Coralco Tech is an organization located in Cyprus and providing interception tools . Since 2011 , the robbers had allegedly been stealing money directly from bank accounts in Russia and other countries of the Commonwealth of Independent States ( CIS ) by using a Trojan called Lurk . The Base64 blob is of particular interest . The HyperText Transfer Protocol ( HTTP ) redirect status response code indicates that the resource requested has been temporarily moved to the URL given by the header .


Another common step taken by threat actors is changing their system's MAC Address to avoid being uniquely identified . This was the case in two known intrusions in 2015 , where attackers named the implant DLL " ASPNET_FILTER.DLL " to disguise it as the DLL for the ASP.NET ISAPI Filter .


NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used , prior to public knowledge of the vulnerability 's existence . Kazuar generates its mutex by using a process that begins with obtaining the MD5 hash of a string " [username]=>singleton-instance-mutex " .


Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . Kaspersky Lab has detected a new method of first infection that uses a drive-by-download with a flash exploit ( CVE-2015-5119 , the one leaked from The Hacking Team incident ) .


Together , during the latter half of 2018 , we worked to remove the apps from the Play store while it was being deployed in the wild . The exploit , which takes advantage of CVE-2018-4878 , allows an attacker to execute arbitrary code such as an implant . However , the group behind MuddyWater has been known to target other countries in the Middle East , Europe and the US .


This is odd because attackers almost never set up an actual webpage on adversary C2 infrastructure .


Moreover , there are many toolkits like the SpyNote Trojan builder that enable users to build malware with ease and few clicks . The hackers will map a company’s network and look for strategically favorable locations for placing their malware . Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent .


They mentioned an Android , iOS and Windows remote access tool ( RAT ) . When we first encountered Lurk , in 2011 , it was a nameless Trojan . Opening the .PDF file drops and executes a malware in a victim ’s system . We should note that SocGholish used to retrieve media files from separate web requests until more recently when it started using self - contained Base64 encoded images .


Russia , like many nations , has long viewed success in the Olympic Games as a source of national prestige and soft power on the world stage .


A brief timeline of this activity is shown in Figure 1.Figure 1: Timeline of this recently observed spear phishing campaign . FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform .


] com or hxxp : //apple-icloud [ . Given the mission , resourcing , and location of PLA Unit 61398 , we conclude that PLA Unit 61398 is APT1 . After the initial checks described above, Glimpse creates a hidden file that contains an agent ID, which is a simple concatenation of a random number 10-99 and the first 8 characters of a GUID without . Apropos of my retrospective report , Bullock found that a great many messages in Biderman ’s inbox were belligerent and anti - Semitic screeds from a former Ashley Madison employee named William Brewster Harrison .


One of the most impressive features of this malware is its resilience . APT10 is known to have exfiltrated a high volume of data from multiple victims , exploiting compromised MSP networks , and those of their customers , to stealthily move this data around the world . OceanLotus : ecaeb1b321472f89b6b3c5fb87ec3df3d43a10894d18b575d98287b81363626f Loader #2 . The adversary may drop or create malware , tools , or other non - native files on a target system to accomplish this , potentially leaving behind traces of malicious activities .


On the other hand , it ’ s extremely easy for the crooks to re-direct communications to another freshly created account , ” explains Štefanko . Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials . Lazarus was previously known to conduct cyberespionage and cybersabotage activities , such as attacks on Sony Pictures Entertainment with volumes of internal data leaked , and many system harddrives in the company wiped .


One of the more prolific actors that we track - referred to as TA505 - is responsible for the largest malicious spam campaigns we have ever observed , distributing instances of the Dridex banking Trojan , Locky ransomware , Jaff ransomware , The Trick banking Trojan , and several others in very high volumes .


The attackers may have also downloaded and installed additional tools to penetrate the network further .


In the analysis that follows , we describe in detail the capabilities of this new variant and a “ kill switch ” that can remotely eliminate the malware from a mobile device . In addition to the aforementioned post-exploitation tools , the actors used these webshells to upload legitimate executables that they would use DLL sideloading to run a malicious DLL that has code overlaps with known Emissary Panda attacks . The email contained an attachment named Seminar-Invitation.doc , which is a malicious Microsoft Word document we track as ThreeDollars .


to eSurv S.R.L . This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 . We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro ) , an Iran-nexus actor that has been active since at least May 2017 .


Based on the timeline , it appears that the actors were actively developing several of the loaders at the same time from 2009 until the early months of 2014 . On November 10 , 2015 , Lotus Blossom sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


Since May 2017 , Mandiant experts observed North Korean actors target at least three South Korean cryptocurrency exchanges with the suspected intent of stealing funds . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload .


THE DUKES 7 YEARS OF RUSSIAN CYBERESPIONAGE .


APK SHA256 Size ( bytes ) First Seen App Package name App name 0589bed1e3b3d6234c30061be3be1cc6685d786ab3a892a8d4dae8e2d7ed92f7 2,740,860 May 2016 com.android.henbox DroidVPN Table 1 Details of the HenBox DroidVPN app on the uyghurapps [ . Hackers usually take precautions , which experts refer to as Opsec . A China-based cyber threat group , which FireEye tracks as an uncategorized advanced persistent threat ( APT ) group and other researchers refer to as admin@338 , may have conducted the activity .


The document was not the only one discovered in the recent attack waves .


] com hxxp : //mailsa-wqu [ . The APT28 , which is linked to the Russian government , returned to low-key intelligence-gathering operations during 2017 and into 2018 , targeting a range of military and government targets in Europe and South America . Performing entropy calculations on subdomain labels can help highlight the amount of randomness in a label, but this is just one of many possible data analysis points, since a standalone feature may not be enough to determine whether traffic is . More information TunnelVision has been observed exploiting Fortinet FortiOS CVE201813379 , Microsoft Exchange ProxyShell and the recent Log4Shell vulnerabilities .


In the past , Scarlet Mimic has primarily targeted individuals who belong to these minority groups as well as their supporters , but we've recently found evidence to indicate the group also targets individuals working inside government anti-terrorist organizations . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


Attackers can point and click their way through a compromised network and exfiltrate data . The ultimate objective of targeted attacks is to acquire sensitive data .


According to slide 22 , " CSEC assesses , with moderate certainty , SNOWGLOBE to be a state-sponsored Cyber Network Operation effort , put forth by a French intelligence agency " . As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware .


They also relied on Nbtscan , net user , and ping commands to obtain insights and identify opportunities for lateral movement .


JULY 2015 , APT28 used two domains ( nato-news.com and bbc-news.org ) to host an Adobe Flash zero-day exploit to target NATO , the Afghan Ministry of Foreign Affairs , and the Pakistani military .


Follow the instructions at the bottom of this page . We assess with high confidence that Sea Turtle was targeted in an attempt to re-establish access to the NetNod network , which was previously compromised by this threat actor . PROMETHIUM is an activity group that has been active since at least 2012 .


This attack campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes . In 2016 , the threat actors conducted a strategic web compromise ( SWC ) on the website of an international industry organization that affected aerospace , academic , media , technology , government , and utilities organizations around the world .


We have identified no collaboration between the two actors , or even an awareness of one by the other .


ALLMSG – send C & C all SMSs received and sent by user , as stored in phone memory . Symantec detects this threat as Backdoor.Nidiran . Our investigation of Leafminer started with the discovery of JavaScript code on several compromised websites in the Middle East .


Finally , a new Windows service is created with the service path pointing to the candidate .exe located in this new directory together with the freshly created , benign-looking DLL . The group has repeatedly used social media , particularly LinkedIn , to identify and interact with employees at targeted organizations , and then used weaponized Excel documents to deliver RATs such as PupyRAT . Executes the payload by overwriting the return address on the stack . The dropper first creates a shortcut file but the dropped DLL is launched with rundll32.exe instead of regsvr32.exe .


The launcher page picks one of two Flash files to deliver depending upon the target ’s platform ( Windows 32 versus 64bits ) .


All the the payloads observed by Cybereason in this campaign were packed by a powerful yet commercial packer called Enigma Packer .


The PlugX malware can be configured to use HTTP , DNS , raw TCP , or UDP to avoid network-based detection .


The dropper is a repacked legitimate application which contains an additional piece of code – “ loader ” . Threat actors have targeted the government of Thailand and delivered the newly discovered Bookworm Trojan since July 2015 . The early stages of a Dexphot infection involves numerous files and processes . Proxy : Multi - hop Proxy A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 ( RDP ) , 139 ( Netbios ) , and 445 ( SMB ) enabling full remote access from outside the network and has also used TOR .004


Attacks on Windows XP allows mobile malware to infect a PC after connecting a smartphone or tablet . Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection . The algorithm used to decrypt the strings is the same as the one used to decrypt the static strings of the module . Who is the Winnti group ?


