StrongPity, an APT group active since at least 2012 and first publically reported in 2016, has mostly focused on countries like Italy and Belgium. However, it has now expanded its scope of attack across Northern Africa, Europe, Asia, and Canada as well.
Quick info
The APT focuses on finding and exfiltrating data from infected machines and runs a series of fake websites that lure users with an array of software tools. These tools are trojanized versions of genuine applications.
- The APT selectively targets victims using a predefined IP list. If a victim’s IP address matches the one in the installer’s configuration file, the group delivers a trojanized version of the application, otherwise a legitimate version.
- Once installed, the malware triggers an exfiltration component that executes a file-searching mechanism tasked for looping via drives, looking for files with some specific extensions defined by attackers.
- If found, the files are stored in a temporary (.ZIP) archive. Then, split into hidden (.SFT) encrypted files and sent to the C2 server. Finally, these files are deleted from the disk to hide any evidence of exfiltration.
- The APT uses two types of servers - download servers that propagate the malicious installer used in the initial compromise of victims and C2 servers.
Hacker-for-hire groups
Besides StrongPity, there are several other hacker-for-hire mercenary groups that are actively offering their services and have been observed expanding their scope of attacks.
- A hacker-for-hire group DeathStalker was observed using a new PowerShell backdoor in their attacks, in early-December.
- CostaRicto was found operating a global espionage campaign on multiple continents.
Conclusion
Hackers-for-hire mercenaries are now becoming popular and many nation-states have been found using their services for espionage. Thus, experts suggest organizations stay protected by deploying web and email filters on the network, segmentation of any critical networks, and advising their employees to use legitimate software downloaded from official sources only.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/898c_shutterstock_1151471429.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/11c7_people-chain.jpg)
