However , using NCC Group’s research published in May 2018 , we were able to discover code overlaps between these DLLs and a sideloaded DLL that ran the SysUpdate tool that the NCC group has associated with an Emissary Panda campaign .


The list also includes several hack tools , such as Mimikatz for credential dumping and several compiled python scripts used to locate and compromise other systems on the local network .


Unfortunately , we do not have access to the PYTHON33.hlp or CreateTsMediaAdm.hlp files , so we do not know the final payload loaded by either of these DLLs .


According to Microsoft’s advisory , this vulnerability was patched on March 12 , 2019 and we first saw the webshell activity on April 1 , 2019 .


Once the adversary established a foothold on the targeted network , they used China Chopper and other webshells to upload additional tools to the SharePoint server to dump credentials , perform network reconnaissance and pivot to other systems .


We also observed Emissary Panda uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before .


Consequently , the Linux malware ecosystem is plagued by financial driven crypto-miners and DDoS botnet tools which mostly target vulnerable servers .


We also observed the actors uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before .


It has been active since at least 2013 , and has targeted individuals likely involved with the Ukrainian government .


The group’s implants are characterized by the employment of information stealing tools among them being screenshot and document stealers delivered via a SFX , and made to achieve persistence through a scheduled task .


The finding shows that EvilGnome operates on an IP address that was controlled by the Gamaredon group two months ago .


FIN7 operations are linked to numerous intrusion attempts having targeted hundreds of companies since at least as early as 2015 .


The FIN7 intrusion set continued its tailored spear phishing campaigns throughout last year .


In addition , during the investigation , we discovered certain similarities to other attacker groups that seemed to share or copy the FIN7 TTPs in their own operations .


In 2018-2019 , researchers of Kaspersky Lab’s Global Research and Analysis Team analyzed various campaigns that used the same Tactics Tools and Procedures (TTPs) as the historic FIN7 , leading the researchers to believe that this threat actor had remained active despite the 2018 arrests .


One of the domains used by FIN7 in their 2018 campaign of spear phishing contained more than 130 email HackOrges , leading us to think that more than 130 companies had been targeted by the end of 2018 .


Interestingly , following some open-source publications about them , the FIN7 operators seems to have developed a homemade builder of malicious Office document using ideas from ThreadKit , which they employed during the summer of 2018 .


Given FIN7’s previous use of false security companies , we decided to look deeper into this one .


This activity cluster , which Kaspersky Lab has followed for a few years , uses various implants for targeting mainly banks , and developers of banking and money processing software solutions .


FIN7’s last campaigns were targeting banks in Europe and Central America .


After a successful penetration , FIN7 uses its own backdoors and the CobaltStrike framework or Powershell Empire components to hop to interesting parts of the network , where it can monetize its access .


AveMaria is a new botnet , whose first version we found in September 2018 , right after the arrests of the FIN7 members .


This threat actor stole suspected of stealing €13 million from Bank of Valetta , Malta earlier this year .


They also use AutoIT droppers , password-protected EXE files and even ISO images .


Interestingly , this actor targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center .


At the end of 2018 , while searching for new FIN7 campaigns via telemetry , we discovered a set of activity that we temporarily called CopyPaste” from a previously unknown APT .


FIN7 and Cobalt used decoy 302 HTTP redirections too , FIN7 on its GRIFFON C2s before January 2018 , and Cobalt , on its staging servers , similar to CopyPaste .


Quite recently , FIN7 threat actors typosquatted the brand Digicert” using the domain name digicert-cdn[.]com , which is used as a command and control server for their GRIFFON implants .


The second one is CobaltGoblin Carbanak EmpireMonkey , which uses the same toolkit , techniques and similar infrastructure but targets only financial institutions and associated software/services providers .


We observe , with various level of confidence , that there are several interconnected groups using very similar toolkits and the same infrastructure to conduct their cyberattacks .


The last piece is the newly discovered CopyPaste group , who targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center .


At the end of 2018 , the cluster started to use not only CobaltStrike but also Powershell Empire in order to gain a foothold on the victims’ networks .


FIN7 thus continues to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework .


