Disguised Spyware Uploaded on Google Play Store We identified previously unknown spyware apps being successfully uploaded on Google Play Store multiple times over the course of over two years . Based on that research and this observation , we postulate that the OilRig group gathered credentials to a legitimate user 's OWA account and logged into the user 's account to send phishing attacks to other individuals within the same , targeted organization . The screenshots are exfiltrated via the ImgBB website . The messages show that Harrison was hired in March 2010 to help promote Ashley Madison online , but the messages also reveal Harrison was heavily involved in helping to create and cultivate phony female accounts on the service .


Non-governmental political organizations may provide access to desirable national policy information , especially foreign policy , but may not have the same level of protection and security as governmental organizations .


Our analysis shows that actors attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . Their targets are marine companies that operate in and around the South China Sea , an LOC of much Chinese interest .


The threat actors used shortened URLs in spear phishing messages and fake news websites to direct targets to download KASPERAGENT .


However , it ’ s possible the set of commands may change in future versions of the Trojan . The decoy documents dropped suggest that the targets are likely to be politically or militarily motivated , with subjects such as Intelligence reports and political situations being used as lure documents . Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities .


Under these conditions , the app continues executing and the intent of targeting Xiaomi devices and users could be inferred , however poorly written code results in execution in more environments than perhaps intended ; further checks are made to ascertain whether the app is running on an emulator , perhaps to evade researcher analysis environments . In 2015 , APT41 targeted a Japanese media organization with a lure document (Figure 3) titled 中東呼吸器症候 群(MERS)の予防 , ” which translates to Prevention of Middle East Respiratory Syndrome (MERS) . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


PCRat S-VULNAME/Gh0st is a payload that we do not see this group using frequently .


We reverse engineered XLoader and found that it appears to target South Korea-based banks and game development companies . Either way , Sofacy's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion . After the reconstruction of the full infection chain , we noticed strong similarities with a recent spear-phishing attack campaign against an unspecified US retail company .


Anti-emulator code . Interestingly , following some open-source publications about them , the FIN7 operators seems to have developed a homemade builder of malicious Office document using ideas from ThreadKit , which they employed during the summer of 2018 . Using information from the FireEye DTI cloud , FireEye observed that Ke3chang targeted a single firm .


FIN7 is a threat actor group that is financially motivated with targets in the restaurant , services and financial sectors . The malware starts communicating with the C&C server by sending basic information about the infected machine .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Maudi Surveillance Operation which was previously reported in 2013 .


In addition , it monitors to verify if com.android.music.helper package is removed . The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites . By targeting high-tech and manufacturing operations in Japan and Taiwan , DragonOK may be acquiring trade secrets for a competitive economic advantage .


] com hxxp : //www [ . Upon gaining access to the machines connected to corporate and guest Wi-Fi networks , APT28 deployed Responder . Several metadata fields ( specifically title , subject , author , comments , manager , and company ) appear to have been populated with different data sets . The top most targeted organizations included those from technology and social media , NATO , and the transportation sector .


This is a stark contrast with other attacks commonly associated with the Sofacy group where generally no more than a handful of victims are targeted within a single organization in a focus-fire style of attack .


Trend Micro 's Mobile App Reputation Service ( MARS ) covers Android and iOS threats using leading sandbox and machine learning technologies . It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks .


The widespread proliferation and use of the following tools suggest that the group likely has the knowledge and capability to use them as part of its operations :


These more recent developments indicate that XLoader is still evolving . TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology . It is worth noting that the IP response observed to set ping mode was the reverse of the IP used to set text mode (i.e., 199.250.250.99 ) . The new documentary , The Ashley Madison Affair , begins airing today on Hulu in the United States and on Disney+ in the United Kingdom .


TG-3390 : american.blackcmd.com .


Due to TrickMo ’ s persistence implementation mentioned earlier , this lockdown screen persists after a restart and is re-initiated every time the device becomes interactive . The ultimate goal of this threat is to mine Monero cryptocurrency in compromised Linux machines . Russia .


] ponethus [ . he Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information . Aumlib , which for years has been used in targeted attacks , now encodes certain HTTP communications . Compromised websites ( WordPress appears to be the top target ) are injected with a code snippet that replaces the current webpage with the aforementioned fake updates templates .


To get around this , the app then uses its root privilege to inject code into the Setup Wizard , extract the CAPTCHA image , and sends it to a remote server to try to solve the CAPTCHA . First , when a specific recipient was targeted , the mails often purported to be meeting invitations from established business partners . APT17 was embedding the encoded C2 IP address for the BLACKCOFFEE malware in legitimate Microsoft TechNet profiles pages and forum threads , a method some in the information security community call a “ dead drop resolver. ” Encoding the IP address makes it more difficult to identify the true C2 address for network security professionals . We called this new malware ?


The group is known for their advanced attacks that leverage custom-built Windows malware ( Kasperagent , Micropsia ) as well as Android malware ( Vamp , GnatSpy ) .


Customers have to send a set text message from their phone to a specific bank number . Skipper , which has been linked to Turla in the past , was found alongside Gazer in most cases we investigated . Winnti : C&C : b[org_name].dnslookup.services : 443 . Organizations can collect this intelligence , review the threats described , consider if and how the threat is relevant to them , and the necessity of making any potential additional mitigations .


The MQTT connection to broker The MQTT connection to broker The MQTT communication is used primarily to update the device state and get commands from the C & C . APT33 has shown particular interest in organizations in the aviation sector , as well as organizations in the energy sector with ties to petrochemical production . Remexi developers use the C programming language and GCC compiler on Windows in the MinGW . Cisco Duo provides multi - factor authentication for users to ensure only those authorized are accessing your network .


The two weaponized documents we discovered leveraging DDE were of particular interest due to victimology and a change in tactics .


Dump data from the IMO messenger app . The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information . Targeting Palestinians : The campaigns seems to target Palestinian individuals and entities , likely related to the Palestinian government . Harrison signed his threatening missive with the salutation , “ We are legion , ” suggesting that whatever comeuppance he had in store for Ashley Madison would come from a variety of directions and anonymous hackers .


While we don't know the motivations behind the attacks , the targeted commercial organizations , along with the targeted government organizations , may point in this direction .


APT Targets Financial Analysts with CVE-2017-0199 .


