The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . The documents that exploit CVE2017-11882 download another payload — an HTML Application ( HTA ) file toting a malicious Visual Basic ( VBS ) script — from the server , which is executed accordingly by the command-line tool mshta.exe .


] qwq-japan [ . While APT1 intruders occasionally use publicly available backdoors such as Poison Ivy and Gh0st RAT . Alternatively, if these do exist and the lock file is older than 10 minutes, the lock file is deleted and the previously running Glimpse script is . The script contained instructions to download and execute a second stage payload .


Normally , this is considered a low-level alert easily defeated by security software .


However , there is also an English version of the DEFENSOR ID app ( see Figure 3 ) besides the Portuguese one , and that app has neither geographical nor language restrictions . Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework . This reverse engineering report looks at the RATs and staging malware found within the Lazarus Group 's collection .


This function creates an event listener for when the SWF file is successfully loaded , which will call the ‘ onload5 ’ function .


However , all of those have been removed from Google Play – despite the fact that some of them didn ’ t contain any adware functionality . The samples we identified target the ATM vendor Diebold . On February 28 , the McAfee discovered that the cybercrime group HIDDEN COBRA continues to target cryptocurrency and financial organizations .


After Check Point notified Google about this threat , the apps were swiftly removed from the Play store . During the same time period , we also observed the actor using the Browser Exploitation Framework ( BeEF ) to compromise victim hosts and download Cobalt Strike . There are 3 types of lists recognized by ZxShell : plain ip addresses , HTTP and FTP addresses . Cisco Secure Firewall ( formerly Next - Generation Firewall and Firepower NGFW ) appliances such as Threat Defense Virtual , Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat .


Emotet activity in 2019 included several high-volume campaigns that collectively distributed tens of millions of messages primarily targeting the manufacturing and healthcare industries . In this blogpost we cover a malicious program for Windows called Octopus that mostly targets diplomatic entities .


Based on the data available to us , Operation Soft Cell has been active since at least 2012 , though some evidence suggests even earlier activity by the threat actor against telecommunications providers . Government officials said they knew the initial attack occurred in 2011 , but are unaware of who specifically is behind the attacks .


The strings section of the app contains embedded command-and-control IP addresses , ports , and domain names in plaintext . APT38 is believed to operate more similarly to an espionage operation , carefully conducting reconnaissance within compromised financial institutions and balancing financially motivated objectives with learning about internal systems . According to SecureWorks , That piece explored how Biderman — who is Jewish — had become the target of concerted harassment campaigns by anti - Semitic and far - right groups online in the months leading up to the hack .


When the family ceases to exist a new one is already available to fill the void , proving that the demand for such malware is always present and that therefore Cerberus has a good chance to survive . Since the end of March up until the end of May 2019 , ESET observed that there were more than 50 victimized computers actively communicating with the C&C server . As detailed in the DOJ complaint , a sample of WHITEOUT ( aka Contopee ) malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank .


Once we reached the non-secured database , we were able to directly observe the app ’ s malicious behavior . Turla is believed to have been operating since at least 2008 , when it successfully breached the US military . HIDDEN COBRA actors use an external tool or dropper to install the FALLCHILL malware to establish persistence .


During the provisioning process , PLATINUM could select whichever username and password they wish . While the attackers used different pretexts when sending these malicious emails , two methodologies stood out .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when the group compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks . In the context of the Ismdoor RAT , the DNS attack technique is used primarily by Greenbug for stealing credentials .


The threat group appears to have developed its own remote access tools that it uses alongside publicly available remote access and post-compromise toolsets .


It can not act independently and operates strictly in accordance with commands received from the C & C server . Tropic Trooper is also still exploiting CVE-2012-0158 , as are many threat actors . In this campaign , the VMProtected launcher used with ShadowPad , as well as with the PortReuse backdoor and skip-2.0 , was replaced by a simpler one . These types of approaches are not uncommon historically , groups have done things like provide " security reports " to compromised organizations to help them " resolve the issue . "


In the following weeks , FireEye released threat intelligence products and updated malware profiles to customers while developing new detection techniques for APT32’s tools and phishing lures . Instead , the group often simply emails a Winnti installer to potential victims , relying on basic social engineering tactics to convince recipients to run the attached malware .


They tend to target any antivirus protections on the device and uninstall them , which increases the possibility of their malware persisting on the device . The attackers used the server deployed on 6 June 2019 to control compromised workstations in these banks . The Carbanak attacks targeting over a 100 financial institutions worldwide .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . 06.2017.docx .


The stage 2 payload was PlugX that beaconed to C&C servers www.icefirebest.com and www.icekkk.net .


The entered data is then checked and the last four digits of the bank card number are also checked against the data sent in the C & C command . Leader is Bookworm 's main module and controls all of the activities of the Trojan , but relies on the additional DLLs to provide specific functionality . The attachments exploited CVE-2017-8759 which was discovered and documented only five days prior to the campaign .


After that , CosmicDuke and the second malware operate entirely independently of each other , including separately contacting their C&C servers .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 . Turla is known to run watering hole and spearphishing campaigns to better pinpoint their targets .


Our security app allows us to transmit this sensitive data encrypted to you , thus increasing the security that you will not suffer any financial loss . These actors perform DNS hijacking through the use of actor-controlled name servers . PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics .


Name svchost.exe Size 1062912 MD5 5e70a5c47c6b59dae7faf0f2d62b28b3 SHA1 cdeea936331fcdd8158c876e9d23539f8976c305 SHA256 730a0e3daf0b54f065bdd2ca427fbe10e8d4e28646a5dc40cbcfb15e1702ed9a Compile Time 2015-04-22 10:49:54 .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . The campaign is believed to be active covertly since fall 2017 .


At the forum of the Armbian operating system , a moderator who goes by the name Tkaiser noted that the backdoor code could remotely be exploitable " if combined with networked services that might allow access to /proc . In 2016 , CTU researchers observed the group using native system . Outlaw : http://www.minpop.com/sk12pack/names.php Command and control . “ Who or what is asdfdfsda@asdf.com ? , ” Biderman asked , after being sent a list of nine email addresses .


This app , dubbed “ TrickMo ” by our team , is designed to bypass second factor and strong authentication pushed to bank customers when they need to authorize a transaction . As observed previously with CVE-2017-11882 and CVE-2018-0802 , the weaponizer was used exclusively by Chinese cyber espionage actors for approximately one year December 2017 through December 2018 , after which cybercrime actors began to incorporate it in their malicious activity . Between May and June 2018 , Unit 42 observed multiple attacks by the OilRig group appearing to originate from a government agency in the Middle East .


This threat is another proof point that attackers are clearly incorporating the mobile device into their surveillance campaigns as a primary attack vector . Fresh from targeting banks in Poland , the banking Trojan has reportedly begun taking aim at banks in Germany . WEBC2 backdoors work for their intended purpose , but they generally have fewer features than the “ Standard Backdoors ” described below . Attackers frequently abuse stolen certificates to prevent the malware they 're spreading from being detected by various security protections .


credential harvester , Sasfis .


] com ws.my-local-weather [ . Since late 2018 , based upon the most-recent posting , FireEye appears to have " walked back " the previously-used terminology of TEMP.Veles and instead refers rather cryptically to the " TRITON actor " , while Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME . those in the Palestinian government . If an adversary can send an unauthorized command message to a control system , then it can instruct the control systems device to perform an action outside the normal bounds of the device 's actions .


HELIX KITTEN is likely an Iranian-based adversary group , active since at least late 2015 , targeting organizations in the aerospace , energy , financial , government , hospitality and telecommunications business verticals . We have already notified Dropbox about the use of its service for this malware .


A mysterious hacker or hackers going by the name " The Shadow Brokers " claims to have hacked a group linked to the NSA and dumped a bunch of its hacking tools . Fxmsp is a hacking collective that has operated in various top-tier Russian- and English-speaking underground communities since 2017 .


From these distribution sites , we can see that 5,520 samples are making HTTP requests to them and these samples have been identified as another downloader Trojan named Nymaim .


The group exploits known vulnerabilities in Microsoft Office products to infect their targets with malware . From the configuration it can be determined that the company was running F-Secure Antivirus and Mofang registered the domain to not appear suspicious .


It could be possible that the espionage actors used his public identity as a diversion to mislead and to hide the real identity of the attackers or it is also possible that this individual was hired to carry out the attack .


The key for each file is generated randomly and stored in the encrypted file with a fixed offset . More recently , in May 2017 , APT33 appeared to target a Saudi organization and a South Korean business conglomerate using a malicious file that attempted to entice victims with job vacancies for a Saudi Arabian petrochemical company . Among all these random keys once the word “salamati” was also used, which means “health” in Farsi . It appears the activity by the group may have been stopped early in the attack chain as the only malicious activity seen on infected machines is credential harvesting .


