The first variant involves social engineering the target into downloading a trojanized app . Thus , Turla operators had access to some highly sensitive information ( such as emails sent by the German Foreign Office staff ) for almost a year . The service ’s existence is verified with the ServiceExists function , which attempts to open the relative registry sub-key in HKLM\SYSTEM\CurrentControlSet\Services . CrowdStrike incident responders found that renamed Plink and AnyDesk executable creation timestamps on affected backend Exchange servers were closely correlated with PowerShell execution events in the Remote PowerShell logs , indicating the threat actor leveraged the newly discovered exploit chain to drop other tooling for persistent access to the affected Exchange servers .


The main purpose of this module is providing reverse shell features on the device by connecting with the C & C server ’ s socket . Therefore , it is clear that the OceanLotus group works during weekdays and takes a break during the weekends . The group behind the campaign has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia . menuPass : Stone Panda , APT10 , Red Apollo , CVNX , HOGFISH . menuPass is a threat group that appears to originate from China and has been active since approximately 2009 .


The team has encountered different versions of the malware over time as it has rapidly evolved . Previous reports have discussed Bisonal malware used in attacks against Japan , South Korea and Russia . Based on the targeting and lures , Unit 42 assesses that the Lotus Blossom actors ' collection requirements include militaries and government agencies in Southeast Asia .


We have observed Delphi , AutoIt , and C++ variants of Zebrocy , all of which are related not only in their functionality , but also at times by chaining the variants together in a single attack .


According to our estimates , about 60 % of mobile malware are elements of both large and small mobile botnets . three computers in China being used to launch the Thrip attacks . By default , every keystroke is recorded using the Keylogger module ( 306, previously documented by Avast ) and saved to disk in the file %APPDATA%\PAGM\OEY\XWWEYG\WAOUE . Mandiant Threat Intelligence assesses that UNC2452 activity aligns with nation - state priorities broadly and that the group ’s targeting patterns are consistent with Russian strategic interests .


Modified DLL file ( goopdate.dll ) used by BRONZE PRESIDENT to install RCSession : 0617cad9e5d559356c43d4037c86227f , f14eaf5d648aebb2ed7b00b2cf4349263b30fb1c , 2ea9ccf653f63bcc3549a313ec9d0bada341556cc32dd2ca4b73e0c034492740 .


The purpose of this module is to extract and execute a malicious payload – the “ patch ” module . Sometimes , the attackers use sub-domains on the exploit websites , to make them seem more legitimate . Process hollowing is a technique that can hide malware within a legitimate system process . Malwarebytes 's EDR shows the full attack chain ( please click to enlarge ): The NetSupport RAT files are hosted on the same compromised WordPress site used earlier to download the Internet shortcut .


APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more . Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware .


As the code snippet shows , the malware creates a notification builder and then does the following : setCategory ( “ call ” ) – This means that the notification is built as a very important notification that needs special privilege . Honeybee attacked beyond the borders of South Korea to target Vietnam , Singapore , Argentina , Japan , Indonesia , and Canada . ( On hosts of interest , Agrius deploys its own custom malware a .NET backdoor called IPsec Helper , which registers itself as a service to establish persistence .


The Flash zero-day exploit ( CVE-2015-5119 ) was added into the Angler Exploit Kit and Nuclear Exploit Pack . The Cobalt started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world . some functions in the ANEL sample have multiple control dispatchers . None Use of Python for malware development and/or packaging : We expect to continue to observe attackers compiling or packaging their OT malware via methods such as PyInstaller ( IRONGATE ) or Py2Exe ( TRITON ) given the proliferation of OT malware developed or packaged using Python in recent years .


Payload deployment Once the static block execution is complete , the Android Lifecycle callback transfers the control to the OnCreate method of the main class . APT15 was targeting information related to UK government departments and military technology . After the first EOCD comes some extra data – another ZIP file . Initially engaged in espionage activity , Agrius deployed a set of destructive wiper attacks against Israeli targets , masquerading the activity as ransomware attacks .


But according to Gnosticplayers , his foray into a public marketplace like Dream has two goals --besides the first and obvious one being money . SPEAR identified recent PassCV samples which implemented another commercial off-the-shelf ( COTS ) RAT called Netwire .


Both groups can set permissions on specific files to Everyone , and work in tandem with the PLATINUM backdoors . Recently , the JPCERT published a thorough analysis of the Plead backdoor , which , according to Trend Micro , is used by the cyberespionage group BlackTech .


Metasploit is an open source framework popular as a tool for developing and executing exploit code against a remote target machine .


Another common step taken by threat actors is changing their system's MAC Address to avoid being uniquely identified . Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents .


It is very easy to trick victims to fall for such attacks . Further analysis showed that the Iron cybercrime group used two main functions from HackingTeam's source in both IronStealer and Iron ransomware . Group5 is a threat group with a suspected Iranian nexus , though this attribution is not definite .


Most attackers target vulnerable applications and operating systems .


The Arabic-language text and English translation of the document are available in ThreatConnect here .


And our researchers estimate that in every 10 Android users 1 was attacked by either one or several of those Trojans during the second half of 2015 , so there are millions of devices with a huge possibility of being infected with Triada . WannaCry incorporated the leaked EternalBlue exploit that used two known vulnerabilities in Windows CVE-2017-0144 and CVE-2017-0145 to turn the ransomware into a worm , capable of spreading itself to any unpatched computers on the victim's network and also to other vulnerable computers connected to the internet . We assess that APT34 works on behalf of the Iranian government based on infrastructure details that contain references to Iran , use of Iranian infrastructure , and targeting that aligns with nation-state interests .


Timeline of posts related to the Hacking Team DATE UPDATE July 5 The Italian company Hacking Team was hacked , with more than 400GB of confidential company data made available to the public . Since 2013 , the Cobalt have attempted to attack banks and financial institutions using pieces of malware they designed . it attempts to guess the next block number based on the address , This actor uses these vulnerabilities to deploy webshells including CHINACHOP .


Leveraging this intelligence allowed us to begin predicting potential C2 domains that would eventually be used by the Sofacy group .


Our Investigation into both clusters further showed that they were both involved in attacks targeting organizations in South East Asia . Based on this , we believe the Rancor attackers were targeting political entities .


Second , the app can set a custom delay between displaying ads . Analysis of the payload allowed us to confidently link this attack to an actor Kaspersky track as BlackOasis . This file drops exactly the same files than the previous campaign but the decoy document is different .


Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability . TAA not only flagged this malicious use of PsExec , it also told us what the attackers were using it for .


The exploitation of this vulnerability is not unique to Emissary Panda , as multiple threat groups are using this vulnerability to exploit SharePoint servers to gain initial access to targeted networks .


The ScarCruft APT gang has made use of a Flash zero day patched Thursday by Adobe to attack more than two dozen high-profile targets in Russia and Asia primarily . APT5 also targeted the networks of some of Southeast Asia 's major telecommunications providers with Leouncia malware .


] com hxxp : //mailsa-wqo [ . In our 2014 report , we identified APT28 as a suspected Russian government-sponsored espionage actor . To support this capability, the adversaries chose to manually craft the DNS queries and communicate directly with the controller as opposed to using existing .NET DNS . Whoever hacked Ashley Madison had access to all employee emails , but they only released Biderman ’s messages — three years worth .


The only difference introduced is that an event named “ WerTyQ34C ” can be signalled by the function “ NvStop ” to terminate the message loop and stop processing .


The a binary is a script wrapper to start run , a Perl-obfuscated script for installation of a Shellbot to gain control of the infected system .


These threats are capable of opening a back door and stealing information from victims' computers . TG-3390 actors have used Java exploits in their SWCs .


It is unclear how long the malicious code existed inside the apps , hence the actual spread of the malware remains unknown . The Winnti umbrella continues to operate highly successfully in 2018 . We will take a look at the keylogger later on . Enable robust application logging for MicroSCADA and aggregate logs to a central location .


HummingWhale , by contrast , managed to sneak its way into about 20 Google Play apps that were downloaded from 2 million to 12 million times , according to researchers from Check Point , the security company that has been closely following the malware family for almost a year . Rather , PapaAlfa could be considered a smart proxy due in part to the fact that the Lazarus can easily switch the backend destination address and port without having to reestablish control over the infected machine hosting the PapaAlfa malware . Because the Elfin and the Shamoon attacks against this organization occurred so close together , there has been speculation that the two groups may be linked . If you can not apply the KB5019758 patch immediately , you should disable OWA until the patch can be applied .


We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages . Hancom Office is widely used in South Korea .


While one variant will use a preconfigured C&C server over HTTP or HTTPS , the other variant will use a Microsoft OneDrive account to exchange commands and stolen data with its operators .


We however feel it is unlikely that the CosmicDuke operators targeting drug dealers and those targeting governments could be two entirely independent entities .


Before sending any data to the C2 using the trojan attempts to disguise its data , the data is serialized using JSON , which is then encoded in Base64 . After a successful phishing attack in which users have opened emails and browsed to malicious links , ITG08 attackers install the More_eggs JScript backdoor on user devices alongside several other malware components . APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world .


