Botconf Author Listing

Sednit, a.k.a. Fancy Bear/APT28/Sofacy, is a group of attackers operating since at least 2004 and whose main objective is to steal confidential information from specific targets. Over the past two years, this group’s activity increased significantly, in particular with numerous attacks against foreign affairs ministries and embassies all over the world.
Technically speaking, Sednit is probably one of the best espionage groups out there. Not only have they created a complex software ecosystem — composed of tens of different components –, but they also regularly come out with 0-day exploits. Also remarkable is their ability to very quickly integrate newly published techniques in their toolkit.
This talk presents the results of a two-year hunt after Sednit, during which we dug up and analyzed many of their software. In particular, we will delve into technical details of their most impressive components:
– DOWNDELPH, a mysterious downloader deployed in rare cases and with advanced persistence methods. In particular, we found a Windows bootkit dropping this component, and also a Windows rootkit, both never documented.
– XTUNNEL, a network proxy tool able to transform an infected machine into a pivot to contact computers normally unreachable from the Internet. Heavily obfuscated, and based on a custom encrypted protocol, XTUNNEL is a major asset in Sednit post-infection toolkit.
– XAGENT, the flagship Sednit backdoor, for which Windows, Linux and iOS versions have been developed. Built as a modular framework around a so-called “kernel”, it allows to build flexible backdoors with, for example, the ability to switch between various network protocols.
– SEDKIT, a full-fledged exploit-kit, which depending on the target’s configuration may drop 0-day exploits or revamped exploits.
During our tracking, we also gained a great visibility on Sednit post-infection modus operandi, a world full of Mimikatz and various custom hacking tools.