CYBERUK 2022: Threat Group Summary - Bridewell Consulting

Cyber Threat Intelligence 2022 – Threat Group Summary

We’ve gathered descriptions on leading threat groups in the Critical National Infrastructure space.

Select your sector in the navigation bar below to find summaries of the most prominent threat groups, or scroll through the page for a wider view of the threat groups in the CNI space.

Education Sector

Scully Spider

“Scully Spider” (aka Gold Opera) is a financially-motivated threat group that develops and operates the “DanaBot” botnet using a malware as a service (MaaS) model. The group is known for software supply-chain attacks as well as distributed denial of service (DDoS) attacks.

Maze

Maze ransomware was first identified in May 2019 and has been linked with the threat group TA2101. The operators of Maze have since been highly active, targeting a wide range of sectors in North America and Europe. After encrypting victim's files, the group creates a post on their deep web website "Maze News" where the operators threaten to expose the victim’s data if the ransom if not paid. The Maze ransomware was previously known as the "ChaCha ransomware", since it used the Chacha20 stream cipher to encrypt and lock victims' files.

7h0rf1nn

User “7h0rf1nn” is active on the Russian-language cybercriminal forum Exploit and the popular English-language cybercriminal forum RaidForums, where they have advertised multiple access offerings targeting victims in the education, military, government, and finance sectors in Portugal, the US, Brazil, and Mexico. There has been little public forum interest in 7h0rf1nn’s listings, but user feedback on RaidForums suggests that 7h0rf1nn has conducted some successful transactions with other forum members. There is no available forum evidence to indicate 7h0rf1nn’s level of technical proficiency, but their successful sales indicate that their listings are credible

Defence Sector

Turla

“Turla” is a threat group that has been active since at least 2004 and is suspected to be associated with Russia. The group’s motives are likely to be obtaining intelligence and conducting cyber espionage. Turla has primarily targeted government and military organizations, such as embassies, ministries, and intelligence agencies. The group has also attacked educational, pharmaceutical, and research entities. Victims are typically based in Europe, the Middle East, Central Asia, and the US.

Ocean

OceanLotus is a cyber espionage group likely based in Vietnam. The group has targeted organizations of geopolitical interest to this country, including China, Philippines, Cambodia, and Laos. The group was also been identified targeting Vietnamese individuals and organizations critical of the Vietnamese government, including within the media and human rights sectors. The group has also been identified attacking Vietnamese dissidents and journalists. Attacks have to date demonstrated moderate to high technical capabilities, including use of custom JavaScript code and malware.

APT40

“APT40” (aka Temp.Periscope, Temp.Jumper, Leviathan) is an advanced persistent threat (APT) group linked to the People’s Republic of China (PRC). The group conducts cyber espionage operations in support of the PRC’s state interests, against the engineering, transportation, and defense industry, especially organizations involved in maritime technologies. Although APT40 has a global targeting scope, it has also conducted attacks on countries of geopolitical or economic significant, likely in support of the PRC’s Belt and Road Initiative (BRI). APT40 has targeted a range of states in Asia, Europe and North America and has likely conducted multiple campaigns simultaneously, indicating a high level of operational capability.

Government Sector

APT28

APT28 (aka Fancy Bear) is a highly sophisticated cyber threat organization that has been publicly attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) Military Unit 26165. The nation-state affiliated group has reportedly been active since as early as 2004 and conducts attacks aligned to the strategic political interests of the Russian government. Digital Shadows asseses the group to be a highly capable threat to organizations in a broad array of sectors including, but not limited to, aerospace, defense, energy, government, and media

Equation

The Equation Group is believed to have been engaged in multiple computer network exploitation operations which date back to 2001 and possibly as early as 1996. The evidence presented by Kaspersky strongly suggested that the Equation Group is highly likely to be a Western nation state actor or entity. Documents subsequently released by WikiLeaks as part of the "Vault 7" series indicated that the Equation Group toolset identified by Kaspersky consisted of tooling and malware used by the US National Security Agency (NSA) and the US Central Intelligence Agency’s (CIA) Center for Cyber Intelligence (CCI), formerly the Information Operations Center. It is therefore considered to be highly likely that the Equation Group is a part of the US intelligence community. The attackers have previously targeted specific individuals of interest, with reconnaissance tools being used to identify whether a compromised machine is used by an intended target. Once a target is identified, a more sophisticated platform was deployed which can be used to monitor the victim and to exfiltrate valuable intellectual property from the machine. In addition to targeted intrusions focused on individuals, documents leaked by the Shadow Brokers have indicated that Equation technical assets were used in the 2013 targeting of a SWIFT Service Bureau in an operation likely intended to establish and maintain access to the organization’s network in order to facilitate general intelligence collection and collection in response to tactical intelligence requirements. It was assessed that actors associated with the Equation Group toolset likely pose a Very High level of threat to organizations and entities which fall within their operational remit.