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials .


Ongoing activity from attack groups like TA459 who consistently target individuals specializing in particular areas of research and expertise further complicate an already difficult security situation for organizations dealing with more traditional malware threats , phishing campaigns , and socially engineered threats every day .


Creation date is a week before the start of the tournament . APT32 often deploys these backdoors along with the commercially-available Cobalt Strike BEACON backdoor . Samples in this grouping were all hosted on sites that were called by the second stage . We can compare many successful RDP attacks to the equivalent of leaving a window or back door unlocked at our homes , giving the criminal a low barrier to entry .


Here the list of the files potentially dropped during the installation stage : FILE NAME STAGE DESCRIPTION d3d9.dll Stage 4 Malware loader used for UAC environments with limited privileges ; also protected by VM obfuscation aepic.dll , sspisrv.dll , userenv.dll Stage 4 Malware loader used in presence of administrative privileges ; executed from ( and injected into ) a fake service ; also protected by VM obfuscation msvcr90.dll Stage 5 Malware payload injected into Since at least 2013 , the Iranian threat group FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations . A SimpleKeyringInterface class is used to initialize the key , while the IV is passed to the SetCipherWithIV function . The government even offered a reward of up to $ 10 million for information on Cl0p after several federal agencies in the US fell victim to the gang .


PLATINUM 's approach toward exploiting vulnerabilities varies between campaigns . Only one incident involving a Russian bank was promptly identified and prevented that is known to Group-IB .


The Backdoor : System malware ( mcpef.apk and brother.apk ) This tries a few persistence methods by using few anti-uninstall techniques ( described below ) and downloads and executes code from server without user consent . PittyTiger has also been seen using Heartbleed vulnerability in order to directly get valid credentials . Since exposure of its operations in 2013 , APT10 has made a number of significant changes intended to thwart detection of its campaigns .


LEAD and BARIUM are not known for large-scale spear-phishing , so it is unlikely that SOC personnel would have to deal with multiple machines having been compromised by these groups at the same time .


While tracking APT28 , we noted the group ’s interest in foreign governments and militaries , particularly those of European and Eastern European nations , as well as regional security organizations , such as the North Atlantic Treaty Organization ( NATO ) and the Organization for Security and Cooperation in Europe ( OSCE ) , among others .


To improve coverage while minimizing false positives , Windows Defender ATP uses the intelligent security graph to differentiate between suspicious and benign behavior before generating alerts .


But rather than trying to pursue some comparison between the two for identification of superiority ( an approach that will result in unproductive argument and social media warring ) , the point of this post is to highlight the distinctions between these approaches and how – in the case of “ the TRITON actor ” – they result in noticeably different conclusions from similar datasets .


This feature was enabled only in newer versions of TrickMo that were tailored specifically for German banks and use a special application for implementing TAN-based 2FA . The malware checks whether its running on a 32-bit or 64-bit system to determine which PowerShell script to grab from the command and control (C2) server . the group 's targets include an embassy in Belgium .


Stolen Data Figure 8 : Sending data to the attacker . The most recent sample of Bemstour seen by Symantec appears to have been compiled on March 23 , 2019 , eleven days after the zero-day vulnerability was patched by Microsoft . Threat Group-1314 : TG-1314 .


Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before . Several times , APT5 has targeted organizations and personnel based in Southeast Asia .


CTU researchers have observed TG-3390 compromising a target organization's externally and internally accessible assets , such as an OWA server , and adding redirect code to point internal users to an external website that hosts an exploit and delivers malware .


Commands Arguments SCREENSHOT None SYS_INFO None GET_NETWORK None SCAN_ALL None .


Interestingly , " mundizza '' is typical of Calabria , a region in the south of Italy , and more specifically it appears to be language native of the city of Catanzaro . TA549 possesses a diverse malware arsenal including PlugX , NetTraveler , and ZeroT . The macro code does the following : COSMICENERGY Possibly Associated With Russian Government - Funded Power Disruption and Emergency Response Exercises During our analysis of COSMICENERGY , we identified a comment in the code that indicated the sample uses a module associated with a project named “ Solar Polygon ” ( Figure 2 ) .


Executing the modified applications obtained this way would result in the victim being infected with unidentified malware .


The group's primary and likely proprietary RCSession RAT communicates with a hard-coded C2 server using a custom protocol over TCP port 443 .


] 205 [ . For these CozyDuke campaigns however , the Dukes appear to have employed two particular later-stage toolsets , SeaDuke and HammerDuke . In the variants that were obtained during this campaign the file contained a PowerShell script that was approximately 2800 lines . The popularity of social network and media platforms remain on the rise , and we expect cybercriminals to be naturally drawn towards exploiting them however they can .


‘ One-time ’ domains also appeared with names made up of random strings of characters and numbers , combined with the top-level domains .cf , .ga , .gq , .ml , or .tk . The HTA files contained job descriptions and links to job postings on popular employment websites . The WannaCry malware consists of two distinct components , one that provides ransomware functionality and a component used for propagation , which contains functionality to enable SMB exploitation capabilities .


UNITEDRAKE is described as a " fully extensible " data collection tool that is specifically developed for Windows machines to allow operators the chance of controlling a device completely . After reviewing all the malware functionalities , we are confident in saying that the attackers look for victims who answer well-defined characteristics and believe that further stages of the attack are delivered only to those who fit the specific victim profile .


Flash Player com.mwmnfwt.arhkrgajn ffa5ac3460998e7b9856fc136ebcd112196c3abf24816ccab1fbae11eae4954c Flash Player com.wogdjywtwq.oiofvpzpxyo 6ac7e7ed83b4b57cc4d28f14308d69d062d29a544bbde0856d5697b0fc50cde4 Flash Player com.hvdnaiujzwo.fovzeukzywfr Until 2019 , SectorJ04 group had carried out massive website-based hacking activities that mainly utilize ransomware and banking trojans for financial profit , and has also been carrying out information gathering activities to secure attack resources such as email accounts and system login information from users since 2019 . Symantec discovered the most recent wave of Tick attacks in July 2015 , when the group compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


Our investigation shines a light on an often unknown and seedier secret life of code-signing certificates , which is completely unknown to their owners .


• Change server domain Out of these , the most interesting command is the “ install app ” command that downloads an encrypted zip file containing the second phase dex file , unpacks and loads it . We identified APT33 malware tied to an Iranian persona who may have been employed by the Iranian government to conduct cyber threat activity against its adversaries . Like mentioned in modules file names the malware consists of several working threads dedicated to different tasks, including C2 command parsing and data . Among the IP addresses owned by Hack520 is a whole/22 IP Range which we dubbed as the “ PIG RANGE ” .


Figure 14 : Information theft via fake credit card verification using stolen branding Figure 15 : Information theft via fake credit card verification using stolen branding Some of the campaigns appear to have a wider reach based on bit.ly statistics like this one from October 13 , 2017 : Figure 16 : bit.ly statistics for an October 13 , 2017 campaign Over several days during the last three months , Proofpoint researchers observed campaigns using similar techniques targeting the banking customers of Raffeisen and Sparkasse . Once in Frankfurt CIA hackers can travel without further border checks to the 25 European countries that are part of the Shengen open border area — including France , Italy and Switzerland . This group is also known as Shell Crew , WebMasters , KungFu Kittens , and PinkPanther .


APT28 continues to evolve its toolkit and refine its tactics in what is almost certainly an effort to protect its operational effectiveness in the face of heightened public exposure and scrutiny .


Figure 14 . The threat actors used two publicly available techniques , an AppLocker whitelisting bypass and a script to inject shellcode into the userinit.exe process . This attack resembles previous attacks by HIDDEN COBRA conducted against the SWIFT .


The attack was detected as part of a spear phishing against a government organization in Europe in late May 2016 . Trochilus was first reported by Arbor Networks in their Seven Pointed Dagger report tying its use to other targeted Southeast Asia activity .


ORat acts as a flexible loader tool rather than a fully featured remote access tool .


He is responsible for developing tools for conducting attacks and is also able to modify complex exploits and third party software . Once an exploitable page is identified , Clever Kitten will attempt to upload a PHP backdoor to gain remote access to the system .


Like Dridex , Locky is also distributed in an affiliate model ; TA505 exclusively distributes Locky Affid=3 .


] 99 [ . Our visibility into the operations of APT28 - a group we believe the Russian Government sponsors - has given us insight into some of the government 's targets , as well as its objectives and the activities designed to further them . The send counter is used to track the number of chunks sent to the . Given Sandworm ’s global threat activity and novel OT capabilties , we urge OT asset owners to take action to mitigate this threat .


Here is a list of their similarities .


BLOCKER_UPDATE_START – display fake HTML page for update . Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 . Another intrusion approach used by Leafminer seems a lot less sophisticated than the previously described methods but can be just as effective : using specific hacktools to guess the login passwords for services exposed by a targeted system .