As a result , the Trojan delete button in the list of applications becomes inactive , which may cause problems for inexperienced users . the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated . Various network attack tools used to fingerprint and compromise other hosts on the network . The attacker also executed various Cobalt Strike components and tried to escalate privileges on the computer using PsExec .


The Proc1 function within the Module1 does nothing more than build the %APPDATA%\MSDN\~msdn.exe path to the dropped payload and executes it using the built-in Shell function .


] databit [ . The Mofang group has been active in relation to the Kyaukphyu sez . status.acmetoy.com /DD/ myScript.js or status.acmetoy.com /DD/ css.css . On March 2 , 2021 , Microsoft released a blog post that detailed multiple zero - day vulnerabilities used to attack on - premises versions of Microsoft Exchange Server .


HttpBrowser 's executable code may be obfuscated through structured exception handling and return-oriented programming .


Even though this individual ’s email id matched with the Pastebin id where base64 encoded malicious code was found , it is hard to say if this individual was or was not involved in this cyber attack .


PLATINUM does not conduct its espionage activity to engage in direct financial gain , but instead uses stolen information for indirect economic advantages . In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker ; 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks .


These repackaged apps pose as communication , news , lifestyle , book , and reference apps popularly used in the Middle East . ScarCruft 's Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . The first one exploits the INCLUDEPICTURE feature of Microsoft Word to get context information about the victim’s computer , and the availability and version number of Microsoft Word . Kaspersky has more here .


Its major functionality is also implemented through the call of the asynchronous task ( “ org.starsizew.i ” ) , including uploading the incoming SMS messages to the remote C2 server and executing any commands as instructed by the remote attacker . The executable variant of Helminth is installed with a dropper Trojan that we are tracking as the HerHer Trojan . Gamaredon cyberwarfare operations against Ukraine are still active . However , the self - proclaimed hacktivist group Anonymous Sudan appears to have increased KillNet ’s capabilities and the group has become the collective ’s most prolific affiliate in 2023 , conducting a majority of claimed DDoS attacks .


Sofacy Attacks Multiple Government Entities .


Instead , the actual content within the body of the websites was an exact match in each instance .


To protect itself from being removed , Svpeng uses a previously unknown vulnerability in Android . Our analysis indicates this is a sophisticated multi-stage infection ; which begins with Epic Turla . For a complete list of tools please see the MainConnectionIo section . Minidionis – one more APT with a usage of cloud drives • Miniduke is back : Nemesis Gemina and the Botgen Studio More details about CozyDuke are available to customers of Kaspersky Intelligence Reporting .


We speculate that the DLL type payload will be downloaded and call its Print export function for further infection .


Shamoon2 : 2a0df97277ddb361cecf8726df6d78ac .


The source process reads /proc/ [ pid ] /maps to find where libc is located in the target process memory . Like BlackEnergy ( a.k.a Sandworm , Quedagh ) , Potao is an example of targeted espionage ( APT ) malware detected mostly in Ukraine and a number of other CIS countries , including Russia , Georgia and Belarus . The attackers can also extend BLACKCOFFEE ’s functionality through additional commands sent as shellcode . Together with our partner CrySyS Lab , we ’ve discovered two new , previously - unknown infection mechanisms for Miniduke .


The program creates the mutex “ mtx ” and an event named “ WerTyQ34C ” .


We performed this comparison and found 28,881 servers that advertised a vulnerable version of SharePoint .


It looks like its main purpose is to get into the system and execute downloaded files with root rights . Kaspersky Lab products detect the Octopus Trojan as Trojan.Win32.Octopus.gen . The activity we have directly observed likely represents only a small fraction of the cyber espionage that APT1 has conducted . These new infection vectors rely on Java and IE vulnerabilities to infect the victim ’s PC .


The Cybereason Nocturnus team suspects that the malware operators and authors are Chinese speakers . The first of them is the well-known FIN7 , which specializes in attacking various companies to get access to financial data or PoS infrastructure . backdoors that now appear to be part of APT15 's toolset .


In an attempt to hide the contents of the stolen data , the threat actor used winrar to compress and password-protect it . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) .


The PLATINUM group has written a few different versions of keyloggers that perform their functions in different ways , most likely to take advantage of different weaknesses in victims ' computing environments . Upon successful exploitation , the attachment will install the Trojan known as NetTraveler using a DLL side-loading attack technique .


After the next run of the infected application , the “ boot ” module will run the “ patch ” module , which hooks the methods from known ad SDKs to its own implementation . The vast majority of systems communicating with Bookworm C2 servers are within the Bangkok metropolitan area where a majority of the government of Thailand exists . 3 、A password-protected ZIP archive ; They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration .


SIGHT Partners is still collecting information on the mechanics of the power outage and what role the KillDisk malware played in the greater event . The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


Request encoding process The HTTP requests follow the format below , while on the WebSocket only the query data is written . IBM X-Force IRIS has gained insight into ITG08’s intrusion methods , ability to navigate laterally , use of custom and open-source tools , and typical persistence mechanisms . APT38 shares malware code and other development resources with TEMP.Hermit North Korean cyber espionage activity , although we consider APT38 .


Changes in the second stage SPLM backdoor are refined , making the code reliably modular .


] comlila-tournai [ . When activities targeting of civil society subsided , the actors instead appeared to have focused on external targets , such a series of attempts to spearphish the Danish Ministry of Foreign Affairs . Within these zones , we know of thousands of FQDNs that have resolved to hundreds of IP addresses ( which we suspect are hops ) and in some instances to APT1 ’s source IP addresses in Shanghai . Monitor for API calls that may attempt to hide artifacts associated with their behaviors to evade detection .


What is sure is that the gap in the Android banking malware rental business left open after the rental of the Anubis 2 and RedAlert 2 Trojans ended provides a good opportunity for the actors behind Cerberus to grow their business quickly . Machete has Latin American targets and has been developed by a Spanish-speaking group , presumably from a LATAM country . APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry .


The mitigation strategies provided may seem like common sense .


PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 . We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 .


CTU researchers observed the first short links targeting hillaryclinton.com email addresses being created in mid-March 2016 ; the last link was created in mid-May .


The most recent Scarlet Mimic attacks we have identified were conducted in 2015 and suggest the group has a significant interest in both Muslim activists and those interested in critiques of the Russian government and Russian President Vladimir Putin . In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company .


After the profile is installed , the user will then be redirected to another Apple phishing site . On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website . The decoded data shows a command to be executed whoami&ipconfig /all on the victim . SysUpdate is exclusively used by Budworm .


