The code supports two different installation methods : setup in a UAC-enforced environment ( with limited privileges ) , or an installation with full-administrative privileges enabled ( in cases where the malware gains the ability to run with elevated permissions ) . APT35 , also known as the Newscaster Team , is a threat group sponsored by the Iranian government that conducts long term , resource-intensive operations to collect strategic intelligence . To aid in the recovery of encrypted payloads , the following Python script can be used to decode pixel colors from a .png image . If the main function is called with only , it will take the path that is intended for connect to the MSSQL server and , upload • None are supplied to the main function , it will immediately fail due to attempting to utilize command line arguments that were not parsed yet .


We also observed automatically generated files on the C2 , indicating the actor behind this campaign also issues commands to search for and exfiltrate PDF and Office documents . This is also a full-featured backdoor controlled by email , and which can work independently of any other Turla component . The ShellMain function is a stub that relocates the DLL to another buffer and spawns a thread that starts from ShellMainThreadInt at offset +0xC0CD . Through this entry , in which we take a closer look at an individual who we believe might be connected to the Winnti group , we hope to give both ordinary users and organizations better insights into some of the tools – notably the server infrastructures- these kinds of threat actors use , as well as the scale in which they operate .


This is done by opening the Google account creation process and parsing the current view . Attackers then moved on to the motor industry in late May . TechNet ’s security was in no way compromised by this tactic , which is likely possible on other message boards and forums . As a consequence , four trams were derailed and twelve people injured due to resulting emergency stops .


Later campaigns saw new attachment types , even as Dridex and Locky payloads remained largely unchanged .


APT28 has continued to develop its tools over the past two years .


They move laterally and escalate system privileges to extract sensitive information — whenever the attacker wants to do so.4 ,5 Because some RATs used in targeted attacks are widely available , determining whether an attack is part of a broader APT campaign can be difficult . Sometimes , however , certain samples made use of domain names for HTTP communication .


This is only a small picture of the threat actor 's operations . Seeking to tease out any possible links between Operation Aurora , VOHO , Operation DeputyDog , and Ephemeral Hydra , we began with Symantec 's Hidden Lynx report as our foundation . We have evidence suggesting that APT1 manually controls thousands of systems in support of their attacks , and have directly observed their control over hundreds of these systems . It can range from asking “ customers ” to pay a monthly fee for access to this set of tools to use in cyber attacks , or users can even pay the original creators to distribute the malware on their behalf and manage the infection .


Educate users about the risks of spearphishing emails .


] site/gate_cb8a5aea1ab302f0_c online 208.91.197 [ . The role of the .NET module is to deliver the known KopiLuwak JavaScript Trojan . It was a decoy to make visitor download a " Flash Player " , which was in fact DownPaper malware , analyzed later in this report .


On November 26 , 2015 , a suspected China-based APT16 sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies . In early 2016 , the Callisto Group was observed sending targeted spear phishing emails .


The main infection vector is a phishing attack using SMS/MMS . PLEAD also uses CVE-2017-7269 , a buffer overflow vulnerability Microsoft Internet Information Services ( IIS ) 6.0 to compromise the victim 's server . Since this malware dates back to around 2004 , there are many samples containing CNC URLs from the 3322.org page . The HyperText Transfer Protocol ( HTTP ) redirect status response code indicates that the resource requested has been temporarily moved to the URL given by the header .


Report_URL : https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/


Missing permissions The lack of the READ_FRAME_BUFFER permission can be justified by the removal of the screen record feature . executable compilation times suggest early 2012 . RIPTIDE ’s first communication with its C2 server fetches an encryption key , and the RC4 encryption key is used to encrypt all further communication . Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.[22][23 ]


The initial attack vector leveraged a phishing email , using the subject line of Upcoming Defense events February 2018 and a sender address claiming to be from Jane ’s 360 defense events events@ihsmarkit.com .


Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() . Ordnance will be able to immediately generate shellcode after users provide the IP and PROT that the shellcode should connect to or listen on .


On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website . In the known spear phishing attacks by the Callisto Group , they employed the " Scout " malware tool from the RCS Galileo platform .


Since at least 2013 , HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government , financial , automotive , and media industries . The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) .


Hashes of samples Type Package name SHA256 digest Custom ads com.targetshoot.zombieapocalypse.sniper.zombieshootinggame 5d98d8a7a012a858f0fa4cf8d2ed3d5a82937b1a98ea2703d440307c63c6c928 Click fraud com.counterterrorist.cs.elite.combat.shootinggame 84672fb2f228ec749d3c3c1cb168a1c31f544970fd29136bea2a5b2cefac6d04 BBSRAT is typically packaged within a portable executable file , although in a few of the observed instances , a raw DLL was discovered to contain BBSRAT . Two files are created for the task at approximately the same time : C:\Windows\System32\Tasks\At1 and C:\Windows\Tasks\At1.job . The PE file also appeared to be a modification of the Miniduke 's main backdoor module that uses the same Twitter URL as the Java payload .


Report_URL : https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/


FakeSpy masquerades as legitimate postal service apps and transportation services in order to gain the users ' trust . Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe . Its activity subsequently increased in the second quarter of 2018 , with a particular spike in April 2018 .


Eleven of the links were clicked once , four were clicked twice , two were clicked three times , and two were clicked four times .


Malware Testing Environment Tied to TEMP.Veles .


In the lab , we changed our Quasar RAT source code to use the known encryption key , and to send fake victim IP address , City , Country code , Flag , and Username .


Patch applications and operating systems .


First , an activity named MainActivity fires up , taking care of hiding the icon and showing the fake notification . During our 2018 monitoring of this group , we were able to identify different techniques utilized by very similar attackers in the MENA region , sometimes on the same target . Winnti malware handles outbound communications using multiple protocols including : ICMP , HTTP , as well as custom TCP and UDP protocols .


Beaconing information The ID is generated for each installation of the malware , while the token remains unique . It is in use by the Molerats ( aka Gaza cybergang ) , a politically motivated group whose main objective , we believe , is intelligence gathering . January 2019 sent via 149.28.156.61 to deliver either Derusbi or KHRat samples with either cswksfwq.kfesv.xyz or connect.bafunpda.xyz as C2 . LIGHTWORK utilizes positional command line arguments for target device , port , and IEC-104 command .


Worryingly , some of the modifications enforced by the spyware might expose the infected devices to further compromise or data tampering . On August 23 , 2017 , we observed OilRig targeting an organization within the United Arab Emirates government . The Exfiltration , however , is done via other cloud providers . However , the problem in general with labeling every ransomware attack as sophisticated is that it excuses the organization that has nt followed the basic preventative best practices .


A particularly interesting aspect of one of the two documents we analyzed was the filename used , crash list ( Lion Air Boeing 737 ).docx .


The Poison Ivy builder kit allows attackers to customize and build their own PIVY server , which is delivered as mobile code to a target that has been compromised , typically using social engineering . Unit 42 enumerated the threat infrastructure related to Bookworm and created a chart to visualize connected entities to its current attack campaign .


Specifically , the threat group used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows .


TG-3390 is known for compromising organizations via SWCs and moving quickly to install backdoors on Exchange servers .


Although there was no evidence of the group using the malware , the threat actors may have leveraged its access or capabilities during earlier phases of the intrusions .


Cannon email Accounts :


Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 .


The data is first encrypted and then encoded with Base64 .


How does the malware work without code for these key components ? At least one of the attacks in this campaign leveraged a European security and defense-themed lure , which aligns with the targeting preferences for this group . Aside from this, there were several other suspicious items we noted: Headers mismatched: The Reply-To and From email address were . But while it was clear earlier on that attackers were actively exploiting CVE-2023 - 34362 , it was only a few days later that it became clear that Cl0p was behind the attacks .


Sofacy ’s reported presence in the DNC network alongside APT29 brought possibly the highest level of public attention to the group ’s activities in 2016 , especially when data from the compromise was leaked and “ weaponized ” .


The function main uses a DES encryption algorithm to encode these addresses . To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT . During our brief window of visibility into one of the known 22 CnC nodes , FireEye observed the Ke3chang conducting reconnaissance and moving laterally throughout the compromised networks .


Having analyzed a few variants of the malware , we noticed that the private key was exposed in the code and did not change . It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations . Symantec detects this threat as Backdoor.Nidiran .


The investigation uncovered that an actor had used these devices to gain initial access to corporate networks .


A third , similar , CosmicDuke campaign was observed presumably targeting Georgian entities since it used an attachment with a Georgian-language name that translates to “ NATO consolidates control of the Black Sea.docx ” .


To surface its ransom note , it uses a series of techniques that take advantage of the following components on Android : The “ call ” notification , among several categories of notifications that Android supports , which requires immediate user attention . All contain the same Visual Basic macro code and author name as Honeybee . After the check , Pikabot is a new malware first seen in early 2023 .


But there 's little stopping it from doing much worse . CTU researchers assess this as the continuation of activity first observed in 2016 , and it is likely that the campaign is ongoing . APT33 : 8.26.21.220 [REDACTED].ddns.net . One possibility is that such claims were made disingenuously as an attempt to establish KillNet 's credibility and/or as a means to distance the group from the Russian government .


BOSS SPIDER used both enterprise and per-host pricing during their campaigns . In many attacks , the group has succeeded in compromising Microsoft Exchange or Lotus Domino email servers in order to intercept company emails and possibly use them to send counterfeit emails .


The fact that the overlay screens are almost identical to the legitimate banking apps suggests that the actors might be very familiar with the Spanish banking applications and might even be accustomed to the language . In one of the attacks , Rapid7 identified the attackers escaping a Citrix application in order to run the payload script on the victim desktop . The Gh0st downloaders employ simple substitution ciphers for hiding strings .


The attacks use Domain Name System ( DNS ) cache poisoning/DNS spoofing , possibly through infringement techniques such as brute-force or dictionary attacks , to distribute and install malicious Android apps . The actors behind LUCKY ELEPHANT recognize the effectiveness and use doppelganger webpages nearly identical to legitimate sites , enticing users to input their credentials . Only a small portion of this code is actually used to start the infection , the rest is just junk code .


Although early versions had some basic code and string obfuscation , protection of the third version of the malware was enhanced with the use of payload obfuscation . The attackers then enumerated access and conducted privilege escalation on the victim networks , utilizing DLL sideloading techniques documented in a US-CERT alert on APT10 to deliver malware . The " Tick " group has conducted cyber espionage attacks against organizations in the Republic of Korea and Japan for several years .


however , overall there is wide geographical spread of infections .


This evidence indicates that the certificate ’s rightful owner either misused it or it had been stolen from them .


Back in October 2016 , Unit 42 published an initial analysis on a Flash exploitation framework used by the Sofacy threat group called DealersChoice .


] infokalisi [ . The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) . The supplied registration information , which is still visible in public “ whois ” data as of February 3, 2013 . If scripts are not commonly used on a system , but enabled , scripts running out of cycle from patching or other administrator functions are suspicious .


Based on the profile of the victims and the type of information targeted by the attackers , Symantec believes that Butterfly is financially motivated , stealing information it can potentially profit from . In a separate incident , CTU researchers identified a file named s.txt , which is consistent with the output of the Netview host-enumeration tool .


We 've seen that this has been the case for many years with spear-phishing campaigns on desktop and mobile platforms , so , unfortunately , it does n't seem that this will change any time soon . Their long run of attacks , focused on Latin American countries , has allowed them to collect intelligence and refine their tactics over the years . We do not have evidence that the earliest targeted financial institutions were victimized by fraudulent transactions before APT38 left the compromised environments , possibly indicating that APT38 was conducting reconnaissance-only activity at that time .


The Apple Developer Enterprise program is intended to allow organizations to distribute proprietary , in-house apps to their employees without needing to use the iOS App Store . Microsoft addressed the SMBv1 vulnerabilities in March 2017 with Security Bulletin MS17-010 . As MuddyWater has consistently been using POWERSTATS as its main tool , they are relatively easy to distinguish from other actors .


However , the persistent presence of Italian language both on the Google Play Store pages as well as inside the spyware code was a clear sign that an Italian actor was behind the creation of this platform . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . When the victims open the document , they are encouraged to click on Enable Content , which causes the embedded malicious macro E-TOOL code to run . It is accessed using a path confusion exploit , CVE-2022 - 41040 , allowing the attacker to reach the backend for arbitrary URLs .


Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 . To our knowledge , Turla is the only espionage group that currently uses a backdoor entirely controlled by emails , and more specifically via PDF attachments .


TEMP.Periscope BackgroundActive since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


The various stealth and resilience techniques implemented in the adware show us that the culprit was aware of the malicious nature of the added functionality and attempted to keep it hidden . Written in pure C language , Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions , and carries out integrity control of various system components to avoid debugging and security detection . This malware is capable of accessing device configuration data , downloading additional files , executing commands , modifying the registry , capturing screen shots , and exfiltrating data .


The Word document usually exploits CVE-2012-0158 . The Arbor report describes the ongoing use of these four vulnerabilities in a series of espionage campaigns against not only Tibetan groups , but also others related to Hong Kong , Taiwan , and Uyghur interests .


All of these apps are developed by the same framework and hence have the same package name and certificate information as seen in Figure 12. certificate Figure 12 : Package name and certificate information . However , in this attack , this file is used to load the Hussarini backdoor via DLL hijacking . APT17 is a China based threat group that has conducted network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


These were instead spread using either a malicious Tor node that would trojanize legitimate applications on-the-fly with the OnionDuke toolset , or via torrent files containing previously trojanized versions of legitimate applications .


They would then use the toolset to gather initial information on the victims , before deciding which ones to pursue further .


We do not know why , but we suspect that it was an attempt to hide the origin of the application . Figure 2 is a typical example of a generic invoice the group used in a campaign in 2014 . They are both Korean-speaking threat actors and sometimes their victimology overlaps .


] commediauploader [ . The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll . That is , this server component receives connections from victim backdoors , displays them to the intruder , and then translates the intruder ’s commands into HTML tags that the victim backdoors read . Operating systems may have features to hide various artifacts , such as important system files and administrative task execution , to avoid disrupting user work environments and prevent users from changing files or features on the system .


Even though this is not a traditional remote access tool ( RAT ) , this campaign seems to target mainly private users . Attackers can point and click their way through a compromised network and exfiltrate data . This module is used by the backdoor during HTTP/HTTPS communication with the C2 server and has a proxy bypass functionality . In the case of ProxyNotShell , the targeted backend service is the Remote PowerShell service .


Specifically , the only known infection vector for HammerDuke is to be downloaded and executed by CozyDuke onto a victim that has already been compromised by that toolset .


This particular iteration was submitted to VirusTotal on September 16 , 2016 .


The C2 server domain is linked to Thai food : Nampriknum [ . Madi was found capturing computer screens , recording audio and stealing screenshots , keystrokes , documents and e-mail correspondence from " Middle Eastern critical infrastructure engineering firms , government agencies , financial houses and academia . Some similarities exist across different versions of the Base64 alphabet , which indicates that these are most likely not completely randomly generated . Designed to guard against XSS attacks , CSP helps control which domains can be accessed as part of a page and therefore restricts which domains to share data with .


We believe this indicates a fairly sustained campaign that has gained momentum over recent months . The basic chain of events upon execution of the MSIL dropper include dropping and executing both a PDF decoy and a Javascript (JS) dropper . The spear-phishing campaign against Asian entities isn't isolated , the admin@338 also started another attack against the US-based think tank on 14th March .


This new organization proposed the creation of a more secure Android phone . We were soon able to help investigate another incident involving Lurk . The malware also sets the executable file ’s attributes to “ Hidden. ” Some of the file names the attackers used include : winhlps.exe , acrotry.exe , AcroRd32.exe , Updater.exe . The RAT 's main binary is launched from " C:\Users\%username%\AppData\Roaming\BranScale\client32.exe " .


HOMEFRY: a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors . RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself .


Information about travel plans and campaign scheduling could provide short-term opportunities for other intelligence operations .


The group uses spear-phishing emails to compromise its targets and infect them with malware .


As mentioned in this blog , Sofacy is carrying out parallel campaigns to attack similar targets around the world but with different toolsets .


Spam emails targeting email accounts used in the integrated mail service of public officials were also found in the hacking activity . While investigating one of these infections involving White Lambert ( network-driven implant ) and Blue Lambert ( active implant ) , we found yet another family of tools that appear to be related .


] comkalisi [ . One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges . Nevertheless , it is noteworthy that Shanghai appeared in the first known APT1 domain registration , along with a phone number that begins with China ’s “ +86 ” international code . Monitor for newly constructed user accounts that may attempt to hide artifacts associated with their behaviors to evade detection .


This is usually done in order to validate the target of a new infection . During this testing , we saw document filenames that contain the C2 we witnessed in the targeted attack above , specifically the filenames XLS-withyourface.xls and XLS-withyourface – test.xls . The actor used the same trick that FireEye in the Flare-On 6 : Challenge 7: They removed the header of the python bytecode . Leveraging this access , an attacker can send remote commands to affect the actuation of power line switches and circuit breakers to cause power disruption .


Additional Downeks downloaders connecting to the previously-observed server dw.downloadtesting.com were also found in this attack :


During our investigation of the campaign , we identified a number of global targets across several industries who were attacked in 2015 .


