It also drops decoy documents in an attempt to camouflage the attack .


However , we can reassemble the whole infection procedure based on our telemetry .


Upon clicking the ads , the malware author receives payment from the website developer , which pays for the illegitimate clicks and traffic . ALLANITE activity closely resembles Palmetto Fusion described by the US Department of Homeland Security . with the server . This is analogous to antivirus solutions using known virus signatures to determine if a computing interaction suggests virus installation or malware delivery across the network .


TG-1314 was mapping network drives using a compromised Altiris account to connect to additional systems .


XLoader can also hijack the infected device ( i.e. , send SMSs ) and sports self-protection/persistence mechanisms through device administrator privileges . Arbor also published APT research on this group , and named it ‘Donot’ . After that , it executes “ exit.exe ” which launches the “ i.cmd ” batch script .


It constructs this list using the WMI query : “SELECT displayName FROM AntivirusProduct ” .


Hotfixmsupload.com is particularly interesting as it has been identified as a Sofacy C2 domain repeatedly , and was also brought forth by Microsoft in a legal complaint against STRONTIUM ( Sofacy ) as documented here .


CapabilitiesFormBook is a data stealer , but not a full-fledged banker . Although Silence 's phishing emails were also sent to bank employees in Central and Western Europe , Africa , and Asia ) .


Network : Presence of http and DNS traffic to the network IOCs shared above .


We observed all these characteristics in the Bisonal 's attacks against both Russia and South Korea . These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider .


] somtum [ . The operation against the Tibetan Parliamentarians illustrates the continued use of malicious attachments in the form of documents bearing exploits . But we do know the change was sudden . Beginning in January 2021 , Mandiant Managed Defense observed multiple instances of abuse of Microsoft Exchange Server within at least one client environment .


Jane ’s by IHSMarkit is a well-known supplier of information and analysis often times associated with the defense and government sector .


As part of the disclosure , Ormandy also included the source code for a proof-of- concept exploit for the vulnerability .


Below is a collection of API methods and a brief description around their purpose . e uncovered the activity of a hacking group which has Chinese origins . At this point , the ZxShell library is no longer linked in the module list of the host process . In other highly successful runs , the actor sent out phony Flash videos directly as email attachments .


Hence , we name this new spin-off campaign as Jaguar Kill Switch . The documents that exploit CVE2017-11882 download another payload — an HTML Application ( HTA ) file toting a malicious Visual Basic ( VBS ) script — from the server , which is executed accordingly by the command-line tool mshta.exe . The main attack vector is via email with crafted Word , Excel or PDF documents attached . If you ’re a user in Ukraine or Poland , especially someone working in the government or military sectors , this is a clear - cut example of a spam campaign targeting this population .


These attacks show significant similarities to previously documented attacks attributed to the Arabic-speaking threat actor , commonly referred to as the MoleRATs group ( aka , The Gaza Cybergang , Moonlight , DustySky , Gaza Hacker Team ) .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . Hackers use the exploits " Nitris Exploit Kit " ( earlier known as CottonCastle ) , which is not available in open sources and sold only to trusted users .


Below is a description of the most noteworthy : The implant is able to spy on all available device sensors and to log registered events . While the URL acts similarly to how eye-watch.in : 443 delivers payloads , we also saw the URL leveraging and exploiting security flaws in Flash : CVE-2015-8651 , CVE-2016-1019 , and CVE-2016-4117 . APT33 : d5262f1bc42d7d5d0ebedadd8ab90a88d562c7a90ff9b0aed1b3992ec073e2b0 S-SHA2 Quasar RAT . The group itself likes to pretend to be a cybersecurity organization as shown in the ransom note below .


This exercise revealed tons of information about techniques used by FinFisher that we used to make Office 365 ATP more resistant to sandbox detection and Windows Defender ATP to catch similar techniques and generic behaviors . Organizations located in Myanmar and targeted by Spring Dragon have gone unmentioned . The UnInstall command doesn’t remove the malware from the system . While many statesponsored threat actors engage in spear phishing , ransomware is the preferred weapon of these cybercriminals .


Rooting trojans The Zen authors have also created a rooting trojan . In addition , the NetTraveler toolkit was able to install additional info-stealing malware as a backdoor , and it could be customized to steal other types of sensitive information such as configuration details for an application or computer-aided design files . This tactic exploits users ’ reduced vigilance when reading their own personal email , even when using corporate IT equipment to do so . However , users reported that the fix was causing Safari to not connect correctly to major websites like Facebook , Instagram and Zoom , leading Apple to pull back the patch .


Interestingly , we uncovered several expired job posting of Android reverse engineer from the actor ’ s front business published in 2018 and 2019 . Hackers gained access to a computer in the trading system in September 2014 . We monitored the activities of these groups and the new malware they are creating for over a year . “ Microsoft remediated the issue by first blocking tokens issued with the acquired key and then replacing the key to prevent continued misuse , ” the report states .


Unit 42 researchers observed the Quasar RA being prevented from executing on a Traps-protected client in September 2016 .


After app installation , whenever SWAnalytics senses victims opening up infected applications or rebooting their phones , it silently uploads their entire contacts list to Hangzhou Shun Wang Technologies controlled servers . During their previous campaign , we found Confucius using fake romance websites to entice victims into installing malicious Android applications .


National political director Finance director Director of strategic communications Director of scheduling Director of travel Traveling press secretary Travel coordinator .


The infrastructure has several layers , although not being very dynamic , still has several layers each one providing some level of protection . Given the use of lure documents designed with social engineering in mind , it is likely that MuddyWater use phishing or spam to target users who are unaware of these documents ' malicious nature . Looks for a Windows device named \Device\acpi_010221 . n July 2019 , we discovered an interesting VBScript named Chrome.vbs ( SHA256 : 0C3D4DFA566F3064A8A408D3E1097C454662860BCACFB6675D2B72739CE449C2 ) associated with the Rancor group . Following a three - month lull of activity , Cl0p returned with a vengeance in June and beat out LockBit as the month ’s most active ransomware gang .


Figure 3 . In August 2019 , FireEye released the Double Dragon” report on our newest graduated threat group , APT41 . Upload a specific file based on the full path name .


Even if CVE-2015-2546 affected Windows 10 , the exploitation would have required much more technical prowess to succeed ; ultimately , SMEP makes it more difficult for attackers . attacks on the chemical industry are merely their latest attack wave .


The second Project Spy version has similar capabilities to the first version , with the addition of the following : Stealing notification messages sent from WhatsApp , Facebook , and Telegram Abandoning the FTP mode of uploading the recorded images Aside from changing the app ’ s supposed function and look , the second and third versions ’ codes had little differences . In all , Kaspersky Lab discovered Metel in more than 30 financial institutions . For example , According to Kaspersky telemetry , targeted organizations included think tanks and individuals working in various areas related to security and geopolitics .


If the directory creation fails it tries to install into “ %TEMP% ” directory instead .


60 % of devices containing or accessing enterprise data are mobile , and mobile devices tend to include a significant amount of personal and business data , assuming the organization has a bring-your-own-device policy in place . The exploit document carrying this alternate KeyBoy configuration also used a decoy document which was displayed to the user after the exploit launched . On November 10 , 2015 , Lotus Blossom sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


The primary targets , so far , are based in India though other Asian countries such as Pakistan and Bangladesh are also affected . While we did not discuss the surrounding attacks using Bookworm in detail , we have observed threat actors deploying Bookworm primarily in attacks on targets in Thailand . The post continues , “ during 2016 , we observed a heavy interest in Angola , exemplified by lure documents indicating targets with suspected ties to oil , money laundering , and other illicit activities . PoetRAT used TLS to encrypt communications over port 143 QuasarRAT can use port 4782 on the compromised host for TCP callbacks .


We have previously observed APT19 steal data from law and investment firms for competitive economic purposes . After reviewing all the malware functionalities , we are confident in saying that the attackers look for victims who answer well-defined characteristics and believe that further stages of the attack are delivered only to those who fit the specific victim profile .


It captures information using plugins to compromise webcam and microphone output along with documenting log keystrokes , carrying out surveillance and access external drives . For the sake of narrative we are going to focus exclusively to those samples we identified being used in attacks against Iranian civil society and diaspora .


The collected data can then be used to generate a unique identifier of the bot or for monetization purposes . PittyTiger has also been seen using Heartbleed vulnerability in order to directly get valid credentials . In August 2018 , Unit 42 observed OilRig targeting a government organization using spear-phishing emails to deliver an updated version of a Trojan known as BONDUPDATER .


The credentials they use to register their malware infrastructure are easily associated with their public social media accounts on Google® , Facebook® , MySpace® , Instagram® , and various dating and blogging sites . We suspect the Kazuar tool may be linked to the Turla threat actor group ( also known as Uroburos and Snake ) , who have been reported to have compromised embassies , defense contractors , educational institutions , and research organizations across the globe .


