GreedyBear

Executive Summary

GreedyBear, also known as APT28/Fancy Bear, is a sophisticated threat actor combining financial theft with espionage objectives. Their latest campaign centered on hijacked Firefox extensions and malicious executables that captured cryptocurrency wallet credentials and stolen more than $1 million in crypto. The operation uses supply‑chain compromise, obfuscation, and centralized C2 infrastructure, expanding to multiple browsers and leveraging AI‑generated code for stealth.

Goals & Targeting

GreedyBear’s strategic objectives blend monetary gain with broader intelligence collection. While the primary motivation appears financial—evidenced by large sums of cryptocurrency stolen—they also target state actors, defense contractors, media outlets, and critical infrastructure across Ukraine, NATO members and European states. The dual focus allows them to collect sensitive data for geopolitical leverage while monetizing compromised accounts through wallet credential theft.

Key Capabilities

• Phishing via spoofed domains
• Credential harvesting through fake login pages
• Distributing malicious browser extensions (Firefox wallet)
• Concurrent multi‑campaign operations
• Cross‑platform implants and droppers (XAgent, X‑Tunnel, WinIDS, Foozer, DownRange)
• Supply chain infiltration
• Dynamic obfuscation of files and code
• Phishing‑based social engineering to install extensions
• Persistent command‑and‑control communication for real‑time exfiltration
• Dynamic code injection
• Continuous malware updates and adaptation
• Spearphishing with malicious attachments
• Exploiting software vulnerabilities (Follina, Outlook zero‑day)
• Deploying credential theft malware CredoMap via RCE
• Using legitimate tools like PowerShell to execute commands disguised as system updates

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Since 2008, GreedyBear has executed large‑scale, multi‑phase campaigns against government and critical infrastructure worldwide. The operator typically launches simultaneous attacks across multiple vectors—phishing, malicious browser extensions, credential stealers, and supply‑chain exploits—maintaining a centralized C2 network that simplifies exfiltration and rapid update of payloads. Their past operations include phishing lures exploiting the Follina vulnerability to deliver CredoMap, an Outlook zero‑day in December 2023 against European government networks, and earlier intrusions into the German Bundestag (2015) and France’s TV5 Monde (2015). The actor consistently targets defense, aerospace, media, energy, pharmaceutical and financial sectors, prioritizing high‑value accounts to facilitate both intelligence gathering and illicit cryptocurrency transactions.

IOC Patterns

• Domain names that imitate legitimate organizations
• Malicious browser extensions with deceptive behavior
• Supply‑chain compromise indicators
• Obfuscated files or code
• Persistent C2 connections
• Phishing emails
• Spearphishing attachments
• Exploits of CVE‑2022‑30190 (Follina)
• Exploits of CVE‑2023‑23397 (Outlook zero‑day)
• Malicious PowerShell commands disguised as Windows updates

Recommended Actions

• Implement phishing awareness training and simulated exercises for users
• Block and monitor malicious Firefox wallet extensions via browser security policies
• Filter or block newly registered domains that mimic legitimate corporate names
• Enforce multi‑factor authentication across all critical accounts to mitigate credential harvesting
• Apply robust email filtering rules and user education to deter spearphishing attempts
• Deploy application whitelisting for web browsers to prevent unapproved extensions
• Monitor outbound traffic for anomalous C2 communications over standard ports (e.g., 53, 80/443)
• Leverage behavioral analytics and EDR solutions to detect obfuscated file execution patterns
• Validate software supply chains with signed code verification and continuous monitoring
• Maintain up‑to‑date threat intelligence feeds covering known malicious domains, IPs, and hash signatures
• Enable automatic patching or apply hotfixes for Office/Outlook vulnerabilities (CVE‑2022‑30190, CVE‑2023‑23397)
• Restrict unapproved PowerShell execution via application control or group policy
• Detect and respond to unauthorized credential theft activity such as CredoMap signatures

Suggested Tags