They were also seen enumerating administrative groups to attempt further exploitation .


APT28 isn’t the only group targeting travelers .


The Blackfly attacks share some similarities with the more recent Suckfly attacks .


Within this time period , we identified close to 300 samples belonging to this family ( all sample hashes are listed in the Appendix ) . NEODYMIUM used a backdoor detected by Windows Defender as Wingbird , whose characteristics closely match FinFisher , a government-grade commercial surveillance package . Brief Description : Dot ﬁle enabling the infection of the Gamaredon Pteranodon . Ashley Madison ’s parent company — Toronto - based Avid Life Media — filed a trademark infringement complaint in 2010 that succeeded in revealing a man named Dennis Bradshaw as the owner .


It is basically SMS spam : many people still follow suspicious links , install software from third-party sources , and give permissions to apps without a second thought . In 2015 , the SecureWorks documented the BRONZE UNION threat group ( formerly labeled TG-3390 ) , which CTU analysis suggests is based in the People's Republic of China ( PRC ) . Users are advised to close unused ports , to secure ports and other internet-facing devices that are regularly open for system administrators ’ support . These frameworks are commonly delivered as part of traditional commodity malware , so infection chains can vary widely .


] today During our investigation , we identified at least four major releases of the RAT . This migration activity was last observed in October 2016 . While their identities remain unknown , the attackers behind the IXESHE campaign demonstrated that they were both determined and capable . Having such a gap with the most commonly used domain allowed with CSP is a major risk indicator of the threats that can come from other domains that are used to serve multiple accounts .


TG-3390 : ctcb.blackcmd.com .


The attack began with a web shell running on a vulnerable , publicly-facing server , from which the attackers gathered information about the network and propagated across the network . Given our increased confidence that Bahamut was responsible for targeting of Qatari labor rights advocates and its focus on the foreign policy institutions other Gulf states , Bahamut 's interests are seemingly too expansive to be limited one sponsor or customer .


Investigation of this testing activity reveals multiple independent ties to Russia , CNIIHM , and a specific person in Moscow .


The primary difference between the CVE-2014-0515 metasploit module and this exploit is , obviously , the vulnerability .


Changes to Egypt ’s internal political climate are known to have affected Egyptian government relations with Hamas over the years .


While we know that the attackers used the Nidiran back door to steal information about the compromised organization , we do not know if Suckfly was successful in stealing other information .


In all cases , the ads are used to convince users to install other apps from different developer accounts , but written by the same group . Recently , Falcon Intelligence observed new activity from MUSTANG PANDA , using a unique infection chain to target likely Mongolia-based victims . This is based on the use of the known APT16 domain rinpocheinfo.com , as well as overlaps in previously observed targeting and tactics , techniques and procedures ( TTPs ) . These are also highly targeted emails with ( relatively speaking ) convincing lures , so whoever is behind these is not to be ignored .


Recently , the ThreatLabZ research team came across a fake Netflix app , which turned out to be a new variant of SpyNote RAT ( Remote Access Trojan ) . In the last successful attack described in Silence: Moving into the darkside , dated April 2018 , the hackers siphoned off about $150 , 000 through ATMs in a single night . Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems .


This ZeroT executable communicated with the C&C domain www.kz-info.net and downloaded PlugX as well as an additional PCRat S-VULNAME/Gh0st Trojan which communicated with the www.ruvim.net C&C server .


The threat actors have used the Baidu search engine , which is only available in Chinese , to conduct reconnaissance activities .


While not directly overlapping , this potential infrastructure link is interesting , as Vixen Panda has previously displayed TTPs similar to COMMENT PANDA , and has extensively targeted European entities . The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine .


Skygofree : Following in the footsteps of HackingTeam 16 JAN 2018 At the beginning of October 2017 , we discovered new Android spyware with several features previously unseen in the wild . In the past , countries such as Saudi Arabia , the UAE and Turkey have been a MuddyWater's main target , but the campaigns have also reached a much wider audience , making their way to victims in countries such as Belarus and Ukraine . They appear to focus on targeting individuals of interest to Iran who work in academic research , human rights , and media , with most victims having been located in Iran , the US , Israel , and the UK .


Recently , we have come across another variant of this app portraying itself as TikTok Pro , but this is a full-fledged spyware with premium features to spy on victim with ease . EvilGnome's functionalities include desktop screenshots , file stealing , allowing capturing audio recording from the user’s microphone and the ability to download and execute further modules . Strings within this sample associated with the malware ’s operations are encoded using a single-byte XOR encoding .


KeyBoy provides basic backdoor functionality , allowing the operators to select from various capabilities used to surveil and steal information from the victim machine . In other words , the attackers attracted our attention by attempting to exploit Kaspersky Lab products .


CVE-2018-0798 is an RCE vulnerability , a stack buffer overflow that can be exploited by a threat actor to perform stack corruption . FIF is notable for its links to the Lashkar-e-Taiba ( LeT ) terrorist organization , which has committed mass-casualty attacks in India in support of establishing Pakistani control over the disputed Jammu and Kashmir border region .


com.advantage.RaiffeisenBank pl.bzwbk.ibiznes24 pl.bzwbk.bzwbk24 pl.bzwbk.mobile.tab.bzwbk24 com.comarch.mobile.investment com.android.vending com.snapchat.android jp.naver.line.android com.viber.voip com.gettaxi.android com.whatsapp com.tencent.mm com.skype.raider com.ubercab com.paypal.android.p2pmobile The group primarily uses Truvasys , a first-stage malware that has been in circulation for several years . The new wave dates back to the end of November 2019 and was ﬁrst analyzed by Vitali Kremez . The contents found in secure[.]66[.]to often lead to zhu[.]vn , which is Hack520 ’s domain for hosting his own private blog .


This isn’t a bad thing as it shows a natural grouping of nodes that could be a good candidate to group to help simplify the overall graph and make analysis easier . The download name was " Zawgyi_Keyboard_L.zip " , and it dropped a " setup.exe " that contained several backdoor components , including an Elise " wincex.dll " ( a42c966e26f3577534d03248551232f3 , detected as Backdoor.Win32.Agent.delp ) .


It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations . RCS Galileo platform .


In 2013 , there was evidence of cooperation ( most probably on a commercial basis ) between different groups of virus writers . It's possible TG-3390 used a waterhole to infect data center employees . This article focuses on the technical details of this new ShadowPad variant . Protecting your information and systems from every vantage point , including your networks , devices , applications , transmissions , privileges , and storage is critical , as is regularly training your staff on the latest cyber threats , trends , and ransomware phishing attacks .


The command and control domains were different , and these samples used unique decoy documents to target their victims .


Firmware is low-level code deep in an operating system that often has high access privileges , so it 's critical that it 's verified and contains no software vulnerabilities . APT10's unprecedented campaign against MSPs , alleged to have included some of the largest MSPs in the world , in order to conduct secondary attacks against their clients , grants the Chinese state the ability to potentially access the networks of hundreds (if not thousands) of corporations around the world . Minzen : 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 .


Filename : attachedTemplate.dotm MD5 : 018611b879b2bbd886e86b62484494da Filename : templates.dotm MD5 : 2a794b55b839b3237482098957877326 .


In comparison , XENOTIME was defined based on principles of infrastructure ( compromised third-party infrastructure and various networks associated with several Russian research institutions ) , capabilities ( publicly- and commercially-available tools with varying levels of customization ) and targeting ( an issue not meant for discussion in this blog ) .


After gaining access to a target network in one intrusion analyzed by CTU researchers , TG-3390 actors identified and exfiltrated data for specific projects run by the target organization , indicating that they successfully obtained the information they sought .


The PDF lists dates of birth , gender , passport numbers , and names . We will detail how the C&C infrastructure and tools used by hacker group Hidden Lynx during its VOHO campaign ( 2012 ) , excellently documented by Symantec researchers last September , overlap with tools used in other high profile operations during the past few years . The sheer number of APT1 IP addresses concentrated in these Shanghai ranges , coupled with Simplified Chinese keyboard layout settings on APT1 ’s attack systems , betrays the true location and language of the operators . Ransomware - as - a - service is a relatively new version of these commodity groups , such as DarkSide , known for the cyber attack in 2021 that disrupted the Colonial oil pipeline and made gas more expensive for thousands of U.S. consumers .


for Android with Extensive Surveillance Capabilities August 20 , 2018 No operating system is safe from malware , as cyber criminals will always want to steal , spy or tamper with your data . SectorJ04 group conducted hacking activities targeting financial institutions located in India and Hong Kong around April 2019 . If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation .


NEW CYBER ESPIONAGE CAMPAIGNS TARGETING PALESTINIANS Over the last several months , the Cybereason Nocturnus team has been tracking recent espionage campaigns targeting the Middle East .


