Threat Flash Alert: Nobelium Spear-Phishing Campaign

Executive Summary

Microsoft’s Threat Intelligence Center (MSTIC) has released an advisory pertaining to a new Spear-Phishing campaign by the Russian threat group dubbed Nobelium.  Nobelium has been labeled responsible for the Solar Winds compromise that took place in 2020.   The start date for this campaign dates back to January 28^th, 2021.  However, the campaign escalated in late May of 2021.  Additional information beyond what is provided in this Threat Flash Alert is available in the linked sources below.

Details

MSTIC initially discovered the campaign in February 2021, by identifying a wave of phishing emails that leveraged the Google ‘Firebase’ platform to stage an ISO file containing malicious content. They utilized this platform to also record attributes of those who access the URL.

This new campaign is taking advantage of the legitimate service Constant Contact to send these malicious links.  The initial wave of these phishing emails appeared as a USAID special alert and contain links to this USAID “special Alert”.

This email affects email platforms and device types in different ways, including Apple and Linux machines.  This is considered a spear-phishing campaign as the emails are tailored for the individual organizations they are targeting.

The email sender address is oriented different for each recipient but all end with the same @ domain “@in.constantcontact.com”.  Due to the sender address these phishing emails easily bypass spam filters.

The current stage of this campaign aims to compromise systems through an HTML file attached to the spear-phishing email.  When this file is opened by the user, a JavaScript within the HTML file writes an ISO file to disc and then encourages the target to open it. This results in the ISO file being mounted similar to an external or network drive.

After being mounted a shortcut file (LNK) executes a DLL which installed and executes a Cobalt Strike Beacon.

Below is an example of the phishing sent by the threat actor impersonating the U.S. Agency for International Development:

May 25^th campaign Indicators of Compromise:

MITRE ATT&CK techniques observed

This threat makes use of attacker techniques documented in the MITRE ATT&CK framework

Initial access

T1566.003 Phishing: Spearphishing via Service—NOBELIUM used the legitimate mass mailing service, Constant Contact to send their emails.

T1566.002  Phishing: Spearphishing Link—The emails sent by NOBELIUM includes a URL that directs a user to the legitimate Constant Contact service that redirects to NOBELIUM-controlled infrastructure.

Execution

T1610 Deploy Container—Payload is delivered via an ISO file which is mounted on target computers.

T1204.001 User Execution: Malicious Link—Cobalt Strike Beacon payload is executed via a malicious link (LNK) file.

Command and control

T1071.001 Application Layer Protocol: Web Protocols—Cobalt Strike Beacons call out to attacker infrastructure via port 443.

Recommendations

At this time we are encouraging organizations to investigate and monitor communications matching the characteristics described below.

Currently mitigations include the following:

• Turning on cloud-delivered protection in your anti-virus or the equivalent in your antivirus products.
• Run Endpoint Detection and Response (EDR) in block mode
• Investigate any recent emails from Constant Contact sender domain
• Inform any employees that this campaign is occurring and to redirect any emails to the appropriate abuse department in your organization and no interaction with the emails should occur
• Enable network protection from accessing malicious domains or other malicious content
• Enable Multi-Factor Authentication (MFA) or two-factor authentication
• Use attack surface reduction rules to block or audit activity associated with this threat. Example rule would be to block all Office applications from creating child processes or block executable files from running unless they meet a prevalence age or trusted list criteria

These may have unintended business consequences, as such it is important to assess and test any security controls implemented for any unforeseen issues that may occur.

SOD Actions

As information is made available, the Security on Demand Threat Recon Unit will continue to monitor these events as information is forthcoming and will update your organization if any patching or additional security controls become available.  Please contact us if you have any questions or concerns regarding this ongoing situation.

Sources

https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

https://threatpost.com/solarwinds-nobelium-phishing-attack-usaid/166531/

https://www.zdnet.com/article/microsoft-warns-of-current-nobelium-phishing-campaign-impersonating-usaid/