During the course of this investigation , we ensured that all certificates compromised by Suckfly were revoked and the affected companies notified .


The attached document contains a conference agenda that the Sofacy group appears to have copied directly from the website for the “ Underwater Defence & Security 2018 Conference ” here .


For sample “ 538ff577a80748d87b5e738e95c8edd2bd54ea406fe3a75bf452714b17528a87 ” the following is an excerpt from the VBA macro building the PowerShell command .


After this announcement , the Palestinian Authority cut salaries for its employees in Gaza by 30 percent and informed Israel that it would no longer pay for electricity provided to Gaza causing blackouts throughout the area and escalating tensions between the rival groups .


A full list of targeted applications is included in the IOC section at the end of this post . Aside from the four companies which have publicly acknowledged attacks , Symantec has identified five other large technology firms compromised by Butterfly , primarily headquartered in the US . It is possible that the operators of this cluster of activity were influenced by open-source publications and do not have any ties with FIN7 . The new campaign , which we call FakeSG , also relies on hacked WordPress websites to display a custom landing page mimicking the victim 's browser .


Our solution is to :


do.jar ( SHA256 : a711e620246d9954510d3f1c8d5c784bacc78069a5c57b9ec09c3e234bc33a8b ) : The decrypted file that was created by “ start.ogg. ” It sends a request to the server with the device ’ s configuration . PittyTiger could also use CVE-2014-1761 , which is more recent . An additional campaign has also been observed targeting Japanese entities .


A current round of cyber-attacks from Chinese source groups are targeting the maritime sector in an attempt to steal technology . In comparison , XENOTIME was defined based on principles of infrastructure ( compromised third-party infrastructure and various networks associated with several Russian research institutions ) , capabilities ( publicly- and commercially-available tools with varying levels of customization ) and targeting ( an issue not meant for discussion in this blog ) .


READ_EXTERNAL_STORAGE - read from external storage . The installed EXE file is almost exactly the same as the DLL version of Bisonal variant used against the Russian organization . In addition , we observed a TTP shift post publication with regards to their malware delivery ; they started using compromised but legitimate domains to serve their malware .


Every device with Google Play includes Google Play Protect and all apps on Google Play are automatically and periodically scanned by our solutions . The PassCV group continues to be extremely effective in compromising both small and large game companies and surreptitiously using their code-signing certificates to infect an even larger swath of organizations . Many threat groups use lateral movement techniques , but this engagement allowed CTU analysts to not only further validate indicators of lateral movement , but also to look a bit closer at those indicators and expand the cluster of indicators surrounding the use of at.exe for lateral movement within the infrastructure . It uses a vulnerability discovered at the end December 2012 , CVE-2012 - 4792 .


Text message and call logs were transmitted every 72 hours to the Shanghai server , and once a day for other personally identifiable data , the company says . In early 2018 , Rapid7 identified that APT10 compromised an apparel company , based upon detections and intelligence gathered from the U.S.-based law firm breach . Tick was spotted last year , but they are actively and silently attacking various organizations in South Korea and Japan for a number of years .


Other than that , its major functionality is to collect private device information , upload it to a remote C2 server , and handle any commands as requested by the C2 server . In May 2016 , Unit 42 began researching attacks that used spear-phishing emails with attachments , specifically malicious Excel spreadsheets sent to financial organizations within Saudi Arabia . The script will check the presence of the “ IndexOfﬁce.exe ” artifact : if true then it will delete it and it will download a new ﬁle/script from “ http://masseffect.space/<PC_Name>_<Hex_Drive_SN>/post.php ” . To date , the ransomware has only been used in a limited fashion .


Super Mario Run Malware # 2 – DroidJack RAT Gamers love Mario and Pokemon , but so do malware authors . The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors . From April 19-24 , 2017 , a politically-motivated , targeted campaign was carried out against numerous Israeli organizations . The new exploit method bypasses URL rewrite mitigations for the endpoint provided by Microsoft in response to •


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . To enhance the effectiveness of phishing attacks into the organization , Barium will collect additional background informationfrom social media sites .


As a result , due to such an unusual compilation process , there were signs in the dex file that point to dexlib , a library used by the Smali tool to assemble dex files . The installed EXE file is almost exactly the same as the DLL version of Bisonal variant used against the Russian organization . Upon execution , this malware creates 10 random directory paths and uses them for a specially designated purpose .


This loads the SWF file , effectively running the malicious code on the system .


This server runs an instance of ‘ Parse Server ’ ( source on GitHub ) , an open source version of the Parse Backend infrastructure , which is a model for providing web app and mobile app developers with a way to link their applications to backend cloud storage and APIs exposed by back-end applications , while also providing features such as user management , push notifications and more . Utilizing KillDisk in the attack scenario most likely served one of two purposes : the attackers covering their tracks after an espionage operation , or it was used directly for extortion or cyber-sabotage . During this time they were able to steal digital certificates from South Korean companies and launch attacks against Indian and Saudi Arabian government organizations .


Yamato Transport - One of Japan 's largest door-to-door delivery service companies , also in Tokyo . Following the exposure of a wide range of their infrastructure and operations by Symantec earlier this year , we discovered that APT33 , or closely aligned actors , reacted by either parking or reassigning some of their domain infrastructure . of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


DanderSpritz consists entirely of plugins to gather intelligence , use exploits and examine already controlled machines . According to a 49-page report published Thursday , all of the attacks are the work of Chinese government 's intelligence apparatus , which the report 's authors dub the Winnti Umbrella .


This is in stark contrast to some other suspected Russian threat actors ( such as Operation Pawn Storm ) who appear to have increased their targeting of Ukraine following the crisis .


This high level of cyber-espionage activity goes back years .


In our analysis , one activity group stood out : NEODYMIUM . Analysis of the operational times of the group 's activities indicates that it is probably centered around China Standard Time ( UTC +8 ) . A bot identifier is generated from the machine’s MAC address . In an article for DarkReading , Ericka Chickowski highlights 15 key indicators of compromise


With a bit of luck , we managed to find logs in which the evidence showed “ Agent Smith ’ s C & C front end routinely distributes a workload between “ w.h * * * g.com ” and “ tt.a * * * d.net ” . This activity is a longer tail for the actor than a spearphish ; this is likely based on the Clever Kitten background , which may be focused on web development/application testing . Using msiexec.exe , a legitimate system process , can make it harder to trace the source of malicious activity . FireEye currently tracks this activity in three clusters , UNC2639 , UNC2640 , and UNC2643 .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . Contextually relevant emails are sent to specific targets with attached documents that are packed with exploit code and Trojan horse programmes designed to take advantage of vulnerabilities in software installed on the target 's computer .