In particular , TG-3390 has exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code . Initial attack targets are commonly software and gaming organizations in United States , Japan , South Korea , and China .


The developer name used , GAS Brazil , suggests the criminals behind the app targeted Brazilian users . In May 2018 , campaigns being conducted by SWEED began leveraging another vulnerability in Microsoft Office: CVE-2017-11882 , a remote code execution bug in Microsoft Office that is commonly observed being leveraged in malicious documents used in commodity malware distribution . The naming scheme used by Novetta for the malware identified during Operation Blockbuster consists of at least two identifiers which each identifier coming from the International Civil Aviation Organization ( ICAO ) 's phonetic alphabet ,2 commonly referred to as the NATO phonetic alphabet .


These malware samples leverage the user agent string “ OPAERA ” , the same one identified in the Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA blog .


TrickMo Calls pushTAN The pushTAN method is a hurdle for malware apps that may reside on the same device , and it ’ s particularly challenging for mobile malware due to Android ’ s application sandbox . Russian cyber espionage actors use zero-day exploits in addition to less complex measures . When we first discovered the OilRig attack campaign in May 2016 , we believed at the time it was a unique attack campaign likely operated by a known , existing threat group .


As an example , in the two images below , we can see the encrypted and decrypted shared preferences file , which is encrypted using the java “ PBEWithMD5AndDES ” algorithm . The toolset includes reams of documentation explaining how the cyber weapons work , as well as details about their use in highly classified intelligence operations abroad . These incidents involved spear-phishing attacks , which characteristic of HELIX KITTEN , included emails containing malicious PowerShell in their macros that connects to known C2 infrastructure .


Kaspersky Lab reported the Trojan to Google , and it has now been removed from the store . With this level of access , the gang has been able to pull off a clever trick by automating the rollback of ATM transactions . In this example , the webpage that the attacker is monitoring is booking.com ( more specifically , the page containing the card details ) . They have named it Industroyer – the biggest threat to Industrial Control Systems ( ICS ) since Stuxnet .


Pivoting on specific file attributes and infrastructure indicators , Unit 42 was able to identify and correlate additional attacker activity and can now provide specific details on a targeted WINDSHIFT attack as it unfolded at a Middle Eastern government agency . The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 .


In this instance , the C2 communication implemented by the Micropsia backdoor also used specific names for different C2 commands .


Providing the app has registered an intent to process particular events from the system , and one of said events occurs , HenBox is effectively brought to life through external stimulus from another app on the system broadcasting a request , or the system itself broadcasting a particular event has occurred . This provides another connection between the targeting of the cryptocurrency organizations and video game targeting . In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations , and characterized APT28 's activity as aligning with the Russian government 's strategic intelligence requirements .


The coding style suggests that the cybercriminals behind this campaign are amateurs . Starting in February 2018 , Palo Alto Networks Unit 42 identified a not just goto . If passed , it would require U.S. financial institutions hit with ransomware to notify the Director of the Treasury Departments Financial Crimes Enforcement Network with details of the attack and the ransom demand .


It can also identify open ports , collect web banners , and download secondary files .


Security Without Borders has recently published an analysis of this family , independently , through their blog . To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer . This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia .


In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves . Many of the tools they use now feature new behaviors , including a change in the ACT they maintain a foothold in the targeted network .


Scarlet Mimic primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 . According to the German press , the intruders used the Winnti family of malware as their main implant , giving them persistent access to the conglomerate 's network as early as February 2016 .


By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device . In addition to the aforementioned post-exploitation tools , the actors used these webshells to upload legitimate executables that they would use DLL sideloading to run a malicious DLL that has code overlaps with known Emissary Panda attacks .


The primary source of data used in this analysis is Palo Alto Networks WildFire , which analyzes malware used in attacks across the world . COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites .


However , the actual timeline of the creation of different variants is unclear . After successfully infecting one of the computers and gaining initial access to the system , the attackers perform reconnaissance of the local network in order to gain domain administrator privileges and eventually consolidate control over the network . IRONHALO : AcroRd32Info.exe.exe a8ccb2fc5fec1b89f778d93096f8dd65 . This activity is followed quickly by additional access and persistent mechanisms .


Port 6205 : Gmail extraction service . activity originated from three separate IP addresses , all located in Chengdu , China . With regards to decoy content themes , this campaign resembles previous campaigns reported in blogs by Vectra , Unit 42 , and Talos . Education accounts for a huge proportion of known Vice Society attacks .


KASPERAGENT is Microsoft Windows malware used in efforts targeting users in the United States , Israel , Palestinian Territories , and Egypt since July 2015 .


APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel files to deliver their initial exploits . Despite the initial perception that the maldoc sample was intended for ICS or OT staff , LYCEUM has not demonstrated an interest in those environments .


FireEye has detected more than 20 cyber threat groups suspected to be sponsored by at least four other nation-states attempting to gain access to targets in the energy sector that could have been used to cause disruptions . The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People 's Republics .


Another attack group , Earworm ( aka Zebrocy ) , has been active since at least May 2016 and is involved in what appears to be intelligence gathering operations against military targets in Europe , Central Asia , and Eastern Asia .


] 133 ” as a main C2 address , and there is only one domain that is hosted on this dedicated server – iliageram [ . It's coincident that both 'darkhydrus' APT group name and ‘Williams’ user name in PDB path found in this Twitter user . ScarCruft tools : 032ed0cd234f73865d55103bf4ceaa22 Downloader .


Lookout customers are protected against this threat and additionally we have included a list of IOCs at the end of this report . cyberattacks against high-value targets in Ukraine in December 2015 and December 2016 . The content of the ZIP attachment it displayed in its UI was not the one it extracted! This sample challenges gateways . Surprisingly enough , it does not take very long to get some information about Hack520 : someone with this handle runs a blog and a Twitter account ( with a handle close to Hack520 ) that is also directly linked to the blog .


Emotet is a type of general-purpose malware that evolved from a well-known banking Trojan , " Cridex " , which was first discovered in 2014 . Some hackers even went onto use the Cisco exploits in the wild .


Mandiant 's APT1 report was the first to change the game , and paved the way for private security companies to expose advanced threat actors en masse . In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e. , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 .


In 2013 , the group deployed a watering hole attack , also known as a strategic web compromise to infect victims with their backdoor . Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers .


Upon decryption , we can see that the response from the server is a JSON object of EventBot ’ s configuration , which contains C2 URLs and a targeted applications list . The most recent sample of Bemstour seen by Symantec appears to have been compiled on March 23 , 2019 , eleven days after the zero-day vulnerability was patched by Microsoft . Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES .


Use of a shared hosting service to distribute malware is highly flexible and low cost for the threat actors . Recently we were able to observe these actors making modifications to their Clayslide delivery documents in an attempt to evade antivirus detection . Ssdeep : 24576:vmoO8itbaZiW+qJnmCcpv5lKbbJAiUqKXM : OoZwxVvfoaPu . The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


For instance , the earliest known CozyDuke version utilized a feature of the Microsoft Visual C++ compiler known as run-time error checking .


More technically inclined people can detect infections by seeing if a device connects to a control server located at app.blinkingcamera.com . The most common communication mode for a RAT is to act as a client to a remote server . NetWeird ( Trojan.Netweird.B ) : A commodity Trojan which can open a backdoor and steal information from the compromised computer . PIEHOP utilizes LIGHTWORK to execute the IEC-104 commands " ON ” or " OFF " on the remote system and immediately deletes the executable after issuing the commands .


CosmicDuke ’s information stealing functionality includes : Keylogging , Taking screenshots , Stealing clipboard contents , Stealing user files with file extensions that match a predefined list , Exporting the users cryptographic certificates including private keys , Collecting user credentials , including passwords , for a variety of popular chat and email programs as well as from web browsers CosmicDuke may use HTTP , HTTPS , FTP or WebDav to exfiltrate the collected data to a hardcoded C&C server .


The source process changes the registers in the target process so that PC register points directly to the shellcode . Potao is another example of targeted espionage malware , a so-called APT , to use the popular buzzword , although technically the malware is not particularly advanced or sophisticated . APT17 : 69.80.72.165 . It also sends collected browser data to another script by sending a POST request to “ hxxp://[c2_hostname]/groups / count / write.php ” .


The actor sends an email to the secondary email account with the unique system identifier as a subject with a secondary payload attached with a filename of txt .


As wonderfully described in a recent public posting , FireEye adheres to a naming convention based upon extensive data collection and activity comparison , designed to yield the identification of a discrete , identifiable entity responsible for a given collection of activity .


In particular , we will focus on the samples SHA-1 AA0FA4584768CE9E16D67D8C529233E99FF1BBF0 and 48BC113EC8BA20B8B80CD5D4DA92051A19D1032B . CapabilitiesFormBook is a data stealer , but not a full-fledged banker .