Instead , they opted for minimal downtime and attempted to continue operations , with only minor modifications to the toolset .


cecilia-gilbert [ . It wasn't until August 2014 that we observed something which made us wonder if RedOctober is back for good . As always , keep in mind that these uses are confirmed uses , and likely represent only a small fraction of APT1 ’s total activity . Greatness , for now , is only focused on Microsoft 365 phishing pages , providing its affiliates with an attachment and link builder that creates highly convincing decoy and login pages .


If an attacker wanted to exploit CVE-2015-1701 , they would first have to be executing code on the victim ’s machine .


The kill switch can also be turned on by SMS . APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia . Secondary ProjectSauron modules are designed to perform specific functions like stealing documents , recording keystrokes , and hijacking encryption keys from both infected computers and attached USB sticks .


They do this not only to identify whether the use of a particular app may permit them to harvest another credential , but also because each targeted app needs to have an overlay mapped to its design , so the Trojan can intercept and steal user data . Prior to the discovery of Operation Daybreak , we observed the ScarCruft APT launching a series of attacks in Operation Erebus . Activity of the Chafer APT group has been observed since at least 2015 , but based on things like compilation timestamps and C&C registration, it’s possible they have been active for even . McAfee researchers will present their findings at this year 's RSA security conference in San Francisco .


Distinct changes to Azazel by the Winnti developers include the addition of a function named ‘Decrypt2’ , which is used to decode an embedded configuration similar to the core implant . Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit.MSWord.CVE-2010-333 , Exploit.Win32.CVE-2012-0158 .


However , due to the absence of certification centers verifying the digital signatures of Android programs , nothing prevents criminals from adding their own signature . January 2018 , TAA triggered an alert at a large telecoms operator in Southeast Asia . 100 Root Thu 24 Oct 2019 12:08:27 PM UTC Initial shellcode . 101 Plugins Thu 24 Oct 2019 12:07:02 PM UTC Provides API for the other modules ; loads modules . 102 Config Thu 24 Oct 2019 12:07:09 PM UTC Handles encrypted configuration string pool . 103 Install Thu 24 Oct 2019 12:07:46 PM UTC Achieves persistence . 104 Online Thu 24 Oct 2019 12:07:17 PM UTC Overall communications with the C&C server . 106 ImpUser Thu 24 Oct 2019 12:07:24 PM UTC User impersonation via token duplication . 200 TCP Thu 24 Oct 2019 12:01:01 PM UTC TCP communications . 202 HTTPS Thu 24 Oct 2019 12:01:15 PM UTC HTTPS communications . 207 Pipe Thu 24 Oct 2019 12:01:35 PM UTC Handles named pipes . 300 Disk Thu 24 Oct 2019 12:02:29 PM UTC File system operations . 301 Process Thu 24 Oct 2019 12:02:36 PM UTC Process handling . 302 Servcie Thu 24 Oct 2019 12:02:45 PM UTC Service handling . 303 Register Thu 24 Oct 2019 12:02:52 PM UTC Registry operations . 304 Shell Thu 24 Oct 2019 12:03:00 PM UTC Command line operations . 306 Keylogger Thu 24 Oct 2019 12:03:16 PM UTC Keylogging to file system . 307 Screen Thu 24 Oct 2019 12:03:25 PM UTC Screenshot capture . 317 RecentFiles Thu 24 Oct 2019 12:04:44 PM UTC Lists recently accessed files . Since early 2022 , KillNet has claimed on multiple occasions to be partnering or coordinating with several criminal elements , including multiple occasions in which it claimed to be working with the widely known ransomware group REvil .


This group has been conducting attacks for at least four years using a backdoor Trojan that has been under active development . The APT38 uses DYEPACK to manipulate the SWIFT transaction records and hide evidence of the malicious transactions , so bank personnel are none the wiser when they review recent transactions .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e. , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 .


We report them to Google and take other steps to disrupt malicious campaigns we discover . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . It is suspected that spear phishing is the primary delivery mechanism for Volgmer infections ; however , HIDDEN COBRA actors use a suite of custom tools , some of which could also be used to initially compromise a system .


This leads us to believe that Zen is just part of a larger infection chain . They then moved on to the motor industry in late May . APT17 . A Polish student used a remote controller device to interface with the Lodz city tram system in Poland .


Record surroundings using the built-in microphone in 3gp format . In other attacks , there was evidence that Felismus was installed using a tool known as Starloader ( detected by Symantec as Trojan.Starloader ) . JhoneRAT : https://drive.google.com/uc?export=download&id=1kbHVkvPIjX49qJ62TBz6drW2YPiiaX2a . The attackers ' aim is to put the organisation in an unbearable position by stopping it from functioning , and then demanding a ransom that can stretch to millions of dollars .


Among the most popular modern defense mechanisms against APTs are air-gaps — isolated network segments without Internet access , where sensitive data is stored .


However , samples don ’ t have key capabilities to infect innocent apps on victim devices yet . Threat actors like Confucius and Patchwork are known for their large arsenal of tools and ever-evolving techniques that can render traditional security solutions — which are often not designed to handle the persistent and sophisticated threats detailed in this blog — ineffective . Memory scans detect and terminate the loading of malicious code hidden by process hollowing — including the monitoring processes that attempt to update the malware code and re-infect the machine via PowerShell commands . • New , unexpected compiled ASPX files in the directory • Reconnaissance , vulnerability - testing requests to the following resources from an external IP address : In our investigations to date , the web shells placed on Exchange Servers have been named differently in each intrusion , and thus the file name alone is not a high - fidelity indicator of compromise .


The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites . On April 24 , 2019 , Fxmsp claimed to have secured access to three leading antivirus companies .


Cannon opens the email with the correct subject and saves the attachment named auddevc.txt .


Its functionality includes uploading and downloading files , and it has configurable network protocols .


Fighting organized crime in your phone One of the main problems with Triada is that it can potentially hurt a LOT of people . In that case , we observed Buhtrap using a local privilege escalation exploit , CVE-2019-1132 , against one of its victims . We assess this activity was carried out by a suspected Iranian cyber espionage threat group , whom we refer to as APT34 , using a custom PowerShell backdoor to achieve its objectives .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58712 [ . On January 4 , Packet Clearing House , which is not an Internet exchange point but rather is an NGO which provides support to Internet exchange points and the core of the domain name system , provided confirmation of this aspect of the actors’ tactics when it publicly revealed its internal DNS had been briefly hijacked as a consequence of the compromise at its domain registrar . APT19 is a Chinese-based threat group that has targeted a variety of industries , including defense , finance , energy , pharmaceutical , telecommunications , high tech , education , manufacturing , and legal services .


Based on our analysis of Callisto Group 's usage of RCS Galileo , we believe the Callisto Group did not utilize the leaked RCS Galileo source code , but rather used the leaked readymade installers to set up their own installation of the RCS Galileo platform . In activity analyzed by CTU researchers , TG-3390 executed the Hunter web application scanning tool against a target server running IIS .


Secondly , when the emails were being sent to a broad set of recipients , the mails purported to be a necessary security update .


Unlike previous samples , this DealersChoice used a DOCX delivery document that required the user to scroll through the document to trigger the malicious Flash object .


Attacks launched by this group were publicly exposed on 2013 in a Trend Micro report about the FakeM Trojan . Other groups attributed to Iranian attackers , such as Rocket Kitten , have targeted Iranian individuals in the past , including anonymous proxy users , researchers , journalists , and dissidents .


It is possible that TG-3390 is false-flag operation by a threat group outside of China that is deliberately planting indications of a Chinese origin .


The core of this functionality is also based on an open-source project that can be found here . RCS Galileo platform . On Monday August 25, 2014 we observed a different spear phish email sent from lilywang823@gmail.com to a technology company located in Taiwan . Cloud Administration Command APT29 has used Azure Run Command and Azure Admin - on - Behalf - of ( AOBO ) to execute code on virtual machines .


There ’ s an app for just about any facet of one ’ s personal and professional life , from booking travel and managing projects , to buying groceries and binge-watching the latest Netflix series . Silence 2.0: Going Global is an extension of our original report: Silence: Moving into the Darkside which remains the most significant contribution to the research on the group and is the first such report to reveal Silence’s activity . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


” social ” – this command that starts the ‘ AndroidMDMSupport ’ service – this allows the files of any other installed application to be grabbed . However , Kaspersky Security Network (KSN) records also contain links that victims clicked from the Outlook web client outlook.live.com” as well as attachments arriving through the Outlook desktop application . Activity from this group was previously linked to FIN7 , but the group is believed to be a distinct group possibly motivated by espionage .


OnionDuke ’s development therefore could not have been simply a response to the outing of one of the other Duke malware , but was instead intended for use alongside the other toolsets .