MuddyWater is widely regarded as a long-lived APT group in the Middle East .


From February to April 2019 , MuddyWater launched a series of spear-phishing attacks against governments , educational institutions , financial , telecommunications and defense companies in Turkey , Iran , Afghanistan , Iraq , Tajikistan and Azerbaijan .


FIN7 thus continue to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework .


We also unearthed and detailed our other findings on MuddyWater , such as its connection to four Android malware variants and its use of false flag techniques , among others , in our report New MuddyWater Activities Uncovered: Threat Actors Used Multi-Stage Backdoors , False Flags , Android Malware , and More .


Instead , the campaign used compromised legitimate accounts to trick victims into installing malware .


Notably , the group’s use of email as infection vector seems to yield success for their campaigns .


We also observed MuddyWater’s use of multiple open source post-exploitation tools , which they deployed after successfully compromising a target .


The attacker also connected to the compromised servers from IP addresses that were linked to dynamic domain names used as C&Cs by the delivered payloads .


The main payload is usually Imminent Monitor RAT; however , at the beginning of 2018 , we also observed the use of LuminosityLink RAT , NetWire RAT , and NjRAT .


But with the West African gang we’ve named Scattered Canary , we have a deeper look at how business email compromise is connected to the rest of the cybercrime .


In a recent report , the FBI’s Internet Crime Complaint Center (IC3) reported that more than 20 , 000 businesses lost nearly $1.3 billion to BEC attacks in 2018 .


This investigation by the Agari Cyber Intelligence Division into the cybercriminal group we’ve named Scattered Canary offers unprecedented visibility into eleven years of fraud and criminal activities , and the growth of a 419 startup into a fully operational BEC business .


While this criminal organization’s activities now center around BEC , and extend to romance scams , credit card fraud , check fraud , fake job listings , credential harvesting , tax schemes , and more , these actors came from much humbler beginnings , starting with basic Craigslist scams in 2008 .


On November 29 , 2018 , Scattered Canary sent an attack email to Agari CFO Raymond Lim , enquiring as to his availability to send out a domestic wire transfer .


Many feel that they have a home team advantage living in Nigeria , where they are free to pay off law enforcement to look the other way .


Scattered Canary’s fraudulent history can be traced as far back as October 2008 , when the group first arrived on the cybercriminal circuit .


By March 2016 , one of Scattered Canary’s members had built enough trust with a romance victim—who we’ll call Jane—that she became a frequent source of new mule accounts for the group .


By all accounts , late 2015 was the beginning of BEC for Scattered Canary .


The first type of attack Scattered Canary pivoted to was credential phishing .


Between July 2015 and February 2016 , Scattered Canary’s primary focus seemed to be mass harvesting general credentials using a Google Docs phishing page .


In the first few months of their credential phishing ventures , Scattered Canary’s sights were mostly set on Asian targets—Malaysia and Japan , in particular .


In November 2015 , the group started to focus on North American users , mostly in the United States .


For over eighteen months from March 2017 until November 2018 , Scattered Canary’s frequent enterprise-focused credential phishing campaigns almost exclusively targeted businesses in the United States and Canada .


In July 2018 , following a trend we have observed across the entire BEC threat landscape , Scattered Canary changed their preferred cash out mechanism from wire transfers to gift cards .


Using personal information obtained from various sources , Scattered Canary started perpetrating fraud against US federal and state government agencies .


In total , 35 actors have been tied to Scattered Canary’s operations since the group emerged in 2008 .


Just as with romance scams , actors make use of scripts and templates they can copy-and-paste without having to create something on their own .


When it comes to engaging targets , Scattered Canary frequently maximized efficiencies through the use of scripts , or as some members of the group call them , formats.” These formats are templated text documents that can contain several layers of phishing messages to send to potential victims .


If Scattered Canary can be seen as a microcosm for the rapidly evolving organizations behind today’s most pernicious email scams , this report demonstrates that a much more holistic approach—one based on threat actor identity rather than type of fraudulent activity—is required to detect email fraud and protect organizations .


It used GitHub and Slack as tools for communication between the malware and its controller .


On July 9 , we discovered a new version of SLUB delivered via another unique watering hole website .


