The notorious hacker group APT28 has launched a sophisticated campaign to distribute HeadLace malware through deceptive car sale advertisements. This new tactic, which began in March 2024, targets diplomats, leveraging fake car ads to mask their malicious intent.
APT28, also known as Fighting Ursa, Fancy Bear, or Sofacy, is a prominent advanced persistent threat (APT) group linked to Russian military intelligence. This group has a long history of employing elaborate phishing schemes to deliver malware, and their latest campaign follows a similar pattern.
The Deceptive Car Ad Campaign Leads to HeadLace Malware Attack
The deceptive car ad campaign centers around fake advertisements for luxury cars, a tactic that has become a staple for cybercriminals. In this instance, APT28 used a fraudulent ad for an Audi Q7 Quattro SUV as bait. The ad was crafted to appeal to diplomats, using the guise of a legitimate car sale to lure victims into clicking malicious links.
Unit 42, the threat intelligence team at Palo Alto Networks, revealed that APT28 exploited public and free services to execute their attack. The malicious link was hosted on Webhook.site, a service typically used for creating randomized URLs for development projects. By leveraging this legitimate service, the hackers could distribute a malicious HTML document without raising immediate suspicion.
The HTML file was designed to execute a multi-stage infection process, starting with an automated check to determine if the victim’s system was running Windows.
If the system was identified as non-Windows, the HTML redirected the user to a decoy image hosted on ImgBB, another free service. For Windows users, the file initiated a download of a ZIP archive containing malware.
Dissecting the HeadLace Malware Attack
The ZIP file, labeled “IMG-387470302099.zip,” contained three files: an executable disguised as an image, a DLL library, and a batch file. The disguised executable, named “IMG-387470302099.jpg.exe,” appeared as a benign image but actually contained a copy of the Windows calculator program.
This file was used to sideload the DLL library, “WindowsCodecs.dll,” which is part of the HeadLace backdoor malware.
HeadLace is a modular and sophisticated form of malware, known for its ability to execute in stages. The DLL file in this headLace malware attack contained a function designed to execute a batch file named “zqtxmo.bat.” This batch file further facilitated the malware’s deployment by downloading additional content from another Webhook.site URL, saving it in the victim’s program data directory, and executing it.
The campaign has been attributed to Fighting Ursa with a medium to high level of confidence. The group’s use of public services to host malicious elements aligns with their previously documented tactics. Their reliance on free services like Webhook.site and ImgBB is a trademakr of their attack strategies, reflecting a broader trend among cybercriminals to exploit legitimate platforms for nefarious purposes.
The researcher’s analysis points to a pattern of behavior consistent with past APT28 campaigns. The group’s method of repurposing successful tactics—such as employing fake car ads—demonstrates their strategic approach to maintaining the effectiveness of their attacks over time.
Previous Instances and Mitigation Strategies
In 2023, another Russian threat group, Cloaked Ursa, used a similar approach with a fake BMW advertisement targeting diplomatic missions in Ukraine. While not directly linked to APT28’s current campaign, the similarity in tactics highlights a persistent trend among Russian threat actors in utilizing deceptive advertisements to deliver malware.
Organizations can enhance their defenses against such attacks by scrutinizing the use of public and free services that are commonly exploited by cybercriminals. Restricting access to these platforms or monitoring their usage more closely can help in identifying and mitigating potential threats.
The APT28 group’s latest campaign, utilizing fake car ads to distribute HeadLace malware, highlights the sophisticated nature of cyber threats. By exploiting legitimate services to host their malicious payloads, Fighting Ursa continues to demonstrate their capability and persistence in targeting high-profile victims such as diplomats.
As cyber threats become more advanced, organizations and individuals must stay vigilant and implement strong security measures to protect against such deceptive attacks. The combination of vigilance, robust security practices, and proactive monitoring is essential in defending against the tactics employed by threat actors like APT28.