The following shows this unused command , which exposed an additional server within Sofacy ’s infrastructure would download and execute an encoded PowerShell script from 92.114.92.102 .


The only known infection vector for SeaDuke is via an existing CozyDuke infection , wherein CozyDuke downloads and executes the SeaDuke toolset .


The activities continue : the most recently observed domain was registered on October 31 , 2017 . Based on our analysis , we can confirm that MuddyWater target Turkish government organizations related to the finance and energy sectors . Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions .


It seems that the main objective of the attackers was information gathering from the infected computers . The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components .


The document files exploit at least three known vulnerabilities in Microsoft Office , which we discuss in the Infection Techniques section . In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets .


The overall process to result in a successful exploitation is :


They have been well documented and well researched with much of their attack methodologies exposed .


While much of the industry focuses on the threats of hardware implants , we can see in this example that adversaries are happy to exploit simpler configuration and security issues to achieve their objectives .


They seem to have specialized knowledge about military operations , as they are focused on stealing specific files such as those that describe navigation routes . Longhorn , which we internally refer to as " The Lamberts " , first came to the attention of the ITSec community in 2014 , when our colleagues from FireEye discovered an attack using a zero day vulnerability ( CVE-2014-4148 ) .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell . In a more recent version of the modified Gh0st RAT malware , Ghost Dragon implemented dynamic packet flags which change the first five bytes of the header in every login request with the controller .


Command & Controls ad1.fbsba [ . Based on information gained from discussion with the initial TRITON/TRISIS responders and subsequent work on follow-on activity by this entity , Dragos developed a comprehensive ( public ) picture of adversary activity roughly matching FireEye 's analysis published in April 2019 , described in various media . campaign targets Palestinian individuals and entities in the Middle East , specifically directed at We searched for the unique string and identified a single match to a cyber range ( aka polygon ) developed by Rostelecom - Solar , a Russian cyber security company that received a government in 2019 to begin training cyber security experts and conducting electric power disruption and emergency response exercises .


The persistent use of social media to identify and manipulate victims indicates that COBALT GYPSY successfully achieves its objectives using this tactic . The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” .


The malware known as Tafacalou ( aka " TFC " , " Transporter " ) is perhaps of greatest interest here , because it acts as an entry point for the more sophisticated spy platforms Babar and Dino . From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space .


In recent years , online activity has gradually been shifting from personal computers to mobile devices . Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word . It is highly likely that this is due to the release of the 2013 FireEye report .


It contains two tables – ‘ supported_devices ’ and ‘ device_address ’ . these threat actors targeted a number of government agencies Threat actors targeted a number of government agencies in East Asia . Operation Soft Cell is a group that is reportedly affiliated with China and is likely state-sponsored .


The function onUserLeaveHint ( ) is called whenever the malware screen is pushed to background , causing the in-call Activity to be automatically brought to the foreground . As the crisis in Syria escalates , FireEye researchers have discovered a cyber espionage campaign , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe . . The campaign started in at least June 2023 , and the ransom note appears to mimic certain aspects of the ransom note used in the global WannaCry attacks from 2017 .


Enabling the “ Toggle Field Codes ” feature reveals the DDE instructions to us and shows that the author had set instructions to size 1 font and with a white coloring .


Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call . After infestation , Weeping Angel places the target TV in a 'Fake-Off' mode , so that the owner falsely believes the TV is off when it is on . FIN7 is a financially-motivated threat group that has primarily targeted the U.S. retail , restaurant , and hospitality sectors since mid-2015 .


The SpyNote RAT registers a service called AutoStartup and a broadcast receiver named BootComplete . The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer . TinyZBot is a bot written in C# and developed by the Cleaver team .


In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks . A significantly improved variant of the Bemstour exploit tool was rolled out in September 2016 , when it was used in an attack against an educational institution in Hong Kong .


This one-line powershell command , stored only in WMI database , establishes an encrypted connection to C2 and downloads additional powershell modules from it , executing them in memory .


Kyrgyzstan Ministry of Foreign Affairs :


In these cases , CozyDuke was instructed by its C&C server to download and execute OnionDuke toolset .


After it is launched , GolfSpy will generate a unique ID for the affected device and then collect its data such as SMS , contact list , location , and accounts in this format : “ % , [ ] , time ” ( shown in Figure 4 ) . The ScarCruft group uses common malware delivery techniques such as spear phishing and Strategic Web Compromises ( SWC ) . Moreover , the builder allows these to modify different IOCs , such as the filenames of wscript.exe or sctasks.exe copies , etc . This is when threat actors create a suite of malware tools and offer them up for sale on illicit websites .


Given previous operational security errors from this actor in the past which resulted in exfiltrated content being publicly accessible Lookout Threat Intelligence is continuing to map out infrastructure and closely monitor their continued evolution . We believe Lazarus started this watering hole attack at the end of 2016 after their other operation was interrupted in South East Asia . If successfully exploited on an unpatched computer , the vulnerability could permit an attacker to install any file on the computer , which effectively permits code execution on the targeted computer . This gave them the ability to launch an unprecedented number of attacks within a short time frame and across a massive scale .


This gives JavaScript run in the WebView access to this method . Bahamut was shown to be resourceful , not only maintaining their own Android malware but running propaganda sites , although the quality of these activities varied noticeably . This simply deletes the ZxShell service key from the Windows registry ( using SHDeleteKey Api ) and all of the subkeys . The second , CVE-2022 - 41080 , has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022 - 41040 used in the ProxyNotShell exploit chain , and it has been marked “ exploitation more likely . ”


After landing on the victim ’ s phone , the RuMMS apps will request device administrator privileges , remove their icons to hide themselves from users , and remain running in the background to perform a series of malicious behaviors . In May 2016 , two apparently unrelated activity groups , PROMETHIUM and NEODYMIUM , conducted attack campaigns in Europe that used the same zeroday exploit while the vulnerability was publicly unknown . Ssdeep : 768:5KCB8tnh7oferuHpC0xw+hnF4J7EyKfJ : oI8XoWruHpp/P4 . COSMICENERGY accomplishes this via its two derivative components , which we track as PIEHOP and LIGHTWORK ( see appendices for technical analyses ) .


Exfiltrated device information and additional sensitive data sent to the C2 server . The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell . The Ke3chang attackers have been active since at least 2010 .


A commonly observed element of implants from VOODOO BEAR — at least until this information was made public in late 2014 — were references in the malware to the 1965 science fiction novel Dune , by Frank Herbert . The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


READ_CONTACTS - Allows the application to read the user 's contacts data . The Carbanak group , which has a long track record of compromising infrastructure belonging to financial institutions , is still active . Additionally , during that time , members of Gorgon Group were also performing criminal operations against targets across the globe , often using shared infrastructure with their targeted attack operations .


This screen persists on the screen and prevents the user from using the navigation buttons . The group 's primary goal is demonstrating to companies that they have weak security . Remsec uses a Lua interpreter to run Lua modules which perform various functions .


Links between XLoader and FakeSpy can give clues to the much broader inner workings of the threat actors behind them . We believe that APT28 's targeting of the MOD aligns with Russian threat perceptions . In our sample traffic, after executing the commands sent via cmd.exe , Glimpse writes the output of the commands in the sendbox directory to the appropriate file names (e.g., 10100 or 10140) prepended with proc (e.g., ) . Although COSMICENERGY does not directly overlap with any previously observed malware families , its capabilities are comparable to those employed in previous incidents and malware .


In some cases , TrickMo may use this feature to intercept SMS messages without the knowledge of the user by activating the lockdown screen and intercepting SMS messages in the background . It is worth noting that during our investigation f-secure uncovered links between infrastructure associated with the Callisto Group and infrastructure used to host online stores selling controlled substances . The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information .


. Silence attacked financial organisations in the UK . In a recent spear-phishing campaign , the Cobalt Group used a known CVE to connect to its C&C server via Cobalt Strike , but ended up revealing all targets .


Note : TERBIUM establishes a foothold throughout the organization and does not proceed with the destructive wiping operation until a specific date/time : November 17 , 2016 at 8:45 p.m . Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) .


These two documents shared multiple data artifacts , such as a shared C2 IP , shared author name , and shared tactics .


The first part of the campaign From Jan. 23 , 2018 , to Feb. 26 , 2018 used a macro-based document that dropped a VBS file and an INI file . Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 .


] com , lending further credence the remaining two domains , gooledriveservice [ . We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 . We assess APT33 works at the behest of the Iranian government .


Customized evasion based on victim profile – The campaign used a publicly available technique to evade AppLocker application whitelisting applied to the targeted systems .


To traverse the firewall , C2 traffic for most TG-3390 tools occurs over ports 53 , 80 , and 443 .


