Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability . Chances are about even , though , that Mofang is a relevant threat actor to any organization that invests in Myanmar or is otherwise politically involved .


With this in mind , we thoroughly look forward to working with you on these matters . Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14 , 2017 , FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East . Truvasys has been involved in several attack campaigns , where it has masqueraded as one of server common computer utilities , including WinUtils , TrueCrypt , WinRAR , or SanDisk .


When using email scams , SilverTerrier actors preferred to use large target audiences , which maximized the likelihood of success with very little risk . To show how this breach and similar breaches can be mitigated , we look at how Windows Defender ATP flags activities associated with BARIUM , LEAD , and other known activity groups and how it provides extensive threat intelligence about these groups .


In 2013 , 3,905,502 installation packages were used by cybercriminals to distribute mobile malware . There were traces of HyperBro in the infected data center from mid-November 2017 . Since 2013 , it has been demonstrated that Winnti is only one of the many malware families used by the Winnti Group . Once the initial export is called ( in this case , the legitimately named function IETrackingProtectionEnabled ) , the downloader will copy itself and call regsvr32.exe with parameters “ /u /s ” to automatically call the function for unregistering COM servers DllUnregisterServer .


Some of this information can be directly extracted from the Windows explorer by looking at the properties of the file .


Here is a full list of possible commands that can be executed by the first module : Command name Description @ stop Stop IRC @ quit System.exit ( 0 ) @ start Start IRC @ server Set IRC server ( default value is “ irc.freenode.net ” ) , port is always 6667 @ boss Set IRC command and control nickname ( default value is “ ISeency ” ) @ nick Set IRC client nickname @ screen Report every time when screen is on ( enable/disable ) @ root Use root features ( enable/disable ) @ timer Set The Lazarus used a similar infrastructure to earlier threats , including the Destover backdoor variant known as Escad . Symantec has the following protection in place to protect customers against these attacks , APT33 : Backdoor.Notestuk Trojan.Stonedrill Backdoor.Remvio Backdoor.Breut Trojan.Quasar Backdoor.Patpoopy Trojan.Nancrat Trojan.Netweird.B Exp.CVE-2018-20250 SecurityRisk.LaZagne Hacktool.Mimikatz SniffPass . Some cyber criminal groups use their hacking skills to go after large organizations .


Due to a lack of other PinchDuke samples from 2008 or earlier , we are unable to estimate when the Duke operation originally began .


CTU researchers have evidence that the threat group compromised U.S and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations . If the domain is in the target , the malware will perform a MitM attack and redirect the traffic to the second proxy ( port 5588 ) , which routes the traffic to the Tor network .


Operation Daybreak appears to have been launched by ScarCruft in March 2016 and employs a previously unknown ( 0-day ) Adobe Flash Player exploit . Anchor Panda uses website and web-server compromise as a means of attack and leverages an enormous cache of tools in its campaigns , to include exploits that take advantage of known CVE software vulnerabilities .


In addition , the Autoit code also creates the following scheduled task for persistence :


Uses SHA256 instead of MD5 to create the key .


In 2016 , an attack campaign by this group was recorded in early May that made use of an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player , which at the time was both unknown and unpatched . The attacks were initially discovered while investigating a phishing attack that targeted political figures in the MENA region .


This functionality can be easily further extended to steal other information , such as bank credentials , although we did not see any banks being targeted in this attack . Filensfer is a family of malware that has been used in targeted attacks since at least 2013 . Threat Group-1314 is an unattributed threat group that has used


Other versions included all the pieces needed for a valid disclosure message . Employing a technique known as " spear phishing " , Barium has heavily targeted individuals within HumanResources or Business Developmentdepartments ofthe targeted organizations in order to compromise the computers ofsuch individuals . This means that , as seen above , the ZxShell Dll is started in listening mode . The videos were quickly passed around offices while users ’ systems were silently infected in the background , and many of the APT ’s components were signed with phony Intel and AMD digital certificates .


Patchwork 's attack was detected as part of a spear phishing against a government organization in Europe in late May 2016 . We were not able to find additional tools , but the attackers again compromised a legitimate Thai website to host their malware , in this case the student portal for a Thai University .


This web hosting service provider continues to be the hosting provider of choice for the threat actors behind NetTraveler . It appears ScarCruft is primarily targeting intelligence for political and diplomatic purposes .


We observed these Quasar samples :


Figure 3: BACKSWING Version 2Version 1:FireEye observed the first version of BACKSWING in late 2016 on websites belonging to a Czech Republic hospitality organization in addition to a government website in Montenegro . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


Every 10 minutes , it sends a new request to the server .


In early 2013 we detected two identical applications on Google Play that were allegedly designed for cleaning the operating system of Android-based devices from unnecessary processes . Many of the tools they use now feature new behaviors , including a change in the way they maintain a foothold in the targeted network . The campaign ID is located at offset 0x99 and is the name of the targeted university . Open Babel allows users to “ search , convert , analyze , or store data from molecular modeling , chemistry , solid - state materials , biochemistry , or related areas , ” according to its website , and is used in other popular pieces of software in the science field .


In personally responding to several incidents across multiple industry sectors since early 2018 matching TTPs from the TRITON / TRISIS event , these items proved consistent and supported the creation of the XENOTIME activity group .


Encryption/Decryption key : version2013 .


The stolen information includes personal and device information . Turla is a well-documented , long operating APT group that is widely believed to be a Russian state-sponsored organization . According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


They then identify the Exchange server and attempt to install the OwaAuth web shell .


Restricting these privileges may prevent malware from running or limit its capability to spread through the network .


Their campaigns appear to have broken out into subsets of activity and malware involving GAMEFISH , Zebrocy , and SPLM , to name a few .


The names of the C2 servers are hardcoded .


Service Name Purpose AndroidAlarmManager Uploading last recorded .amr audio AndroidSystemService Audio recording AndroidSystemQueues Location tracking with movement detection ClearSystems GSM tracking ( CID , LAC , PSC ) ClipService Clipboard stealing AndroidFileManager Uploading all exfiltrated data AndroidPush XMPP С & C protocol ( url.plus:5223 ) RegistrationService Registration on C & C via HTTP ( url.plus/app/pro/ ) Interestingly , a self-protection feature was implemented in almost every service However , in the summer of 2016 , NewsBeef deployed a new toolset that includes macro-enabled Office documents , PowerSploit , and the Pupy backdoor . From 2017 through 2018 , the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan .


CTU researchers have observed TG-3390 activity between 04:00 and 09:00 UTC , which is 12:00 to 17:00 local time in China ( UTC +8 ) .


Dell SecureWorks researchers unveiled a report on Threat Group-3390 that has targeted companies around the world while stealing massive amounts of industrial data . Meanwhile , parallel work at Dragos ( my employer , where I have performed significant work on the activity described above ) uncovered similar conclusions concerning TTPs and behaviors , for both the 2017 event and subsequent activity in other industrial sectors .


The said exploits will root the device and install a shell backdoor . The group has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . As previously detailed , Leveraging legitimate tools , publicly available malware , and livingofftheland tactics , MuddyWater focused on targeting Exchange Servers as part of a larger effort to deploy web shells and establish a backdoor within target networks .


However , TA505 was also among the first actors to return to high-volume Dridex distribution this same month , even as they demonstrated their ability to diversify and deliver threats beyond Dridex .


On connecting a smartphone in the USB drive emulation mode to a computer running Windows XP , the system automatically starts the Trojan ( if AutoPlay on the external media is not disabled ) and is infected . Execute a command through exploits for CVE-2018-0802 . Interestingly , the timestamp present in this config at offset 0x84 is later than the modules ’ timestamps and the loader compilation timestamp . It crafts configurable IEC-104 Application Service Data Unit ( ASDU ) messages , to change the state of RTU Information Object Addresses ( IOAs ) to ON or OFF .


A possible indication for timing might be when the app reaches a specific number of downloads or infected devices . Starting in February 2018 , Palo Alto Networks identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States . the tail instruction of the dispatcher predecessor can be a conditional jump like jnz , The difference between ProxyNotShell and the newly discovered exploit method we are calling OWASSRF .


iOS development Analysis of these Android samples led to the discovery of infrastructure that contained several samples of an iOS port . Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal . The group has focused mainly on governmental targets in Iraq and Saudi Arabia , according to past telemetry .


They enable engineers and operators to safely control and possibly shutdown processes before a major incident occurs .


spear phishing : 69.87.223.26:8080/p .


dllhost.exe : The main host for the .dll file . iviewers.dll : Used to load encrypted payloads and then decrypt them . msfled : The encrypted payload .


] it Bologna server1bs.exodus.connexxa [ . There is often a singular focus from the security community on ICS malware largely due to its novel nature and the fact that there are very few examples found in the wild . Once the user logs on to the infected machine , the shortcut points to the file binary location in the C:\ProgramData\ folder . CrowdStrike Falcon will detect the OWASSRF exploit method described in this blog , and will block the method if the prevention setting for • None Monitor Exchange servers for signs of exploitation visible in IIS and Remote PowerShell logs using this script developed by CrowdStrike Services • None Consider application - level controls such as web application firewalls .