One curious trait of Bahamut is that it develops fully-functional applications in support of its espionage activities , rather than push nonfunctional fake apps or bundle malware with legitimate software . CTU researchers have evidence that the TG-3390 compromised U.S. and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations .


Interestingly , that location may be either a web address or a Microsoft OneDrive account .


After its foray into overt and disruptive attacks in 2016 , the group has subsequently returned to its roots , mounting intelligence gathering operations against a range of targets .


If , for some reason , SuperService does not switch off the screen when there is an attempt to revoke the device administrator privileges , the Trojan tries to intimidate the user : While running , Rotexy tracks the following : switching on and rebooting of the phone ; termination of its operation – in this case , it relaunches ; sending of an SMS by the app – in this case , the phone is switched to silent mode . Analysts in our DeepSight Managed Adversary and Threat Intelligence ( MATI ) team have found a new backdoor , Backdoor.Powemuddy , new variants of Seedworm 's Powermud backdoor ( aka POWERSTATS ) , a GitHub repository used by the group to store their scripts , as well as several post-compromise tools the group uses to exploit victims once they have established a foothold in their network . The campaign 's use of an SMB worm to distribute WCry contributed to the ransomware 's virulence .


There were several distinct areas where mobile malware underwent advances . LuckyMouse , also known as Iron Tiger , EmissaryPanda , APT 27 and Threat Group-3390 , is the same group of Chinese hackers who was found targeting Asian countries with Bitcoin mining malware early this year . We have contacted the compromised universities and provided the necessary information and assistance to remediate the compromise . Additional attacker backdoors identified on systems with names that masquaraded as legitimate binaries and also produced AOT files upon translation ( e.g. , npx - cli and npx-cli.aot ) .


Nevertheless , on May 12th 2015 ( a few weeks after the attack against Bundestag appears to have started ) the American security firm root9B released a report containing details on malware samples very similar to Artifact #2 .


The hackers will map a company’s network and look for strategically favorable locations for placing their malware . To further exemplify the proficiency of the attackers leveraging the Lamberts toolkit , deployment of Black Lambert included a rather sophisticated TTF zero day exploit , CVE-2014-4148 .


] databit [ . The first attack started in early July with a ShimRatReporter payload . The POST URI is changed to /bbs/ search.asp ( as mentioned , earlier Aumlib variants used a POST URI of /bbs/ info.asp . ) The POST body is now encoded . FireEye currently tracks this activity in three clusters , UNC2639 , UNC2640 , and UNC2643 .


In particular , EventBot can intercept SMS messages and bypass two-factor authentication mechanisms . The operation against the Tibetan Parliamentarians illustrates the continued use of malicious attachments in the form of documents bearing exploits . The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign .


Given that both organizations appear to describe similar ( if not identical ) activity , any reasonable person could ( and should ) ask – why the inconsistency in naming and identification? Aside from the competitive vendor naming landscape ( which I am not a fan of in cases on direct overlap , but which has more to say for itself when different methodologies are employed around similar observations ) , the distinction between FireEye and Dragos ’ approaches with respect to the “ TRITON actor ” comes down to fundamental philosophical differences in methodology .


The new IP addresses are typically on the same subnet as the previous ones .


Destructive malware used by VOODOO BEAR includes a wiper called PassKillDisk . Further tracking of the Lazarus’s activities has enabled Kaspersky researchers to discover a new operation , active since at least November 2018 , which utilizes PowerShell to control Windows systems and Mac OS malware to target Apple customers .


Gooligan-infected apps can also be installed using phishing scams where attackers broadcast links to infected apps to unsuspecting users via SMS or other messaging services . Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea 's Reconnaissance General Bureau ( RGB ) . This results in The email would start a conversation between the attackers and victims sometimes being quite lengthy to establish trust , which would include the attackers encouraging the victim to open a registration link hosted by a real website that had already been compromised by the attackers .


First , they use the built-in toolbox commands to determine what apps are running . Group123 is constantly evolving as the new fileless capability that was added to ROKRAT demonstrates . Another obfuscation , This article is based on research by Marcelo Rivero , Malwarebytes ' ransomware specialist , who monitors information published by ransomware gangs on their Dark Web sites .


TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems . The samples Novetta obtained from the active Axiom infection were compiled in mid- to late 2014 and represent what Novetta is referring to as version 3.0 of the Winnti lineage .


On April 3 , 2016 , we still observed new RuMMS samples emerging in the wild . Data about Wingbird activity indicates that it is typically used to attack individuals and individual computers instead of networks . Hash : e2cb06e0a5c14b4c5f58d0e56a1dc10b6a1007cf56c77ae6cb07946c3dfe82d8 . While COSMICENERGY ’s capabilities are not significantly different from previous OT malware families ’ , its discovery highlights several notable developments in the OT threat landscape .


Over a few days' span , the threat actors install remote access tools on additional systems based upon the results of the network reconnaissance .


The additions include code to decrypt an embedded Flash object and an event handler that calls a newly added function ( “ skinEvent2 ” ) that plays the decrypted object .


This very first step fails in Android 7.0 and higher , even with a root permission . The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People's Republics . This BLACKCOFFEE variant contains one or more URLs that link to the biography sections of attacker-created profiles as well as forum threads that contain comments from those same profiles . This model is flexible and enables the operators to constantly change how their backdoors retrieve further commands or malcode as needed .


] orgmary-crawley [ . We named it RedOctober because we started this investigation in October 2012 , an unusually hot month . Typical use of HTRAN is fairly simple : the attacker must specify the originating IP address ( of his or her workstation in Shanghai ) , and a port on which to accept connections . This makes Greatness particularly well - suited for phishing business users .


App Swap Per Device Avg . One of its file stealers , swissknife2 , abuses a cloud storage service as a repository of exfiltrated files . Many of the URLs listed were in use for an extended period . The file , matches signatures for the tried - and - true China Chopper .


