Description of Campaign
The Russian Federation's Ministry of Foreign Affairs was targeted with phishing emails to harvest credentials. The stolen credentials were used to exploit trusted connections and send additional emails from a compromised account. Successful attacks resulted in the victim's system being infected with variants from the Konni malware family. The malware was used to steal sensitive data and send the information back to actor-controlled command and control servers.

Our ATR Team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by Lumen Technologies and shared publicly.

How to use this article:

1. If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign. 
2. Review the product detection table and confirm that your environment is at least on the specified content version.
   To download the latest content versions, go to the Security Updates page.
3. Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
4. Review KB91836 - Countermeasures for entry vector threats.
5. Review KB87843 - Dynamic Application Containment rules and best practices.
6. Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

This Knowledge Base article discusses a specific threat that's being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.
 
Campaign IOC

Type	Value
SHA256	B6845A436DF2B3A79DD1B0E4A57A06C60F718EEE0272A3EB81183EE4750037B9
SHA256	4CA8AC99B2416D8FAE67A8B18A58C8D267B7E2B72AF1EE0369F2470A030AF8C7
SHA256	24F5FB91CA41E4A191A44629F064FA14C4063B7CDA68EBC2B7AFB7E68A9D3CDD
SHA256	A3CD08AFD7317D1619FBA83C109F268B4B60429B4EB7C97FC274F92FF4FE17A2
IP-DST	152.89.247.26
HOSTNAME	portalmid.pronto-login.com
HOSTNAME	passport.yandex.ru-settings.pronto-login.com
HOSTNAME	mid.pronto-login.com
HOSTNAME	e.mail.ru.settings.pronto-login.com
HOSTNAME	russia.carnegieinsider.com
HOSTNAME	economy.carnegieinsider.com
HOSTNAME	portal.newint-mid.ru.carnegieinsider.com
HOSTNAME	hpronto.settings.carnegieinsider.com
HOSTNAME	leaks.carnegieinsider.com
HOSTNAME	docs.undss.carnegieinsider.com
HOSTNAME	e.mail.ru.settings.carnegieinsider.com
HOSTNAME	victory-2020.atwebpages.com
DOMAIN	pronto-login.com
URL	http://victory-2020.atwebpages.com/index.php?user_id=45678&type=%d
URL	http://i758769.atwebpages.com
URL	http://h378576.atwebpages.com

Minimum Content Versions

Content Type	Version
V2 DAT (VirusScan Enterprise)	10246
V3 DAT (Endpoint Security)	4698

  
Detection Summary                               

IOC	Scanner	Detection
B6845A436DF2B3A79DD1B0E4A57A06C60F718EEE0272A3EB81183EE4750037B9	AVEngine V2	BAT/Agent.cb
	AVEngine V3	BAT/Agent.cb
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
4CA8AC99B2416D8FAE67A8B18A58C8D267B7E2B72AF1EE0369F2470A030AF8C7	AVEngine V2	Generic trojan.qc
	AVEngine V3	Generic trojan.qc
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
24F5FB91CA41E4A191A44629F064FA14C4063B7CDA68EBC2B7AFB7E68A9D3CDD	AVEngine V2	Generic trojan.qc
	AVEngine V3	Generic trojan.qc
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
A3CD08AFD7317D1619FBA83C109F268B4B60429B4EB7C97FC274F92FF4FE17A2	AVEngine V2	Generic agent.c
	AVEngine V3	Generic agent.c
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

                    
Aggressive set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

VirusScan Enterprise - Access Protection Rules:
Host Intrusion Prevention: