PLATINUM uses custom-developed malicious tools and has the resources to update these applications often to avoid being detected . Our analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan .


The macro obtains the payload saved to the system from within the document stored as UserForm1.Label2.Caption and will write it to : %APPDATA%\MSDN\~msdn.exe .


The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros . The SDK , named SWAnalytics is integrated into seemingly innocent Android applications published on major 3rd party Chinese app stores such as Tencent MyApp , Wandoujia , Huawei App Store , and Xiaomi App Store .


Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit.MSWord.CVE-2010-333 , Exploit.Win32.CVE-2012-0158 . These include CVE-2010-3962 as part of an attack campaign in 2010 and CVE-2014-1776 in 2014 . Beginning in August 2016 , a group calling itself the Shadow Brokers began releasing tools it claimed to have originated from the Equation Group .


This disallows apps to be installed on your device from unknown sources . Our technical analysis of the malware used in these attacks showed close ties to BS2005 backdoors from operation Ke3chang , and to a related TidePool malware family discovered by Palo Alto Networks in 2016 that targeted Indian embassies across the globe . Ke3chang has targeted several industries , including oil , government , military , and more .


APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel files to deliver their initial exploits . Earlier this month , Securelist 's technology caught another zero-day exploits deployed in targeted attacks .


This example shows one possible implementation of this technique . In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker , 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks . The second December spear phishing attack targeted Taiwan based news media organizations . Last week , the Biden administration released its formal roadmap for its national cybersecurity initiative meant to encourage greater investment in cybersecurity and strengthen the U.S. ’s critical infrastructure security ( and more ) .


Also , it appears that the actors used ActionScript from an open source video player called “ f4player ” , which is freely available on GitHub .


This was no longer detectable with static signatures by our product .


It is generally considered a descendant of the Dyreza banking Trojan and features mutliple modules .


While Vcrodat is delivered via the malicious dropper , we have yet to discover how Nibatad is delivered to the infected computer . We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 ( EternalBlue ) vulnerability patched in MS17-010 .


TRITON is a highly specialized framework whose development would be within the capability of a low percentage of intrusion operators .


It 's one of the strings - " How you 'll sign in '' - that it looks for during the account creation process . Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor.Sogu . Though the security community has not yet broadly discussed this technique , FireEye has observed other threat groups adopting these measures and expect this trend to continue on other community sites . For the CrySyS Lab analysis , please read [ here ] .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . According to statistics , Corkow primarily targets users in Russia and the CIS , but it is worth noting that in 2014 the amount of attacks targeting the USA increased by 5 times , in comparison with 2011 .


Attributes of one of the artifacts and intelligence gathered on the infrastructure operated by the attackers suggest that the attack was perpetrated by a state-sponsored group known as Sofacy ( or APT28 ) .


QiAnXin confirmed that this is a DarkHydrus Group’s new attack targeting Middle East region . However , the unique malware variant , BlackEnergy 3 , reemerged in Ukraine early in 2015 , where we had first found Sandworm Team .


A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . Over the last 10 months , Kaspersky Lab researchers have analyzed a massive cyber-espionage operation which we call " Epic Turla " .


Given the nature of connected devices in smart homes , it ’ s highly likely many of these devices , and indeed the controller app itself , communicate with one another sending status notifications , alerts and so on . Although we do not have first-hand evidence of APT41's compromise of TeamViewer , we have observed APT41 use compromised TeamViewer credentials as an entry point at multiple organizations . The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


It is installed as an ISAPI filter .


Triada is a modular mobile Trojan that actively uses root privileges to substitute system files and exists mostly in the device ’ s RAM , which makes it extremely hard to detect . Earlier this month , Securelist 's technology caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . In May 2016 , Unit 42 began researching attacks that used spear-phishing emails with attachments , specifically malicious Excel spreadsheets sent to financial organizations within Saudi Arabia .


The phishing site uses the gathered information as its GET parameter , allowing the attacker to access the stolen information . It is possible , although not confirmed , that APT16 was also responsible for targeting this government agency , given both the timeframe and the use of the same n-day to eventually deploy the ELMER backdoor . The malware sends another TXT query with the receiver structure, as depicted . Attackers could exploit these vulnerabilities to carry out a variety of attacks , in some cases gaining the ability to execute remote code on the targeted machine .


Extracting the payload is straight forward – we simply dump the resource and decompress it .


Once a valid card with a malicious EMV chip is detected , RIPPER will instantiate a timer to allow a thief to control the machine . Both Win32/Barlaiy & Win32/PlugX.L are remote access " trojans " , which allow Barium to gather a victim 's information , control a victim 's device , install additional malware , and exfiltrate information fi-om a victim 's device .


The commands supported by the analyzed version of the Cerberus bot are listed below . We saw SectorJ04 group activity in Germany , Indonesia , the United States , Taiwan , India . The Middle Eastern hacker group in this case is codenamed " BlackOasis " .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team . We noted in our original blog the large amount of targeting of Iranian citizens in this campaign , we observed almost one-third of all victims to be Iranian .


This feature is designed to block one application from accessing the data of other applications without rooting the device . If the attackers are attempting to compromise persons involved in SEC filings due to their information access , they may ultimately be pursuing securities fraud or other investment abuse . The email address is associated with the Lebanese domain of a major global financial institution .


We observed the string “ 1FABFBFF0000065132F71D94 ” in memory during debugging of the native variant .


This was an original spyware program , designed to exfiltrate almost all accessible information . Fxmsp specialize in breaching highly secure protected networks to access private corporate and government information . In order to deploy an implant for the final payload , ScarCruft uses a multi-stage binary infection scheme . In addition to SocGholish , the Domen toolkit was a well - built framework that emerged in 2019 while another campaign known as sczriptzzbn dropped SolarMarker leading to the NetSupport RAT in both cases .


INTRODUCTION For the past few weeks , the Cybereason Nocturnus team has been investigating a new type of Android malware dubbed EventBot , which was first identified in March 2020 . We encountered the first document exploit called " THAM luan - GD - NCKH2.doc " a few days ago , which appears to be leveraging some vulnerabilities patched with MS12-060 . iDefense analysts have identified a campaign likely to be targeting members of— or those with affiliation or interest in—the ASEAN Defence Ministers ' Meeting ( ADMM ) .


After a series of technical analysis ( which is covered in detail below ) and heuristic threat hunting , we discovered that a complete “ Agent Smith ” infection has three main phases : A dropper app lures victim to install itself voluntarily . We believed that the actors would use this date code to track their attack campaigns ; however , after continued analysis of the malware , we think these static dates could also be a build identifier for the Trojan . Insights from one year of tracking a polymorphic threat . Monitor network data flows for unexpected patterns and metadata that may be indicative of a mismatch between protocol and utilized port .


We sourced the over 561MB of exfiltrated data from this domain alone , all of which we found to be 7z compressed and password protected . " IRIDIUM has hit more than 200 government agencies , oil and gas companies and technology companies , including Citrix Systems Inc " , they said . The technology-themed zones reference well-known technology companies ( AOL , Apple , Google , Microsoft ) , antivirus vendors ( McAfee , Symantec ) , and products ( Blackberry , Bluecoat ) . Looking at the top 3 M domains , only 210 K use CSP .


The samples we identified leverage the same user agent string “ OPAERA ”


We observed many web landing pages that mimic the sites of mobile operators and which are used to spread the Android implants . Our analysis revealed that they drop a new backdoor , which is written in PowerShell as MuddyWater’s known POWERSTATS backdoor . Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver .


As you can see in the following screenshot , simply attempting to highlight the lines in which the DDE instructions reside does not display them .


This mobile malware masquerades as legitimate , trusted postal service applications so that it can gain the users trust . The attacker also connected to the compromised servers from IP addresses that were linked to dynamic domain names used as C&Cs by the delivered payloads . There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group ; although posted in March 2018 , it refers to a campaign in 2017 .


The command uses the echo command to write a large chunk of base64 encoded data to a text file named cmd.txt .


Symantec Security Response has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks . On June 7 , 2013 , Rapid7 released an analysis of malware dubbed ' KeyBoy ' , also exploiting unknown vulnerabilities in Microsoft Office , similarly patched by MS12-060 , but allegedly targeting interests in Vietnam and India .


Instead , the Spring Dragon group is known to have employed spearphish exploits , strategic web compromises , and watering holes attack . While Operation Emmental was able to bypass two-way authentication by tricking its victims into installing a fake app , we have not observed OSX_DOK.C doing this .


The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method . Starting in December 2014 , the criminal group began running keyloggers in the infected system .


Malwr.com observed this site in association with another sample that called out to mailsinfo.net – a host identified in the Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA blog .


The malicious application sends a request to choose a network account , a specific account that can only be processed by authentication services exported by the malicious application . As explained later , we believe this campaign is financially-motivated and that it targets accounting departments in Russian businesses . Dexphot usually extracts the decompressed files to the target system ’s Favorites folder . The themed " updates " look very professional and are more up to date than its SocGholish counterpart .


