Internal name : DWN_DLL_MAIN.dll File format : PE32 DLL MD5: ce8b99df8642c065b6af43fde1f786a3 Linker version : 11.0 , Microsoft Visual Studio Linker timestamp : 2015.07.28 13:05:20 ( GMT ) .


Targeting a safety system indicates significant damage and loss of human life were either intentional or acceptable goals of the attack , a consequence not seen in previous disruptive attacks such as the 2016 CRASHOVERRIDE malware that caused a power loss in Ukraine .


The commands supported by the most recent version of the bot are listed below . Based on the technical data uncovered , and in light of recent disclosures by the U.S. Department of Justice on the ongoing activities of Chinese state-sponsored threat actors . krjregh.sacreeflame.com lywja.healthsvsolu.com .


It is important to remember there are many threat actors operating in the Middle East , and often there are overlaps in TTPs , tools , motivation , and victimology .


Report_URL : https://www.secureworks.com/blog/living-off-the-land


com.xiaomi.smarthome.receive_alarm Received notifications from Xiaomi ’ s smart home IoT devices . We have also observed APT41 limitedly deploy rootkits on Linux systems and Master Boot Record (MBR) bootkits , such as ROCKBOOT , on Windows systems to hide their malware and maintain persistence on victim systems . Another attack group , Earworm ( aka Zebrocy ) , has been active since at least May 2016 and is involved in what appears to be intelligence gathering operations against military targets in Europe , Central Asia , and Eastern Asia .


Indicators of compromise ( IOC ) URLs hxxp : //5.9.33.226:5416 hxxp : //172.110.10.171:85/testcc.php hxxp : //sub1.tdsworker.ru:5555/3ds/ Hash values Package.apk - A342a16082ea53d101f556b50532651cd3e3fdc7d9e0be3aa136680ad9c6a69f eCommon.dl - 604deb75eedf439766896f05799752de268baf437bf89a7185540627ab4a4bd1 This group is very active and continues to develop new features for its malware , and implement infrastructure changes in 2019 . During one reported incident , APT38 caused an outage in the bank 's essential services .


It eventually kills all threads that belong to these undesired modules ( using ZwQueryInformationThread native API with ThreadQuerySetWin32StartAddress information class ) . The loader 's main goal was to run a PowerShell command to execute shellcode . Winnti : T1050 New Service . The script contains 1,759 lines of code .


This macOS malware used public source code in order to build crafted macOS installers .


6bdfb79f813448b7f1b4f4dbe6a45d1938f3039c93ecf80318cedd1090f7e341 ADDITIONAL INFORMATION Packages monitored pin.secret.access com.chase.sig.android com.morganstanley.clientmobile.prod com.wf.wellsfargomobile com.citi.citimobile com.konylabs.capitalone com.infonow.bofa com.htsu.hsbcpersonalbanking com.usaa.mobile.android.usaa In the Naikon scheme , a C&C server can be specialized XSControl software running on the host machine . Rancor : cswksfwq.kfesv.xyz . An adversary could potentially instruct a control systems device to perform an action that will cause an Impact


'' For each interaction , the malware will check if the generator is a package that belongs to the anti-virus list , the malware will abuse another feature of the Accessibility API . In 2012 , the Molerats attacks appeared to rely heavily on the XtremeRAT , a freely available tool that is popular with attackers based in the Middle East . ShadowHammer : Liveupdate_Test_VER365.zip . In the UK , education has suffered a significant drop in funding in the last decade , according to the non - partisan Education Policy Institute .


We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded . COVELLITE remains active but appears to have abandoned North American targets , with indications of activity in Europe and East Asia .


This content is then uploaded to a remote site outside of the compromised organization completing the attack .


Command-and-Control ( C2 ) IP addresses :


The target is encouraged to click on the link to read the entire article .


We incorporated those changes into our build , discovering that this worked for most sample versions with almost no further modification .


Using a publicly available rooting framework , the PHA attempts to root devices and gain persistence on them by reinstalling itself on the system partition of rooted device . During Kaspersky Lab 's analysis of NetTraveler , the company 's experts identified six victims that had been infected by both NetTraveler and Red October , which was another cyberespionage operation analyzed by Kaspersky Lab in January 2013 . On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website . Since then , Apple released a new fix for iOS , iPadOS and macOS that reliably fixes the vulnerability again .


The threat actors behind the Sea Turtle campaign were successful in compromising entities by manipulating and falsifying DNS records at various levels in the domain name space . As of this publication , BRONZE UNION remains a formidable threat group that targets intellectual property and executes its operations at a swift pace .


Although the MenuPass Group used mostly publicly available RATs , they were successful in penetrating a number of high value targets , so it is entirely possible this is indeed a continuation of past activity . The group uses legitimate administration tools to fly under the radar in their post-exploitation phase , which makes detection of malicious activity , as well as attribution more complicated .


ESET detections of Android/AdDisplay.Ashas on Android devices by country Is adware harmful ? We observed implementation of this bypass in the macro code to invoke regsvr32.exe , along with a URL passed to it which was hosting a malicious SCT file . These implants are variations of earlier forms of Bankshot , a remote access tool that gives an attacker full capability on a victim 's system .


This malicious APK is 334326 bytes file , MD5 : 0b8806b38b52bebfe39ff585639e2ea2 and is detected by Kaspersky Lab products as “ Backdoor.AndroidOS.Chuli.a ” . PROMETHIUM and NEODYMIUM both used a zero-day exploit that executed code to download a malicious payload . In addition to stealing keystrokes , Naikon also intercepted network traffic .


Suckfly 's attacks on government organizations that provide information technology services to other government branches is not limited to India .


period of IRCService start @ hide Hide implant icon @ unhide Unhide implant icon @ run Execute specified shell @ broadcast Send command to the second module @ echo Write specified message to log @ install Download and copy specified component to the system path The implant uses a complex intent-based communication mechanism between its components to broadcast commands : Approximate graph of relationships between BusyGasper components Second ( main ) module This module writes a log of the command execution history to the file named “ lock ” , which is later exfiltrated The McAfee Advanced Threat Research team discovered a previously unknown data-gathering implant that surfaced in mid-February 2018 . APT33 : 5798aefb07e12a942672a60c2be101dc26b01485616713e8be1f68b321747f2f S-SHA2 Notestuk/TURNEDUP . None Enablement and usage of SQL extended stored procedures for Windows shell command execution : PIEHOP ( filename : r3_iec104_control.exe ) ( MD5 : cd8f394652db3d0376ba24a990403d20 ) is a disruption tool written in Python and packaged with PyInstaller version 2.1 + that has the capability to connect to a user supplied remote MSSQL server for uploading files and issuing remote commands to a RTU .


Also of note is Bouncing Golf ’ s possible connection to a previously reported mobile cyberespionage campaign that researchers named Domestic Kitten . Securelist believe the attacks are launched by an APT Group we track under the codename " ScarCruft " . In addition , during the investigation , we discovered certain similarities to other attacker groups that seemed to share or copy the FIN7 TTPs in their own operations . " So far we do n't have data that the attackers stole from common users but we do have at least two incidents when Winnti malware had been planted on an online game update server and


Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word . The main command and control ( C&C ) server used in this attack is hosted on an IP address which belongs to a Ukrainian ISP , specifically to a MikroTik router running a firmware version released in March 2016 .


It also targets devices made by Chinese manufacturer Xiaomi and those running MIUI , an operating system based on Google Android made by Xiaomi . Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue . In August 2013 , FireEye reported that admin@338 had been using the Poison Ivy RAT in its operations .