Energetic Bear

Energetic Bear is a threat group that has been active since at least 2010, and is associated with the Russian Federation. The group’s motivations are assessed by Digital Shadows as likely cyberespionage. Energetic Bear primarily conducts highly-targeted operations targeting critical infrastructure in the energy and industrial sectors, with victims typically based in the United States of America and Europe.

Healthcare Sector

inthematrix1

inthematrix1 is a highly active initial access broker who operates on the high-profile Russian-language cybercriminal forum Exploit. Despite their short tenure on the forum, inthematrix1 has built a positive reputation due to their frequent and reliable advertisements of remote desktop protocol (RDP) accesses targeting victims in multiple geographies and industries. inthematrix1 has received praise from multiple prominent forum users and appears to have successfully sold most of their advertised listings.

Nei

nei is a highly active initial access broker who operates on the prominent Russian-language cybercriminal forums XSS and Exploit. Since joining the forums in early 2021, nei has advertised over 80 RDP-VPN accesses to mostly US- UK-, and France-based organizations. nei’s advertising threads and their positive reputation scores indicate that they have successfully sold many of their listings, suggesting that the user is credible and that their offerings are genuine. Their high level of technical knowledge and comments about past activity suggest that they have likely operated in the cybercriminal underground under alternative aliases.

Chemical Sector

Lazarus Group

Lazarus Group is a highly active advanced persistent threat (APT) group, believed to be motivated by the nation-state objectives of the Democratic People’s Republic of Korea (North Korea). The group has heavily targeted the United States and the Republic of Korea (South Korea), focusing on the financial services, government and technology sectors. The group is linked to a variety of custom-developed malware including remote access trojans (RATs), keyloggers, downloaders and destructive wipers. Delivery methods used by the group have included watering holes and spearphishing email operations. Lazarus has been linked to several thefts from financial institutions involving the Society for Worldwide Interbank Financial Telecommunication (SWIFT) network, including the USD 81 million theft from the Bangladesh Bank in early 2016. Additionally, the group has been linked to the 2017 wCry ransomware incident.

Maze

Maze ransomware was first identified in May 2019 and has been linked with the threat group TA2101. The operators of Maze have since been highly active, targeting a wide range of sectors in North America and Europe. After encrypting victim's files, the group creates a post on their deep web website "Maze News" where the operators threaten to expose the victim’s data if the ransom if not paid. The Maze ransomware was previously known as the "ChaCha ransomware", since it used the Chacha20 stream cipher to encrypt and lock victims' files.

TA505

TA505 is a financially-motivated threat group that has been active since 2014. The group has demonstrated a propensity to operate with a wide range of malware variants, and has also helped popularize smaller, regional variants across the globe. TA505 primarily uses the Necurs botnet for widespread malware spam campaigns, but has also been observed using alternative distribution methods. As a result, the group has not been observed to favor any specific target geography, as their campaigns reach entities across the globe. The financial sector is a major target, likely due to the opportunities for significant financial gain.

Cyber Berkut

Cyber-Berkut is a pro-Russian, Ukrainian hacktivist group who claims to be responsible for multiple cyber-attacks against Western countries, and a series of cyberattacks during the 2014 civil conflict in Ukraine. Cyber-Berkut also engages in cyber-espionage, information warfare operations and disruptive computer network intrusions. The group supports Ukrainian independence and fights against what it perceives as neo-fascism and neo-nationalism. The group takes an anti-EU and anti-West stance, and are strong supporters of the former Ukrainian President Viktor Yanukovych.

Food Sector

TA505

TA505 is a financially-motivated threat group that has been active since 2014. The group has demonstrated a propensity to operate with a wide range of malware variants, and has also helped popularize smaller, regional variants across the globe. TA505 primarily uses the Necurs botnet for widespread malware spam campaigns, but has also been observed using alternative distribution methods. As a result, the group has not been observed to favor any specific target geography, as their campaigns reach entities across the globe. The financial sector is a major target, likely due to the opportunities for significant financial gain.

Lapsus$

The cyber-threat group “Lapsus$ Group” was first discovered around December 2021, after the group targeted such high-profile victims as Brazil’s Ministry of Health and Portugal’s media conglomerate Impresa. Based on its targeting scope and interests, Lapsus$ Group seems to focus on Portuguese-speaking victims, especially those located in South America. The group is financially motivated and conducts cyber extortion, threatening to expose victims’ identities and data if a ransom is not paid.

