Russian Cyberspies Build ‘Go’ Version of Their Trojan

The Russian-linked cyber-espionage group Sofacy has developed a new version of their Zebrocy tool using the Go programming language, Palo Alto Networks security researchers warn.

The first-stage malware was initially analyzed in April this year, and has been observed in numerous attacks in October and November. Last month, however, the researchers also observed a new Trojan being used in the group’s attacks.

Also known as APT28, Fancy Bear, Pawn Storm, Sednit and Strontium, the state-sponsored actor has been active for several years, focusing on cyber-espionage and believed to have orchestrated the attacks targeting the 2016 presidential election in the United States. 

The group hit Ukraine and NATO countries over the past years, but a recent report revealed governmental targets on four continents. An October report from Kaspersky revealed that the activities of various nation-state Russian groups started to overlap.

The group has used different programming languages to build functionally similar Trojans before, and the Zebrocy tool went through this process as well, with numerous variants developed in AutoIt, Delphi, VB.NET, C# and Visual C++ already observed.

The recently discovered Go variant of Zebrocy has been already used in attacks, the researchers say. One of the incidents occurred on October 11 and employed a spear-phishing email with an LNK attachment that would run a series of PowerShell scripts to extract a payload. The scripts, however, were coded incorrectly and the payload wasn’t installed.

The same Trojan variant was also delivered as part of a campaign running from mid-October through mid-November, and which used 9 delivery documents that had the same author name, Joohn. The documents would fetch a remote template and trick the victim into allowing a malicious macro to run.

The Go variant of Zebrocy does initial information collection on the compromised system, sends the data to the command and control (C&C) server, and attempts to download, install and execute a payload from it. It also shows additional specific overlaps in functionality with other tool variants, including the use of a shared C&C URL.

The malware attempts to evade automated malware analysis, and uses HTTP POST requests to interact with its C&C server. The system data it collects includes a list of running processes, information gathered via the ”systeminfo” command, local disk information, and a screenshot of the desktop.

If the server responds with an encoded payload, the malware saves it to disk, and creates an auto run registry key to ensure the payload is executed at user login. The secondary payload was found to be another Trojan written in the Go language, also meant to download additional tools onto the compromised system, Palo Alto Networks says.

“The Sofacy group continues to use variants of the Zebrocy payload in its attack campaigns. It is also apparent that the Sofacy group will use these new variants of Zebrocy across multiple different campaigns, as the Go variant of Zebrocy was delivered via the LNK shortcut and a Dear Joohn delivery document,” Palo Alto Networks concludes.

Related: Russia-Linked Phishing Attacks Hit Government Agencies on Four Continents

Related: Infamous Russian Hacking Group Used New Trojan in Recent Attacks