Given the lack of indicators of compromise , we decided to check to see if this was the same malware we had been researching . APT10 achieves persistence on its targets primarily by using scheduled tasks or Windows services in order to ensure the malware remains active regardless of system reboots . According to Gartner , ASUS is the world’s 5th-largest PC vendor by 2017 unit sales . Over the last decade , Iran has waged a number of disruptive and destructive cyber campaigns against government entities and companies alike , becoming infamous for its deployment of wiper malware as well as its retaliatory attack strategy .


The other overlapping files are tools used by the adversary to locate other systems on the network etool.exe , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 checker1.exe and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket psexec.exe . makeself.sh is a small shell script that generates a self-extractable compressed tar archive from a directory .


Instead , the group often simply emails a Winnti installer to potential victims , relying on basic social engineering tactics to convince recipients to run the attached malware .


Trend Micro offers security for Android mobile devices through Mobile Security for Android™ to protect against these types of attacks . This isn't the first time we've seen Cobalt makes this error—back in March , an attack focussing on 1,880 targets across financial institutions in Kazakhstan had the same flaw . the code was written to link the block comparison variable and block address in MMAT_LOCOPT , But as a new documentary series on Hulu reveals [ SPOILER ALERT ! ] , there was just one problem with that theory : Their top suspect had killed himself more than a year before the hackers began publishing stolen user data .


The keylogger can track three different events ( Figure 5 ) : TYPE_VIEW_CLICKED Represents the event of clicking on a View-like Button , CompoundButton , etc . The latter was one of at least three law firms Butterfly has targeted over the past three years . As with their previous fake company “ Combi Security ” , we are confident that they continue to create new personas for use in either targeting or recruiting under a “ new ” brand , “ IPC ” . In fact , this chain also leads to NetSupport RAT .


HummingWhale , as the professionally developed malware has been dubbed , is a variant of HummingBad , the name given to a family of malicious apps researchers documented in July invading non-Google app markets . The design of KiloAlfa is broken down into two basic components : the persistence functionality and the keylogging functionality . However , prior to this attempted attack , Symantec had rolled out proactive protection against any attempt to exploit this vulnerability ( Exp.CVE-2018-20250 ) . Such non - native files and other data may be removed over the course of an intrusion to maintain a small footprint or as a standard part of the post - intrusion cleanup process .


We further assess that APT28 is the group responsible for the network compromises of WADA and the DNC and other entities related to the 2016 U.S. presidential election cycle .


The modern version of Rotexy combines the functions of a banking Trojan and ransomware . In fact , REDBALDKNIGHT has been zeroing in on Japanese organizations as early as 2008 — at least based on the file properties of the decoy documents they've been sending to their targets . The malware known as RATANKBA is just one of the weapons in Lazarus ' arsenal .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . Analysts in our DeepSight Managed Adversary and Threat Intelligence ( MATI ) team have found a new backdoor , Backdoor.Powemuddy , new variants of Seedworm 's Powermud backdoor ( aka POWERSTATS ) , a GitHub repository used by the group to store their scripts , as well as several post-compromise tools the group uses to exploit victims once they have established a foothold in their network .


Beginning in 2017 , the Lazarus group heavily targeted individuals with spear phishing emails impersonating job recruiters which contained malicious documents . Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue .


After enabling AccessibilityService , the malware sets itself as the default SMS app Now installed and having obtained the necessary permissions from the user , Riltok contacts its C & C server . APT10 is a Chinese cyber espionage group that FireEye has tracked since 2009 . The .scr file contains 2 Office documents .


During this stage , the loader may also call a certain API using native system calls , which is another way to bypass breakpoints on API and security solutions using hooks . At a high level , Retriever is a .NET downloader that downloads secondary payloads from servers associated with Magic Hound . The steganography algorithm appears to be bespoke and utilizes a least significant bit approach to minimize visual differences when compared with the original image to prevent analysis by discovery tools . " VP Labs RD and Deputy CSO at LogRhythm .


EVENTBOT VERSION 0.0.0.2 Dynamic Library Loading As of Version 0.0.0.2 , EventBot attempts to hide its main functionality from static analysis . KHRAT is a backdoor trojan purported to be used with the China-linked cyberespionage group DragonOK . In July 2017 , FireEye observed APT34 targeting an organization in the Middle East using the POWRUNER PowerShell-based backdoor and the downloader BONDUPDATER .


Attackers in this case made every attempt to launch a clever attack campaign by spoofing legitimate email ids and using an email theme relevant to the targets .


As of this writing , all the domains were registered recently and some are already offline . As explained in further detail below , the JS dropper ultimately installs a JS decryptor onto an infected machine that will then finally decrypt and execute the actual KopiLuwak backdoor in memory only . A case of these obscure lines can be found in a blogpost published in coordination and parallel to this report - " Flying Kitten to Rocket Kitten , A Case of Ambiguity and Shared Code " 3 by Collin Anderson and Claudio Guarnieri .


Shamoon2 : 69.87.223.26 .


First , the app creates a JavaScript function to call a Java method , getImageBase64 , exposed to WebView using addJavascriptInterface . The targets and themes of Bahamut 's campaigns have consistently fallen within two regions – South Asia ( primarily Pakistan , specifically Kashmir ) and the Middle East ( from Morocco to Iran ) . ZxShell employs a strange method for communication : it hooks the NtWriteFile API and recognizes 5 different special handle values as commands : In this blog post , we show how the newly found Kritec skimmer was found along side one of its competitors .


CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 . In particular , the threat actors have exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code .


In 2018 , versions of Rotexy emerged that contacted the C & C using its IP address . During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros . WannaCry ( also known as WCry or WanaCryptor ) malware is a self-propagating ( worm-like ) ransomware that spreads through internal networks and over the public internet by exploiting a vulnerability in Microsoft 's Server Message Block ( SMB ) protocol , MS17-010 .


This list is expected to grow in the future . Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials . The email below was sent from a personal email account with a subject line of “ New Year Wishes on January 1st ” .


from the Android device and SIM card setForward — currently not implemented , but can be used to hijack the infected device getForward — currently not implemented , but can be used to hijack the infected device hasPkg — check the device whether a specified app is installed or not setRingerMode — set the device ’ s ringer mode setRecEnable — set the device ’ s ringer mode as silent reqState — get a detailed phone connection status , which includes activated network and Wi-Fi ( with or without password ) showHome — The group was initially known for its espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures . The tool is able to grant remote access and full , direct control of the infected machine to the group .


In the course of further research , we found a number of related samples that point to a long-term development process . MuddyWater target groups across Middle East and Central Asia , primarily using spear phishing emails with malicious attachments . Charming Kitten usually tries to access private email and Facebook accounts , and sometimes establishes a foothold on victim computers as a secondary objective .


However , because of the length of time for which the group has been distributing Dridex , distribution mechanisms trace the state of the art for the last two years of email campaigns with techniques ranging from straight macro documents to a variety of zipped scripts .


Although they may have started much earlier , the earliest BlackEnergy sample we could attribute to the Quedagh gang is from December 14 , 2010 . APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


The Quasar serve does not verify the RAT data , and displays this data in the RAT Server GUI when the RAT is executed and connects to the server .


Based on this information , Talos assesses with high confidence that the malware is the same and this is , in fact , the Gustuff malware . We observed the deployment and testing of multiple versions of Quasar malware , and the introduction of the bespoke malware families ChChes and RedLeaves . We believe this to be a very sophisticated supply chain attack , which matches or even surpasses the Shadowpad and the CCleaner incidents in complexity and techniques . Simultaneously , a new variant of Monti , based on the Linux platform , has surfaced , demonstrating notable differences from its previous Linux - based versions .


To ensure you are fully protected against PHAs and other threats , we recommend these 5 basic steps : Install apps only from reputable sources : Install apps from a reputable source , such as Google Play . RASPITE overlaps significantly with Symantec 's Leafminer , which recently released a report on the group 's activity in the Middle East . This may suggest that the malefactor changed a build configuration rather than the source code itself . Cisco Secure Web Appliance ( formerly Web Security Appliance ) automatically blocks potentially dangerous sites and tests suspicious sites before users access them .


DYNAMIC LIBRARY LOADING Once the application has finished the installation process , the malware starts its real malicious activity . We also found the China Chopper webshell on the SharePoint servers , which has also been used by the Emissary Panda threat group . Gorgon Group isn't the first actor group we've witnessed dabble in both nation state level and criminal attacks .


TURNING OFF YOUR PHONE IS MEANINGLESS , ALL YOUR DATA IS ALREADY STORED ON OUR SERVERS ! One of Silence 's first targets was a Russian bank , when they tried to attack AWS CBR . The macros popped the same “ Document decryption error ” error message—even if macro code remain totally different . Monitor for any attempts to enable scripts running on a system would be considered suspicious .


