The UK National Cyber Security Centre (NCSC) has formally attributed the 'Authentic Antics' malware attacks to APT28, also known as Fancy Bear, a threat actor linked to Russia's military intelligence service (GRU). This sophisticated malware campaign targets Microsoft 365 users, aiming to steal credentials and OAuth 2.0 tokens to gain unauthorized access to email accounts.
Technical Analysis of 'Authentic Antics'
According to the NCSC's detailed technical analysis dated May 6, 2025, 'Authentic Antics' operates by embedding itself within the Outlook process. It generates multiple Microsoft login prompts to intercept the victim's sign-in data and authorization codes. The malware's design suggests that it could also target other Microsoft 365 applications, such as Exchange Online, SharePoint, and OneDrive, due to their configurable nature per tenant.
The exfiltration method employed by 'Authentic Antics' is particularly stealthy. The malware uses the victim's own Outlook account to send the stolen data to an attacker-controlled email address, effectively bypassing traditional network monitoring tools. To conceal its activities, it disables the "save to sent" option, ensuring that the victim remains unaware of the unauthorized data transmission.
The malware comprises multiple components, including a dropper, an infostealer, and several PowerShell scripts. Its high level of sophistication allows it to maintain prolonged access to victim email accounts without detection. This is achieved by limiting its presence on disk, storing data in Outlook-specific registry locations, and communicating only with legitimate services, thereby avoiding the need for a command-and-control (C2) server.
Attribution to APT28 and Sanctions
The NCSC's analysis has led to the attribution of 'Authentic Antics' to APT28, a group also known by aliases such as Fancy Bear, Sednit, Sofacy, Pawn Storm, STRONTIUM, Tsar Team, and Forest Blizzard. This group has a history of conducting cyber espionage operations aligned with Russian state interests.
In response to these findings, the UK Government has sanctioned three GRU units—26165, 29155, and 74455—and 18 Russian individuals involved in these and related campaigns. UK officials have condemned the GRU's hybrid operations aimed at destabilizing Europe and endangering British citizens, emphasizing the growing sophistication of Russian intelligence services. The NCSC remains committed to exposing such cyber activities and sanctioning the responsible parties.
Broader Context of APT28's Activities
APT28 has been implicated in various cyber operations targeting government, defense, and technology entities. Notably, the group has exploited vulnerabilities in Microsoft Outlook (CVE-2023-23397) and WinRAR (CVE-2023-38831) to collect Windows NTLM credential hashes from organizations in Europe and North America. These campaigns represent a shift in tactics, with APT28 conducting mass credential collection efforts, a departure from their traditionally targeted operations. (csoonline.com)
The group's exploitation of Microsoft Exchange vulnerabilities has also been documented. APT28 has leveraged these flaws to gain unauthorized access to email systems, systematically harvesting sensitive information about Western aid shipments to Ukraine. Their advanced post-exploitation techniques demonstrate a deep understanding of Microsoft's email architecture, allowing them to maintain persistent access to organizational email systems. (messageware.com)
Implications and Recommendations
The attribution of 'Authentic Antics' to APT28 underscores the persistent threat posed by state-sponsored cyber actors. Organizations, particularly those using Microsoft 365 services, should be vigilant and implement robust security measures to mitigate the risk of such sophisticated attacks.
Recommendations:
- Regular Software Updates: Ensure that all software, especially Microsoft Outlook and other Microsoft 365 applications, are updated to the latest versions to patch known vulnerabilities.
- Multi-Factor Authentication (MFA): Implement MFA to add an additional layer of security, making it more challenging for attackers to gain unauthorized access.
- User Education: Conduct regular training sessions to educate employees about phishing tactics and the importance of not interacting with suspicious emails or attachments.
- Network Monitoring: Deploy advanced network monitoring tools to detect unusual activities, such as unauthorized data exfiltration or communication with unknown external servers.
- Incident Response Plan: Develop and regularly update an incident response plan to ensure a swift and effective response to potential security breaches.
Source: BleepingComputer UK ties GRU to stealthy Microsoft 365 credential-stealing malware