This task proved to be nontrivial . Depending on placement , a web shell can provide continued access to victims ' environments , re-infect victim systems , and facilitate lateral movement . The data received from the C&C server is encrypted using the same key . As outlined in recent research detailing the GRU 's disruptive playbook , we have observed Sandworm adopting LotL tactics across its wider operations to similarly increase the speed and scale at which it can operate while minimizing the odds of detection .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government . In addition to these , we also identified " Macfog " , a native Mac OS X implementation of Icefog that infected several hundred victims worldwide .


Deserialize the decrypted response into another client response object .


Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer . Our initial observation of the Bahamut group originated from in-the-wild attempts to deceive targets into providing account passwords through impersonation of platform providers .


" WzI3MDg5LDI4NjE4LDk4MzMsNDE3MCwyNTcyMiwxOTk3NywyMzY5LDIxNDI2LDM0MzUsNzQ0MiwzMDE0NiwyMTcxOSwxNjE0MCwxNjI4MCwxNjY4OCwyMjU1MCwxOTg2NywxOTQsMzI5OF0= " .


as the user agent , while more recent samples use “ OPAERA ”


We believe this backdoor is relatively new and seems to have appeared starting in the beginning of 2019 .


ACCESS_NETWORK_STATE - Allows the application to access information about networks . However , this action doesn’t appear to have made a dent in the cybercriminal organization , as subsequent spear-phishing campaigns seem to have been reported from March until May 2018 . As we continued to investigate , it became apparent that Gorgon Group had been consistently targeting worldwide governmental organizations operating within Pakistan .


In most cases , LEAD ’s attacks do not feature any advanced exploit techniques .


In addition , the malware can log in to the attacker ’ s email inbox , parse emails in a special folder for commands and save any payloads to a device from email attachments . This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans . A second JavaScript command was also executed , which created a scheduled task to execute chfeeds.vbe multiple times a day . Mandiant has previously identified the domain wasxxv[.]site being used by North Korean threat actors .


Several analysis reports were published on this malware in 2014 and , finally , the source code was leaked in 2015 . Since at least 2008 , The Lamberts have used multiple sophisticated attack tools against high-profile victims . Some of the campaign codes we have seen include : CRML_0505 , CRML_MIL , Firebox4 , JUST_0525 , ML0628 , MW0629 , OM222 . Our demonstration shows how using the Google Analytics API , a web skimmer can send data to be collected in his own account instance .


Adobe on Thursday patched a zero-day vulnerability in Flash Player that has been used in targeted attacks carried out by a new APT group operating primarily against high-profile victims in Russia and Asia . We suspect that the group sought access to these networks to obtain information that would enable it to monitor communications passing through the providers' systems .


So far , this software ( along with the Android version ) has been made available through phishing sites that imitated Italian and Turkmenistani mobile carriers . WannaCry utilizes EternalBlue by crafting a custom SMB session request with hard-coded values based on the target system . The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros .


For the .NET version , the following registry key and value are used for persistence :


We have directly observed multiple copies of Exodus with more than 50 installs and we can estimate the total number of infections to amount in the several hundreds , if not a thousand or more . While continuing research on the August 2018 attacks on a Middle eastern government that delivered BONDUPDATER , Unit 42 researchers observed OilRig 's testing activities and with high confidence links this testing to the creation of the weaponized delivery document used in this attack . The actor used the same technique in the macro and in the JhoneRAT . A main goal of this attack was to obtain access to email accounts .


Signing malware with code-signing certificates is becoming more common , as seen in this investigation and the other attacks we have discussed .


Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier . This threat is another proof point that attackers are clearly incorporating the mobile device into their surveillance campaigns as a primary attack vector .


While there have been several Suckfly campaigns that infected organizations with the group ’s custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions .


2016 We do not know exactly how many people have been infected with RuMMS malware ; however , our data suggests that there are at least 2,729 infections with RuMMS samples from January 2016 to early April 2016 . In the January 16 , 2018 attack , we observed OilRig attacking an organization it previously targeted in January 2017 . The purpose is to download an image from a new Google Drive link . These types of threat actors will be attempting to cause the most embarrassment andor pain to prove the company can not function without them .


Shamoon2 : 69.87.223.26:8080/eiloShaegae1 .


At the time of analysis , the subdomains did not host a website; however , based on BITTER APT group’s targeting patterns , it is highly likely that they were created to host faux login phishing pages designed to steal user’s credentials . Hackers first actively spread bots using the Niteris exploit , and then search for infected devices at banks amongst their bots by analyzing IP addresses , cracked passwords and results of the modules performance .


Extract call logs , contacts and messages from the Skype app . the group 's targets include an organization in Sweden . Using Geopolitically-charged Lure Content : The attackers use specially crafted lure content to trick their targets into opening malicious files that infect the victim ’s machine with the Pierogi backdoor . The name “ Anonymous Sudan ” is likely an attempted appropriation of the brand of the well - known hacktivist collective “ Anonymous , ” similar to another KillNet affiliate , “ Anonymous Russia . ”


W:\Visual Studio 2017\Spark4.2\Release\Spark4.2.pdb .


“ Agent Smith ” itself , though , seems to target mainly India users . Overall , the Bookworm infrastructure overlaps with the infrastructure hosting C2 servers used by various attack tools , including FFRAT , Poison Ivy , PlugX , and others . Over time , Dexphot-related malicious behavior reports dropped to a low hum , as the threat lost steam . Encrypted Channel APT29 has used multiple layers of encryption within malware to protect C2 communication .


We believe this spyware platform is developed by an Italian company called eSurv , which primarily operates in the business of video surveillance . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . This RAT uses three different cloud services to perform all its command and control ( C2 ) activities . The attackers only managed to deploy it to three machines on the organizations network and it was blocked on two of those three computers .


In 2013 , many of the decoy documents employed by the Dukes in their campaigns were related to Ukraine ; examples include a letter undersigned by the First Deputy Minister for Foreign Affairs of Ukraine , a letter from the embassy of the Netherlands in Ukraine to the Ukrainian Ministry of Foreign affairs and a document titled “ Ukraine ’s Search for a Regional Foreign Policy ” .


How to unblock the phone Now for some good news : Rotexy doesn ’ t have a very well-designed module for processing commands that arrive in SMSs . If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros . The period between November 2014 and January 2015 marked one of the earlier instances in which Proofpoint observed persistent exploitation attempts by this actor .


The Sednit group – also known as APT28 , Fancy Bear , Sofacy or STRONTIUM – has been operating since at least 2004 and has made headlines frequently in past years .


The ScarCruft group keeps expanding its exfiltration targets to steal further information from infected hosts and continues to create tools for additional data exfiltration . this SWC was used to specifically target Turkish banking .


While no phishing- or social engineering-initiated routines were observed in this campaign , we found multiple attacks over the network that are considered “ loud. ” These involved large-scale scanning operations of IP ranges intentionally launched from the command and control ( C&C ) server .


The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage .


If that part is found , the app loads Javascript snippets from the JSON parameters to click a button or other HTML element , simulating a real user click . NetTraveler has been used to target diplomats , embassies and government institutions for over a decade , and remains the tool of choice by the adversaries behind these cyber espionage campaigns . The Chinese government would benefit from improved insight into local media coverage of Taiwanese politics , both to better anticipate the election outcome and to gather additional intelligence on politicians , activists , and others who interact with journalists . Popular tax preparation software companies are under fire from lawmakers for allegedly sharing personal information with social media sites , including Google and Meta .


The official “ Golden Cup ” Facebook page . FireEye assesses that APT32 leverages a unique suite of fully-featured malware , in conjunction with commercially-available tools , to conduct targeted operations that are aligned with Vietnamese state interests . The information for this specific sample is listed below . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


As part of their activities , they are known for hijacking DNS settings on Japanese routers that redirect users to malicious IP addresses , creating disguised malicious Android apps that appear as popular apps , stealing Apple ID credentials by creating Apple phishing pages , as well as performing web crypto mining on browsers . FIN7 thus continues to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework . This time , APT15 opted for a DNS based backdoor : RoyalDNS .


The malware opens the URLs using the user agent that imitates a PC browser in a hidden webpage and receives a redirection to another website . The attackers behind observed activity in 2018 operate from the Xicheng District of Beijing via the net block 221.216.0.0/13 . If ZxShell successfully connects to the remote host , the function DoHandshake is called . As 2021 ends , one critical theme remains constant within the world of enterprise security ransomware attacks are continuing to rise , yearoveryear , across private and public entities .


the back of a surge in Trojan activity , we decided to carry out an in-depth analysis and track the evolution of some other popular malware families besides Asacub . CraP2P has frequently been used to distribute other malware such as Locky and Dridex , but also supported large scale spam campaigns for dating advertisement and pump-and-dump scams after the demise of Kelihos . As a backdoor Trojan , Volgmer has several capabilities including : gathering system information , updating service registry keys , downloading and uploading files , executing commands , terminating processes , and listing directories .


Others like transferbot , promptupdate and promptuninstall are meant to help the operator manage the malware . Versions of this particular orchestrator were found on other victims , together with White Lambert samples , indicating a close relationship between the White and Pink Lambert malware families . This helped disguise their activities . Recognizing and stopping the above malicious JavaScript request requires advanced visibility solutions that can detect the access and exfiltration of sensitive user data ( in this case the user ’s email address and password ) .