In this way , when the service runs during boot , the original Windows executable is executed from a different location and it will automatically load and map the malicious DLL inside its address space , instead of using the genuine system library . By compromising a user account that has administrative or elevated access , Magic Hound can quickly access a targeted environment to achieve their objectives . Known to load an updated version of Remy backdoor . For operational plans development , the combination of threats , vulnerabilities , and impacts must be evaluated in order to identify important trends and decide where effort should be applied to eliminate or reduce threat capabilities eliminate or reduce vulnerabilities and assess , coordinate , and deconflict all cyberspace operations NIST , 2010 .


Although a number of actors have distributed Dridex , TA505 operates multiple affiliate IDs , including what appears to be the earliest recorded affiliate , botnet ID 125 .


] website mobilestoreupdate [ . The Elfin espionage group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries . The Remexi developers seem to rely on legitimate Microsoft utilities, which we enumerate in the table below： extract.exe Deploys modules from the .cab file into the working Event Cache directory, bitsadmin.exe Fetches files from the C2 server to parse and execute . However , even though the employees work for you they may feel the companys property belongs to them , not the business , and may feel justified in theft .


Like many original equipment manufacturers , it uses software components from other developers . Once on the Visma network , APT10 attackers used the Microsoft BITSAdmin CLI tool to copy malicious tools from a suspected attacker-controlled C2 hosted on 173.254.236[.]158 to the \ProgramData\temp\ directory on the infected host . Invader : e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e .


The Flash object must contact an active C2 server to download an additional Flash object containing exploit code ;


on Feb 28 , 2016 . Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . Entities in these sectors are often " enabling victims " as telecommunications providers or IT services agencies and vendors could provide Seedworm actors with further victims to compromise .


Finally , the malware downloads the next stage payload , decrypting it and possibly executing it with the Print parameter .


The folders seem to contain information about the company 's development documentation , artificial intelligence model , web security software , and antivirus software base code . Attackers are targeting Windows platform and aiming at government institutions as well as big companies in Colombia .


Talos assesses with high confidence that Group 123 was responsible for six campaigns . These campaign-related VPSs are located in South Africa .


Whitefly usually attempts to remain within a targeted organization for long periods of time—often months—in order to steal large volumes of information . This vulnerability was discovered by FireEye in September 2017 , and it is a vulnerability we have observed being exploited in the wild .


Sofacy is known for making extensive use of phishing attacks to lure targets into revealing their credentials via realistic reconstruction of internal systems , such as webmails , as employed against the Georgian Ministry of Internal Affairs in the infamous attacks that preceded the Georgian invasion of 2008 .


The only sample was found on public repositories and almost seemed to indicate a test run to determine the detection ratio of the sample . LYCEUM deployed this tool via DanBot shortly after gaining initial access to a compromised environment . APT38 , in particular , is strongly distinguishable because of its specific focus on financial institutions and operations that attempt to use SWIFT fraud to steal millions of dollars at a time .


Most devices can be controlled by Xiaomi ’ s “ MiHome ” Android app , which is available on Google Play with between 1,000,000 and 5,000,000 downloads . In 2014 , APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service . In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM ( aka Xagent , aka CHOPSTICK ) , JHUHUGIT ( which is built with code from the Carberp sources ) , AZZY ( aka ADVSTORESHELL , NETUI , EVILTOSS , and spans across 4-5 generations ) and a few others .


Figure 7 . Most of these data-stealing capabilities were present in the oldest variants of CARBANAK that we have seen and some were added over time . Umbrella , our secure internet gateway (SIG) , blocks users from connecting to malicious domains , IPs , and URLs , whether users are on or off the corporate network .


It seems that the malware authors produced and delivered malware that only works on specific systems based on previously collected information .


In addition , the network beacon traffic for the new malware resembles those used by the CORESHELL backdoor .


The group has demonstrated access to zero-day vulnerabilities (CVE-2018-0802) , and the ability to incorporate them into operations . The usefulness of flare-qdb can be seen in cases such as loops dealing with strings .


After further analysis , it was discovered that the RTF files were exploiting the CVE-2018-0798 vulnerability in Microsoft’s Equation Editor (EQNEDT32) . In the Bahamut report , we discussed two domains found within our search that were linked with a custom Android malware agent .


These three macOS installers use a similar post installer script in order to implant a mach-o payload , as well as using the same command-line argument when executing the fetched second-stage payload .


According to the build path ( Z:\Loader\x64\Release\WinloaderExe.pdb ) , the malware author called this malware a loader .


The dropper and the payload are quite similar to the previous versions but the author modified some public information such as MUTEX name , obfuscation .


This campaign , like later CozyDuke campaigns , began with spear-phishing emails that tried to impersonate commonly seen spam emails .


The decompile method is based on the fact that Android applications are Java-based , meaning it is possible to recompile it . As noted in our previous blog on Buhtrap , this gang has been actively targeting Russian businesses , mostly through spear-phishing . The installer downloads an MSI package from one of the two URLs , and then launches msiexec.exe to perform a silent install . As we have seen over the years , SocGholish is an established player that has managed to compromise countless victims and deliver ransomware after facilitating the installation of tools like Cobalt Strike or Mimikatz .


The table below shows the commands available to the operator for tasking on infected devices . The attack leveraged malware we called ' BlackLambert ' , which was used to target a high profile organization in Europe . The attackers primarily use malicious .PDF files that exploit vulnerabilities in Adobe Reader , Acrobat , and Flash Player , including the use of two zero-day exploits—one in 2009 and another in 2011 . Our gathered field data shows the following statistics on CSP usage across the Internet ( based on HTTPArchive March 2020 scan ):


If the system is deemed interesting , the next stage malware would be delivered into corresponding directories .


The hook gets windows messages indicating when a network drive has been attached .


One chunk contains the entire malware DLL code ( without PE headers ) . This cyber-espionage group was dubbed ' Rocket Kitten ' , and remains active as of this writing , with reported attacks as recent as October 2015 . The final payload comes in a form of a launcher DLL that contains an encrypted backdoor in its .rdata section and a plain-text configuration in its resources . Astamirov is now facing charges of wire fraud and of intentionally damaging protected computers , plus he 's accused of making ransom demands through deploying ransomware .


This opens the door to , for example , fully controlling the victim ’ s bank account . This campaign used the abovementioned .html file , malicious Excel/Word document VBA macro , the FlawedAmmyy payload , and Amadey . This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets financial organizations .


To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control . OSX Malware Linked to Operation Emmental Hijacks User Network Traffic .


After successful installation , tap Open and enable the device administrator . We believe that the Sea Turtle campaign continues to be highly successful for several reasons . APT37 has also been linked to following campaigns between 2016-2018 : Operation Daybreak , Operation Erebus , Golden Time , Evil New Year , Are you Happy? , FreeMilk , Northern Korean Human Rights , and Evil New Year 2018 .


Once in their possession , the actors use these compromised payment card credentials to generate further card information . APT threat actors , most likely nation state-sponsored , targeted a diplomat in the French Ministry of Foreign Affairs with a seemingly legitimate invitation to a technology conference in Taiwan .


Appendix Samples Some of the latest Cerberus samples found in the wild : App name Package name SHA 256 hash Flash Player com.uxlgtsvfdc.zipvwntdy 728a6ea44aab94a2d0ebbccbf0c1b4a93fbd9efa8813c19a88d368d6a46b4f4f Flash Player com.ognbsfhszj.hqpquokjdp fe28aba6a942b6713d7142117afdf70f5e731c56eff8956ecdb40cdc28c7c329 The SectorJ04 group , which has been utilizing the same pattern of infection and the same malware for more than six months , is believed to be attempting to change its infection methods such as downloading malware directly from malicious documents without using MSI installation files , changing their spam email format and using new types of backdoor . BRONZE BUTLER compromises organizations to conduct cyberespionage , primarily focusing on Japan .


The overarching campaign appears to target both Chinese nationals within different industries and government agencies in Southern Asia . This threat report gives insight into some of the information that Fox-IT has about a threat actor that it follows , called Mofang .


In addition to the following step-by-step process illustrates how Cannon communicates with the actor-controlled C2 email address to obtain a secondary payload .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools . These operations involved highly targeted email lures with repurposed content and attachments that contained an updated version of KeyBoy .


Sensitive bank documents have be found on the servers that were controlling Carbanak . this attack against a Kaspersky Lab user on August 5 , 2014 .


The credentials they use to register their malware infrastructure are easily associated with their public social media accounts on Google® , Facebook® , MySpace® , Instagram® , and various dating and blogging sites . VAMP targeted various types of data from the phones of victims : images , text messages , contacts , and call history , among others .


The use of weaponized legitimate documents is a longstanding operational standard of Patchwork . It is highly likely that the Mofang group is a group that operates out of China and is probably government-affiliated .


