Threat actors are lurking for potential victims by scouting the web for vulnerabilities they can penetrate and systems to infiltrate.
Hackers groups, like Potao Express, BlackEnergy and Turla, account for as many as 79 unique malware families that have been used to hack several European government and military computers, as well as other “high-value” targets in Ukraine, Russia, Georgia, Belarus and others.
Gathering the patterns and data, Check Point Research and genetic malware analysis firm Intezer, created the first-ever comprehensive analysis to visualize the attacks state-sponsored Russian-attributed threat groups have been doing.
"The Russian APT map is a web-based, interactive map that shows the different families and actors that are part of the Russian APT ecosystem, as well as the connections between them. The map is basically a one stop shop for anyone who is interested to learn and understand the connections and attributions of the samples, modules, families and actors that together are building this ecosystem."
Showcasing the map, Itay Cohen from Check Point Research and Omri Ben Bassat from Intezer, said that:
It should be noted that all Russia's state-sponsored cyberespionage operations, including the 2016 U.S. elections hack and the Petya ransomware attacks on Ukraine, have been attributed to only three intelligence services: the FSB (Federal Security Service), the SVR (Foreign Intelligence Service), and GRU (Main Intelligence Directorate for Russia’s military).
None of which however, directly collaborate with one another.
As a result, the researchers hypothesize that Russia is able to ignore the overlap in malware tools and libraries developed by various attack groups, underscoring the sprawling scale of the country’s internet espionage and sabotage operations.
"The biggest challenge problem we had was that there is no naming standardization for malware and threat actors in the infosec industry," Cohen said. "We had to step carefully between different articles and research papers and draw the lines."
The web-based map is made as intuitive and rich with information as possible.
By collecting, classifying and analyzing approximately 2,000 Russian APT malware samples, the map shows about 22,000 connections between the samples that shared 3.85 million pieces of code. The samples fall into 60 families and 200 different modules, per the analysis.
“While each actor does reuse its code in different operations and between different malware families, there is no single tool, library or framework that is shared between different actors,” the researchers said.
Using the map, users should get an overview of the ecosystem or go down to the details into specific connections. By clicking on nodes in the graph for example, will reveal a side panel containing information about the malware family the node belongs to, as well as links to analysis reports on Intezer’s platform and external links to related articles and publications.
Along with this map, Check Point Research and Intezer also created a tool they named 'Russian APT Detector'.
The developers have made this map and its data open source on GitHub, as they invite anyone interested in the project to add more information and improve it.