Lateral movement to other machines on the network .


Secondly , it underlines their boldness , arrogance and self-confidence ; they are clearly confident in both their ability to compromise their targets even when their tools and techniques are already publicly known , and critically , they appear to be extremely confident in their ability to act with impunity . 2015 : Continuing surgical strikes with CosmicDuke .


While doing our investigation we were able to identify other malware packages with different names . This section details changes made to APT10 tools , techniques and procedures ( TTPs ) post-2014 , following its shift from Poison Ivy to PlugX . In January 2019 , we discovered a sophisticated supply chain attack involving the ASUS Live Update Utility . The backdoor ’s primary functionality involves retrieving and executing additional modules .


But , thanks to the attackers known affection for decoy documents that pose as news summaries , we were able to date the campaign back to March 2018 . BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control ( C2 ) and operational infrastructure .


Fileless execution and persistence – In targeted campaigns , threat actors often attempt to avoid writing an executable to the disk to avoid detection and forensic examination .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . At first look , it pretends to be a Java related application but after a quick analysis , it was obvious this was something more than just a simple Java file .


The macro then uses the command certutil -decode to decode the contents of this text file and outputs the decoded content to a randomly named file with a .exe extension in the C:\Programdata folder .


We don’t know for sure who is responsible for this campaign , but digging into the passive DNS results led us to some breadcrumbs .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills . The second , aptly titled " kontrakt87.doc " , copies a generic telecommunications service contract from MegaFon , a large Russian mobile phone operator .


Some of the indicators in the following post were published on AlienVault OTX on 6/13 .


Allows an application to write SMS messages . The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell's 1984 , but Weeping Angel , developed by the CIA's Embedded Devices Branch (EDB) , which infests smart TVs , transforming them into covert microphones , is surely its most emblematic realization . FIN7 : Carbanak Group .


The ‘ ejtmjealr.com ’ domain is particularly interesting due to a similar domain , ‘ ejdqzkd.com ’ being discussed by Jarosław Jedynak of CERT.PL in this analysis of Nymaim from earlier in the year .


Once ZeroT is running , we observed that the fake User-Agent used in the requests changed from “ Mozilla/6.0 ( compatible ; MSIE 10.0 ; Windows NT 6.2 ; Tzcdrnt/6.0 ) ” to “ Mozilla/6.0 ( compatible ; MSIE 11.0 ; Windows NT 6.2 ) ” , thus removing the “ Tzcdrnt ” typo observed in previous versions .


North Korea linked hackers are among the most prolific nation-state threats , targeting not only the U.S. and South Korea but the global financial system and nations worldwide . On Nov. 27 , 2018 , Cisco 's Talos research division published a write-up outlining the contours of a sophisticated cyber espionage campaign it dubbed DNSpionage .


The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets . Using XREFs during static analysis is a common technique to quickly find where functions of interest are called .


Take advantage of native mitigations built into Windows 10 . The next sample was another Spindest variant and had the same timestamp as the aforementioned PcClient sample .


( We named the spyware " Exodus '' after this Command & Control domain name . In December 2017 , FireEye publicly released our first analysis on the TRITON attack where malicious actors used the TRITON custom attack framework to manipulate industrial safety systems at a critical infrastructure facility and inadvertently caused a process shutdown . Executes arbitrary commands via the CMD shell . Rather than limiting security to searching for a series of stringent profiles , security teams can attempt to analyze threat indicators in real time .


However , it is unusual for the group to use this technique to deliver one of its malware components directly .


The Patchwork attack group has been targeting more than just government-associated organizations . The activity dates to at least 2013 and has ties to multiple reports by other researchers .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Shrouded Crossbow employs three BIFROST-derived backdoors : BIFROSE , KIVARS , and XBOW .


Here are just some of them : ngglobal – FirebaseCloudMessaging topic name Issuer : CN = negg – from several certificates negg.ddns [ . Operation Pawn Storm is an active economic and political cyber-espionage operation that targets a wide range of entities , like the military , governments , defense industries , and the media . In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


HammerDuke is a simple backdoor that is apparently designed for similar use cases as SeaDuke .


As researchers continued discovering new toolsets that were created and used by the same group that had been operating MiniDuke , the new toolsets were also given “ Duke ” -derived names , and thus the threat actor operating the toolsets started to be commonly referred to as “ the Dukes ” .


To be sure though , I needed to find other samples and see how they stacked up against this one .


We decided to take a peek under the hood of a modern member of the Asacub family . Much like the observers watching the shadows of objects cast upon the wall of the cave , these two definitions ( XENOTIME and TEMP.Veles , both presumably referring to " the TRITON actor " ) describe the same phenomena , yet at the same time appear different . Outlaw Updates Kit to Kill Older Miner Versions , Targets More Systems . PIEHOP utilizes LIGHTWORK to execute the IEC-104 commands " ON ” or " OFF " on the remote system and immediately deletes the executable after issuing the commands .


According to RiskIQ ’ s PassiveTotal , the domain expired 7 months ago . The Leafminer 's post-compromise toolkit suggests that Leafminer is looking for email data , files , and database servers on compromised target systems . TA549 possesses a diverse malware arsenal including PlugX , NetTraveler , and ZeroT .


These incidents show a novel infection vector being used by APT28 .


If Arabic keyboard and language settings are not found on the machine , the backdoor will not carry out its malicious activity .


The Spark payload is a custom backdoor likely developed by the MoleRATs group .


Since Android version 7 ( Nougat ) this information is gathered using other means , perhaps inferring the devices used by potential victim run older versions of Android . In a highly unusual case , APT41 attempted to extort a game company by deploying the Encryptor RaaS ransomware . We have reasons to believe that the operators of the APT28 network are either Russian citizens or citizens of a neighboring country that speak Russian .


