Apt29 Evolving Diplomatic Phishing

During the lead up to Ukraine's counteroffensive, Mandiant and Google’s Threat Analysis Group (TAG) have tracked an increase in the frequency and scope of APT29 phishing operations. Investigations into the group’s recent activity have identified an intensification of operations centered on foreign embassies in Ukraine. Notably, as part of this activity, we have seen phishing emails targeting a wide range of diplomatic representations in Kyiv including those of Moscow’s partners, representing the first time we have observed this cluster of APT29 activity pursuing governments strategically aligned with Russia. Based on the timing and focus of APT29’s Ukraine-focused operations, we judge they are intended to aid Russia’s Foreign Intelligence Service (SVR) in intelligence collection concerning the current pivotal phase of the war.

APT29’s increased phishing activity in Ukraine has occurred alongside an uptick in the group’s more routine espionage operations against global diplomatic entities. Across these malware delivery operations, APT29 continues to prioritise European Ministries of Foreign Affairs and embassies, but it has also sustained operations that are global in scope and illustrative of Russia’s far-reaching ambitions and interests in other regions. The current secondary focus is concentrated in Asia, with governments in Türkiye (formerly known as Turkey), India, and other regions of vital strategic importance to Moscow such as Africa factoring into its 2023 priorities. We judge that Russia’s war in Ukraine has almost certainly shaped APT29’s espionage priorities, but it has not supplanted them.

We track this diplomatic-focused phishing activity as operationally distinct from APT29’s ongoing initial access operations targeting cloud-based Microsoft products . Although APT29’s cloud-focused exploitation may lead to the compromise of diplomatic entities, variance in the scale, quality and targeting patterns of the two lines of effort indicate that they are highly likely distinct initial access clusters operating with different priorities and levels of capability. However, we continue to see significant overlap in post-compromise methods across both lines of effort, indicating that multiple initial access teams may hand-off to a centralized exploitation team once inside a victim environment.

Figure 1: APT29’s distinct initial access clusters

Alongside the increased pace of operations and changes in targeting, we have also seen a major shift in the group’s tooling and tradecraft. APT29 has rebuilt several of its tools and has made repeated iterative modifications to its existing malware delivery chain, likely to ensure its operational longevity despite long-term persistent use. We assess that several of these changes are highly likely specifically designed to sidestep research methods and tools commonly used by the threat intelligence community to track their operations, indicating that operational security priorities continue to factor heavily into APT29’s tooling decisions.

Starting in 2021, APT29 adopted a tactic called HTML smuggling in its malware delivery operations, hiding its first-stage JavaScript dropper in malicious HTML attachments we call ROOTSAW (also known as EnvyScout ). As detailed in research by Mandiant , CERT-Polska , Palo Alto Networks and others, ROOTSAW has been a constant feature of APT29's operations over the past two years and has been the primary vehicle to decode and deliver the group’s stage malware. Upon opening the archive file, victims are presented with either a Windows shortcut (LNK) file or a legitimate software binary, that when opened, executes an accompanying DLL, leading to commodity backdoors such as BEACON or BRC4 (Brute Ratel C4) executing on the system.

ROOTSAW’s central and continued role in APT29 operations has spurred changes to the malware delivery chain over time. The most visible change has been the move away from HTML attachments as the initial infection vector, with APT29 shifting to hosting its first-stage payloads on compromised web services such as WordPress sites. Migrating the first-stage payload server side has likely provided APT29 a greater degree of control over its malware delivery chain and allowed the group to be more judicious the exposure of its later-stage capabilities. For example, to prevent detection of malware in environments not intended for compromise, APT29 has implemented various forms of filtering in its first-stage payloads and has removed staged malware from compromised servers shortly after operational use. Notably, these efforts have also prevented payloads being acquired by public malware repositories and other common security research tools, helping to avoid detection and extend the operational lifespan of its newer malware variants.

Figure 2: APT29’s diverse first-stage delivery methods

As shown the following campaigns tracked throughout the first half of 2023 detail, APT29 has made continuous, iterative efforts to introduce additional obfuscation and anti-analysis components into its operations. The group has experimented with various obfuscation techniques such as the use of JavaScript Obfuscator , delivery and execution guardrails, hosting decryption keys server side, and delivering decoy documents when victim profiling checks fail. In this accelerated period of tooling evolution, the group has also begun to rotate in novel malware delivery tools and techniques instead of its mainstay first-stage payload.

In March 2023, Mandiant identified a new APT29 phishing campaign targeting Türkiye. The phishing waves impersonated the Turkish Deputy Minister of Foreign Affairs and included a phishing link accompanied by content related to the February 2023 earthquake that struck southern Türkiye.

In both waves, APT29 incorporated a new version of ROOTSAW with added user-agent based anti-analysis guardrails. This variant checks the user-agent of the device, looking for Windows operating systems that do not contain “.NET” and contain the value “Windows NT”. As a result, if the victim is running a non-Windows based operating system or the request is made through .NET, the server will deliver a decoy PDF file. In the second wave, this PDF file was identical to the version contained in the malicious ZIP payload. This filtering tactic is likely used to identify automated downloaders and non-compatible victim devices, further reducing the odds of exposing malware in non-compromise contexts. Each payload within the new ROOTSAW variant is obfuscated using a unique key, although the deobfuscation routine remains the same.

Figure 3: ROOTSAW user-agent and operating system check to determine which file to deploy

In an additional phishing campaign in March 2023, APT29 targeted various diplomatic missions in Europe. Notably, in the two weeks that lapsed between the Turkey campaign, further changes were identified resulting in two new variants of ROOTSAW that shifted the newly added anti-analysis guardrails server side.