We identified campaigns targeting Thai users and their devices . But even though they share the use of Winnti , the BARIUM and LEAD activity groups are involved in very different intrusion scenarios . In some cases , the compromised servers are hosted on target organizations ’ networks after successful infiltration so the attackers can increase their control of the victims ’ infrastructure . Instead , victims would end up infecting their computers with the NetSupport RAT , allowing threat actors to gain remote access and deliver additional payloads .


First , when a specific recipient was targeted , the mails often purported to be meeting invitations from established business partners .


These ransomware payloads only seem to target Korean systems , since they won’t execute if the system language is not Korean . We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers .


In 2015 , Suckfly conducted a multistage attack between April 22 and May 4 against an e-commerce organization based in India .


RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself . Barium Defendants install the malicious " Win32/Barlaiy " malware and the malicious " Win32/PlugX.L " malware on victim computers using the means described above .


The increasing sophistication of surveillanceware The structure of the surveillanceware indicates it is very sophisticated . From February to September 2016 , WhiteBear activity was narrowly focused on embassies and consular operations around the world . Each Svchost group can contain one or more service names that are extracted from the following registry key , whose Parameters key contains a ServiceDLL value : HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service . The final payload of the July 2023 campaign is njRAT , which increases our confidence that the threat actor 's goals are information stealing and remote control of the targeted systems .


Name winexesvc.exe Size 23552 MD5 77e7fb6b56c3ece4ef4e93b6dc608be0 SHA1 f46f84e53263a33e266aae520cb2c1bd0a73354e SHA256 5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d .


INDRIK SPIDER isn't the only criminal actor running big game hunting operations ; The first ransomware to stake a claim for big game hunting was Samas ( aka SamSam ) , which is developed and operated by BOSS SPIDER . The threat actor used an exploit from the arsenal of the state-sponsored hacker group APT28 .


] somtum [ . In addition to the campaign in Myanmar , Mofang has been observed to attack targets across multiple sectors ( government , military , critical infrastructure and the automotive and weapon industries ) in multiple countries . Such a move requires recoding malware , updating infrastructure , and possibly retraining workers on new processes . Our investigation revealed that the files created on the Exchange servers were owned by the user NT AUTHORITY\SYSTEM , a privileged local account on the Windows operating system .


] 141 2020-04-26 In the course of the investigation , the team discovered a potential link to an additional Android infostealer . The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience . ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints .


HenBox : The Chickens Come Home to Roost March 13 , 2018 at 5:00 AM Unit 42 recently discovered a new Android malware family we named “ HenBox ” masquerading as a variety of legitimate Android apps . Talos now has moderate confidence that the threat actors behind Sea Turtle have been using another DNS hijacking technique . An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


The base64 encoded content downloaded from the Pastebin link is then decoded to an executable and dropped on the system .


In the areas marked ‘ { text } ’ Rotexy displays the text it receives from the C & C . Like PLEAD , Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents . Active since at least 2014 , the Leviathan has long-standing interest in maritime industries , naval defense contractors , and associated research institutions in the United States and Western Europe .


By Claud Xiao September 13 , 2016 at 5:00 AM Over the past two years , we ’ ve observed many cases of Microsoft Windows and Apple iOS malware designed to attack mobile devices . In 2017 , the same entities that were affected by the Okrum malware and by the 2015 Ketrican backdoors again became targets of the malicious actors . The group was attributed as the actor behind the Korea Hydro & Nuclear Power Co.compromise .


Hunter — A web application scanning tool written by @tojen to identify vulnerabilities in Apache Tomcat , Red Hat JBoss Middleware , and Adobe ColdFusion .


] addroider.com ’ . Our investigations revealed that the attackers drove around several cities in Russia , stealing money from ATMs belonging to different banks . There is no evidence that Suckfly gained any benefits from attacking the government organizations , but someone else may have benefited from these attacks .


Outlaw Updates Kit to Kill Older Miner Versions , Targets More Systems .


This creates a chain of events that triggers the automatic pop-up of the ransomware screen without doing infinite redraw or posing as system window . We believe that the Ke3chang attackers are operating out of China and have been active since at least 2010 . Currently malware with the obfuscations is limited , We would also like to thank Trellix for our continued partnership and for providing supporting detection YARA rules and associated indicators .


Translate on the fly the objects the server send to mirrored matching client objects ( will not work if client doesn’t have this object , or renamed it ) .


The big first buffer is used as index for multiple concurrent threads . This Trojan is related to the Elise backdoor described in the Operation Lotus Blossom report . Thus , we do not know the exact purpose of this malicious service . The log messages recorded in the nslog can include connection statistics for SSLVPN and ICA proxy sessions .


] com hxxp : //www [ . The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . Carbon Black product specific content can be located in the User Exchange . certutil.exe


In either case , PLATINUM would need to have gained administrative privileges on targeted systems prior to the feature 's misuse . Attackers then moved on to the motor industry in late May .


It is now clear that after being implicated in the U.S. presidential election attacks in late 2016 , APT28 was undeterred by the resulting publicity and continues to mount further attacks using its existing tools .


These vulnerabilities include :


Application of the data remains challenging , and so to continue our initiative of establishing playbooks for adversary groups , we have added this attack campaign as the next playbook in our dataset .


ESET researchers analyze new TTPs attributed to the Turla group that leverage PowerShell to run malware in-memory only . The group will also use a compromised account to create scheduled tasks on systems or modify legitimate Windows services to install the HIGHNOON and SOGU backdoors . APT41 uses multiple methods to perform lateral movement in an environment , including RDP sessions , using stolen credentials , adding accounts to User and Admin groups , and password brute-forcing utilities . To maintain presence , APT41 relies on backdoors , a Sticky Keys vulnerability , scheduled tasks , bootkits , rootkits , registry modifications , and creating or modifying startup files . APT41 leveraged ROCKBOOT as a persistence mechanism for PHOTO and TERA backdoors . APT41 has also been observed modifying firewall rules to enable file and printer sharing to allow for inbound Server Message Block (SMB) traffic .


be92a751e5abbcd24151b509dbb4feb98ea46f367a99d6f86ed4a7c162461e31 5c4d666cef84abc2a1ffd3b1060ef28fa3c6c3bb4fad1fa26db99350b41bea4c 06081ab7faa729e33b9397a0e47548e75cbec3d43c50e6368e81d737552150a5 753999cb19a4346042f973e30cf1158c44f2335ab65859d3bfa16bca4098e2ef While North Korean cyber operations against specific countries may have been driven by diplomatic factors and perceived insults against Pyongyang , the application of increasingly restrictive and numerous financial sanctions against North Korea probably contributed to the formation of APT38 . you should read his blog post . Continual education for employees to spot phishing attacks is also a key , basic measure with todays threat landscape .


Some indicators may come in the form of peculiar behavior such as unexpected rebooting , finding unfamiliar apps installed , or instant messaging apps suddenly freezing . In a recent spear-phishing campaign , the Cobalt Hacking Group used a remote code execution vulnerability in Microsoft Office software to connect to its command and control server via Cobalt Strike . Additionally here is no mapping information in MMAT_GLBOPT2 because the condition block that contains the variable has been deleted . The response of the initial sent packet knock contains some commands to be executed on the victim machine


DustySky is a campaign which others have attributed to the Gaza Cybergang group , a group that targets government interests in the region .


Take a screenshot of any app in foreground . The group 's targets include a number of organizations and individuals located in Russia . The tactics , techniques , and procedures ( TTPs ) , content , and theme of the decoy documents , as well as the victimology observed in the campaign , resemble previous attacks that have targeted Palestinians . Researchers at Akamai reported on a Magecart skimmer campaign disguised as Google Tag Manager that also made the news with the compromise of one of Canada 's largest liquor store ( LCBO ) .


Using intel from this research , we have made Office 365 ATP more resistant to FinFisher ’ s anti-sandbox checks . First released in 2005 , the tool has gone unchanged since 2008 with v ersion 2.3.2 . The backdoor DLL is stored in the .rdata section of the launcher , compressed with LZMA , and encrypted with RC4 . However , given the lack of conclusive evidence , we consider it also possible that a different actor - either with or without permission - reused code associated with the cyber range to develop this malware .


Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 . Specifically , Suckfly used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows .


Under a model known as sandboxing , most Android apps are n't permitted to access passwords or other data available to most other apps . There are several indicators , which have led CTU researchers to believe with high confidence that NICKEL ACADEMY is behind the current spearphishing campaign . APT33 : 91.230.121.144 remserver.ddns.net . A rough translation of this message is as follows : Hack520 seems to be very interested in hosting services and his profile fits that of a system administrator profile with some programming and hacking skills .


This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample .


The following tools appear to be exclusive to TG-3390 : OwaAuth web shell — A web shell and credential stealer deployed to Microsoft Exchange servers .