More details on this protection is available in the conclusion of the report .


One of the most notable functions of the initial dropper is to bypass Windows UAC ( User Account Control ) in order to execute the next payload with higher privileges . Clever Kitten primarily targets global companies with strategic importance to countries that are contrary to Iranian interests .


We also found a Windows version of the UnionCryptoTrader ( 0f03ec3487578cef2398b5b732631fec ) .


Kaspersky found Zebrocy deploying a compiled Python script , which we call PythocyDbg , within a Southeast Asian foreign affairs organization: this module primarily provides for the stealthy collection of network proxy and communications debug capabilities . The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME .


Sending C2-specified SMS messages to phone numbers in the victim ’ s contacts . PROMETHIUM uses a unique set of tools and methods to perform actions like lateral movement and data exfiltration . This vbs is properly the macro executed by the macro engine of word . Threat actors are always looking to expand the strategies they use , thus security practices and solutions that work for less organized cybercriminals might not work for determined groups who are willing to spend time , resources and manpower to accomplish their goals .


In later versions , another encryption layer is added using Curve25519 encryption . According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 . APT32 poses a threat to companies doing business or preparing to invest in Vietnam .


Their similarity is made more apparent by looking at their naming method for downloadable files , domain structure of fake websites and other details of their deployment techniques , exemplified in figure 10 . APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy . In our sample, after the malware sent the 0 action, the controller responded with an A record containing 24.125.10.140 . Future cybercriminal campaigns on social network platforms may not be so gentle .


Proofpoint researchers have observed a well-known Russian-speaking APT actor usually referred to as Turla using a new .NET/MSIL dropper for an existing backdoor called JS/KopiLuwak . Group-IB specialists tracked a massive mailout of emails containing a malicious Microsoft Word attachment titled Договор.doc” [Contract.doc] .


The oil and gas infrastructure nexus observed in connection with greensky27.vicp.net and other Unit 78020 ( Naikon ) infrastructure suggests targeting patterns supportive of the PRC 's strategic interests over energy resources within the South China Sea and Southeast Asia . This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge .


Once a foothold is established , they try to upload more backdoors , USB stealers as well as other hacking tools such as “ Mimikatz ” for lateral movement .


The attackers send fake text messages to lure the victims to click on a malicious link . Typically , APT10 tends to employ a namesquatting scheme in their domains that aims to confuse the observer by posing as a legitimate domain . The threat group using these implants has been active since at least 2014 and has been seen targeting individuals likely involved in the Ukrainian government .


PLATINUM primarily targets its intended victims using spear phishing . In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker , 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks .


ac5abaebd9f516b8b389450f7d27649801d746fb14963b848f9d6dad0a505e66 3a45d7a16937d4108b5b48f44d72bb319be645cbe15f003dc9e77fd52f45c065 Domains cvcws [ . The Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information . The newest campaign uses updated versions of Aumlib and Ixeshe . The themed " updates " look very professional and are more up to date than its SocGholish counterpart .


The steps implemented include : Load a URL in a WebView Run JavaScript in WebView Toggle WiFi state Toggle mobile data state Read/modify SMS inbox Solve captchas Captchas One of the more interesting states implements the ability to solve basic captchas ( obscured letters and numbers ) . Thus far , Bahamut 's campaigns have appeared to be primarily espionage or information operations – not destructive attacks or fraud . The first thread is the “ communication ” thread . If executed successfully , LIGHTWORK provides the operator the following command - line output : Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis .


Wh1sks estimated that , between June and early August , the Shadow Brokers have made up to $88,000 in an alternative cryptocurrency called Monero . Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body . For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2. This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP PROT 443 . Previous reports have discussed Bisonal malware used in attacks against Japan , South Korea and Russia . This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others . If it's Cyrillic and the command to the shell is not ‘ipconfig’ , the threat converts the command result text encoding from Cyrillic to UTF-16 . Similar to the Bisonal variant targeting the Russian organization , this sample was also disguised as PDF document .


The “ boot ” module has placeholder classes for the entry points of the infected applications . We initially became aware of Careto when we observed attempts to exploit a vulnerability in our products to make the malware " invisible " in the system . Not only is it harder to detect the malicious code while it ’s running , it ’s harder to find useful forensics after the process has stopped . In addition to SocGholish , the Domen toolkit was a well - built framework that emerged in 2019 while another campaign known as sczriptzzbn dropped SolarMarker leading to the NetSupport RAT in both cases .


The targeting of Chinese nationals may also be related to this campaign , but equally may be part of a separate campaign by the adversary or even as part of them selling Surveillance-As-A-Service in a similar manner previously seen with the HANGOVER group . KeyBoy provides basic backdoor functionality , allowing the operators to select from various capabilities used to surveil and steal information from the victim machine .


The Janus vulnerability , which allows the actor to replace any application with an infected version . We noticed that criminals were spreading Buhtrap using this method from May 2015 to August 2015 . exe ( for extracting files from the password-protected ZIP archive ) , rundll32.exe ( for loading the loader DLL ) , schtasks.exe ( for scheduled tasks ) , powershell.exe ( for forced updates ) . User Execution : Malicious Link APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link .002 User Execution : Malicious File APT29 has used various forms of spearphishing attempting to get a user to open attachments , including , but not limited to , malicious Microsoft Word documents , .pdf , and .lnk files .


The set of permissions required by Marcher according to the manifest is as follows : ∗ android.permission.CHANGE_NETWORK_STATE ( change network connectivity state ) ∗ android.permission.SEND_SMS ( send SMS messages ) ∗ android.permission.USES_POLICY_FORCE_LOCK ( lock the device ) ∗ android.permission.RECEIVE_BOOT_COMPLETED ( start malware when device boots ) ∗ android.permission.INTERNET ( communicate with the internet ) ∗ android.permission.VIBRATE The oldest sample we've seen up to now is from November 2013 . As our analysis demonstrates , ZxShell is an effective tool that can be ultimately used to steal user credentials and other highly valuable information . Having such a gap with the most commonly used domain allowed with CSP is a major risk indicator of the threats that can come from other domains that are used to serve multiple accounts .


This specific IP address is a critical piece of information that enables us to connect this attack to a spree of previous targeted campaigns .


] it Firenze server4fi.exodus.connexxa [ . TEMP.Veles created a custom malware framework and tailormade credential gathering tools , but an apparent misconfiguration prevented the attack from executing properly . Zavantazhyty means to load or download in Ukranian . For Snort coverage that can detect the exploitation of these vulnerabilities , download the latest rule sets from Snort.org , and our latest Vulnerability Advisories are always posted on Talos Intelligence ’s website .


The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon . Such attacks highlight the need for caution before downloading files from unknown sources and enabling macro for files from unknown sources .


There are several indicators ( see section " trojan activity '' below ) that it is in its last stages of development , but it has the potential to be a serious threat . Cloud Atlas remains very prolific in Eastern Europe and Central Asia . FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims .


Instead , we feel the targeting of drug dealers was a new task for a subset of the Dukes group , possibly due to the drug trade ’s relevance to security policy issues .


It uses the same technique as it used to determine the offset to the mmap function . In March 2014 , the gang behind Potao started using a new infection vector . APT17 : 4c21336dad66ebed2f7ee45d41e6cada . The page hxxp://[c2_hostname]/groups / business - principles.html is used as an starting point for the attack .


Based on our observations of interactions in this channel , between May 2016 and June 2016 , malicious actors validated 2 , 987 cards from 62 countries , with the most coming from the U.S. (nearly half) , Brazil , and France . Additionally , HELIX KITTEN actors have shown an affinity for creating thoroughly researched and structured spear-phishing messages relevant to the interests of targeted personnel .


The original leak is no longer available on github.com , but a copy can be found here . Longhorn , which we internally refer to as " The Lamberts " , first came to the attention of the ITSec community in 2014 , when our colleagues from FireEye discovered an attack using a zero day vulnerability ( CVE-2014-4148 ) . The IXESHE campaign has been successfully executing targeted attacks since 2009 . As Google Analytics is allowed in the CSP configuration of many major sites , this demo shows how an attacker can bypass this security protection and steal data .


5db49122d866967295874ab2c1ce23a7cde50212ff044bbea1da9b49bb9bc149 70e2eea5609c6954c61f2e5e0a3aea832d0643df93d18d7d78b6f9444dcceef0 80810a8ec9624f317f832ac2e212dba033212258285344661e5da11b0d9f0b62 8453ce501fee1ca8a321f16b09969c517f92a24b058ac5b54549eabd58bf1884 Dragos assesses with moderate confidence that XENOTIME intends to establish required access and capability to cause a potential , future disruptive—or even destructive—event . Vydalyty means to remove or delete in Ukrainian . • None consisting of CVE-2022 - 41080 and CVE-2022 - 41082 to achieve remote code execution ( RCE ) through Outlook Web Access ( OWA ) .