The Shadow Brokers have long claimed that the tools they release are from the " Equation Group " , the name of a government hacking group outed by Kaspersky Lab in 2015 , which is widely believed to be the NSA . The actors behind LUCKY ELEPHANT recognize the effectiveness and use doppelganger webpages nearly identical to legitimate sites , enticing users to input their credentials . The heavier targeting in Pakistan adheres to historical targeting and the ongoing tension between the two countries , which has escalated since a terrorist attack in Kashmir on 14 February 2019 . The targeting of Pakistan , Bangladesh , Sri Lanka , Maldives , Myanmar , Nepal , and the Shanghai Cooperation Organization are all historical espionage targets by India . However , it is clear is that Donot are actively establishing infrastructure and are targeting governments in South Asia . First attack of this campaign took place in May 2018 . Arbor also published APT research on this group , and named it ‘Donot’ . Donot attacked government agencies , aiming for classified intelligence . We identified this APT group coded as ‘APT-C-35’ in 2017 , who is mainly targeting Pakistan and other South Asian countries for Cyber Espionage . At least 4 attack campaigns against Pakistan have been observed by us since 2017 . Spear phishing emails with vulnerable Office documents or malicious macros are sent to victims . In the latest attack , Donot group is targeting Pakistani businessman working in China . Two unique malware frameworks , EHDevel and yty , are developed by attackers . wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 . Furthermore , it has similar code logic as previous ones wuaupdt.exe in this attack appears in previous Donot attack , and C2 addresses are same to previous ones . From the attack activity captured this time , it is obvious that Donot APT group is still keen on Pakistan as primary target of attack , and even expands scope of attack to include Pakistani staffs and institutions in China . Buhtrap still make extensive use of NSIS installers as droppers and these are mainly delivered through malicious documents . They first came to light in 2016 , when they managed to steal sensitive information from the US Democratic National Committee (DNC) . Earworm first came to light in 2016 , when they managed to steal sensitive information from the US Democratic National Committee (DNC) . They were also behind an attack on the World Anti-Doping Agency (WADA) , in which they leaked confidential information about several drug tests . SPLM , GAMEFISH , and Zebrocy delivery all maintain their own clusters , but frequently overlap later . Our previous post on Sofacy's 2017 activity stepped aACT from the previously covered headline buzz presenting their association with previously known political hacks and interest in Europe and the US , and examines their under-reported ongoing activity in middle east , central asia , and now a shift in targeting further east , including China , along with an overlap surprise . The larger , 300kb+ SPLM backdoors deployed in 2016 and 2017 are not observed any longer at targets in 2018 . A previous , removed , report from another vendor claimed non-specific information about the groups' interest in Chinese universities , but that report has been removed – most likely detections were related to students’ and researchers’ scanning known collected samples and any incidents” remain unconfirmed and unknown . Either ACT , the group's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion . The actors behind this campaign we call LUCKY ELEPHANT use doppelganger webpages to mimic legitimate entities such as foreign governments , telecommunications , and military . Currently , Sofacy targets large air-defense related commercial organizations in China with SPLM , and moves Zebrocy focus across Armenia , Turkey , Kazahkstan , Tajikistan , Afghanistan , Mongolia , China , and Japan . Either ACT , Sofacy's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion . According to this new alert , Hidden Cobra the U.S. government’s code name for Lazarus has been conducting FASTCash attacks stealing money from Automated Teller Machines (ATMs) from banks in Asia and Africa since at least 2016 . Lazarus is a very active attack group involved in both cyber crime and espionage . The group was initially known for its espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures . Following US-CERTs report , Symantec's research uncovered the key component used in Lazarus's recent wave of financial attacks . More recently , Lazarus has also become involved in financially motivated attacks , including an US$81 million dollar theft from the Bangladesh Central Bank and the WannaCry ransomware . Other open source and semi-legitimate pen-testing tools like nbtscan and powercat are being used for mapping available resources and lateral movement as well . To make the fraudulent withdrawals , Lazarus first breaches targeted banks' networks and compromises the switch application servers handling ATM transactions . The operation , known as FASTCash” has enabled Lazarus to fraudulently empty ATMs of cash . In order to permit their fraudulent withdrawals from ATMs , Lazarus inject a malicious Advanced Interactive eXecutive (AIX) executable into a running , legitimate process on the switch application server of a financial transaction network , in this case a network handling ATM transactions . It was previously believed that the attackers used scripts to manipulate legitimate software on the server into enabling the fraudulent activity . In recent years , Lazarus has also become involved in financially motivated attacks . This malware in turn intercepts fraudulent Lazarus cash withdrawal requests and sends fake approval responses , allowing the attackers to steal cash from ATMs . Lazarus was linked to the $81 million theft from the Bangladesh central bank in 2016 , along with a number of other bank heists . Lazarus was also linked to the WannaCry ransomware outbreak in May 2017 . WannaCry incorporated the leaked EternalBlue exploit that used two known vulnerabilities in Windows CVE-2017-0144 and CVE-2017-0145 to turn the ransomware into a worm , capable of spreading itself to any unpatched computers on the victim's network and also to other vulnerable computers connected to the internet . Lazarus was initially known for its involvement in espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures that saw large amounts of information being stolen and computers wiped by malware . In short , Lazarus continues to pose a serious threat to the financial sector and organizations should take all necessary steps to ensure that their payment systems are fully up to date and secured . As with the 2016 series of virtual bank heists , including the Bangladesh Bank heist , FASTCash illustrates that Lazarus possesses an in-depth knowledge of banking systems and transaction processing protocols and has the expertise to leverage that knowledge in order to steal large sums from vulnerable banks . The attack , which starts with a malicious attachment disguised as a top secret US document , weaponizes TeamViewer , the popular remote access and desktop sharing software , to gain full control of the infected computer . As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC . It is hard to tell if there are geopolitical motives behind this campaign by looking solely at the list of countries it was targeting , since it was not after a specific region and the victims came from different places in the world . The initial infection vector used by the threat actor also changed over time , during 2018 we have seen multiple uses of self-extracting archives instead of malicious documents with AutoHotKey , which displayed a decoy image to the user . The recent wave of FASTCash attacks demonstrates that financially motivated attacks are not simply a passing interest for the Lazarus group and can now be considered one of its core activities . Although both examples of the different delivery methods described above show an exclusive targeting of Russian speakers , the recurring financial and political themes that they use highlight the attacker's interest in the financial world once more . Throughout our investigation , we have found evidence that shows operational similarities between this implant and Gamaredon Group . Gamaredon Group is an alleged Russian threat group . Gamaredon Group has been active since at least 2013 , and has targeted individuals likely involved with the Ukrainian government . EvilGnome's functionalities include desktop screenshots , file stealing , allowing capturing audio recording from the user’s microphone and the ability to download and execute further modules . Gamaredon Group primarily makes use of Russian hosting providers in order to distribute its malware . Gamaredon Group's implants are characterized by the employment of information stealing tools — among them being screenshot and document stealers delivered via a SFX , and made to achieve persistence through a scheduled task . Gamaredon Group infects victims using malicious attachments , delivered via spear phishing techniques . The techniques and modules employed by EvilGnome — that is the use of SFX , persistence with task scheduler and the deployment of information stealing tools—remind us of Gamaredon Group’s Windows tools . We can observe that the sample is very recent , created on Thursday , July 4 . As can be observed in the illustration above , the makeself script is instructed to run ./setup.sh after unpacking . The ShooterAudio module uses PulseAudio to capture audio from the user's microphone . makeself.sh is a small shell script that generates a self-extractable compressed tar archive from a directory . During our 2018 monitoring of this group , we were able to identify different techniques utilized by very similar attackers in the MENA region , sometimes on the same target . Gaza Cybergang Group3 (highest sophistication) whose activities previously went by the name Operation Parliament . Gaza Cybergang has been seen employing phishing , with several chained stages to evade detection and extend command and control server lifetimes . The most popular targets of SneakyPastes are embassies , government entities , education , media outlets , journalists , activists , political parties or personnel , healthcare and banking . Through our continuous monitoring of threats during 2018 , we observed a new wave of attacks by Gaza Cybergang Group1 targeting embassies and political personnel . Gaza Cybergang Group1 is an attack group with limited infrastructure and an open-source type of toolset , which conducts widespread attacks , but is nevertheless focused on Palestinian political problems . In this campaign , Gaza Cybergang used disposable emails and domains as the phishing platform to target the victims . The RAT , however , had a multitude of functionalities (as listed in the table below) such as to download and execute , compress , encrypt , upload , search directories , etc . We expect the damage caused by these groups to intensify and the attacks to extend into other regions that are also linked to the complicated Palestinian situation . Cylance determined that the ‘Ghost Dragon’ group utilized specifically tailored variants of Gh0st RAT , which the group modified from the 3.6 version of the source code released in 2008 . The standard network protocol for Gh0st RAT 3.6 employs zlib compression , which utilizes ‘Gh0st’ as a static five-byte packet flag that must be included in the first five bytes of initial transmission from the victim . In a more recent version of the modified Gh0st RAT malware , Ghost Dragon implemented dynamic packet flags which change the first five bytes of the header in every login request with the controller . SPEAR has observed numerous different XOR keys utilized by Ghost Dragon . exploit and tools continued to be used after Buckeye's apparent disappearance in 2017 . The Buckeye attack group was using Equation Group tools to gain persistent access to target organizations at least a year prior to the Shadow Brokers leak . Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability . While Buckeye appeared to cease operations in mid-2017 , the Equation Group tools it used continued to be used in attacks until late 2018 . The 2017 leak of Equation Group tools by a mysterious group calling itself the Shadow Brokers was one of the most significant cyber security stories in recent years. However , Symantec has now found evidence that the Buckeye Cyber Espionage group (aka APT3 , Gothic Panda ) began using Equation Group tools in attacks at least a year prior to the Shadow Brokers leak . Equation is regarded as one of the most technically adept espionage groups and the release of a trove of its tools had a major impact , with many attackers rushing to deploy the malware and exploits disclosed . DoublePulsar was delivered to victims using a custom exploit tool (Trojan.Bemstour) that was specifically designed to install DoublePulsar . One vulnerability is a Windows zero-day vulnerability (CVE-2019-0703) discovered by Symantec . Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers .


Whitefly is a highly adept group with a large arsenal of tools at its disposal , capable of penetrating targeted organizations and maintaining a long-term presence on their networks . According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


Ensuring that applications and operating systems are patched with the latest updates greatly reduces the number of exploitable entry points available to an attacker .


The group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries . The functionalities are similar to the malicious app provided , which includes installing tor and proxy .


On August 23 , 2017 , DHS published a Malware Analysis Report ( MAR-10132963 ) that examines malware functionality to provide detailed code analysis and insight into specific tactics , techniques , and procedures ( TTPs ) observed in the malware .


Pony is a fairly common malware family that has existed in various forms since 2012 , with our first indications of Nigerian use occurring in August 2014 . The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center .


] commargaery [ . This documentation provides new insight into intrusion efforts conducted by at least four discrete Iranian threat actors , Rocket Kitten , Infy , Sima , and Operation Cleaver , including groups and tools that have not been previously disclosed . In the same way that people program named contacts into their cell phones and no longer need to remember phone numbers , DNS allows people to remember names like “ google.com ” instead of IP addresses . Tarrask is able to create " hidden " scheduled tasks by deleting the Security Descriptor ( SD ) registry value.[9 ] WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it 's attempts to elevate privileges through IFileOperation .


The Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information . If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail , TG-3390 identify other externally accessible servers and deploy ChinaChopper web shells .