Since we published out last report on SLUB , the backdoor has been updated and several improvements were implemented .


During this attack , we found that the SLUB malware used two Slack teams sales-yww9809” and marketing-pwx7789 .


SWEED remains consistent across most of their campaigns in their use of spear-phishing emails with malicious attachments .


In April 2018 , SWEED began making use of a previously disclosed Office exploit .


We found them targeting countries in the Middle East such as United Arab Emirates and Saudi Arabia , as well as other countries such as India , Japan , Argentina , the Philippines , and South Korea .


TA505 is also using FlowerPippi (Backdoor.Win32.FLOWERPIPPI.A) , a new backdoor that we found them using in their campaigns against targets in Japan , India , and Argentina .


TA505 targeted Middle Eastern countries in a June 11 campaign that delivered more than 90% of the total spam emails to the UAE , Saudi Arabia , and Morroco .


It fetches the same FlawedAmmyy downloader .msi file , then downloads the FlawedAmmyy payload .


TA505 used Wizard (.wiz) files in this campaign , with FlawedAmmyy RAT as the final payload .


On June 14 , we saw TA505’s campaign still targeting UAE with similar tactics and techniques , but this time , some of the spam emails were delivered via the Amadey botnet .


It later delivered an information stealer named EmailStealer , ” which stolesimple mail transfer protocol (SMTP) credentials and email addresses in the victim’s machine .


On June 18 , the majority of the campaign’s spam emails were sent with the subject , Your RAKBANK Tax Invoice / Tax Credit Note” or Confirmation .


This campaign used the abovementioned .html file , malicious Excel/Word document VBA macro , the FlawedAmmyy payload , and Amadey .


On June 17 , we observed the campaign’s spam emails delivering malware-embedded Excel files directly as an attachment .


On June 20 , we spotted the campaign’s spam emails delivering .doc and .xls files .


After our analysis , we found that Proofpoint reported this malware as AndroMut as well .


Another new malware we found that TA505 is using in their campaigns last June 20 against targets in Japan , the Philippines , and Argentina is FlowerPippi .


The malicious email contains a highly suspicious sample which triggered the ZLAB team to investigate its capabilities and its possible attribution , discovering a potential expansion of the TA505 operation .


The attack , as stated by CyberInt , leveraged a command and control server located in Germany related to the TA505 actor: a very active group involved in cyber-criminal operation all around the world , threatening a wide range of high profile companies , active since 2014 .


The comparison of the infection chains reveals in both cases TA505 used a couple of SFX stages to deploy the RMS” software: a legitimate remote administration tool produced by the Russian company TektonIT .


The TA505 group is one of the most active threat groups operating since 2014 , it has traditionally targeted Banking and Retail industries , as we recently documented during the analysis of the Stealthy Email Stealer” part of their arsenal .


In 2018 , Kaspersky Labs published a report that analyzed a Turla PowerShell loader that was based on the open-source project Posh-SecMod .


Turla is believed to have been operating since at least 2008 , when it successfully breached the US military .


This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products .


However , it is likely the same scripts are used more globally against many traditional Turla targets in Western Europe and the Middle East .


Based on our research , SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans .


It is interesting to note that Turla operators used the free email provider GMX again , as in the Outlook Backdoor and in LightNeuron .


This new research confirms our forecast and shows that the Turla group does not hesitate to use open-source pen-testing frameworks to conduct intrusion .


One attack during this campaign involved the use of infrastructure belonging to another espionage group known as Crambus aka OilRig , APT34 .


Waterbug has been using Meterpreter since at least early 2018 and , in this campaign , used a modified version of Meterpreter , which was encoded and given a .wav extension in order to disguise its true purpose .


In all likelihood , Waterbug’s use of Crambus infrastructure appears to have been a hostile takeover .


One of the most interesting things to occur during one of Waterbug’s recent campaigns was that during an attack against one target in the Middle East , Waterbug appeared to hijack infrastructure from the Crambus espionage group and used it to deliver malware on to the victim’s network .


These three recent Waterbug campaigns have seen the group compromise governments and international organizations across the globe in addition to targets in the IT and education sectors .