Data was always sent to the C & C server via HTTP in the body of a POST request in encrypted form to the relative address /something/index.php . CTU researchers have evidence that the threat group compromised U.S and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations . These new samples targeted Linux- and Unix-based operating systems , vulnerable servers , and internet of things ( IoT ) devices by exploiting known vulnerabilities with available exploits . The customers of these commercial spyware organizations know who their victim(s ) are .


After downloading and unpacking , the main module executes the exploit binary file . The dropped PE file has the distinctive file name 8.t” . Tropic Trooper focuses on targeting government , healthcare , transportation , and high-tech industries and has been active since 2011 .


Claudio Guarnieri , a security researcher who has investigated Hacking Team along with others at the Citizen Lab , was quick to point this out . Nevertheless , resourceful threat actors such as ScarCruft will probably continue to deploy zero-day exploits against their high profile targets .


Microsoft reiterates that the PLATINUM tool does not expose flaws in Intel® Active Management Technology ( AMT ) , but uses the technology within an already compromised network to evade security monitoring tools . Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor.Sogu .


] infogooogel-drive [ . Considering the language being used in the malicious code is Arabic , it seems that the attacker is familiar with Arabic language as well . This saves the intruder from having to manually edit webpages . Adversaries may attempt to hide artifacts associated with their behaviors to evade detection .


This section contains network signatures and host-based rules that can be used to detect malicious activity associated with HIDDEN COBRA actors .


Windows 10 S devices are naturally protected against FinFisher and other threats thanks to the strong code integrity policies that don ’ t allow unknown unsigned binaries to run ( thus stopping FinFisher ’ s PE installer ) or loaded ( blocking FinFisher ’ s DLL persistence ) . menuPass is an ongoing APT campaign with a broad range of targets and will likely continue to target Japan in the future . OceanLotus : 0 config varies content is read from resource P1/1 . In one of our previous blog entries , we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming , pharmaceutical , and telecommunications companies .


These devices were located in the following countries : How we protect you To protect Android devices and users , Google Play provides a complete set of security services that update outside of platform releases . Symantec identified two strains of custom malware used by the Leafminer group : Trojan.Imecab and Backdoor.Sorgu . Given that these attacks were mostly targeted against Asia and the gaming industry , it shouldn’t be surprising they are the work of the group described in Kaspersky ’s “ Winnti – More than just a game ” . Geographically , most victims are located in Europe , specifically Italy .


The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences . In October 2015 , the Callisto Group was observed sending targeted credential phishing emails .


The domain go-microstf.com was originally set up to spoof Google Analytics login page .


After compromising a system , typically by installing Powermud or Powemuddy , Seedworm first runs a tool that steals passwords saved in users ' web browsers and email , demonstrating that access to the victim 's email , social media , and chat accounts is one of their likely goals . Adversary behavioral artifacts further suggest the TEMP.Veles operators are based in Moscow , lending some further support to the scenario that CNIIHM , a Russian research organization in Moscow , has been involved in TEMP.Veles activity .


The first version of Proyecto RAT” was published at the end of 2010 . We identified an overlap in the domain voguextra.com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post .


In all of these cases , we operate under strict confidentiality rules with our customers and cannot reveal publicly any information about these attacks .


FANCY BEAR adversary used different tradecraft , deploying X-Agent malware with capabilities to do remote command execution , file transmission and keylogging .


These exploits still plague many devices today because security patches that fix them may not be available for some versions of Android , or the patches were never installed by the user . A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . We also observed a pattern that was also using an 8-bit portion of the register . Depending on the campaign , the final payload or the third intermediate stage is appended as an encrypted binary blob to the end of the image .


Talos said the perpetrators of DNSpionage were able to steal email and other login credentials from a number of government and private sector entities in Lebanon and the United Arab Emirates by hijacking the DNS servers for these targets , so that all email and virtual private networking ( VPN ) traffic was redirected to an Internet address controlled by the attackers . CTU researchers have observed the threat actors installing a credential logger and backdoor on Microsoft Exchange servers , which requires a technical grasp of Internet Information Services ( IIS ) .


The stolen data fields are : Mobile - The infected device phone number Machine - The device model ( in our example : Google Pixel 2 ) Sversion - The OS version Bank - Checks if there are any banking-related or cryptocurrency trading apps Provider - The telecommunication provider ( IMSI value in device settings ) npki - Checks if the folder named NPKI ( National Public Key Infrastructure ) might contain authentication certificates related to financial transactions onStartCommand function for stealing device information and additional sensitive data . The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 . Each attack comprises a variety of phases , including reconnaissance , exploitation , command and control , lateral movement , and Exfiltration .


In the past year , FireEye iSIGHT Intelligence has discovered newly developed wiper malware being deployed by TEMP.Reaper , which we detect as RUHAPPY . CraP2P has frequently been used to distribute other malware such as Locky and Dridex , but also supported large scale spam campaigns for dating advertisement and pump-and-dump scams after the demise of Kelihos .


If the argument -SSL is given through command-line to the artifact , these beacons will be encapsulated in an SSL connection and a proper TLS handshake will be initiated with the C&C .


These PDFs would attempt to silently infect the recipient with MiniDuke , while distracting them by displaying a decoy document .


CTU researchers assess with high confidence that threat groups like TG-1314 will continue to live off of the land to avoid detection and conduct their operations .


The actor attempts to exploit CVE-2018–8440 — an elevation of privilege vulnerability in Windows when it improperly handles calls to Advanced Local Procedure Call — to elevate the privileges using a modified proof-of-concept exploit . The China-backed Barium APT is suspected to be at the helm of the project .


Eventually , the screen PIN preferences will be saved to an additional XML file in the shared preferences folder . The dropped PE file has the distinctive file name 8.t” . Between December 28 , 2016 and January 1 , 2017 , CTU researchers observed a phishing campaign targeting Middle Eastern organizations .


Our investigation of APT28 ’s compromise of WADA ’s network , and our observations of the surrounding events reveal how Russia sought to counteract a damaging narrative and delegitimize the institutions leveling criticism .


This subset of SPLM / CHOPSTICK activity leads into several small surprises that take us into 2018 , to be discussed in further detail at SAS 2018 .


They are believed to have successfully attacked the Ministries of Internal and Foreign Affairs of several ex-Soviet countries , as well as Eastern European governments and military institutions , and NATO and the White House .


Skype ; 3rd party stores only Most of these apps are well established and available on Google Play , however , com.skype.rover appears to be available only on third-party app stores . In these instances , APT41 leveraged TeamViewer to transfer malware into the compromised environment , although we do not have direct evidence of APT41 compromising TeamViewer . As researchers continued discovering new toolsets that were created and used by the same group that had been operating MiniDuke , and thus the threat actor operating the toolsets started to be commonly referred to as " Dukes " .


During our analysis , the C2 server provided a secondary payload that functionally appeared similar to the initial Zebrocy sample .


Chinese language traces in the code : During the investigation , the Cybereason Nocturnus team discovered code artifacts that may indicate Chinese threat actors . FIN7 thus continue to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework . Coincidentally , following the recent hack of a US Navy contractor and theft of highly sensitive data on submarine warfare , we have found evidence of very recent activity by a group referred to as APT15 , known for committing cyber espionage which is believed to be affiliated with the Chinese government .


If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs . UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques .


Port 6208 : IMO extraction service . Symantec detects this threat as Backdoor.Nidiran . Meetings minutes of different Palestinian organizations . Request a demo meeting with us or reach out to us at salesthreatconnect.com to see how we can help automate phishing analysis and response for your organization .


Poseidon has maintained a consistently evolving toolkit since the mid-2000s . The attackers try to lure targets through spear phishing emails that include compressed executables .


Taking this information from directory listings , like the one shown above , allowed for the decryption of all content . Infy engaged in malware spearphishing against the same targets as Flying Kitten from the outset of its campaign ; Operation Cleaver has registered several resources related to development agencies that have been the subject of intrusion attempts by others since February 2014 . advanbusiness.com businessconsults.net businessformars.com companyinfosite.com conferencesinfo.com copporationnews.com . Unfortunately , the CSP policy ca n’t discriminate based on the Tag ID .


Locky distribution ceased in June and July but returned in August with volumes rivaling the peaks of 2016 .


We decided to call the operation “ ViceLeaker ” , because of strings and variables in its code . Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body . For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2 This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP port 443 . The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload . Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected .


All the domains in both batches were initially registered with the same alias : “ John Kasai of Klagenfurt , Austria ” .


User clicks link to attacker controlled website .


A BREXIT-themed lure document that delivers ZEKAPAB malware .