To retrieve IP addresses that have ARP entries , Ryuk calls GetIpNetTable . ScarCruft has several ongoing operations , utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer .


For instance , in the case of the “ Execute ” opcode ( 0x17 ) , the 32-bit code to run is stored entirely into the variable section with the value at offset 5 specifying the number of bytes to be copied and executed . Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called " Rocket Kitten " ( AKA Operation Saffron Rose , Ajax Security Team , Operation Woolen-Goldfish ) as well as an older attack campaign called Newscasters . Winnti : a260dcf193e747cee49ae83568eea6c04bf93cb3 https://bugcheck.xigncodeservice.com/Common/Lib/Common_Include.php . DDoS and MiTM Attacks Any anomalous increase in traffic or redirect through unrecognized external servers can be an indication of a cyberattack that s about to happen .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . In 2017 , the same entities that were affected by the Okrum malware and by the 2015 Ketrican backdoors again became targets of the malicious actors .


Tropic Trooper is also still exploiting CVE-2012-0158 , as are many threat actors . The Winnti umbrella and linked groups' initial targets are gaming studios and high tech businesses .


] com are or were intended for malicious use . According to our telemetry , the campaign spreading these tools has been live since 2016 , with the most recent detections as late as in July 2019 . Cybereason also attributes the recently reported Backdoor.Win32.Denis to the OceanLotus Group , which at the time of this report 's writing , had not been officially linked to this threat actor .


First ( start ) module The first module , which was installed on the targeted device , could be controlled over the IRC protocol and enable deployment of other components by downloading a payload from the FTP server : @ install command As can be seen from the screenshot above , a new component was copied in the system path , though that sort of operation is impossible without root privileges . Based on our analysis of public and private information from submissions , along with product telemetry , it appears Proxysvc was used alongside the 2017 Destover variant and has operated undetected since mid-2017 . Elfin is one of the most active groups currently operating in the Middle East , targeting a large number of organizations across a diverse range of sectors . The malware is designed to cause electric power disruption by interacting with IEC 60870 - 5 - 104 ( IEC-104 ) devices , such as remote terminal units ( RTUs ) , that are commonly leveraged in electric transmission and distribution operations in Europe , the Middle East , and Asia .


An example of the string which is sent to the command-and-control would be “ phone 26.03.2013 ” . Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 ( Microsoft Office Equation Editor , widely used by Chinese-speaking actors since December 2017 ) , we can′t prove they were related to this particular attack . NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used , prior to public knowledge of the vulnerability 's existence .


The function “ NvStart ” is similar to the main function of the older module ; it creates a window and enters the message loop waiting for device arrival notifications .


The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine . This malware , which specifically targets Swiss banking users , uses a phishing campaign to drop its payload , which eventually results in the hijacking of a user ’s network traffic using a Man-in-the-Middle ( MitM ) attack .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries . We will detail how the C&C infrastructure and tools used by hacker group Hidden Lynx during its VOHO campaign ( 2012 ) , excellently documented by Symantec researchers last September , overlap with tools used in other high profile operations during the past few years .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . While the machine is in isolation , SOC personnel can direct the infected machine to collect live investigation data , such as the DNS cache or security event logs , which they can use to verify alerts , assess the state of the intrusion , and support follow-up actions .


What is Chrysaor ? Targeted regions included in the list of Leafminer are Saudi Arabia , United Arab Emirates , Qatar , Kuwait , Bahrain , Egypt , Israel , and Afghanistan . APT33 : 192.119.15.39 remote-server.ddns.net . Instead , it appeared that corresponding requests were made directly through the Outlook Web Application ( OWA ) endpoint , indicating a previously undisclosed exploit method for Exchange .


Due to the current absence of maintained and supported Android banking Malware-as-a-Service in the underground community , there is a certainly demand for a new service . The SectorJ04 group has carried out large-scale hacking activities targeting South Korea , while also expanding the field of attacks to Southeast Asian countries such as Taiwan and the Philippines . The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


Data collectors : dump all existing content on the device into a queue . This actor , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 . Winnti : a045939f 2018-07-11 15:45:57 https://bugcheck.xigncodeservice.com/Common/Lib/Common_bsod.php . The file ’s name consists of six randomly - generated alphanumeric characters .


It does so using the Services , Broadcast Receivers , and Activities components of the Android platform . From 16 October 2018 to 1 January 2019 , Silence sent out about 84 , 000 emails in Russia alone to update their address database . Flying Kitten ( which is another name given by the security industry to Charming Kitten ) was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of the IRI ( Islamic Republic of Iran ) government and foreign espionage targets .


Beginning in mid-January 2019 , TA542 distributed millions of Emotet-laden emails in both English and German . Active since 2012 , it has so far targeted Taiwanese government agencies and private organizations .


It ’ s even possible to send log messages via SMS to the attacker ’ s number . Malefactors used watering hole attacks to compromise legitimate and trusted websites frequently visited by their targets . APT33 : 87e2cf4aa266212aa8cf1b1c98ae905c7bac40a6fc21b8e821ffe88cf9234586 S-SHA2 LaZagne . We found roughly 500 domain names that lead or have led to the “ Pig network ” between 2015 to March 2017 .


Our visibility into the operations of APT28 - a group we believe the Russian Government sponsors - has given us insight into some of the government ’s targets , as well as its objectives and the activities designed to further them .


Infrastructure The infrastructure supporting this malware is rather complex . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign . If the module that loads the sample is named myapp.exe the module will exit Once loaded , it sleeps for six seconds . The adversary may drop or create malware , tools , or other non - native files on a target system to accomplish this , potentially leaving behind traces of malicious activities .


] ponethus [ . There is the exploit code and malware used to gain access to systems , the infrastructure that provides command and control to the malware operator , and the human elements – developers who create the malware , operators who deploy it , and analysts who extract value from the stolen information . Cybercriminals are constantly evolving and adapting in their attempts to bypass computer network defenses . The decoy installer ( Install%20Updater%20(V104.25.151)-stable.url ) is an Internet shortcut downloaded from another compromised WordPress site .


Such app stores are so-called because they are not officially supported by Android , nor are they provided by Google , unlike the Play Store . Turla is a complex cyberattack platform focused predominantly on diplomatic and government-related targets , particularly in the Middle East , Central and Far East Asia , Europe , North and South America and former Soviet bloc nations . APT1 has used and steadily modified BISCUIT since as early as 2007 and continues to use it presently .


Once the actor had successfully established access to the network , a simple network scan to look for other insecure devices allowed them to discover and move across the network in search of higher-privileged accounts that would grant access to higher-value data .


ZeroT remained the primary stage 1 payload , but the stage 2 payloads varied .


The only other publicly used name for the threat actor that we are aware of is “ APT29 ” .


While all of the earlier toolsets – GeminiDuke , PinchDuke , and CosmicDuke – were designed around a core infostealer component , MiniDuke is centered on a simplistic backdoor component whose purpose is to enable the remote execution of commands on the compromised system .


Cannon uses SMTPS and POP3S as its C2 channel compared to Zebrocy that uses a more commonly observed HTTP or HTTPS based C2 .


Samples uploaded to VirusTotal To encourage further research in the security community , we ’ ve uploaded these sample Chrysaor apps to Virus Total . FireEye is highlighting a cyber espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40 . Winnti : xigncodeservice.com 2018-07-10 09:18:17 https://namu.wiki/w/XIGNCODE . If the main function is called with only , it will take the path that is intended for connect to the MSSQL server and , upload • None are supplied to the main function , it will immediately fail due to attempting to utilize command line arguments that were not parsed yet .


Otherwise , it will launch an ACTION_APPLICATION_SETTINGS intent trying to trick the user to grant the permissions . Both the Trochilus and MoonWind RATs were hosted on the same compromised sites and used to target the same organization at the same time . The same “ Tran Duy Linh ” Microsoft Word Exploit Kit was used in delivery of this backdoor . Enterprise T1078 Valid Accounts APT29 has used a compromised account to access an organization 's VPN infrastructure .


Their software , once surreptitiously installed on a target 's cell phone or computer , can be used to monitor the target 's communications , such as phone calls , text messages , Skype calls , or emails . After publishing our initial series of blogposts back in 2016 , we have continued to track the ScarCruft threat actor .


If the text is retrieved successfully , the app uses JavaScript injection again to submit the HTML form with the captcha answer . The China-backed BARIUM APT is suspected to be at the helm of the project . The code then tries to kill each process and service that belongs to the following list of AV products : Symantec B-TOOL S-IDTY Firewall Norton ESET McAfee Avast Avira Sophos Malwarebytes . The name of the shortcut file , depending on the campaign , is either randomly generated by a random string generator function or hardcoded in the macro code .


