StrongPity, an APT group active since at least 2012 and first publically reported in 2016, has mostly focused on countries like Italy and Belgium. Now expanded its scope of attack across Northern Africa, Europe, Asia, and Canada
Quick Review
StrongPity focuses on finding and exfiltrating data from infected machines and runs a series of fake websites that lure users with an array of software tools. These tools are trojanized versions of genuine applications.
- The APT selectively targets victims using a predefined IP list. If a victim’s IP address matches the one in the installer’s configuration file, the group delivers a trojanized version of the application, otherwise a legitimate version.
- Once installed, the malware triggers an exfiltration component that executes a file-searching mechanism tasked for looping via drives, looking for files with some specific extensions defined by attackers.
- If found, the files are stored in a temporary (.ZIP) archive. Then, split into hidden (.SFT) encrypted files and sent to the C2 server. Finally, these files are deleted from the disk to hide any evidence of exfiltration.
- The APT uses two types of servers – download servers that propagate the malicious installer used in the initial compromise of victims and C2 servers.
Hacker-for-hire groups
Besides StrongPity, there are several other hacker-for-hire mercenary groups that are actively offering their services and have been observed expanding their scope of attacks.
- A hacker-for-hire group Death Stalker was observed using a new PowerShell backdoor in their attacks, in early-December.
- CostaRica was found operating a global espionage campaign on multiple continents.
Conclusion
Hackers-for-hire mercenaries are now becoming popular and many nation-states have been found using their services for espionage. Thus, experts suggest organizations stay protected by deploying web and email filters on the network, segmentation of any critical networks, and advising their employees to use legitimate software downloaded from official sources