Curiously though , Waterbug also compromised other computers on the victim’s network using its own infrastructure .


Symantec believes that the variant of Mimikatz used in this attack is unique to Waterbug .


Aside from the attack involving Crambus infrastructure , this sample of Mimikatz has only been seen used in one other attack , against an education target in the UK in 2017 .


The first observed evidence of Waterbug activity came on January 11 , 2018 , when a Waterbug-linked tool (a task scheduler named msfgi.exe) was dropped on to a computer on the victim’s network .


In the case of the attack against the Middle Eastern target , Crambus was the first group to compromise the victim’s network , with the earliest evidence of activity dating to November 2017 .


Waterbug’s intrusions on the victim’s network continued for much of 2018 .


Symantec did not observe the initial access point and the close timeframe between Waterbug observed activity on the victim’s network and its observed use of Crambus infrastructure suggests that Waterbug may have used the Crambus infrastructure as an initial access point. also reconfigures the Microsoft Sysinternals registry to prevent pop-ups when running the PsExec tool .


Waterbug also used an older version of PowerShell , likely to avoid logging .


In one of these campaigns , Waterbug used a USB stealer that scans removable storage devices to identify and collect files of interest .


The DeepSight Managed Adversary and Threat Intelligence (MATI) team co-authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug (aka Turla) cyber espionage group , and methods of detecting and thwarting activities of this adversary .


The DeepSight MATI team authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug (aka Turla) cyber espionage group , and methods of detecting and thwarting activities of this adversary .


While reviewing a 2015 report⁵ of a Winnti intrusion at a Vietnamese gaming company , we identified a small cluster of Winnti⁶ samples designed specifically for Linux⁷ .


Following these reports , Chronicle researchers doubled down on efforts to try to unravel the various campaigns where Winnti was leveraged .


We will see more from Zebrocy into 2019 on government and military related organizations .


The FBI issued a rare bulletin admitting that a group named APT6 hacked into US government computer systems as far back as 2011 and for years stole sensitive data .


FireEye iSIGHT Intelligence believes that APT37 is aligned with the activity publicly reported as Scarcruft and Group123 .


Trend Micro attributes this activity to MuddyWater , an Iran-nexus actor that has been active since at least May 2017 .


FireEye assess that the actors employing this latest Flash zero-day are a suspected North Korean group we track as TEMP.Reaper .


FireEye has observed other suspected North Korean threat groups such as TEMP.Hermit employ wiper malware in disruptive attacks .


Kaspersky reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 .


APT33 is the only group that Kaspersky has observed use the DROPSHOT dropper .


The cyber espionage group APT32 heavily obfuscates their backdoors and scripts , and Mandiant consultants observed APT32 implement additional command argument obfuscation in April 2017 .


In all Mandiant investigations to date where the CARBANAK backdoor has been discovered , the activity has been attributed to the FIN7 threat group .


Kaspersky released a similar report about the same group under the name Carbanak in February 2015 .


FireEye assesses that APT32 leverages a unique suite of fully-featured malware .


FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam’s manufacturing , consumer products , and hospitality sectors .


The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on these backdoor families based on Mandiant investigations of APT32 intrusions .


FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests .


In May and June 2017 , FireEye has associated this campaign with APT19 , a group that we assess is composed of freelancers , with some degree of sponsorship by the Chinese government .


APT10 is a Chinese cyber espionage group that FireEye has tracked since 2009 .


In addition to the spear phishes , FireEye ISIGHT Intelligence has observed APT10 accessing victims through global service providers .


FireEye’s visibility into the operations of APT28 – a group we believe the Russian government sponsors – has given us insight into some of the government’s targets , as well as its objectives and the activities designed to further them .


FireEye has tracked and profiled APT28 group through multiple investigations , endpoint and network detections , and continuous monitoring .


In April 2015 , FireEye uncovered the malicious efforts of APT30 , a suspected China-based threat group .


FireEye iSIGHT Intelligence has been tracking a pair of cybercriminals that we refer to as the Vendetta Brothers .


McAfee concludes that some groups—and especially the Poetry Group —have shifted tactics to use Citadel in ways other than what it was originally intended for .