The malware contains a list of 209 packages hardcoded in its source code . Additionally , the group compromised organizations in Europe and North America that have ties to the Middle East . This could be an attempt to evade sandbox analysis as mouse and keyboard movement is typically not performed . However , given the lack of conclusive evidence , we consider it also possible that a different actor - either with or without permission - reused code associated with the cyber range to develop this malware .


In addition , it collects identifiers and some data from the device . OceanLotus , also known as APT32 , is believed to be a Vietnam-based APT group that has become increasingly sophisticated in its attack tactics , techniques , and procedures ( TTPs ) . Ursnif Variant 446ffd272c79554a19b5f4299327fb74b8ff457681d10571caa6eea51ec406b0 ea7e1650031c92b7377788f05926034e Ursnif Variant 42636f3185c9e398958aad272d983c8b8b1409df4ce93f1f8f608e190290f56d 377cd85d8d68fc58976a123aa151c5e0 Ursnif Variant 24b2141c1134ef14f33a38c58342b6573940c5460d03a2945fafac36e32e6889 b73cbffea8094cfa18b067d9568c53e7 Ursnif Variant e53b0a60c238c45019089bdf7f16d5f47b7ba15ca2c918e385c41f0c2076eb52 24fe5a6196e32749cd030ab51824cabe Ursnif Variant 4c8de1713f830819e8354b653fd19a5cafd0bc8fa3145eedf555f24261c874de 589734cb60aa515599c687539c520049 . Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader , one of the most popular PDF reader alternatives to Adobe Acrobat .


House Speaker Nancy Pelosi later confirmed that the DCCC had suffered a network compromise .


CVE-2015-6585 : Hangul Word Processor Vulnerability .


Figure 14 : disabling infected apps auto-update Figure 15 : changing the settings of the update timeout The Ad Displaying Payload Following all of the above , now is the time to take a look into the actual payload that displays ads to the victim . The campaign was active until January 2014 , but during our investigations the C&C servers were shut down . Next , the loader DLL E-TOOL targets the setup.exe file in SysWoW64 . Malwarebytes customers are protected as we detect the infrastructure and final payload used in these attacks .


As Talos observed at the beginning of 2017 , Group 123 started a campaign corresponding with the new year in 2018 . The Trojan is quite similar to the .NET RocketMan Trojan Obviously and can handle the same commands; additionally , it includes the #screen” command to take a screenshot .


Unfortunately , at the time of collection , the C2 domain had been sinkholed by a third party .


In our research , we focus on the most recent sample , an application dubbed as " Golden Cup '' , launched just before the start of World Cup 2018 . Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years . In this instance it is saved to the C:\ProgramData directory with a pseudo random name . While one of his signatures uses his own blog domain , there is also a second signature which uses 93[.]gd , a domain that was found to have been actively selling VPS services in the past .


AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products . ESET has been tracking this threat for months and has observed several changes , sometimes within weeks . APT38 relies on DYEPACK , a SWIFT transaction-hijacking framework , to initiate transactions , steal money , and hide any evidence of the fraudulent transactions from the victimized bank .


Some versions of the Skygofree feature the self-protection ability exclusively for Huawei devices . The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” . APT41 is a group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity .


Once connected to the pipe , a user or a program can easily provide information required to execute command ( just as they would normally through a command-line ) .


WhatsApp message capture The service com.serenegiant.service.ScreenRecorderService , is invoked by the ScreenRecorderActivity . Callisto Group via credential phishingThese spear phishing emails were crafted to appear highly convincing , including being sent from legitimate email accounts suspected to have been previously compromised by the Callisto Group via credential phishing . It is worth noting that this email appeared to have been sent from another Taiwanese Government employee , implying that the email was sent from a valid but compromised account . Some TrickBot samples have used HTTP over ports 447 and 8082 for C2 .


A " Tracking tool '' or an " Admin tool '' are often cited for these kinds of tools for " commercial '' or " enterprise '' usage . Blending in with legitimate traffic is a common tactic used by attackers to help fly under the radar . Though public disclosures resulted in APT12 adaptations , FireEye observed only a brief pause in APT12 activity before the threat actors returned to normal activity levels . In fact , this chain also leads to NetSupport RAT .


PlugX — A remote access tool notable for communications that may contain HTTP headers starting with " X- " ( e.g. , " X-Session : 0 " ) .


Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) . January 2018 , TAA triggered an alert at a large telecoms operator in Southeast Asia .


Doing so executes code checking if the device is manufactured by Xiaomi , or if Xiaomi ’ s fork of Android is running on the device . APT41 frequently leverages timely news stories as the lure content in their spear-phishing emails , although social engineering content does not always correlate with targeted users or organizations . Since at least 2007 , APT28 has engaged in extensive operations in support of Russian strategic interests .


Other cyberespionage groups , including Black Vine and Hidden Lynx , have also used stolen certificates in their campaigns .


Unfortunately , we were unable to get any C2 S-TOOL servers to issue download commands to any samples that we tested in our lab .


The traffic transits in clear and is therefore potentially exposed to man-in-the-middle attacks : At the same time , null will also bind a local shell on 0.0.0.0:6842 . On April 22 , 2015 , Suckfly exploited a vulnerability on the targeted employee 's operating system ( Windows ) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack . Meeting Agenda.pdf : That 's because a new ransomware called BlackSuit had appeared which shared 98 percent of its code with the infamous Royal ransomware .


2015-02-04 2015-07-20 http : //119.network/lte/Configuratore_TIM.apk 2015-07-08 Many of these domains are outdated , but almost all ( except one – appPro_AC.apk ) samples located on the 217.194.13.133 server are still accessible . In Operation Sheep’s case , Shun Wang likely harvests end user contact lists without application developer acknowledgement . APT12 is a threat group that has been attributed to China .


From the outside , they are indistinguishable from the legitimate applications . Traffic was intercepted on a node between the end machine and the Adobe servers , allowing Turla 's operators to replace the legitimate Flash executable with a trojanized version . It is not directly used from msvcrt.dll but is instead copied to another memory chunk before being called . They claim to have compromised the company and are willing to help resolve the issue .


Similar to its other attacks , Suckfly used the Nidiran back door along with a number of hacktools to infect the victim 's internal hosts .


A coordinated Shamoon outbreak begins and computer hard drives across the organization are permanently wiped .


Here is a command and control protocol fragment : Commands from C2 server parsing In total , the malicious APK handles 16 different commands : Command Endpoint Description 1 reqsmscal.php Send specified SMS message 2 reqsmscal.php Call specified number 3 reqsmscal.php Exfiltrate device info , such as phone model and OS version 4 reqsmscal.php Exfiltrate a list of all installed applications 5 reqsmscal.php Exfiltrate default browser history ( limited to a given date ) 6 reqsmscal.php After reviewing all the malware functionalities , we are confident in saying that the attackers look for victims who answer well-defined characteristics and believe that further stages of the attack are delivered only to those who fit the specific victim profile . We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester .


How it Works In order to get into the Google Play Store , the malware uses a phased approach which is quite a common practice for malware authors these days . APT32 often deploys these backdoors along with the commercially-available Cobalt Strike backdoor . The samples had minor changes , and were presumably changed by the attackers to avoid detection by hash . Threat actors like the Winnti group rarely ever stay static in terms of both tools and tactics .


As observed previously with CVE-2017-11882 and CVE-2018-0802 , the weaponizer was used exclusively by Chinese cyber espionage actors for approximately one year December 2017 through December 2018 , after which cybercrime actors began to incorporate it in their malicious activity . As a result , it is already flagged as Bahamut by antivirus engines .


Bread has used a few tricks to keep strings in plaintext while preventing basic string matching . In one case in late 2014 , APT5 breached the network of an international telecommunications company . Shutdown Logout , shutdown or restart the target system . Check the flag T as indicator if single stepping .


In addition future Trojans could leverage root exploits to make them almost impossible to remove and give malicious actors the ability to hook generic low level API ’ s that are used by all ( banking ) applications , just like the attack vector as has been used on the desktop platform for years . Attackers like to use spear-fishing email with password protected RAR attachment to avoid being detected by the email gateway . ZxShell is one sample amongst several tools that Group 72 used within their campaign . Though Google meant to have this parameter be used to mention the page the user visited , we used it to exfiltrate the user name and password data encoded in base64 .


Phone number for administration changeServer : At this point , the malware changes the C2 to a new host , even though the API and communication protocol continues to be the same . Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn't possible for us to verify this link . The malware supports the following capabilities : Terminate specific process、Enumerate processes、Upload file、Download file、Delete file、List folder contents、Enumerate storage volumes、Execute a command、Reverse shell、Take a screenshot . Conducted for commercial or financial purposes , corporate espionage involves


The code above changes the font color to black within the specified cell range and presents the content to the user .


Firewalls provide security to make your network less susceptible to attack .


The pushTAN method has a clear advantage : It improves security by mitigating the risk of SIM swapping attacks and SMS stealers . Since May 2017 , Mandiant experts observed North Korean actors target at least three South Korean cryptocurrency exchanges with the suspected intent of stealing funds . Unit 42 's ongoing research into the OilRig campaign shows that the threat actors involved in the original attack campaign continue to add new Trojans to their toolset and continue their persistent attacks in the Middle East .


