MASHA AND THESE BEARS

### Overview Kurt, a principal security researcher on Kaspersky's Global Research and Analysis Team (GReAT), analyzes significant shifts in the operations of the threat group APT28 (also referred to as Sofacy) heading into 2018. While historically known for Western-focused operations such as targeting NATO, Ukraine, European elections, and the DNC hack, Sofacy has evolved into a more agile and measured actor. Kurt highlights key evolutions in their toolset, infrastructure, development culture, and geographic targeting, specifically their movement further east into Asia.

### Key Topics - **Targeting Pivot to the Far East**: Moving beyond historical Western targets and Central Asian "-stans", Sofacy expanded operations across Mongolia, Japan, and China in 2018. - **Target Overlap with Gray Lambert**: A notable compromise occurred on an aerospace and defense conglomerate server in China previously infected with Gray Lambert (a user-mode passive sniffer implant associated with the Lambert actor family). - **Decline of SPLM / X-Agent**: The traditional heavy C++ backdoor known as SPLM or CHOPSTICK is largely disappearing from active deployments, replaced by smaller in-memory modules and new frameworks. - **Rise of Zebrocy**: A subgroup of Sofacy utilizing modular .NET and PowerShell tools, distinct IP-based infrastructure, and rapidly iterating codebases.

### Technical Details - **Malware Evolution**: Historically, Sofacy maintained consistent C++ codebases over long periods (2004–2009 and 2009–2015). By 2017–2018, the ~300 KB fully featured SPLM backdoor—which bundled keyloggers, remote shells, and file-stealing capabilities communicating over HTTP, FTP, or SMTP—fell out of widespread use. In 2018, SPLM appeared almost exclusively as small in-memory remote shell modules. - **Chinese Server Overlap**: Sofacy deployed in-memory components onto a Chinese aerospace server shortly after Kaspersky cleaned up Gray Lambert. Hypothesized infection vectors include shared vulnerable web application exploitation (most likely), replay of recorded Lambert magic-value sessions, Lambert false flags, or stolen Sofacy tooling. - **Cryptography Comparison**: Sofacy's 2017 in-memory plugins use a custom 32-round feedback-based cipher recompiled per victim with changing operators and constraints (distinct from NSA's Speck algorithm). In 2016 (DNC hack), they used simpler sequential XOR operations. In contrast, threat group Turla demonstrates professional standard cryptography (RSA, DES, 3DES) coupled with immature commentary, while Zebrocy implements simpler, practical custom crypto routines. - **Zebrocy Characteristics**: Zebrocy relies on .NET and PowerShell rather than C++, incorporating USB/removable drive monitoring to exfiltrate files and borrowing open-source tooling such as PowerShell Empire. Zebrocy also utilizes configuration INI files with build ID formatting reminiscent of BlackEnergy's 2014 custom plugins. - **Infrastructure Shifts**: Traditional Sofacy infrastructure relied on domain names registered via privacy services and paid using Bitcoin. Zebrocy and newer operations have moved toward bare IP addresses, eliminating the need for domain anonymity services.

### Takeaways Into 2018 and beyond, Sofacy operations demonstrate heightened agility. Defenders must anticipate continuing abandonment of legacy C++ code in favor of modular .NET, PowerShell, and open-source frameworks, continued diversification away from domain-centric infrastructure toward IP-based command-and-control, and broadened geographic targeting across East Asia.