It 's also raising eyebrows because of the connection with China , which has frequently sparred with the U.S. over cyber espionage . Rapid7 reviewed malware discovered in the victim’s environment and found implants that used Dropbox as the C2 . Daserf : f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 .


The code and functionality have changed numerous times ; from simple unobfuscated malware at the beginning to sophisticated multi-stage spyware that gives attackers full remote control of the infected device . MuddyWater compiles various offensive Python scripts . Taidoor is a threat group that has operated since at least 2009 and has primarily targeted the Taiwanese government .


The group uses legitimate administration tools to fly under the radar in their post-exploitation phase , which makes detection of malicious activity , as well as attribution more complicated . This is a hacking group with Chinese origins which targets selected organisations related with education , energy and technology .


As a result , CTU researchers were unable to ascertain the initial access vector .


This Arabic-speaking group uses spear phishing attacks to infect target machines in the Middle East and North Africa with various Remote Access Trojans ( RATs ) .


According to our data , 0.4 % of the websites visited by users of our products were compromised sites . attacks to a Chinese-speaking threat actor group called LuckyMouse . In this case , the launcher is much simpler . What makes COSMICENERGY unique is that based on our analysis , a contractor may have developed it as a red teaming tool for simulated power disruption exercises hosted by Rostelecom - Solar , a Russian cyber security company .


First , based on information that is associated with the registered C & C domain , we identified the name of the registrant , along with further data like country and email address , as seen in Figure 8 . The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . SHA256 : eb90e40fc4d91dec68e8509056c52e9c8ed4e392c4ac979518f8d87c31e2b435 .


The group has repeatedly used social media , particularly LinkedIn , to identify and interact with employees at targeted organizations , and then used weaponized Excel documents to deliver RATs such as PupyRAT . This includes Python scripts . Usually , the Stageless Meterpreter has the Ext_server_stdapi.x64.dll” , Ext_server_extapi.x64.dll” , and Ext_server_espia.x64.dll” extensions .


If this file is not present , it is recreated from a hardcoded encrypted array inside the body of the DLL .


FireEye observed that BACKSWING , a malicious JavaScript profiling framework , was deployed to at least 54 legitimate sites starting as early as September 2016 . These emails included recruitment-themed lures and links to malicious HTML Application ( HTA ) files .


'' " According to our statistics , as of today , there 're more than 500 , 000 Android devices infected by this bootkit in China in last six months . Where they exist , they often use grey market or pirated software . APT1 establishes a foothold once email recipients open a malicious file and a backdoor is subsequently installed . [ c2_hostname ] The purpose of the shellcode is to download a GIF image file from URL hxxp://[c2_hostname]/groups / pic.gif , then search for and decrypt the hidden PE file inside of it .


The content of the HTTP POST data is telemetry data in a json format about the device the malware is running on . The APT38 targeted news outlets known for their business and financial sector reporting , probably in support of efforts to identify and compromise additional financial institutions . After the modification , Depending on the platform and on how the code is compiled , these vulnerabilities could lead to arbitrary code execution : Talos is disclosing these vulnerabilities despite no official fix from Open Babel .


Wmiexec — This publicly available tool uses WMI to create SYSTEM-level shells on remote hosts .


params : This command allows the malicious operator to change configuration parameters in the malware . MuddyWater has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia . KHRAT : File Name : 8081.dll . The usage of the h and m parameters and its values local and net are very similar to arguments used by Conti .


Should a user enable this content , Gallmaker is then able to use the DDE protocol to remotely execute commands in memory on the victima 's system . On January 15 , Confiant exposed the activity of the Zirconium group , spreading malicious ads via a network of fake ad agencies through 2017 , in what amounted to the largest malvertising campaign of recent times .


The first malicious sample we identified ( 6843AE9EAC03F69DF301D024BFDEFC88 ) had the file name “ testproj.exe ”


After that , it begins to harvest information stored on the device . In this latest campaign , APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER . The group primarily uses Truvasys , a first-stage malware that has been in circulation for several years .


Kaspersky Internet Security for Android and the Sberbank Online app securely protect users against attacks by this Trojan . The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon . The Leviathan group has specifically targeted engineering , transportation , and the defense industry , especially where these sectors overlap with maritime technologies .


Due to the sheer number of recipients , it may not have been possible to customize the emails in the same way as was possible with lower-volume campaigns .


As mentioned earlier , we believe that OSX_DOK.C might be the MAC OS X version of WERDLOD , an online banking malware that used the same techniques as Operation Emmental .


Hackers can hide their apps ’ real intentions or even manipulate users into leaving positive ratings , in some cases unknowingly . Dragos does not publicly describe ICS activity group technical details except in extraordinary circumstances in order to limit tradecraft proliferation . The MainConnectionIo function checks if the Windows Firewall is enabled , sets the Tcp Keep Alive value and Non-blocking mode connection options and receives data from the remote host through the ReceiveCommandData function . • Other actors merged into this group : 0 Sign up for free Mandiant Threat Intelligence for detailed reports about UNC groups including :


APT33 leverages a mix of public and non-public tools and often conducts spear-phishing operations using a built-in phishing module from " ALFA TEaM Shell " , a publicly available web shell . We have reported the issues to the UPX team , and they have already fixed it .


FireEye believes that two actors – Turla and an unknown financially motivated actor – were using the first EPS zero-day CVE-2017-0261 , and APT28 was using the second EPS zero-day CVE-2017-0262 along with a new Escalation of Privilege (EOP) zero-day CVE-2017-0263 . The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


While WERDLOD and OSX_DOK.C use different codes ( since they target different operating systems ) , they have similar proxy settings and script formats .


We have chosen to join forces to continue the investigation around Gooligan . Further , the recent DOJ complaint provides insight into initial compromise techniques conducted by North Korean operators against APT38 targets , which may have been leveraged as part of the initial compromise into the targeted organizations . referred to as maturity levels . The threat actor then used the built - in certutil utility to Base64 encode the segments .


] netsybil-parks [ . Amongst a backdrop of other incidents , Infy became one of the most frequently observed agents for attempted malware attacks against Iranian civil society beginning in late 2014 , growing in use up to the February 2016 parliamentary election in Iran . For example , “ hugesoft.org ” is an FQDN but also represents a zone . Monitor for newly constructed files that may attempt to hide artifacts associated with their behaviors to evade detection .


APT28 : AT THE CENTER OF THE STORM .


In fact , they were extremely open and verbose about their functionality - for example , early samples contained a plethora of logging messages in unencrypted form .


WildFire properly classifies these Downeks and Quasar samples as malicious .


The com.dsufabunfzs.dowiflubs strings in the screenshot above refer to the internal name this particular malware was given , which in this case was randomized into alphabet salad . APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world 's largest cyber heists . ANEL ( also referred to as UpperCut ) an internal user may have fallen prey to a spear phishing attack ,


This campaign is named after a rare backdoor used by the MoleRATs Group , dubbed Spark by Cybereason and previously reported by 360 ’s blog .


The activity class “ org.starsizew.MainActivity ” executes when the app is started . In December 2015 , Symantec published a post about " two Iran-based attack groups that appear to be connected , Cadelle and Chafer " that " have been using Backdoor.Cadelspy and Backdoor.Remexi to spy on Iranian individuals and Middle Eastern organizations " . Finally the macros are executed using the Ofﬁce engine . If the main function is called with only , it will take the path that is intended for connect to the MSSQL server and , upload • None are supplied to the main function , it will immediately fail due to attempting to utilize command line arguments that were not parsed yet .


Broadcast Receivers are Android components that can register themselves for particular events . In the former Soviet Union , Silence targeted banks in Kyrgyzstan , Kazakhstan , and Ukraine . At certain times , Mesri has been a member of an Iran-based hacking group called the Turk Black Hat security team " .


It is interesting that the attackers used Java Base64 library developed by Sauron Software . LuckyMouse has been spotted using a widely used Microsoft Office vulnerability ( CVE-2017-11882 ) . NEODYMIUM used a backdoor detected by Windows Defender as Wingbird , whose characteristics closely match FinFisher , a government-grade commercial surveillance package .


XLoader can also start other attacker-specified packages . A previous , removed , report from another vendor claimed non-specific information about the groups' interest in Chinese universities , but that report has been removed – most likely detections were related to students’ and researchers’ scanning known collected samples and any incidents” remain unconfirmed and unknown . It contains information like : Server address and port the client will connect to ; The password chosen by the attacker for the remote access ; The ID associated to the victim client .