HIDDEN COBRA is known to use vulnerabilities affecting various applications .


Since 2006 , Hamas has controlled the Gaza strip and Fatah has controlled the West Bank .


Specifically , the strings 866-593-54352 ( notice it is one digit too long ) , 403-965-2341 , or the address 522 Clematis .


It use threading so many agent can connect and controlled at the same time . the agent must collect information about the system when it first start then report it to the C2 . there is template for agent which will be filled with ip and port when the C2 run . include functions but not all implemented in the initial POC :


In Russia , there were several relatively large cybercriminal groups engaged in financial theft via attacks on RBS . CTU researchers have observed TG-3390 activity between 04:00 and 09:00 UTC , which is 12:00 to 17:00 local time in China ( UTC +8 ) .


In particular , WERDLOD uses scripts running on http://127.0.0.1:5555/#{random_string}.js?ip=#{my_ip} as proxy :


The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation . Hackers gained access to a computer in the trading system in September 2014 .


This data theft module appears to have been compiled in May 2015 and is designed to watch removable drives and collect files from them , depending on a set of rules defined by the attackers .


] clubupload999 [ . We noted in our original blog the large amount of targeting of Iranian citizens in this campaign , we observed almost one-third of all victims to be Iranian . The programs acting as APT1 servers have mainly been : FTP , for transferring files ; web , primarily for WEBC2 ; RDP , for remote graphical control of a system ; HTRAN , for proxying ; and C2 servers associated with various backdoor families . DarkTortilla has used % HiddenReg%


Although created using a comprehensive vetting process , the possibility of false positives always remains .


This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams . APT5 targeted the network of an electronics firm that sells products for both industrial and military applications .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . Targets included a wide array of high-profile entities , including intelligence services , military , utility providers ( telecommunications and power ) , embassies , and government institutions .


* * * End translation * * * Referring again to bit.ly , we can see click statistics for this campaign ( Figure 6 ) . The attackers stole organizations' SSL certificates associated with security appliances such as ASA to obtain VPN credentials , allowing the actors to gain access to the targeted network . The group mainly targets banks and financial institutions and has targeted more than 16 organizations in at least 13 countries since at least 2014 . APT3 : Gothic Panda , Pirpi , UPS Team , Buckeye , Threat Group-0110 , TG-0110 .


For example , going back , going home , opening recents , etc . We observed several attacks in June and July 2013 against targets in the Middle East and the U.S. that dropped a PIVY payload that connected to command-and-control ( CnC ) infrastructure used by the Molerats attackers . In recent attacks , the group has persistently targeted at least one government organization in Cambodia B-LOC E-IDTY from December 2018 through January 2019 . These victims are not criminals or terrorists , but instead , they are associated with activism .


TG-3390 actors have also used the following publicly available tools :


This allows the source process to trace the target . The attackers have targeted a large number of organizations globally since early 2017 , with the main focus on the Middle East and North Africa ( MENA ) , especially Palestine . If the C2 server is discovered or shut down , the threat actors can update the encoded IP address on TechNet to maintain control of the victims ’ machines . The final stage backdoor connects to two servers , one in Panama and one in Turkey to receive the instructions from the attackers .


We believe the developers were scammed to use this malicious SDK , unaware of its content , leading to the fact that this campaign was not targeting a specific county or developed by the same developer . APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns . Similar to its other attacks , Suckfly used the Nidiran back door along with a number of hacktools to infect the victim 's internal hosts .


Check Point ’ s Analysis and Response Team ( ART ) disclosed the finding to Android ’ s Security team who took the appropriate security steps to remove the infected app and added the malware to Android ’ s built-in protection mechanisms . While the Sima moniker could similarly originate from software labels , it is a common female Persian name and a Persian-language word for " visage " or " appearance " . The links between CopyPaste and FIN7 are still very weak . Though Google meant to have this parameter be used to mention the page the user visited , we used it to exfiltrate the user name and password data encoded in base64 .


On top of all this , one of the malicious developer ’ s YouTube videos – a tutorial on developing an “ Instant Game ” for Facebook – serves as an example of operational security completely ignored . This blog covers the changes , improvements , and Indicators of Compromise (IOC) of Ploutus-D in order to help financial organizations identify and defend against this threat . On February 28 , the McAfee Advanced Threat Research team discovered that the cybercrime group HIDDEN COBRA continues to target cryptocurrency and financial organizations .


Assuming the C2 is still operational however , Word loads the remote template ( SHA256 : f1e2bceae81ccd54777f7862c616f22b581b47e0dda5cb02d0a722168ef194a5 ) and the user is presented with the screen .


Months Device Remained Infected India 15,230,123 2,017,873,249 2.6 1.7 2.1 Bangladesh 2,539,913 208,026,886 2.4 1.5 2.2 Pakistan 1,686,216 94,296,907 2.4 1.6 2 Indonesia 572,025 67,685,983 2 1.5 2.2 Nepal 469,274 44,961,341 2.4 1.6 2.4 US 302,852 19,327,093 1.7 1.4 1.8 Nigeria 287,167 21,278,498 2.4 1.3 2.3 Hungary 282,826 7,856,064 1.7 1.3 1.7 Saudi Arabia 245,698 18,616,259 2.3 During their previous campaign , we found Confucius using fake romance websites to entice victims into installing malicious Android applications . In addition , every few days more domains are generated to host more payloads . If the system is in a single - system domain , it will execute on the local computer .


Even as software vulnerabilities often take a back seat to human exploits and social engineering , robust defenses must include protection at the email gateway , proactive patch management , and thoughtful end user education .


After the actor behind RedAlert 2 decided to quit the rental business , we observed a surge in Anubis samples in the wild . This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted by Machete . APT38 's targeting of financial institutions is most likely an effort by the North Korean government to supplement their heavily-sanctioned economy .


The encryption algorithm used is RSA , and interestingly , the authors chose to use the private key for decryption and leave it in the code as a hardcoded string . APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making . We don't know the exact date Suckfly stole the certificates from the South Korean organizations .


This malware appears to be newly developed with code that differs significantly from previously known Android malware . This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics . iDefense analysts have identified a campaign likely to be targeting members of or those with affiliation or interest in the ASEAN Defence Minister 's Meeting ( ADMM ) .


The same websites have hosted different RuMMS samples at different dates . Just over a week later , on January 16 , 2018 , we observed an attack on a Middle Eastern financial institution . The template located on Google Drive contains a macro . On multiple systems , XPdb entries for the malware contained the parent process of the JumpCloud agent , further evidence that the threat actor leveraged JumpCloud to gain initial access to victim environments .


Cisco Talos discovered a new malicious campaign from the well known actor Group 74 ( aka Tsar Team , Sofacy , APT28 , Fancy Bear ) .


The exploit , which takes advantage of CVE-2018-4878 , allows an attacker to execute arbitrary code such as an implant . In this post , we have presented the evolutions of the Turla Mosquito campaign over the last few months .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Periscope 's activity has previously been suspected of being linked to China , but now researchers believe their evidence links the operation to the Chinese state .


This is done by sending “ 3458 ” in an SMS to the blocked device – this will revoke the administrator privileges from the Trojan . The second , aptly titled " kontrakt87.doc " , copies a generic telecommunications service contract from MegaFon , a large Russian mobile phone operator . This actor , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 .


These factors , in combination with the fact that the command and control infrastructure used by Frozen Cell and Desert Scorpion resides in similar IP blocks , supports the theory that the same actor is responsible for operating , if not developing , both families . Utilizing KillDisk in the attack scenario most likely served one of two purposes : the attackers covering their tracks after an espionage operation , or it was used directly for extortion or cyber-sabotage . Nevertheless, this case does highlight the types of tricks the bad guys are using in an attempt to deliver malware through . It also reveals direct links to secure[.]66[.]to and zhu[.]vn , both of which also belong to Hack520 and contains his personal blog .


Previously , Cloud Atlas dropped its validator” implant named PowerShower” directly , after exploiting the Microsoft Equation vulnerability CVE-2017-11882 mixed with CVE-2018-0802 . Kaspersky Lab To compromise the utility , Kaspersky Lab determined that the cyberattackers used stolen digital certificates used by ASUS to sign legitimate binaries , and altered older versions of ASUS software to inject their own malicious code .


The main thread also spawns a separate thread for receiving new commands from the C2 servers .


Yet the most-recent posting covering TTPs from initial access through prerequisites to enable final delivery of effects on target ( deploying TRITON / TRISIS ) avoids the use of the TEMP.Veles term entirely .


HD_Audio.exe : 86bd78b4c8c94c046d927fb29ae0b944bf2a8513a378b51b3977b77e59a52806 crashes upon execution . sim.exe 723108103ccb4c166ad9cdff350de6a898489f1dac7eeab23c52cd48b9256a42 connects to hnoor.newphoneapp.com .