PLATINUM uses a number of different custom-developed backdoors to communicate with infected computers . Obviously , the developers behind NetTraveler have taken steps to try to hide the malware 's configuration .


TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution . In order to fight back against this cyber-espionage , Kaspersky Lab will continue its research .


In that case , the only help comes from an antivirus solution , for example , Kaspersky Internet Security for Android . But two tools used were unique to the group : ASPXTool , an Internet Information Services ( IIS ) specific " Web shell " used to gain access to servers inside a target 's network ; and the OwaAuth credential stealing tool and Web shell , used to attack Microsoft Exchange servers running the Web Outlook interface . ShadowPad is a multimodular backdoor where the modules are referenced from the Root module with a circular list from which one can extract the module address , a UNIX timestamp ( probably embedded automatically during the module ’s compilation process ) and a module identifier . DLL sideloading attacks use the DLL search order mechanism in Windows to plant and then invoke a legitimate application that executes a malicious payload .


In the first iteration , the screen recording is started and will only stop when the RAT determines that WhatsApp is not running . These spear phishing emails were crafted to appear highly convincing , including being sent from legitimate email accounts suspected to have been previously compromised by the Callisto Group via credential phishing . The HIGHTIDE backdoor connected directly to 141.108.2.157 . [ 42 ] TYPEFRAME has used ports 443 , 8080 , and 8443 with a FakeTLS method .


TG-3390 is capable of using a C2 infrastructure that spans multiple networks and registrars .


As we 've seen with actors like Dark Caracal , this low cost , low sophistication approach that relies heavily upon social engineering has still been shown to be highly successful for those operating such campaigns . We believe that Lazarus will remain one of the biggest threats to the banking sector , finance , and trading companies , as well as casinos for the next few years . The exploit was used against one target in the chemical sector in Saudi Arabia . csvde.exe


Understand firewalls .


Through research , 360 Helios Team has found that , since 2007 , the Poison Ivy Group has carried out 11 years of cyber espionage campaigns against Chinese key units and departments , such as national defense , government , science and technology , education and maritime agencies . The malware has started targeting corporate , SMB , investment banking and consumer accounts at banks , including some in Portugal and the U.S. , in addition to Poland , according to researchers at IBM 's X-Force team .


" Emboldened by financial and technological independence , their skillsets will advance–putting end users , enterprises , and government agencies at risk . Just last week Lazarus were found stealing millions from ATMs across Asia and Africa . APT33 : 5.187.21.70 microsoftupdated.com . This seeming “ streamlining ” of activities by DPRK often makes it difficult for defenders to track , attribute , and thwart malicious activities , while enabling this now collaborative adversary to move stealthily and with greater speed .


Command and control API calls ViperRAT samples are capable of communicating to C2 servers through an exposed API as well as websockets . The subject is a series of targeted attacks against private companies . Finally , it spawns the main thread that starts at the original location of ShellMainThread procedure , and terminates . In October 2019 , ESET published “ Operation Ghost ” detailing a set of new trojans used by the Dukes , including PolyglotDuke , RegDuke and FatDuke .


] cendata [ . In addition to banks , the MoneyTaker group has attacked law firms and also financial software vendors . APT16 . The web shell was written to the system by the UMWorkerProcess.exe process , which is associated with Microsoft Exchange Server ’s Unified Messaging service .


A business can obtain access to this program only provided they meet requirements set out by Apple . The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April . In March 2018 , Trend Micro provided a detailed analysis of another campaign that bore the hallmarks of MuddyWater .


The C2 for the aforementioned 9002 sample was logitechwkgame [ . Mapping the group’s activities since 2012 (Figure 2) also provides some indication that APT41 primarily conducts financially motivated operations outside of their normal day jobs . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


After obtaining the desired rights , the Trojan sets itself as the default SMS app ( by independently clicking Yes in AccessibilityService ) , before vanishing from the device screen . In May and June 2017 , FireEye has associated this campaign with APT19 , a group that we assess is composed of freelancers , with some degree of sponsorship by the Chinese government . Indicating that this library was probably used in another campaign .


As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware . The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio .


Low-volume campaigns distributed Dridex during much of 2015 Moderate volumes of Dridex appeared from the end of 2015 through February 2016 ; it is worth noting that these “ moderate volume ” campaigns were , at the time , the largest campaigns ever observed .


the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated . In this campaign , the attackers experimented with publicly available tooling for attack operations .


Log keystrokes .


file Fingerprint the system and check the following registry values : HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid should not be “ 6ba1d002-21ed-4dbe-afb5-08cf8b81ca32 ” HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DigitalProductId should not be “ 55274-649-6478953-23109 ” , “ A22-00001 ” , or “ 47220 ” HARDWARE\Description\System\SystemBiosDate should not contain “ 01/02/03 ” Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents . The complexity of the shellcode and loaders shows the group continues to invest heavily in development of bespoke tooling . Mandiant directly observed one ( 1 ) variant of STRATOFEAR as a Mach - O executable compiled for ARM64 systems that contained a self - signed certificate with a particular Common Name ( CN ) .


] 230 [ . The Komplex Trojan revealed a design similar to Sofacy 's Carberp variant Trojan , which we believe may have been done in order to handle compromised Windows and OS X systems using the same C2 server application with relative ease . The enumerated methods are stored , then a for loop looks first for the method named DownloadString ( highlighted in blue ) . NoEscape is a new ransomware which been doing the rounds in underground forums since May 2023 .


Fxmsp specialize in breaching highly secure protected networks to access private corporate and government information . BRONZE UNION actors leveraged initial web shell access on Internet-facing systems to conduct internal reconnaissance .


To avoid confusion however , we have decided to continue referring to the loader as the “ MiniDuke loader ” .


Note , however , that based on the leak mail from a customer inquiry , Hacking Team was in the process of developing exploits for Android 5.0 Lollipop . Against targets in the CIS countries , the Cobalt also used their own infrastructure , which included rented dedicated servers . In the example below , The hackers behind the campaign have been identified as Tortoiseshell , which is believed to work on behalf of the Iranian government .


The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation . Bookworm has little malicious functionality built-in , with its only core ability involving stealing keystrokes and clipboard contents .


The first class , colloquially known as " wipers " , are a class of malware has the primary intent of destroying data on a victim 's machine . Also , Bookworm uses a combination of encryption and compression algorithms to obfuscate the traffic between the system and C2 server .


As security controls have improved , DLL side loading has evolved to load a payload stored in a different directory or from a registry value .


During our research we also found a component called KPWS that turned out to be another downloader for Slingshot components . The most popular targets of SneakyPastes are embassies , government entities , education , media outlets , journalists , activists , political parties or personnel , healthcare and banking .


SMS grabbing : EventBot has the ability to parse SMS messages by using the targeted device ’ s SDK version to parse them correctly . According to ClearSky , the suspected Lazarus operatives looked to leverage a vulnerability in outdated WinRAR file-archiving software that hackers have been exploiting since it was disclosed last month . Additionally , there is evidence to suggest APT33 targeted Saudi Arabia .


The target list and bank specific fake login pages can be dynamically updated via their C2 panel ( dashboard back-end ) which significantly increases the adaptability and scalability of this attack . Despite the fact that the Changing Information Technology Inc. certificate was revoked on July 4 , 2017 , the BlackTech group is still using it to sign their malicious tools . We have written a simple C++ ZxShell Server that implements the communication and the handshake for the version 3.10 and 3.20 of the ZxShell DLL . As Google Analytics is allowed in the CSP configuration of many major sites , this demo shows how an attacker can bypass this security protection and steal data .


The web shell files appeared to be installed during the timeframe that BRONZE PRESIDENT was active on the system .


Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word . PittyTiger has also been seen using Heartbleed vulnerability in order to directly get valid credentials .


In this particular case , the bot abuses the accessibility service privilege to obtain the package name of the foreground application and determine whether or not to show a phishing overlay window , as shown in the following code snippet : Targets Some examples of phishing overlays are shown below . A new type of backdoor called AdroMut and a new malware called FlowerPippi was also found coming from SectorJ04 . BRONZE BUTLER has used a broad range of publicly available ( Mimikatz and gsecdump ) and proprietary ( Daserf and Datper ) tools .


The malware starts communicating with the C&C server by sending basic information about the infected machine . One of its file stealers , swissknife2 , abuses a cloud storage service as a repository of exfiltrated files .


File downloading ;


This business unit and the eSurv software and brand was sold from Connexxa S.R.L . In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company . We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro as MuddyWater ) , an Iran-nexus actor that has been active since at least May 2017 .


Looking under the hood we see the VBA code that builds the PowerShell B-FILE S-TOOL command and launches it but something seemed off .


The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio . After the source codes of their tools became public in 2016 , the name Buhtrap was used for the financial Trojan .