At the time of writing Lookout has observed two updates to the Dardesh application , the first on February 26 and the second on March 28 . However , from this it 's only clear that Lazarus might have attacked Polish banks . The Elfin espionage group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries . None The discovery was part of recent CrowdStrike Services investigations into several Play ransomware intrusions where the common entry vector was confirmed to be Microsoft Exchange .


Other research have also connected the OSX malware and Retefe ( the external term used for WERDLOD ) via similarities in their behavior .


FANCY BEAR has also been linked publicly to intrusions into the German Bundestag and France ’s TV5 Monde TV station in April 2015 .


Actors will run HTRAN on a server and configure their malware to interact with that server ; however , the actor will configure HTRAN to forward traffic to another server where the actual C2 server exists . PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 .


Xiaomi , a privately owned Chinese electronics and software company , is the 5th largest smart phone manufacturer in the world and also manufactures IoT devices for the home . APT41 has also used credentials compromised in previous operations . In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM , JHUHUGIT , AZZY and a few others .


Germany is one of the first attack turfs TrickBot spread to when it first emerged in 2016 . Moving through the infection process , NetWitness Endpoint detects the initial exploit CVE-2017-1182 in action as the Microsoft Equation Editor , EQNEDT32.exe , scores high for potentially malicious activity . All three waves involved a single spear phishing email that appeared to originate from a government agency based in the Middle East .


] it/gate_cb8a5aea1ab302f0_c online 185.158.248 [ . BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e , possibly en masse . menuPass has targeted individuals and organizations in Japan since at least 2014 , and as the same organizations and academics were largely targeted each month in these attacks , it further shows menuPass is persistent in attempts to compromise their targets .


At this stage , we have two similar , parallel constructions of events – the how behind the immediate deployment and execution of TRITON / TRISIS – yet dramatically different responses in terms of attribution and labeling .


After that , stage 2 payloads are still retrieved as Bitmap ( BMP ) images that use Least Significant Bit ( LSB ) Steganography to hide the real payloads .


ESET detects this adware , collectively , as Android/AdDisplay.Ashas . In January , Kaspersky identified new activity by the Transparent Tribe APT group aka PROJECTM and MYTHIC LEOPARD , a threat actor with interests aligned with Pakistan that has shown a persistent focus on Indian military targets . The malware configuration contains one Command and Control: pactchfilepacks.net23.net .


It is impossible to deprive it of these rights without the use of specialized tools ( such as Kaspersky Internet Security for Android ) . Once a victim is confirmed as " interesting " , the attackers upload another Epic backdoor which has a unique ID used to control this specific victim . Local user account creation tools . /Library / Ruby / Gems/2.6.0 / extensions / init.rb Ruby script 53789519 /usr / local / bin / com.docker.vmnat FULLHOUSE.DOORED 53789522 /usr / local / bin / com.docker.vmnat.lock Not recovered 54101444 /Library / Fonts / ArialUnicode.ttf.md5 STRATOFEAR ( Config ) 54102142


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . The malware will begin to download other utilities .


Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 . This behavioural tactic was previously mentioned in relation to KeyBoy in a 2013 blog post by Cisco .


In this case , explorer.exe will instance the MMDeviceEnumerator class and will execute the payload .


Logcat logs show FakeSpy uses libmsy.so to execute the malicious packed mycode.jar file . We also observed the actors uploading custom backdoors such as HyperBro which is commonly associated with Emissary Panda . Several additional documents surfaced between January 17 and February 3 .


] ponethus [ . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups . And a new version of Ixeshe , which has been in service since 2009 to attack targets in East Asia , uses new network traffic patterns , possibly to evade traditional network security systems . We should note that SocGholish used to retrieve media files from separate web requests until more recently when it started using self - contained Base64 encoded images .


Scxreexcv4 Capture an image micmokmi8x Capture audio Yufsssp Get latitude and longitude GExCaalsss7 Get call logs PHOCAs7 Call phone numbers sent by the C & C server Gxextsxms Get a list of inbox SMS messages Msppossag Send SMS with message body sent by the C & C server Getconstactx Get a list of all contacts Rinxgosa Play a ringtone bithsssp64 Execute commands sent by the C & C server DOWdeletx Deletes When used against 32-bit targets , Bemstour still delivered the same DoublePulsar backdoor . While there is some overlap between IP addresses used by Scarlet Mimic E-APT and Putter Panda , it has not been concluded that the groups are the same .


In this case , we had observed a strange pattern emerging from the Sofacy group over the past year within their command and control infrastructure .


Saudi Arabia released a warning to local organizations about the Shamoon malware , alerting about potential attacks and advising organizations to prepare .


The threat actors seem to have abandoned these URLs and might be looking into other ways to reach more victims . We have been presented with a rare opportunity to see some development activities from the actors associated with the OilRig attack campaign , a campaign Unit 42 has been following since May 2016 . Brief Description : SFX Archive Second Stage . Simultaneously , a new variant of Monti , based on the Linux platform , has surfaced , demonstrating notable differences from its previous Linux - based versions .


As an initial attack vector , “ Agent Smith ” abuses the 9Apps market – with over 360 different dropper variants . The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates , though , Indian and Canadian companies with interests in those Middle Eastern countries may have also been targeted . Dexphot exhibits multiple layers of polymorphism across the binaries it distributes . Beginning in January 2021 , Mandiant Managed Defense observed the creation of web shells on one Microsoft Exchange server file system within a customer ’s environment .


Check that the mutex WininetStartupMutex0 does not already exist Check that no DLL whose base name has hash value of 0xC9CEF3E4 is mapped into the malware address space The hashes in these checks are most likely correspond to sandbox or security products that the FinFisher authors want to avoid . During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros . This white paper describes the steganography algorithm used in two distinct loader variants and looks at the launcher of the backdoor that was encoded in one of the .png cover images . mcvsocfg.dll : In April , Talos discovered a new ransomware actor , RA Group , conducting double extortion attacks using their ransomware variant based on leaked Babuk source code .


Trojan.Sofacy Backdoor.SofacyX Infostealer.Sofacy OSX.Sofacy Trojan.Shunnael Trojan.Lojax .


Detailed Malware Structure Malware Strucutre com.mile.brain ( SHA256 : 135d6acff3ca27e6e7997429e5f8051f88215d12351e4103f8344cd66611e0f3 ) : This is the main application found on Google Play . They have also been seen using Heartbleed vulnerability in order to directly get valid credentials . PwC UK and BAE Systems , working closely with industry and government , have uncovered a new , unparallelled campaign which we refer to as Operation Cloud Hopper .


Their research showcased a set of downloaders and domains that could potentially lead to a more extensive malware distribution campaign .


The indictment was for conducting " active cyber operations with the intent of interfering in the 2016 presidential election . " The espionage operation was run by Unit 26165 , commanded by GRU Officer Viktor Borisovich Netykshko .


] 251 2d108ff3a735dea1d1fdfa430f37fab2 com.psiphon3 dexlib 2.x 188.165.49 [ . This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others . The downloaded payload is an image file , but it contains an appended malicious payload to be decrypted .


A remarkable fact is that all the targeted apps relate to Spanish banks , including targets never seen before in any other Android banking Trojan . On top of the breadth , volume , and targets of attacks that APT10 has conducted since at least 2016 , we now know that these operations are being run by the Chinese intelligence agency , the Ministry of State Security (MSS) . Symantec was first to publicly report on Tick , followed by LAC in 2016 .


Even the C & C server side was mostly exposed with the file listing available for everyone to traverse through it . In 2015 and 2016 , two Vietnamese media outlets were targeted with malware that FireEye assesses to be unique to APT32 . The image below highlights the nodes associated with the samples analyzed in this report . The group , which has some loose ties and similarities to other Iranian APTs like APT34 and Charming Kitten , first came to light in 2019 .


The ShadowBrokers' latest dump of Equation Group hacks focuses on UNIX systems and GSM networks , and was accompanied by an open letter to President Trump . Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China .


It appears that the attackers may have impersonated the identity of a real young woman and stole her pictures to construct the fake profile , along with a professional biography also stolen from yet another person . The contents of the decoy PDF is a job descriptions with the South Korean Coast Guard .


EventBot uses this function to update its C2s , the configuration of webinjects , etc . Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant . In a recent attack , APT33 sent spear-phishing emails to workers in the aviation industry .


, IMSI , operator code , country , MCC-mobile country , SIM serial , operator name , and mobile number ) Upload wifi information ( e.g. , SSID , wifi speed , and MAC address ) Upload other information ( e.g. , display , date , time , fingerprint , created at , and updated at ) The app is capable of stealing messages from popular messaging apps by abusing the notification permissions to read the notification content and saving it to the database . The threat group using these implants has been active since at least 2014 and has been seen targeting individuals likely involved in the Ukrainian government . the CFG ( specifically mblock_t : :p redset and mblock_t : :s uccset ) An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 ( update 1 ) , as exploited in the wild starting in December 2021 .


