Analysts discovered a new campaign from the SNAKEMACKEREL group that uses fake Brexit-related documents to infiltrate major government agencies and steal information.

Researchers with Accenture noted that SNAKEMACKEREL, which is also known by several other names including Sofacy, is an espionage-motivated collective of cybercriminals with a history of launching malware attacks on public sector organizations across North America and the European Union.

In the recent campaign, victims were lured in with a spear phishing attack to open documents containing the malicious macros, which then activated a form of malware that has multiple names, including Zebrocy and Zekapab. Agencies targeted in the campaign included the U.K. Defence Science and Technology Laboratory, the U.K Foreign and Commonwealth Office, and the Organisation for the Prohibition of Chemical Weapons.

How SNAKEMACKEREL Capitalizes on Current Events

The files containing the malware were sent the same day U.K. Prime Minister Theresa May signed the draft agreement that would signal the country’s departure as a member of the European Union, a decision colloquially known as Brexit. When victims received the fake documents, however, they saw a series of jumbled text that suggests they were created with an earlier version of Microsoft Word. This tricked victims into clicking on the macros containing the malware.

Components within the macro include an executable binary similar in nature to code used in attacks attributed to Sofacy earlier this year. Once Zekapab has infected a victim’s system, it sends HTTP POST requests to deliver information it has collected back to threat actors, while another component can spread the malware even further across a network.

Researchers said SNAKEMACKEREL has also been used to target organizations outside of the U.K., including the North Atlantic Treaty Organization (NATO), the International Olympic Committee and defense contractors, among others.

Avoid the Threat of Spear Phishing Attack Campaigns

According to IBM experts, the spear phishing attack is a favorite technique among cyberthreat groups because it tends to work at least 10 percent of the time. That’s why security training not only has to be in place for all employees, but potentially automated in such a way that laggards can be identified and their use of critical IT systems can be improved.

If that doesn’t suffice, identity and access management (IAM) solutions can help raise the alarm when suspicious-looking documents, such as those sent by SNAKEMACKEREL, make their way into staff inboxes.

Source: Accenture