After all network derived IPs have been processed , the malware generates random IPs and uses the same combination of PingCastle and EternalBlue to spread to that host . Written in pure C language , Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions , and carries out integrity control of various system components to avoid debugging and security detection .


Sanitize and validate input to ensure that it is properly typed and does not contain escaped code .


During our tests the spyware was upgraded to the second stage on our test device immediately after the first check-ins . However , they later continued by making modifications to the Excel document just prior to the attack on August 26th . ImportError : Unknown magic number 227 in final2 . Therefore can be no leakage on our part .


Behind the scenes , there are number of process occurring simultaneously . makeself.sh is a small shell script that generates a self-extractable compressed tar archive from a directory . For context , embedded Winnti campaign designators have ranged from target names , geographic areas , industry , and profanity .


The Trojan sends an email to sahro.bella7@post.cz with i.ini as the attachment , S_inf within the body and a subject with a unique system identifier via SMTPS from one of the following accounts : Bishtr.cam47 , Lobrek.chizh , Cervot.woprov .


This sample was also found to be deployed using the CVE-2012-0158 vulnerability . In the past they used Adobe Gh0st , Poison Ivy and Torn RAT malware as their primary attack vector is sphere phishing .


TG-4127 created 150 short links targeting this group .


] 230 [ . This assertion of time zone is also supported by timestamps found in many GeminiDuke samples , which similarly suggest the group work in the Moscow Standard Time timezone , as further detailed in the section on the technical analysis of GeminiDuke . The base64 encoded PE file that can be seen in line 2760 of the image above is a GandCrab Variant . Charming Kitten members , claiming to be a senior teaching and research fellow at SOAS university in London sent targeted emails to a select number of victims from fewer than 10 organizations in the US and UK , inviting them to an online conference called The US Security Challenges in the Middle East .


Most of them are almost harmless — all they did until recently was injecting tons of ads and downloading others of their kind . Unit 42 's analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . In recent attacks they set up a fake VPN Web Portal and targeted at least five Israeli IT vendors , several financial institutes , and the Israeli Post Office .


On September 13 , WADA confirmed that APT28 had compromised its networks and accessed athlete medical data .


+86.01078456689 Fax . PLEAD also dabbled with a short-lived , fileless version of their malware when it obtained an exploit for a Flash vulnerability ( CVE-2015-5119 ) that was leaked during the Hacking Team breach . Unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals .


In a report released on January 7 2017 , the U.S. Directorate of National Intelligence described this activity as an “ influence campaign. ” This influence campaign - a combination of network compromises and subsequent data leaks - aligns closely with the Russian military ’s publicly stated intentions and capabilities .


9b2fd7189395b2f34781b499f5cae10ec86aa7ab373fbdc2a14ec4597d4799ba ac216d502233ca0fe51ac2bb64cfaf553d906dc19b7da4c023fec39b000bc0d7 b1ccb5618925c8f0dda8d13efe4a1e1a93d1ceed9e26ec4a388229a28d1f8d5b ba4beb97f5d4ba33162f769f43ec8e7d1ae501acdade792a4a577cd6449e1a84 The two malware families themselves are also very similar , and therefore we think that the shared technique is an indication of a single developer , or development company , behind both CONFUCIUS_A and CONFUCIUS_B . Within a year APT40 was observed masquerading as a UUV manufacturer , and targeting universities engaged in naval research .


The app that resulted in the largest number of affected users was the click fraud version , which was installed over 170,000 times at its peak in February 2018 . PassCV continues to maintain a heavy reliance on obfuscated and signed versions of older RATs like ZxShell and Ghost RAT , which have remained a favorite of the wider Chinese criminal community since their initial public release . Various artifacts from the initial phases of the incident provided strong indications of the existence of this particular threat group within the client's infrastructure . According to HTTP headers of the server , the applet was uploaded on February 11 , 2013 , one month after the Metasploit code was published and two days before Oracle issued a security alert regarding the vulnerability .


It minimizes the risk of overexposure by specifically targeting Arabic speakers .


This submitter has thousands of other submissions in VirusTotal , however , it is the only one that continues to submit EventBot samples via the VirusTotal API . This post was our first analysis of the first Panda Banker campaign that we’ve seen to target financial institutions in Japan . An Iranian hacking group formerly named Ajax Security ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


On April 22 , 2015 , Suckfly exploited a vulnerability on the targeted employee 's operating system ( Windows ) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack .


Initially some particular words from the decompiled classes.dex of Exodus Two sent us in the right direction . Proofpoint is tracking this attacker , believed to operate out of China , as TA459 . The macro code embedded in the document is rather simple and is not obfuscated . Many of the individuals work at organizations related to financial services , cryptocurrency , blockchain , web3 and related entities .


After manual launch , it shows a fake welcome notification to the user : Dear Customer , we ’ re updating your configuration and it will be ready as soon as possible . The January 2017 report followed up on other private reports published on the group’s BeEF-related activity in 2015 and 2016 . The group has been observed utilizing TRITON , a malware framework designed to manipulate industrial safety systems .


Ginp embeds the following set of features , allowing it to remain under the radar and successfully perform attacks : Overlaying : Dynamic ( local overlays obtained from the C2 ) SMS harvesting : SMS listing SMS harvesting : SMS forwarding Contact list collection Application listing Overlaying : Targets list update SMS : Sending Calls : Call forwarding C2 Resilience : Auxiliary C2 list Self-protection : Hiding the App icon Self-protection : Preventing removal Self-protection : Emulation-detection Update 'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS (JukeBox) and Linux (DanceFloor) . The web server was also a C2 server for another threat , Minzen ( a.k.a , XXMM , Wali , or ShadowWali ) .


All the observed landing pages mimic the mobile operators ’ web pages through their domain name and web page content as well . According to Cheetah Mobile’s follow-up investigation , fraudulent behaviors came from two 3rd party SDKs Batmobi , Duapps integrated inside Cheetah SDK . The group has targeted a variety of victims including but not limited to media outlets , high-tech companies , and multiple governments .


The sample we analyzed is most likely forked from open source quasar 1.2.0.0 .


Throughout 2017 we observed this threat actor actively attempting to compromise victims with various malware payloads .


The Cybereason Nocturnus team will continue to monitor EventBot ’ s development . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . APT10 withdrew from direct targeting using Poison Ivy in 2013 and conducted its first known retooling operation , upgrading its capabilities and replatforming to use PlugX .


Apart from collecting the above data , the spyware monitors users ’ phone calls , records them , and saves the recorded file on the device . We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester . This downloader , seen in past FIN7 campaigns , downloads a one-byte XOR encrypted ( eg. with the key equal to 0x50 or 0x51 ) piece of meterpreter shellcode to execute . Usually , they ’d have to hope a successful attack leads to a ransom payment or some sort of other financial windfall .


This is then returned as a string to PowerShell , which calls invoke-expression ( iex ) on it , indicating that the expected payload is PowerShell .


Mandiant disclosed these vulnerabilities to Lenovo in May of 2016 . In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 .


Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies . In addition , a current ANY.RUN playback of our observed Elise infection is also available .


Originally targeting Western European banks , it has since been developed into a robust global botnet that is comprised of several modules , each of which equips Emotet with different spamming , email logging , information stealing , bank fraud , downloading , and DDoS , among others . Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns : PLEAD , Shrouded Crossbow , and of late , Waterbear .


Just like the old-school mail worms that used the victim 's address book to select the next victims , this banking trojan 's activation cycle includes the exfiltration of the victim 's address book . APT10 has been in operation since at least 2009 , and has evolved its targeting from an early focus on the US defence industrial base ( DIB )1 and the technology and telecommunications sector , to a widespread compromise of multiple industries and sectors across the globe , most recently with a focus on MSPs . OceanLotus : d78a83e9bf4511c33eaab9a33ebf7ccc16e104301a7567dd77ac3294474efced Payload PNG ( loader #2 ) . TeamTNT has used an IRC bot for C2 communications.[13 ] Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level .


" PittyTiger " is a mutex used by the malware . Since that time , the group attacked companies in California , Utah , Oklahoma , Colorado , Illinois , Missouri , South Carolina , North Carolina , Virginia and Florida .


In the case of FinFisher , however , we could not find a good existing interactive disassembler ( IDA ) plugin that can normalize the code flow . The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan . The malware files simply have lots of clean files appended to them . To understand the context of a computing interaction between servers , tools , and users , we need to analyze the endtoend process .


Machine learning module indicates continuous evolution As mentioned , this ransomware is the latest variant of a malware family that has undergone several stages of evolution . FireEye gained visibility into one of 23 known command-and-control ( CnC ) servers operated by the Ke3chang actor for about one week . however TAU expects not only APT10 but also other threat actors will start to use them . The Monti ransomware collective has restarted their operations , focusing on institutions in the legal and governmental fields .


