4 ms·
To what extent have others outside Crowdstrike confirmed their findings? They seem mainly based around commonalities in what is understood to be a propriety mal
by themgt 10y ago
To what extent have others outside Crowdstrike confirmed their findings? They seem mainly based around commonalities in what is understood to be a propriety malware platform/toolset attributed to the Russians. Like a Metasploit-Stuxnet combo? I find these two statements from this vs. the DNC press release to be odd:
"X-Agent is a cross platform remote access toolkit, variants have been identified for various Windows operating systems, Apple’s iOS, and likely the MacOS. Also known as Sofacy, X-Agent has been tracked ..." [1]
"FANCY BEAR (also known as Sofacy or APT 28) ... This adversary has a wide range of implants at their disposal, which have been developed over the course of many years and include Sofacy, X-Agent ... and even malware for Linux, OSX, IOS, Android and Windows Phones." [2]
So, is Sofacy the name of the group or their malware platform? Are Sofacy and X-Agent the same tool, or separate? Is X-Agent a metasploit-type tool or a platform-specific malware for various operating systems? Has the security community in general seen this evidence and agreed on these findings, or is this primarily Crowdstrike's own little expedition?
[1]: https://www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/ https://www.crowdstrike.com/blog/danger-close-fancy-bear-tra...
[2]: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...