Israeli media published the first reports about the social networking and social engineering aspects of this campaign . According to our estimations , this group has been active for several years and specializes in cyberattacks against the online video game industry . This thread implements the main code , responsible for the entire botnet DLL . Up until now , we ’ve been relatively lucky – our most recent examples of social network - based cybercrime reveal threat actors using relatively mild motives ( monetization ) .


Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including military .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . For a long time the Winnti group had been considered as a Chinese threat actor targeting gaming companies specifically .


Conclusion The “ Corona Updates ” app had relatively low downloads in Pakistan , India , Afghanistan , Bangladesh , Iran , Saudi Arabia , Austria , Romania , Grenada , and Russia . Kaspersky Lab 's research team responded to three financial institutions in Russia that were infected with the GCMAN malware . . Most organizations receive and make use of intelligence published from third parties such as government agencies , specialist providers or collaborative groups .


Bitdefender researchers have identified a new Android spyware , dubbed Triout , which appears to act as a framework for building extensive surveillance capabilities into seemingly benign applications . In late July , SectorJ04 group used FlawedAmmy RAT to carry out hacking attacks on companies and universities in sectors such as education , job openings , real estate and semiconductors in South Korea . Carbanak is also aware of the IFOBS banking application and can , on command , substitute the details of payment documents in the IFOBS system .


July 7 Three exploits – two for Flash Player and one for the Windows kernel—were initially found in the information dump . Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt . considering each block and instruction addresses . Standard file deletion commands are available on most operating system and device interfaces to perform cleanup , but adversaries may use other tools as well .


The HenBox app downloaded in May 2016 , as described in Table 1 below , masquerades as a legitimate version of the DroidVPN app by using the same app name “ DroidVPN ” and the same iconography used when displaying the app in Android ’ s launcher view , as highlighted in Figure 2 below Table 1 . Winnti's mode of operation: to collect information on the organizational charts of companies , on cooperating departments , on the IT systems of individual business units , and on trade secrets , obviously . They have largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


Services can perform long-running operations in the background and does not need a user interface . As part of their phishing campaigns , silence still uses Microsoft Office documents with macros or exploits , CHM files , and .LNK shortcuts as malicious attachments . Flying Kitten was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of government and foreign espionage targets .


This suggests that the Snake Wine group will likely continue to escalate their activity and persistently target both private and government entities within Japan . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups .


In light of this , we believe an attack against unpatched vulnerabilities is a reasonable conjecture for how the server was compromised . The usage of KopiLuwak , a well-known and exclusive artefact previously used by the Turla group , makes us attribute this campaign to this actor with high confidence . FireEye believes the change from RIPTIDE to HIGHTIDE represents a temporary tool shift to decrease malware detection while APT12 developed a completely new malware toolset .


Shortly after releasing information on their espionage operations , our friends at TrendMicro found evidence that the operators were not only conducting classic strategic espionage but targeting SCADA systems as well . In addition to these , the Animal Farm attackers used at least one unknown , mysterious malware during an operation targeting computer users in Burkina Faso .


Another novelty is a VPN-related package , which is based on OrbotVPN . The spear phishing emails used in the known attacks by the Callisto Group were so convincing that even skilled and alert users would likely have attempted to open the malicious attachment . This spear phish contained a malicious Word document that exploited CVE-2012-0158 . Cloud API APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments .


Monitor and remove any unauthorized code present in any www directories .


All of the URLs reference the file “ mms.apk ” and all use the domain “ XXXX.ru ” , which belongs to a top five shared hosting platform in Russia ( the domain itself has been obfuscated to anonymize the provider ) . The primary operational technique used by Night Dragon comprised a variety of hacker tools , including privately developed and customized RAT tools that provided complete remote administration capabilities to the attacker . Some static information about SFX are : New variants based on leaked code are becoming more common We have continued seeing various malicious campaigns since the start of 2023 , where the threat actors have used new ransomware variants based on leaked source code or builders .


In this case , the attacker can get the list of all installed apps and then remotely launch the victim ’ s app of their choice to either steal credentials or perform malicious actions ( e.g . Nonetheless , these spam emails were not delivered to the UAE or Arabic-speaking users , but to banks in Asian countries such as India , Indonesia , and the Philippines . The use of decoy documents also reveals some of the potential targets of the Lazarus group 's malicious activity , specifically the use spear phishing attacks observed targeting South Korean government and aerospace organizations .


Stage 5 : The final loader takes control The stage 5 malware is needed only to provide one more layer of obfuscation , through the VM , of the final malware payload and to set up a special Structured Exception Hander routine , which is inserted as Wow64PrepareForException in Ntdll . Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as Oilrig1 and CopyKittens2 . The Internal name of this DLL is a randomly looking CLSID and it only exports one function called DllEntry . When exploiting these flaws , the threat actor almost always deploys a tunneling tool , the most common of which are Fast Reverse Proxy Client FRPC and Plink .


“ Pulling Back the Curtains on EncodedCommand PowerShell Attacks ” .


We labeled this new variant XLoader version 7.0 , because of the different deployment method and its use of the native code to load the payload and hide in Instagram and Tumblr profiles . The use of BLACKCOFFEE demonstrates APT17 's evolving use of public websites to hide in plain sight . If a query with the M action returns an IP address that is not 99.250.250.199 , the malware will use ping mode . In mid - June 2023 , KillNet announced that the collective and actors claiming to be from the Russian ransomware group REvil were collaborating in a joint operation targeting Western financial systems .


FIN7 is a threat actor group that is financially motivated with targets in the restaurant , services and financial sectors . Custom payloads utilized by TEMP.Veles in investigations conducted by Mandiant are typically weaponized versions of legitimate open-source software , retrofitted with code used for command and control .


Furthermore , conflating adversaries with tools , since tools can be repurposed or used by other entities than those first observed deploying them , leads to further potential confusion as the “ X actor ” is quickly compressed in the minds of some to refer to any and all instantiations of tool “ X ” .


EventBot permissions EventBot ’ s permissions as seen in the manifest file . makeself.sh is a small shell script that generates a self-extractable compressed tar archive from a directory . The Lotus Blossom actors using Emissary have been active for at least seven years in Southeast Asia .


Intezer has evidence dating back to September 2018 which shows Pacha Group has been using a cryptomining malware that has gone undetected on other engines . As shown above , the threat runs several native binaries to collect useful information for its recon phase .


In particular , this second group also has the capability of dumping users ' credentials using the same technique employed by Mimikatz . The NetTraveler group has infected victims across multiple establishments in both the public and private sector including government institutions , embassies , the oil and gas industry , research centers , military contractors and activists .


Once infected njRAT communicates to the attacker and allows the attacker to log keystrokes , upload/download files , access victims web camera , audio recording , steal credentials , view victims desktop , open reverse shell etc .


Take steps to secure Windows systems , such as installing and configuring Microsoft 's Enhanced Mitigation Experience Toolkit ( EMET ) and Microsoft AppLocker .


Due to these changes without a new date string , we believe the date codes are used for campaign tracking rather than a Bookworm build identifier . With the recent arrests of actors using the Lurk banking trojan , Buhtrap appears to be a likely alternative for actors wishing to target Russian banks and software .


Once archive is loaded , the application uses reflection api to call methods from the class names specified in the json . The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell . DustySky ( called " NeD Worm " by its developer ) is a multi-stage malware in use since May 2015 .


The Zen trojan uses its root privileges to turn on accessibility service ( a service used to allow Android users with disabilities to use their devices ) for itself by writing to a system-wide setting value enabled_accessibility_services . The attack wave started in late July 2011 and continued into midSeptember 2011 . Both Japan and Taiwan are important intelligence collection targets for China , particularly because of recent changes to Japan ’s pacifist constitution and the upcoming Taiwanese election . Adversaries may manipulate control systems devices or possibly leverage their own , to communicate with and command physical control processes .