We believe that these industries have also been targeted as part of a larger supply-chain attack in order for Orangeworm to get access to their intended victims related to healthcare .


Orangeworm 's secondary targets include Manufacturing , Information Technology , Agriculture , and Logistics .


While these industries may appear to be unrelated , we found them to have multiple links to healthcare , such as large manufacturers that produce medical imaging devices sold directly into healthcare firms , IT organizations that provide support services to medical clinics , and logistical organizations that deliver healthcare products .


Once Orangeworm has infiltrated a victim 's network , they deploy Trojan.Kwampirs , a backdoor Trojan that provides the attackers with remote access to the compromised computer .


Patchwork targets were chosen worldwide with a focus on personnel working on military and political assignments , and specifically those working on issues relating to Southeast Asia and the South China Sea .


Kwampirs uses a fairly aggressive means to propagate itself once inside a victim 's network by copying itself over network shares .


In mid-August , the OilRig threat group sent what appeared to be a highly targeted phishing email to a high-ranking office in a Middle Eastern nation .


Patchwork 's attack was detected as part of a spear phishing against a government organization in Europe in late May 2016 .


The attack was detected as part of a spear phishing against a government organization in Europe in late May 2016 .


The Patchwork attack group has been targeting more than just government-associated organizations .


Symantec has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks .


Two security companies , Cymmetria and Kaspersky , each recently released reports on the campaign , most of which are in line with our observations .


Symantec Security Response has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks .


While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec , we have seen infections in multiple countries due to the nature of the victims operating large international corporations .


Although approximately half of the attacks focus on the US , other targeted regions include China , Japan , Southeast Asia , and the United Kingdom .


While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec telemetry , we have seen infections in multiple countries due to the nature of the victims operating large international corporations .


Our first observation of an attempted attack related to this campaign dates back to November 2015 , although Symantec telemetry data indicates that the campaign may have already existed in early 2015 or perhaps even earlier .


Should a user enable this content , Gallmaker is then able to use the DDE protocol to remotely execute commands in memory on the victima 's system .


While both back door Trojans wait for commands from the threat actor , they can search for files and upload them to the specified server once activated .


Patchwork ( also known as Dropping Elephant ) is a cyberespionage group whose targets included diplomatic and government agencies as well as businesses .


Patchwork is known for rehashing off-therack tools and malware for its own campaigns .


They also included Dynamic Data Exchange ( DDE ) and Windows Script Component ( SCT ) abuse to their tactics , as well as started exploiting recently reported vulnerabilities .


These socially engineered emails contain web links of weaponized documents containing exploits or macros .


It contains an additional meta tag at the end of the web page source code , " refreshing " ( redirecting ) the site visitor to the weaponized document .


It 's probable that Patchwork uses this package to facilitate server installation when using a Windows environment .


In March and April 2018 , Volexity identified multiple spear phishing campaigns attributed to Patchwork , an Indian APT group also known as Dropping Elephant .


This increase in threat activity was consistent with other observations documented over the last few months in blogs by 360 Threat Intelligence Center analyzing attacks on Chinese organizations and Trend Micro noting targets in South Asia .


Volexity has also found that , in addition to sending malware lures , the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages .


The newsletter includes a link to the attacker 's website , which has content focusing on topics related to China to draw the target 's interest .


Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) .


The threat actors appear to have leveraged publicly available exploit code that can be found on Github at the URL : https://github.com/rxwx/CVE-2017-8570 .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools .


At this point , the attackers know the user has opened the document and send another spear-phishing email , this time containing an MS Word document with an embedded executable .


The Word document usually exploits CVE-2012-0158 .


Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


From the attacks observed by Volexity , what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks .


Once started , it downloads additional malware from the C2 and also uploads some basic system information , stealing , among other things , the user 's Google Chrome credentials .


It repeatedly attempts to iterate through directories and to collect files with the following extensions : doc , docx , ppt , pptx , pps , ppsx , xls , xlsx , and pdf .


In this case , a small group reusing exploit code , some powershell-based malware and mostly social engineering has been able to steal sensitive documents and data from victims since at least November 2015 .


In the past few months , Unit 42 has observed the Patchwork group , alternatively known as Dropping Elephant and Monsoon , conducting campaigns against targets located in the Indian subcontinent .


The malicious documents seen in recent activity refer to a number of topics , including recent military promotions within the Pakistan Army , information related to the Pakistan Atomic Energy Commission , as well as Pakistan 's Ministry of the Interior .


The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities .


Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability .


The Patchwork group continues to plague victims located within the Indian subcontinent .


The overarching campaign appears to target both Chinese nationals within different industries and government agencies in Southern Asia .


It appears to have started in December 2015 and is still ongoing as of July 2016 .


The use of weaponized legitimate documents is a longstanding operational standard of Patchwork .


It is dropped by at least one of the weaponised documents17 used in the MONSOON campaign where it is embedded inside another executable .


The majority of the code for TINYTYPHON is taken from the MyDoom worm and has been repurposed to find and exfiltrate documents .


The targeting of Chinese nationals may also be related to this campaign , but equally may be part of a separate campaign by the adversary or even as part of them selling Surveillance-As-A-Service in a similar manner previously seen with the HANGOVER group .


The use of weaponized legitimate documents is a longstanding operational standard of this group .


We decided to spend some time to investigate around this malware and found out that it was used exclusively by a single group of attackers .


The newsnstat.com domain was used earlier in 2015 for previous HANGOVER campaigns , and was then repurposed in December 2015 for the MONSOON campaign .


Our researches around the malware family revealed the " Pitty Tiger " group has been active since 2011 , yet we found traces which makes us believe the group is active since 2010 .


The group exploits known vulnerabilities in Microsoft Office products to infect their targets with malware .


Pitty Tiger group is sometimes using stolen material as spear phishing content to target other persons .


PittyTiger has also been seen using Heartbleed vulnerability in order to directly get valid credentials .


They have also been seen using Heartbleed vulnerability in order to directly get valid credentials .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) .


PittyTiger could also use CVE-2014-1761 , which is more recent .


" PittyTiger " is a mutex used by the malware .


This RAT is the origin of the attackers ' group name .


Paladin RAT is another remote administration tool used by the Pitty Tiger group .


Pitty Tiger , like other APT attackers , often use anti-virus " familiar names " when registering domains or creating subdomains .


" Pitty Tiger " is also a string transmitted in the network communications of the RAT .


A recent report documents a group of attackers known as " PittyTiger " that appears to have been active since at least 2011 ; however , they may have been operating as far back as 2008 .


We have been monitoring the activities of this group and believe they are operating from China .


This threat group uses a first-stage malware known as Backdoor.APT.Pgift ( aka Troj/ReRol.A ) , which is dropped via malicious documents and connects back to a C2 server .


By integrating the findings with prior research , it was possible to connect MONSOON directly with infrastructure used by the HANGOVER group via a series of strong connections .


Backdoor.APT.PittyTiger – This malware is the classic " PittyTiger " malware ( PittyTigerV1.0 ) that was heavily used by this group in 2012 - 2013 .


Backdoor.APT.PittyTiger1.3 ( aka CT RAT ) – This malware is likely used as a second-stage backdoor .


It also appears the attackers use this as second-stage malware .


We have observed the Enfal malware in use since 2011 and in conjunction with Backdoor.APT.Pgift as the payload of a malicious document used in spearphishing attacks .


The Pitty Tiger group mostly uses spear phishing in order to gain an initial foothold within the targeted environment .


PittyTiger leverages social engineering to deliver spearphishing emails , in a variety of languages including English , French and Chinese , and email phishing pages to their targets .


PLATINUM has been targeting its victims since at least as early as 2009 , and may have been active for several years prior .


This section describes the history , behavior , and tactics of a newly discovered targeted activity group , which Microsoft has code-named PLATINUM .


Like many such groups , PLATINUM seeks to steal sensitive intellectual property related to government interests , but its range of preferred targets is consistently limited to specific governmental organizations , defense institutes , intelligence agencies , diplomatic institutions , and telecommunication providers in South and Southeast Asia .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


LATINUM makes a concerted effort to hide their infection tracks , by self-deleting malicious components , or by using server side logic in ' one shot mode ' where remotely hosted malicious components are only allowed to load once .


PLATINUM often spear phishes its targets at their non-official or private email accounts , to use as a stepping stone into the intended organization 's network .


PLATINUM uses custom-developed malicious tools and has the resources to update these applications often to avoid being detected .


PLATINUM primarily targets its intended victims using spear phishing .


PLATINUM configures its backdoor malware to restrict its activities to victims ' working hours , in an attempt to disguise post-infection network activity within normal user traffic .


PLATINUM does not conduct its espionage activity to engage in direct financial gain , but instead uses stolen information for indirect economic advantages .


PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts .


For the initial infection , PLATINUM typically sends malicious documents that contain exploits for vulnerabilities in various software programs , with links or remotely loaded components ( images or scripts or templates ) that are delivered to targets only once .


PLATINUM 's approach toward exploiting vulnerabilities varies between campaigns .


The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components .


When the document was opened in Word , PLATINUM exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer .


n one case from 2013 , the target was sent a malicious document through a spear phishing email message .


The DLL exploited another previously unknown vulnerability ( designated CVE-2015-2546 ) in the Windows kernel , which enabled it to elevate privileges for the Word executable and subsequently install a backdoor through the application .


When the document was opened in Word , it exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer .


In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves .


Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015 .


In both these campaigns the activity group included remote triggers to deactivate exploitation , with an attempt to conceal the vulnerability , and prevent analysis of the attack .


After gaining access to a victim 's computer , PLATINUM installs its own custom-built malware to communicate with the compromised system , issue commands , and move laterally through the network .


PLATINUM uses a number of different custom-developed backdoors to communicate with infected computers .


This section describes some of the tools used by the group .


The lack of any significant evidence of shared code between any of these backdoor families is another clue as to the scope of the resources on which the activity group is able to draw , and the precautions the group is willing and able to take in order to avoid losing its ability to conduct its espionage operations .


In addition to Dipsind and its variants , PLATINUM uses a few other families of custom-built backdoors within its attack toolset .


The PLATINUM group has written a few different versions of keyloggers that perform their functions in different ways , most likely to take advantage of different weaknesses in victims ' computing environments .


While one family relies on a small number of supported commands and simple shells , the other delves into more convoluted methods of injections , checks , and supported feature sets .


Both groups can set permissions on specific files to Everyone , and work in tandem with the PLATINUM backdoors .


In particular , this second group also has the capability of dumping users ' credentials using the same technique employed by Mimikatz .


In addition to using several publicly known injection methods to perform this task , it also takes advantage of an obscure operating system feature known as hot patching .


One of PLATINUM 's most recent and interesting tools is meant to inject code into processes using a variety of injection techniques .


At a high level , hot patching can transparently apply patches to executables and DLLs in actively running processes , which does not happen with traditional methods of code injection such as CreateRemoteThread or WriteProcessMemory .


Hot patching is an operating system-supported feature for installing updates without having to reboot or restart a process .


Multiple Dipsind variants have been identified , all of which are believed to be used exclusively by PLATINUM .


The group 's most frequently used backdoors belong to a malware family that Microsoft has designated Dipsind , although some variants are detected under different names .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 Administrator permissions are required for hot patching , and the technique used by PLATINUM does not attempt to evade this requirement through exploitation .


PLATINUM has used several zero-day exploits against their victims .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 .


PLATINUM has consistently targeted victims within a small set of countries in South and Southeast Asia .


PLATINUM has developed or commissioned a number of custom tools to provide the group with access to victim resources .


Some of the tools used by PLATINUM , such as the port-knocking backdoor , show signs of organized thinking .


Take advantage of native mitigations built into Windows 10 .


For example , the summer 2015 attack that used the unusual ' resume ' would not have been successful on Windows 10 as-is because of the presence of the Supervisor Mode Execution Prevention ( SMEP ) mitigation , even without the latest security updates installed .


Even if CVE-2015-2546 affected Windows 10 , the exploitation would have required much more technical prowess to succeed ; ultimately , SMEP makes it more difficult for attackers .


For example , one zero-day vulnerability exploit ( CVE-2015-2545 ) used by PLATINUM was addressed immediately in September 2015 .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel® Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication .


Until this incident , no malware had been discovered misusing the AMT SOL feature for communication .


We confirmed that the tool did not expose vulnerabilities in the management technology itself , but rather misused AMT SOL within target networks that have already been compromised to keep communication stealthy and evade security applications .


In either case , PLATINUM would need to have gained administrative privileges on targeted systems prior to the feature 's misuse .


The updated tool has only been seen in a handful of victim computers within organizational networks in Southeast Asia—PLATINUM is known to customize tools based on the network architecture of targeted organizations .


One possibility is that PLATINUM might have obtained compromised credentials from victim networks .


Another possibility is that the targeted systems did not have AMT provisioned and PLATINUM , once they've obtained administrative privileges on the system , proceeded to provision AMT .


During the provisioning process , PLATINUM could select whichever username and password they wish .


The new SOL protocol within the PLATINUM file-transfer tool makes use of the AMT Technology SDK 's Redirection Library API ( imrsdk.dll ) .


The PLATINUM tool is , to our knowledge , the first malware sample observed to misuse chipset features in this way .


Microsoft reiterates that the PLATINUM tool does not expose flaws in Intel® Active Management Technology ( AMT ) , but uses the technology within an already compromised network to evade security monitoring tools .


The discovery of this new PLATINUM technique and the development of detection capabilities highlight the work the Windows Defender ATP team does to provide customers greater visibility into suspicious activities transpiring on their networks .


It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks .


This signals just how long ago the Poseidon threat actor was already working on its offensive framework .


However , Poseidon 's practice of being a ' custom-tailored malware implants boutique ' kept security researchers from connecting different campaigns under the umbrella of a single threat actor .


Poseidon Group is dedicated to running targeted attacks campaigns to aggressively collect information from company networks through the use of spear-phishing packaged with embedded , executable elements inside office documents and extensive lateral movement tools .


The Poseidon Group is a long-running team operating on all domains : land , air , and sea .


The Poseidon Group has been active , using custom code and evolving their toolkit since at least 2005 .


Poseidon has maintained a consistently evolving toolkit since the mid-2000s .


The Poseidon Group actively targets this sort of corporate environment for the theft of intellectual property and commercial information , occasionally focusing on personal information on executives .


PROMETHIUM is an activity group that has been active as early as 2012 .


This malware family is known as " PittyTiger " by the anti-virus community .


NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird .


The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


PROMETHIUM distributed links through instant messengers , pointing recipients to malicious documents that invoked the exploit code to launch Truvasys on victim computers .


PROMETHIUM is an activity group that has been active since at least 2012 .


In 2016 , an attack campaign by this group was recorded in early May that made use of an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player , which at the time was both unknown and unpatched .


Truvasys is a collection of modules written in the Delphi programming language , a variant of Pascal .


While studying Truvasys , Microsoft uncovered a previously undocumented piece of malware known as Myntor that is a completely separate malware family .


Unit 61486 is the 12th Bureau of the PLA 's 3rd General Staff Department ( GSD ) and is headquartered in Shanghai , China .


The CrowdStrike has been tracking this particular unit since 2012 , under the codename PUTTER PANDA , and has documented activity dating back to 2007 .


The CrowdStrike Intelligence team has been tracking this particular unit since 2012 , under the codename PUTTER PANDA , and has documented activity dating back to 2007 .


This particular unit is believed to hack into victim companies throughout the world in order to steal corporate trade secrets , primarily relating to the satellite , aerospace and communication industries .


Parts of the PUTTER PANDA toolset and tradecraft have been previously documented , both by CrowdStrike , and in open source , where they are referred to as the MSUpdater group .


PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries .


According to the hacking collective , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks .


The folders seem to contain information about the company 's development documentation , artificial intelligence model , web security software , and antivirus software base code .


Targeting antivirus companies appears to have been the primary goal of Fxmps' latest network intrusions .


This period started with their seeming disappearance in October 2018 and concluded with their return in April 2019 .


The hacker 's name is Gnosticplayers , and since February 11 the hacker has put up for sale data for 32 companies in three rounds [stories on Round 1 , Round 2 , and Round 3] on Dream Market , a dark web marketplace .


But according to Gnosticplayers , his foray into a public marketplace like Dream has two goals --besides the first and obvious one being money .


Data collected by Secureworks incident response ( IR ) analysts and analyzed by CTU researchers indicates that GOLD LOWELL extorts money from victims using the custom SamSam ransomware .


Some sources claimed that GOLD LOWELL operations specifically targeted the healthcare vertical following public SamSam incidents in 2016 and 2018 .


However , CTU analysis indicates that GOLD LOWELL is motivated by financial gain , and there is no evidence of the threat actors using network access for espionage or data theft .


In January 2017 , GOLD LOWELL began targeting legitimate RDP account credentials , in some cases discovering and compromising accounts using brute-force techniques .


In 2015 and 2016 , GOLD LOWELL frequently exploited JBoss enterprise applications using several versions of this open-source JBoss exploitation tool .


In 2017 and early 2018 , the group used PowerShell commands to call Mimikatz from an online PowerSploit repository , which is a collection of publicly available PowerShell modules for penetration testing .


Gold Lowell responded by modifying a registry entry to disable the endpoint tool 's scanning functionality .