This could be very dangerous and cause some devices to crash following the overwrite . The titles and contents of these files suggest that the actor targeted individuals affiliated with these government agencies and the Fatah political party . While paying for your reservation or checking out at a hotel , it ’s a good idea to use a virtual wallet such as Apple Pay , Google Pay , etc . To compromise the victims , the attackers used extremely effective social engineering techniques which involved sending malicious PDF documents to their targets .


this RTF exploits again the CVE-2017_1882 on eqnedt32.exe . this RTF exploits again the CVE-2017-1882 on eqnedt32.exe .


Step 3 : Run installation Start the Bank Austria security app from the notifications or your download folder , tap Install . Once they have access to the network , they steal the organization's legitimate SSL certificate and use it on actor-controlled servers . The group has targeted victims primarily in South Korea , but also in Japan , Vietnam , Russia , Nepal , China , India , Romania , Kuwait , and other parts of the Middle East .


After the Anubis actor was allegedly arrested and the source code was leaked there was also huge increase in the number of Anubis samples found in the wild , but the new actors using Anubis have no support or updates . Machete is malware that has been developed and is actively maintained by a Spanish-speaking group . We have moderate confidence APT39 operations are conducted in support of Iranian national interests based on regional targeting patterns focused in the Middle East .


TG-3390 has access to proprietary tools , some of which are used exclusively by TG-3390 and others that are shared among a few Chinese threat groups .


The iOS and Android apps for Netflix are enormously popular , effectively turning a mobile device into a television with which users can stream full movies and TV programs anytime , anywhere . Since the report’s release in September 2018 , Group-IB’s Threat Intelligence team has detected 16 campaigns targeting banks launched by Silence . The group has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


Specifically , the following facts support this assessment: The attacker targeted the SIS suggesting an interest in causing a high-impact attack with physical consequences . This alert 's IOC files provide HIDDEN COBRA indicators related to FALLCHILL .


ESET researchers will continue monitoring new Turla activities and will publish relevant information on our blog . From the time of file creation , the attacker started working at least as early as July 2018 . The link to feeds.rapidfeeds.com left in its XML configuration file was also mentioned by Kaspersky’s report in the reference section , which confirms that the APT-C-09 group keeps updating its C2 configuration channel and the recent one reserves some past features . For example , Donot and Bitter disguised as Kashmiri Voice to attack Pakistan , Transparent Tribe attacked India with decoy document regarding terrorist attacks in Kashmir . Considering APT-C-09 , Bitter and Donot have carried out targeted attacks against China , we must take actions in advance and keep a close eye on their recent activities . APT41 espionage operations against the healthcare , high-tech , and telecommunications sectors include establishing and maintaining strategic access , and through mid-2015 , the theft of intellectual property . FireEye Threat Intelligence assesses with high confidence that APT41 carries out an array of financially motivated intrusions , particularly against the video game industry , including stealing source code and digital certificates , virtual currency manipulation , and attempting to deploy ransomware . APT41 has executed multiple software supply chain compromises , gaining access to software companies to inject malicious code into legitimate files before distributing updates . APT41 is unique among tracked China-based actors in that it leverages non-public malware typically reserved for espionage operations in what appears to be activity that falls outside the scope of state-sponsored missions . Based on early observed activity , consistent behavior , and APT41's unusual focus on the video game industry , we believe the group's cyber crime activities are most likely motivated by personal financial gain or hobbyist interests . APT41 campaigns include most of the incidents previously attributed in FireEye Threat Intelligence reporting to GREF Team and a number of additional clusters that were previously unnamed . Activity traces back to 2012 when individual members of APT41 conducted primarily financially motivated operations focused on the video game industry before expanding into likely statesponsored activity . Learning to access video game production environments enabled APT41 to develop the tactics , techniques , and procedures (TTPs) that were later leveraged against software companies to inject malicious code into software updates . APT41 has targeted organizations in 14 countries over seven years , including: France , India , Italy , Japan , Myanmar , the Netherlands , Singapore , South Korea , South Africa , Switzerland , Thailand , Turkey , the United Kingdom , and the United States (Figure 1) . APT41 espionage operations against entities in these countries follow targeting of verticals consistent with Chinese national policy priorities . We believe that like other Chinese espionage operators , APT41 has moved toward strategic intelligence collection and establishing access , but aACT from direct intellectual property theft . In 2014 , APT41 was observed carrying out espionage campaigns concurrently with financially motivated intrusions , demonstrating that they could balance different objectives simultaneously . Since 2017 , APT41's activities have included a series of supply chain compromises . The group also targeted companies involved in producing motherboards , processors , and server solutions for enterprises . Since 2013 , APT41 has targeted organizations involved in the research , development , and sale of computer components used for machine-learning , autonomous vehicles , medical imaging , and the consumer market . In a 2014 compromise , APT41 targeted a European conglomerate and specifically focused on systems physically located in China . In spring 2015 , APT41 targeted information related to two entities undergoing a merger announced the previous year . Since 2017 , APT41 has consistently targeted telecommunications companies , possibly a crucial first step to establish a foothold in targeting a particular region . Targeted telecom companies spanned several countries , and recently identified intrusions were concentrated in countries where we had not identified any prior APT41 activity . In July and August 2016 , APT41 sent spear-phishing emails to Hong Kong media organizations known for pro-democracy editorial content . This was the first instance we have observed of APT41 targeting pro-democracy groups in Hong Kong . APT41 frequently leverages timely news stories as the lure content in their spear-phishing emails , although social engineering content does not alACTs correlate with targeted users or organizations . In 2015 , APT41 targeted a Japanese media organization with a lure document (Figure 3) titled 中東呼吸器症候 群(MERS)の予防 , ” which translates to Prevention of Middle East Respiratory Syndrome (MERS) . APT41 activity aimed at medical device companies and pharmaceuticals is demonstrative of the group's capacity to collect sensitive and highly valuable intellectual property (IP) , although we have not observed evidence of IP theft since late 2015 . Unlike other observed Chinese espionage operators , APT41 conducts explicit financially motivated activity , which has included the use of tools that are otherwise exclusively used in campaigns supporting state interests . Although APT41 initially targeted the parent company , 30 percent of the victimized hosts were related to a subsidiary specialized in manufacturing medical devices . In 2018 , we observed APT41 target a third healthcare company , although their goals during this compromise were unclear . In June 2018 , APT41 sent spear-phishing emails using an invitation lure to join a decentralized gaming platform linked to a cryptocurrency service (Figure 5) that had positioned itself as a medium of exchange for online games and gambling sites . This provides another connection between the targeting of the cryptocurrency organizations and video game targeting . In October 2018 , the group compiled an instance of XMRig , a Monero cryptocurrency mining tool , demonstrating a continued interest in cryptocurrency . APT41 campaigns focused on the video game sector have largely affected studios and distributors in East and Southeast Asia , although global companies based in the United States have also been targeted . APT41 continuously returns to targeting the video game sector and seems to have matured its campaigns through lessons learned in operations against the industry . We believe these operations include broadly malicious activity that can enable further operations , such as targeting game source code and compromising digital certificates , while other activities are explicitly financially motivated , such as abusing in-game currency mechanics . In October 2012 , APT41 used captured credentials to compromise a jump server and access a production environment where they deployed a Linux version of PHOTO . Since at least 2012 , APT41 has repeatedly gained access to game development environments within affected companies , including online multiplayer networks , as well as targeting of production database administrators . APT41 has been observed inserting malicious code into legitimate video game files to distribute malware . In 2018 , the group inserted CRACKSHOT malware into game files that were signed with legitimate codesigning certificates , most likely indicating access to the production environment , which facilitated a supply chain compromise . We have also observed APT41 limitedly deploy rootkits on Linux systems and Master Boot Record (MBR) bootkits , such as ROCKBOOT , on Windows systems to hide their malware and maintain persistence on victim systems . Selective deployment of ROCKBOOT suggests that APT41 reserves more advanced TTPs and malware only for high-value targets . APT41 has blatantly engaged in financially motivated activity targeting the video game industry , including manipulating virtual currencies . In a highly unusual case , APT41 attempted to extort a game company by deploying the Encryptor RaaS ransomware . APT41 is well-known for leveraging compromised digital certificates from video game studios to sign malware . We suggest that APT41 sought to target in-game currency but found they could not monetize the specific targeted game , so the group resorted to ransomware to attempt to salvage their efforts and profit from the compromise . APT41 has also used credentials compromised in previous operations . In 2014 , APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service . Although we do not have first-hand evidence of APT41's compromise of TeamViewer , we have observed APT41 use compromised TeamViewer credentials as an entry point at multiple organizations . Public reports of supply chain compromises linked to APT41 date back to at least 2014 , and technical evidence associated with these incidents was used to determine a relationship , if any , with APT41 . As demonstrated in operations targeting the video game industry , APT41 leverages a variety of TTPs to access production environments where they can inject malicious code into legitimate files . In March 2017 , suspected Chinese espionage operators targeted CCleaner , a utility that assists in the removal of unwanted files from a computer . In July 2017 , APT41 injected malicious code into a software update package maintained by Netsarang and signed it with a legitimate Netsarang certificate in an operation referred to as ShadowPad by Kaspersky . Both APT41 and the actors in the CCleaner incident used TeamViewer during initial compromise . Supply chain compromises are most likely an extension of APT41's tactics used in gaining access to gaming development environments and to other gaming organizations via third-party service providers . Beginning in July 2018 , APT41 appeared to have directly targeted several East and Southeast Asia-based video game developers and distributors to inject legitimate executables with the CRACKSHOT backdoor . The lure used to target the cryptocurrency exchange (displayed in Figure 5 and translated in Figure 6) referenced an online gaming platform , tying the cryptocurrency targeting to APT41's focus on video game-related targeting . FireEye malware analysis identified source code overlaps between malware used by APT41 in May 2016 targeting of a U.S.-based game development studio and the malware observed in supply chain compromises in 2017 and 2018 . In May 2016 , APT41 deployed a POISONPLUG sample at a U.S.-based game development studio . Alternatively , it is also possible that APT41 injected malicious code into the package prior to compilation , circumventing the need to steal the code-signing certificate and compile it on their own . Either APT41 is operating outside of state control but still working with other Chinese APT malware actors , tools , and infrastructure on a parttime or contractual basis , or APT41 is a full-time . APT41 uses many of the same tools and compromised digital certificates that have been leveraged by other Chinese espionage operators . Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations . APT41 has used several malware families that have also been used by other Chinese espionage operators , including variants of HIGHNOON , HOMEUNIX , PHOTO , SOGU , and ZXSHELL , among others . HIGHNOON , one of the main code families observed being used by APT41 , was also used by APT17 in 2015 to target semiconductor and chemical manufacturers . HOMEUNIX , another popular backdoor used by APT41 , has been used by at least 14 separate Chinese espionage groups , including APT1 , APT10 , APT17 , APT18 , and APT20 . APT41 has used CROSSWALK.BIN , a kernel driver , to circumvent firewalls and covertly send data . Another Chinese espionage group used a similar tool , CLASSFON , to covertly proxy network communications in 2011 . At least two of these malware families , HIGHNOON.CLI and GEARSHIFT , have been used by APT17 and another suspected Chinese espionage group . APT41 regularly leverages code-signing certificates to sign malware when targeting both gaming and nongaming organizations . In July 2017 , APT41 initiated a TeamViewer session and transferred files that were later deleted . In these instances , APT41 leveraged TeamViewer to transfer malware into the compromised environment , although we do not have direct evidence of APT41 compromising TeamViewer . In May 2018 , APT41 used TeamViewer for initial entry in the compromise of a healthcare company . Notably , APT41 was observed using proof-of-concept exploit code for CVE-2019-3396 within 23 days after the Confluence . APT41 has targeted payment services specializing in handling in-game transactions and real money transfer (RMT) purchases .