Technical Analysis XLoader first loads the encrypted payload from Assets/db as test.dex to drop the necessary modules then requests for device administrator privileges . At least 4 attack campaigns against Pakistan have been observed by us since 2017 . Then it invokes the renamed executable and runs it passing a series of parameter : “ uninstall.exe x -pQELRatcwbU2EJ5 -y ”


? After the phishing email resulted in a successful infiltration , ITG08 used the More_eggs backdoor to gain a foothold and infect additional devices . We consider APT38 's operations more global and highly specialized for targeting the financial sector .


Lately , Patchwork has been sending multiple RTF files exploiting CVE-2017-8570 . One vulnerability is a Windows zero-day vulnerability ( CVE-2019-0703 ) discovered by Symantec . Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers .


Incident Background Beginning on Oct. 24 at 08:00 UTC , FireEye detected and blocked attempts to infect multiple clients with a drive-by download masquerading as a Flash Update (install_flash_player.exe) that delivered a wormable variant of ransomware . The Middle Eastern hacker group in this case is codenamed " BlackOasis " Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


However , this time , the permission is actually used . security policy in the Eastern Europe and South Caucasus regions . Attached to this email was a malicious Microsoft Word document ( MD5: f6fafb7c30b1114befc93f39d0698560 ) that exploited CVE-2012-0158 . TEMP.Veles has used port - protocol mismatches on ports such as 443 , 4444 , 8531 , and 50501 during C2 .


It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in . This function is similar to the various versions of backdoors ( such as sctrls and sip_telephone ) that we analyzed in our previous blog post and whitepaper .


An investigation of Chrysaor Malware on Android 03 April 2017 Google is constantly working to improve our systems that protect users from Potentially Harmful Applications ( PHAs ) . During our investigation , there was a breakthrough discovery that helped connect Leafminer to a number of attacks observed on systems in the Middle East and identify the toolkit used in the group 's efforts of intrusion , lateral movement , and exfiltration . APT33 : 192.119.15.35 [REDACTED].ddns.net . As such , we ’ve seen a growing number of reports of victims who are targeted with commercial spyware .


However , the group ’s activities since the beginning of 2017 have again become more covert and appear to be mainly motivated by intelligence gathering .


TrickMo is no different ; the goal is to complete the operation while raising minimal suspicion . Since they were first identified in January 2-16 , this adversary has consistently targeted large organizations for high ransom demands . Strider has been active since at least October 2011 .


Targets of the campaign received Microsoft Word documents via email that claimed to contain instructions for logging into webmail or information regarding a state law proposal .


In 2015 and 2016 , Dridex was one of the most prolific eCrime banking trojans on the market and , since 2014 , those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits . According to 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor .


Accessibility features are typically used to help users with disabilities by giving the device the ability to write into input fields , auto-generate permissions , perform gestures for the user , etc . Today , this malware is still actively being used against the Philippines . M-Trends 2018 can arm security teams with the knowledge they need to defend against today 's most often used cyber attacks , as well as lesser seen and emerging threats .


On the 14th of November , F-Secure published a blog post naming the malware OnionDuke and associating it with MiniDuke and CosmicDuke , the other Duke toolsets known at the time .


Information about the C&C infrastructure identified in our analysis of Suckfly activity can be seen in Table 1 .


Finally , the malware spawns a thread that has the goal to load , remap , and relocate the stage 5 malware . Mandiant has previously observed targeted attackers stealing email , but few threat actors have been as successful at this as APT35 . While this loader differs somewhat in general implementation , the payload extraction routine seems to be the same as in the previous variant . In this incident , the attacker leveraged an EOL version of the MicroSCADA supervisory control system .


Analysis of a threat group's targeting , origin , and competencies can determine which organizations could be at risk .


Subsequently , two additional articles ( here and here ) were released by Objective-See which provide an analysis of some validated WINDSHIFT samples targeting OSX systems . APT28 is using novel techniques involving the EternalBlue exploits and the open source tool Responder to spread laterally through networks and likely target travelers .


FAKE REVIEWS When early versions of apps are first published , many five star reviews appear with comments like : “ So .. good .. ” “ very beautiful ” Later , 1 star reviews from real users start appearing with comments like : “ Deception ” “ The app is not honest … ” SUMMARY Sheer volume appears to be the preferred approach for Bread developers . Researchers from various security organizations have used a variety of names to assign responsibility for the hacks , including LEAD , BARIUM , Wicked Panda , GREF , PassCV , Axiom , and Winnti . In versions 3.1 – 3.21, the configuration info is xor encoded with 0x85 . Most fraudsters create one - time email addresses or use stolen email addresses , both of which are easy to create or obtain .


In 2014 , our colleagues at Crowdstrike wrote an expos about a long-standing Chinese APT threat group they self-named Putter Panda , which Mandiant / FireEye refers to as APT2 . China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool .


Unlike newer samples , this one created a unique file sloo.exe .


Unlike other rooting malware , this Trojan not only installs its modules into the system , it also injects malicious code into the system runtime libraries . In addition to the legitimate AmmyAdmin tool , the hackers used Visconti Backdoor developed based on legitimate RMS ( remote manipulator system ) software . The macro code inside the remote OLE document contains PowerShell commands that download and execute the final payload . ( Forbes , Gizmodo ) • Vulnerability Roundup : Memory corruption vulnerability in Microsoft Edge ; MilesightVPN and router could be taken over • Malicious Microsoft Drivers Could Number in the Thousands : Cisco Talos • New Threat Actor Launches Cyber - attacks on Ukraine and Poland •


The first webview overlay is created on step 6 of the activation cycle . We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro ) , an Iran-nexus actor that has been active since at least May 2017 . The newer sample appears to be a re-write for optimization purposes with the underlying behavior remaining the same , reverse shell . First , the endpoint , used for informing clients about services offered by the remote Microsoft Exchange server , is accessed using an authenticated request to the frontend .


The collection of basic device information . The generalized targeting of organizations involved in energy and petrochemicals mirrors previously observed targeting by other suspected Iranian threat groups , indicating a common interest in the sectors across Iranian actors . The newest module’s compilation timestamp is March 2018 . Budworm aka LuckyMouse , Emissary Panda , APT27 deployed a previously unseen variant of its SysUpdate backdoor SysUpdate DLL inicore_v2.3.30.dll .


The ultimate objective of targeted attacks is to acquire sensitive data . XENOTIME operates globally , impacting regions far outside of the Middle East , their initial target .


Copy the content from the server object into the new client object ( will not work if client implementation is different ) .


In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage . This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files .