We discuss these changes and its effect on Android and Apple devices . From October 2012 to May 2014 , FireEye observed APT12 utilizing RIPTIDE , that communicates via HTTP to a hard-coded command and control ( C2 ) server . Prior to making any query, a function called AdrGen is used to build a query . Although we can not verify that the service disruptions occurred directly as a result of KillNet operations , the data below illustrates claims that overlap temporally with verified service disruptions .


Regularly update and patch the router ’ s software and firmware to prevent exploits , and enable its built-in firewall . This malware in turn intercepts fraudulent Lazarus cash withdrawal requests and sends fake approval responses , allowing the attackers to steal cash from ATMs . The Winnti malware family was first reported in 2013 by Kaspersky Lab .


Similarly to another Android spyware made in Italy , originally discovered by Lukas Stefanko and later named Skygofree and analyzed in depth by Kaspersky Labs , Exodus also takes advantage of " protectedapps '' , a feature in Huawei phones that allows to configure power-saving options for running applications . Their next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting , again attempting to extract all Word documents . JhoneRAT : https://drive.google.com/uc?export=downloadid=1vED0wN0arm9yu7C7XrbCdspLjpoPKfrQ . Notably , CADDYWIPER has been the most frequently used disruptive tool against Ukrainian entities during the war and has seen consistent operational use since March 2022 , based on public reporting .


We believe the purpose of this parallel use was to ‘ fieldtest ’ the new CosmicDuke tool , while at the same time ensuring operational success with the tried-and-tested PinchDuke .


The greater worry is that these situations may sometimes not be simple mistakes . This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more . Darkhotel is a threat group that has been active since at least 2004 .


EVENTBOT VERSION 0.4.0.1 Package Name Randomization In this version , the package name is no longer named ‘ com.example.eventbot ’ , which makes it more difficult to track down . This time the document purported to be about the involvement of the Emir of Qatar in funding ISIS , which was seemingly copied from a website critical of Qatar . The Magic Hound has repeatedly used social media to identify and interact with employees at targeted organizations and then used weaponized Excel documents .


When popular applications come under fire and are featured prominently in the news , hackers get excited as these newsworthy apps can become their latest target . It is hard to tell if there are geopolitical motives behind this campaign by looking solely at the list of countries it was targeting , since it was not after a specific region and the victims came from different places in the world . The Linux version of Winnti is comprised of two files : a main backdoor ( libxselinux ) and a library ( libxselinux.so ) used to hide it ’s activity on an infected system . ‘ libxselinux.so ’ — the userland rootkit . libxselinux.so.old : 11a9f798227be8a53b06d7e8943f8d68 906dc86cb466c1a22cf847dda27a434d04adf065 4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a .


] it Reggio Calabria server3bo.exodus.connexxa [ . Targeting a safety system indicates significant damage and loss of human life were either intentional or acceptable goals of the attack , a consequence not seen in previous disruptive attacks such as the 2016 CRASHOVERRIDE malware that caused a power loss in Ukraine . There are 3 basic commands coming from the server in the form of MD5 hashes : Masquerading the attacks as ransomware provides the threat actors with plausible deniability , which allows the nationstate to send a message without taking direct blame .


The image below shows the function that parses the SMS messages , decrypts them using the hardcoded RSA private key and executes the commands . APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military aviation capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making . stolen certificates being used maliciously occurred in early 2014 .


WHO IS BEHIND FAKESPY ’ S SMISHING CAMPAIGNS ? Quite recently , FIN7 threat actors typosquatted the brand Digicert” using the domain name digicert-cdn[.]com , which is used as a command and control server for their GRIFFON implants . APT15 was targeting information related to UK government departments and military technology .


Ignore Battery Optimization : This sets permissions to continue to operate at full capacity while the phone 's screen is turned off and the phone locked . The actors uploaded a variety of tools that they used to perform additional activities on the compromised network , such as dumping credentials , as well as locating and pivoting to additional systems on the network . Beginning in early March 2018 , Unit 42 started observing Gorgon group attacks against Russian , Spanish and United States government agencies operating in Pakistan .


The malicious apps are all developed by a Korean company named Kiniwini , registered on Google Play as ENISTUDIO corp . In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group . If it is , the botnet connection I/O procedure is called through the MainConnectionIo function . The cyber espionage campaign has been attributed to Iranian APT MuddyWater aka Static Kitten and is reported to be actively ongoing , targeting government agencies , as well as entities in the sectors of tourism and academia , within countries including the UAE , Saudi Arabia , and Israel .


List of available commands The command names are self-explanatory . The sample analyzed is f589827c4cf94662544066b80bfda6ab from late August 2015 . It shares the same malicious behavior reported by Checkpoint in Rancor : The Year of The Phish E-MAL SHA-1 c829f5f9ff89210c888c1559bb085ec6e65232de . There are two types of logs identified that can be useful in identifying historical evidence of session hijacking after the successful exploitation of CVE-2023 - 4966 .


The HTA files contained job descriptions and links to job postings on popular employment websites . LAZARUS GROUP is responsible for attacks ranging from the 2014 attack on Sony Pictures to a number of Bitcoin heists in 2017 .


X-Force IRIS SHA256 : 528714aaaa4a083e72599c32c18aa146db503eee80da236b20aea11aa43bdf62 .


Poison Ivy is a remote access tool that is freely available for download from its official web site at www.poisonivy-rat.com . Overall , the Bookworm infrastructure overlaps with the infrastructure hosting C2 servers used by various attack tools , including FFRAT , Poison Ivy , PlugX , and others .


Configure firewalls to disallow Remote Desktop Protocol ( RDP ) traffic coming from outside of the network boundary , except for in specific configurations such as when tunneled through a secondary virtual private network ( VPN ) with lower privileges .


This ongoing activity and the fact that APT28 continues to refine its toolset means that the group will likely continue to pose a significant threat to nation state targets .


Memory collected from systems involved in the intrusion was analyzed using the Volatility framework .


Following up our most recent Sofacy research in February and March of 2018 , we have found a new campaign that uses a lesser known tool widely attributed to the Sofacy group called Zebrocy .


Last but not least , we publish our findings to help Android users protect themselves . Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word . Since at least 2013 , HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government , financial , automotive , and media industries .


will result in writing our file instead to the same directory as the Quasar serve code .


It is therefore valuable to observe how the Dukes reacted to CosmicDuke ’s outing at the beginning of July .


It will also install the malicious app “ com.qualcmm.timeservices. ” These archives contain the file “ .root.sh ” which has some comments in Chinese : Main phase In this phase , the Trojan launches the “ start ” file from Game324.res or Game644.res . FrozenCell is the mobile component of a multi-platform attack we've seen a threat actor known as " Two-tailed Scorpion/APT-C-23 " , use to spy on victims through compromised mobile devices and desktops . This data suggests that the number of countries with potential victims is higher than our telemetry has registered . We called this new malware ?


As outlined in the diagram above , It installs an additional application with the same functionality and these two applications monitor the removal of each other . FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East , we were somewhat confused as the previous public reporting had attributed these attacks to FIN7 .


List of commands sewn into the body of the Trojan : Command code Parameters Actions 2 – Sending a list of contacts from the address book of the infected device to the C & C server 7 “ to ” : int Calling the specified number 11 “ to ” : int , “ body ” : string Sending an SMS with the specified text to the specified number 19 “ text ” : string , “ n ” : string Sending SMS with the specified text to numbers from the address book of the infected device , with the name of the addressee from the TG-3390 uses DLL side loading , a technique that involves running a legitimate , typically digitally signed , program that loads a malicious DLL . Shellbot is also used to control the botnet , with a command that is sent and run from the C&C to determine if there is a code execution in the shell , the hostname , and its architecture . None Deploy advanced endpoint detection and response ( EDR ) tools to all endpoints to detect web services spawning PowerShell or command line processes .


The modifications were minor and likely performed to add capabilities and avoid detection .


The CloudDuke toolset consists of at least a loader , a downloader , and two backdoor variants .


Anubis can completely hijack an Android mobile device , steal data , record phone calls , and even hold the device to ransom by encrypting the victim ’ s personal files . The Sima group also engaged in impersonation of Citizenship and Immigration Services at the Department of Homeland Security , posing as a notice about the expiration of the recipient 's Permanent Residence status . It was believed that the arrest of the group leader will have an impact on the group’s operations . One might think we could have updated the CSP to only allow specific TIDs : .


] 213 To backdoor legitimate applications , attackers used a Smali injection technique – a type of injection that allows attackers to disassemble the code of original app with the Baksmali tool , add their malicious code , and assemble it with Smali . The contents of the decoy PDF is a job descriptions with the South Korean Coast Guard . One of its main functions is to steal information .


similar triggers that are easily detectable . Magic Hound will often find simpler ways for effective compromise , such as creative phishing and simple custom malware . Once all sections are loaded , the relocations get fixed and the MZ/PE headers are zeroed out in memory . It is entirely possible that these threat actors will go as far as compromising close contacts of their targets .


