MalwareUsed by 1 actorExploits 1 CVE

Sofacy Trojan

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2015-1641Microsoft Office RTF Memory Corruption Vulnerability

The e-mail was sent from a potentially compromised account belonging to the Ministry of Foreign Affairs of another government entity and carried the Carberp variant of the Sofacy Trojan.

via paloalto researchcenter historicresearchcenter.paloaltonetworks.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT28

The e-mail was sent from a potentially compromised account belonging to the Ministry of Foreign Affairs of another government entity and carried the Carberp variant of the Sofacy Trojan.

via paloalto researchcenter historicresearchcenter.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted the United States government... The email contained an RTF file as an attachment, with the filename "Exercise_Noble_Partner_16.rtf"

Execution

2 techniques

T1059.001PowerShellEvidence1

The "btecache.dll" file is a Trojan that loads and executes "svchost.dll"... This allows the threat actors to download additional files to the system, execute both executables and DLLs and delete files.

T1203Exploitation for Client ExecutionEvidence1

The RTF file is a weaponized document that attempts to exploit CVE-2015-1641 to drop two files to the system, specifically, "btecache.dll" and "svchost.dll".

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The path to the "btecache.dll" file is added to the following registry key: Software\Microsoft\Office test\Special\Perf\: "C:\Users\[username]\AppData\Roaming\btecache.dll"

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The path to the "btecache.dll" file is added to the following registry key: Software\Microsoft\Office test\Special\Perf\: "C:\Users\[username]\AppData\Roaming\btecache.dll"

Stealth

1 technique

T1036MasqueradingEvidence1

The Trojan delivered in this attack contains two network locations that it will send network beacons to, specifically “google.com” and “191.101.31.6”. These beacons are sent to the legitimate website google.com as an attempt to hide the true C2 beacons

Discovery

2 techniques

T1057Process DiscoveryEvidence1

This callback data allows the threat actors to determine if the infected machine is a target of interest, as the beacon contains a list of running processes

T1082System Information DiscoveryEvidence1

The clear text of the data sent in the network beacons contains information regarding the compromised system... a new line delimited list of running processes on the system... The name of the system's hard drive... OS version... CPU architecture.

Command and Control

3 techniques

T1001Data ObfuscationEvidence1

The POST data seen in the beacon in Figure 1 is base64 encoded and encrypted using the same custom algorithm used to encrypt the data in the beacon URL.

T1071.001Web ProtocolsEvidence1

The Trojan sends network beacons to its command and control (C2) server... The network beacons are sent using HTTP POST requests with URLs created largely with random characters.

T1105Ingress Tool TransferEvidence1

The threat actors can then respond to these network beacons to download and execute additional secondary payloads on the system.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

paloalto researchcenter historicNews

Jun 14, 2016

New Sofacy Attacks Against US Government Agency

A Sofacy-associated trojan built with code from leaked Carberp source code. It uses a loader DLL to execute the main payload, persists via a Microsoft Office-related registry key so it loads when Office apps are opened, beacons to C2 infrastructure with host/process information, and can download, execute, and delete secondary payloads.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 1 CVE

Sofacy Trojan

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2015-1641Microsoft Office RTF Memory Corruption Vulnerability

The e-mail was sent from a potentially compromised account belonging to the Ministry of Foreign Affairs of another government entity and carried the Carberp variant of the Sofacy Trojan.

via paloalto researchcenter historicresearchcenter.paloaltonetworks.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT28

The e-mail was sent from a potentially compromised account belonging to the Ministry of Foreign Affairs of another government entity and carried the Carberp variant of the Sofacy Trojan.

via paloalto researchcenter historicresearchcenter.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Execution

2 techniques

T1059.001PowerShellEvidence1

T1203Exploitation for Client ExecutionEvidence1

The RTF file is a weaponized document that attempts to exploit CVE-2015-1641 to drop two files to the system, specifically, "btecache.dll" and "svchost.dll".

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The path to the "btecache.dll" file is added to the following registry key: Software\Microsoft\Office test\Special\Perf\: "C:\Users\[username]\AppData\Roaming\btecache.dll"

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The path to the "btecache.dll" file is added to the following registry key: Software\Microsoft\Office test\Special\Perf\: "C:\Users\[username]\AppData\Roaming\btecache.dll"

Stealth

1 technique

T1036MasqueradingEvidence1

Discovery

2 techniques

T1057Process DiscoveryEvidence1

This callback data allows the threat actors to determine if the infected machine is a target of interest, as the beacon contains a list of running processes

T1082System Information DiscoveryEvidence1

Command and Control

3 techniques

T1001Data ObfuscationEvidence1

The POST data seen in the beacon in Figure 1 is base64 encoded and encrypted using the same custom algorithm used to encrypt the data in the beacon URL.

T1071.001Web ProtocolsEvidence1

The Trojan sends network beacons to its command and control (C2) server... The network beacons are sent using HTTP POST requests with URLs created largely with random characters.

T1105Ingress Tool TransferEvidence1

The threat actors can then respond to these network beacons to download and execute additional secondary payloads on the system.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

paloalto researchcenter historicNews

Jun 14, 2016

New Sofacy Attacks Against US Government Agency

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.