[FireEye]DHS and FBI Joint Analysis Report Confirms FireEye’s Assessment that Russian Government Likely Sponsors APT28 and APT29

[igor51]

DHS and FBI Joint Analysis Report Confirms FireEye’s Assessment that
Russian Government Likely Sponsors APT28 and APT29

On Dec. 29, 2016, the Department of Homeland Security (DHS) and
  Federal Bureau of Investigation (FBI) released a Joint Analysis Report
  confirming FireEye’s long held public assessment that the Russian
  government likely sponsors the groups that we track as Advanced
  Persistent Threat (APT) 28 and APT29. We have tracked and profiled
  these groups through multiple investigations, endpoint and network
  detections, and continuous monitoring, allowing us to understand the
  groups’ malware, operational changes and motivations. This
  intelligence has been critical to protecting and informing our clients
  and exposing this threat.

 

FireEye first publicly announced that the Russian government likely
  sponsors APT28 in a     href="https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html">report
    released in October 2014. APT28 has pursued military and
  political targets in the U.S. and globally, including U.S. political
  organizations, anti-doping agencies, NGOs, foreign and defense
  ministries, defense attaches, media outlets, and high profile
  government and private sector entities. Since at least 2007, APT28 has
  conducted operations using a sophisticated set of malware that employs
  a flexible, modular framework allowing APT28 to consistently evolve
  its toolset for future operations. APT28’s operations closely align
  with Russian military interests and the 2016 breaches, and pursuant
  public data leaks demonstrate the Russian government's wide-ranging
  approach to advancing its strategic political interests.

 

In July 2015, we released a report focusing on a tool used by APT29,
  malware that we call   href="https://www.fireeye.com/blog/threat-research/2015/07/hammertoss_stealthy.html">HAMMERTOSS.
  In detailing the sophistication and attention to obfuscation evident
  in HAMMERTOSS, we sought to explain how APT29’s tool development
  effort defined a clandestine, well-resourced and state-sponsored
  effort. Additionally, we have observed APT29 target and breach
  entities including government agencies, universities, law firms and
  private sector targets. APT29 remains one of the most capable groups
  that we track, and the group’s past and recent activity is consistent
  with state espionage.

 

The Joint Analysis Report also includes indicators for another group
  we (then iSIGHT Partners) profiled publicly in 2014: Sandworm Team.
  Since 2009, this group has targeted entities in the energy,
  transportation and financial services industries. They have deployed
  destructive malware that impacted the power grid in Ukraine in late
  2015 and used related malware to affect a Ukrainian ministry and other
  financial entities in December 2016. Chiefly characterized by their
  use of the well-known Black Energy trojan, Sandworm Team has often
  retrofitted publicly available malware to further their offensive
  operations. Sandworm Team has exhibited considerable skill and used
  extensive resources to conduct offensive operations. 

Source: DHS and FBI Joint Analysis Report Confirms FireEye’s Assessment that
Russian Government Likely Sponsors APT28 and APT29