ProjectSauron APT

Advanced Persistent Threat (APT) groups and actors are among the most threatening criminals in the world of cybercrime. Their attacks are often characterized by the use of previously undocumented exploits and malware, as well as by exploiting previously compromised infrastructure to aid their future attacks. A group that fits this description perfectly is ProjectSauron APT, or also known as the Strider APT.

Threatening APT Actors Engage in Attacks against High-Profile Military, Government and Financial Entities

This group's operations concentrated on data theft from government and military entities, and their activities can be traced back to 2011. The hackers use state-of-the-art malware implants to aid their attacks and remain undetected. Some of ProjectSauron APT's key features are:

• Their payloads feature a modular design that allows them to extend or shrink their functionality on-the-fly.
• They make use of the DNS protocol for communication with the command and control server.
• They rely on various encryption routines to protect their network traffic.
• They modify the payloads used in different attacks to make it more difficult for malware researchers to discover all of their operations.
• They use special USB storage drives to extract data from air-gapped networks. This means that the criminals may also have physical access to the facilities they infiltrate, but it is possible that they may be relying on automation to exfiltrate the data.

ProjectSauron APT's attacks have reached Russia, Rwanda, Iraq, Italy, and other countries. Their focus is on government and military organizations, but artifacts of their activities have also been discovered on companies operating in the financial and telecommunications sectors.

The ProjectSauron APT may be a Nation-Backed Actor

The ability to penetrate air-gapped networks is undoubtedly one of the most impressive properties of ProjectSauron APT's campaigns. One way to do this is to gain physical access to the facility, but they might be relying on automated USB drives to carry out the task. For example, an infected USB may be connected to the air-gapped network, and a corrupted script may copy important data to it. Once the USB is connected to a network-enabled system, it would transfer the stolen files.

ProjectSauron APT's attacks are very covert, and the infection vectors that the criminals use are still unknown. Security specialists suspect that the operation might have cost millions of dollars to set up, and it is possible that we may be talking about a nation-backed threat actor.