Telecoms Sector

Lazarus Group

Lazarus Group is a highly active advanced persistent threat (APT) group, believed to be motivated by the nation-state objectives of the Democratic People’s Republic of Korea (North Korea). The group has heavily targeted the United States and the Republic of Korea (South Korea), focusing on the financial services, government and technology sectors. The group is linked to a variety of custom-developed malware including remote access trojans (RATs), keyloggers, downloaders and destructive wipers. Delivery methods used by the group have included watering holes and spearphishing email operations. Lazarus has been linked to several thefts from financial institutions involving the Society for Worldwide Interbank Financial Telecommunication (SWIFT) network, including the USD 81 million theft from the Bangladesh Bank in early 2016. Additionally, the group has been linked to the 2017 wCry ransomware incident.

TA505

TA505 is a financially-motivated threat group that has been active since 2014. The group has demonstrated a propensity to operate with a wide range of malware variants, and has also helped popularize smaller, regional variants across the globe. TA505 primarily uses the Necurs botnet for widespread malware spam campaigns, but has also been observed using alternative distribution methods. As a result, the group has not been observed to favor any specific target geography, as their campaigns reach entities across the globe. The financial sector is a major target, likely due to the opportunities for significant financial gain.

APT41

“APT10” is an advanced persistent threat (APT) group linked to the People’s Republic of China (PRC). Active since at least 2009, the group has targeted organizations in the US, Europe, and Japan. However, the global nature of some of its attacks indicate that several other countries and industries have likely also been affected by APT10. Prominent APT10 attacks include Operation Cloud Hopper, Operation Soft Cell, and Operation TradeSecret. The group has historically made use of several zero-day exploits and custom malware, demonstrating a high degree of technical capability. Overall, Digital Shadows regards the group as posing a High threat.

Energy Sector

Sandworm

“Sandworm” is an advanced persistent threat group that has been active since at least 2009 and has been attributed to Russia. Sandworm makes use of customizable malware such as “BlackEnergy” and “KillDisk”. The group exploits known vulnerabilities and zero-day exploits, favoring social engineering, spearphishing, and phishing as initial infection methods. Sandworm’s focus has been on targeting Ukraine, likely as a result of the ongoing Russia-Ukraine armed conflict, and is best known for attacks against the Ukrainian energy sector in 2015 and 2016, the NotPetya malware attacks in 2017, and the botnet of firewalls in 2022 during the Russia-Ukraine War

Maze

Maze ransomware was first identified in May 2019 and has been linked with the threat group TA2101. The operators of Maze have since been highly active, targeting a wide range of sectors in North America and Europe. After encrypting victim's files, the group creates a post on their deep web website "Maze News" where the operators threaten to expose the victim’s data if the ransom if not paid. The Maze ransomware was previously known as the "ChaCha ransomware", since it used the Chacha20 stream cipher to encrypt and lock victims' files.

Anonymous

Anonymous is a hacktivist collective that emerged in 2005 from a collection of users active on the message board 4chan. The Anonymous name has garnered a considerable amount of publicity and is commonly regarded as one of the most infamous hacktivist movements. However, the collective is highly fragmented with varying splinter groups and individuals supporting different causes. Splinter groups are commonly formed based on source geography but all groups use the Anonymous brand, iconography and shared ideology. The notoriety associated with the Anonymous collective is assessed to provide a foundation for support as hacktivist operations are announced, but the ease in which any individuals or groups can identify with this collective means that the impact of any particular movement cannot be assessed with confidence . Common tactics used by affiliates of this collective include defacement, denial of service and small, often low impact data leakage

APT33

APT 33 is an advanced Iranian state-associated actor, best known for conducting password spraying attacks and social engineering, including specially crafted spear phishing to gain initial access to target networks. The group have been in operation since at least 2013, and have targeted numerous industries in the United States, South Korea, Saudi Arabia and the wider Middle-East. Much of their activity has targeted the aviation and energy industries, but more recently industrial control systems

Financial Sector

FIN7

“FIN7” is a financially-motivated threat group, with unconfirmed links to Russia, that predominantly targets the US retail and hospitality sectors. Their tactics commonly involved spearphishing emails with malicious attachments that download a combination of open-source and custom malware. Other tactics involved exfiltration and subsequent exploitation of card payment data through use of point of sale (POS) malware. Several alleged members of the FIN7 group have been arrested by US law enforcement but this has not stopped the group who have continued attacks and are developing “Tiron”, a new malware to replace “Carbanak”.

