BadRory

Executive Summary

BadRory is a suspected APT group observed conducting spear-phishing campaigns against Russian government entities, military contractors, universities, and hospitals through boobytrapped Office documents. The group has demonstrated moderate sophistication, focusing on state-related targets and leveraging phishing as its primary attack vector.

Goals & Targeting

BadRory appears to be targeting sectors critical to national security and societal stability, such as government, military, education, and healthcare. This suggests the group's primary goal may involve intelligence gathering, surveillance, or disruption of state functions. The targeting of Russian entities specifically indicates a potential alignment with Russian interests or internal priorities.

BadRory has emerged as a potentially state-sponsored APT group targeting sensitive sectors within Russia. The group has conducted at least two waves of spear-phishing attacks in October 2022 and April 2023, delivering malicious payloads via Office documents. These campaigns suggest BadRory is focused on compromising high-value targets with significant implications for national security. While the group's exact origins remain unclear, its targeting patterns align with common behaviors observed in Russian-speaking APTs. The attacks are likely designed to gather sensitive information or disrupt operations.

Key Capabilities

• Spear-phishing via Office documents
• Malware deployment
• Staging infrastructure

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

BadRory's campaigns have demonstrated a methodical approach, with specific targeting of high-value Russian institutions over multiple waves. The group appears to operate with moderate sophistication and demonstrates persistence in achieving its objectives. Notable operations include the 2022 and 2023 spear-phishing campaigns, which targeted a range of sectors including government and military contractors.

IOC Patterns

• Spear-phishing emails with malicious Office attachments
• Presence of custom malware payloads

Recommended Actions

• Enhance email filtering and content isolation for suspected phishing attempts
• Implement strong endpoint detection and response (EDR) solutions to detect malicious activity

Suggested Tags