If the C2 has already been taken offline the document will still open , but Word will be unable to retrieve the remote template and thus Word will not load a macro .


Historically , the majority of their targeting has been focused on the South Korean government , military , and defense industrial base . Fresh from targeting banks in Poland , the banking Trojan GozNym has begun taking aim at banks in Germany .


We continue to monitor its progress . ] com , which we previously identified in October 2017 to be an OilRig C2 . It can be proc.exe or chrome.exe or winrar.exe . External Server Requests Indicates an attempt to exfiltrate data to an external server .


For contacting C & C , the spyware was found to be using free DNS services , as shown in the screenshot below : SpyNote RAT uses an unusual trick to make sure that it remains up and running and that the spying does not stop . Prior to April 2018 , as described in Group-IB’s Silence: Moving into the darkside report , Silence’s target interests were primarily limited to former Soviet and Eastern European countries including Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan . Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as OilRig and CopyKittens .


In April 2013 , we saw the first sample , which made heavy use of dynamic code loading ( i.e. , fetching executable code from remote sources after the initial app is installed ) . MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs . IRONHALO persists by copying itself to the current user ’s Startup folder . We recommend checking the following for potential evidence of compromise : • Child processes of on Exchange Servers , particularly .


The Trojan also hit users from Ukraine , Turkey , Germany , Belarus , Poland , Armenia , Kazakhstan , the US , and other countries . In 2015 , the SecureWorks® Counter Threat Unit™ ( CTU ) research team documented the BRONZE UNION threat group ( formerly labeled TG-3390 ) , which CTU™ analysis suggests is based in the People's Republic of China ( PRC ) . Outlaw ’s attack routines may not be new , but it still serves as a reminder for enterprises to update their systems regularly . Part of this can be explained by the fact that 8BASE disproportionately attacked Brazil with 11 attacks last month , while PLAY focused on Switzerland ( 5 ) .


Below are a series of indicators Microsoft has observed as active during the STRONTIUM activity discussed in this article .


ABUSE OF ACCESSIBILITY SERVICES EventBot abuses the accessibility services of Android devices for the majority of its activity . OutExtra.exe is a signed legitimate application from Microsoft named finder.exe . For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . Considering the Trojan delivery method and through our analysis of infections on banks' networks , we can confirm that all infections were conducted on a random basis .


The document attached to this e-mail exploits CVE-2012-0158 . However , based on the findings shared in this report we assess with high confidence that the actor 's primary long-term mission is politically focused .


This was the C2 for an Android infostealer responsible for several attacks in Italy back in late 2019 . The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server . They move laterally and escalate system privileges to extract sensitive information — whenever the attacker wants to do so.4 ,5 Because some RATs used in targeted attacks are widely available , determining whether an attack is part of a broader APT campaign can be difficult .


The goal of the attackers appears to be to collect intellectual property such as design documents , formulas , and manufacturing processes .


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 . The 360 Intelligence Center observed four distinct campaigns against Pakistan since 2017 (link) , recently targeting Pakistani businessmen working in China .


Previous version The capture service class implements the chat applications interception . Callisto Group and related infrastructure contain links to at least Russia , Ukraine , and China . The one outlier was written as winword.exe . Acquire Infrastructure : Web Services APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware , such as HAMMERTOSS .


Example of more recent FakeSpy campaigns targeting France . Symantec’s Elfin report denoted additional targeting of the engineering , chemical , research , finance , IT , and healthcare sectors . Our investigation revealed an attack where the GCMAN group then planted a cron script into bank 's server , sending financial transactions at the rate of $200 per minute .


In all three incidents , the attackers gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials . Upon successful exploitation , the attachment will install the Trojan known as NetTraveler using a DLL side-loading attack technique .


Translated from Russian , this file is named “ PROJECT_REALIZATION_PLAN.rar ” and contains a compressed .scr executable .


Zen family PHA authors exhibit a wide range of techniques , from simply inserting an advertising SDK to a sophisticated trojan . he PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) . Dell SecureWorks Counter Threat Unit ( CTU ) analysts were recently engaged with a client thought to have been compromised by a threat group CTU researchers have named Threat Group-0416 ( TG-0416 ) . The code of the exploit is very similar to the one published in the Metasploit kit , but the inner class that disables the security manager is encoded differently , most likely to avoid detection .


In the summer of 2014 , we noted that certain samples of BlackEnergy malware began targeting Ukranian government organizations for information harvesting . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data exfiltration and to provide remote access to infected machines . The mothership server is generally a VPS , which runs the Control panel software used to interact with the victims .


RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself . Deepen told Threatpost the group has been operating since at least since 2008 and has targeted China and US relations experts , Defense Department entities , and geospatial groups within the federal government .


The threat actor relied on WMI and PsExec to move laterally and install their tools across multiple assets . Confucius targeted a particular set of individuals in South Asian countries , such as military personnel and businessmen , among others .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . BARIUM , a Chinese state player that also goes by APT17 , Axiom and Deputy Dog , was previously linked to the ShadowPad and CCleaner incidents , which were also supply-chain attacks that used software updates to sneak onto machines .


SHA256 15abd32342e87455b73f1e2ecf9ab10331600eb4eae54e1dfc25ba2f9d8c2e8a .


The Leafminer operators use EternalBlue to attempt lateral movement within target networks from compromised staging servers . However , despite the similarities to previous Turla campaigns , we believe that WhiteBear is a distinct project with a separate focus .


Other samples communicated with other servers listed at the bottom of this report . These incidents involved spear-phishing attacks , which characteristic of HELIX KITTEN , included emails containing malicious PowerShell in their macros that connects to known C2 infrastructure . This campaign shows a threat actor interested in specific Middle Eastern and Arabic-speaking countries . With regards to these similarities , we highlight the following trends which could manifest in future OT malware : •


The origins of MiniDuke can thus be traced back to the origins of GeminiDuke , of which the earliest observed sample was compiled in January of 2009 .