The macro obtains the document saved to the system from within the document stored as UserForm1.Label1.Caption and will write it to : %TEMP%\~temp.docm .


However , a white font color is applied to the text to make it appear that the victim must enable macros to access the content .


Our intelligence shows “ Agent Smith ” droppers proliferate through third-party app store “ 9Apps ” , a UC team backed store , targeted mostly at Indian ( Hindi ) , Arabic , and Indonesian users . We believe that the IP addresses from Canada , Russia and Norway are analysis systems of antivirus companies or security researchers . Microsoft Defender ATP data shows the effectiveness of behavioral blocking and containment capabilities in stopping the Dexphot campaign . Dynamic Resolution During the SolarWinds Compromise , APT29 used dynamic DNS resolution to construct and resolve to randomly - generated subdomains for C2.[12 ]


If /sdcard/MemosForNotes was present on the device , the Chrysaor app removes itself from the device . The actor has conducted operations since at least 2013 in support of China 's naval modernization effort . The apex domain was set to redirect to a relevant legitimate site using the Namecheap redirection service , while the subdomain points to the malicious C&C server . None The motives have not yet been definitively determined , but are guessed to be the result of a oneoff attempt to gather intelligence that potentially can be used in further phishing campaigns .


If the lateral movement with credentials fails , then the malware uses PingCastle MS17-010 scanner (PingCastle is a French Active Directory security tool) to scan that particular host to determine if its vulnerable to EternalBlue , and uses it to spread to that host . There was code to download a decoy document from the Internet and open it in a second winword.exe process using the Start-Process cmdlet .


Symantec has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks . It is highly likely MoonWind is yet another new tool being used by the group or groups responsible for that activity , indicating they are not only still active but continuing to evolve their playbook .


When the victim opens the attached word document it prompts the user to enable macro content and both the documents ( Uri Terror Report.doc and mha-report.doc ) displayed the same content and contained a Show Document button .


The ActionScript relies on event listeners to call specific functions when the event “ Event.COMPLETE ” is triggered after successful HTTP requests are issued to the C2 server .


CrowdStrike® Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams . For the sake of narrative we are going to focus exclusively to those samples we identified being used in attacks against Iranian civil society and diaspora .


Although at first glance this appears somewhat complex , it is in fact a rather simple , repeated keyboard sequence .


The information collected by the malware and the control over the victim 's mobile device allows their operators to perform more complex social engineering attacks . The campaign , which we refer to as Operation Cloud Hopper , has targeted managed IT service providers ( MSPs ) , allowing APT10 unprecedented potential access to the intellectual property and sensitive data of those MSPs and their clients globally . OceanLotus : 4c02b13441264bf18cc63603b767c3d804a545a60c66ca60512ee59abba28d4d Loader #2 . It is possible that the malware was used to support exercises such as the ones hosted by Rostelecom - Solar in 2021 in collaboration with the Russian Ministry of Energy or in 2022 for the ( SPIEF ) .


At runtime , the apps can check which carrier the device is connected to and fetch a configuration object from the command and control server . These text messages did not include links but are intended to build credibility around the fake service notifications later sent to the target 's email address . The ZxShell driver starts by acquiring some kernel information and then hooking “ ObReferenceObjectByHandle ” API . UNC4899 's targeting is selective , and they have been observed gaining access to victim networks through JumpCloud .


A few days later they can cancel the trial and do not need to pay a penny . In addition to making changes to the Excel worksheets that contain the decoy content , the actor also made changes to the worksheet that is initially displayed to the user . So , static analysis on the “ 6323 ” ﬁle shown as its nature : it is written using Microsoft Visual Studio .NET , therefore easily to reverse . These observations leave open the possibility that COSMICENERGY was developed with malicious intent , and at a minimum that it can be used to support targeted threat activity in the wild .


Ongoing activity While monitoring this particular threat , we found another XLoader variant posing as a pornography app aimed at South Korean users . Despite the differing sponsorship , penetration of Hong Kong and Taiwan-based media organizations continues to be a priority for China-based APT16 . Note the request number parameter is now 0001: 39e965e000caD60001679C79T.sample-domain.evil . The ransomware is a 64bit executable written in Rust and it recognises the following commandline parameters


The details of this attribution is explained in a dedicated section below .


WebView JavaScript Interface Continuing on the theme of cross-language bridges , Bread has also tried out some obfuscation methods utilizing JavaScript in WebViews . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 . This set of functionality allows the operator complete control of a system . Astamirov is now facing charges of wire fraud and of intentionally damaging protected computers , plus he 's accused of making ransom demands through deploying ransomware .


To trick the targeted individual into enabling macros , the attackers deliberately used jumbled-up text as content .


and was identified within an archive file ( 4FE7561F63A71CA73C26CB95B28EAEE8 ) with the name “ التفاصيل الكاملة لأغتيال فقهاء.r24 ” .


The incident represented a shift in the capabilities and consequences of ICS malware .


Next it writes a hardcoded binary from its body to “ msdeltemp.dll ” into the target directory .


The second Windows vulnerability (CVE-2017-0143) was patched in March 2017 after it was discovered to have been used by two exploit tools—EternalRomance and EternalSynergy—that were also released as part of the Shadow Brokers leak . Later that month , the same tactics and patterns were seen in attempts against an Iranian women 's activist – an individual commonly targeted by Iranian actors , such as Charming Kitten and the Sima campaign documented in our 2016 Black Hat talk .


Ukrainian officials revealed that the investigation into the compromise of the CEC ’s internal network identified malware traced to APT28 .


nis : The su application used to execute shell commands with root privileges . PLATINUM has used several zero-day exploits against their victims . Moafee and DragonOK both use a well-known proxy tool – HUC Packet Transmit MAL ( HTRAN ) – to disguise their geographical locations .


This research identified several bouts of offensive activity that occurred in the past few months , which revealed similar operational methods in which the attackers served malicious documents and other malware executables from web servers to their targets to establish an initial foothold in the network .


We were also able to confirm that the phone number he provided to the domain registrar was genuine . Many groups leverage the regsvr32.exe application whitelisting bypass , including APT19 in their 2017 campaign against law firms . phpschboy.prohosts.org .


To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys . COVELLITE operates globally with targets primarily in Europe , East Asia , and North America .


There are known related samples that are able to create such directories on removable drives , i.e . the sample with md5: 8cb08140ddb00ac373d29d37657a03cc .


Please follow these basic precautions during the current crisis—and at all times : Install apps only from official stores , such as Google Play . We have been tracking the malicious activities related to this threat actor and discovered a previously undocumented malware family with strong links to the Ke3chang group – a backdoor we named Okrum . It has been an active operation since August of 2017 and as recently as February 2018 .


These include CVE-2010-3962 as part of an attack campaign in 2010 and CVE-2014-1776 in 2014 . In June we published on a previously unknown group we named " Bahamut " , a strange campaign of phishing and malware apparently focused on the Middle East and South Asia .


It is also another example for why organizations and consumers alike should have an advanced mobile threat prevention solution installed on the device to protect themselves against the possibility of unknowingly installing malicious apps , even from trusted app stores . Moreover , the number of Corkow incidents detected in Q1 2015 in the United States exceeds the number of those in the CIS countries . The group goes further in its social engineering effort : to convince the hotel personnel about the legitimacy of their request , a copy of the National Registry of Legal Entities card ( CNPJ ) is attached to the quotation . Since then , Apple released a new fix for iOS , iPadOS and macOS that reliably fixes the vulnerability again .


During the course of our research , we noticed that we were not the only ones to have found the operation . Fxmsp is a hacking collective that has operated in various top-tier Russian- and English-speaking underground communities since 2017 . As a rule , the initial dropper is created by the infection procedure . Initial access brokers use tools like NetSupport RAT to gather information and perform additional actions on victims of interest .


With further analysis of the Quasar RAT C2 Server , we uncovered vulnerabilities in the server code , which would allow remote code execution .


TABLE OF CONTENTS Security Recommendations Introduction Threat Analysis Common Features Unique Features by Version Malware Under Active Development Suspected Detection Tests by the Threat Actor EventBot Infrastructure Cybereason Mobile Conclusion Indicators of Compromise MITRE ATT & CK for Mobile Breakdown SECURITY RECOMMENDATIONS Keep your mobile device up-to-date with the latest software updates from legitimate sources . The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll . The Spring Dragon appears to have rolled out a steady mix of exploits against government-related organizations in VN , TW , PH , and other locations over the past few years .


DAN GOODIN - 1/23/2017 , 4:39 PM A virulent family of malware that infected more than 10 million Android devices last year has made a comeback , this time hiding inside Google Play apps that have been downloaded by as many as 12 million unsuspecting users . A rudimentary but somewhat clever design , KiloAlfa provides keylogging capability for the Lazarus Group 's collection of malicious tools . This file was likely delivered via a spear-phishing email . We have previously observed targeting in countries including Germany , Denmark , Sweden , France , Poland , Slovakia , Ukraine , Israel , the United Arab Emirates ( UAE ) , and other NATO ally and partner countries such as Japan .


