Palo Alto Networks

Sofacy

Dear Joohn: The Sofacy Group’s Global Campaign

As alluded to in our previous blog regarding the Cannon tool, the Sofacy group (AKA Fancy Bear, APT28, STRONTIUM, Pawn Storm, Sednit) has persistently attacked various government and private organizations around the world from mid-October 2018 through mid-November 2018. The majority of targets were NATO-aligned nation states, al...

Unit 42

Dec 12, 2018

By Bryan Lee and Robert Falcone

Palo Alto Networks

Products and Services

Partners

News of the Week

News of the Week: November 24, 2018

Did you miss any of this week’s Palo Alto Networks action? Don’t worry – we’ve rounded up our top news and views right here:

Nov 24, 2018

By Justin Hall

Unit 42

Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan

In late October and early November 2018, Unit 42 intercepted a series of weaponized documents that use a technique to load remote templates containing a malicious macro. These type...

Nov 20, 2018

By Robert Falcone and Bryan Lee

News of the Week

News of the Week: June 9, 2018

Did you miss any of this week’s Palo Alto Networks action? Don’t worry – we’ve rounded up our top news and views right here:

Jun 09, 2018

By Justin Hall

Unit 42

Sofacy Group’s Parallel Attacks

The Sofacy group remains a persistent global threat. Unit 42 and others have shown in the first half of 2018 how this threat actor group continues to target multiple organizations throughout the world with a strong emphasis on government, diplomatic and other strategic...

Jun 06, 2018

By Bryan Lee and Robert Falcone

Unit 42

Sofacy Uses DealersChoice to Target European Government Agency

Back in October 2016, Unit 42 published an initial analysis on a Flash exploitation framework used by the Sofacy threat group called DealersChoice. The attack consisted of Microsof...

Mar 15, 2018

By Robert Falcone

Unit 42

Sofacy Attacks Multiple Government Entities

The Sofacy group (AKA APT28, Fancy Bear, STRONTIUM, Sednit, Tsar Team, Pawn Storm) is a well-known adversary that remains highly active in the new calendar year of 2018. Unit 42 actively monitors this group due...

Feb 28, 2018

By Bryan Lee, Mike Harbison and Robert Falcone

Threat Brief, Unit 42

Threat Brief: Sofacy Group Targeting European and North American Diplomats

Palo Alto Networks Unit 42 threat research team has just uncovered a new set of attacks by the Sofacy group using malicious emails targeting foreign affairs agencies and ministries...

Feb 28, 2018

By Christopher Budd

Unit 42

XAgentOSX: Sofacy’s XAgent macOS Tool

During our continued research on Sofacy’s Komplex Trojan, we have found a sample of a backdoor Trojan that we believe the Sofacy group uses when targeting individuals running macOS systems. The backdoor Trojan authors have called it XAgentOSX, which shares the name XAge...

Feb 14, 2017

By Robert Falcone

Unit 42

Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue

Recently, Palo Alto Networks Unit 42 reported on a new exploitation platform that we called “DealersChoice” in use by the Sofacy group (AKA APT28, Fancy Bear, STRONTIUM, Pawn Storm...

Dec 15, 2016

By Robert Falcone and Bryan Lee

Unit 42

‘DealersChoice’ is Sofacy’s Flash Player Exploit Platform

Unit 42 has reported on various Sofacy group attacks over the last year, most recently with a post on Komplex, an OS X variant of a tool commonly used by the Sofacy group. In the same timeframe of the Komplex a...

Oct 17, 2016

By Robert Falcone and Bryan Lee

Events, News of the Week

Palo Alto Networks News of the Week – October 1, 2016

Did you miss any of this week’s Palo Alto Networks action? Don’t worry, we’ve rounded up the top news right here.

Oct 01, 2016

By Justin Hall

Unit 42

Sofacy’s ‘Komplex’ OS X Trojan

Unit 42 researchers identified a new OS X Trojan associated with the Sofacy group that we are now tracking with the 'Komplex' tag using the Palo Alto Networks AutoFocus threat intelligence platform.

Sep 26, 2016

By Dani Creus, Tyler Halfpop and Robert Falcone

Events, News of the Week

Palo Alto Networks News of the Week – July 23, 2016

Unit 42 found Andromeda malware targeting Italian users in recent spam campaigns, and shared a technical walkthrough of the Office Test persistence method used in recent Sofacy attacks. The team also discovered...

Jul 23, 2016

By Anna Lough

Threat Prevention, Uncategorized, Unit 42

Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy...

As mentioned in our previous blog, we observed the Sofacy group using a new persistence mechanism that we call “Office Test” to load their Trojan each...

Jul 20, 2016

By Robert Falcone

Events, News of the Week

Palo Alto Networks News of the Week – June 18

Unit 42 identified a spear phishing attack from the Sofacy group targeting the United States government. The news was covered by SecurityWeek and Ars Technica, among others.

Jun 18, 2016

By Anna Lough

Unit 42

New Sofacy Attacks Against US Government Agency

The Sofacy group, also known as APT28, is a well-known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted t...

Jun 14, 2016

By Robert Falcone and Bryan Lee

Malware, Threat Prevention, Unit 42

A Look Into Fysbis: Sofacy’s Linux Backdoor

The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia. Their targets have spanned all across the world, with a focus on government, defen...

Feb 12, 2016

By Bryan Lee and Rob Downs

Load more blogs