For the purpose of this report we analyze here the Exodus One sample with hash 8453ce501fee1ca8a321f16b09969c517f92a24b058ac5b54549eabd58bf1884 which communicated with the Command & Control server at 54.71.249.137 . In addition to Helminth , the ISMDoor implant is likely used by the Iran-based adversary to attack targets particularly those in the Middle East region . For this specific condition , it is important because it 's filtering on the keyboard layout to identify the targets . A careful analysis of the domain registrations from this threat actor between 2014 and 2015 allowed us to identify one profile used to register several domains that were used as C&C servers for a particular malware family employed by the Winnti group .


This backdoor first emerged in December 2019 , and was discovered by Cybereason .


Leafminer attempts to infiltrate target networks through various means of intrusion : watering hole websites , vulnerability scans of network services on the internet , and brute-force login attempts . A window will pop out .


Because all the URLs used in this campaign have the form of hxxp : //yyyyyyyy [ . Wingbird , the advanced malware used by NEODYMIUM , has several behaviors that trigger alerts in Windows Defender ATP . The decoy document is written using the ukrainian language mixed to many special chars aimed to lure the target to click on it . A month later , GReAT discovered two more previously unknown infection mechanisms for MiniDuke , which relied on Java and Internet Explorer vulnerabilities to infect the victim ’s PC .


The majority of droppers in 9Apps are games , while the rest fall into categories of adult entertainment , media player , photo utilities , and system utilities . The use of InPage as an attack vector is not commonly seen , with the only previously noted attacks being documented by Kaspersky in late 2016 . The MSI packages generally include a clean version of unzIP . The web shell was written to the system by the UMWorkerProcess.exe process , which is associated with Microsoft Exchange Server ’s Unified Messaging service .


Several sources estimate that by the year 2020 some 50 billion IoT devices will be deployed worldwide .


Dolkun lsa Chairman of the Executive Committee Word Uyghur Congress ” While the victim reads this fake message , the malware secretly reports the infection to a command-and-control server . The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 . PROMETHIUM is an activity group that has been active as early as 2012 .


When loaded with startup command 2 , the installer can copy the original explorer.exe file inside its current running directory and rename d3d9.dll to uxtheme.dll . Once connected to the VPN , APT35 focused on stealing domain credentials from a Microsoft Active Directory Domain Controller to allow them to authenticate to the single-factor VPN and Office 365 instance . Varies : The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


This variant ’ s app name , along with many others , is written in Chinese and describes the app as a backup tool . APT41 espionage operations against the healthcare , high-tech , and telecommunications sectors include establishing and maintaining strategic access , and through mid-2015 , the theft of intellectual property . The malware used by the Wekby group has ties to the HTTPBrowser malware family , and uses DNS requests as a command and control mechanism .


FireEye believes the Ke3chang attackers likely began attempting to exfiltrate sensitive data shortly thereafter . In the former Soviet Union , Silence targeted banks in Kyrgyzstan , Kazakhstan , and Ukraine .


Input validation is a method of sanitizing untrusted input provided by users of a web application .


As the actor moved from one device to another , they would drop a simple shell script to establish persistence on the network which allowed extended access to continue hunting .


If one of them was detected , the other one provided the attacker with continued access .


It came in the form of a " Tran Duy Linh " CVE-2012-0158 exploit kit document MD5 : de8a242af3794a8be921df0cfa51885f61 and was observed on April 10 , 2014 . This is also a full-featured backdoor controlled by email , and which can work independently of any other Turla component .


] com autoandroidup [ . We expect APT33 activity will continue to cover a broad scope of targeted entities , and may spread into other regions and sectors as Iranian interests dictate . Remexi includes different modules that it deploys in its working directory, including configuration decryption and parsing, launching victim activity logging in a separate module, and seven threads for various espionage and auxiliary . Some hackers are motivated by the sense of achievement that comes with cracking open a major system .


In green , we can see the references to the SMS API . However , in the same week of September a series of spearphishing attempts once again targeted a set of otherwise unrelated individuals , employing the same tactics as before . To allow the VNC session to connect , the current network socket WSAProtcol_Info structure is written to a named pipe prior to calling zxFunction001 . zxFunction001 modifies the current process memory , uses data contained in the named pipe to create a socket , and then executes the code that sends the remote desktop session to the server controller . The rare opportunity to examine Sharpshooter 's backend operations allowed the researchers to create a fuller picture of the activity and interaction between the various tools used by the threat actor .


The actor altered their macOS and Windows malware considerably , adding an authentication mechanism in the macOS downloader and changing the macOS development framework .


Based on this information , CTU researchers assess that TG-3390 aims to collect defense technology and capability intelligence , other industrial intelligence , and political intelligence from governments and NGOs .


RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism . Using the information gathered from its reconnaissance on social media sites , Barium packages the phishing e-mail in a ACT that gives the e-mail credibility to the target user , often by making the e-mail appear as ifit were sent from an organization known to and trusted by the victim or concerning a topic of interest to the victim .


CozyDuke however represents the complete opposite .


Describing this additional piece of code in detail is outside the scope of this analysis and may require a new dedicated blog post . menuPass has targeted individuals and organizations in Japan since at least 2014 , and as the same organizations and academics were largely targeted each month in these attacks , it further shows menuPass is persistent in attempts to compromise their targets . OceanLotus : {12C044FA-A4AB-433B-88A2-32C3451476CE} memory pointer 4 points to a function that spawns another copy of malicious process . Disrupting supply chains , destroying centrifuges and other attacks can be classified as WarDefense driven .


Figure 1 . While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past , Spring Dragon employs more involved and creative intrusive activity as well . When the payload is started , the registry value is queried and execution is aborted if set . Instead of compiling a list of threats , this technique looks at what is already on a computer and identifies programs as safe , blocking software that does nt match .


They are selective in their attacks and wait for about three months between incidents , which is approximately three times longer than other financially motivated APT groups , like MoneyTaker , Anunak ( Carbanak ) , Buhtrap or Cobalt . BRONZE UNION has consistently demonstrated the capability to conduct successful large-scale intrusions against high-profile networks and systems .


Government agencies and enterprises should plan to be hit from all angles - cloud services , mobile devices , laptops - in order to build comprehensive security strategies that work . Hancom Office is widely used in South Korea . First , they place malware ( usually in ZIP files ) on the legitimate websites hosted on the hop point and then send spear phishing emails with a link that includes the legitimate FQDN . One might think we could have updated the CSP to only allow specific TIDs : .


TG-3390 : blackcmd.com .


With every Android update , the malware authors are forced to come up with new tricks . On occasion the APT37 directly included the ROKRAT payload in the malicious document and during other campaigns the attackers leveraged multi-stage infection processes . recently analyzed a series of malware samples that utilized compiler-level obfuscations . We prefer to keep it secret , we have no goal to destroy your business .


This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge . Periodically , the malware tries to contact the command-and-control ( C&C ) server with the username encoded into parameters .


After launch , it downloads a codec for MP3 encoding directly from the C & C server : http : //54.67.109.199/skype_resource/libmp3lame.dll The skype_sync2.exe module has a compilation timestamp – Feb 06 2017 and the following PDB string : \\vmware-host\Shared Folders\dati\Backup\Projects\REcodin_2\REcodin_2\obj\x86\Release\REcodin_2.pdb network.exe is a It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in . The group generally targets defense and government organizations , but has also targeted a range of industries including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities in the United States , Western Europe , and along the South China Sea .


This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets Bitcoin users and global financial organizations . Madcap” is similar to the XAgent malware , but the former is focused on recording audio .


In late 2016 , versions of the Trojan emerged that contained the card.html phishing page in the assets/www folder . To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys . We also saw that the attack technique bears some resemblance to a previous 2017 Lazarus attack , analyzed by BAE Systems , against targets in Asia .


As a backdoor Trojan , Volgmer has several capabilities including : gathering system information , updating service registry keys , downloading and uploading files , executing commands , terminating processes , and listing directories . We speculate that other attacks delivering Bookworm were also targeting organizations in Thailand based on the contents of the associated decoys documents , as well as several of the dynamic DNS domain names used to host C2 servers that contain the words " Thai " or " Thailand " .


If the user closes the windows , they will appear again due to the timer configuration . Lastly , ITG08 used Comodo code-signing certificates several times during the course of the campaign . Operation Daybreak appears to have been launched by unknown attackers to infect high profile targets through spear-phishing e-mails .


Fraud Both of the billing methods detailed above provide device verification , but not user verification . The times of day the group is active also suggests that it is based near Beijing and the group has reportedly used malware that has been observed in other Chinese operations , indicating some level of collaboration . FindPass Find login account password . Although this wave did not use any zero day exploits , it relied on steganography and NTFS alternate data streams to complicate detection .


Microsoft addressed the SMBv1 vulnerabilities in March 2017 with Security Bulletin MS17-010 . Recently , we found several new versions of Carbon , a second stage backdoor in the Turla group arsenal .


Only samples mentioned or relevant to the relational analysis have been included .


On the other hand , ShadowBrokers group made headlines in 2016 when it claimed to have robbed various exploitation tools used by the NSA including the notorious ETERNALBLUE that was a vital component in the WannaCry ransomware campaign causing damages to systems worldwide . According to the researchers , the group injected malicious JavaScript code into the official government websites associated with the data center in order to conduct watering hole attacks .