Screenshots from this developer ’ s YouTube video shows history of checking Ashas adware on Google Play ESET telemetry Figure 15 . The regsvr32.exe executable can be used to download a Windows Script Component file (SCT file) by passing the URL of the SCT file as an argument . The exploit , which takes advantage of CVE-2018-4878 , allows an attacker to execute arbitrary code such as an implant .


The Root of All ( Android ) Evil So how does TrickMo get around these security features ? HawkEye is a versatile Trojan used by diverse actors for multiple purposes . In July 2017 , we observed the OilRig group using a tool they developed called ISMAgent in a new set of targeted attacks .


It can also access the phone ’ s cameras and microphone . More recently Turla was accused of breaching RUAG , a Swiss technology company , in a public report published by GovCERT.ch . Researchers have pointed out that it is not uncommon for China-based threat groups to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement .


Suckfly 's first step was to identify a user to target so the attackers could attempt their initial breach into the e-commerce company 's internal network .


Based on information gained from discussion with the initial TRITON S-MAL/TRISIS responders and subsequent work on follow-on activity by this entity , Dragos developed a comprehensive ( public ) picture of adversary activity roughly matching FireEye ’s analysis published in April 2019 , described in various media .


As visible on following chart , the lifespan of many well-known rented Android bankers is usually no more than one or two years . Operators behind Machete apparently already have information about individuals or organizations of interest to them in Latin America , how to reach them , and how best to trick them into getting compromised . APT38 .


After all , a working product is often more important than a stable product . The activity dates to at least 2013 and has ties to multiple reports by other researchers . Public disclosures may result in an immediate change in APT12 ’s tools . The new campaign , which we call FakeSG , also relies on hacked WordPress websites to display a custom landing page mimicking the victim 's browser .


The attackers deploy the Shamoon malware .


The conditions to build an additional payload are never met . In this campaign , Gaza Cybergang used disposable emails and domains as the phishing platform to target the victims . Initial technical information about this feature was shared by the Thyssenkrupp CERT in the form of an Nmap script that could be used to identify Winnti infections through network scanning .


We have worked with Google and they ensure that Google Play Protect proactively catches apps of this nature . Lazarus was initially known for its involvement in espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures that saw large amounts of information being stolen and computers wiped by malware . In April 2019 , reports emerged of an intrusion involving Winnti malware at a GermanPharmaceutical company .


Of note , this methodology of naming abstracts away the “ who ” element – XENOTIME may represent a single discrete entity ( such as a Russian research institution ) or several entities working in coordination in a roughly repeatable , similar manner across multiple events .


Many of the targets we identified were well known commercial organizations located in India .


] it Catanzaro server2fi.exodus.connexxa [ . CNIIHM 's characteristics are consistent with what we might expect of an organization responsible for TEMP.Veles activity . Requesting commands from the C2 server : They have used phishing emails containing inline links to malicious URLs hosting DOUBLEDRAG malware , a highly obfuscated Javascript downloader .


Check Point analyzed Yingmob ’ s Umeng account to gain further insights into the HummingBad campaign and found that beyond the 10 million devices under the control of malicious apps , Yingmob has non-malicious apps installed on another 75 million or so devices . Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs . APT33 : 64.251.19.214 [REDACTED].ddns.net . The Monti ransomware collective has restarted their operations , focusing on institutions in the legal and governmental fields .


Infection vector and victims While looking for the infection vector , we found no evidence of spear phishing or any of the other common vectors . When victims open malicious documents attached to the emails , the malware scans for Bitcoin activity and then establishes an implant for long-term data-gathering . This script in turn downloaded and executed a PowerShell backdoor known as POSHC2 , a proxy-aware C&C framework , from the C&C server ( https:// host-manager.hopto.org ) . But after being informed that Bradshaw was not subject to Canadian trademark laws , Avid Life offered to buy AshleyMadisonSucks.com for $ 10,000 .


SpyNote RAT captured the device ’ s screen activities along with audio using the MediaProjectionCallback functionality ( available with Lollipop , the Android 5.0 release , and later ) and saved the output in a file named " video.mp4 '' as shown in the following screenshot SMS stealing SpyNote RAT was also observed stealing SMS messages from the affected devices , as shown in screenshot below : Stealing contacts The ability to steal contacts is a favorite feature for spyware developers , as the stolen contacts can be used to further spread the spyware Group-IB specialists have established that the aim of the attack was to deliver and launch the second stage of Silence’s Trojan , known as Silence.MainModule . The basic principles of targeted attacks on financial institutions have not changed since 2013 when the Anunak , Corkow , Buhtrap , and Lurk groups began conducting the first attacks on Russian banks .


These encoded strings contain the new URL addresses not seen in older versions of FakeSpy . At the end of 2018 , while searching for new FIN7 campaigns via telemetry , we discovered a set of activity that we temporarily called CopyPaste” from a previously unknown APT . In May 2017 , NCC Group 's Incident Response team reacted to an ongoing incident .


The capabilities remained unchanged , but a new endpoint was added to the Trojan C2 allowing it to handle the generic card grabber overlay and specific target overlays ( banking apps ) separately . On the two other victim networks , the attackers deployed a unique version of the UPPERCUT (ANEL) backdoor , known to have only been used by APT10 . The group focuses on companies that have intellectual property or sensitive information like those in the Defense and High-Tech industries .


The main difference is that Smaps transmits data as plain text , while Asacub encrypts data with the RC4 algorithm and then encodes it into base64 format . CTU researchers have observed the threat group obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both . The kit we found is in tgz format , though we have observed some samples disguised as png or jpg . Tools for phishing analysis and remediation that save security operations teams time and help find indicators of compromise across a sea of suspicious messages can also make a big difference in the fight against ransomware .


We have collected numerous samples spanning from 2016 to early 2019 . The use of infrastructure tied to Iranian operations , timing and alignment with the national interests of Iran also lead FireEye to assess that APT34 acts on behalf of the Iranian government . The RAT starts by launching three threads . Methods of manipulating control can include changes to set point values , tags , or other parameters .


TG-3390 : 208.115.242.37 .


COSMICDUKE : First known activity January 2010 , Most recent known activity Summer 2015 , Other names Tinybaron , BotgenStudios , NemesisGemina , C&C communication methods HTTP(S) , FTP , WebDav , Known toolset components Information stealer , Multiple loaders , Privilege escalation component , Multiple persistence components .