In November 2017 , Talos observed the Group123 , which included a new version of ROKRAT being used in the latest wave of attacks .


In addition to TALOS investigation on KONNI , on July 18 2017 , BitDefender released a whitepaper on DarkHotel .


ESET has also reported PowerShell scripts being used by Turla to provide direct , in-memory loading and execution of malware .


Researchers at Symantec suspect that Turla used the hijacked network to attack a Middle Eastern government .


Symantec researchers have uncovered evidence that the Waterbug APT group has conducted a hostile takeover of an attack platform .


Researchers at the Microstep Intelligence Bureau have published a report on targeted attacks on the Ukrainian government that they attribute to the Gamaredon threat actor .


Kaspersky found an active campaign by a Chinese APT group we call SixLittleMonkeys that uses a new version of the Microcin Trojan and a RAT that we call HawkEye as a last stager .


Trend Micro has previously reported the use of this malware in targeted attacks by the BlackTech group , primarily focused on cyber-espionage in Asia .


LuckyMouse activity detected by Palo Alto involved the attackers installing web shells on SharePoint servers to compromise government organizations in the Middle East .


Talos published its analysis of the BlackWater campaign , related to MuddyWater group .


Regarding other groups , Kaspersky discovered new activity related to ZooPark , a cyber-espionage threat actor that has focused mainly on stealing data from Android devices .


Recorded Future published an analysis of the infrastructure built by APT33 (aka Elfin) to target Saudi organizations .


In a recent campaign , Kaspersky observed ScarCruft using a multi-stage binary to infect several victims and ultimately install a final payload known as ROKRAT – a cloud service-based backdoor .


The threat actor behind the campaign , which Kaspersky believes to be the PLATINUM APT group , uses an elaborate , previously unseen , steganographic technique to conceal communication .


FireEye defined APT40 as the Chinese state-sponsored threat actor previously reported as TEMP.Periscope , Leviathan and TEMP.Jumper .


In January , Kaspersky identified new activity by the Transparent Tribe APT group aka PROJECTM and MYTHIC LEOPARD , a threat actor with interests aligned with Pakistan that has shown a persistent focus on Indian military targets .


OceanLotus was another actor active during this period , using a new downloader called KerrDown , as reported by Palo Alto .


ESET recently uncovered a new addition to OceanLotus’s toolset targeting Mac OS .


In mid-2018 , Kaspersky's report on Operation AppleJeus” highlighted the focus of the Lazarus threat actor on cryptocurrency exchanges .


Kaspersky also observed some activity from Gaza Team and MuddyWater .


Kaspersky wrote about LuckyMouse targeting national data centers in June .


Kaspersky also discovered that LuckyMouse unleashed a new wave of activity targeting Asian governmental organizations just around the time they had gathered for a summit in China .


Kaspersky have observed similar activity in the past from groups such as Oilrig and Stonedrill , which leads us to believe the new attacks could be connected , though for now that connection is only assessed as low confidence .


In August 2019 , FireEye released the Double Dragon” report on our newest graduated threat group , APT41 .


Today , FireEye Intelligence is releasing a comprehensive report detailing APT41 , a prolific Chinese cyber threat group that carries out state-sponsored espionage activity in parallel with financially motivated operations .


Group-IB experts continuously monitor the Silence’ activities .


Group-IB has uncovered a hacker group , MoneyTaker , attacking banks in the USA and Russia .


Group-IB reveals the unknown details of attacks from one of the most notorious APT groups , Lazarus .


Finally , Kaspersky produced a summary report on Sofacy’s summertime activity .


Kaspersky were also able to produce two reports on Korean speaking actors , specifically involving Scarcruft and Bluenoroff .


Analysis of the payload allowed us to confidently link this attack to an actor Kaspersky track as BlackOasis .


For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2 This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP port 443 .


We can observe that the sample is very recent , created on Thursday , July 4


Buckeye's exploit tool , EternalRomance , as well as EternalSynergy , can exploit the CVE-2017-0143 message type confusion vulnerability to perform memory corruption on unpatched victim computers .


Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT Maudi Surveillance Operation which was previously reported in 2013 .