Introduction
Cyber attacks grew during the COVID-19 pandemic. They grew in number and in the ways attackers got in. Their impact grew too.
The pandemic widened the attack surface. More attacks reached companies through people working from home and from the office. At the same time, attackers keep bringing in new tools and new ways of working. So the threat picture keeps changing.
Take the 2021 SolarWinds attack. It had a huge impact.
The malware seems to have spread inside a trusted product. Many companies were hit after it, most of all in the U.S. and Europe.
Why attackers target Europe
Criminal groups want money
Most individual threat actors who attack Europe want one thing: money. Here is what we have seen:
- Banks and the finance sector are their main target.
- Targeted ransomware attacks rose fast during the COVID-19 crisis.
- Many companies could not afford downtime. So they paid the ransom.
- Some ransomware groups asked for even more. They threatened to publish stolen data. This is called double extortion.
State-backed groups want intelligence
Groups backed by a government work in a different way. They run longer operations for the state they serve. Money comes second. Their goal is to gather strategic intelligence about the target country.
So security teams need two things today: visibility and speed. They need both to watch threat actors and what those actors are doing now.
APT Groups
APT28 – Fancy Bear
Main Targeted Sectors: Energy, Government Agencies, Media
Associated Malware: CHOPSTICK, SOURFACE, WinIDS, X-Agent
APT28, also known as Fancy Bear, is a threat group based in Russia. It attacks NATO member states and Eastern European countries most of all.
- Its campaigns use malware families built for each victim.
- It also tries to break straight into the email accounts of target companies. It does this with password spraying.
- This seems to cut its need to spread malware to collect user data.
For more on this threat actor, read our APT28 – Fancy Bear profile.
APT15
Main Targeted Sectors: Economy and Finance, Energy, Commerce, Military
Associated Malware: Enfal, Baldeagle, Noisemaker, Mirage
APT15 is thought to be based in China. It targets central bodies in several European countries, the USA and South Africa.
- Its operators share tools with other Chinese APTs. These include backdoors and technical infrastructure.
- It often uses spear phishing emails to get its first foothold.
- Its targets work in sectors that interest the Chinese government.
APT35
Main Targeted Sectors: Energy, Defense Industry, Government, Communication
Associated Malware: Aspxshellsv, Brokeyolk, Pupyrat, Tunna, Mangopunch, Drubot, Houseblend
APT35 is also called Newscaster Team. It is a cyber espionage group backed by the Iranian government. It runs long operations to gather strategic intelligence.
It gets its first access in three ways:
- Spear-phishing campaigns against the target company.
- Accounts it took over with passwords stolen in past operations.
- Password spraying against web apps open to the internet.
APT27
Main Targeted Sectors: Government, Energy, Aviation, Transportation
Associated Malware: Pandora, Sogu, Zxshell, Ghost, Wideberth, Quickpulse, Flowerpot
APT27 is backed by China. It has targeted many companies with head offices around the world. These include North and South America, Europe and the Middle East.
APT27 usually starts with spear phishing. It is known for one method in particular:
- It takes over an account inside a victim company.
- It uses that account to send phishing emails to firms in similar industries.
- It does this instead of using zero-day flaws.
APT38 – Lazarus
Main Targeted Sectors: Economy and Finance
Associated Malware: APT38, one of the most productive groups, uses malware families to target financial organizations.
APT38 is backed by the North Korean regime. This group was seen carrying out the largest known cyber heist.
- Many in the security world know APT38 as “Lazarus”.
- But its money motive, its own toolkit and its tactics, techniques and procedures (TTPs) suggest it is a separate group.
- APT38 is also known for destroying evidence or victim networks in its operations.
For more on “Lazarus – APT38”, read our blog post.
APT29 – Cozy Bear
Main Targeted Sectors: Education, Energy, Finance, Government, Technology
Associated Malware: Aspxshellsv, Brokeyolk, Pupyrat, Tunna, Mangopunch, Drubot, Houseblend
APT29 is nicknamed Cozy Bear. It is a threat group based in Russia. It is thought to act for the Russian Foreign Intelligence Service.
APT29 has run spear phishing campaigns to deliver certain types of malware. Its targets are firms in many industries, mostly in Europe. The group is thought to be behind several high-profile attacks:
- The 2015 Pentagon attack.
- A 2020 breach of a security company.
- The SolarWinds attack.
- The theft of COVID-19 vaccine data.
The group also stands out in one more way. It tries to get back into networks it has lost control of.
To be continued…
