Threat Actor ProfileAPT28 / Fancy Bear

Fancy Bear activity has been observed in at least 59 countries around the world, including the Netherlands. The first well-documented attacks against Dutch agencies and nationals occurred after the MH17 tragedy. In July 2014, 298 people lost their lives when Malaysian Airlines Flight 17 was shot down by Russian forces in Ukrainian airspace. The majority of victims (193 passengers) were Dutch, which caused the Netherlands and its citizens extreme grief and distress. The Dutch Safety Board (‘Onderzoeksraad Voor Veiligheid’) was tasked with investigating the tragedy. In October 2015, while the investigation was still ongoing, a coordinated attack was directed at “Dutch, Malaysian, Australian, Belgian, and Ukrainian authorities” in an attempt to gather information regarding the investigation into the downing of MH17.

The attackers mimicked DSB’s VPN servers in order to gain access to the credentials of its users, as well as utilized a “rogue” Outlook Web Access server targeting DSB’s partner organizations. Based on these tools and techniques, researchers at Trend Micro were able to identify the group as Fancy Bear. Later the same group was named to have been behind the phishing emails between February 2015 and July 2016 aimed at Bellingcat, an investigative global journalism team headquartered in Amsterdam. The journalists were covering the MH17 case, claiming the Russian 53rd Anti-Aircraft missile brigade's involvement to the crash years before European authorities confirmed this.

Both the DSB and Bellingcat were collecting and analyzing data regarding not only the circumstances of the crash but also the movement of two members of Unit 29155 in and out of the Netherlands. Although this unit had been involved in politically motivated international criminal activities, the two tracked members are not amongst those later convicted for their involvement in the MH17 crash. Nevertheless, for a group such as Fancy Bear, retaining this information would be a characteristic motivation for organizing the attacks. Experts, however, believe that the attacks were unsuccessful.

Over the years Russian groups have been connected to a multitude of attacks in the Netherlands, although the specific APT is not always clearly identified. During the months leading up to the 2017 elections, hundreds of Dutch government employees were targeted with phishing emails in an attempt to gather sensitive political information, including within the Ministry of General Affairs in The Hague. Dutch General Intelligence and Security Service (AIVD) director–general Rob Bertholee characterized these attacks as “a threat to our democracy.” The AIVD cautioned about the potential dangers of using specific outdated election software, which resulted in the ballots being counted by hand. Interference in the Dutch election may not entirely align with Russian interests, as even the most radical parties were uninterested in building a closer relationship with Russia after the MH17 crash. However, as Hunt & Hackett founder Ronald Prins pointed out, “the Dutch elections are a good practice for them.” Although it is theorized that Fancy Bear and Cozy Bear were behind the initial attacks, the AIVD never confirmed the specific groups. Interference in the election itself was not reported.

The latest known activity of Fancy Bear in the Netherlands was detected by Kaspersky Lab in 2018. The Dutch Military Intelligence and Security Service stopped an attack attributed to Fancy Bear against The Hague-based international organization, the Organization for the Prohibition of Chemical Weapons (OPCW). Since then, the group’s focus seems to have shifted away from the Netherlands.

After some highly publicized campaigns from 2016 to 2018 - as described in the previous sections, - the group had been avoiding high-profile activities. That is until the Russian invasion of Ukraine in 2022. Weeks before the military operations began, however, security companies had been detecting signs suggesting a possible increase in Russia-backed cyber-attacks across Europe, and it was already theorized in January that Fancy Bear was tasked to gather intelligence surrounding the escalating conflict with Ukraine. Although in April Microsoft successfully removed several domains used by Fancy Bear to carry out attacks against Ukraine, the group continued their activities. In June, Fancy Bear was spotted to have joined a number of attackers participating in the exploit of the so-called “Follina” vulnerability (CVE-2022-30190). Follina was a remote code execution vulnerability in the Microsoft Support Diagnostic Tool, discovered as a zero-day in late May 2022 and its exploitation was attributed to multiple different threat groups, including from China, Belarus, and Russia. Fancy Bear’s campaign using Follina was aligned with their earlier methods of distributing phishing emails, this time taking advantage of public fear over nuclear weapons. Upon the opening of the document, the credential stealer malware CredoMap was uploaded to the user’s system utilizing the Follina vulnerability. The magnitude of the damage caused by Fancy Bear exploiting this specific vulnerability in the Ukrainian conflict is unknown, however, it exquisitely exemplifies the possible usage of cyberattacks within an international armed conflict.

The war between Russia and Ukraine not only created new channels for established APTs to exploit, but new actors entered the arena as well, often motivated by ideology or personal political affiliation with either side. Hacktivist operations are most often distinguishable from APT groups based on their level of sophistication. This phenomenon, often referred to as hacktivism, was rapidly growing during the first months of the war. During the turbulent events of the war three groups emerged identifying themselves as Russian hacktivist teams: Xaknet, Infoccentr and CyberArmyofRussia_Reborn. These groups were responsible for data leaks on their Telegram channels after attacks on Ukrainian victims. Their activity was consistent with previous Fancy Bear operations, suggesting coordination with the GRU or even directly with Fancy Bear itself.

Links to other APTs

However, not only hacktivists have been connected to the group. Earworm, also known as Zebocracy, has been observed to carry out similar activities to Fancy Bear, including reconnaissance, taking screenshots, and executing files and commands. The command and control infrastructure used by Earworm has been found to largely overlap with that of Fancy Bear, indicating some level of cooperation between the two groups. Nevertheless, since not much is known about Earworm, the extent of the connection between the two groups is not clear.

Fancy Bear’s most famous connection to another group, however, is the infiltration of the US Democratic National Committee’s network. In 2016, after installing a proprietary software package called Falcon, the DNC was alarmed that Russian actors were present in their system, and two separate actors were identified: Fancy Bear, and Cozy Bear, also known as APT29. The latter is considered to be affiliated with the Russian Foreign Intelligence Service. At the time of discovery, Fancy Bear had been inside the network for only a few weeks, specifically focusing on the research department and materials on Donald Trump, whereas Cozy Bear had been stealing emails for over a year. The breach was significant and resulted in international coverage which was further escalated by the fact that not only one but two separate groups were infiltrating the DNC. Nevertheless, it is not believed that the two groups were acting in a coordinated manner or that they even knew of each other’s presence in the system.

After the DNC attacks, a self-proclaimed hacker under the pseudonym Guccifer2.0 claimed responsibility for the breach, however, his claims were quickly dismissed. As to the real identities of Fancy Bear’s members, it remains largely unknown. A 2018 US indictment and consequent charges brought against GRU officers in 2020 revealed six alleged GRU officials’ names, however, those officials are associated with Unit 74455, which is believed to be the APT group Sandworm.

Actions have been taken against members of the group in the EU, although only reflecting the early activities of the group. In 2020 sanctions including travel bans and asset freezes were imposed against two Fancy Bear members by the EU Council based on the group’s 2015 campaign against the German Federal Parliament. The time lapse between the attacks and the imposing of punishment reflects the huge gap between criminal activity in cyberspace and the slow and rigid legal mechanisms.