Thread by @hatr

Now to the most hilarious bit of the #VulkanFiles: The curious case of "Secret Party NTC Vulkan" and APT #MagmaBear

The documents contained in the leak are not only intricate, with a few exceptions like hardware specs and disinfo-related pieces (see this thread:

https://twitter.com/christo_buschek/status/1641457689279729664

) there's not much infosec-professionals can quickly utilize. Think IP-addresses, hashes, source code etc.

But during our research we were told about a file. It's an excel file, and it is on Virustotal. The filename is in Russian and translates to "Secret Party NTC Vulkan". We obtained the file, since it was an xls-file I used a thing called oletools blog.didierstevens.com/programs/oledu…

With this tool, you can see what is happening inside of macros. Anyway, this file apparently reached out to a domain to grab a DLL-file from there. This is where the bear showed up, the one you see at the top of this thread.

Virustotal has a "Community"-tab. In it, sometimes researchers, sometimes automated entries describe the files and if they're malicious. This one had the reference "APT Magma Bear". (Magma, as in what's inside a Volcano).

I immediately thought: Oh, this could've been a name Crowdstrike gave this company. (Crowdstrike calls these state-sponsored groups "bears": Fancy Bear, Cozy Bear, Voodoo Bear. So why not Magma Bear?)

Turns out though: When I looked at the file, I should have increased the size of my screen. Because apparently the person who developed this tool was the one who gave the name. As seen in this picture.

The file itself isn't really malicious. It's s a simple prank. Somebody sent this invitation, around New Years and who ever opened it was greeted with this APT Bear (and also the Soviet March from Red Alert 3 was playing).

We reached out to the developer (some info wasn't deleted so we were able to corroborate he worked for the company at that time) and asked them why they did it. Here's their response.

They also confirmed the Red Alert 3 information (the DLL had it stored as a MIDI). If you want to listen to it, here you go.

Again: Nothing malicious, but hilarious.