Figure 4: ROOTSAW payload decryption routine

In April 2023, APT29 continued to modify its standard malware delivery chain, introducing a new technique for malware delivery. In this operation, APT29 re-used one its frequent diplomatic event-themed lure documents spoofing the Czechia Embassy (more commonly known as the Czech Republic) that invited targets to a wine tasting event on April 13, 2023. The document contained a link to the phishing website “ which delivered either an ISO or a ZIP archive to the victim.

In May, in the lead up to Ukraine’s counteroffensive, APT29 conducted two distinct phishing waves targeting a wide range of diplomatic representations in Kyiv, including those of Moscow’s partners. Each campaign adopted separate intrusion chains similar to those seen in March and April 2023.

Figure 5: Likely repurposed legitimate invite to a charity concert in Ukraine

In late June, Mandiant identified an additional APT29 phishing campaign with a new variant of ROOTSAW to target a European government. Phishing emails were sent from a compromised North American government email address and crafted to appear as an invitation to a public holiday celebration from Norwegian embassy personnel. Two different delivery mechanisms were used in this campaign, a PDF (MD5: b4141aa8d234137f0b9549a448158a95) containing a link to an actor-hosted ROOTSAW variant, and emails with an attached Scalable Vector Graphic (SVG) file (MD5: 295527e2e38da97167979ade004de880) rather than the typical HTML payload.

Figure 6: Traditional 404 error from compromised APT29 infrastructure

Figure 7: 404 error from IP filtered by APT29

In July, APT29 continued to experiment with new ROOTSAW delivery mechanisms and victim filtering capabilities in an operation deploying a new downloader ICEBEAT to target European diplomatic entities. Emails were sent purporting to be an invite from a non-specified German embassy for an Ambassador’s farewell reception. Of note, ICEBEAT’s use of the open source Zulip messaging platform for command and control (C2) follows a pattern of past APT29 downloaders using legitimate services for command and control including Dropbox, Firebase, OneDrive and Trello.

Figure 8: Decoy lure used by APT29 for filtered victims

Figure 9: PDF decoy document used during successful malware delivery

Beyond the continued adaptation of APT29’s malware delivery chain, Mandiant has also observed dedicated efforts to update and evolve the group’s later-stage malware into multiple variations, increasing the quantity and quality of tooling used across its campaigns. At least six distinct downloaders have been identified during the first half of 2023:

DAVESHELL is shellcode that functions as an in-memory dropper relying on reflective injection. Its embedded payload is mapped into memory and executed. DAVESHELL is based in the public available repository .

Figure 10: APT29’s Second-Stage Downloaders Used in 2023

As noted in the June 2023 campaign, we have also witnessed APT29 operating various infection chains simultaneously within a single campaign, suggesting that distinct initial access operators or subteams may be operating in parallel to service different regional targets or espionage objectives. Although we have been unable to ascertain the specific logic behind decisions which malware delivery approach to use or when to introduce new later-stage malware variants, we judge with low confidence that they are likely driven by mission-specific parameters such as targets or operational objectives.

The increased scope and frequency of APT29's diplomatic-focused spear phishing campaigns in the first half of 2023 has compelled the initial access team to make repeated modifications to its long-standing malware delivery chain. Efforts to move capabilities server side, introduce anti-analysis components, and deliver decoy documents in non-compromise contexts have likely helped the group extend the shelf-life of its ROOTSAW-centred concept of operations. Even with this unprecedented pace of change, the group has remained highly operational security conscious, and has taken repeated steps to circumvent the methods that security researchers use to track and respond to its activity.

APT29's increased operational tempo has also exposed patterns of operations that likely reflect different initial access operators or subteams supported by a centralized development team. More generally, these patterns likely reflect a growing mission and pool of resources dedicated to collecting political intelligence and that group will almost certainly continue to pose a high severity threat to governments and diplomatic entities globally.

As part of our efforts to combat serious threat actors, TAG uses the results of our research to improve the safety and security of Google’s products. Upon discovery, all identified websites and domains are added to Safe Browsing to protect users from further exploitation. TAG also sends all targeted Gmail and Workspace users government-backed attacker alerts notifying them of the activity and encourages potential targets to enable Enhanced Safe Browsing for Chrome and ensure that all devices are updated. Where possible, Mandiant sends victim notifications via the Victim Notification Program . We are committed to sharing our findings with the security community to raise awareness, and with companies and individuals that might have been targeted by these activities. We hope that improved understanding of tactics and techniques will enhance threat hunting capabilities and lead to stronger user protections across the industry.

Mandiant Advantage Security Validation can automate the following process to give you real data on how your security controls are performing against these threats.

The following table is a subset of MSV actions for one of the malware variants. Find out more Mandiant Security Validation .

Malicious Activity Scenario - APT29 Continues to Leverage Meeting Agenda Themes, ROOTSAW, SALTSHAKER to Target European Diplomatic Entities

Malicious Activity Scenario - APT29 Uses BEATDROP and BOOMMIC to Deploy BEACON

Malicious Activity Scenario - APT29 Targets with ROOTSAW, FANCYBEAT Downloaders, Variant #1

Phishing Email - Malicious Link, APT29, MUSKYBEAT, Variant #1

Command and Control - APT29, MUSKYBEAT , DNS Query

Malicious File Transfer - APT29, MUSKYBEAT Dropper, Download, Variant #1

Malicious File Transfer - APT29, MUSKYBEAT, Download, Variant #1

By Google Threat Intelligence Group • 18-minute read