over port 443 to communicate with its command and control server, a method consistent with T1071.001 (Application Layer Protocol). Upon establishing a connection, the implant regularly beaconed back every hour, confirming its presence in the environment and waiting for further commands. The C2 server registered various domain names, with our analysis revealing a strong temporal correlation in their registration dates.
Lateral Movement & Discovery
Following its deployment, EVA-01 initiated lateral movement within the network, exploiting Windows Management Instrumentation (WMI) as its primary vector for propagation, utilizing the technique outlined in T1047. This allowed the malware to execute commands on remote machines once credentials were harvested. Our investigation detailed several processes being initiated through WMI queries, further expanding the actor’s footprint throughout the organization.
Impact & Objectives
The overarching objective of APT29 typically revolves around intelligence collection, primarily targeting entities dealing with national security and foreign affairs. We observed that EVA-01 facilitates the exfiltration of sensitive documents by compressing files into archives and encrypting them before transferring these files to the C2 over the established HTTPS channel. During our analysis, we identified several sensitive files, including research papers and internal communications, being exfiltrated successfully.
MITRE ATT&CK Mapping
- T1193 – Spear Phishing Link: Used to gain initial access through a malicious document.
- T1203 – Exploitation for Client Execution: Exploit via Microsoft Office vulnerability to execute the dropper.
- T1071.001 – Application Layer Protocol: HTTPS used for C2 communication.
- T1047 – Windows Management Instrumentation: Leveraged for lateral movement across the network.
Detection Opportunities
- Monitor for suspicious modifications to
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current\Run. - Analyze network traffic for anomalous HTTPS requests to newly registered domains.
- Implement EDR solutions to detect unusual WMI activity originating from established user accounts.
Analyst Notes
The evolving tactics used by APT29 in deploying the EVA-01 malware illustrate a pressing need for organizations to bolster their defenses against such modular and persistent threats. Continuous education of users regarding phishing attacks and reinforcing endpoint detection mechanisms can significantly reduce the likelihood of successful intrusions. Our analysis underscores the importance of vigilance and proactive threat hunting activities to identify these advanced persistent threats before they achieve their objectives.
Source: Original Report