Malicious module “ ip ” This file will be executed by the patched system library . Talos reported that these DNS hijacks also paved the way for the attackers to obtain SSL encryption certificates for the targeted domains ( e.g.webmail.finance.gov.lb ) , which allowed them to decrypt the intercepted email and VPN credentials and view them in plain text . APT1 . If the target system meets the pre - defined requirements , the malware will use Twitter ( unbeknownst to the user ) and start looking for specific tweets from pre - made accounts .


q= - : As is common with trojans , the communication is always initiated by the trojan on the device to the C2 . In addition , configuring PowerShell script logging and identifying any obfuscation will assist in mitigating ITG08’s use of PowerShell to conduct malicious activity . APT38 is a financially motivated group linked to North Korean cyber espionage operators , renown for attempting to steal hundreds of millions of dollars from financial institutions and their brazen use of destructive malware .


The RTF document 8cf3bc2bf36342e844e9c8108393562538a9af2a1011c80bb46416c0572c86ff was very small in size at 264 bytes .


messages from IM accounts , including Facebook Messenger , WhatsApp , Skype , Viber , Line , WeChat , Hangouts , Telegram , and BlackBerry Messenger . Symantec discovered the most recent wave of Tick attacks in July 2015 , when BRONZE BUTLER compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks . like this , The series also touches on shocking new details unearthed by KrebsOnSecurity and Jeremy Bullock , a data scientist who worked with the show ’s producers at the Warner Bros. production company Wall to Wall Media .


Digital signature verification can be bypassed by giving the malicious file exactly the same name as a legitimate file and placing it on the same level in the archive . Visitors to sites exploited by Emissary Panda are directed by code embedded in the sites to a malicious webpage , which screens their IP address . It will first achieve persistence on the system by writing the in-memory patched parent process to disk to a path specified in the configuration string pool . ThreatConnect Can Help Protect Your Organization from Phishing and BEC Attacks


Almost all of the strings and behaviors we describe in this analysis of a .NET version are also present in the native version .


Trend Micro™ Mobile Security for Apple devices ( available on the App Store ) can monitor and block phishing attacks and other malicious URLs .


In recent BitPaymer IR engagements , Falcon Intelligence linked the initial infection vector to fake updates for a FlashPlayer plugin and the Chrome web browser . We believe they may have some links to North Korea , which may explain why ScarCruft decided to closely monitor them .


Design In the manifest , the malware requests a large number of permissions . APT10 is a constantly evolving , highly persistent China-based threat actor that has an ambitious and unprecedented collection programme against a broad spectrum of sectors , enabled by its strategic targeting . The reason that it stayed undetected for so long is partly due to the fact that the trojanized updaters were signed with legitimate certificates ( eg : “ ASUSTeK Computer Inc. ” ) . Each data item fills its location by calling function so , it will become like the following but with the victim collected data .


Similar to Samas and BitPaymer , Ryuk is specifically used to target enterprise environments . Samurai Panda is interesting in that their target selection tends to focus on Asia Pacific victims in Japan , the Republic of Korea , and other democratic Asian victims .


The Poseidon Group actively targets this sort of corporate environment for the theft of intellectual property and commercial information , occasionally focusing on personal information on executives . We found that the group behind this campaign targeted mainly industrial , engineering and manufacturing organizations in more than 30 countries .


On April 20 , Proofpoint observed a targeted campaign focused on financial analysts working at top global financial firms operating in Russia and neighboring countries .


Either of these tools could have been used to exfiltrate the archived data .


During this time they were able to steal digital certificates from South Korean companies and launch attacks against Indian and Saudi Arabian government organizations .


TG-3390 actors have deployed the OwaAuth web shell to Exchange servers , disguising it as an ISAPI filter .


In this case , Yandex Browser , Chromium , 7Star Browser ( a Chromium-based browser ) , and CentBrowser are targeted , as well as versions of Microsoft Outlook from 1997 through 2016 .


The group created a custom malware framework and tailormade credential gathering tools , but an apparent misconfiguration prevented the attack from executing properly .


NATO , Afghan Ministry of Foreign Affairs , Pakistani Military :


] com hxxp : //nttdocomo-qae [ . Several sources consider APT28 a group of CyberMercs based in Russia . Carbon Black TAU ThreatSight Analysis GandCrab and Ursnif . Bullock had spent many hours poring over the hundreds of thousands of emails that the Ashley Madison hackers stole from Biderman and published online in 2015 .


Removing the junk instructions revealed a readable block of code . Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 . The decrypted MUI file contains position-independent code at offset 0 . This type of vulnerability is known as a server - side request forgery ( SSRF ) .


The malicious capabilities observed in the second stage include the following : Upload attacker-specified files to C2 servers Get list of installed applications Get device metadata Inspect itself to get a list of launchable activities Retrieves PDF , txt , doc , xls , xlsx , ppt , pptx files found on external storage Send SMS Retrieve text messages Track device location Handle limited attacker commands via out of band text messages Record surrounding audio Record calls Record video Retrieve account information such as email addresses Retrieve contacts Removes copies of itself if Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers . The group , which first became active in late 2015 or early 2016 , specializes in scanning for vulnerable websites and using this to identify potential targets , either for attacks or creation of command and control ( C&C ) infrastructure . We judge that these operations are very likely aimed at stealing information and gaining persistent remote access .


] cashnow [ . Gorgon used numerous decoy documents and phishing emails , both styles of attacks lacked overall sophistication . By using the and instruction , As confirmed by our own research data , CISA also found LockBit took the top spot as the biggest global ransomware threat in 2022 .


Release_Time : 2016-03-15 Report_URL : https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=62e325ae-f551-4855-b9cf-28a7d52d1534&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments


The variables storing the results of the regular expression matches are used within the ActionScript for further interaction with the C2 server .


Just like we can’t make a definitive determination as to who conducted this campaign , we do not know for sure who it was intended to target .


Just 7 days later , on the 26th of January , a component for CosmicDuke was compiled that exploited the vulnerability and allowed the tool to operate with higher privileges .


A month after observing sample 2 , we obtained another which used the same package name as sample 2 ( cn.android.setting ) . Based on early observed activity , consistent behavior , and APT41's unusual focus on the video game industry , we believe the group's cyber crime activities are most likely motivated by personal financial gain or hobbyist interests . FANCY BEAR ( also known as Sofacy or APT28 ) is a separate Russian-based threat actor , which has been active since mid 2000s , and has been responsible for targeted intrusion campaigns against the Aerospace , Defense , Energy , Government and Media sectors .


Based on the amount of open-source information available on the target , it is feasible that a spear-phishing email may have been used .


It performs a privilege check once every second ; if unavailable , the Trojan starts requesting them from the user in an infinite loop : If the user agrees and gives the application the requested privileges , another stub page is displayed , and the app hides its icon : If the Trojan detects an attempt to revoke its administrator privileges , it starts periodically switching off the phone screen , trying to stop the user actions . The Palo Alto Networks Unit 42 research team recently came across a series of malicious files which were almost identical to those targeting the Saudi Arabian government previously discussed by MalwareBytes . If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit .


In this latest incident , the group registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day . Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability .


] 6 2020-02-29 http : //themoil [ . We didn’t choose to name it after a vegetable; the .NET malware developers named it Topinambour themselves . Charming kitten regularly target international media outlets with Persian-language services .


Extract logs from Facebook Messenger conversations . The group has maintained a low profile until now and its targets have been mainly organizations and individuals that would be of interest to a nation state 's intelligence services . Cybereason suspects that the backdoor may have been obtained in underground communities rather than home-grown , as the evidence found in the code of the backdoor suggests it may have been developed by Ukranian-speaking hackers . Malware detections do n’t matter nearly as much as malware damage — just one ransomware attack can close your business .


FireEye uncovered malware development activity that is very likely supporting TEMP.Veles activity .


In addition , analysis of these backdoor delivery methods also highlights a trend by many threat actors where they use legitimate storage platforms to deliver the initial stages of the attack .


Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload . Given the group 's specific interest in infrastructure operations , rapidly improving capabilities , and history of aggressive targeting , Dragos considers this group a primary threat to the ICS industry .


Per a 2015 report from CitizenLab , Gamma Group licenses their software to clients and each client uses unique infrastructure , making it likely that the two documents are being used by a single client . The first time this happened was at the beginning of the month , when Proofpoint researchers blew the lid off a cyber-espionage campaign named Operation Transparent Tribe , which targeted the Indian embassies in Saudi Arabia and Kazakhstan .


After app installation , whenever SWAnalytics senses victims opening up infected applications or rebooting their phones , it silently uploads their entire contacts list to Hangzhou Shun Wang Technologies controlled servers . Analysis of the emails has shown that the attachment contains an exploit for the CVE-2017-11882 vulnerability .


This also aligns with HenBox ’ s timeline , as in total we have identified almost 200 HenBox samples , with the oldest dating to 2015 . This could include diplomats , experts in the areas of interest related to the Digital Economy Task Force , or possibly even journalists . The attackers used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


The dropper implements 2 persistence mechanisms :


Based on the length of the Dukes ’ activity , our estimate of the amount of resources invested in the operation and the fact that their activity only appears to be increasing , we believe the group to have significant and most critically , stable financial backing .