60 % of devices containing or accessing enterprise data are mobile . iSiGHT Partners has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 . Commodity RATs also complicate efforts by security professionals to correlate a threat actor 's activity over time—attackers can hide in the sea of malicious activity that also uses Poison Ivy-based malware .


This isn’t a bad thing as it shows a natural grouping of nodes that could be a good candidate to group to help simplify the overall graph and make analysis easier . NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used , prior to public knowledge of the vulnerability 's existence .


The most common way to achieve this is by creating a broadcast receiver that is registered to the “ android.intent.action.BOOT_COMPLETED ” broadcast action and adding code that boots the application when the broadcast is fired . Once in possession of compromised payment card credentials , these actors use tools commonly known as card generators to generate new card numbers based on the compromised ones , creating additional opportunities for monetization . The June 2017 sample of Clayslide contained the same OfficeServicesStatus.vbs file found in the ISMAgent Clayslide document , but instead of having the payload embedded in the macro as segregated base64 strings that would be concatenated , this variant obtained its payload from multiple cells within the " Incompatible " worksheet .


] com/aa hxxp : //nttdocomo-qar [ . Previous work published by security vendor FireEye in October 2014 suggests the group might be of Russian origin . This report is being released to help researchers and security practitioners combat this campaign as new samples are being discovered in the wild daily . They choses the appropriate DLL by passing a flag in the first Argument .


Distribution of victims . This , in turn , would provide access to a larger amount of intellectual property and sensitive data . OceanLotus : plan.evillese.com:8531 11b4 . Seven of the vulnerabilities included in today ’s Vulnerability Roundup have a CVSS severity score of 9.8 out of a possible 10 .


All communication with the C2 is done over HTTP . In addition to the More_eggs malware , ITG08 leveraged in-memory attacks by injecting malicious code , in this case Mimikatz , into legitimate system processes . In this campaign , the Group123 used a classical HWP document in order to download and execute a previously unknown malware : NavRAT .


The malware mainly targets banking and financial applications , but also looks for popular shopping apps such as eBay or Amazon . Symantec has to date discovered 49 different organizations in more than 20 countries that have been attacked by Butterfly . The links between CopyPaste and FIN7 are still very weak . As we have seen over the years , SocGholish is an established player that has managed to compromise countless victims and deliver ransomware after facilitating the installation of tools like Cobalt Strike or Mimikatz .


To be distributed outside the app store , an IPA package must contain a mobile provisioning profile with an enterprise ’ s certificate . The EternalBlue exploit from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 . Given the use of lure documents designed with social engineering in mind , it is likely that MuddyWater use phishing or spam to target users who are unaware of these documents ' malicious nature .


At some point in his Google Play “ career ” , he apparently decided to increase his ad revenue by implementing adware functionality in his apps ’ code . One of them – ipv4.dll – has been placed by the APT with what is , in fact , a downloader for other malicious components . This malware report contains analysis of one 32-bit Windows executable file , identified as a Remote Access Trojan ( RAT ) .


Two details about MiniDuke components are worth noting .


In the latest version , a layer of obfuscation was added , perhaps taking the malware one step closer to being fully operational . Japan is no stranger to banking malware . Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East ( including targets inside Iran itself ) , as well as across Europe and in the United States .


Then , using POST requests to the relative address report.php , it sends data about the device ( IMEI , phone number , country , mobile operator , phone model , availability of root rights , OS version ) , list of contacts , list of installed apps , incoming SMS , and other information . FireEye iSIGHT Intelligence has been tracking a pair of cybercriminals that we refer to as the Vendetta Brothers . Another difference is the directory where the files are dropped , it's no longer C:\Windows but rather the local setting of the current user (%USERPROFILE%\Local Settings\winnit\winnit.exe) .


It is a very unusual way to get Device Administrator rights . PCH is a nonprofit entity based in northern California that also manages significant amounts of the world 's DNS infrastructure , particularly the DNS for more than 500 top-level domains and a number of the Middle East top-level domains targeted by DNSpionage . As we stated in there port , our position was that “ The Chinese government may authorize this activity , but there ’s no way to determine the extent of its involvement. ” Now , three years later , we have the evidence required to change our assessment . • Based on the analysis , it appears that the MiniDuke - s creators provide a dynamic backup system that also can fly under the radar – if Twitter isn - t working or the accounts are down , the malware can use Google Search to find the encrypted strings to the next C2 .


Some actions include ( with rough translations ) : The command-and-control server The command-and-control server is located at IP 64.78.161.133 . Tropic Trooper is also still exploiting CVE-2012-0158 , as are many threat actors . BlackOasis in recent months sent a wave of phishing emails .


The following is a screenshot from IDA with comments showing the strings and JNI functions . Our direct observation of in-the-wild spearphishing attacks staged by the Bahamut group have been solely attempts to deceive targets into providing account passwords through impersonation of notices from platform providers . FileMG File Manager . winvnc Remote Desktop . rPortMap Port Forwarding . capsrv Video Device Spying . zxplug Add and load a ZxShell custom plugin . Wall to Wall reached out in July 2022 about collaborating with Bullock after KrebsOnSecurity published A Retrospective on the 2015 Ashley Madison Breach .


If the device is located outside Russia or is an emulator , the application displays a stub page : In this case , the Trojan ’ s logs contain records in Russian with grammatical errors and spelling mistakes : If the check is successful , Rotexy registers with GCM and launches SuperService which tracks if the Trojan has device administrator privileges . This blog post analyzes several recent Molerats attacks that deployed PIVY against targets in the Middle East and in the U.S. We also examine additional PIVY attacks that leverage Arabic-language content related to the ongoing crisis in Egypt and the wider Middle East to lure targets into opening malicious files . Microsoft addressed the SMBv1 vulnerabilities in March 2017 with Security Bulletin MS17-010 .


] com Counter Measures Use an up to date anti-malware software that is capable of identifying this threat . To enable connections to the infected computer using the Remote Desktop Protocol ( RDP ) , Carbanak sets Termservice service execution mode to Auto . Additionally , the group compromised organizations in Europe and North America that have ties to the Middle East .


Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year .


CTU researchers have observed the threat actors employing legitimate Kaspersky antivirus variants in analyzed samples .


F-Secure ’s whitepaper on CosmicDuke includes a timeline of the loader ’s usage , based on compilation timestamps .


This group famously also reached out to WikiLeaks ( referred to as " Organization 1 " in the indictment ) to amplify their information operation , and they promoted the leaks to journalists through GRU -controlled email and social media accounts .


Perhaps more information on XLoader will be known in the future . We assess that APT28 is most likely sponsored by the Russian government . Once written, the send operations . As confirmed by our own research data , CISA also found LockBit took the top spot as the biggest global ransomware threat in 2022 .


In order to track who opened the phishing emails , viewed the links , and downloaded the attachments in real-time , APT32 used cloud-based email analytics software designed for sales organizations . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East .


The DNC announced it had suffered a network compromise and that a subsequent investigation found evidence of two breaches , attributed to APT28 and APT29 .


CTU researchers have observed BRONZE PRESIDENT targeting multiple NGOs .


Indicators of Compromise SHA256 Package App label 332e68d865009d627343b89a5744843e3fde4ae870193f36b82980363439a425 ufD.wykyx.vlhvh SEX kr porn 403401aa71df1830d294b78de0e5e867ee3738568369c48ffafe1b15f3145588 ufD.wyjyx.vahvh 佐川急便 466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b Some of APT28 's more commonly used tools are the SOURFACE downloader , its second stage backdoor EVILTOSS , and a modular family of implants that we call CHOPSTICK . If the send function is being invoked in ping mode, the process described above is followed; however, instead of manually building and transmitting the DNS query, the [System.Net.Dns]::GetHostAddresses method is . In the months leading up to and after Russia ’s illegal further invasion began , Ukraine experienced a series of disruptive cyber operations , including website defacements , distributed denial - of - service ( DDoS ) attacks , and cyber attacks to delete data from computers belonging to government and private entities – all part of the Russian playbook .


'' The application uses the label " Installer '' and its name is " android.app.Application . The actor attempts to exploit CVE-2018–8440 — an elevation of privilege vulnerability in Windows when it improperly handles calls to Advanced Local Procedure Call — to elevate the privileges using a modified proof-of-concept exploit . In 2017 , APT37 targeted a company in Middle East that entered into a joint venture with the North Korean government to provide telecommunications service to the country .


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework . Turla is a notorious group that has been targeting government officials .


Curiously , Bahamut appears to track password attempts in response to failed phishing attempts or to provoke the target to provide more passwords . Based on analysis of the group 's SWCs , TG-3390 operations likely affect organizations in other countries and verticals .