In contrast however , for OnionDuke and MiniDuke the linked image files contain embedded malware to be downloaded and executed , rather than instructions .


, kernel32.dll , advapi32.dll , and version.dll ) and remapping them in memory . The Magic Hound attack campaign is an active and persistent espionage motivated adversary operating in the Middle East region . OceanLotus Steganography Malware Analysis White Paper . Eventually , when the DLL is copied into its final path , rundll32.exe is used to call the exported function SetQueryNetSessionCount , which downloads the next stage .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal . One e-mail carried a Microsoft PowerPoint file named " thanks.pps " ( VirusTotal ) , the other a Microsoft Word document named " request.docx " .


Microsoft is aware of the outstanding local privilege escalation vulnerability in Windows ( CVE-2015-1701 ) .


SUSPECTED DETECTION TESTS BY THE THREAT ACTOR In searching for EventBot , we ’ ve identified multiple submissions from the same submitter hash , 22b3c7b0 : EventBot 22b3c7b0 submitter hash The 22b3c7b0 submitter hash that submitted most of the EventBot samples to VirusTotal . Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware . The May 2014 ' Operation Saffron Rose ' publication identifies an Iranian hacking group formerly named ' Ajax Security ' ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


Additionally , a specific loader is often associated with the MiniDuke toolset and is referred to as the “ MiniDuke loader ” .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . The CVE-2012-0773 was originally discovered by VUPEN and has an interesting story .


If a smartphone or tablet was released more than a year ago , it is probably no longer supported by the manufacturer and patching of vulnerabilities is no longer provided . They used an exploit of Internet Information Server to inject keylogger and backdoor malware onto the Exchange server . The numbering on each arrow corresponds to the chronological sequence of events . Considering that both Royal and BlackSuit were active last month , however , a rebrand probably is n’t happening any time soon .


July 20 A new zero-day vulnerability ( CVE-2015-2426 ) was found in Windows , which Microsoft fixed in an out-of-band patch . CopyKittens use several self-developed malware and hacking tools that have not been publicly reported to date , and are analyzed in this report : TDTESS backdoor ; Vminst , a lateral movement tool ; NetSrv , a Cobalt Strike loader ; and ZPP , a files compression console program . Additionally , In early 2023 , KillMilk , the claimed founder of KillNet , attempted to ransom the purportedly stolen documents to NATO for 3 bitcoin , possibly in part to increase attention surrounding the activity .


One common evasive mechanism used by the Spark backdoor is its ability to check for installed security products using WMI queries ( WQL ) .


The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies . After that , the attacker is capable to control the compromised device .


Back in 2011-2012 , the group used a relatively tiny implant ( known as “ Sofacy ” or SOURFACE ) as its first stage malware .


The keywords are comprised of the names of individuals .


MyReceiver and AlarmReceiver start the MainService whenever appropriate events occur . One vulnerability is a Windows zero-day vulnerability (CVE-2019-0703) discovered by Symantec . BRONZE BUTLER : REDBALDKNIGHT , Tick .


] com csip6 [ . APT41 has established and maintained strategic access to organizations in the healthcare , high-tech , and telecommunications sectors . POSHSPY is an excellent example of the skill and craftiness of APT29 .


Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others . Until late December 2015 , in nearly every Infy message documented since our tracking began in May 2013 , no attempt included strong tailoring of the approach , often not even including an email body , instead relying on cryptic filenames and email subjects to attract interest .


Multiple Dipsind variants have been identified , all of which are believed to be used exclusively by PLATINUM . During Kaspersky Lab 's analysis of NetTraveler , the company 's experts identified six victims that had been infected by both NetTraveler and Red October , which was another cyberespionage operation analyzed by Kaspersky Lab in January 2013 .


Call Service Figure 5 : Code for the calls service As seen above , the calls service stores incoming call details in .mp3 format in the /sdcard/DCIM/.dat/ directory with file name appended with " In_ '' for incoming calls and " Out_ '' for outgoing calls . These include CVE-2010-3962 as part of an attack campaign in 2010 and CVE-2014-1776 in 2014 . It is sometimes referred to as FIN7 , but these appear to be two groups using the same Carbanak malware and are therefore tracked separately .


If one of the applications is deleted , the second application downloads and re-installs the removed one . FireEye iSIGHT Intelligence confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . FIN7 is a threat actor group that is financially motivated with targets in the restaurant , services and financial sectors .


As described in earlier analyses , Downeks ’ main purpose is as a downloader .


From the samples we collected , we can conclude that the same threat actor produced many individual malware modules during the last ten years . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 . As we wrote then , compared to Kingphish , Bahamut operates as though it were a generation ahead in terms of professionalism and ambition .


The code supports two different installation methods : setup in a UAC-enforced environment ( with limited privileges ) , or an installation with full-administrative privileges enabled ( in cases where the malware gains the ability to run with elevated permissions ) . APT35 , also known as the Newscaster Team , is a threat group sponsored by the Iranian government that conducts long term , resource-intensive operations to collect strategic intelligence . To aid in the recovery of encrypted payloads , the following Python script can be used to decode pixel colors from a .png image . If the main function is called with only , it will take the path that is intended for connect to the MSSQL server and , upload • None are supplied to the main function , it will immediately fail due to attempting to utilize command line arguments that were not parsed yet .


We also observed automatically generated files on the C2 , indicating the actor behind this campaign also issues commands to search for and exfiltrate PDF and Office documents . This is also a full-featured backdoor controlled by email , and which can work independently of any other Turla component . The ShellMain function is a stub that relocates the DLL to another buffer and spawns a thread that starts from ShellMainThreadInt at offset +0xC0CD . Through this entry , in which we take a closer look at an individual who we believe might be connected to the Winnti group , we hope to give both ordinary users and organizations better insights into some of the tools – notably the server infrastructures- these kinds of threat actors use , as well as the scale in which they operate .


This is done by opening the Google account creation process and parsing the current view . Attackers then moved on to the motor industry in late May . TechNet ’s security was in no way compromised by this tactic , which is likely possible on other message boards and forums . As a consequence , four trams were derailed and twelve people injured due to resulting emergency stops .


Later campaigns saw new attachment types , even as Dridex and Locky payloads remained largely unchanged .


APT28 has continued to develop its tools over the past two years .


They move laterally and escalate system privileges to extract sensitive information — whenever the attacker wants to do so.4 ,5 Because some RATs used in targeted attacks are widely available , determining whether an attack is part of a broader APT campaign can be difficult . Sometimes , however , certain samples made use of domain names for HTTP communication .


This is only a small picture of the threat actor 's operations . Seeking to tease out any possible links between Operation Aurora , VOHO , Operation DeputyDog , and Ephemeral Hydra , we began with Symantec 's Hidden Lynx report as our foundation . We have evidence suggesting that APT1 manually controls thousands of systems in support of their attacks , and have directly observed their control over hundreds of these systems . It can range from asking “ customers ” to pay a monthly fee for access to this set of tools to use in cyber attacks , or users can even pay the original creators to distribute the malware on their behalf and manage the infection .


Educate users about the risks of spearphishing emails .


] site/gate_cb8a5aea1ab302f0_c online 208.91.197 [ . The role of the .NET module is to deliver the known KopiLuwak JavaScript Trojan . It was a decoy to make visitor download a " Flash Player " , which was in fact DownPaper malware , analyzed later in this report .


On November 26 , 2015 , a suspected China-based APT16 sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies . In early 2016 , the Callisto Group was observed sending targeted spear phishing emails .