Each version expands the bot ’ s functionality and works to obfuscate the malware against analysis . If it's Cyrillic and the command to the shell is not ‘ipconfig’ , the threat converts the command result text encoding from Cyrillic to UTF-16 . The oldest sample we found was created in 2009 , indicating this tool has been in use for almost seven years .


So we decided to write our own plugin code using IDA Python . On November 10 , 2015 , threat actors sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs . This is probably done by the component that drops and installs this malicious service . The Monti ransomware collective has restarted their operations , focusing on institutions in the legal and governmental fields .


Cobalt Strike — This popular and commercially available penetration tool gains shell access to an infected system .


The payload is actually an HTML Application ( HTA ) file , not an RTF document .


Then it sends all that information to the Command & Control server . Adobe Flash Player exploit . FireEye also reported on these attacks in a May 22 blog post .


The command & control server ( C & C server ) returns the URL to click along with a very long list of additional parameters in JSON format . In this report , we'll review how the NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . APT16 actors sent spear phishing emails to two Taiwanese media organization addresses and three webmail addresses . “ Microsoft remediated the issue by first blocking tokens issued with the acquired key and then replacing the key to prevent continued misuse , ” the report states .


After receiving an unprecedented amount of attention in 2016 , APT28 has continued to mount operations during 2017 and 2018 .


A search for this certificate fingerprint on the Internet scanning service Censys returns 8 additional servers : IP address 34.208.71.9 34.212.92.0 34.216.43.114 52.34.144.229 54.69.156.31 54.71.249.137 54.189.5.198 78.5.0.195 207.180.245.74 Opening the Command & Control web page in a browser presents a Basic Authentication prompt : Closing this prompt causes the server to send a " 401 Unauthorized Response '' with an " Access Denied '' message in Italian Taidoor spoofed Taiwanese government email addresses to send out socially engineered emails in the Chinese language that typically leveraged Taiwan-themed issues . Runs the executable file and deletes the .txt file . “ Who or what is asdfdfsda@asdf.com ? , ” Biderman asked , after being sent a list of nine email addresses .


The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . Southeastern Europe as well as countries in the former Soviet Union Republichas recently been the main target .


These spear-phishing emails range from ones purposely designed to look like spam messages used to spread common crimeware and addressed to large numbers of people , to highly targeted emails addressed to only a few recipients ( or even just one person ) and with content that is highly relevant for the intended recipient .


Interestingly , the artifact bundles a copy of OpenSSL 1.0.1e , from February 2013 , which causes the unusually large size of the binary .


APT35 typically targets military , diplomatic and government , media , energy , engineering , business services and telecommunications sectors in U.S. and the Middle East . Citrix told Threatpost that this is indeed the same password-spraying attack it announced itself last week – but it wouldn't confirm the other details in Resecurity 's post , including the attribution .


'' We determined that the " eCommon '' file contains support code and structures that are platform independent . We observed another campaign targeting an organisation located in Lebanon . The Elfin group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries .


Powerview.ps1 — This PowerShell-based module for network reconnaissance is part of the PowerSploit penetration testing framework .


We suspect the updated PIN is sent to the C2 , most likely to give the malware the option to perform privileged activities on the infected device related to payments , system configuration options , etc . The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” . CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash .


Version # 3 : Sept. - Dec. 2019 — Domain : ponethus [ . one organization is located in the US . Following the release of the article , FireEye observed a distinct change in RIPTIDE ’s protocols and strings . PingPull can use HTTPS over port 8080 for C2.[28 ]


Also , we found a debug version of the implant ( 70a937b2504b3ad6c623581424c7e53d ) that contains interesting constants , including the version of the spyware . Its attack activities can be traced back to April 2012 . Axiom is a cyber espionage group suspected to be associated with the Chinese government .


Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 . The codename for Turla APT group in this presentation is MAKERSMARK .


Port 6211 : Calendar extraction service . Attackers have been known to distribute malicious files masquerading as the legitimate iviewers.dll file and then use DLL load hijacking to execute the malicious code and infect the computer . Criticism of and embarrassing content about Hamas . This includes tens of thousands of terminals outside of Ukraine that , among other things , support wind turbines and provide Internet services to private citizens .


The first versions of the new AZZY implant appeared in August of this year .


The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process . If the macros in SPK KANUN DEĞİŞİKLİĞİ GİB GÖRÜŞÜ.doc” are enabled , an embedded payload is decoded and saved in the %APPDATA% directory with the name CiscoAny.exe” .


Most recently they were connected to a campaign in March that targeted ” organizations in Turkey , Pakistan , and Tajikistan .


Mobile Banking com.IngDirectAndroid ING com.instagram.android Instagram com.konylabs.capitalone Capital One® Mobile com.mail.mobile.android.mail mail.com mail com.microsoft.office.outlook Microsoft Outlook com.snapchat.android Snapchat com.tencent.mm WeChat com.twitter.android Twitter com.ubercab Uber com.usaa.mobile.android.usaa USAA Mobile com.usbank.mobilebanking U.S. Bank - Inspired by customers com.viber.voip Viber com.wf.wellsfargomobile SectorJ04 group carried out intensive hacking on various industrial sectors , including South Korea’s media , manufacturing and universities , around February and March 2019 . In some cases , the attackers used the Society for Worldwide Interbank Financial Telecommunication ( SWIFT ) network to transfer money to their accounts .


In another modification , first observed in the most recent October 11 Parliamentarian operation ( version agewkassif ) , the developer (s ) of KeyBoy began using a string obfuscation routine in order to hide many of the critical values referenced within the malware . CTU researchers discovered the threat actors searching for " [company] login " , which directed them to the landing page for remote access .


] net svcws [ . These samples were contained in exploit documents containing distinct lure content , one having a Tibetan nexus , the other an Indian nexus . But we also attempt to figure out why the adversary changed — what broke? — so that we can predict if and when they will change again in the future . Stolen credentials can be resold to other threat actors tied to ransomware gangs .


These botnets generally target the following regions :


Gooligan , a family of Android malware that came to light in November after it compromised more than 1 million Google accounts , contained similar abilities to tamper with Google Play ratings . Regardless of their sophistication or refinement , the malware families within the Lazarus Group 's India and Lima classes perform at a reasonable level for their designed purpose : the introduction and persistence of malware from the Lazarus Group on a victim 's infrastructure . Quasar RAT ( Trojan.Quasar ) : Commodity RAT that can be used to steal passwords and execute commands on an infected computer . The way Hack520 signs his messages in one hacker forum provides a clue pointing to this connection .


Finally , Mandiant’s Devon Kerr and John Miller of FireEye iSIGHT Intelligence will expose the tactics of FIN7 , a financially motivated hacker group that FireEye tracked throughout 2016 . Clever Kitten actors have a strong affinity for PHP server-side attacks to make access ; this is relatively unique amongst targeted attackers who often favor targeting a specific individual at a specific organization using social engineering .


Microsoft application whitelisting solution AppLocker prevents unknown executables from running on a system .


any additional APKs are downloaded to external storage . Considering that the afterhack publications by the media mentioned that the investigation stumbled upon three different attackers , it was not obvious whether Lazarus was the one responsible for the fraudulent SWIFT transactions , or if Lazarus had in fact developed its own malware to attack banks ' systems . It has compromised a wide range of targets , including governments along with organizations in the research , chemical , engineering , manufacturing , consulting , finance , telecoms , and several other sectors . NuisanceDestruction intrinsic There are some that are intrinsically motivated to simply attack an organization or person for no other reason than to create chaos and destruction .


Carefully consider the risks before granting administrative rights to users on their own machines .


Lets start by giving a summary about the muddyc3 tool :


] 137 54.69.156 [ . Aside from the competitive vendor naming landscape ( which I am not a fan of in cases on direct overlap , but which has more to say for itself when different methodologies are employed around similar observations ) , the distinction between FireEye and Dragos' approaches with respect to the " TRITON actor " comes down to fundamental philosophical differences in methodology . The threat actor behind the attack invested considerable time and effort to lure their victims with specially-crafted documents that target Palestinian individuals and entities in the Middle East . None Enablement and usage of SQL extended stored procedures for Windows shell command execution : PIEHOP ( filename : r3_iec104_control.exe ) ( MD5 : cd8f394652db3d0376ba24a990403d20 ) is a disruption tool written in Python and packaged with PyInstaller version 2.1 + that has the capability to connect to a user supplied remote MSSQL server for uploading files and issuing remote commands to a RTU .


The following month , we released a private report on our Threat Intelligence Portal to alert our clients about this newly discovered operation and began writing YARA rules in order to catch more samples . According to the Fxmsp , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks . Afterwards , the installer malware creates a downloader and a configuration file from its resource and executes it . Malwarebytes customers are protected as we detect the infrastructure and final payload used in these attacks .


] com on port 22011 . In 2015 , Suckfly conducted a multistage attack . Directory of Government Services.pdf : Tracked by Mandiant as FREEFIRE , it is a lightweight backdoor written for .NET .


First , the attacker’s mission is to disrupt an operational process rather than steal data . The McAfee Advanced Threat Research team discovered a previously unknown data-gathering implant that surfaced in mid-February 2018 .