The iOS apps leverage the same C2 infrastructure as the Android version and use similar communications protocols . While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past , Spring Dragon employs more involved and creative intrusive activity as well . Between February and March 2019 , probable MuddyWater-associated samples indicated that BlackWater established persistence on the compromised host , at used PowerShell commands to enumerate the victim 's machine and contained the IP address of the actor 's command and control ( C2 ) .


TG-3390 uses older exploits to compromise targets , and CTU researchers have not observed the threat actors using zero-day exploits as of this publication . Conversely , LokiBot and Agent Tesla are new malware tools .


Better not to take any chances at all , no matter which version of the OS you use . this RTF exploits again the CVE-2017_1882 on eqnedt32.exe . The vulnerability was patched by Microsoft on Nov 14 , 2017 .


de.dkb.portalapp pl.pkobp.ipkobiznes pl.com.suntech.mobileconnect eu.eleader.mobilebanking.pekao.firm pl.mbank pl.upaid.nfcwallet.mbank eu.eleader.mobilebanking.bre pl.asseco.mpromak.android.app.bre pl.asseco.mpromak.android.app.bre.hd pl.mbank.mnews eu.eleader.mobilebanking.raiffeisen pl.raiffeisen.nfc hr.asseco.android.jimba.rmb PROMETHIUM is an activity group that has been active as early as 2012 . In the recent months , Ukrainian CERT ( CERT-UA ) reported an intensiﬁcation of Gamaredon B-ACT S-APT Cyberattacks against military targets . The Aclip backdoor uses the Slack API to send system data , files , and screenshots to the C2 while receiving PowerShell commands at the same time .


Shamoon2 : 5.254.100.200 .


One of the reasons Winexe is preferred over PSExec , is that it provides a Linux client , while PSExec doesn’t .


Based on the Tafacalou infection logs , we observed that most of the victims are in the following countries : Syria , Iran , Malaysia , USA , China , Turkey , Netherlands , Germany , Great Britain , Russia , Sweden , Austria , Algeria , Israel , Iraq , Morocco , New Zealand , Ukraine . Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems .


, a reference to Hamas military leader Mazen Fuqaha who was assassinated on March 24 , 2017 .


Such notifications would be received by the MiHome app or any other , such as HenBox , so long as they register their intent to do so . Public reports of supply chain compromises linked to APT41 date back to at least 2014 , and technical evidence associated with these incidents was used to determine a relationship , if any , with APT41 . APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


USPS is the most well-known branch of the US government and provides a publicly funded postal service . Recorded Future’s Insikt Group has been monitoring APT33 activity , beginning with research published in October 2017 , which revealed new infrastructure , malware hashes , and TTPs relating to the threat actor(s) . Kaspersky Lab 's research team responded to three financial institutions in Russia that were infected with the GCMAN malware .


Allows an application to read SMS messages . These redactions include ten of thousands of CIA targets and attack machines throughout Latin America , Europe and the United States . The group is believed to be Vietnam based .


Tactical threat intelligence is based on incident response investigations and research , and is mapped to the kill chain .


This blog post describes another attack campaign where attackers used the Uri terror attack and Kashmir protest themed spear phishing email to target officials in the Indian Embassies and Indian Ministry of External Affairs ( MEA ) .


The malware ’ s creators had used obfuscation to upload the new piece of malware to Google Play . Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 . During our analysis of victim networks , we were able to observe APT10 once again initiate a retooling cycle in late 2016 .


Some of the documents exploited CVE-2017-0199 to deliver the payload . The threat actors use a commercial installation tool called Smart Installer Maker to encapsulate and execute a self-extracting RAR archive and in some cases a decoy slideshow or Flash installation application .


Sample 1 may use AES-encrypted strings with reflection , while Sample 2 ( submitted on the same day ) will use the same code but with plaintext strings . Blackgear has been targeting various industries since its emergence a decade ago . The new xor encoding byte is 0x5B . As well as SysUpdate , the attackers used a number of legitimate or publicly available tools to map the network and dump credentials .


The collection of basic device information . APT33 sent spear phishing emails to employees whose jobs related to the aviation industry . The developers used GCC compiler on Windows in the MinGW . Commercial spyware can be seen as having legitimate reasons to exist , especially in instances of crime and terrorism ( as long as it is highly regulated ) .


They are both targeting businesses using accounting software , are fingerprinting systems of interest similarly , are looking for smart card readers , and finally , they deploy an array of malicious tools to spy on their victims . Our investigation showed that these attacks were targeted , and that the threat actor sought to steal communications data of specific individuals in various countries .


July 14 A new zero-day vulnerability ( CVE-2015-2425 ) was found in Internet Explorer . The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled . However , DarkRace is a new ransomware group first discovered by researcher S!Ri .


Table 4 HenBox variant 's Intents and Receivers Most of the intents registered in the AndroidManifest.xml file , or loaded during run-time , are commonly found in malicious Android apps . APT41 is well-known for leveraging compromised digital certificates from video game studios to sign malware . Previous work published by security vendor FireEye in October 2014 suggests the group might be of Russian origin .


Letting an attacker get access to this kind of data can have severe consequences . The document exploited CVE-2012-0158 and will decode and write an executable to disk upon infection . Attackers can point and click their ACT through a compromised network and exfiltrate data .


” some_encrypted_data ” } .


This supports our analysis that the overarching theme in the Dukes ’ targeting is the collection of intelligence to support diplomatic efforts .


] net page for DroidVPN remained identical when serving either HenBox or DroidVPN apps , just that the legitimate APK file had been replaced with HenBox for an unknown period of time . Raiu and his team have followed the digital tracks left behind by some of the Winnti hackers . Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc .


C:\Users\user\runawy.exe .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . Like PLEAD , Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents .


First observed in mid-2014 , this malware shared code with the Bugat ( aka Feodo ) banking Trojan . Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


FrozenCell is part of a very successful , multi-platform surveillance campaign . This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample . We consider these domains to be “ hijacked ” because they were registered by someone for a legitimate reason , but have been leveraged by APT1 for malicious purposes . In our Google Analytics platform , we will see the data as : In our demo the DP will result in page view of Which will be decoded from base64 as : The source of the problem is that the CSP rule system is n’t granular enough .


The out-of-the-box server could not communicate with the client sample owing to the previously documented modifications that we had observed .


Sofacy kicked off the year deploying two 0day in a spearphish document , both a Microsoft Office encapsulated postscript type confusion exploit ( abusing CVE-2017-0262 ) and an escalation of privilege use-after-free exploit ( abusing CVE-2017-0263 ) .


Before patching , the Trojan will backup the original library with a name bak_ { original name } . For example , the actors behind FrozenCell used a spoofed app called Tawjihi 2016 , which Jordanian or Palestinian students would ordinarily use during their general secondary examination . Other threat actors may also be part of this wave of attacks , though there is no confirmation at the current time . For the CrySyS Lab analysis , please read [ here ] .


Meanwhile , parallel work at Dragos ( my employer , where I have performed significant work on the activity described above ) uncovered similar conclusions concerning TTPs and behaviors , for both the 2017 event and subsequent activity in other industrial sectors .


Sofacy , also known as APT28 , Fancy Bear , and Tsar Team , is a highly active and prolific APT .


Cannon opens the email with the correct subject and decodes the hexadecimal data in the body of the message to obtain the secondary email account .


] 26/html2/2018/GrafKey/new-inj-135-3-dark.html hxxp : //88.99.227 [ . Despite last month 's report on aspects of the MuddyWater campaign , the group is undeterred and continues to perform operations . This is the same domain used by the KHRAT S-MAL Trojan E-MAL . Adversaries may manipulate control systems devices or possibly leverage their own , to communicate with and command physical control processes .


There are some indicators that this sample is just a test sample on its final stages of development . Using compromised accounts , LYCEUM send spearphishing emails with malicious Excel attachments to deliver the DanBot malware , which subsequently deploys post-intrusion tools . The APT38 targeted news outlets known for their business and financial sector reporting , probably in support of efforts to identify and compromise additional financial institutions .


As our investigation continued , we soon realized this was much larger than a few hacktools .


DanderSpritz consists entirely of plugins to gather intelligence , use exploits and examine already controlled machines . One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges .


We also discovered during our research that the RAT Server used by this attacker is itself vulnerable to remote attack , a double-edged sword for these attackers .


These threat actors appear to be choosing the right apps – those that could be popular with locals in the region , at the right time – while tensions grow in this region of China , to ensure a good victim install-base . We believe that like other Chinese espionage operators , APT41 has moved toward strategic intelligence collection and establishing access , but away from direct intellectual property theft . APT28 's malware settings suggest that the developers have done the majority of their work in a Russian language build environment during Russian business hours , which suggests that the Russian government is APT28 's sponsor .