Based on our findings Linux.GreedyAntd 's operations closely resemble previous cryptojacking campaigns deployed by Pacha Group in the past . While the Sima moniker could similarly originate from software labels , it is a common female Persian name and a Persian-language Word for " visage " or " appearance " . Given its use in more advanced social engineering campaigns against women 's rights activists , the label seem particularly apt .


Our analysis shows that the threat actor behind the FakeSpy malware is a Chinese-speaking group , commonly referred to as " Roaming Mantis '' , a group that is known to have launched similar campaigns in the past . The samples we analyzed originated from the Philippines . These VNC exectuables would either be included in the SFX file or downloaded by the batch script .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server .


This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge . The exploit installs Silence’s loader , designed to download backdoors and other malicious programs .


including the functionality to steal passwords , take screenshots , log keystrokes , and steal files .


HummingWhale has also been observed hiding the original malicious app once it 's installed and trying to improve its Google Play reputation by automatically generating posts disguised as positive user comments and ratings . This reverse engineering report looks at the RATs and staging malware found within the Lazarus Group 's collection . DarkComet ( Backdoor.Breut ) : Another commodity RAT used to open a backdoor on an infected computer and steal information . Lastly , the command supplies a file named “ s1.txt ” in the " pack\scil\ " folder of the attacker 's ISO .


While they still use RAR SFX format for the initial payloads , ZeroT now uses a the legitimate McAfee utility ( SHA256 3124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe ) named mcut.exe instead of the Norman Safeground AS for sideloading as they have in the past .


This application is freely available from poisonivy-rat.com .


GolfSpy encrypts all the stolen data using a simple XOR operation with a pre-configured key before sending it to the C & C server using the HTTP POST method . We believe they may have some links to North Korea , which may explain why ScarCruft decided to closely monitor them . The third module allows the operators to take a screenshot of the remote system . Instead , they can make money by marketing their services to other bad actors for a fee .


In their latest leak , they have released the UNITEDRAKE NSA exploit , which is a remote access and control tool that can remotely target Windows-based systems to capture desired information and transfer it to a server . Dokument 09.06.2017.docx .


The entered data is forwarded to the cybercriminals . FireEye’s visibility into the operations of APT28 – a group we believe the Russian government sponsors – has given us insight into some of the government’s targets , as well as its objectives and the activities designed to further them . In the sample only the English version can be displayed to the user (that is hardcoded in the sample) .


Some apps have started with clean versions , in an attempt to grow user bases and build the developer accounts ’ reputations . Both Win32/Barlaiy & Win32/PlugX.L are remote access " trojans " , which allow Barium to gather a victim 's information , control a victim 's device , install additional malware , and exfiltrate information fi-om a victim 's device . The buttons are all in Chinese , with the help of Google Translate and keen detective skills ( read : button clicking ) , we ’ve deciphered the functionality . These group policies contained instructions to copy a file from a server to the local hard drive and to schedule a task to run the copied file at a particular time .


The Sofacy threat group continues to use their DealersChoice framework to exploit Flash vulnerabilities in their attack campaigns .


This page mimics a legitimate bank form and blocks the device screen until the user enters all the information . While not detected at the time , Microsoft 's antivirus and security products now detect this Barium malicious file and flag the file as " Win32/ShadowPad.A " . While the group has not yet demonstrated an ICS capability , RASPITE 's recent targeting focus and methodology are clear indicators of necessary activity for initial intrusion operations into an IT network to prepare the ACT for later potential ICS events .


Our research on the RTM malware shows that the Russian banking system is still a target of choice for criminals . Back in February 2016 , Indian army officials issued a warning against the usage of three apps , WeChat , SmeshApp , and Line , fearing that these apps collected too much information if installed on smartphones used by Indian army personnel .


In addition to “ Free VPN Master Android , ” we ’ ve observed Red Alert 2.0 Trojans in the wild disguising themselves using names like : Flash Player or Update Flash Player Android Update or Android Antivirus Chrome Update or Google Update Update Google Market WhatsApp Viber OneCoin Wallet Pornhub Tactic FlashLight or PROFlashLight Finanzonline The vast majority of in-the-wild Red Alert 2.0 samples falsely present themselves as Adobe Flash player for Android , a utility that Adobe stopped supporting years ago . The compilation times of APT37 malware is consistent with a developer operating in the North Korea time zone ( UTC +8:30 ) and follows what is believed to be a typical North Korean workday . The BITS mechanism has existed since Windows XP up to the current Windows 10 versions and was developed to create download/upload jobs, mostly to update the OS . They will usually have found your email address via a data breach of a third party .


Despite the group's proficiency , there are still many opportunities to detect and disrupt its operation by studying its modus operandi .


In the actual targeted attack detected by the Hungarian National Security Agency , TeamSpy used components of the TeamViewer tool combined with other malware modules . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload .


The Lazarus Group was first identified in Novetta’s report Operation Blockbuster in February 2016 . The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer .


Unfortunately , there is a specific feature of Android vulnerabilities that means it is only possible to get rid of them by receiving an update from the device manufacturers . A variety of malware , including the PlugX tool , was shared with other known Chinese threat groups . It then creates a service named clr_optimization_v4.0.30229_32 , which is responsible for executing CLR.exe . The sample of LIGHTWORK we obtained includes eight hardcoded IEC-104 information object addresses ( IOA ) , which typically correlate with input or output data elements on a device and may correspond to power line switches or circuit breakers in an RTU or relay configuration .


This is a first for an APT group , and shows Sednit has access to very sophisticated tools to conduct its espionage operations .


This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans . The developers of Bookworm use these modules in a rather unique ACT , as the other embedded DLLs provide API functions for Leader to carry out its tasks .


They have at some point used just about every cloaking and obfuscation technique under the sun in an attempt to go undetected . ALLANITE operations continue and intelligence indicates activity since at least May 2017 . A host firewall Several issues in Foxit PDF reader could lead to arbitrary code execution Foxit PDF Reader is one of the most popular PDF readers on the market , offering many similar features to Adobe Acrobat .


Cannon moves the downloaded file to the specified path .


The payload turned out to be an open source penetration test toolkit called Koadic .


] net , is now a legitimate version of the DroidVPN app , and looks as shown in Figure 1 below . RocketMan!” (probably a reference to Donald Trump’s nickname for Kim Jong Un) and MiamiBeach” serve as the first beacon messages from the victim to the control server . APT1 is a China-based cyber-espionage group , active since mid-2006 .


Coverage Additional ways our customers can detect and block this threat are listed below . The Machete group sends very specific emails directly to its victims , and these change from target to target . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank .


2015 , APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


Tools such as PlugX have historically been leveraged by threat groups operating in the PRC .


This particular HenBox variant , as listed in Table 3 above , harvests data from two popular messaging and social media apps : Voxer Walkie Talkie Messenger ( com.rebelvox.voxer ) and Tencent ’ s WeChat ( com.tencent.mm ) . APT41 has used several malware families that have also been used by other Chinese espionage operators , including variants of HIGHNOON , HOMEUNIX , PHOTO , SOGU , and ZXSHELL , among others . Of note , we also discovered the Sofacy group using a very similar delivery document to deliver a new Trojan called Cannon .


Thanks to a relative lack of security controls applied to mobile devices , these devices have become very attractive targets for a broad range of malicious actors . According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 . Lazarus Group is a threat group that has been attributed to the North Korean government .


Two years back , in the month of March we reported , NQ Mobile Security Research Center uncovered the world 's first Android bootkit malware called 'DKFBootKit ' , that replaces certain boot processes and can begin running even before the system is completely booted up . The computers of diplomats , military attachés , private assistants , secretaries to Prime Ministers , journalists and others are under the concealed control of unknown assailant (s ) . While APT1 intruders occasionally use publicly available backdoors such as Poison Ivy and Gh0st RAT , the vast majority of the time they use what appear to be their own custom backdoors . Researchers have uncovered an ongoing cyberespionage campaign targeting more than 30 online video game companies over the past four years .


This file is decrypted and injected into an instance of InstallUtiil.exe , and functions as a Tor anonymizer . PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched .


In this report , we'll review how NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . The group has also targeted businesses operating in the South China Sea , which is a strategically important region and the focus of disputes between China and other states .


Industrial safety systems are highly redundant and separate controls which override and manage industrial processes if they approach unsafe conditions such as over-pressurization , overspeed , or over-heating .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . The latest version of Madi also has the ability to monitor the Russian social network Vkontakte ( VK ) along with the Jabber messaging platform to look for users who visit websites that contain words like " USA " , " Skype " , and " gov " .


Keeping in mind the sensitivity of passwords , GoCrack includes an entitlement-based system that prevents users from accessing task data unless they are the original creator or they grant additional users to the task . Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


If you haven't heard about it for some reason , I would recommend to read this detailed report by Group-IB , as this APT attacks not only Russian banks , but also banks in more than 25 countries . In early May 2016 , both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe .


Figure 5 . ScarCruft also attacked a diplomatic agency in Hong Kong , and another diplomatic agency in North Korea . To do that , it also drops a PowerShell script on the workstation to execute . • Bad actors who want to get into the cyber attack business need little to no technical skills to get started .


The InterceptCall receiver is triggered whenever there is an incoming or outgoing call . How Buckeye obtained Equation Group tools at least a year prior to the Shadow Brokers leak remains unknown . Carbanak is a threat group that mainly targets banks .


They should also take the following steps to harden both web applications and the servers hosting them to reduce the risk of network intrusion via this vector .


Distribution via alternative app stores . LuckyMouse has been spotted using a widely used Microsoft Office vulnerability ( CVE-2017-11882 ) . The launcher is a 32-bit DLL named hpqhvsei.dll , which is the name of a legitimate DLL loaded by hpqhvind.exe . In one of our previous blog entries , we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming , pharmaceutical , and telecommunications companies .


Two of these campaigns were detailed in separate blog posts by the Polish security company Prevenity , who said that both campaigns targeted Polish entities with spear- phishing emails containing malicious attachments with relevant Polish language names .


It is however still only an iteration on earlier versions of the MiniDuke loader .


The user visits the URL to complete the payment and enters their phone number . The group has also targeted businesses operating in the South China Sea , which is a strategically important region and the focus of disputes between China and other states . Ps Process service Unix command implementation . What ’s more , two other vulnerabilities in MOVEit were found while new victims were still coming forward .


During our investigation into the activity , FireEye identified a direct overlap between BADRABBIT redirect sites and sites hosting a profiler we’ve been tracking as BACKSWING . The Magic Hound campaign was also discovered using a custom dropper tool , which we have named MagicHound.DropIt .


The one non-random string difference was the path to the “ .txt ” and “ .exe ” files within the command “ certutil -decode ” , as the Sofacy document used “ C:\Programdata\ ” for the path whereas the Luckystrike document used the path stored in the Application.UserLibraryPath environment variable .


During the May 2014 Ukrainian presidential election , purported pro-Russian hacktivists CyberBerkut conducted a series of malicious activities against the CEC including a system compromise , data destruction , a data leak , a distributed denial-of-service ( DDoS ) attack , and an attempted defacement of the CEC website with fake election results .


The ‘ onload2 ’ function decrypts the response received from the HTTP request issued in ‘ onload1 ’ function .


The class “ org.starsizew.Tb ” also has a self-monitoring mechanism to restart itself when its own onDestroy API is triggered . Artifacts identified within the malware samples related to these attacks also suggest the targeting of the defense industry in Saudi Arabia , which appears to be related to an earlier wave of attacks carried out in the fall of 2015 . Finally , the malware will write the “ IndexOfﬁce.txt ” ﬁle in the “ %APPDATA%\Microsoft\Ofﬁce\ ” path . In early 2020 , new versions of Foudre a malware associated with the APT Advanced Persistent Threat Infy discussed in detail below emerged with new and improved elements from previous versions .


The macro ran a PowerShell command that attempted to download additional PowerShell loader scripts for PupyRAT , a research and penetration-testing tool that has been used in attacks . The pie chart in Figure 8 shows that the vast majority ( 73% ) of the hosts are geographically located in Thailand , which matches the known targeting of this threat group .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy .


The key for the RC4 encryption in this sample is the hardcoded string “ h0le ” .


Quasar contains the NetSerializer library that handles serialization of high level IPacket objects that the client and server use to communicate .


Palo Alto Networks Traps Advanced Endpoint Protection recently prevented recent attacks that we believe are part of a campaign linked to DustySky .


The malicious executables all called out to the same URLs on windowsnewupdates.com .


Figure 13 : Popup asking for a credit card number The application also supports stealing credit card verification information ( Figures 14 and 15 ) . By hiding these security flaws from manufacturers like Apple and Google the CIA ensures that it can hack everyone &mdsh; at the expense of leaving everyone hackable . The intrusion into healthcare company Anthem has been attributed to Deep Panda .


As Riltok shows , cybercriminals can apply the same methods of infection to victims in different countries with more or less the same success . Kaspersky found an active campaign by a Chinese APT group we call SixLittleMonkeys that uses a new version of the Microcin Trojan and a RAT that we call HawkEye as a last stager . Indeed , the malware author moved this part of the code from the core of the malware to a library .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id87721 [ . The attackers would then use the certificate on actor-controlled servers to perform additional MitM operations to harvest additional credentials . APT28 is a threat group that has been attributed to Russia's Main Intelligence Directorate of the Russian General Staff by a July 2018 U.S. Department of Justice indictment .


IBM analysts recently unveiled a first look at how threat actors may have placed Shamoon2 malware on systems in Saudi Arabia .


Once the user double-clicks on the executable file , the dropper drops a Word document in %AppData% and displays the following decoy document to the victim , while the dropper runs in the background and installs the backdoor . %appdata%\info.docx :


Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace .


While unlikely , it is worth considering that the same C&C server might have been the subject of 3rd-party attacks due to this vulnerability .


Malicious activity is trigged only on user interaction , attackers normally use this technique to bypass sandbox/automated analysis .


This particular application is signed with a fake certificate : Owner : CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Issuer CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Serial : 1c9157d7 Validity : 11/02/2017 00:16:46 03/20/2045 00:16:46 MD5 Hash : A8:55:46:32:15 If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file . As of June 2015 , the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong .


In the beginning of July 2015 , the Dukes embarked on yet another large-scale phishing campaign .


On many occasions , both the dropper and the payload will contain a range of techniques to ensure the sample is not being analyzed on a virtual machine , using a debugger , or located within a sandbox .


There are the following relevant detection paths ( the last one is an alternative Telegram client – “ Telegram X “ ) : Name Detection path Sex Game For Adults 18.apk /storage/emulated/0/WhatsApp/Media/WhatsApp Documents/ 4_6032967490689041387.apk /storage/emulated/0/Telegram/Telegram Documents/ Psiphon-v91.apk /storage/emulated/0/Android/data/org.thunderdog.challegram/files/documents/ Backdoored Open Source During the course For simplicity , Kaspersky is calling them the BlackEnergy APT group . We believe they may have some links to North Korea , which may explain why ScarCruft decided to closely monitor them .


BRONZE PRESIDENT uses custom batch scripts to collect either specific file types ( including files with .pptx , .xlsx , .pdf extensions ) or all files within a specific location .


Analysis of those files uncovered two more imphashes , 0B4E44256788783634A2B1DADF4F9784 and E44F0BD2ADFB9CBCABCAD314D27ACCFC , for a total of 20 malicious files .


CTU researchers discovered the threat actors searching for " [company] login , " which directed them to the landing page for remote access .


What this means for you All Lookout customers are protected from this threat . The Axiom group has been presented as an advanced Chinese threat actor carrying out cyber-espionage attacks against a whole range of different industries . The ZxShell mutex is created named @_ZXSHELL_@ . The file c018c54eff8fd0b9be50b5d419d80f21 ( r3_iec104_control.py ) imports the " iec104_mssql_lib " module , which is contained within the extracted contents as adfa40d44a58e1bc909abca444f7f616 ( iec104_mssql_lib.pyc ): 2b86adb6afdfa9216ef8ec2ff4fd2558 ( iec104_mssql_lib.py ) implements PIEHOP ’s primary capabilities and contains many developer - supplied comments for the included code .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools . It is therefore possible that the large percentage of high value targets identified in our analysis of the GhostNet are coincidental , spread by contact between individuals who previously communicated through e-mail .


DROPSHOT is a notable piece of malware used to deliver variants of the TURNEDUP backdoor . The campaign code " 20150920 " is associated with this decoy , which is a week prior to media articles announcing that the Crown Price of Thailand Maha Vajiralongkorn will lead the Bike for Dad 2015 event .


Each organization typically only saw a handful of employees at the receiving end of these emails .


Interestingly , there appear to be two parallel efforts within the campaign , with each effort using a completely different toolset for the attacks .


This mimics the wallet updater connected to the C2 addresses : wfcwallet.com ( resolved ip : 108.174.195.134 ) , www.chainfun365.com ( resolved ip : 23.254.217.53 ) .


After analyzing the traffic associated with these short links , we determined that each one was associated with a referral path from mail.mosa.pna.ps . With Javafog , we are turning yet another page in the Icefog story by discovering another generation of backdoors used by the attackers . When APT1 attackers are not using WEBC2 , they require a “ command and control ” ( C2 ) user interface so they can issue commands to the backdoor . Cisco Talos researchers recently discovered Greatness , one of the most advanced phishing - as - a - service tools ever seen in the wild .