Infrastructure FTP server The attackers used ftp : //213.174.157 [ . In one of the samples received for analysis , the US-CERT Code Analysis Team observed botnet controller functionality . APT33 : 91.235.142.76 mywinnetwork.ddns.net . It supports loading arbitrary .NET assemblies encoded as Base64 sent to it via chat comments .


In previous incidents involving this threat actor , we observed them using malicious documents hosted on websites about the Indian Army , instead of sending these documents directly as an email attachment . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) .


Answer from the C2 The C2 will check the country field , if it 's empty or if the country is not targeted , it will reply with a " Unauthorized '' answer . Most targets are from the Middle East : Israel , Egypt , Saudi Arabia , United Arab Emirates and Iraq . DUDELL : File Name :E quipment Purchase List 2018-2020 (Final ).xls . p - macos-55554944c2a6eb29a7bc3c73acdaa3e0a7a8d8c7


The server can use this information to determine if the user ’ s carrier is one of Bread ’ s targets . We identified an overlap in the domain voguextra.com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post . The last type of Kernel modification that ZxShell rootkit performs is the system call dispatcher ( KiFastCallEntry ) hook . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


Like HammerDuke , SeaDuke appears to be used by the Dukes group primarily as a secondary backdoor left on CozyDuke victims after that toolset has completed the initial infection and stolen any readily available information from them .


To be more specific , the malware uninstalls cloud security products by Alibaba Cloud and Tencent Cloud . Instead of Flash exploits , older Wild Neutron exploitation and watering holes used what was a Java zero-day at the end of 2012 and the beginning of 2013 , detected by Kaspersky Lab products as Exploit.Java.CVE-2012-3213.b .


Nevertheless , users should practice proper security hygiene to mitigate threats that may take advantage of a home or business router ’ s security gaps . It was previously believed that the attackers used scripts to manipulate legitimate software on the server into enabling the fraudulent activity . Dropurl : kentona[.su – 47.245.58.124 https://kentona[.su/xpepriubgpokejifuv7efrhguskdgfjn/ananas.exe https://kentona[.su/xpepriubgpokejifuv7efrhguskdgfjn/pasmmm.exe C2: 217[.12.201.159 TA505 : 0c88e285b6fc183c96b6f03ca5700cc9ca7c83dfccc6ad14a946d1868d1cc27325 TA505 : 1ee1ba514212f11a69d002005dfc623b1871cc808f18ddfa2191102bbb9f623b TA505 : fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 TA505 : c69ce39ac3e178a89076136af7418c6cb664844b0ce5cb643912ed56c373a08a TA505 : 5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3 .


Italian ( Subito.apk ) and French ( Leboncoin.apk ) versions appeared shortly afterwards in January 2019 . FireEye iSIGHT Intelligence believes that APT37 is aligned with the activity publicly reported as Scarcruft and Group123 . Both files were stored in "C:\Windows" .


Conversations-based app mimics Telegram messenger Even when we originally thought this was a backdoored version of the Conversations app , used to infect victims , we didn´t discovered anything malicious in it . When the group's focus shifted to banks , the decoy documents were related to banking system regulations or advisories from FinCERT , an organization created by the Russian government to provide help and guidance to its financial institutions . But both group seem to have different TTPs ( Tactics , Techniques and Procedures ) and it leads us to believe that one group regularly lurks in the other ’s shadow .


Record audio using the computer ’s microphone .


The service is implemented in the class com.serenegiant.service.ScreenRecorderService which is declared in the package manifest . Taking that into account , we classify the Lamberts as the same level of complexity as Regin , ProjectSauron , Equation and Duqu2 , which makes them one of the most sophisticated cyber espionage toolkits we have ever analysed . Intrusions and campaigns conducted by this group are in-line with PRC goals and self-interest in Taiwan . Adversaries may also make changes to victim systems to abuse non - standard ports .


In aggregate , the type of information stolen could let an attacker know where a person is , with whom they are associated ( including contacts ’ profile photos ) , the messages they are sending , the websites they visit and search history , screenshots that reveal data from other apps on the device , the conversations they have in the presence of the device , and a myriad of images including anything at which device ’ s camera is pointed . The Turla group is known to be painstaking and work in stages , first doing reconnaissance on their victims' systems before deploying their most sophisticated tools such as Carbon . Each Svchost session can contain multiple shared services that are organized in groups . Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality , or without the logical preconditions to trigger their expected function .


This behavior can be detected using a tool called WinLister , which enumerates hidden windows .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . In this blog post , we discussed two separate malware variations that behave in very similar ACTs and use similar techniques to acquire a C2 address , with both using Yahoo Answers and Quora to evade traditional mechanisms for blocking command and control domains .


The malware is also issuing commands to download and execute other malware families such as the banking Trojans Dridex and Qakbot . One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) .


In March 2016 , Symantec published a blog on Suckfly , an advanced cyberespionage group that conducted attacks against a number of South Korean organizations to steal digital certificates .


With no clear declaration of usage from Shun Wang , nor proper regulatory supervision , such data could circulate into underground markets for further exploit , ranging from rogue marketing , targeted telephone scams or even friend referral program abuse during November’s Single’s Day and December’s Asian online shopping fest . In this sample , however , the module names were changed from actors and characters’ names to car models , namely BMW_x1” , BMW_x2” and up to BMW_x8” .


Anomali Researchers were able to identify multiple samples of malicious RTF documents ITW using the same exploit for CVE-2018-0798 . No zero-day vulnerabilities were used to breach targeted networks , instead " TG-3390 relied on old vulnerabilities such as CVE-2011-3544 " — a near-year-old Java security hole — " and CVE-2010-0738 to compromise their targets " , Dell SecureWorks' researchers reported .


Interestingly , there is an allowlist of tapped activities : ui.ConversationActivity ui.ConversationListActivity SemcInCallScreen Quadrapop SocialPhonebookActivity The listener can operate with only coordinates , so it calculates pressed characters by matching given values with hardcoded ones : Additionally , if there is a predefined command , the keylogger can make a screenshot of the tapped display area : Manual access and operator menu There is a hidden menu ( Activity ) for controlling implant features that It is suspected that spear phishing is the primary delivery mechanism for Volgmer infections ; however , HIDDEN COBRA actors use a suite of custom tools , some of which could also be used to initially compromise a system . APT33 : dedfbc8acf1c7b49fb30af35eda5e23d3f7a202585a5efe82ea7c2a785a95f40 S-SHA2 POSHC2 backdoor . In late May , SentinelLabs observed a new Iranian statesponsored APT , which they dubbed Agrius , as conducting an extensive espionagedestruction campaign against Israeli targets since 2020 .


Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials . In this report , we'll review how NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan .


We have provided an updated version of those conclusions , a layout of the tactics that they generally employ , as well as observations of apparent tactical shifts .


This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch .


http://ditetec.com S-DOM/ts.exe http://ditetec.com S-DOM/u2.exe http://domass.com.ua S-DOM/index.gif http://firop.com S-DOM/ego.exe http://unoset.com S-DOM/jpx.exe http://unoset.com S-DOM/sxr.exe https://doci.download S-DOM/inc.exe https://farhenzel.co S-DOM/gls.exe https://farsonka.co S-DOM/trb.exe https://formsonat.co S-DOM/mrb.exe https://fortuma.co S-DOM/scu.exe https://iilliiill.bid S-DOM/6ven.exe https://iilliiill.bid S-DOM/ven.exe https://iilliiill.bid S-DOM/ven.tvv https://lom.party S-DOM/mov.exe https://naiillad.date S-DOM/ex3.exe https://naiillad.date S-DOM/u3.exe https://naiillad.date S-DOM/vmer.exe https://naiillad.date S-DOM/vsync.exe https://notepad-plus-plus.org/repository S-DOM/7.x/7.4.2/npp.7.4.2.Installer.exe https://prof.cricket S-DOM/wp.exe https://tvavi.win S-DOM/pago.exe .


) You should also avoid the temptation to play games from sources other than legitimate app stores ; such games are not safe and may bring harm to your reputation and your bank account . The Hong Kong government was spied on by the Winnti hackers . Back in 2013 , CopyKittens used several Facebook profiles to spread links to a website impersonating Haaretz news , an Israeli newspaper .


The naming scheme used by Novetta for the malware identified during Operation Blockbuster consists of at least two identifiers which each identifier coming from the International Civil Aviation Organization ( ICAO ) 's phonetic alphabet ,2 commonly referred to as the NATO phonetic alphabet . Unit 42 recently published a blog on a newly identified Trojan called Bookworm , which discussed the architecture and capabilities of the malware and alluded to Thailand being the focus of the threat actors' campaigns .


In most so-called Western versions of the Trojan , the package names in the default configuration file are erased . In addition to TALOS investigation on KONNI , on July 18 2017 , BitDefender released a whitepaper on DarkHotel . This is of course simple but often it can be enough for a user to miss something malicious by name .


The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities . Users who failed to patch their systems may find themselves mining cryptocurrency for threat actors .


Filename : ntslwin.exe MD5 : 7e67122d3a052e4755b02965e2e56a2e Filename : ~de03fc12a.docm MD5 : 9d703d31795bac83c4dd90527d149796 . templates.dotm dropped the following :


Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials . INF ﬁles have been used in the past by MuddyWater , although they were launched using Advpack.dll and not IEAdvpack.dll .


