The Sofacy group recently targeted several government organizations around the world with the new Cannon Trojan.

In late October and early November, the Palo Alto Networks Unit 42 threat research team collected multiple weaponized documents targeting government organizations. The researchers couldn’t analyze all the files because the command-and-control (C&C) servers for some of them were down, but they managed to glean some valuable insights from two of the documents in particular.

The first file is a Microsoft Word document that loads a malicious macro when a user clicks the “enable content” button. This macro employs the AutoClose function to prevent Word from executing the malicious code until the user closes the document, thereby evading detection. At that point, the macro loads Zebrocy, an infostealer written in Delphi, which Sofacy has used since at least 2016.

The second document is very similar in structure to the first file, but executes a different payload: the Cannon Trojan. This new threat, which is written in C#, uses several email accounts to send system data and obtain a secondary payload from the attackers.

What’s Behind the Rise of Infostealers?

Zebrocy and Cannon aren’t the only infostealers Sofacy has employed in its attack campaigns. In the past, Symantec observed the group using another Trojan known as Seduploader to perform reconnaissance on an infected computer. The security firm also detected Sofacy’s execution of X-Agent as a second-stage infostealer.

These threats contributed to an overall increase in information stealers targeting government entities and regular organizations. In May 2018, FortiGuard noted a rise in data-stealing malware over the previous few months. Loki and Fareit experienced the most significant growth during that period.

How to Defend Against the Cannon Trojan

To defend against the Cannon Trojan and similar threats, security leaders should conduct ongoing phishing simulations with all employees. They should also take a layered approach to email security by implementing perimeter protection, scanning emails and conducting ongoing employee security awareness training.

Sources: Palo Alto Networks, Symantec, FortiGuard