The Trojan ’ s assets folder contained the file data.db with a list of possible values for the User-Agent field for the PAGE command ( which downloads the specified webpage ) . Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library ( .dll ) Just last week Lazarus were found stealing millions from ATMs across Asia and Africa .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . While documents designed to exploit the InPage software are rare , they are not new – however in recent weeks Unit42 has observed numerous InPage exploits leveraging similar shellcode , suggesting continued use of the exploit previously discussed by Kaspersky .


We therefore believe the Dukes ’ primary mission to be so valuable to their benefactors that its continuation outweighs everything else .


Downeks also has a self-update capability , if instructed by the C2 .


However , based on the findings shared in this report we assess with high confidence that the actor 's primary long-term mission is politically focused . Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME .


MenuPass is a well-documented CN-APT group , whose roots go back to 2009 . iSiGHT Partners has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 .


campaigns involving both BokBot and TrickBot were first identified by CrowdStrike Intelligence in July 2017 . Group-IB researchers were tracking Silence throughout this period and conducting response following incidents in the financial sector .


For example , if an infected device is connected to a public Wi-Fi network any other host will be able to obtain a terminal on the device without any form of authentication or verification by simply connecting to the port . Most of the group 's attacks are focused on government or technology related companies and organizations . Asala.mp3 : The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


Here are some highlights . Like many espionage campaigns , much of APT40 's activity begins by attempting to trick targets with phishing emails , before deploying malware such as the Gh0st RAT trojan to maintain persistence on a compromised network . TransFile Transfer file in or from remote host . Software developers can use coded certificates to digitally sign their software , which means any code with that signature becomes a trusted source .


Reznov.dll - 17b8665cdbbb94482ca970a754d11d6e29c46af6390a2d8e8193d8d6a527dec3 Custom activity prefix com.cact.CAct Cerberus - A new banking Trojan from the underworld August 2019 In June 2019 , ThreatFabric analysts found a new Android malware , dubbed “ Cerberus ” , being rented out on underground forums . Machete's long run of attacks , focused in Latin American countries , has allowed them to collect intelligence and refine their tactics over the years . We attribute APT38 to North Korean state-sponsored operators based on a combination of technical indicators linking the activity to Pyongyang and details released by DOJ implicating North Korean national Park Jin Hyok in a criminal conspiracy .


The C & C server observed in this campaign is ‘ www [ . Just a few months later , in February 2015 , we announced the discovery of Carbanak , a cyber-criminal gang that used custom malware and APT techniques to steal millions of dollars while infecting hundreds of financial institutions in at least 30 countries . While we don't know the motivations behind the attacks , the targeted commercial organizations , along with the targeted government organizations , may point in this direction .


iSiGHT has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 . PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . More than half of the organizations we have observed being targeted or breached by APT5 operate in these sectors .


By using the login and password stolen from the browser , the Windows Trojan initiates a fake transaction while Perkele intercepts ( via the C & C server ) the mTAN sent by the bank to the user . It is not the first time Turla has used generic tools . SHA256 : 1eda7e556181e46ba6e36f1a6bfe18ff5566f9d5e51c53b41d08f9459342e26c . Harrison even went after Bradshaw ’s lawyer and wife , listing them both on a website he created called Contact - a - CEO[.]com , which Harrison used to besmirch the name of major companies — including several past employers — all entities he believed had slighted him or his family in some way .


There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors . Over the course of three years of observation of campaigns targeting civil society and human rights organizations , from records of well over two hundred spearphishing and other intrusion attempts against individuals inside of Iran and in the diaspora , a narrative of persistent intrusion efforts emerges .


With default settings , SWAnalytics will scan through an Android device’s external storage , looking for directory tencent/MobileQQ/WebViewCheck” . This algorithm was previously discussed by security researchers in a Confucius-related blog post .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " . Callisto Group and related infrastructure contain links to at least Russia , Ukraine , and China .


Example of traffic from an early version of Asacub ( 2015 ) The data transmitted and received is encrypted with the RC4 algorithm and encoded using the base64 standard . Through an IP address whitelisting process , the threat group selectively targets visitors to these websites . Files using simple PHP-based web shells were also used to attack systems with weak SSH and Telnet credentials . CrowdStrike researchers replicated the exploit method attack on Exchange systems that had not received the November 8 , 2022 patch KB5019758 , but could not replicate the attack on systems that had received that patch .


However , Earworm also appears to conduct separate operations from APT28 and thus Symantec tracks them as a distinct group .


Over the year , the number of mobile malware modifications designed for phishing , the theft of credit card information and money increased by a factor of 19.7 . Emissary Panda is still active and continues to target selected organisations . This campaign of the Winnti Group against Hong Kong universities was taking place in the context of Hong Kong facing civic protests that started in June 2019 triggered by an extradition bill . For example , the report shows that the US shouldered a hefty 43 percent of all global attacks and that ransomware attacks in France nearly doubled in the last five months .


TG-3390 actors use command and control ( C2 ) domains for extended periods of time but frequently change the domains' IP addresses .


iSiGHT Partners has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 . There were traces of HyperBro in the infected data center from mid-November 2017 .


All of the most recent versions of EventBot contain a ChaCha20 library that can improve performance when compared to other algorithms like RC4 and AES . According to our telemetry , Okrum was used to target diplomatic missions in Slovakia , Belgium , Chile , Guatemala , and Brazil , with the attackers showing a particular interest in Slovakia . We believe recent activity targeting private interests in Vietnam suggests that APT32 poses a threat to companies doing business or preparing to invest in the country .


Malicious programs intentionally scan for machines with an automated Bank-Customer system of the Central bank of Russia ( further referred to as BCS CBR ) . Our experts have found that cybercriminals are actively focusing on SMBs , and giving particular attention to accountants .


The GandCrab author also had a spat with South Korean security vendor AhnLab last summer after the security firm released a vaccine for the GandCrab ransomware . In another case , Sima mirrored an announcement made about the broadcast of a television program on Iranian-American cultural affairs in order to impersonate the individual and engage in spearphishing within hours of the legitimate message .


And others have all malicious content removed , except for log comments referencing the payment process . Barium has targeted Microsoft customers both in Virginia , the United States , and around the world . I have the same machine infected with two different version of ZxShell . As opposed to the PowerPoint documents that did not display any slides in our testing environments , all Excel documents display legitimate - looking documents related to the targeted military organizations , or generic descriptions on how to enable VBA macro functionality in Excel .


We found nine additional samples sharing the imphash values for the two executables , C66F88D2D76D79210D568D7AD7896B45 and DCF3AA484253068D8833C7C5B019B07 .


The C2 address , as stored in samples we ’ ve seen , comprise both an IP address and port number ; So far , all the samples we ’ ve tested attempted to contact an IP address on port 7878/tcp . Over time these malware similarities diverged , as did targeting , intended outcomes , and TTPs , almost certainly indicating that TEMP.Hermit activity is made up of multiple operational groups primarily linked together with shared malware development resources and North Korean state sponsorship . Instead , If you followed Cybersecurity and Infrastructure Security Agency CISA alerts on ransomware for the year , you would have noted malicious activity attributed to many ransomware variants .


In March , it peaked at 1,169 infections . We also identified another sample of ThreeDollars , created on January 15 , 2017 with the file name strategy preparation.dot . The malware author has a curious sense of humor . Ways our customers can detect and block this threat are listed below .


Shellcode downloads and runs executable payload .


At the same time , it hides an icon and starts background services to hide further actions from the user . Previous analysis of the NewsBeef APT indicates that the group focuses on Saudi Arabian (SA) and Western targets , and lacks advanced offensive technology development capabilities . The White Company is a likely state-sponsored threat actor with advanced capabilities .


] com/ hxxp : //apple-icloud [ . After compromising a victim organization , APT28 will steal internal data that is then leaked to further political narratives aligned with Russian interests . When there are no more bytes to send, a hardcoded file end marker COCTabCOCT is sent in the data section and the send loop will be . Leveraging this access , an attacker can send remote commands to affect the actuation of power line switches and circuit breakers to cause power disruption .


The additional commands that attackers can carry out via a socket connection ( top ) and the key used to encrypt the stolen data ( bottom ) Correlating Bouncing Golf 's Activities We monitored Bouncing Golf ’ s C & C-related activities and saw that the campaign has affected more than 660 devices as of this writing . The other one , " Operation Erebus " employs an older exploit , for CVE-2016-4117 and leverages watering holes . Even though we have been able to retrieve four different modules , it is possible that the FIN7 operators have more modules in their toolsets for achieving their objectives on the victim’s workstation . It contains features such as having the victim ’s email address pre - filled and displaying their appropriate company logo and background image , extracted from the target organization ’s real Microsoft 365 login page .


This DealersChoice Flash object shares a similar process to previous variants ; however , it appears that the Sofacy actors have made slight changes to its internal code .


Intelligence collection directed by nation state actors against US political targets provides invaluable insight into the requirements directed upon those actors .