For example , they used Nmap to scan various internal IP address ranges and SMB ports .


The banking app test : the credentials as entered ( left ) and as available in the database ( right ) Second , we wrote a test message in an email client . It is interesting to note that Turla operators used the free email provider GMX again , as in the Outlook Backdoor and in LightNeuron . Because of this , additional HIDDEN COBRA malware may be present on systems compromised with FALLCHILL .


The targets and capabilities of HenBox , in addition to the ties to previous activity using four different Windows malware families with political-themed lures against several different South East Asian countries , indicates this activity likely represents an at least three-year-old espionage campaign . Interestingly , some of the APT41's POISONPLUG malware samples leverage the Steam Community website associated with Valve , a video game developer and publisher . We assess the targeting of multiple companies with aviation-related partnerships to Saudi Arabia indicates that APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia .


These components are responsible for a myriad of functions including handling decryption , network communications , gaining super-user privileges , monitoring system logs , loading additional Dalvik code files , tracking the device location and more . The group also targeted companies involved in producing motherboards , processors , and server solutions for enterprises . Given the available data , we assess that APT28 's work is sponsored by the Russian government .


The malware uses an RC4 encryption key that was previously used by the CHOPSTICK backdoor .


During the investigation , this app was able to successfully connect to the command and control server , but it received no commands . We named the actor DustSquad and have provided private intelligence reports to our customers on four of their campaigns involving custom Android and Windows malware . We refer to this group as “ APT1 ” and it is one of more than 20 APT groups with origins inChina . Once they are downloaded to the machine , they can fetch a larger backdoor which carries out the cyberespionage activities , through functions such as copy file , move file , remove file , make directory , kill process and of course , download and execute new malware and lateral movement tools .


Proofpoint researchers observed one DanaBot affiliate ( Affid 11 ) specifically targeting Canada with " Canada Post " themed lures between January 1 and May 1 , 2019 . When we first encountered Lurk , in 2011 , it was a nameless Trojan .


The main DLL also contains eClient subclasses that implement some of the native capabilities . China Chopper contains a remote shell (Virtual Terminal) function that has a first suggested command of netstat an|find ESTABLISHED . On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " to APT33 , operating at the behest of the Iranian government .


Since it becomes a part of the boot partition , formatting the device will not solve the problem . We are also grateful to the Private Office of his Holiness the Dalai Lama , the Tibetan Government-in-Exile , the missions of Tibet in London , Brussels , and New York , and Drewla ( a Tibetan NGO ) . Since 2006 , Mandiant has observed APT1 compromise 141 companies spanning 20 major industries . That DLL file is the main module of Miniduke , and it uses the URL http://twitter.com/TamicaCGerald to fetch commands .


The Trojan displays a fake HTML update page ( update.html ) that blocks the device ’ s screen for a long period of time . Even an experienced user can be fooled by downloading a malicious file that is apparently from adobe.com , since the URL and the IP address correspond to Adobe 's legitimate infrastructure . RASPITE targeting includes entities in the US , Middle East , Europe , and East Asia .


Push notifications were also used to control audio recording . To mitigate the threat of the described campaign , security teams can consider blocking access to the C2 server 103.236.150.14 and , where applicable , ensure that the Microsoft Security Update KB2553204 is installed in order to patch the CVE-2017-11882 vulnerability . Despite last month 's report on aspects of the MuddyWater campaign , the group is undeterred and continues to perform operations .


Furthermore , there are indications that APT32 actors are targeting peripheral network security and technology infrastructure corporations . Talos reported that these DNS hijacks also paved the ACT for the attackers to obtain SSL encryption certificates for the targeted domains ( webmail.finance.gov.lb ) , which allowed them to decrypt the intercepted email and VPN credentials and view them in plain text .


They have different functions and ways of spreading , but the same purpose — to steal money from the accounts of businesses . CTU researchers assess with high confidence that TG-3390 uses information gathered from prior reconnaissance activities to selectively compromise users who visit websites under its control .


Persistence mechanism Registry Key :


In May 2018 , campaigns being conducted by SWEED began leveraging another vulnerability in Microsoft Office: CVE-2017-11882 , a remote code execution bug in Microsoft Office that is commonly observed being leveraged in malicious documents used in commodity malware distribution . The scanner was identified as the Acunetix Web Vulnerability Scanner which is a commercial penetration testing tool that is readily available as a 14-day trial .


Some sources claimed that GOLD LOWELL operations specifically targeted the healthcare vertical following public SamSam incidents in 2016 and 2018 . The first new connection SPEAR identified was derived from an email address listed in Blue Coat Systems' original report on PassCV .


That the Dukes were already developing and operating at least two distinct malware toolsets by the second half of 2008 suggests to us that either the size of their cyberespionage operation was already large enough to warrant such an arsenal of tools , or that they expected their operation to grow significantly enough in the foreseeable future to warrant the development of such an arsenal .


This pattern is shared across the original samples .


In this blog post , FireEye researchers are going to examine a recent instance where FireEye Managed Defense came toe-to-toe with APT41 . The malware then writes the R resource data to the file C:\WINDOWS\tasksche.exe .


Contrary to what might be expected from malware , early CozyDuke versions also lacked any attempt at obfuscating or hiding their true nature .


The DllMain function only decrypts the data structures and initializes Windows API pointers .


An investigation of the web shell , later classified as a modified version of the China Chopper web shell , uncovered several attack phases and TTPs . Barium has targeted Microsoft customers both in Virginia , the United States , and around the world .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , industrial control systems and SCADA , government , and media for espionage and destructive purposes , since at least 2011 . It appears the Desert Falcons sent malicious executables though phishing campaigns impersonating individuals associated with the Palestinian Security Services , the General Directorate of Civil Defence - Ministry of the Interior , and the 7th Fateh Conference of the Palestinian National Liberation Front ( held in late 2016 ) .


Much like we have seen in recent months , anyone can be impacted by a mobile device attack . Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download . The campaign , which we refer to as Operation Cloud Hopper , has targeted managed IT service providers ( MSPs ) , allowing APT10 unprecedented potential access to the intellectual property and sensitive data of those MSPs and their clients globally .


In contrast , LEAD has established a far greater reputation for industrial espionage .


First , the malicious app tries to determine whether it is being tested by the Google Play security mechanism . Group-IB reveals the unknown details of attacks from one of the most notorious APT groups , Lazarus . Execute a command .


Until this incident , no malware had been discovered misusing the AMT SOL feature for communication . The new activity described in this blogpost was detected by ESET in Taiwan , where the Plead malware has alACTs been most actively deployed .


Svpeng sends the corresponding messages to the SMS services of two banks . Turla APT group makes an extra effort to avoid detection by wiping files securely , changing the strings and randomizing what could be simple markers through the different backdoor versions . Winnti : C&C : w[org_name].livehost.live : 443 . The ISO file contained at least the following :


As this is a complex process , we recommend powering off your device and approaching a certified technician , or your mobile service provider , to request that your device be “ re-flashed. ” Change your Google account passwords immediately after this process . APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry . This is important to perform in each maturity level as the obfuscated code could be modified or removed as the code becomes more optimized . Both TANKTRAP GPOs deployed CADDYWIPER from a staged directory to systems as msserver.exe .


Elections were not held in Gaza .


Moreover , we were able to confirm that several of the victims are linked to cryptocurrency business entities .


Their victims have been identified in the United States , Western Europe , Brazil , Canada , China , Georgia , Iran , Japan , Malaysia and South Korea .


EventBot C2 URLs C2 URLs and other settings in a nested class . To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control . COBALT GYPSY 's continued social media use reinforces the importance of recurring social engineering training .


Secondly , the value the Dukes intended to gain from these MiniDuke campaigns may have been so great that they deemed it worth the risk of getting noticed .


GEMINIDUKE : First known activity January 2009 , Most recent known activity December 2012 , C&C communication methods HTTP(S) , Known toolset components Loader , Information stealer , Multiple persistence components .


While tracking what days of the week Suckfly used its hacktools , we discovered that the group was only active Monday through Friday .


This strengthens our suspicion that this malware is still undergoing development and has not been officially marketed or released yet . The earliest step in any possible attack(s) involving this variant of KopiLuwak of which Proofpoint researchers are currently aware begin with the MSIL dropper . We present the connection between Behzad Mesri , an Iranian national recently indicted for his involvement in hacking HBO , and Charming Kitten .


The “ id ” value inside the “ data ” block is equal to the “ timestamp ” value of the relevant command : In addition , the Trojan sets itself as the default SMS application and , on receiving a new SMS , forwards the sender ’ s number and the message text in base64 format to the cybercriminal : Thus , Asacub can withdraw funds from a bank card linked to the phone by sending SMS for the transfer of funds to another account using the number of the card or mobile phone . When the adversaries' operations are live , they modify the record again to point the C2 domain to an IP address they can access . Considering the amount of resources needed to deploy all the necessary patches for an enterprise ( such as quality testing and operations alignment ) , which implies costly downtime for operations and the hesitation to update all systems immediately , Outlaw may find even more targets and victims for their updated botnets every time there is a patch released and waiting to be downloaded . While no substantive posts have been made to the FuckNATO channel since late April 2023 , Mandiant anticipates that KillNet and its affiliates will continue to target NATO for the continued future , with the potential for developments in the war in Ukraine to reinvigorate targeting .


