Using AttackIQ to Prepare for Nation-State Adversaries

Overview: Ken Town and Francis from AttackIQ's Adversary Research Team present a threat emulation methodology designed to prepare enterprise defenses against Russian state-sponsored threat group APT28 (Fancy Bear / Unit 26165). The presentation examines APT28's history, targeting profiles, and multi-stage malware arsenals, focusing on the Zebrocy and SkinnyBoy campaigns. The speakers demonstrate how organizations can use AttackIQ's automated attack graphs to emulate full kill chains, validating whether security controls successfully detect and prevent sophisticated nation-state intrusions.

Key Topics: - Threat profile and geopolitical objectives of Russian state actor APT28 (GRU Unit 26165) - Reverse engineering and behavioral analysis of the Zebrocy (Silver C) malware family - Analysis of the SkinnyBoy (AceLoad) reconnaissance tool targeting the defense sector - Emulating multi-stage intrusions using Atomic, Network, and Anatomic attack graphs

Technical Details: APT28, attributed by the U.S. Department of Justice to Unit 26165 of the Russian General Staff Main Intelligence Directorate (GRU), has conducted cyber espionage operations since at least 2007. The threat actor targets global government institutions, the defense industrial base (DIB), and international bodies such as the World Anti-Doping Agency (WADA) and the Organization for the Prohibition of Chemical Weapons (OPCW). To emulate APT28 tradecraft accurately, AttackIQ developed behavioral emulation templates modeling two prominent malware campaigns.

The first emulation template models Zebrocy (phonetically described as "Silver C"), a multi-stage, multi-family toolset deployed extensively in 2018–2019. Zebrocy comprises modular downloaders, droppers, and collection tools authored in diverse programming languages including Delphi, Go, Nim, and Rust. Synthesizing intelligence from ESET (Welivesecurity) and Palo Alto Networks Unit 42, AttackIQ constructed a 31-node attack graph replicating Zebrocy's multi-step execution flow, focusing heavily on host discovery, command-and-control communication over uncommon protocols, and HTTP-based data exfiltration. The second template models SkinnyBoy (also known as AceLoad), an evasion tool deployed in May 2021 against defense and government targets via spear-phishing documents designed to harvest system telemetry and exfiltrate proprietary data.

Ken Town demonstrates how the AttackIQ platform operationalizes these threat models across three testing modes: Atomic tests (single-scenario checks for specific controls), Network tests (replaying raw PCAP traffic across hosts to evaluate boundary defenses), and Anatomic attack graphs. Attack graphs chain multiple atomic scenarios into dynamic, branching execution trees. During emulation, the engine determines the next adversary action based on whether an endpoint control prevented or permitted the preceding technique. This enables defenders to identify exact control failures across the kill chain and remediate defensive gaps before an adversary engages.

Key Takeaways: Defenders must move beyond evaluating isolated indicators of compromise (IOCs) to test end-to-end adversary behaviors across the entire attack lifecycle. Utilizing multi-node attack graphs allows organizations to validate whether endpoint and network security controls prevent adversary progression at early execution stages. Security operations teams should leverage threat intelligence to prioritize emulation of high-risk threat groups like APT28, testing specific modular toolsets like Zebrocy and SkinnyBoy against production controls.

(AI summary — Gemini Flash)