The malware may communicate with its command and control (C2) server over The Onion Router (Tor) network if configured to do so . Since 2011 , the robbers had allegedly been stealing money directly from bank accounts in Russia and other countries of the Commonwealth of Independent States ( CIS ) by using a Trojan called Lurk .


The GoogleUpdate.exe component is responsible for communicating with the remote C&C server . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign .


The nine stolen certificates originated from nine different companies who are physically located close together around the central districts of Seoul , South Korea .


TG-3390 uses the PlugX remote access tool .


Also , in some versions of the Trojan the file names were random strings of characters . For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer . Notably , after the first SMB packet sent to the victim 's IP address , WannaCry sends two additional packets to the victim containing the hard-coded IP addresses 192.168.56.20 and 172.16.99.5 .


The C & C server IP addresses used also appear to be disparate , as they were located in many European countries like Russia , France , Holland , and Germany . Kaspersky speculates that ScarCruft could also be behind another zero-day , CVE-2016-0147 , a vulnerability in Microsoft XML Core Services that was patched in April . A few days after the tweet , in January 2019 , the operators changed their landing page in order to prevent this type of tracking against their infrastructure . Greatness is specifically designed to work in a standardized way so that the experience is the same for each customer who buys into the service , potentially allowing anyone with a moderate amount of technical ability to carry out advanced , convincing phishing attacks .


Known CozyDuke modules include : Command execution module for executing arbitrary Windows Command Prompt commands , Password stealer module , NT LAN Manager ( NTLM ) hash stealer module , System information gathering module , Screenshot module .


This sort of functionality is more common in criminality-oriented botnets , not statesponsored targeted attacks .


We first started tracking Bread ( also known as Joker ) in early 2017 , identifying apps designed solely for SMS fraud . A current round of cyber-attacks from Chinese source groups are targeting the maritime sector in an attempt to steal technology . The command processing function starts by substituting the main module name and path in the hosting process PEB , with the one of the default internet browser . The attacks that Anonymous Sudan has claimed in support of KillNet , both before and after it officially joined the collective , have broadened the geographic scope of its targeting to include entities elsewhere in Europe and the U.S. ; it has since continued to expand the scope of its targeting further afield to include countries such as Israel and Ethiopia .


The WIZARD SPIDER threat group , known as the Russia-based operator of the TrickBot banking malware , had focused primarily on wire fraud in the past . This week we will discuss another Chinese nexus adversary we call Samurai Panda .


The code for downloading and executing the next stage malware .


Allows applications to change network connectivity state . The CIA also runs a very substantial effort to infect and control Microsoft Windows users with its malware . DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016 .


TL ; DR Google Play Protect detected and removed 1.7k unique Bread apps from the Play Store before ever being downloaded by users Bread apps originally performed SMS fraud , but have largely abandoned this for WAP billing following the introduction of new Play policies restricting use of the SEND_SMS permission and increased coverage by Google Play Protect More information on stats and relative impact is available in the Android Security 2018 Year in Review report BILLING FRAUD Bread apps typically fall into two categories : SMS fraud ( older versions ) and toll fraud ( newer versions ) . Dragos does not corroborate nor conduct political attribution to threat activity . The command processing is straightforward . Subsequently , KillNet claimed to have compromised NATO ’s training site , Joint Advanced Distributed Learning , and published dozens of purportedly leaked images on its channels .


The commands available are located in one of the configuration blobs mentioned earlier .


In the next sections , for simplicity , we will continue the analysis only on the 64-bit payload . Ties to SHAPESHIFT suggest that APT33 may engage in destructive operations or shares tools or development resources with an Iranian threat group that conducts destructive operations . On top of that , the decoded payload is also encrypted with AES-128 and finally obfuscated with XOR 0x3B . This then offered a means to log on using email providers , which could then capture the passwords and user names .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia . If a target of the spear phishing described in " Phase 2 : malware deployment " opened the email attachment and , crucially , clicked on the icon in the attachment , this would lead to the target 's computer becoming infected with the " Scout " malware tool from the RCS Galileo platform .


PROMETHIUM is an activity group that has been active as early as 2012 . Using the Kaspersky Security Network ( KSN ) and artifacts from malware files and attack sites , we were able to trace the attacks back to March 2015 .


The group runs custom batch scripts to collect specific file types and takes proactive steps to minimize detection of its activities .


This alert contains indicators of compromise ( IOCs ) , malware descriptions , network signatures , and host-based rules to help network defenders detect activity conducted by the North Korean B-IDTY E-LOC government .


The trojan uses the Android Accessibility API to intercept all interactions between the user and the mobile device . Security researchers subsequently linked these attacks to a broader , yearlong campaign that targeted not just Israelis but Palestinians as well . ShadowHammer : https://liveupdate01s.asus.com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER362.zip . Threat actors typically register and use several domains in order to discretely lead their malware to their Command and Control ( C&C ) servers .


The short links in the spearphishing emails redirected victims to a TG-4127 controlled URL that spoofed a legitimate Google domain .


On 24 March 2019 , Silence.ProxyBot (MD5 2fe01a04d6beef14555b2cf9a717615c) was uploaded to VirusTotal from an IP address in Sri Lanka . These samples appeared to have been created by OilRig during their development and testing activities , all of which share many similarities with the delivery document used in the recent OilRig attack against a Middle Eastern government , N56.15.doc ( 7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00 ) that we have also included in Table 1 .


In the image below , we can see a packet that was sent to the attacker ’ s C & C containing collected information along with stolen SMS data . PLATINUM uses a number of different custom-developed backdoors to communicate with infected computers . First identified in January 2015 , Orangeworm has also conducted targeted attacks against organizations in related industries as part of a larger supply-chain attack in order to reach their intended victims .


The OwaAuth web shell is likely created with a builder , given that the PE compile time of the binary does not change between instances and the configuration fields are padded to a specific size .


After decompiling the sample , we were able to document the modifications from the open-source Quasar .


Allows an application to read or write the system settings . The attack against Samsung smart TVs was developed in cooperation with the United Kingdom's MI5/BTSS . FIN8 is a financially motivated threat group known to launch tailored spearphishing campaigns targeting the retail , restaurant , and hospitality industries .


Allows applications to open network sockets . The CIA's Mobile Devices Branch (MDB) developed numerous attacks to remotely hack and control popular smart phones . A portion of FIN7 was run out of a front company called Combi Security .


As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC . Once an exploitable page is identified , the actor will attempt to upload a PHP backdoor to gain remote access to the system .


To date , all observed Snake Wine 's attacks were the result of spear phishing attempts against the victim organizations . Group-IB specialists determined that the email addresses of IT bank employees were among the recipients of these emails .


Also , Bookworm uses a combination of encryption and compression algorithms to obfuscate the traffic between the system and C2 server . After the initial compromise , TG-3390 delivers the HTTPBrowser backdoor to its victims .


the Android platform have received media attention . Active since 2012 , it has so far targeted Taiwanese government agencies and private organizations . This is used in some of the newer 3.22 and 3.39 samples . In addition , more ransomware gangs are attacking targets multiple times a month : the number of groups carrying out more than one known attack per month in the UK has climbed steadily for a year , from just one in July 2022 to eight in June 2023 .


In some cases , the decompilation process will fail , and “ Agent Smith ” will try another method for infecting the original application – A binary patch , which simply provides a binary file of the “ boot ” module of “ Agent Smith ” . Buhtrap is getting better at disguising the code they inject into compromised websites . The said obfuscated script is designed to check for antivirus products . While FakeSG appears to be a newcomer , it uses different layers of obfuscation and delivery techniques that make it a threat to take seriously and which could potentially rival with SocGholish .


A ptrace_attach syscall is called . The objective of the attacks is clearly espionage – they involve gaining access to top legislative , executive and judicial bodies around the world . The malware then communicates directly with the retrieved and decoded IP address to receive commands and send stolen information . Once they are downloaded to the machine , they can fetch a larger backdoor which carries out the cyberespionage activities , through functions such as copy file , move file , remove file , make directory , kill process and of course , download and execute new malware and lateral movement tools .


The cryptominer employed by Pacha Group , labeled Linux.GreedyAntd by Intezer , was completely undetected by all leading engines , demonstrating the sophistication of this malware . A preliminary analysis caught the attention of our Threat Analysis and Intelligence team as it yielded interesting data that , among other things , shows that Silence was targeting employees from financial entities , specifically in the Russian Federation and the Republic of Belarus .


Symantec has had the following protections in place to protect customers against APT28 attacks :


The theme also reflects the targeting of the group which primarily focuses on NATO members , countries in Central Asia and those neighboring Russia .


iSiGHT Partners has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 . The Poseidon Group actively targets this sort of corporate environment for the theft of intellectual property and commercial information , occasionally focusing on personal information on executives .