RECEIVE_BOOT_COMPLETED - Allows the application to receive a broadcast after the system finishes booting . Discovered in 2014 , the campaign quickly gained notoriety after compromising the security systems of 100 banks in 40 countries and stealing up to $1 billion in the process . Between April 1 , 2018 and May 30 , 2018 , we observed the domain stevemike-fireforce.info used in a Gorgon Group cybercrime campaign involving more than 2,300 emails and 19 documents in the initial attack .


Spread command from C2 The victim receives the command sendSMSMass . APT10 has been in operation since at least 2009 , and has evolved its targeting from an early focus on the US defence industrial base ( DIB ) and the technology and telecommunications sector , to a widespread compromise of multiple industries and sectors across the globe , most recently with a focus on MSPs . OceanLotus : C:\Users\Meister\Documents\Projects\BrokenShield\Bin\x86\Release\BrokenShield.pdb Loader #2 . We believe this is a different campaign and threat actor altogether .


Therefore , it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer . The first confirmed date when TajMahal samples were seen on a victim’s machine is August 2014 .


These techniques permit the CIA to bypass the encryption of WhatsApp , Signal , Telegram , Wiebo , Confide and Cloackman by hacking the smart phones that they run on and collecting audio and message traffic before encryption is applied . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups .


The dropper installs 2 files :


This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies . Considering the language being used in the malicious code is Arabic , it seems that the attacker is familiar with Arabic language as well .


However , it was detected dynamically by the host intrusion prevention subsystem when it appeared in the system and was executed .


This variable is decoded with the base64 algorithm in order to get a Windows library ( PE file ) which is written to disk .


MESSAGE – send SMS containing specified text to a specified number . During this testing , we saw document filenames that contain the C2 we witnessed in the targeted attack above , specifically the filenames XLS-withyourface.xls and XLS-withyourface – test.xls . CTU researchers also identified components in the custom C2 protocol being used ( the ACT in which the malware talks to the Command and Control Servers ) which they have seen utilized by Nickel Academy ( Lazarus ) previously .


This was more complex .


Apps with a custom-made advertisement SDK The simplest PHA from the author 's portfolio used a specially crafted advertisement SDK to create a proxy for all ads-related network traffic . Unit 42 's analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . The first spear phishing message was sent to a Taiwanese governmental employee on Dec. 1 . FireEye detects this activity across our platforms .


When DualToy began to spread in January 2015 , it was only capable of infecting Android devices . In 2018 , we discovered a new version of the Ketrican backdoor that featured some code improvements . Malware used by Lazarus Group correlates to other reported campaigns , including Operation Flame , Operation 1Mission , Operation Troy , DarkSeoul , and Ten Days of Rain .


Key : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AudioMgr Key : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleIndexer .


Command Description push Shows a push notification . The SectorJ04 group’s preexisting targets were financial institutions located in countries such as North America and Europe , or general companies such as retail and manufacturing , but they recently expanded their areas of activity to include the medical , pharmaceutical , media , energy and manufacturing industries . Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


We believe that , unusually , the purpose of the OnionDuke variant spread via the Tor node was not to pursue targeted attacks but instead to form a small botnet for later use .


Privilege escalation requests The screens asking for the user 's approval wo n't close unless the user approves the privilege escalation . Attackers use it to create , expand and cement their foothold in compromised environments . Prior to the discovery of Operation Daybreak , we observed the ScarCruft APT launching a series of attacks in Operation Erebus .


SHA256 : 4393ff391396cdfd229517dd98aa7faecad04da479fe8ca322f035ceee363273 .


Virulent Android malware returns , gets > 2 million downloads on Google Play HummingWhale is back with new tricks , including a way to gin user ratings . We believe they started this watering hole campaign at the end of 2016 after their other operation was interrupted in South East Asia . Two users in the targeted organization received a file called " JobDetails.rar " , which attempted to exploit the WinRAR vulnerability . UNC4899 targeting overlaps with a separate RGB - aligned group , APT43 , who in July , 2023 displayed interest in the cryptocurrency vertical , specifically targeting a variety of C - Suite executives from multiple fintech and cryptocurrency companies in the United States , South Korea , Hong Kong , and Singapore .


It controls each and every functionality based on the commands sent by the command and control ( C & C ) server . However , Buckeye had already been using some of these leaked tools at least a year beforehand . Gorgon Group is a threat group consisting of members who are suspected to be Pakistan based or have other connections to Pakistan .


In that report , we documented our observation that the Sofacy group appeared to use conventional obfuscation techniques to mask their infrastructure attribution by using random registrant and service provider information for each of their attacks .


We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded . Threat actors have targeted the government of Thailand and delivered the newly discovered Bookworm Trojan since July 2015 .


This suggests that the operators of the Command & Control are not enforcing a validation of the targets . HELIX KITTEN is likely an Iranian-based adversary group , active since at least late 2015 , targeting organizations in the aerospace , energy , financial , government , hospitality and telecommunications business verticals . Additionally , the generated code by uncompyle6 varies depending on the version and the impact is important . Cisco Secure Malware Analytics ( formerly Threat Grid ) identifies malicious binaries and builds protection into all Cisco Secure products .


HammerDuke ’s use of Twitter and crafted image files is reminiscent of other Duke toolsets .


TG-3390 SWCs may be largely geographically independent , but the group's most frequently used C2 registrars and IP net blocks are located in the U.S. Using a U.S. based C2 infrastructure to compromise targets in the U.S. helps TG-3390 actors avoid geo-blocking and geo-flagging measures used in network defense .


Since late 2018 , based upon the most-recent posting , FireEye appears to have “ walked back ” the previously-used terminology of TEMP.Veles and instead refers rather cryptically to the “ TRITON actor ” , while Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME .


February saw three particularly interesting publications on the topic of macOS malware: a Trojan Cocoa application that sends system information including keychain data back to the attacker , a macOS version of APT28’s Xagent malware , and a new Trojan ransomware . In this latest incident , the group registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day .


A closer examination of the tool revealed the second user agent string was from a secondary payload that was retrieved by the cba5ab65a24be52214736bc1a5bc984953a9c15d0a3826d5b15e94036e5497df sample .


Chinese APK names : Some of FakeSpy ’ s APK package names contain anglicized Chinese ( Mandarin ) words that might be related to Chinese songs and lyrics , food , provinces , etc . Instead , the campaign used compromised legitimate accounts to trick victims into installing malware . Other names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . The group is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


While Sofacy is also known to use of custom exploit frameworks and spear-phishing attacks , it is possible in this case that they managed to obtain privileged credentials of network administrators within the Bundestag through the use of a phishing attack , which then allowed them to navigate through the network and gain access to more data .


The second stage The second stage apps contain the surveillanceware capabilities . What actually happens is that the malware is able to decode data from the PDF documents and interpret it as commands for the backdoor . The installed service registry key is opened and the 2 values under its Parameter subkey are created . A great example is that of the notorious bank robber slick Willy Sutton .


In the case of this malware , the activity groups strongly associated with Winnti are BARIUM and LEAD .


IOCs C & C IP addresses : 155.133.82.181 155.133.82.240 155.133.82.244 185.234.218.59 195.22.126.160 195.22.126.163 195.22.126.80 195.22.126.81 5.45.73.24 5.45.74.130 IP addresses from which the Trojan was downloaded : 185.174.173.31 185.234.218.59 188.166.156.110 195.22.126.160 195.22.126.80 195.22.126.81 In 2016 , the threat actors conducted a strategic web compromise ( SWC ) on the website of an international industry organization that affected aerospace , academic , media , technology , government , and utilities organizations around the world . With technologies that employ web/URL filtering , behavioral analysis , and custom sandboxing , XGen security offers protection against ever-changing threats that bypass traditional controls and exploit known and unknown vulnerabilities . Talos discovered multiple vulnerabilities in Foxit PDF Reader that could allow an adversary to execute , arbitrary code on the targeted machine .


As such , these findings represent a collection of compromised websites , compromised registrar accounts used to spin up subdomains , domains used by malware DGA ’s , phishing kits , carding forums , malware C2 sites , and a slew of other domains that revolve around criminal activity .


Otherwise , it will return a JSON encoded " OK , '' and if that is the case , the command to be executed . The United States and countries in Europe are targeted as well . The DUDELL sample is a weaponized Microsoft Excel B-IDTY I-TOOL document that contains a malicious macro E-TOOL that runs on the victim ’s machine . Subscribing to the Talos weekly newsletter provides information about the most prevalent malware .


