APT29
APT29, also known as Midnight Blizzard, BlueBravo, or Cozy Bear, has been identified using a new backdoor variant called WINELOADER to target German political parties. This campaign marks a significant shift in the group’s focus from its traditional targets—diplomatic missions—to political entities, indicating a broader operational intent to gather political intelligence.
Target and Timing:
📌The campaign specifically targeted German political parties, with phishing emails sent around February 26, 2024. These emails featured a logo from the Christian Democratic Union (CDU) and included malicious links.
Technical Details:
📌WINELOADER is believed to be a variant of the non-public historic BURNTBATTER and MUSKYBEAT code families, which have been uniquely associated with APT29 by Mandiant.
📌The malware employs sophisticated techniques such as DLL side-loading, RC4 encryption for payload decryption, and evasion tactics like process/DLL name checks and Ntdll usermode hook bypass.
Initial Access:
📌The initial access was achieved through phishing attachments leading to a compromised website, «waterforvoiceless[.]org, » which hosted the ROOTSAW dropper. This dropper then facilitated the download and execution of the WINELOADER payload.
Operational Significance:
📌This shift to targeting political parties reflects growing interest in influencing or understanding Western political dynamics, especially in the context of ongoing geopolitical tensions.
📌The targeting of political parties is seen as a strategic move to gather actionable intelligence that could potentially influence political outcomes or strategies in Europe and beyond.
Broader Implications:
📌The campaign against German political parties is not seen as an isolated incident but rather part of a broader strategy that could target other Western political entities.
Vkontakte
Twitter
Одноклассники