] com and appupdatemoremagic [ . Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina . APT33 has targeted organizations – spanning multiple industries – headquartered in the United States , Saudi Arabia and South Korea .


Since mid-November 2015 , the threat actor referred to as “ Sofacy ” or “ APT28 ” has been utilizing a unique payload and delivery mechanism written in Delphi and AutoIT .


It contained approximately 8GB of stolen data . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " . The graph can also be viewed in the VTGraph Console for additional exploration . Also , the names he used are not randomized and begin with .


The Dukes group as a whole however showed no sign of slowing down .


The malware leverages an exploit , codenamed EternalBlue” , that was released by the Shadow Brokers on April 14 , 2017 . attacks to a Chinese-speaking threat actor group called LuckyMouse .


Figure 2: Zyklon attack flowInfection Techniques CVE-2017-8759 . Further analysis uncovered a handful of ties indicating the actors may also be using the PCShare malware family , which has not been previously tied to the group .


In a 2018 blogpost , ESET researchers predicted that Turla would use more and more generic tools . By 2014 , the Winnti malware code was no longer limited to game manufacturers . Winnti is targeting high-tech companies as well as chemical and pharmaceutical companies . Winnti is attacking companies in Japan , France , the U.S. and Germany . The Winnti hackers broke into Henkel’s network in 2014 . Henkel confirms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions . Far from attacking Henkel and the other companies arbitrarily , Winnti takes a highly strategic approach . The hackers behind Winnti have also set their sights on Japan’s biggest chemical company , Shin-Etsu Chemical . In the case of another Japanese company , Sumitomo Electric , Winnti apparently penetrated their networks during the summer of 2016 . Winnti hackers also penetrated the BASF and Siemens networks . Thanks to this tool , we found out back in March 2019 that the Bayer pharmaceutical group had been hacked by Winnti . At Gameforge , the Winnti hackers had already been removed from the networks when a staff member noticed a Windows start screen with Chinese characters . To witnesses , the spy appears to be running a program showing videos , presenting slides ( Prezi ) , playing a computer game or even running a fake virus scanner .


In 2020 , it appears that TrickBot ’ s vast bank fraud is an ongoing project that helps the gang monetize compromised accounts . Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT Maudi Surveillance Operation which was previously reported in 2013 . This latest attack consisted of three waves between May and June 2018 .


In Operation Sheep’s case , Shun Wang likely harvests end user contact lists without application developer acknowledgement . wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 .


In this blog , we showed that the threat actor behind the recent FakeSpy campaign is a Chinese-speaking group called “ Roaming Mantis ” known to operate mainly in Asia . The first version of Proyecto RAT” was published at the end of 2010 . The U.S. Government refers to the malicious cyber activity by the North Korean government as HIDDEN COBRA .


The malware authors used QtBitcoinTrader developed by Centrabit .


Most of the samples we found date from the last half of 2017 , fewer samples date from 2016 , and a handful date back to 2015 . Turla's goal could include diplomats , experts in the areas of interest related to the Digital Economy Task Force , or possibly even journalists . The admin@338 used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


It also appears the attackers use this as second-stage malware . At the end of June 2015 Mofang started its campaign to gather information of a specific target in relation to the sezs : the cpg Corporation .


One example of a lure document used in the Spark campaign is a PDF file that is used to deliver the Spark backdoor to the victim .


However , the malware wouldn ’ t want to depend on user interaction to trigger the ransomware screen , so , it adds another functionality of Android callback : As the code snippet shows , the malware overrides the onUserLeaveHint ( ) callback function of Activity class . Large-scale cyber espionage campaigns such as " GhostNet " . 0xf001 ) Therefore , having access to such code allows threat actors with minimum programming knowledge to modify and compile their own ransomware variants .


Pacha Group is believed to be of Chinese origin , and is actively delivering new campaigns , deploying a broad number of components , many of which are undetected and operating within compromised third party servers . These spearphishing attempts represent an evolution of Iranian actors based on their social engineering tactics and narrow targeting .


The only instances which we are aware of where the Dukes did not use spear-phishing as the initial infection vector is with certain OnionDuke variants .


It also researches methods for enabling enterprise safety in emergency situations .


Four of the 16 short links were clicked , three by the senior staff members .


With each new version , the malware adds new features like dynamic library loading , encryption , and adjustments to different locales and manufacturers . The malware leverages an exploit , codenamed EternalBlue” , that was released by the Shadow Brokers on April 14 , 2017 . The research and ongoing tracking of APT10 by both PwC UK and BAE .


Trojan.Zekapab Backdoor.Zekapab .


For example , one zero-day vulnerability exploit ( CVE-2015-2545 ) used by PLATINUM was addressed immediately in September 2015 . The backdoor will load the encrypted configuration file and decrypt it , then use Secure Sockets Layer ( SSL ) protocol to connect to command-and-control ( C&C ) servers .


31edacd064debdae892ab0bc788091c58a03808997e11b6c46a6a5de493ed25d 87ffec0fe0e7a83e6433694d7f24cfde2f70fc45800aa2acb8e816ceba428951 eabc604fe6b5943187c12b8635755c303c450f718cc0c8e561df22a27264f101 Kernel Backdoor found in Gadgets Powered by Popular Chinese ARM Since that analysis , CTU researchers have observed multiple BRONZE UNION threat campaigns that illustrate the evolution of the group 's methods and espionage objectives . Outlaw : 1800de5f0fb7c5ef3c0d9787260ed61bc324d861bc92d9673d4737d1421972aa Cryptocurrency miner Trojan.SH.MALXMR.UWEJP . In addition , individuals like Hack520 prove that these threat actors are composed of varied individuals who have their own set of expertise .


Within days , the Check Point research team detected another instance with a different package name but which uses the same code . Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 . For example , PwC UK has observed APT10 compiling DLLs out of tools , such as Mimikatz and PwDump6 , and using legitimate , signed software , such as Windows Defender to load the malicious payloads .


Volexity has also found that , in addition to sending malware lures , the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups .


Seedworm likely functions as a cyber espionage group to secure actionable intelligence that could benefit their sponsor 's interests . We identified file creation times for numerous files that TEMP.Veles created during lateral movement on a target 's network .


The regsvr32.exe executable can be used to download a Windows Script Component file ( SCT file ) by passing the URL of the SCT file as an argument .


CTU researchers do not have evidence that these spearphishing emails are connected to the DNC network compromise that was revealed on June 14 .


AdFind — This command-line tool conducts AD queries .


As mentioned in a recent ISC diary entry , the macro gets the contents of cells in column 170 in rows 2227 to 2248 to obtain the base64 encoded payload .


As recently as this past week , researchers observed Chinese hackers escalating cyber-attack efforts to steal military research secrets from US universities . Much like the observers watching the shadows of objects cast upon the wall of the cave , these two definitions ( XENOTIME and TEMP.Veles , both presumably referring to " the TRITON actor " ) describe the same phenomena , yet at the same time appear different .


These dumpers are quickly removed once they have done their job .


There is a ‘ protected apps ’ list in this brand ’ s smartphones , related to a battery-saving concept . A high volume of redirections from the compromised site continues into mid-January 2017 . APT41 has been active since as early as 2012 .


In April 2016 , a security researcher demonstrated a way to bypass this using regsvr32.exe , a legitimate Microsoft executable permitted to execute in many AppLocker policies .


In addition to adding the code , the attackers also changed the icon and package name . The Buhtrap group is well known for its targeting of financial institutions and businesses in Russia . We have also shared more details with our threat intelligence customers in the past .


FireEye analyzed the malware found on DNC networks and determined that it was consistent with our previous observations of APT28 tools .


Mandianta 's APT1 report was the first to change the game , and paved the way for private security companies to expose advanced threat actors en masse . The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience .


Shamoon2 : analytics-google.org : 69/checkFile.aspx .


At peak times of activity , we have seen up to 23 different apps from this family submitted to Play in one day . Blackgear 's campaigns also use email as an entry point , which is why it's important to secure the email gateway . The data is stored in the last 0x100 bytes of the file . Next , it sends a “ C_SC_NA_1 – single command ” to each hardcoded IOA to modify the state of the target station ’s IOA ( OFF or ON ) .


The malware checks the infected system ’s information and compares it to a given value .


The email purported to have been sent from legitimate email ids .


] 64 [ . In 2017 , APT37 targeted a company in Middle East that entered into a joint venture with the North Korean government to provide telecommunications service to the country . To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every . Additionally , different attackers may have different motivations .


Symantec tracks the group behind this activity as Blackfly and detects the malware they use as Backdoor.Winnti . The exploit installs Silence’s loader , designed to download backdoors and other malicious programs .