The evidence above suggests that EventBot is still in the development stage , and as such , is not likely to have been used for large attack campaigns thus far . Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue . As described in previous publications , the Rocket Kitten attackers make extensive use of various phishing schemes .


The first part of the campaign From Jan. 23 , 2018 , to Feb. 26 , 2018 used a macro-based document that dropped a VBS file and an INI file . The samples we identified target the ATM vendor Diebold .


In addition , these out-of-the-box hosting services usually provide better infrastructure than the attackers could manage to construct ( or compromise ) themselves . Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system . Before reversing the executable , it is possible to clean it allowing the size reduction and the junk instruction reduction inside the code . Researchers have linked the group with low confidence to APT33 and APT34 .


Some of the documents exploited CVE-2017-0199 to deliver the payload . According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 .


Check Point reached out to the Google Security team immediately with information on this campaign . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank . Before continuing , Several issues in Foxit PDF reader could lead to arbitrary code execution Foxit PDF Reader is one of the most popular PDF readers on the market , offering many similar features to Adobe Acrobat .


This was probably done for debugging purposes , indicating the malware may be an early prototype version . The document attached to this e-mail exploits CVE-2012-0158 . In the past , BlackOasis messages were designed to appear like news articles from 2016 about political relations between Angola and China .


It is capable of a variety of functions , including credential theft , hard drive and data wiping , disabling security software , and remote desktop functionality . In addition to these , the Animal Farm attackers used at least one unknown , mysterious malware during an operation targeting computer users in Burkina Faso .


WICKED SPIDER has been observed targeting technology companies in Germany , Indonesia , the Russian Federation , South Korea , Sweden , Thailand , Turkey , the United States , and elsewhere . The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


The following is a review of scope and impact of the Chrysaor app named com.network.android tailored for a Samsung device target , with SHA256 digest : ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5Upon installation , the app uses known framaroot exploits to escalate privileges and break Android 's application sandbox . Between August 2 and 4 , the Leviathan sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors . A string identifying a campaign . Systems are compromised to enable them to then attack other systems .


Write a new file “ %LOCAL_APPDATA%\dllhost.exe ” or “ %TEMP%\dllhost.exe ” and execute it , then delete the file , Write a new file “ %LOCAL_APPDATA%\sechost.dll ” or “ %TEMP%\sechost.dll ” and call its first exported function using “ rundll32.exe ” or Windows API , then delete the file , Run shellcode provided by the server in a new thread While processing the commands , the backdoor logs all errors and execution results .


However , over the last nine campaigns since Trend Micro‘s June report , TA505 also started using .ISO image attachments as the point of entry , as well as a .NET downloader , a new style for macro delivery , a newer version of ServHelper , and a .DLL variant of FlawedAmmyy downloader . Lotus Blossom attempted to exploit CVE-2014-6332 using the POC code available in the wild .


The SWC of a Uyghur cultural website suggests intent to target the Uyghur ethnic group , a Muslim minority group primarily found in the Xinjiang region of China .


Backdoor.SH.SHELLBOT.AA : b68bd3a54622792200b931ee5eebf860acf8b24f4b338b5080193573a81c747d .


The Zebrocy tool associated with this current strain of attacks is constructed in several different forms based on the programming language the developer chose to create the tool .


However , the underlying code can be quite different in that various obfuscation mechanisms were adopted to evade detection by anti-virus tools . Iranian threat agent OilRig has been targeting multiple organisations in Israel and other countries in the Middle East since the end of 2015 . The ﬁrst check performed is on the arguments : if the arguments length is equal to zero , the malware terminates the execution . Cl0p 's precipitous rise to the top of the charts this month , on the other hand , can be explained by their exploitation of a zero - day in MOVEit Transfer , a widely used file transfer software .


All contain the same Visual Basic macro code and author name as Honeybee . Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware .


CNIIHM officially collaborates with other national technology and development organizations , including :


Either method to load HenBox ultimately results in an instance of a service being launched . In March 2017 , suspected Chinese espionage operators targeted CCleaner , a utility that assists in the removal of unwanted files from a computer . Their evolving and modified SPLM , CHOPSTICK , XAgent code is a long-standing part of Sofacy activity , however much of it is changing .


When the attacker restarts the Quasar application , our uploaded “ dnsapi.dll ” will instead be loaded .


EventBot is in constant development , as seen with the botnetID string above , which shows consecutive numbering across versions . It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns . Since early 2014 , an attacker group of Iranian origin has been actively targeting persons of interest by means of malware infection , supported by persistent spear phishing campaigns .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . Symantec during 2012 linked the Elderwood Project to Operation Aurora ; Trojan.Naid and Backdoor.Moudoor were also used in Aurora , by the Elderwood Gang , and by Hidden Lynx .


This newest variant has been labeled XLoader version 6.0 ( detected as AndroidOS_XLoader.HRXD ) , following the last version discussed in a previous research on the malware family . Researchers have pointed out that it is not uncommon for admin@338 to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement . Name SHA256 . " The server was used to distribute and infect victims with an upgraded version of Rising Sun with SSL capabilities , " informs a report shared with BleepingComputer .


Health_insurance_registration.doc : 1b5e33e5a244d2d67d7a09c4ccf16e56 . job_titles.doc : fa72c068361c05da65bf2117db76aaa8 . job_titles_itworx.doc : 43fad2d62bc23ffdc6d301571135222c . job_titles_mci.doc : ce25f1597836c28cf415394fb350ae93 .


The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . To compromise the utility , Kaspersky Lab determined that Barium used stolen digital certificates used by ASUS to sign legitimate binaries , and altered older versions of ASUS software to inject their own malicious code .


Look for information about the status of your device . The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Beyond the file system metadata for the Prefetch file ( creation and last modification times ) and the last execution time within the file metadata , CTU analysts did not observe any indicators of value on the source host . [ c2_hostname ] The purpose of the shellcode is to download a GIF image file from URL hxxp://[c2_hostname]/groups / pic.gif , then search for and decrypt the hidden PE file inside of it .


] 6 2020-03-26 http : //rxc.rxcoordinator [ . These campaign-related VPSs are located in South Africa . MenuPass spoofed several sender email addresses to send spear phishing emails , most notably public addresses associated with the Sasakawa Peace Foundation and The White House .


In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM ( aka Xagent , aka CHOPSTICK ) , JHUHUGIT ( which is built with code from the Carberp sources ) , AZZY ( aka ADVSTORESHELL , NETUI , EVILTOSS , and spans across 4-5 generations ) and a few others .


“ As part of our ongoing efforts to protect users from the Ghost Push family of malware , we ’ ve taken numerous steps to protect our users and improve the security of the Android ecosystem overall. ” We are very encouraged by the statement Google shared with us addressing the issue . Per the complaint , the email account watsonhenny@gmail.com was used to send LinkedIn invitations to employees of a bank later targeted by APT38 . the application will perform distinct layers of code analysis and optimization , Mandiant attributed these intrusions to UNC4899 , a Democratic People 's Republic of Korea ( DPRK)-nexus actor , with a history of targeting companies within the cryptocurrency vertical .


MuddyWater is a well-known threat actor group founded by Iran . “ that has been active since 2017 .


The archive also contained all the necessary codes to target Australian financial institutions . The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros . Derusbi is a backdoor B-MAL S-MAL Trojan E-MAL believed to be used among a small group of attackers , which includes the Rancor group . Open - source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org .


This campaign has most likely been created to allow the targeting of people linked to or interested by cybersecurity , so probably the people who are more sensitive to cybersecurity threats .


Adobe independently patched the vulnerability ( CVE-2015-3043 ) in APSB15-06 .


The code to load the main module dynamically can also be seen statically . Upon decrypting and executing , it drops two additional files wsc_proxy.exe (legitimate Avast executable) and a malicious DLL wsc.dll in the %TEMP% folder . APT35 has historically used unsophisticated tools like those listed below in Figure 3 .


It is also able to move code execution into different locations if needed . Regardless of causation , the rapid development of new versions of Emissary suggests that the malware authors are making frequent modifications to evade detection , which as a corollary suggests the Lotus Blossom are actively using the Emissary Trojan as a payload in attacks . Winnti : a045939f53c5ad2c0f7368b082aa7b0bd7b116da https://bugcheck.xigncodeservice.com/Common/Lib/Common_bsod.php . Since early 2023 , we have seen several new Yashma strains emerge , including ANXZ , Sirattacker , and Shadow Men Team .


More data is appearing daily , leading us to believe the actors are still highly active . The malware is distributed primarily through laced spam emails that lure recipients into opening attachments . WEBC2 backdoors are often packaged with spear phishing emails . Digital certificates stolen in some of the heists have been used to sign malware that targeted Tibetan and Uyghur activists .