The main infection vector is a phishing attack using SMS/MMS . PLEAD also uses CVE-2017-7269 , a buffer overflow vulnerability Microsoft Internet Information Services ( IIS ) 6.0 to compromise the victim 's server . Since this malware dates back to around 2004 , there are many samples containing CNC URLs from the 3322.org page . The HyperText Transfer Protocol ( HTTP ) redirect status response code indicates that the resource requested has been temporarily moved to the URL given by the header .


Report_URL : https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/


Missing permissions The lack of the READ_FRAME_BUFFER permission can be justified by the removal of the screen record feature . executable compilation times suggest early 2012 . RIPTIDE ’s first communication with its C2 server fetches an encryption key , and the RC4 encryption key is used to encrypt all further communication . Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.[22][23 ]


The initial attack vector leveraged a phishing email , using the subject line of Upcoming Defense events February 2018 and a sender address claiming to be from Jane ’s 360 defense events events@ihsmarkit.com .


Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() . Ordnance will be able to immediately generate shellcode after users provide the IP and PROT that the shellcode should connect to or listen on .


On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website . In the known spear phishing attacks by the Callisto Group , they employed the " Scout " malware tool from the RCS Galileo platform .


Since at least 2013 , HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government , financial , automotive , and media industries . The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) .


Hashes of samples Type Package name SHA256 digest Custom ads com.targetshoot.zombieapocalypse.sniper.zombieshootinggame 5d98d8a7a012a858f0fa4cf8d2ed3d5a82937b1a98ea2703d440307c63c6c928 Click fraud com.counterterrorist.cs.elite.combat.shootinggame 84672fb2f228ec749d3c3c1cb168a1c31f544970fd29136bea2a5b2cefac6d04 BBSRAT is typically packaged within a portable executable file , although in a few of the observed instances , a raw DLL was discovered to contain BBSRAT . Two files are created for the task at approximately the same time : C:\Windows\System32\Tasks\At1 and C:\Windows\Tasks\At1.job . The PE file also appeared to be a modification of the Miniduke 's main backdoor module that uses the same Twitter URL as the Java payload .


Report_URL : https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/


FakeSpy masquerades as legitimate postal service apps and transportation services in order to gain the users ' trust . Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe . Its activity subsequently increased in the second quarter of 2018 , with a particular spike in April 2018 .


Eleven of the links were clicked once , four were clicked twice , two were clicked three times , and two were clicked four times .


Malware Testing Environment Tied to TEMP.Veles .


In the lab , we changed our Quasar RAT source code to use the known encryption key , and to send fake victim IP address , City , Country code , Flag , and Username .


Patch applications and operating systems .


First , an activity named MainActivity fires up , taking care of hiding the icon and showing the fake notification . During our 2018 monitoring of this group , we were able to identify different techniques utilized by very similar attackers in the MENA region , sometimes on the same target . Winnti malware handles outbound communications using multiple protocols including : ICMP , HTTP , as well as custom TCP and UDP protocols .


Beaconing information The ID is generated for each installation of the malware , while the token remains unique . It is in use by the Molerats ( aka Gaza cybergang ) , a politically motivated group whose main objective , we believe , is intelligence gathering . January 2019 sent via 149.28.156.61 to deliver either Derusbi or KHRat samples with either cswksfwq.kfesv.xyz or connect.bafunpda.xyz as C2 . LIGHTWORK utilizes positional command line arguments for target device , port , and IEC-104 command .


Worryingly , some of the modifications enforced by the spyware might expose the infected devices to further compromise or data tampering . On August 23 , 2017 , we observed OilRig targeting an organization within the United Arab Emirates government . The Exfiltration , however , is done via other cloud providers . However , the problem in general with labeling every ransomware attack as sophisticated is that it excuses the organization that has nt followed the basic preventative best practices .


A particularly interesting aspect of one of the two documents we analyzed was the filename used , crash list ( Lion Air Boeing 737 ).docx .


The Poison Ivy builder kit allows attackers to customize and build their own PIVY server , which is delivered as mobile code to a target that has been compromised , typically using social engineering . Unit 42 enumerated the threat infrastructure related to Bookworm and created a chart to visualize connected entities to its current attack campaign .


Specifically , the threat group used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows .


TG-3390 is known for compromising organizations via SWCs and moving quickly to install backdoors on Exchange servers .


Although there was no evidence of the group using the malware , the threat actors may have leveraged its access or capabilities during earlier phases of the intrusions .


Cannon email Accounts :


Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 .


The data is first encrypted and then encoded with Base64 .


How does the malware work without code for these key components ? At least one of the attacks in this campaign leveraged a European security and defense-themed lure , which aligns with the targeting preferences for this group . Aside from this, there were several other suspicious items we noted: Headers mismatched: The Reply-To and From email address were . But while it was clear earlier on that attackers were actively exploiting CVE-2023 - 34362 , it was only a few days later that it became clear that Cl0p was behind the attacks .


Sofacy ’s reported presence in the DNC network alongside APT29 brought possibly the highest level of public attention to the group ’s activities in 2016 , especially when data from the compromise was leaked and “ weaponized ” .


The function main uses a DES encryption algorithm to encode these addresses . To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT . During our brief window of visibility into one of the known 22 CnC nodes , FireEye observed the Ke3chang conducting reconnaissance and moving laterally throughout the compromised networks .


Having analyzed a few variants of the malware , we noticed that the private key was exposed in the code and did not change . It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations . Symantec detects this threat as Backdoor.Nidiran .


The investigation uncovered that an actor had used these devices to gain initial access to corporate networks .


A third , similar , CosmicDuke campaign was observed presumably targeting Georgian entities since it used an attachment with a Georgian-language name that translates to “ NATO consolidates control of the Black Sea.docx ” .


To surface its ransom note , it uses a series of techniques that take advantage of the following components on Android : The “ call ” notification , among several categories of notifications that Android supports , which requires immediate user attention . All contain the same Visual Basic macro code and author name as Honeybee . After the check , Pikabot is a new malware first seen in early 2023 .


But there 's little stopping it from doing much worse . CTU researchers assess this as the continuation of activity first observed in 2016 , and it is likely that the campaign is ongoing . APT33 : 8.26.21.220 [REDACTED].ddns.net . One possibility is that such claims were made disingenuously as an attempt to establish KillNet 's credibility and/or as a means to distance the group from the Russian government .


BOSS SPIDER used both enterprise and per-host pricing during their campaigns . In many attacks , the group has succeeded in compromising Microsoft Exchange or Lotus Domino email servers in order to intercept company emails and possibly use them to send counterfeit emails .


The fact that the overlay screens are almost identical to the legitimate banking apps suggests that the actors might be very familiar with the Spanish banking applications and might even be accustomed to the language . In one of the attacks , Rapid7 identified the attackers escaping a Citrix application in order to run the payload script on the victim desktop . The Gh0st downloaders employ simple substitution ciphers for hiding strings .


The attacks use Domain Name System ( DNS ) cache poisoning/DNS spoofing , possibly through infringement techniques such as brute-force or dictionary attacks , to distribute and install malicious Android apps . The actors behind LUCKY ELEPHANT recognize the effectiveness and use doppelganger webpages nearly identical to legitimate sites , enticing users to input their credentials . Only a small portion of this code is actually used to start the infection , the rest is just junk code .


Although early versions had some basic code and string obfuscation , protection of the third version of the malware was enhanced with the use of payload obfuscation . The attackers then enumerated access and conducted privilege escalation on the victim networks , utilizing DLL sideloading techniques documented in a US-CERT alert on APT10 to deliver malware . The " Tick " group has conducted cyber espionage attacks against organizations in the Republic of Korea and Japan for several years .


however , overall there is wide geographical spread of infections .


