HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group

The Russian cyber threat groups that we monitor frequently design innovative ways to cover their tracks. In early 2015, we came across a malware backdoor, which we call HAMMERTOSS, from an advanced persistent threat (APT) group that we suspect the Russian government sponsors.This group, APT29, employs HAMMERTOSS to compromise its targets. Using a variety of techniques—from creating an algorithm that generate daily Twitter handles to embedding pictures with commands—the developers behind HAMMERTOSS have devised a particularly effective tool. HAMMERTOSS uses Twitter, GitHub, and cloud storage services to relay commands and extract data from compromised networks.