Exposing Fancy Bear’s Phantom Net: Decoding the BearedShell & SlimAgent Campaigns

Unveiling Fancy Bear’s Phantom Net Campaign

The notorious Fancy Bear, also known as APT28, has once again surfaced with a new wave of attacks targeting high-value targets across various sectors. This group, widely attributed to Russian intelligence agencies, continues to evolve their tactics, techniques, and procedures (TTPs), using sophisticated tools to maintain persistence in targeted environments.

The current campaign, Phantom Net Voxel, revolves around the deployment of multiple malicious agents like BearedShell (via tcpiphlpsvc.dll) and SlimAgent (via eapphost.dll), both carefully designed to fly under the radar and maintain long-term access. These malicious payloads utilize common enterprise software channels and cloud-based infrastructure to exfiltrate data and establish command and control (C2) communication with their handlers.

At the core of this operation is the use of weaponized Office documents, second-stage DLLs, and cloud storage APIs that serve as covert C2 channels. The BearedShell malware, specifically, makes use of WinHTTP APIs to blend in with legitimate network traffic, while the SlimAgent malware has advanced memory manipulation techniques that allow it to reside in the system’s memory, evading detection for as long as possible.

The goal of this blog post is to shed light on the infrastructure behind these attacks and provide defenders with actionable intelligence including high-value Indicators of Compromise (IOCs) to block these attacks at the earliest stages of execution.

Key Features of Fancy Bear’s Phantom Net Campaign

1. Weaponized Documents: Fancy Bear has consistently used malicious Office documents as initial access vectors. These documents are crafted with hidden macros or exploits to drop and execute malicious payloads like BearedShell.

2. Public Cloud C2: A hallmark of this campaign is the use of public cloud services for C2 communication, making detection more difficult. The attacker utilizes cloud storage providers such as Koofr, Icedrive, and Filen for data exfiltration and command signaling.

3. Multi-Stage Payloads: The attackers deploy several stages of malicious files, including second-stage DLLs, to further their foothold within targeted networks. These DLLs are often executed in-memory, minimizing the need to write malicious files to disk.

4. Memory-Based Execution: Fancy Bear’s tools make extensive use of in-memory execution. This method ensures that malicious code is run directly within a system’s RAM, making it more challenging for traditional antivirus solutions to detect.

5. Advanced Persistence Mechanisms: The use of WinHTTP APIs for C2 allows for covert communication and remote control, while tools like SlimAgent and BearedShell ensure long-term persistence on infected systems.

Detailed Analysis of BearedShell and SlimAgent

BearedShell:

File name: tcpiphlpsvc.dll
Hash: 2EABE990F91BFC480C09DB02A4DE43116B40DA2D6EAAD00A034ADF4214DAC4D1
VirusTotal score: 49 detections

Suspicious Imports: GetCurrentProcess, WinHttpConnect, WriteFile

C2 Mechanism: Uses WinHTTP for communication, blending with normal network traffic to avoid detection.

SlimAgent:

File name: eapphost.dll
Hash: 9FAEB1C8A4B9827F025A63C086D87C409A369825428634B2B01314460A332C6C
VirusTotal score: 25/42 detections

Suspicious Imports: WriteFile, GetCurrentThreadId, VirtualAlloc, CryptDestroyHash, GetClipboardData
Functionality: Likely used for data exfiltration and system compromise, utilizing memory-based techniques to evade detection.

IOCs to Block: Protecting Your Network from Fancy Bear’s Phantom Net

In this campaign, Fancy Bear is using various tools and infrastructure to maintain persistence and move laterally through networks. Below are some critical IOCs (Indicators of Compromise) that should be immediately blocked to defend against this ongoing threat:

1) Weaponized Office documents (MD5), Block / Quarantine

2) Public cloud C2 endpoints, Monitor / Restrict

3) Second-stage DLL hashes (pick 3), Block by hash / quarantine

4) HTTP Grunt / in-memory stagers, Behavioral detection (3)

5) Malware samples / notable binaries, Block by hash

6) Misc artifacts (3), Investigate / sandbox

Why This Matters

Fancy Bear continues to evolve, utilizing increasingly sophisticated techniques to blend in with legitimate traffic and avoid detection. Their reliance on public cloud services for C2 and memory-based malware execution makes traditional detection methods less effective.

This campaign demonstrates the group’s ability to leverage multi-stage payloads and cloud storage APIs, allowing them to bypass many network and endpoint defenses. By using weaponized Office documents to drop malicious payloads and communicate over encrypted channels, Fancy Bear’s tactics resemble those of other advanced persistent threats, but with a heightened level of sophistication and operational security.

By mapping this Phantom Net Voxel infrastructure, we can help organizations stay ahead of these evolving threats and better secure their networks.

Recommended Actions for Defenders:

• Block identified IOCs immediately via endpoint security and email gateway tools.
• Update network segmentation and access controls for cloud services to prevent unauthorized C2 communications.
• Use advanced behavioral analysis and sandboxing techniques to detect in-memory malware execution.
• Enhance cloud API security, ensuring that only authorized traffic is allowed from trusted IP ranges.

Fancy Bear is relentless, but with the right protections in place, your organization can defend against these advanced tactics. Stay vigilant, and use the intelligence provided here to bolster your security posture.