Following are some examples of the decoys used by these droppers : The purpose of Exodus One seems to be to collect some basic identifying information about the device ( namely the IMEI code and the phone number ) and send it to the Command & Control server . The tester created the final test file less than 8 hours before the creation time of a delivery document , which was then delivered via a spear-phishing email 20 minutes later . The attacker used a second trick to avoid analysis of the python code . There was a massive decrease in the activity from Royal , for example , which normally dominates the monthly rankings — often cracking into the top five — with an average of roughly 30 attacks a month in that period .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries . When the New York Times and Mandiant last year unmasked a large scale Chinese hacking operation , pinpointing its location down to the building , the report drew mainstream attention to what security professionals already well knew : sophisticated threat actors carry out persistent cyber operations over months and years .


The Shadow Brokers , the group that publicly dumped a cache of NSA hacking tools , appears to be back and ready to sell stolen material on an individual basis . According to the Fxmsp , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks .


Proofpoint is tracking this attacker , believed to operate out of China , as TA459 .


First Signs in September 2019 In September 2019 , a tweet by CERT-Bund caught the attention of the IBM Trusteer Mobile Security Research team . specifically CVE-2018-0798 , before downloading subsequent payloads . The OilRig group continues to be a persistent adversary group in the Middle East region .


In particular , the threat actors have exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code . Initial attack targets are commonly software and gaming organizations in United States , Japan , South Korea , and China .


In particular , these packages have not been observed to contain or to download exploits which would be required to perform certain types of activities on iOS devices . Some of the documents exploited CVE-2017-0199 to deliver the payload . Cisco Talos assesses with moderate confidence that a campaign we recently discovered called " BlackWater " is associated with suspected persistent threat actor MuddyWater .


We found traces of the Gooligan malware code in dozens of legitimate-looking apps on third-party Android app stores . Although APT38 is distinct from other TEMP.Hermit activity , both groups operate consistently within the interests of the North Korean state . The global variable value dword_745BB58C is either even or odd , The most significant similarities we identified are with INDUSTROYER and INDUSTROYER.V2 , which were both malware variants deployed in the past to impact electricity transmission and distribution .


The Android banking Trojan rental business Rental of banking Trojans is not new . Machete was active and constantly working on very effective spearphishing campaigns . This is evidence of shared motivation and intent to target the SWIFT system by the North Korean operators performing the reconnaissance and APT38 which later targeted that organization .


'' The report said HummingBad apps are developed by Yingmob , a Chinese mobile ad server company that other researchers claim is behind the Yinspector iOS malware . These and other tools used by the Lazarus group can be mitigated by routinely scanning the network for any malicious activity to help prevent the malware from entering and spreading through an organization . APT33 : 64.251.19.214 mynetwork.ddns.net . To perform analysis of NetScaler memory core dump files , they need to be collected .


Disable , discontinue , or disallow the use of Internet Control Message Protocol ( ICMP ) and Simple Network Management Protocol ( SNMP ) as much as possible .


With Version 0.0.0.1 , there is a dedicated functions class where all main malicious activity happens and can be observed . Rapid7 reviewed malware discovered in the victim’s environment and found implants that used Dropbox as the C2 . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


To bypass Google Play Store security checks , the malware creators used a very interesting method : they uploaded a clean app to the store at the end of March , 2017 , and would then update it with a malicious version for short period of time . COVELLITE operates globally with targets primarily in Europe , East Asia , and North America . The code is specifically looking for data in Portuguese and English , allowing the attackers to steal credit card data from web pages written in these languages . This dangerous malware was developed to exploit weaknesses in those systems and the communication protocols they use – systems developed decades ago with almost no security measures .


The recent activity in the U.S. is but one of many instances of Russian Government influence operations conducted in support of strategic political objectives , and it will not be the last .


EventBot web injects execution method Web injects execution method by a pre-established configuration . Create a link file in the startup folder for AutoHotkeyU32.exe , allowing the attack to persist even after a system restart . Although we have only observed APT33 use DROPSHOT to deliver TURNEDUP , we have identified multiple DROPSHOT samples in the wild that delivered wiper malware we call SHAPESHIFT .


Turla has been operating for a number of years and its activities have been monitored and analyzed by ESET research laboratories . The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits , including the EternalBlue exploit used in the WannaCry attack from May 2017 .


HttpBrowser ( also known as TokenControl ) — A backdoor notable for HTTPS communications with the HttpBrowser User-Agent .


It saves the messages ’ metadata and content , filters the information by fields , and sends them to the C2 server using the URL /servlet/SendMassage2 . We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 . The Ke3chang have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , chemicals , manufacturing , mining sectors .


Instead of running its service only at boot time , it registers a receiver that listens to the “ android.intent.action.SCREEN_ON ” and “ android.provider.Telephony.SMS_DELIVER ” broadcast actions . However , Brazilian actors commonly use several methods to do so , such as reselling cards they have created , paying bills with stolen cards in return for a portion of the bill's value and reselling illicitly obtained goods . While investigating recent attacks performed by the threat actor group OilRig using their new Bondupdater version , Unit 42 researchers searched for additional Microsoft Office documents used by OilRig hoping to locate additional malware being used in other attacks during the same time period .


The second timer will run every five seconds and it will try to enable the WiFi if it 's disabled . Gamaredon Group primarily target Ukrainian organizations and resources using spear-phishing attacks , and they use military or similar documents as bait . The compilation times of APT37 malware is consistent with a developer operating in the North Korea time zone ( UTC +8:30 ) and follows what is believed to be a typical North Korean workday .


In mid-2016 , malware that FireEye believes to be unique to APT32 was detected on the networks of a global hospitality industry developer with plans to expand operations into Vietnam . The most popular targets of SneakyPastes are embassies , government entities , education , media outlets , journalists , activists , political parties or personnel , healthcare and banking .


Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) . The group , believed to be based in China , has also targeted defense contractors , colleges and universities , law firms , and political organizations — including organizations related to Chinese minority ethnic groups .


It ’ s not enough for this malware family to swap just one innocent application with an infected double . The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates , though , Indian and Canadian companies with interests in those Middle Eastern countries are also targeted . Dexphot also generates the names for the tasks at runtime , which means a simple block list of hardcoded task names will not be effective in preventing them from running . Related activity may also include a Southeast Asian government and Central Asian telecom .


The macro then writes this data to a text file in the C:\Programdata folder using a random filename with the .txt extension .


This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets financial organizations . This full-blown spying framework consists of two packages named ‘Tokyo’ and ‘Yokohama’ .


Based on the mutexes and domain names of some of their C&C servers , BlackTech 's campaigns are likely designed to steal their target 's technology . Like many threat groups , TG-3390 conducts strategic web compromises ( SWCs ) , also known as watering hole attacks , on websites associated with the target organization 's vertical or demographic to increase the likelihood of finding victims with relevant information .


Kryptowire says the code , which it found on a BLU R1 HD devices , transmitted fine-grained location information and allowed for the remote installation of other apps . KHRAT is a backdoor trojan purported to be used with the China-linked cyberespionage group DragonOK . Should the user become aware of the infection later , it may be difficult to find the cause due to the fact that the original embedded file contained within the SFX is benign .


In an extensive email to the victim , the INDRIK SPIDER operator provides a decryptor download link , decryptor deletion link ( to be used following decryptor download ) and a password . Kaspersky speculates that ScarCruft could also be behind another zero-day , CVE-2016-0147 , a vulnerability in Microsoft XML Core Services that was patched in April .


One sample in particular , cba5ab65a24be52214736bc1a5bc984953a9c15d0a3826d5b15e94036e5497df used yet another unique user agent string in combination with the previous user agent for its C2 : Mozilla v5.1 ( Windows NT 6.1 ; rv : 6.0.1 ) Gecko Firefox .


Validating Arabic keyboard and language settings on the infected machine .


Unlike many ransomware operations , which usually just require victims to make the payment and subsequently download a decryptor , INDRIK SPIDER requires the victim to engage in communication with an operator . The other one , ScarCruft 's Operation Erebus employs an older exploit , for CVE-2016-4117 and leverages watering holes .


Like EternalPetya , infpub.dat determines if a specific file exists on the system and will exit if found . The Palo Alto Networks Unit 42 research team recently came across a series of malicious files which were almost identical to those targeting the Saudi Arabian government previously discussed by MalwareBytes .


Take pictures with the embedded camera . The group uses an advanced piece of malware known as Remsec ( Backdoor.Remsec ) to conduct its attacks . Part one of this research investigates the Spark campaign , where attackers use social engineering to infect victims , mainly from the Palestinian territories , with the Spark backdoor . With ThreatConnect , teams get a single Platform to simplify the processing , categorization , and response to suspicious emails , reducing the time to remediate active threats from days to minutes .


Once this Intent object is generated with the action value pointing to the decrypted content , the decryption function returns the Intent object to the callee . In May 2017 , NCC Group 's Incident Response team reacted to an ongoing incident . ZIP archives are supposed to have one “End of Central Directory” (EOCD) signifying the end of the . In 2015 GReAT reported that CozyDuke often spear phishes targets with emails containing a link to a hacked website .