] com was a C2 for Poison Ivy samples associated with attacks on Myanmar and other Asian countries discussed in a blog published by Arbor Networks in April 2016 . The limited use of these tools by APT41 suggests the group reserves more advanced TTPs and malware only for high-value targets . APT32 often deploys these backdoors along with the commercially-available Cobalt Strike BEACON backdoor .


This APT group usually carries out target attacks against government agencies to steal sensitive information . TG-3390 SWCs may be largely geographically independent , but the group 's most frequently used C2 registrars and IP net blocks are located in the U.S .


Moreover , we retrieved his University ID ; a quick googling showed some of his exam grades . The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits , including the EternalBlue exploit used in the WannaCry attack from May 2017 . jams481.site.bz .


For most of the OnionDuke components we observed , the first versions that we are aware of were compiled during the summer of 2013 , suggesting that this was a period of active development around this toolset .


In 2018 , Kaspersky Labs published a report that analyzed Turla threat group . To control ATMs , the group uses the Atmosphere Trojan , which is unique to Silence , or a program called xfs-disp.exe . In addition , Silence downloads the reverse proxy programs Silence.ProxyBot and SilenceProxyBot.NET , which are described in detail in the report Silence: moving into the darkside .


CVE-2016-0034 : Microsoft Silverlight 5.1.41212.0 Vulnerability .


The NGOs targeted by BRONZE PRESIDENT conduct research on issues relevant to the PRC .


In case of both the documents ( Uri Terror Report.doc and mha-report.doc ) the malicious macro code was heavily obfuscated (used obscure variable/function names to make analysis harder ) and did not contain any auto execute functions .


In addition to the clicking activity , Judy displays a large amount of advertisements , which in some cases leave users with no option but clicking on the ad itself . Public disclosure by third-parties , including the DHS , associate ALLANITE operations with Russian strategic interests . The code waits for an incoming connection . Module ID Internal Name 1 module_ipc 2 module_monitor 3 module_apu 4 module_event 5 module_net


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests . Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory .


Even though the Dukes appear to have targeted governments all over the world , we are unaware of them ever targeting the Russian government .


Deutsche Post - Deutsche Post DHL Group , a German multinational package delivery and supply chain management company headquartered in Bonn . Insikt Group enumerated all domains reported as being used by APT33 since January 2019 . Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec , in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking , which we are calling Gorgon Group .


The official “ Golden Cup ” Facebook page . From 2016 through 2017 , two subsidiaries of U.S. and Philippine consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations . Carbon Black was able to discover approximately 120 different Ursnif variants that were being hosted from the domains iscondisth.com and bevendbrec.com . irongreen.exe : 404d25e3a18bda19a238f77270837198 c064f6f047a4e39014a29c8c95526c3fe90d7bcea5ef0b8f21ea306c27713d1f , Sun Dec 18 11:04:31 2011 UTC . irongreen.text : 85aa9117c381eae3d181ab63daab335e . irongreen.rdata : 3e1c774bc4e0ffc2271075e621aa3f3d . irongreen.data : 6c389e5e301564f65dcad4811dbded8b . irongreen.rsrc : efba623cc62ffd0ccbf7f3fbf6264905 . irongreen.reloc : 6cf46599a57a6cbc5d18fbb2883620ce . The fact that this activity occurred as recently as August 2023 suggests that the group is currently active , and that those organizations that may be of interest to Budworm should be aware of this activity and the groups current toolset .


The finding , in part , shows the risk that can come in opting for less expensive smartphones , whose manufacturers may not diligently fix security vulnerabilities . Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe The attackers used identical TTPs for executing malware and Mimikatz as observed before , by using DLL sideloading with known good binaries that had DLL search order path issues . Daserf : 04080fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a .


Captured legitimate user credentials when users interacted with these actor - controlled servers . we detected an ongoing campaign targeting a national data center in the Centeral Asia .


Further research of the attacker ’ s infrastructure revealed more related mimicking domains . It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns . The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


] net , negg1.ddns [ . We believe the iOS malware gets installed on already compromised systems , and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems . In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations .


Permissions The package name follows the original style name used on DenDroid . Some of the known filenames for Gray Lambert are mwapi32.dll and poolstr.dll – it should be pointed though that the filenames used by the Lamberts are generally unique and have never been used twice . APT12 . In addition to the complexity of managing CSP rules , this vulnerability shows how widely used services such as Google Analytics can be subverted to bypass this protection .


Figure 12 : Fake Bank Austria Security application icon In addition to operating as a banking Trojan , overlaying a legitimate banking app with an indistinguishable credential theft page , the malware also asks for credit card information from the user when they open applications such as the Google Play store . The CIA has developed automated multi-platform malware attack and control systems covering Windows , Mac OS X , Solaris , Linux and more , such as EDB's HIVE and the related Cutthroat and Swindle tools , which are described in the examples section below . Deep Panda is a suspected Chinese threat group known to target many industries , including government , defense , financial , and telecommunications .


He also used his email account to log into various services in the video , which identifies him as the adware domain owner , beyond any doubt . Ploutus-D will load KXCashDispenserLib” library implemented by Kalignite Platform (K3A.Platform.dll) to interact with the XFS Manager and control the Dispenser (see Figure 13) . In this analysis , we observed the return of HIDDEN COBRA 's Bankshot malware implant surfacing in the Turkish financial system .


Historically , the majority of their targeting has been focused on the South Korean government , military , and defense industrial base . Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word .


APT41 has targeted payment services specializing in handling in-game transactions and real money transfer (RMT) purchases . Confucius' backdoors are delivered through Office documents exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .


In this latest incident , the group registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day . This article is an attempt to share this experience with other experts , particularly the IT security specialists in companies and financial institutions that increasingly find themselves the targets of cyber-attacks .


The C2 backend url looks like this : https : //evilhost/c2folder/njs2/ ? Bookworm 's functional code is radically different from PlugX and has a rather unique modular architecture that warranted additional analysis by Unit 42 . These emails contained malicious Microsoft Word documents with the aforementioned Flash Player zero-day hidden inside an embedded ActiveX object . BADCALL communicates on ports 443 and 8000 with a FakeTLS method.[6 ] Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.[7 ] BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.[8 ]


Threat data from endpoints are combined with signals from email and data , identities , and apps in Microsoft 365 Defender ( previously Microsoft Threat Protection ) , which orchestrates detection , prevention , investigation , and response across domains , providing coordinated defense . Using information from the FireEye DTI cloud , FireEye observed that Ke3chang targeted a single firm . Double Loaded Zip File Delivers Nanocore Most malware sent via emails is packaged in archives such as ZIP, RAR, and 7z ) . How The Command are executed The malware add to the user environment variables and creates a pipe for covert communication and receiving the output .