Gold Lowell then provide a download link to a unique XML executable file and corresponding RSA private key to decrypt the files .


This methodology , known as " big game hunting " , signals a shift in operations for WIZARD SPIDER , a criminal enterprise of which GRIM SPIDER appears to be a cell .


The WIZARD SPIDER threat group , known as the Russia-based operator of the TrickBot banking malware , had focused primarily on wire fraud in the past .


Similar to Samas and BitPaymer , Ryuk is specifically used to target enterprise environments .


Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release .


Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors .


However , Ryuk is only used by GRIM SPIDER and , unlike Hermes , Ryuk has only been used to target enterprise environments .


Since Ryuk 's appearance in August , the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD .


Hermes ransomware , the predecessor to Ryuk , was first distributed in February 2017 .


In mid-August 2018 , a modified version of Hermes , dubbed Ryuk , started appearing in a public malware repository .


Ryuk was tailored to target enterprise environments and some of the modifications include removing anti-analysis checks .


As mentioned in the Hermes to Ryuk section , Ryuk uses a combination of symmetric ( AES ) and asymmetric ( RSA ) encryption to encrypt files .


For each mounted drive , Ryuk calls GetDriveTypeW to determine the drive 's type .


To retrieve IP addresses that have ARP entries , Ryuk calls GetIpNetTable .


Open-source reporting has claimed that the Hermes ransomware was developed by the North Korean group STARDUST CHOLLIMA ( activities of which have been public reported as part of the " Lazarus Group " ) , because Hermes was executed on a host during the SWIFT compromise of FEIB in October 2017 .


The two executables related to Hermes are bitsran.exe and RSW7B37.tmp .


Falcon Intelligence has medium-high confidence that the GRIM SPIDER threat actors are operating out of Russia .


Based on these factors , there is considerably more evidence supporting the hypothesis that the GRIM SPIDER threat actors are Russian speakers and not North Korean .


The hackers also started tweeting a few samples of internal emails from the company .


From a process and file perspective , Hermes and Ryuk target files in a similar fashion .


Claudio Guarnieri , a security researcher who has investigated Hacking Team along with others at the Citizen Lab , was quick to point this out .


The breach on Hacking Team comes almost a year after another surveillance tech company , the competing FinFisher , was hacked in a similar way , with a hacker leaking 40 Gb of internal files .


Their software , once surreptitiously installed on a target 's cell phone or computer , can be used to monitor the target 's communications , such as phone calls , text messages , Skype calls , or emails .


In 2015 and 2016 , Dridex was one of the most prolific eCrime banking trojans on the market and , since 2014 , those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits .


In August 2017 , a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K. 's National Health Service ( NHS ) , with a high ransom demand of 53 BTC ( approximately $200,000 USD ) .


The targeting of an organization rather than individuals , and the high ransom demands , made BitPaymer stand out from other contemporary ransomware at the time .


Though the encryption and ransom functionality of BitPaymer was not technically sophisticated , the malware contained multiple anti-analysis features that overlapped with Dridex .


Later technical analysis of BitPaymer indicated that it had been developed by INDRIK SPIDER , suggesting the group had expanded its criminal operation to include ransomware as a monetization strategy .


The beginning of 2017 also brought a turning point in INDRIK SPIDER 's operation of Dridex .


CrowdStrike® Falcon® Intelligence™ also observed a strong correlation between Dridex infections and BitPaymer ransomware .


During incidents that involved BitPaymer , Dridex was installed on the victim network prior to the deployment of the BitPaymer malware .


Also unusual was the observation that both Dridex and BitPaymer were spread through the victim network using lateral movement techniques traditionally associated with nation-state actors and penetration testing .


The information gathered from these engagements , combined with information from prior Dridex IR engagements , provides insight into how INDRIK SPIDER deploys and operates both Dridex and BitPaymer .


In recent BitPaymer IR engagements , Falcon Intelligence linked the initial infection vector to fake updates for a FlashPlayer plugin and the Chrome web browser .


With the move to targeting select victims for high-value payouts , the INDRIK SPIDER adversary group is no longer forced to scale its operations , and now has the capacity to tailor its tooling to the victim 's environment and play a more active role in the compromise with " hands on keyboard " activity .


This web hosting service provider continues to be the hosting provider of choice for the threat actors behind NetTraveler .


These new tactics of selectively targeting organizations for high ransomware payouts have signaled a shift in INDRIK SPIDER 's operation with a new focus on targeted , low-volume , high-return criminal activity : a type of cybercrime operation we refer to as big game hunting .


Later , in January 2018 , a report was released that identified similarities between the BitPaymer ransomware and Dridex malware .


The report authors renamed the malware " FriedEx " .


Falcon Intelligence has analyzed this malware and can confirm the overlap between BitPaymer/FriedEx and Dridex malware .


Though there is no functionality to collect this information in the ransomware itself , the ransomware is deployed by INDRIK SPIDER in parallel with Dridex malware , and the Dridex malware contains modules that may be used to collect information from infected hosts .


Falcon Intelligence has acquired multiple decryption tools related to BitPaymer , which confirm the theory that a unique key is used for each infection .


Unlike many ransomware operations , which usually just require victims to make the payment and subsequently download a decryptor , INDRIK SPIDER requires the victim to engage in communication with an operator .


Falcon Intelligence has had unique insight into the email dialogue between a victim and an INDRIK SPIDER operator .


Initial victim communication with the INDRIK SPIDER operator , using one of the email addresses provided , results in the operator providing key pieces of information up front , such as the BTC address and the ransom amount .


It was made clear during communications that INDRIK SPIDER is not willing to negotiate on the ransom amount , explicitly stating that the victim can use multiple Bitcoin exchanges to obtain the number of BTC required , and the exchange rate should be calculated based on the rate posted on the cryptocurrency exchange Bittrex .


Of note , INDRIK SPIDER specifies the geographical location of where the victim should seek help , confirming that they know key information about the victim .


INDRIK SPIDER uses file sharing platforms to distribute the BitPaymer decryptor .


In an extensive email to the victim , the INDRIK SPIDER operator provides a decryptor download link , decryptor deletion link ( to be used following decryptor download ) and a password .


The recommendations provided are not only good advice , but also provide indications of how INDRIK SPIDER breaches organizations and moves laterally until domain controller access is gained .


Ransom demands have varied significantly , suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization .


INDRIK SPIDER consists of experienced malware developers and operators who have likely been part of the group since the early days of Dridex operations , beginning in June 2014 .


The formation of the group and the modus operandi changed significantly in early 2017 .


Dridex operations became more targeted , resulting in less distribution and Dridex sub-botnets in operation , and BitPaymer ransomware operations began in July 2017 .


There is no doubt that BitPaymer ransomware operations are proving successful for Indrik Spider , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan .


There is no doubt that BitPaymer ransomware operations are proving successful for this criminal group , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan .


Though Dridex is still bringing in criminal revenue for the actor after almost four years of operation , targeted wire fraud operations likely require lengthy planning .


In scenarios where wire fraud is not as lucrative an option , INDRIK SPIDER might use ransomware to monetize the compromise instead .


INDRIK SPIDER isn't the only criminal actor running big game hunting operations ; The first ransomware to stake a claim for big game hunting was Samas ( aka SamSam ) , which is developed and operated by BOSS SPIDER .


Since they were first identified in January 2-16 , this adversary has consistently targeted large organizations for high ransom demands .


In July 2017 , INDRIK SPIDER joined the movement of targeted ransomware with BitPaymer .


Most recently , the ransomware known as Ryuk came to market in August 2017 and has netted its operators , tracked by Falcon Intelligence as GRIM SPIDER , a significant ( and immediate ) profit in campaigns also targeting large organizations .


The WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware .


The LUNAR SPIDER threat group is the Eastern European-based operator and developer of the commodity banking malware called BokBot ( aka IcedID ) , which was first observed in April 2017 .


The BokBot malware provides LUNAR SPIDER affiliates with a variety of capabilities to enable credential theft and wire fraud , through the use of webinjects and a malware distribution function .


campaigns involving both BokBot and TrickBot were first identified by CrowdStrike Intelligence in July 2017 .


These gtags have been closely associated with LUNAR SPIDER activity .


Unit 42 followed network traces and pivoted on the information left behind by this actor , such as open directories , document metadata , and binary peculiarities , which enabled us to find a custom-made piece of malware , that we named " CapturaTela " .


Our telemetry for this campaign identified email as the primary delivery mechanism and found the first related samples were distributed in August 2018 .


Aside from the use of the custom trojan CapturaTela , the actor makes extensive use of several other remote access Trojans to perform its malicious activities .


Why would OurMine want to target WikiLeaks .