This evidence indicates that the certificate ’s rightful owner either misused it or it had been stolen from them .


Back in October 2016 , Unit 42 published an initial analysis on a Flash exploitation framework used by the Sofacy threat group called DealersChoice .


] infokalisi [ . The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) . The supplied registration information , which is still visible in public “ whois ” data as of February 3, 2013 . If scripts are not commonly used on a system , but enabled , scripts running out of cycle from patching or other administrator functions are suspicious .


Based on the profile of the victims and the type of information targeted by the attackers , Symantec believes that Butterfly is financially motivated , stealing information it can potentially profit from . In a separate incident , CTU researchers identified a file named s.txt , which is consistent with the output of the Netview host-enumeration tool .


We 've seen that this has been the case for many years with spear-phishing campaigns on desktop and mobile platforms , so , unfortunately , it does n't seem that this will change any time soon . Their long run of attacks , focused on Latin American countries , has allowed them to collect intelligence and refine their tactics over the years . We do not have evidence that the earliest targeted financial institutions were victimized by fraudulent transactions before APT38 left the compromised environments , possibly indicating that APT38 was conducting reconnaissance-only activity at that time .


The Apple Developer Enterprise program is intended to allow organizations to distribute proprietary , in-house apps to their employees without needing to use the iOS App Store . Microsoft addressed the SMBv1 vulnerabilities in March 2017 with Security Bulletin MS17-010 . As MuddyWater has consistently been using POWERSTATS as its main tool , they are relatively easy to distinguish from other actors .


However , the persistent presence of Italian language both on the Google Play Store pages as well as inside the spyware code was a clear sign that an Italian actor was behind the creation of this platform . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . When the victims open the document , they are encouraged to click on Enable Content , which causes the embedded malicious macro E-TOOL code to run . It is accessed using a path confusion exploit , CVE-2022 - 41040 , allowing the attacker to reach the backend for arbitrary URLs .


Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 . To our knowledge , Turla is the only espionage group that currently uses a backdoor entirely controlled by emails , and more specifically via PDF attachments .


TEMP.Periscope BackgroundActive since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


The various stealth and resilience techniques implemented in the adware show us that the culprit was aware of the malicious nature of the added functionality and attempted to keep it hidden . Written in pure C language , Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions , and carries out integrity control of various system components to avoid debugging and security detection . This malware is capable of accessing device configuration data , downloading additional files , executing commands , modifying the registry , capturing screen shots , and exfiltrating data .


The Word document usually exploits CVE-2012-0158 . The Arbor report describes the ongoing use of these four vulnerabilities in a series of espionage campaigns against not only Tibetan groups , but also others related to Hong Kong , Taiwan , and Uyghur interests .


All of these apps are developed by the same framework and hence have the same package name and certificate information as seen in Figure 12. certificate Figure 12 : Package name and certificate information . However , in this attack , this file is used to load the Hussarini backdoor via DLL hijacking . APT17 is a China based threat group that has conducted network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


These were instead spread using either a malicious Tor node that would trojanize legitimate applications on-the-fly with the OnionDuke toolset , or via torrent files containing previously trojanized versions of legitimate applications .


They would then use the toolset to gather initial information on the victims , before deciding which ones to pursue further .


We do not know why , but we suspect that it was an attempt to hide the origin of the application . Figure 2 is a typical example of a generic invoice the group used in a campaign in 2014 . They are both Korean-speaking threat actors and sometimes their victimology overlaps .


] commediauploader [ . The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll . That is , this server component receives connections from victim backdoors , displays them to the intruder , and then translates the intruder ’s commands into HTML tags that the victim backdoors read . Operating systems may have features to hide various artifacts , such as important system files and administrative task execution , to avoid disrupting user work environments and prevent users from changing files or features on the system .


Even though this is not a traditional remote access tool ( RAT ) , this campaign seems to target mainly private users . Attackers can point and click their way through a compromised network and exfiltrate data . This module is used by the backdoor during HTTP/HTTPS communication with the C2 server and has a proxy bypass functionality . In the case of ProxyNotShell , the targeted backend service is the Remote PowerShell service .


Specifically , the only known infection vector for HammerDuke is to be downloaded and executed by CozyDuke onto a victim that has already been compromised by that toolset .


This particular iteration was submitted to VirusTotal on September 16 , 2016 .


The C2 server domain is linked to Thai food : Nampriknum [ . Madi was found capturing computer screens , recording audio and stealing screenshots , keystrokes , documents and e-mail correspondence from " Middle Eastern critical infrastructure engineering firms , government agencies , financial houses and academia . Some similarities exist across different versions of the Base64 alphabet , which indicates that these are most likely not completely randomly generated . Designed to guard against XSS attacks , CSP helps control which domains can be accessed as part of a page and therefore restricts which domains to share data with .


We believe this indicates a fairly sustained campaign that has gained momentum over recent months . The basic chain of events upon execution of the MSIL dropper include dropping and executing both a PDF decoy and a Javascript (JS) dropper . The spear-phishing campaign against Asian entities isn't isolated , the admin@338 also started another attack against the US-based think tank on 14th March .


This new organization proposed the creation of a more secure Android phone . We were soon able to help investigate another incident involving Lurk . The malware also sets the executable file ’s attributes to “ Hidden. ” Some of the file names the attackers used include : winhlps.exe , acrotry.exe , AcroRd32.exe , Updater.exe . The RAT 's main binary is launched from " C:\Users\%username%\AppData\Roaming\BranScale\client32.exe " .


HOMEFRY: a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors . RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself .


Information about travel plans and campaign scheduling could provide short-term opportunities for other intelligence operations .


The group uses spear-phishing emails to compromise its targets and infect them with malware .


As mentioned in this blog , Sofacy is carrying out parallel campaigns to attack similar targets around the world but with different toolsets .


Spam emails targeting email accounts used in the integrated mail service of public officials were also found in the hacking activity . While investigating one of these infections involving White Lambert ( network-driven implant ) and Blue Lambert ( active implant ) , we found yet another family of tools that appear to be related .


] comkalisi [ . One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges . Nevertheless , it is noteworthy that Shanghai appeared in the first known APT1 domain registration , along with a phone number that begins with China ’s “ +86 ” international code . Monitor for newly constructed user accounts that may attempt to hide artifacts associated with their behaviors to evade detection .


This is usually done in order to validate the target of a new infection . During this testing , we saw document filenames that contain the C2 we witnessed in the targeted attack above , specifically the filenames XLS-withyourface.xls and XLS-withyourface – test.xls . The actor used the same trick that FireEye in the Flare-On 6 : Challenge 7: They removed the header of the python bytecode . Leveraging this access , an attacker can send remote commands to affect the actuation of power line switches and circuit breakers to cause power disruption .


Additional Downeks downloaders connecting to the previously-observed server dw.downloadtesting.com were also found in this attack :


During our investigation of the campaign , we identified a number of global targets across several industries who were attacked in 2015 .


They were also seen enumerating administrative groups to attempt further exploitation .


APT28 isn’t the only group targeting travelers .


The Blackfly attacks share some similarities with the more recent Suckfly attacks .


Within this time period , we identified close to 300 samples belonging to this family ( all sample hashes are listed in the Appendix ) . NEODYMIUM used a backdoor detected by Windows Defender as Wingbird , whose characteristics closely match FinFisher , a government-grade commercial surveillance package . Brief Description : Dot ﬁle enabling the infection of the Gamaredon Pteranodon . Ashley Madison ’s parent company — Toronto - based Avid Life Media — filed a trademark infringement complaint in 2010 that succeeded in revealing a man named Dennis Bradshaw as the owner .