] info OpSec fails and use of cryptography While looking at this infrastructure , we identified that one of these domains has directory indexing enabled . On May 2 , 2016 , Palo Alto published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available . However , they also include names referencing English-speaking countries , such as “ aunewsonline.com ” ( Australia ) , “ canadatvsite.com ” ( Canada ) , and “ todayusa.org ” ( U.S . ) . Our demonstration shows how using the Google Analytics API , a web skimmer can send data to be collected in his own account instance .


] net , negg2.ddns [ . We found two malicious iOS applications in Operation Pawn Storm . The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


To protect against code injections and other attacks , system operators should routinely evaluate known and published vulnerabilities , periodically perform software updates and technology refreshes , and audit external-facing systems for known web application vulnerabilities .


While FireEye has not directly observed BACKSWING delivering BADRABBIT , BACKSWING was observed on multiple websites that were seen referring FireEye customers to 1dnscontrol.com , which hosted the BADRABBIT dropper . Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14 , 2017 , FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


The beginning of 2011 however saw a significant break from that routine , when a large grouping of domain names was registered by the Dukes in two batches ; the first batch was registered on the 29th of January and the second on the 13th of February .


It then resets cron and removes possible cache files from other programs , starts scripts and binaries a , init0 , and start , and sets the persistence by modifying the crontab .


Some emulators build their phone number out of the default number created in the emulator software and the port number : 5554. getMachine function using anti-emulator technique . AveMaria is a new botnet , whose first version we found in September 2018 , right after the arrests of the FIN7 members . ministries of foreign affairs in Europe have been targeted and compromised by a threat actor we call Ke3chang .


As rooting exploits on Android become less prevalent and lucrative , PHA authors adapt their abuse or monetization strategy to focus on tactics like click fraud . In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy . Unlike the Nov. 26 campaign , these attacks targeted Taiwanese governmental and media and entertainment organizations . The contents of the Exchange Web Server ( also found within the folder ) • At least 14 days of Exchange Control Panel ( ECP ) logs , located in We have found significant hunting and analysis value in these log folders , especially for suspicious CMD parameters in the ECP Server logs .


Originally intended to target the Russian audience , the banker was later adapted , with minimal modifications , for the European “ market. ” The bulk of its victims ( more than 90 % ) reside in Russia , with France in second place ( 4 % ) . It also reconfigures the Microsoft Sysinternals registry to prevent pop-ups when running the PsExec tool . Talos has named this malware KONNI .


At the time of writing this article , no other significant changes in Asacub ’ s network behavior had been observed : The origin of Asacub It is fairly safe to say that the Asacub family evolved from Trojan-SMS.AndroidOS.Smaps . The threat actors have used the Baidu search engine , which is only available in Chinese , to conduct reconnaissance activities . From the sample we analyzed , attacks started from one virtual private server ( VPS ) that searches for a vulnerable machine to compromise ( previous techniques used malicious URLs or infecting legitimate websites for bot propagation ) . We also want to specifically thank Google ’s Threat Analysis Group ( TAG ) , Mandiant ’s DPRK Fusion Cell , and our government partners for their continued collaboration and support .


Malware code showing definition of populateConfigMap Figure 14 . ther names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon . The other archiving tools were able to extract one file from the ZIP attachment – either order.jpg or SHIPPING_MX00034900_PL_INV_pdf.exe . CADDYWIPER was then executed as a scheduled task at a predetermined time .


The document loads malicious content from http://109.248.148.42/office/thememl/2012/main/attachedTemplate.dotm via the settings.xml.rels component that is embedded within the DOCX document .


If brother.apk application is removed , mcpef.apk reinstalls brother.apk from assets . It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks . Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document .


The ability to carry out these types of intelligence-gathering activities on phones represents a huge score for the operator . Based on the patterns of subdomain registration over time in DNS , TRAC believes this is an example where the attackers registered their own second-level domain . The pause and retooling by APT12 was covered in the Mandiant 2014 M-Trends report . As a result , we decided to call this variant FakeSG .


Figure 7 – C2 As seen in Figure 8 , this version of Anubis is built to run on several iterations of the Android operating system , dating back to version 4.0.3 , which was released in 2012 . Wild Neutron 's attack took advantage of a Java zero-day exploit and used hacked forums as watering holes . We recently discovered some interesting telemetry on this actor , and decided to dig deeper into ScarCruft ’s recent activity . The themed " updates " look very professional and are more up to date than its SocGholish counterpart .


1849a50a6ac9b3eec51492745eeb14765fe2e78488d476b0336d8e41c2c581d4 d328fca14c4340fcd4a15e47562a436085e6b1bb5376b5ebd83d3e7218db64e7 59b9809dba857c5969f23f460a2bf0a337a71622a79671066675ec0acf89c810 120474682ea439eb0b28274c495d9610a73d892a4b8feeff268c670570db97e2 For the sake of this analysis we'll take the Vietnamese backdoor as an example ; the one found in the Indian attack operates in the exact same way . The attackers behind the breach of the New York Times ’ computer network late last year appear to be mounting fresh assaults that leverage new and improved versions of malware . RussianPanda ( @AnFam17 ) named the URL shortcut campaign RogueRaticate .


Additionally , one of the two government organizations had the highest infection rate of the Indian targets .


In our February report , we discovered the Sofacy group using Microsoft Office documents with malicious macros to deliver the SofacyCarberp payload to multiple government entities .


For threat hunting , iDefense recommends searching for the following :


In addition , Antiy Lab revealed the APT organization Green Spot on September 19 , 2018 . Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download .


In addition to the traffic originating from Chengdu , we identified a selection of hacktools and malware signed using nine stolen certificates .


It abuses accessibility services . In this blog we provide insight into the tactics , techniques and procedures (TTPs) of a Brazilian cyber crime group that specializes in payment card fraud operations . In August 2017 , we found this threat group has developed yet another Trojan that they call ' Agent Injector ' with the specific purpose of installing the ISMAgent backdoor .


Execute a command through exploits for CVE-2018-0802 . Their operations against gaming and technology organizations are believed to be economically motivated in nature .


In this scenario , the domain cdnverify.net was registered on January 30 , 2018 and just two days later , an attack was launched using this domain as a C2 .


As mentioned by Kaspersky , even though the exploits used for these MiniDuke campaigns were near-identical to those described by FireEye , there were nevertheless small differences .


This threat group attacked defense contractors and aerospace companies . China Chopper contains a remote shell ( Virtual Terminal ) function that has a first suggested command of netstat an|find ESTABLISHED .


Thanks to this tool reuse , we found the threat group uploading a credential dumping tool called Dumpert that we had not seen used in prior incidents involving the exploitation of CVE-2019-0604 .


The Word document usually exploits CVE-2012-0158 . The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April .


According to the document.xml file , the DealersChoice loader SWF exists after the “ covert-shores-small.png ” image file within the delivery document .


RECEIVE_SMS - Allows the application to receive SMS messages . Of note , FireEye discovered two additional new malware families hosted at this domain , VALUEVAULT and LONGWATCH . While it 's not known if the attackers physically reside in Pakistan , all members of Gorgon Group purport to be in Pakistan based on their online personas .


The first part is the target directory , the second is a regular expression used to match specific files , while the last part is an ID . But before the ScarCruft infection , however , another APT group also targeted this victim with the host being infected with GreezeBackdoor on March 26 , 2018 . The last retrieved module is a persistence module . Lesser - known threat actors want to piggyback off having a big name associated with them , like DarkSide , to intimidate their actors or lend more credence to the effectiveness of their threats .


] com hxxp : //mailsa-wqe [ . Since releasing our 2014 report , we continue to assess that APT28 is sponsored by the Russian Government . Using TXT resource records enabled the actors to provide tasking in fewer transactions due to the amount of data that can be transmitted in a TXT . Another new actor we discovered , seemingly of Vietnamese origin , uses a Yashma ransomware variant to target victims in Bulgaria , China , Vietnam and other countries .


TEMP.Veles ’ lateral movement activities used a publicly-available PowerShell based tool , WMImplant .


Once again this downloader is as straightforward as the Zebrocy gang ’s other downloaders .


Users looking forward to using the TikTok app amidst the ban might look for alternative methods to download the app . Xagent is the original filename Xagent.exe whereas seems to be the version of the worm . The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes , normally using Syrian and Iranian themes .


The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 . Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 ( Microsoft Office Equation Editor , widely used by Chinese-speaking actors since December 2017 ) , we can′t prove they were related to this particular attack .


One of its file stealers , swissknife2 , abuses a cloud storage service as a repository of exfiltrated files . At that time it was the name of a cybercriminal group that was stealing money from Russian financial establishments — to the tune of at least $150,000 per hit .


As mentioned in our previous blog on Bookworm , the Trojan sends a static date string to the C2 server that we referred to as a campaign code . It is thus interesting to see Buhtrap add strategic web compromises to their arsenal .