The script then waits 20 minutes before it runs the wrapper script initall :


The first type of content , starting with “ method=install ” , will be sent when the app is started for the first time , including the following device private information : Victim identifier Network operator Device model Device OS version Phone number Device identifier App version Country The second type of information will be sent periodically to indicate that the device is alive . The two variants of Helminth do require different delivery methods , with the script variant relying on an Excel spreadsheet for delivery , while the executable variant is more traditional in the fact that it can be installed without a delivery document . Gamaredon : http://get-icons.ddns.net/apu.dot/ . Monitor MSSQL Servers with access to OT systems and networks for evidence of : • Reconnaissance and enumeration activity of MSSQL servers and credentials .


For example , in a 2015 attack on one South American foreign ministry , the group appeared to be searching for very specific information . The samples provided were alleged to be targeting Tibetan and Chinese Pro-Democracy Activists .


The attackers use their access to deploy additional tools and malware to other endpoints or escalate privileges in the network .


Over the last twelve months , Microsoft has delivered nearly 1400 nation-state notifications to those who have been targeted or compromised by STRONTIUM .


The TRITON sample Mandiant analyzed added an attacker-provided program to the execution table of the Triconex controller . Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs .


Enlarge / Hummingbad/Shedun infections by Android version . In November 2017 , CTU researchers discovered the North Korean cyber threat group , known as Lazarus Group , had launched a malicious spearphishing campaign using the lure of a job opening for the CFO role at a European-based cryptocurrency company . APT33 : 195.20.52.172 mynetwork.cf . In other instances , such as the Babuk source code , the leaks were seemingly an operational error .


And my answer for this is : neither is perfect , but both are useful – depending upon your goals and objectives .


But if your device is not from a Chinese manufacturer , then chances that you are a victim of it , are very less . GhostNet represents a network of compromised computers resident in high-value political , economic , and media locations spread across numerous countries worldwide . In almost every case , APT backdoors initiate outbound connections to the intruder ’s “ command and control ” ( C2 ) server . We have discovered and analysed two previously unknown infector vectors that were used in the MiniDuke attacks .


'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS (JukeBox) and Linux (DanceFloor) . The decoy documents dropped suggest that the targets are likely to be politically or militarily motivated , with subjects such as Intelligence reports and political situations being used as lure documents .


Two strings are passed into the call , the shortcode and keyword used for SMS billing ( getter methods renamed here for clarity ) . In contrast to many other APT campaigns , which tend to rely heavily on spear phishing to gain victims , " th3bug " is known for compromising legitimate websites their intended visitors are likely to frequent . Uninstall Uninstall and terminate ZxShell bot DLL . The exploits were sourced from different VPN provider IP addresses and previously compromised third - party devices .


EventBot VirusTotal search for the malicious IP address VirusTotal search for the malicious IP address . The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . In 2011 , three years after the most recent release of PIVY , attackers used the RAT to compromise security firm RSA and steal data about its SecureID authentication system .


Extract information from th GMail app . Russia . Cyber Espionage with a New Malware : The Cybereason Nocturnus team has discovered recent , targeted attacks in the Middle East to deliver the Pierogi backdoor for politically-driven cyber espionage . Ukrainian and Polish government and military organizations among those targeted Talos first discovered a campaign in late April using several malicious files very likely intended for users in Ukraine , based on the content of the lure displayed when the target opens a malicious Microsoft Excel file .


The code responsible for this verification is shown in the following snippet : How it works When the malware is first started on the device it will begin by hiding its icon from the application drawer . In 2019 , the SectorJ04 group expanded its hacking activities to cover various industrial sectors located across Southeast Asia and East Asia , and is changing the pattern of their attacks from targeted attacks to searching for random victims . APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol ( RDP ) , Secure Shell ( SSH ) , PsExec , RemCom , and xCmdSvc .


Upon opening of the MS Word document , our embedded file exploits CVE-2017-11882 to drop a malicious fake Norton Security Shell Extension module , 'NavShExt.dll' , which is then injected into iexplore.exe to install the backdoor , begin collection , and activate command and control . After further analysis , it was discovered that the RTF files were exploiting the CVE-2018-0798 vulnerability in Microsoft ’s Equation Editor ( EQNEDT32 ) .


In January 2017 , new domain names appeared in the campaign hosted on a different IP location . The APT38 uses DYEPACK to manipulate the SWIFT transaction records and hide evidence of the malicious transactions , so bank personnel are none the wiser when they review recent transactions .


Gallmaker 's activity appears to be highly targeted , with its victims all related to government , military , or defense sectors . Since early 2013 , we have observed activity from a unique threat actor group , which we began to investigate based on increased activities against human right activists in the beginning of 2015 .


Perhaps the app ’ s false capabilities also fueled the low number of downloads . In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company . Last , As the victims of commercial spyware are highly targeted individuals , the sobering truth is that some attackers have the means to be able to spend six figures to compromise a single target .


A lull in June 2016 associated with a disruption in the Necurs botnet ; TA505 is heavily reliant on this massive botnet to send out high-volume malicious spam campaigns and disappearances of TA505 activity frequently accompany disruptions in Necurs .


In 2017 , APT37 expanded its targeting beyond the Korean peninsula to include Japan , Vietnam and the Middle East , and to a wider range of industry verticals , including chemicals , electronics , manufacturing , aerospace , automotive and healthcare entities . The Cloud Atlas implants utilize a rather unusual C&C mechanism .


Figure 1 shows one such landing page using stolen branding from Bank Austria . Once the script runs , it passes the decoded script from the image file to the Windows command line in a variable $x , which uses cmd.exe to execute the obfuscated script and run it via PowerShell . FIN10 is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016 .


As such , the blog continues to push forward the narrative of how ICS attacks are enabled through prepositioning and initial intrusion operations – an item I have discussed at length .


Ginp - A malware patchwork borrowing from Anubis November 2019 Intro ThreatFabric analysts have recently investigated an interesting new strain of banking malware . For example , Comodo was defeated by CIA malware placing itself in the Window's Recycle Bin . They have also targeted companies related to industrial control systems .


The threat actor attempted to compromise critical assets , such as database servers , billing servers , and the active directory . Several times , APT5 has targeted organizations and personnel based in Southeast Asia .


Zygote is the core process in the Android OS that is used as a template for every application , which means that once the Trojan gets into Zygote , it becomes a part of literally every app that is launched on the device . Earlier this month , we caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . This suggests that the threat actors are not only focused on financial organizations , as their target set could include other industries as well .


Five of the individuals also had a hillaryclinton.com email account that was targeted by TG-4127 .


In November 2018 , a version of the Trojan for the English market appeared in the shape of Gumtree.apk . The PowerShell script will look at the architecture of the system to check which malicious DLL files should be downloaded . In this campaign , the dropper filename was beauty.scr .


Based on this , we do not believe that the Dukes are replacing their covert and targeted campaigns with the overt and opportunistic CozyDuke and CloudDuke style of campaigns .


It is a worrying observation . Confucius' operations include deploying bespoke backdoors and stealing files from their victim 's systems with tailored file stealers , some of which bore resemblances to Patchwork 's . Because of these carefully designed layers of polymorphism , a traditional file-based detection approach wouldn’t be effective against Dexphot . While the use of web shells is common amongst threat actors , the parent processes , timing , and victim(s ) of these files clearly indicate activity that commenced with the abuse of Microsoft Exchange .


How they did it : GRU hackers .


Indexed directories on C2 infrastructure While exfiltrated content is encrypted , information used to generate the password is plainly visible in the top level directories for each device . Resecurity claims that IRIDIUM breached Citrix 's network during December 2018 . The names suggest websites that professionals might visit : Instead of using twitter ’s google - analytic account , we used an account we control .


EventBot method responsible for the library loading The method responsible for the library loading . In addition , a current ANY.RUN playback of our observed Elise infection is also available . Many of the fake personas utilized by APT35 claimed to be part of news organizations , which led to APT35 being referred to as the Newscaster Team .


of our analysis , we also found samples sharing code with the ViceLeaker malware , in particular they shared a delimiter that was used in both cases to parse commands from the C2 server . Since the middle of 2015 , one of the preferred attack vectors for BlackEnergy in Ukraine has been Excel documents with macros that drop the Trojan to disk if the user chooses to run the script in the document . ScarCruft also attacked a diplomatic agency in Hong Kong , and another diplomatic agency in North Korea .


While analyzing the code , we found that the whole system consists of four critical components , as follows : penetration solutions , ways to get inside the device , either via SMS/email or a legitimate app low-level native code , advanced exploits and spy tools beyond Android ’ s security framework high-level Java agent – the app ’ s malicious APK command-and-control ( C & C ) servers , used to remotely send/receive malicious commands Attackers use two methods to get targets to download RCSAndroid . FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015 . If the variable registers for the comparison and assignment are different , Therefore , there are cases where these vulnerabilities are accessible via the internet .