SpyNote RAT builder The SpyNote Remote Access Trojan ( RAT ) builder is gaining popularity in the hacking community , so we decided to study its pervasiveness . In February 2019 , Russian media7 reported a Silence attack on IT Bank in the city of Omsk . The Cobalt group misused Cobalt Strike , for instance , to perpetrate ATM cyber heists and target financial institutions across Europe , and interestingly , Russia .


We did not apply this to any live C2 servers – we only tested this with our own servers in our lab .


Android Trojan Found in Targeted Attack 26 MAR 2013 In the past , we ’ ve seen targeted attacks against Tibetan and Uyghur activists on Windows and Mac OS X platforms . Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 . Considering the volume of Naikon activity observed and its relentless , repeated attack attempts , such a confrontation was worth looking into , so we did .


Over the years Kaspersky is tracked multiple campaigns by the Animal Farm group . Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa .


APT10's unprecedented campaign against MSPs , alleged to have included some of the largest MSPs in the world , in order to conduct secondary attacks against their clients , grants the Chinese state the ability to potentially access the networks of hundreds (if not thousands) of corporations around the world . This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others .


XLoader abuses the MessagePack ( a data interchange format ) to package the stolen data and exfiltrate it via the WebSocket protocol for faster and more efficient transmission . The operation , known as FASTCash” has enabled Lazarus to fraudulently empty ATMs of cash . The TA505 group is one of the most active threat groups operating since 2014 , it has traditionally targeted Banking and Retail industries , as we recently documented during the analysis of the “ Stealthy Email Stealer ” part of their arsenal .


This post discusses an earlier variant of the backdoor attributed to the MoleRATs group .


2013 in figures A total of 143,211 new modifications of malicious programs targeting mobile devices were detected in all of 2013 ( as of January 1 , 2014 ) . In March 2017 , Wikileaks published details about an exploit affecting Mikrotik called ChimayRed . Since Winnti is also a malware family , we always write “ Winnti Group ” when we refer to the malefactors behind the attacks . TIEDYE has similarities to RABBITHUNT , which is a backdoor written in C++ that communicates via a custom binary protocol over TCP .


In a 5-month timespan , actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging , back-connect proxy or RAT capabilities . They also identified broadly similar TTPs being used in the attack against a U.S law firm specializing in intellectual property law . We also identified www.gokickes.com was the C2 of another Invader variant ( 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb ) .


Maker May 12 , 2016 Mohit Kumar How to Hack an Android device ? this SWC was used to specifically target Turkish banking . Outlaw : b68bd3a54622792200b931ee5eebf860acf8b24f4b338b5080193573a81c747d Shellbot Backdoor.SH.SHELLBOT.AA . To prevent ProxyNotShell exploitation on older Microsoft Exchange servers , Microsoft released a blog4 advocating for a custom inside the Microsoft IIS server supporting Exchange .


We observed the following customizations :


HummingBad does this by silently installing promoted apps on infected phones , defrauding legitimate mobile advertisers , and creating fraudulent statistics inside the official Google Play Store . We also recently discovered that Lazarus successfully planted their backdoor ( detected by Trend Micro as BKDR_BINLODR.ZNFJ-A ) into several machines of financial institutions across Latin America . APT33 : 37.48.105.178 servhost.hopto.org . Others include Excel spreadsheets that contain socially engineered instructions on how to enable macros in Excel so that the malicious VBA code can be executed .


Like multiple other Chinese cyber espionage actors , TEMP.Periscope has recently re-emerged and has been observed conducting operations with a revised toolkit . Upon execution , it will communicate with an attacker-controller website to download a variant of the Pony malware , pm.dll” along with a standard Vawtrak Trojan .


We also found several apps containing the malware , which were developed by other developers on Google Play . The Winnti umbrella and closely associated entities has been active since at least 2009 . Finally the main network communication function GetIpListAndConnect is called . The strings are obfuscated using the stack and simple Bitwise operation .


Then the application downloads java archive from the URL specified in json , dynamically loads it with class loader API . The other overlapping files are tools used by the adversary to locate other systems on the network etool.exe , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 checker1.exe and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) . In addition to DustySky , the attackers use publicly available tools such as the following Remote Administration Tools ( RAT ) : Poison Ivy , Nano Core , XtremeRAT , DarkComet and Spy-Net .


In this case , a small group reusing exploit code , some powershell-based malware and mostly social engineering has been able to steal sensitive documents and data from victims since at least November 2015 . In another modification , first observed in the most recent October 11 Parliamentarian operation ( version agewkassif ) , the developer (s ) of KeyBoy began using a string obfuscation routine in order to hide many of the critical values referenced within the malware .


SPLM / CHOPSTICK components deployed throughout 2017 were native 64-bit modular C++ Windows COM backdoors supporting http over fully encrypted TLSv1 and TLSv1.2 communications , mostly deployed in the second half of 2017 by Sofacy .


The same happens with the package squareup.otto , which is an open-source bus implementation focused on Android implementation . The Callisto Group has been active at least since late 2015 and continues to be so , including continuing to set up new phishing infrastructure every week . Similar to the newly discovered HIGHTIDE samples documented above , this malicious document dropped a backdoor to C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe . Enterprise T1482 Domain Trust Discovery During the SolarWinds Compromise , APT29 used the Get - AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell .


This document 85da72c7dbf5da543e10f3f806afd4ebf133f27b6af7859aded2c3a6eced2fd5 appears to have been targeting a North American government organization dealing with foreign affairs .


Since the size is controlled by the attacker , it ’s possible to overflow the fixed size buffer with certain data .


Until 2013 however , earlier Duke toolsets had not been put in a proper context .


The case where we observed this involved WhatsApp . The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware . Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists , activists , and dissidents since at least 2012 .


Throughout 2017 , we observed two versions of BACKSWING and saw a significant increase in May with an apparent focus on compromising Ukrainian websites . To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys .


Once a valid card with a malicious EMV chip is detected , RIPPER will instantiate a timer to allow a thief to control the machine . The malware will then install fake certificates in the system to perform a MitM attack without notifying the user .


While the number of Sogu targets is currently small relative to the Poison Ivy attacks , we continue to monitor their activities .


The fake bitmap image embedded as resource The 32-bit stage 2 malware uses a customized loading mechanism ( i.e. , the PE file has a scrambled IAT and relocation table ) and exports only one function . Although we have only observed APT33 use DROPSHOT to deliver TURNEDUP , we have identified multiple DROPSHOT samples in the wild that delivered wiper malware we call SHAPESHIFT . All exports contain the exact same code which will decrypt the payload , inject it into memory , and execute it . STRATOFEAR ’s code references five predefined module types that have an ID value and an internal name :


Of course , it 's also possible that whatever group The Shadow Brokers have exposed simply gained access to the Stuxnet tools secondhand , and reused them . Since early 2013 , we have observed activity from a unique threat actor group , which we began to investigate based on increased activities against human right activists in the beginning of 2015 .


These actors have also used Adobe Flash player vulnerabilities to gain initial entry into users' environments .


Patchwork is known for rehashing off-therack tools and malware for its own campaigns . This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics .


This confirms Tropic Trooper is using Poison Ivy as part of their toolkit , something speculated in the original Trend Micro report but not confirmed by them . One government official puts it very matter-of-factly: Winnti is very specific to Germany .


The software generated 2FA code as it appeared on the device ’ s display ( left ) and as available in the database ( right ) Along with the malicious DEFENSOR ID app , another malicious app named Defensor Digital was discovered . In all likelihood , Waterbug’s use of Crambus infrastructure appears to have been a hostile takeover . The attackers behind Operation GhostSecret used a similar infrastructure to earlier threats , including SSL certificates used by FakeTLS in implants found in the Destover backdoor variant known as Escad , which was used in the Sony Pictures attack .


Passive DNS results on a communications domain associated with the Shamoon attack revealed related network infrastructure , identifying additional domains used by the threat actors .


This attack campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes .


This version appeared as Wabi Music , and copied a popular video-sharing social networking service as its backend login page . Today at the Security Analyst Summit ( SAS 2016 ) , Kaspersky Lab is announcing the discovery of two new gangs engaged in APT-style bank robberies – Metel and GCMAN – and the reemergence of the Carbanak group with new targets in its sights . And , While one of his signatures uses his own blog domain , there is also a second signature which uses 93[.]gd , a domain that was found to have been actively selling VPS services in the past .


The additional samples targeted the same large Central Asian nation state as previously mentioned but more interestingly , one of the samples was a weaponized document also leveraging DDE and containing a non-Zebrocy payload .


Some of the C2 servers are located in Thailand . To show how this breach and similar breaches can be mitigated , we look at how Windows Defender ATP flags activities associated with BARIUM , LEAD , and other known activity groups and how it provides extensive threat intelligence about these groups . Using this approach , the attackers amassed at least 60 C&C servers over time . As we have seen over the years , SocGholish is an established player that has managed to compromise countless victims and deliver ransomware after facilitating the installation of tools like Cobalt Strike or Mimikatz .