The stages of the FinFisher multi-layered protection mechanisms Stage 0 : Dropper with custom virtual machine The main dropper implements the VM dispatcher loop and can use 32 different opcodes handlers . The Elise malware used by Lotus Blossom , which was an attack campaign on targets in Southeast Asia . Let’s start with who is not targeted . Because the cdhash is computed based on executable code in the application , Mandiant was able to identify additional malware in the environment despite the files being deleted by the threat actor and the samples having different file hashes .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . No zero-day vulnerabilities were used to breach targeted networks , instead " TG-3390 relied on old vulnerabilities such as CVE-2011-3544 " — a near-year-old Java security hole — " and CVE-2010-0738 to compromise their targets " , Dell SecureWorks' researchers reported .


Equipped reverse shell payload with specific string After an in-depth look , we found that some versions of the reverse shell payload code share similarities with PRISM – a stealth reverse shell backdoor that is available on Github . OceanLotus's targets include China's maritime institutions , maritime construction , scientific research institutes and shipping enterprises . In 2016 and 2017 , the group targeted managed IT service providers , manufacturing and mining companies , and a university .


This threat actor is remarkable for two reasons : Its access to sophisticated zero-day exploits for Microsoft and Adobe software Its use of an advanced piece of government-grade surveillance spyware FinFisher , also known as FinSpy and detected by Microsoft security products as Wingbird FinFisher is such a complex piece of malware that , like other researchers , we had to devise special methods to crack it . APT40 relies heavily on web shells for an initial foothold into an organization . The backdoor reports information about the machine such as the user name , computer name , Windows version and system language to the C&C server and awaits commands . • Cisco Talos has discovered a threat actor conducting several campaigns against government entities , military organizations and civilian users in Ukraine and Poland .


The Web page shown here on the left is hosted on a domain that seems apt : free-vpn [ . FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . In that case, it takes a . The United States is joining with allies and partners to condemn Russia ’s destructive cyber activities against Ukraine .


In the case of 32-bit systems , the malware may attempt a known UAC bypass by launching printui.exe system process and using token manipulation with NtFilterToken as described in this blog post . CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash . The way the payload is invoked ( by overwriting the return address on the stack , as opposed to a direct call ) . The Talos Threat Spotlight posts and Quarterly Trends reports provide details of threats and the techniques used by threat actors .


The majority of infected machines are located in the US , Bangladesh and the UK ;


First , it modifies the Zygote process . This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams . It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . There has also been at least one victim targeted by a spear-phishing attack .


125: UK , US , and Canada 220: UK and Australia 223: Germany 7200: UK 7500: Australia .


This domain is similar to the one the malware author used for his adware C & C communication , minigameshouse [ . RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism . SHA256 : dd730cc8fcbb979eb366915397b8535ce3b6cfdb01be2235797d9783661fc84d .


Gaza Cybergang Group 3 in Operation Parliament : In this instance , the malware also used people ’s names for C2 communication to send and receive commands from the server .


The adversaries then issue HTTP GET requests , sometimes with the User-Agent MINIXL , to exfiltrate the archive parts from the victim's network .


Further analysis of the malware identified what looks like a custom back door .


Each of these behaviors is under the control of the remote C2 server . The discovery by Kaspersky marks at least the fifth zero-day exploit used by BlackOasis and exposed by security researchers since June 2015 . From this URL it tries to download another stage then storing it into “ C:\Users\admin\AppData\Roaming\ ” path with random name . NjRAT is an open - source remote access trojan ( RAT ) whose source code is freely available and is used by commodity actors and APTs , making the process of attribution more difficult .


UAC When running under a limited UAC account , the installer extracts d3d9.dll and creates a persistence key under HKCU\Software\Microsoft\Windows\Run . The attacker used a spear-phishing email containing a link to a fake resume hosted on a legitimate website that had been compromised . The library code performs numerous checks for the CPU features , and based on the outcome , it will choose a processor-specific implementation of the cryptographic function . The file c018c54eff8fd0b9be50b5d419d80f21 ( r3_iec104_control.py ) imports the " iec104_mssql_lib " module , which is contained within the extracted contents as adfa40d44a58e1bc909abca444f7f616 ( iec104_mssql_lib.pyc ): 2b86adb6afdfa9216ef8ec2ff4fd2558 ( iec104_mssql_lib.py ) implements PIEHOP ’s primary capabilities and contains many developer - supplied comments for the included code .


It is worth noting that shortly before the attack , security vendors reported the use of 0-day exploits in Flash Player and Microsoft Windows by the same threat actor .


The existence of the Equation Group was first posited in Feb. 2015 by researchers at Russian security firm Kaspersky Lab , which described it as one of the most sophisticated cyber attack teams in the world . They tried new techniques to steal from banking systems , including AWS CBR ( the Russian Central Bank 's Automated Workstation Client ) , ATMs , and card processing .


% 20Configuratore % 20v5_4_2.apk http : //vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/ 2015-01-14 http : //windupdate.serveftp.com/wind/LTE/WIND % 20Configuratore % 20v5_4_2.apk http : //windupdate.serveftp.com/wind/LTE/ 2015-03-31 http : //119.network/lte/Internet-TIM-4G-LTE.apk http : //119.network/lte/download.html In China alone , we have seen underground market sheep shavers” ported SMS rogue marketing strategy to spread Alipay Red Packet referral URL links . APT12 : IXESHE , DynCalc , Numbered Panda , DNSCALC .


If the user wants to check which app is responsible for the ad being displayed , by hitting the “ Recent apps ” button , another trick is used : the app displays a Facebook or Google icon , as seen in Figure 6 . The malware may inject itself into browser processes and explorer.exe . We don't know if the document is a legitimate compromised document or a fake that the attacker has created in an effort to be credible .


By : Trend Micro April 20 , 2018 We have been detecting a new wave of network attacks since early March , which , for now , are targeting Japan , Korea , China , Taiwan , and Hong Kong . One of the IP addresses , 128.127.105.13 , was previously used by the DoNot Team (aka APT-C-35) , a suspected Indian APT group . Paying more attention during the code analysis , we discovered that it is full of junk instructions used to declare and initialize variables never used .


Nbtscan — This publicly available command-line tool scans systems for NetBIOS name information ( see Figure 2 ) .


Spaghetti code makes the program flow hard to read by adding continuous code jumps , hence the name . iDefense analysts have identified a campaign likely to be targeting members of or those with affiliation or interest in the ASEAN Defence Minister 's Meeting ( ADMM ) . We have seen it installed as a Windows service and as a DLL in C:\Windows\System32 using the following file names : The threat actor was consistently observed removing prior payloads from disk ; however , the FSEvents artifacts were able to provide great insight into files that previously existed on disk .


One certificate was generated locally on what appeared to be a HP-UX box , and another was generated on 8569985.securefastserver.com with an email address root@8569985.securefastserver.com , as seen here for their nethostnet.com domain .


Artifacts During the research , we found plenty of traces of the developers and those doing the maintaining . Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware . The admin@338 has targeted international media organizations in the past .


All MiniDuke components , from the loader and downloader to the backdoor , had been slightly updated and modified during the downtime .


' to disguise the Base64 . After injecting Meterpreter into memory , the attacker had complete control of the infected device . The group has compromised more than 16 organizations in at least 13 different countries , sometimes simultaneously , since at least 2014 .


Separate administrators into privilege tiers with limited access to other tiers .


DHS and FBI assess that HIDDEN COBRA actors will continue to use cyber operations to advance their government 's military and strategic objectives .


Alternatively , it is also possible that APT41 injected malicious code into the package prior to compilation , circumventing the need to steal the code-signing certificate and compile it on their own . The first time the Lambert family malware was uncovered publicly was in October 2014 , when FireEye posted a blog about a zero day exploit ( CVE-2014-4148 ) used in the wild .


In particular , we noted that the Sofacy group deployed a webpage on each of the domains .


This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April . Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam .


] com Unit 42 published a blog in July 2016 about 9002 malware being delivered using a combination of shortened links and a file hosted on Google Drive . In another instance , APT41 targeted a hotel’s reservation systems ahead of Chinese officials staying there , suggesting the group was tasked to reconnoiter the facility for security reasons . In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 .


Port 6209 : Telegram extraction service . Specifically , Suckfly used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows . News about Hamas and the Palestinian National Authority . The contents found in secure[.]66[.]to often lead to zhu[.]vn , which is Hack520 ’s domain for hosting his own private blog .


This can be packaged and " sold '' in many different ways to customers . As we have seen in some previous targeted malware attacks , the attackers in this incident are taking advantage of services like changeip.com to establish free subdomains in their infrastructure . These development efforts may have resulted in the emergence of the WATERSPOUT backdoor . The tactics , techniques and procedures ( TTPs ) are very similar to those of SocGholish and it would be easy to think the two are related .