Instead , OurMine had managed to alter WikiLeaks 's DNS records ( held by a third-party registrar ) to direct anyone who tried to visit wikileaks.org to visit a different IP address which definitely wasn't under the control of Julian Assange and his cronies .


We don't know how OurMine managed to access WikiLeaks 's DNS records , but past experience has shown that their typical modus operandi is simply to log in using their victim 's password .


Alternatively , OurMine might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address .


Alternatively , the attackers might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address .


Known for hijacking prominent social media accounts , the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network .


Last year , OurMine victimized Marvel , The New York Times , and even the heads of some of the biggest technology companies in the world .


Mark Zuckerberg , Jack Dorsey , Sundar Pichai , and Daniel Ek — the CEOs of Facebook , Twitter , Google and Spotify , respectively — have also fallen victim to the hackers , dispelling the notion that a career in software and technology exempts one from being compromised .


The group is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


OurMine is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


The group 's primary goal is demonstrating to companies that they have weak security .


US intelligence agencies pinned the breach on North Korea ( one of the hacking group 's demands was that Sony pull The Interview , Seth Rogan 's comedy about a plot to assassinate Kim Jong-Un ) .


Of course , Sony ( one of Vevo 's joint owners ) fell victim to a devastating hack in 2014 after a group of hackers calling themselves the " Guardians of Peace " dumped a wealth of its confidential data online .


The cryptominer employed by Pacha Group , labeled Linux.GreedyAntd by Intezer , was completely undetected by all leading engines , demonstrating the sophistication of this malware .


Intezer has evidence dating back to September 2018 which shows Pacha Group has been using a cryptomining malware that has gone undetected on other engines .


The new miner employed by Pacha Group , named Linux.GreedyAntd , has shown to be more sophisticated than the average Linux threat , using evasion techniques rarely seen in Linux malware .


Pacha Group is believed to be of Chinese origin , and is actively delivering new campaigns , deploying a broad number of components , many of which are undetected and operating within compromised third party servers .


We have labeled the undetected Linux.Antd variants , Linux.GreedyAntd and classified the threat actor as Pacha Group .


Based on our findings Linux.GreedyAntd 's operations closely resemble previous cryptojacking campaigns deployed by Pacha Group in the past .


Among the artifacts hosted in GreedyAntd 's servers , we managed to find a single component not related to the same cryptojacking operation just previously discussed and leveraged by Pacha Group .


It was one of the few ransomware strains that were being mass-distributed via email spam and exploit kits , but also as part of targeted attacks against high-profile organizations ( a tactic known as big-game hunting ) at the same time .


The GandCrab author also had a spat with South Korean security vendor AhnLab last summer after the security firm released a vaccine for the GandCrab ransomware .


Recently , Sophos Labs has observed criminal groups scanning the internet for open MySQL databases running on Windows systems , which they tried to infect with GandCrab .


CrowdStrike Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams .


Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February .


CrowdStrike® Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams .


PINCHY SPIDER is the criminal group behind the development of the ransomware most commonly known as GandCrab , which has been active since January 2018 .


PINCHY SPIDER sells access to use GandCrab ransomware under a partnership program with a limited number of accounts .


The main catalyst for dedicated development by PINCHY SPIDER , however , has been an ongoing battle with cybersecurity providers that are actively developing GandCrab mitigations and decryptors .


In February , PINCHY SPIDER released version 5.2 of GandCrab , which is immune to the decryption tools developed for earlier versions of GandCrab and in fact , was deployed the day before the release of the latest decryptor .


CrowdStrike Intelligence first identified new GandCrab ransomware deployment tactics in mid-February , when a threat actor was observed performing actions on a victim host in order to install GandCrab .


Using RDP and stolen credentials from the initially compromised host , the threat actor then proceeded to move laterally around the victim network and was able to deploy GandCrab across several other hosts .


Near the end of February , CrowdStrike Intelligence observed another incident in which similar manual lateral movement techniques were used to deploy GandCrab across multiple hosts in an enterprise .


Once Domain Controller access was acquired , Pinchy Spider used the enterprise 's own IT systems management software , LANDesk , to deploy a loader to hosts across the enterprise .


This loader , known as Phorpiex Downloader , is not specifically tied to GandCrab or PINCHY SPIDER , and it has previously been observed dropping other malware , such as Smoke Bot , Azorult , and XMRig .


As reported in the CrowdStrike 2018 Global Threat Report , big game hunting was a trend that helped define the criminal threat landscape in 2018 .


BOSS SPIDER used both enterprise and per-host pricing during their campaigns .


Both INDRIK SPIDER ( with BitPaymer ransomware ) and GRIM SPIDER ( with Ryuk ransomware ) have made headlines with their high profile victims and ransom profits , demonstrating that big game hunting is a lucrative enterprise .


Running successful big game hunting operations results in a higher average profit per victim , allowing adversaries like PINCHY SPIDER and their partners to increase their criminal revenue quickly .


The threat actor Rocke was originally revealed by Talos in August of 2018 and many remarkable behaviors were disclosed in their blog post .


The family was suspected to be developed by the Iron cybercrime group and it's also associated with the Xbash malware we reported on in September of 2018 .


The threat actor Rocke was first reported by Cisco Talos in late July 2018 .


The ultimate goal of this threat is to mine Monero cryptocurrency in compromised Linux machines .


To deliver the malware to the victim machines , the Rocke group exploits vulnerabilities in Apache Struts 2 , Oracle WebLogic , and Adobe ColdFusion .


Once the C2 connection is established , malware used by the Rocke group downloads shell script named as " a7 " to the victim machine .


To be more specific , the malware uninstalls cloud security products by Alibaba Cloud and Tencent Cloud .


Public cloud infrastructure is one of the main targets for Rocke .


FortiGuard Labs has been monitoring a Linux coin mining campaign from " Rocke " – a malware threat group specializing in cryptomining .


The malicious bash script components of the malware are hosted in Pastebin , with the profile name " SYSTEMTEN " , which is very similar to previous names used by the " Rocke " threat group .


However , around a month ago , Rocke started targeting systems that run Jenkins by attempting to exploit CVE-2018-1000861 and CVE-2019-1003000 .


By utilizing a hook library , it is more complicated for users to manually detect and remove the infection from their systems , giving the threat actors more time to generate profit .


The group also made it back into the news with the recent WannaCry ransomware that targeted computers around the globe ; it piggybacked on exploits revealed by the Shadow Brokers .


A mysterious hacker or hackers going by the name " The Shadow Brokers " claims to have hacked a group linked to the NSA and dumped a bunch of its hacking tools .


The Shadow Brokers claimed to have hacked the Equation Group and stolen some of its hacking tools .


The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites .


The Shadow Brokers , the group that publicly dumped a cache of NSA hacking tools , appears to be back and ready to sell stolen material on an individual basis .


Wh1sks estimated that , between June and early August , the Shadow Brokers have made up to $88,000 in an alternative cryptocurrency called Monero .


Moreover , Wh1sks was able to find out the email addresses of five people who have subscribed to the Shadow Brokers' monthly dump service .


Buried among this new treasure trove , there are several mentions of previously disclosed NSA top secret programs and software such as " STRAITBIZARRE " , used to control implants remotely , and " JEEPFLEA " , a project to hack the money transferring system SWIFT .


The Shadow Brokers have long claimed that the tools they release are from the " Equation Group " , the name of a government hacking group outed by Kaspersky Lab in 2015 , which is widely believed to be the NSA .


Recently , FireEye released a great report on one of the more active groups , now known as APT30 .


In addition , Kaspersky discovered that the Winnti group uses a popular backdoor known as PlugX which also has Chinese origins .


Previous work published by security vendor FireEye in October 2014 suggests APT28 might be of Russian origin .


After publishing our initial series of blogposts back in 2016 , Kaspersky has continued to track the ScarCruft threat actor .


Based on the ScarCruft’s recent activities , Kaspersky strongly believes that this ScarCruft group is likely to continue to evolve .


Kaspersky also discovered an interesting piece of rare malware created by this threat actor ScarCruft .


Kaspersky witnessed the ScarCruft threat actor extensively testing a known public exploit during its preparation for the next campaign .


Based on our telemetry , Kaspersky can reassemble ScarCruft’s binary infection procedure .


In addition , Kaspersky analyzed the victims of this campaign and spotted an interesting overlap of this campaign with another APT actor known as DarkHotel .


Secureworks researchers investigated activities associated with the BRONZE BUTLER (also known as Tick) threat group , which likely originates in the People .


However , an investigation by Symantec has found that Butterfly has been active since at least March 2012 and its attacks have not only continued to the present day , but have also increased in number .


Talos assesses with high confidence that Group 123 was responsible for six campaigns .


Attacks launched by Scarlet Mimic were publicly exposed on 2013 in a Trend Micro report about the FakeM Trojan .


Finally , Talos identified a 6th campaign that is also linked to Group 123 .