Cobalt Group

Cobalt Group is an organized, Russian-based criminal group that has conducted intrusions into banks across Asia, Europe and North America to facilitate the theft of cash from bank's ATMs. Active since at least July 2016, the group predominantly uses spearphishing as an initial intrusion vector and is known to use the penetration testing tool "Cobalt Strike" and the credential harvester "Mimikatz" to move laterally. Cobalt is motivated by opportunities for financial gain and uses its custom malware "Ripper" to dispense cash from infected ATMs.

Buhtrap Group

Buhtrap is the name of a threat actor group and a malware that has been active since at least 2014 and has historically targeted financial institutions in Russia and Ukraine. In Sep 2016, the group altered their tactics and started to deliver malware via drive-by downloads. Buhtrap was historically dropped onto a victim's system via a malicious Rich Text Format (RTF) document sent over email. Starting in September 2016, Cyphort Labs observed the same malware being dropped via a drive-by download. The threat level of Buhtrap is assessed to be High based on the group's high capability and their successful intrusions.

Transport Sector

Maze

Maze ransomware was first identified in May 2019 and has been linked with the threat group TA2101. The operators of Maze have since been highly active, targeting a wide range of sectors in North America and Europe. After encrypting victim's files, the group creates a post on their deep web website "Maze News" where the operators threaten to expose the victim’s data if the ransom if not paid. The Maze ransomware was previously known as the "ChaCha ransomware", since it used the Chacha20 stream cipher to encrypt and lock victims' files.

APT37

APT37 is a highly active advanced persistent threat (APT) group, believed to be motivated by the nation-state objectives of the Democratic People’s Republic of Korea (North Korea). The group has mainly targeted the Republic of Korea (South Korea), focusing on government, financial services and technology sectors. The group is linked to a variety of custom-developed malware including remote access trojans (RATs), downloaders and destructive wipers. Delivery methods used by the group have included watering holes and spearphishing email operations. APT37 has been known to use exploits for the South Korean-developed Hangul Word Processor, and Microsoft Office and Adobe Flash vulnerabilities. The group has been linked to the 2016 campaign known as Operation Daybreak as well as an earlier campaign known as Operation Erebus.

APT10

“APT10” is an advanced persistent threat (APT) group linked to the People’s Republic of China (PRC). Active since at least 2009, the group has targeted organizations in the US, Europe, and Japan. However, the global nature of some of its attacks indicate that several other countries and industries have likely also been affected by APT10. Prominent APT10 attacks include Operation Cloud Hopper, Operation Soft Cell, and Operation TradeSecret. The group has historically made use of several zero-day exploits and custom malware, demonstrating a high degree of technical capability. Overall, Digital Shadows regards the group as posing a High threat.

Water Sector

APT10

“APT10” is an advanced persistent threat (APT) group linked to the People’s Republic of China (PRC). Active since at least 2009, the group has targeted organizations in the US, Europe, and Japan. However, the global nature of some of its attacks indicate that several other countries and industries have likely also been affected by APT10. Prominent APT10 attacks include Operation Cloud Hopper, Operation Soft Cell, and Operation TradeSecret. The group has historically made use of several zero-day exploits and custom malware, demonstrating a high degree of technical capability. Overall, Digital Shadows regards the group as posing a High threat.

Maze

Maze ransomware was first identified in May 2019 and has been linked with the threat group TA2101. The operators of Maze have since been highly active, targeting a wide range of sectors in North America and Europe. After encrypting victim's files, the group creates a post on their deep web website "Maze News" where the operators threaten to expose the victim’s data if the ransom if not paid. The Maze ransomware was previously known as the "ChaCha ransomware", since it used the Chacha20 stream cipher to encrypt and lock victims' files.

Patchwork

Patchwork is a cyber espionage group attributed to the targeting of companies and individuals China and South Asia, as well as Europe and North America. Reporting suggests the groups has targeted retail, telecommunications, media, aerospace, financial services, and non-governmental organization sectors including think tanks. Patchwork has used a number of custom malware variants, commercially or publicly available tooling and software exploits in its campaigns. Patchwork is also identified as Dropping Elephant and Chinastrats, and is associated with campaigns named "Monsoon" and "Operation Hangover".

About Bridewell

Legal

T: +44 (0)3303 110 940
E: hello@bridewell.com

© Copyright 2022 – Bridewell Consulting
Bridewell is the trading name of Bridewell Consulting Limited registered in England and Wales.
VAT Registration No: 386809347 | Company Registration No: 11101195.
Registered Office: 40 Caversham Road, Reading, RG1 7EB