It is basically SMS spam : many people still follow suspicious links , install software from third-party sources , and give permissions to apps without a second thought . In 2015 , the SecureWorks documented the BRONZE UNION threat group ( formerly labeled TG-3390 ) , which CTU analysis suggests is based in the People's Republic of China ( PRC ) . Users are advised to close unused ports , to secure ports and other internet-facing devices that are regularly open for system administrators ’ support . These frameworks are commonly delivered as part of traditional commodity malware , so infection chains can vary widely .


] today During our investigation , we identified at least four major releases of the RAT . This migration activity was last observed in October 2016 . While their identities remain unknown , the attackers behind the IXESHE campaign demonstrated that they were both determined and capable . Having such a gap with the most commonly used domain allowed with CSP is a major risk indicator of the threats that can come from other domains that are used to serve multiple accounts .


TG-3390 : ctcb.blackcmd.com .


The attack began with a web shell running on a vulnerable , publicly-facing server , from which the attackers gathered information about the network and propagated across the network . Given our increased confidence that Bahamut was responsible for targeting of Qatari labor rights advocates and its focus on the foreign policy institutions other Gulf states , Bahamut 's interests are seemingly too expansive to be limited one sponsor or customer .


Investigation of this testing activity reveals multiple independent ties to Russia , CNIIHM , and a specific person in Moscow .


The primary difference between the CVE-2014-0515 metasploit module and this exploit is , obviously , the vulnerability .


Changes to Egypt ’s internal political climate are known to have affected Egyptian government relations with Hamas over the years .


While we know that the attackers used the Nidiran back door to steal information about the compromised organization , we do not know if Suckfly was successful in stealing other information .


In all cases , the ads are used to convince users to install other apps from different developer accounts , but written by the same group . Recently , Falcon Intelligence observed new activity from MUSTANG PANDA , using a unique infection chain to target likely Mongolia-based victims . This is based on the use of the known APT16 domain rinpocheinfo.com , as well as overlaps in previously observed targeting and tactics , techniques and procedures ( TTPs ) . These are also highly targeted emails with ( relatively speaking ) convincing lures , so whoever is behind these is not to be ignored .


Recently , the ThreatLabZ research team came across a fake Netflix app , which turned out to be a new variant of SpyNote RAT ( Remote Access Trojan ) . In the last successful attack described in Silence: Moving into the darkside , dated April 2018 , the hackers siphoned off about $150 , 000 through ATMs in a single night . Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems .


This ZeroT executable communicated with the C&C domain www.kz-info.net and downloaded PlugX as well as an additional PCRat S-VULNAME/Gh0st Trojan which communicated with the www.ruvim.net C&C server .


The threat actors have used the Baidu search engine , which is only available in Chinese , to conduct reconnaissance activities .


While not directly overlapping , this potential infrastructure link is interesting , as Vixen Panda has previously displayed TTPs similar to COMMENT PANDA , and has extensively targeted European entities . The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine .


Skygofree : Following in the footsteps of HackingTeam 16 JAN 2018 At the beginning of October 2017 , we discovered new Android spyware with several features previously unseen in the wild . In the past , countries such as Saudi Arabia , the UAE and Turkey have been a MuddyWater's main target , but the campaigns have also reached a much wider audience , making their way to victims in countries such as Belarus and Ukraine . They appear to focus on targeting individuals of interest to Iran who work in academic research , human rights , and media , with most victims having been located in Iran , the US , Israel , and the UK .


Recently , we have come across another variant of this app portraying itself as TikTok Pro , but this is a full-fledged spyware with premium features to spy on victim with ease . EvilGnome's functionalities include desktop screenshots , file stealing , allowing capturing audio recording from the user’s microphone and the ability to download and execute further modules . Strings within this sample associated with the malware ’s operations are encoded using a single-byte XOR encoding .


KeyBoy provides basic backdoor functionality , allowing the operators to select from various capabilities used to surveil and steal information from the victim machine . In other words , the attackers attracted our attention by attempting to exploit Kaspersky Lab products .


CVE-2018-0798 is an RCE vulnerability , a stack buffer overflow that can be exploited by a threat actor to perform stack corruption . FIF is notable for its links to the Lashkar-e-Taiba ( LeT ) terrorist organization , which has committed mass-casualty attacks in India in support of establishing Pakistani control over the disputed Jammu and Kashmir border region .


com.advantage.RaiffeisenBank pl.bzwbk.ibiznes24 pl.bzwbk.bzwbk24 pl.bzwbk.mobile.tab.bzwbk24 com.comarch.mobile.investment com.android.vending com.snapchat.android jp.naver.line.android com.viber.voip com.gettaxi.android com.whatsapp com.tencent.mm com.skype.raider com.ubercab com.paypal.android.p2pmobile The group primarily uses Truvasys , a first-stage malware that has been in circulation for several years . The new wave dates back to the end of November 2019 and was ﬁrst analyzed by Vitali Kremez . The contents found in secure[.]66[.]to often lead to zhu[.]vn , which is Hack520 ’s domain for hosting his own private blog .


This isn’t a bad thing as it shows a natural grouping of nodes that could be a good candidate to group to help simplify the overall graph and make analysis easier . The download name was " Zawgyi_Keyboard_L.zip " , and it dropped a " setup.exe " that contained several backdoor components , including an Elise " wincex.dll " ( a42c966e26f3577534d03248551232f3 , detected as Backdoor.Win32.Agent.delp ) .


It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations . RCS Galileo platform .


In 2013 , there was evidence of cooperation ( most probably on a commercial basis ) between different groups of virus writers . It's possible TG-3390 used a waterhole to infect data center employees . This article focuses on the technical details of this new ShadowPad variant . Protecting your information and systems from every vantage point , including your networks , devices , applications , transmissions , privileges , and storage is critical , as is regularly training your staff on the latest cyber threats , trends , and ransomware phishing attacks .


The command and control domains were different , and these samples used unique decoy documents to target their victims .


Firmware is low-level code deep in an operating system that often has high access privileges , so it 's critical that it 's verified and contains no software vulnerabilities . APT10's unprecedented campaign against MSPs , alleged to have included some of the largest MSPs in the world , in order to conduct secondary attacks against their clients , grants the Chinese state the ability to potentially access the networks of hundreds (if not thousands) of corporations around the world . Minzen : 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 .


Filename : attachedTemplate.dotm MD5 : 018611b879b2bbd886e86b62484494da Filename : templates.dotm MD5 : 2a794b55b839b3237482098957877326 .


In comparison , XENOTIME was defined based on principles of infrastructure ( compromised third-party infrastructure and various networks associated with several Russian research institutions ) , capabilities ( publicly- and commercially-available tools with varying levels of customization ) and targeting ( an issue not meant for discussion in this blog ) .


After gaining access to a target network in one intrusion analyzed by CTU researchers , TG-3390 actors identified and exfiltrated data for specific projects run by the target organization , indicating that they successfully obtained the information they sought .


The PDF lists dates of birth , gender , passport numbers , and names . We will detail how the C&C infrastructure and tools used by hacker group Hidden Lynx during its VOHO campaign ( 2012 ) , excellently documented by Symantec researchers last September , overlap with tools used in other high profile operations during the past few years . The sheer number of APT1 IP addresses concentrated in these Shanghai ranges , coupled with Simplified Chinese keyboard layout settings on APT1 ’s attack systems , betrays the true location and language of the operators . Ransomware - as - a - service is a relatively new version of these commodity groups , such as DarkSide , known for the cyber attack in 2021 that disrupted the Colonial oil pipeline and made gas more expensive for thousands of U.S. consumers .


for Android with Extensive Surveillance Capabilities August 20 , 2018 No operating system is safe from malware , as cyber criminals will always want to steal , spy or tamper with your data . SectorJ04 group conducted hacking activities targeting financial institutions located in India and Hong Kong around April 2019 . If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation .


NEW CYBER ESPIONAGE CAMPAIGNS TARGETING PALESTINIANS Over the last several months , the Cybereason Nocturnus team has been tracking recent espionage campaigns targeting the Middle East .


In particular , TG-3390 has exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code . Initial attack targets are commonly software and gaming organizations in United States , Japan , South Korea , and China .


The developer name used , GAS Brazil , suggests the criminals behind the app targeted Brazilian users . In May 2018 , campaigns being conducted by SWEED began leveraging another vulnerability in Microsoft Office: CVE-2017-11882 , a remote code execution bug in Microsoft Office that is commonly observed being leveraged in malicious documents used in commodity malware distribution . The naming scheme used by Novetta for the malware identified during Operation Blockbuster consists of at least two identifiers which each identifier coming from the International Civil Aviation Organization ( ICAO ) 's phonetic alphabet ,2 commonly referred to as the NATO phonetic alphabet .


These malware samples leverage the user agent string “ OPAERA ” , the same one identified in the Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA blog .


TrickMo Calls pushTAN The pushTAN method is a hurdle for malware apps that may reside on the same device , and it ’ s particularly challenging for mobile malware due to Android ’ s application sandbox . Russian cyber espionage actors use zero-day exploits in addition to less complex measures . When we first discovered the OilRig attack campaign in May 2016 , we believed at the time it was a unique attack campaign likely operated by a known , existing threat group .


As an example , in the two images below , we can see the encrypted and decrypted shared preferences file , which is encrypted using the java “ PBEWithMD5AndDES ” algorithm . The toolset includes reams of documentation explaining how the cyber weapons work , as well as details about their use in highly classified intelligence operations abroad . These incidents involved spear-phishing attacks , which characteristic of HELIX KITTEN , included emails containing malicious PowerShell in their macros that connects to known C2 infrastructure .


Kaspersky Lab reported the Trojan to Google , and it has now been removed from the store . With this level of access , the gang has been able to pull off a clever trick by automating the rollback of ATM transactions . In this example , the webpage that the attacker is monitoring is booking.com ( more specifically , the page containing the card details ) . They have named it Industroyer – the biggest threat to Industrial Control Systems ( ICS ) since Stuxnet .


Pivoting on specific file attributes and infrastructure indicators , Unit 42 was able to identify and correlate additional attacker activity and can now provide specific details on a targeted WINDSHIFT attack as it unfolded at a Middle Eastern government agency . The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 .


In this instance , the C2 communication implemented by the Micropsia backdoor also used specific names for different C2 commands .


Providing the app has registered an intent to process particular events from the system , and one of said events occurs , HenBox is effectively brought to life through external stimulus from another app on the system broadcasting a request , or the system itself broadcasting a particular event has occurred . This provides another connection between the targeting of the cryptocurrency organizations and video game targeting . In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations , and characterized APT28 's activity as aligning with the Russian government 's strategic intelligence requirements .


The coding style suggests that the cybercriminals behind this campaign are amateurs . Starting in February 2018 , Palo Alto Networks Unit 42 identified a not just goto . If passed , it would require U.S. financial institutions hit with ransomware to notify the Director of the Treasury Departments Financial Crimes Enforcement Network with details of the attack and the ransom demand .


It can also identify open ports , collect web banners , and download secondary files .


Security Without Borders has recently published an analysis of this family , independently , through their blog . To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer . This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia .


In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves . Many of the tools they use now feature new behaviors , including a change in the ACT they maintain a foothold in the targeted network .


Scarlet Mimic primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 . According to the German press , the intruders used the Winnti family of malware as their main implant , giving them persistent access to the conglomerate 's network as early as February 2016 .


By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device . In addition to the aforementioned post-exploitation tools , the actors used these webshells to upload legitimate executables that they would use DLL sideloading to run a malicious DLL that has code overlaps with known Emissary Panda attacks .


The primary source of data used in this analysis is Palo Alto Networks WildFire , which analyzes malware used in attacks across the world . COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites .


However , the actual timeline of the creation of different variants is unclear . After successfully infecting one of the computers and gaining initial access to the system , the attackers perform reconnaissance of the local network in order to gain domain administrator privileges and eventually consolidate control over the network . IRONHALO : AcroRd32Info.exe.exe a8ccb2fc5fec1b89f778d93096f8dd65 . This activity is followed quickly by additional access and persistent mechanisms .


Port 6205 : Gmail extraction service . activity originated from three separate IP addresses , all located in Chengdu , China . With regards to decoy content themes , this campaign resembles previous campaigns reported in blogs by Vectra , Unit 42 , and Talos . Education accounts for a huge proportion of known Vice Society attacks .


KASPERAGENT is Microsoft Windows malware used in efforts targeting users in the United States , Israel , Palestinian Territories , and Egypt since July 2015 .


APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel files to deliver their initial exploits . Despite the initial perception that the maldoc sample was intended for ICS or OT staff , LYCEUM has not demonstrated an interest in those environments .


FireEye has detected more than 20 cyber threat groups suspected to be sponsored by at least four other nation-states attempting to gain access to targets in the energy sector that could have been used to cause disruptions . The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People 's Republics .


Another attack group , Earworm ( aka Zebrocy ) , has been active since at least May 2016 and is involved in what appears to be intelligence gathering operations against military targets in Europe , Central Asia , and Eastern Asia .


] 133 ” as a main C2 address , and there is only one domain that is hosted on this dedicated server – iliageram [ . It's coincident that both 'darkhydrus' APT group name and ‘Williams’ user name in PDB path found in this Twitter user . ScarCruft tools : 032ed0cd234f73865d55103bf4ceaa22 Downloader .


Lookout customers are protected against this threat and additionally we have included a list of IOCs at the end of this report . cyberattacks against high-value targets in Ukraine in December 2015 and December 2016 . The content of the ZIP attachment it displayed in its UI was not the one it extracted! This sample challenges gateways . Surprisingly enough , it does not take very long to get some information about Hack520 : someone with this handle runs a blog and a Twitter account ( with a handle close to Hack520 ) that is also directly linked to the blog .


Emotet is a type of general-purpose malware that evolved from a well-known banking Trojan , " Cridex " , which was first discovered in 2014 . Some hackers even went onto use the Cisco exploits in the wild .


Mandiant 's APT1 report was the first to change the game , and paved the way for private security companies to expose advanced threat actors en masse . In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e. , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 .


In 2013 , the group deployed a watering hole attack , also known as a strategic web compromise to infect victims with their backdoor . Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers .


Upon decryption , we can see that the response from the server is a JSON object of EventBot ’ s configuration , which contains C2 URLs and a targeted applications list . The most recent sample of Bemstour seen by Symantec appears to have been compiled on March 23 , 2019 , eleven days after the zero-day vulnerability was patched by Microsoft . Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES .


Use of a shared hosting service to distribute malware is highly flexible and low cost for the threat actors . Recently we were able to observe these actors making modifications to their Clayslide delivery documents in an attempt to evade antivirus detection . Ssdeep : 24576:vmoO8itbaZiW+qJnmCcpv5lKbbJAiUqKXM : OoZwxVvfoaPu . The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


For instance , the earliest known CozyDuke version utilized a feature of the Microsoft Visual C++ compiler known as run-time error checking .


