Russian APT Hackers Co-Opt Pakistani Infrastructure

A Russian state hacking group hijacked the command and control infrastructure of a Pakistan-based espionage network as part of an ongoing intelligence-gathering operation targeting victims in Asia, finds a report from Microsoft and Black Lotus Labs.

See Also: OnDemand | 2024 Phishing Insights: What 11.9 Million User Behaviors Reveal About Your Risk

Microsoft attributed the hacks to a Russian advanced persistent group it tracks as Secret Blizzard. The group also known as KRYPTON, Venomous Bear, Snake and Turla Team is part of the Russian state security agency Federal Security Service, specifically unit known as Center 16.

Russian hackers began compromising the infrastructure of a Pakistan-based espionage cluster that Microsoft has been tracking as Storm-0156 since at least November 2022, using its backdoors to deploy its own backdoors.

“While not unique, leveraging the access of other adversaries is a somewhat unusual attack vector for threat actors in general,” Microsoft wrote – a demonstration of the FSB’s commitment to diversifying attack vectors.

Microsoft said it is unclear how Secret Blizzard compromised Storm-0156. Among the backdoor variants deployed by the FSB was Tiny Turla, disguised as a Windows-based service that configured control servers. It has also used a .NET backdoor that Microsoft tracks as “TwoDash,” and a custom Trojan called “Statuezy” that monitors and logs data. The threat group also deployed another custom malware downloader called “MiniPocket.”

The victims include Afghanistan’s Ministry of Foreign Affairs, the General Directorate of Intelligence, and the country’s foreign consulates.

“In each of these cases, we observed the deployment of Storm-0156 backdoors which were subsequently used to download the Secret Blizzard tools to target devices in Afghanistan,” Microsoft said.

Although in India, the group avoided direct deployment of its tools – a potential indicator of the political decision made within the FSB, Microsoft said.

Secret Blizzard Malware Infrastructure Adoption

The Russian threat group primarily focuses on gaining long-term access for extensive espionage activities through the use of multiple command and control infrastructure, and malware backdoor.

This isn’t the first time the FSB has decided to usurp malicious infrastructure. Previous examples include use of the Iranian advanced persistent group OilRig to target victims in the Middle East, re-using Andromeda commodity malware to deploy backdoor and co-opting malware developed by Kazakhstan-based threat actor to target victims in Central Asia.

“Leveraging this type of resource has both advantages and drawbacks,” said Microsoft. While co-opting or hijacking established infrastructure can help to establish footholds with minimal effort, the disadvantage is that “the information obtained through this technique may not align entirely with Secret Blizzard’s collection priorities.”

If the threat actor that established the initial foothold has poor operational security, co-optation also risks triggering endpoint or network security alerts, potentially exposing FSB activities.