It is interesting to observe that the actual target list contains : 7 French banking apps 7 U.S. banking apps 1 Japanese banking app 15 non-banking apps This uncommon target list might either be the result of specific customer demand , or due to some actors having partially reused an existing target list . Prior to 2019 , the SectorJ04 group conducted large-scale hacking activities for financial gain using exploit kits on websites to install ransomware , such as Locky and GlobeImporter , along with its banking Trojan , on its victims computers . The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


This method checks if eight hours have passed from the first run of application , and if so , request containing the device ’ s data to the server . This vulnerability was discovered by FireEye in September 2017 , and it is a vulnerability we have observed being exploited in the wild . We observed several attacks in June and July 2013 against targets in the Middle East and the U.S. that dropped a PIVY payload that connected to command-and-control ( CnC ) infrastructure used by the Molerats attackers .


Malware code showing decryption of assets Figure 10 . This report demonstrates that Ke3chang is able to successfully penetrate government targets using exploits for vulnerabilities that have already been patched and despite the fact that these ministries have defenses in place . Both are compressed when archived, and both indicate that they are the only file in their ZIP structures as indicated in their local file headers and EOCDs . We have observed individuals with managerial , digital marketing , digital media , and human resources roles in companies to have been targeted .


HummingBad also has the ability to inject code into Google Play to tamper with its ratings and statistics . In May 2017 , SecureWorks® Counter Threat Unit® ( CTU ) researchers investigated a widespread and opportunistic WCry ( also known as WanaCry , WanaCrypt , and Wana Decrypt0r ) ransomware campaign that impacted many systems around the world . APT33 : 64.251.19.214 [REDACTED].ddns.net . None After initial access via this new exploit method , the threat actor leveraged maintain access , and performed anti - forensics techniques on the Microsoft Exchange server in an attempt to hide their activity .


At line 5 , local variable v4 specifies the first parameter url , which can be changed by the remote C2 server later . This suggests that the threat actors are not only focused on financial organizations , as their target set could include other industries as well . Gamaredon : e2cb06e0a5c14b4c5f58d0e56a1dc10b6a1007cf56c77ae6cb07946c3dfe82d8 . In the case of ProxyNotShell , the targeted backend service is the Remote PowerShell service .


Figure 12 . After the executable is executed , it downloads Pony and Vawtrak malware variants to steal data . Filename: adobe distillist.lnk .


FireEye detects this activity across our platforms , including named detection for TONEDEAF , VALUEVAULT , and LONGWATCH . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions .


This section will contain a fake export table mimicking the same export table of the original system DLL chosen . CTU researchers determined that the COBALT GYPSY threat group orchestrated this activity due to the tools , techniques , and procedures ( TTPs ) used in both campaigns . Loads next-stage payload using custom .png steganography . Further analysis of COSMICENERGY is available as part of .


The variety of malware delivered by the group also demonstrates their deep connections to the underground malware scene .


We believe that it is the largest Google account breach to date , and we are working with Google to continue the investigation . The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . To handle this type of scenario , For more information , contact : intelreports@kaspersky.comPowerShell event logs for the creation of an arbitrary process from PowerShell .


The module aborts the thread receiving C2 command after it fails to correctly execute commands more than six times in a row , i.e. if file or process creation fails .


rm.rf operatore.italia it.offertetelefonicheperte it.servizipremium assistenza.sim assistenza.linea.riattiva assistenza.linea it.promofferte Exodus Two 64c11fdb317d6b7c9930e639f55863df592f23f3c7c861ddd97048891a90c64b a42a05bf9b412cd84ea92b166d790e8e72f1d01764f93b05ace62237fbabe40e Exodus Two This seems confusing as FireEye earlier publicly declared the TRITON as a discrete entity , linked to a Russian research institution , and christened it as " TEMP.Veles " . The records of the domains and IPs involved in this campaign seem to show that the attackers created a new infrastructure specifically for this campaign . Reconstruction of the host ’s anti - virus logs indicates “ lun.vbs ” and “ n.bat ” were executed in close time proximity .


by the great enthusiasm , contribution and desire from all in attendance to make this occasion something meaningful , the outcome of which produced some concrete , action-orientated solutions to our shared grievances . The Middle Eastern hacker group in this case is codenamed " BlackOasis " Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . In particular , we noticed that the Naikon group was spear-phished by an actor we now call " Hellsing " .


Once the dropped file ( officeupdate.exe ) is executed the malware drops additional files ( googleupdate.exe , malib.dll and msccvs.dll ) into the %AllUsersProfile%\Google directory and then executes the dropped googleupdate.exe Upon execution malware makes a connection to the c2 server on port 5555 and sends the system & operating system information along with some base64 encoded strings to the attacker as shown below .


They have also been seen using Heartbleed vulnerability in order to directly get valid credentials . three computers in China being used to launch the Thrip attacks .


In addition to using SWCs to target specific types of organizations , TG-3390 uses spearphishing emails to target specific victims .


This loader , known as Phorpiex Downloader , is not specifically tied to GandCrab or PINCHY SPIDER , and it has previously been observed dropping other malware , such as Smoke Bot , Azorult , and XMRig . The company specializes in finance and natural resources specific to that region .


In addition to Dipsind and its variants , PLATINUM uses a few other families of custom-built backdoors within its attack toolset . In this report , we'll review how the NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan .


The Office document contains a VBA script .


For example , we found several suspicious strings written in the Chinese language in a function called isNetworkAvailable , previously discussed in this blog : An almost identical function is mentioned in an earlier research , that ties FakeSpy and other malware to the Roaming Mantis group . We also unearthed and detailed our other findings on MuddyWater , such as its connection to four Android malware variants and its use of false flag techniques , among others , in our report New MuddyWater Activities Uncovered: Threat Actors Used Multi-Stage Backdoors , False Flags , Android Malware , and More . APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more .


Hot patching is an operating system-supported feature for installing updates without having to reboot or restart a process . In addition , the NetTraveler toolkit was able to install additional info-stealing malware as a backdoor , and it could be customized to steal other types of sensitive information such as configuration details for an application or computer-aided design files .


The executable will then load iviewers.dll , which is normally a clean , legitimate file .


Instead of relying on SMS messages , which can be easily intercepted by third-party apps , these applications started using push notifications for users , containing the transaction details and the TAN . Most of these data-stealing capabilities were present in the oldest variants of CARBANAK that we have seen and some were added over time . In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch .


with a register 0xE CMP Compare the value pointed by the internal VM descriptor with an immediate value 0xF XCHG Exchange the value pointed by the internal VM descriptor with a register 0x10 SHL Jump to a function ( same as opcode 0x1 ) This additional virtual machine performs the same duties as the one already described but in a 64-bit environment . APT34 often uses compromised accounts to conduct spear-phishing operations . In case the payload is bigger than the image used to store it , the remaining payload bytes are simply attached to the image after its IEND marker , and read directly from the file . NoEscape is a new ransomware which been doing the rounds in underground forums since May 2023 .


These attackers have used additional malware families in previous activity dating to at least 2015 that include PlugX , Zupdax , 9002 , and Poison Ivy . Assuming this variant of KopiLuwak has been observed in the wild , there are a number of ways it may have been delivered including some of Turla’s previous attack methods such as spear phishing or via a watering hole . This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose .


backdoor , Xagent , webhp , SPLM .


] today www [ . Chances are about even , though , that Mofang is a relevant threat actor to any organization that invests in Myanmar or is otherwise politically involved . Akin to turning a battleship , retooling TTPs of large threat actors is formidable . The observed activity included creation of web shells for persistent access , remote code execution , and reconnaissance for endpoint security solutions .


X-Force IRIS identified the below malicious document .


1000 50″ , ” timestamp ” : ” 1452272572″ } } , { “ command ” : ” sent & & & ” , ” params ” : { “ to ” : ” +79262000900″ , ” body ” : ” BALANCE ” , ” timestamp ” : ” 1452272573″ } } ] Instructions received from the server A comparison can also be made of the format in which Asacub and Smaps forward incoming SMS ( encoded with the base64 algorithm ) from the device to the C & C server : Smaps TG-3390 uses older exploits to compromise targets , and CTU researchers have not observed the threat actors using zero-day exploits as of this publication . The script then waits 20 minutes before it runs the wrapper script initall : The CozyDuke malware utilizes a backdoor and dropper , and exfiltrates data to a C2 server .


The mobile ransomware , detected by Microsoft Defender for Endpoint as AndroidOS/MalLocker.B , is the latest variant of a ransomware family that ’ s been in the wild for a while but has been evolving non-stop . Between April 1 , 2018 and May 30 , 2018 , we observed the domain stevemike-fireforce.info used in a Gorgon Group cybercrime campaign involving more than 2,300 emails and 19 documents in the initial attack . It should be noted every function is not always obfuscated . Ashley Madison ’s executives understood that only a handful of employees at the time would have had access to the systems needed to produce the screenshots McNeill published online .


Yet one point of confusion in the blog comes at the very start : referring to the entity responsible for TRITON as the “ TRITON actor ” .


Group-IB specialists have established that the aim of the attack was to deliver and launch the second stage of Silence’s Trojan , known as Silence.MainModule . While in most cases the infection vector remains unknown , the high profile attack from 2014 used a very complex Windows TTF zero-day exploit ( CVE-2014-4148 ) .