More technically inclined people can detect infections by seeing if a device connects to a control server located at app.blinkingcamera.com . The most common communication mode for a RAT is to act as a client to a remote server . NetWeird ( Trojan.Netweird.B ) : A commodity Trojan which can open a backdoor and steal information from the compromised computer . PIEHOP utilizes LIGHTWORK to execute the IEC-104 commands " ON ” or " OFF " on the remote system and immediately deletes the executable after issuing the commands .


CosmicDuke ’s information stealing functionality includes : Keylogging , Taking screenshots , Stealing clipboard contents , Stealing user files with file extensions that match a predefined list , Exporting the users cryptographic certificates including private keys , Collecting user credentials , including passwords , for a variety of popular chat and email programs as well as from web browsers CosmicDuke may use HTTP , HTTPS , FTP or WebDav to exfiltrate the collected data to a hardcoded C&C server .


The source process changes the registers in the target process so that PC register points directly to the shellcode . Potao is another example of targeted espionage malware , a so-called APT , to use the popular buzzword , although technically the malware is not particularly advanced or sophisticated . APT17 : 69.80.72.165 . It also sends collected browser data to another script by sending a POST request to “ hxxp://[c2_hostname]/groups / count / write.php ” .


The actor sends an email to the secondary email account with the unique system identifier as a subject with a secondary payload attached with a filename of txt .


As wonderfully described in a recent public posting , FireEye adheres to a naming convention based upon extensive data collection and activity comparison , designed to yield the identification of a discrete , identifiable entity responsible for a given collection of activity .


In particular , we will focus on the samples SHA-1 AA0FA4584768CE9E16D67D8C529233E99FF1BBF0 and 48BC113EC8BA20B8B80CD5D4DA92051A19D1032B . CapabilitiesFormBook is a data stealer , but not a full-fledged banker .


Lateral movement to other machines on the network .


Secondly , it underlines their boldness , arrogance and self-confidence ; they are clearly confident in both their ability to compromise their targets even when their tools and techniques are already publicly known , and critically , they appear to be extremely confident in their ability to act with impunity . 2015 : Continuing surgical strikes with CosmicDuke .


While doing our investigation we were able to identify other malware packages with different names . This section details changes made to APT10 tools , techniques and procedures ( TTPs ) post-2014 , following its shift from Poison Ivy to PlugX . In January 2019 , we discovered a sophisticated supply chain attack involving the ASUS Live Update Utility . The backdoor ’s primary functionality involves retrieving and executing additional modules .


But , thanks to the attackers known affection for decoy documents that pose as news summaries , we were able to date the campaign back to March 2018 . BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control ( C2 ) and operational infrastructure .


Fileless execution and persistence – In targeted campaigns , threat actors often attempt to avoid writing an executable to the disk to avoid detection and forensic examination .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . At first look , it pretends to be a Java related application but after a quick analysis , it was obvious this was something more than just a simple Java file .


The macro then uses the command certutil -decode to decode the contents of this text file and outputs the decoded content to a randomly named file with a .exe extension in the C:\Programdata folder .


We don’t know for sure who is responsible for this campaign , but digging into the passive DNS results led us to some breadcrumbs .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills . The second , aptly titled " kontrakt87.doc " , copies a generic telecommunications service contract from MegaFon , a large Russian mobile phone operator .


Some of the indicators in the following post were published on AlienVault OTX on 6/13 .


Allows an application to write SMS messages . The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell's 1984 , but Weeping Angel , developed by the CIA's Embedded Devices Branch (EDB) , which infests smart TVs , transforming them into covert microphones , is surely its most emblematic realization . FIN7 : Carbanak Group .


The ‘ ejtmjealr.com ’ domain is particularly interesting due to a similar domain , ‘ ejdqzkd.com ’ being discussed by Jarosław Jedynak of CERT.PL in this analysis of Nymaim from earlier in the year .


Once ZeroT is running , we observed that the fake User-Agent used in the requests changed from “ Mozilla/6.0 ( compatible ; MSIE 10.0 ; Windows NT 6.2 ; Tzcdrnt/6.0 ) ” to “ Mozilla/6.0 ( compatible ; MSIE 11.0 ; Windows NT 6.2 ) ” , thus removing the “ Tzcdrnt ” typo observed in previous versions .


North Korea linked hackers are among the most prolific nation-state threats , targeting not only the U.S. and South Korea but the global financial system and nations worldwide . On Nov. 27 , 2018 , Cisco 's Talos research division published a write-up outlining the contours of a sophisticated cyber espionage campaign it dubbed DNSpionage .


The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets . Using XREFs during static analysis is a common technique to quickly find where functions of interest are called .


Take advantage of native mitigations built into Windows 10 . The next sample was another Spindest variant and had the same timestamp as the aforementioned PcClient sample .


( We named the spyware " Exodus '' after this Command & Control domain name . In December 2017 , FireEye publicly released our first analysis on the TRITON attack where malicious actors used the TRITON custom attack framework to manipulate industrial safety systems at a critical infrastructure facility and inadvertently caused a process shutdown . Executes arbitrary commands via the CMD shell . Rather than limiting security to searching for a series of stringent profiles , security teams can attempt to analyze threat indicators in real time .


However , it is unusual for the group to use this technique to deliver one of its malware components directly .


The Patchwork attack group has been targeting more than just government-associated organizations . The activity dates to at least 2013 and has ties to multiple reports by other researchers .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Shrouded Crossbow employs three BIFROST-derived backdoors : BIFROSE , KIVARS , and XBOW .


Here are just some of them : ngglobal – FirebaseCloudMessaging topic name Issuer : CN = negg – from several certificates negg.ddns [ . Operation Pawn Storm is an active economic and political cyber-espionage operation that targets a wide range of entities , like the military , governments , defense industries , and the media . In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


HammerDuke is a simple backdoor that is apparently designed for similar use cases as SeaDuke .


As researchers continued discovering new toolsets that were created and used by the same group that had been operating MiniDuke , the new toolsets were also given “ Duke ” -derived names , and thus the threat actor operating the toolsets started to be commonly referred to as “ the Dukes ” .


To be sure though , I needed to find other samples and see how they stacked up against this one .


We decided to take a peek under the hood of a modern member of the Asacub family . Much like the observers watching the shadows of objects cast upon the wall of the cave , these two definitions ( XENOTIME and TEMP.Veles , both presumably referring to " the TRITON actor " ) describe the same phenomena , yet at the same time appear different . Outlaw Updates Kit to Kill Older Miner Versions , Targets More Systems . PIEHOP utilizes LIGHTWORK to execute the IEC-104 commands " ON ” or " OFF " on the remote system and immediately deletes the executable after issuing the commands .


According to RiskIQ ’ s PassiveTotal , the domain expired 7 months ago . The Leafminer 's post-compromise toolkit suggests that Leafminer is looking for email data , files , and database servers on compromised target systems . TA549 possesses a diverse malware arsenal including PlugX , NetTraveler , and ZeroT .


These incidents show a novel infection vector being used by APT28 .


If Arabic keyboard and language settings are not found on the machine , the backdoor will not carry out its malicious activity .


The Spark payload is a custom backdoor likely developed by the MoleRATs group .


Since Android version 7 ( Nougat ) this information is gathered using other means , perhaps inferring the devices used by potential victim run older versions of Android . In a highly unusual case , APT41 attempted to extort a game company by deploying the Encryptor RaaS ransomware . We have reasons to believe that the operators of the APT28 network are either Russian citizens or citizens of a neighboring country that speak Russian .