{"id":86932,"date":"2018-12-03T08:00:10","date_gmt":"2018-12-03T16:00:10","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/?p=86932"},"modified":"2025-12-16T08:17:47","modified_gmt":"2025-12-16T16:17:47","slug":"analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/12\/03\/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers\/","title":{"rendered":"Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers"},"content":{"rendered":"\n

Reuters recently reported a hacking campaign focused on a wide range of targets across the globe. In the days leading to the Reuters publication, Microsoft researchers were closely tracking the same campaign.<\/p>\n\n\n\n

Our sensors revealed that the campaign primarily targeted public sector institutions and non-governmental organizations like think tanks and research centers, but also included educational institutions and private-sector corporations in the oil and gas, chemical, and hospitality industries.<\/p>\n\n\n\n

Microsoft customers using the complete Microsoft Threat Protection<\/a> solution were protected from the attack. Behavior-based protections in multiple Microsoft Threat Protection components blocked malicious activities and exposed the attack at its early stages. Office 365 Advanced Threat Protection<\/a> caught the malicious URLs used in emails, driving the blocking of said emails, including first-seen samples. Meanwhile, numerous alerts in Windows Defender Advanced Threat Protection<\/a> exposed the attacker techniques across the attack chain.<\/p>\n\n\n\n

Third-party security researchers have attributed the attack to a threat actor named APT29 or CozyBear, which largely overlaps with the activity group that Microsoft calls YTTRIUM. While our fellow analysts make a compelling case, Microsoft does not yet believe that enough evidence exists to attribute this campaign to YTTRIUM.<\/p>\n\n\n\n

Regardless, due to the nature of the victims, and because the campaign features characteristics of previously observed nation-state attacks, Microsoft took the step of notifying thousands of individual recipients in hundreds of targeted organizations. As part of the Defending Democracy Program<\/a>, Microsoft encourages eligible organizations to participate in Microsoft AccountGuard<\/a>, a service designed to help these highly targeted customers protect themselves from cybersecurity threats.<\/p>\n\n\n\n

Attack overview<\/h2>\n\n\n\n

The aggressive campaign began early in the morning of Wednesday, November 14. The targeting appeared to focus on organizations that are involved with policy formulation and politics or have some influence in that area.<\/p>\n\n\n\n

\"Phishing<\/figure>\n\n\n\n

Phishing targets in different industry verticals<\/em><\/p>\n\n\n\n

Although targets are distributed across the globe, majority are located in the United States, particularly in and around Washington, D.C. Other targets are in Europe, Hong Kong, India, and Canada.<\/p>\n\n\n\n

\"Phishing<\/figure>\n\n\n\n

Phishing targets in different locations<\/em><\/p>\n\n\n\n

The spear-phishing emails mimicked sharing notifications from OneDrive and, as noted by Reuters, impersonated the identity of individuals working at the United States Department of State. If recipients clicked a link on the spear-phishing emails, they began an exploitation chain that resulted in the implantation of a DLL backdoor that gave the attackers remote access to the recipients\u2019 machines.<\/p>\n\n\n\n

\"Attack<\/figure>\n\n\n\n

Attack chain<\/em><\/p>\n\n\n\n

Analysis of the campaign<\/h2>\n\n\n\n

Delivery<\/h3>\n\n\n\n

The spear-phishing emails used in this attack resemble file-sharing notifications from OneDrive.<\/p>\n\n\n\n

\"spear-phishing<\/figure>\n\n\n\n

The emails contain a link to a legitimate, but compromised third-party website:<\/p>\n\n\n

\nhxxps:\/\/www.jmj.com\/personal\/nauerthn_state_gov\/TUJE7QJl[random string]\n<\/pre><\/div>\n\n\n
The random strings are likely used to identify distinct targeted individuals who clicked on the link. However, all observed variants of this link redirect to a specific link on the same site:<\/p>\n\n\n
\nhxxps:\/\/www.jmj.com\/personal\/nauerthn_state_gov\/VFVKRTdRSm\n<\/pre><\/div>\n\n\n
When users click the link, they are served a ZIP archive containing a malicious LNK file. All files in a given attack have the same file name, for example, ds7002.pdf<\/em>, ds7002.zip<\/em>, and ds7002.lnk<\/em>.<\/p>\n\n\n\n
Installation<\/h3>\n\n\n\n
The LNK file represents the first stage of the attack. It executes an obfuscated PowerShell command that extracts a base64-encoded payload from within the LNK file itself, starting at offset 0x5e2be<\/em> and extending 16,632 bytes.<\/p>\n\n\n\n
\"Encoded<\/figure>\n\n\n\n
Encoded content in the LNK file<\/em><\/p>\n\n\n\n
The encoded payload\u2014another heavily obfuscated PowerShell script\u2014is decoded and executed:<\/p>\n\n\n\n
\"Decoded<\/figure>\n\n\n\n
Decoded second script<\/em><\/p>\n\n\n\n
The second script carves out two additional resources from within the .LNK file:<\/p>\n\n\n\n