A group linked to Russia’s intelligence service has targeted the Slovak government officials for months, ESET and IstroSec security firms said. The firms revealed new details about the campaign targeting Slovakia Government and Cobalt Strike infrastructure used by the threat actor.
The group responsible for the attacks is known as the Dukes or Nobelium, and APT29. It has been linked to the Russian Foreign Intelligence Service, SVR.
According to security firms IstroSec and ESET, the SVR hackers targeted Slovak officials through spear-phishing campaigns. Their analysis was based solely on publicly available information, community threat intelligence sources (VirusTotal), and their own investigations.
According to their research presented at a talk at Def Con, SVR operators posing as the Slovak National Security Authority (NBU) sent emails to Slovak diplomats in spear-phishing campaigns designed to infect their systems. Emails contained ISO/IMG attachments looking like Word documents.
Researchers from IstroSec explained how they discovered the SVR’s command-and-control servers that were used in these attacks. The ISOC team said that some C&C servers used by SVR also contained documents that were aimed at Czech government officials.
Security firm ESET has confirmed that the group was responsible for the attacks against European diplomats in 13 European countries.
According to ESET, all the attacks used in these incidents used the same scheme: email -> ISO disk image -> LNK shortcut file -> Cobalt Strike backdoor. This tactic was earlier described by Volexity and Microsoft in their respective reports.
The Russian espionage group used a variety of techniques to infect users of iOS devices. One of these attacks used a Safari iOS zero-day to steal sensitive information from diplomats who read their emails on their iPhones.
The incident and results have been reported to the local authorities such as computer security incident response team. The report included the collected indicators of compromise such as hashes and IP addresses.
