Sofacy Malware - German Bundestag

Hunt Hypothesis

Sofacy malware is being used to target the German Bundestag, likely for data exfiltration and espionage. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats targeting critical infrastructure.

YARA Rule

rule apt_sofacy_xtunnel
{

    meta:
        author = "Claudio Guarnieri"
        description = "Sofacy Malware - German Bundestag"
        score = 75

    strings:
        $xaps = ":\\PROJECT\\XAPS_"
        $variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
        $variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
        $variant22 = "is you live?"
        $mix1 = "176.31.112.10"
        $mix2 = "error in select, errno %d" $mix3 = "no msg"
        $mix4 = "is you live?"
        $mix5 = "127.0.0.1"
        $mix6 = "err %d"
        $mix7 = "i`m wait"
        $mix8 = "hello"
        $mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"

    condition:
        ((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*))) 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 15 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Scheduled System Maintenance Task
  Description: A legitimate system maintenance task, such as Windows Task Scheduler running a script to clean temporary files or update system settings, may trigger the rule due to similar process or file activity.
  Filter/Exclusion: Exclude processes initiated by the Windows Task Scheduler (Task Scheduler or schtasks.exe) or files located in system directories like C:\Windows\Temp or C:\Windows\System32.

• Scenario: Admin User Performing System Updates
  Description: An administrator performing routine system updates or patching operations may execute scripts or tools that resemble Sofacy malware behavior.
  Filter/Exclusion: Exclude processes executed by admin users with elevated privileges (e.g., runas or cmd.exe with runas /user:Administrator) or those associated with Microsoft Update (wusa.exe or WindowsUpdate.exe).

• Scenario: Legitimate Security Tool Execution
  Description: A security tool such as Malwarebytes, Bitdefender, or Kaspersky may perform similar actions to malware, such as scanning or quarantining files, which could trigger the rule.
  Filter/Exclusion: Exclude processes associated with known security tools (e.g., mbam.exe, bitdefender.exe, kavservice.exe) or files located in security tool directories (e.g., C:\Program Files\Malwarebytes).

• Scenario: Automated Backup Job
  Description: A scheduled backup job using tools like Veeam, Acronis, or Windows Backup may involve file copying or compression activities that resemble malware behavior.
  Filter/Exclusion: Exclude processes related to backup tools (e.g., veeam.exe, acronisbackup.exe, wbadmin.exe) or files in backup directories (e.g.,