26fef238028ee4b5b8da631c77bfb44ada3d5db8129c45dea5df6a51c9ea5f55 33a9da16d096426c82f150e39fc4f9172677885cfeaedcff10c86414e88be802 34d000ee1e36efd10eb37e2b79d69249d5a85682a61390a89a1b9391c46bf2ba 4f6146956b50ae3a6e80a1c1f771dba848ba677064eb0e166df5804ac2766898 Dragos instead focuses on threat behaviors and appropriate detection and response . URL : http://nicoledotso.icu/debby/weatherford/Vydalyty . They can target a single company , maybe with the intention of stealing trade secrets or discrediting that company .


) embedded in the executable and prepares the execution of a new layer of VM decoding . DROPSHOT is a notable piece of malware used to deliver variants of the TURNEDUP backdoor . The encoded payload is additionally encrypted with AES128 and further obfuscated with XOR in an attempt to fool steganography detection tools . Once installed , the trojan could disrupt operations within systems and networks or exfiltrate confidential data .


It should be noted that until this point , even though CosmicDuke had been in active use for over 4 years , and had undergone minor modifications and updates during that time , even the most recent CosmicDuke samples would often embed persistence components that date back to 2012 .


In fact , with full access to the compromised Android smartphone , the opportunities for criminals to wreak havoc are significant – such as erasing infected phones or launching man-in-the-middle ( MITM ) attacks . The group has carried out attacks most months since December 2017 . so the callback can deobfuscate multiple control flow flattenings . Based on available information Mandiant has not been able to assess a general location that the group operates from .


] com9oo91e [ . The actors successfully compromised a host of an Saudi government institutions on January 17 , 2016 , and maintained access for at least two weeks . Overall , the combination of a relatively high number of “ Shanghai ” registrations with obviously false registration examples in other registrations suggests a partially uncoordinated domain registration campaign from 2004 until present , in which some registrants tried to fabricate non-Shanghai locations but others did not . Monitor for changes made to windows registry keys and/or values that may attempt to hide artifacts associated with their behaviors to evade detection .


It is considered to be the most advanced group of the three , and is focused on high-profile targets in the Middle East , North America , Europe and Asia .


Display a message box .


Examples of notable Potao dissemination techniques , some of which were previously unseen , or at least relatively uncommon , include the use of highly-targeted spear-phishing SMS messages to drive potential victims to malware download sites and USB worm functionality that tricked the user into ' willingly ' executing the trojan . In addition , BRONZE UNION activity on multiple U.S.-based defense manufacturer networks included the threat actors seeking information associated with aerospace technologies , combat processes , and naval defense systems .


Windows Credential Editor ( WCE ) — obtains passwords from memory . gsecdump — obtains passwords from memory . winrar — compresses data for Exfiltration . nbtscan — scans NetBIOS name servers .


Machine translation of this tweet reads : “ Watch out for online banking : Emotet reloads TrickBot . Notably , APT41 was observed using proof-of-concept exploit code for CVE-2019-3396 within 23 days after the Confluence . This threat group has conducted broad targeting across a variety of industries , including financial , government , energy , chemical , and telecommunications .


The use of the client application differs from many other webshells that the actor would interact with in a browser window .


During these intrusions , LEAD ’s objective was to steal sensitive data , including research materials , process documents , and project plans .


The communication with the server is a handshake using an encryption algorithm ( Camellia ) .


Most mobile malware is designed to steal users ’ money , including SMS-Trojans , and lots of backdoors and Trojans . Emissary Panda has used many ways with the most notable being the exploits from the Hacking Team leak . In addition to the two compromised universities , thanks to the C&C URL format used by the attackers we have reasons to think that at least three additional Hong Kong universities may have been compromised using these same ShadowPad and Winnti variants . Further , NIST does not endorse any commercial products that may be mentioned on these sites .


The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage . In 2015 , the SecureWorks documented the BRONZE UNION threat group ( formerly labeled TG-3390 ) , which CTU analysis suggests is based in the People's Republic of China ( PRC ) .


The full list of banking applications targeted is included in the appendix . Our analysis of this malware shows that it belongs to Hussarini , also known as Sarhust , a backdoor family that has been used actively in APT attacks targeting countries in the ASEAN region since 2014 . At a high level , Retriever is a .NET downloader that downloads secondary payloads from servers associated with Magic Hound .


This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005 .


Exodus is equipped with extensive collection and interception capabilities . In August 2017 , we found this threat group has developed yet another Trojan that they call ' Agent Injector ' with the specific purpose of installing the ISMAgent backdoor . These commands can be issued to a specific victim based on the UID generated on each target ( by using the disk serial and contextual information such as the hostname , the antivirus and the OS ) or to all of them . One explanation for this could be that that they used the region as a test zone ; another would be that the threat actor runs the operation from those locations , although it could also be a false flag meant to point the researchers on the wrong path .


The malware , dubbed “ Judy ” , is an auto-clicking adware which was found on 41 apps developed by a Korean company . Initial attack targets are commonly software and gaming organizations in United States , Japan , South Korea , and China . If the target filename is incorrect or invalid the plugin file is deleted and the registry value is erased . First , the discovery of new OT malware presents an immediate threat to affected organizations , since these discoveries are rare and because the malware principally takes advantage of insecure by design features of OT environments that are unlikely to be remedied any time soon .


During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals . Similar to our approach with Symantec 's report on Hidden Lynx , we used Recorded Future to organize the technical details about the DeputyDog attacks to reveal technical information described in the open source reporting across multiple campaigns .


SPLM 64-bit modules already appeared to be at version 4 of the software by May of the year .


Usually they would upload a clean version back on Google Play the very same day . US targets emerged in September 2017 with a small , targeted phishing campaign directed at select U.S. electric companies . In the ProCC campaigns , the downloaded files are Delphi binaries . Adversaries may manipulate physical process control within the industrial environment .


The second artifact – identified across this report as Artifact #2 – -has the following attributes :


Heaven ’ s gate is still in use in 2017 Stage 2 : A second multi-platform virtual machine The 64-bit stage 2 malware implements another loader combined with another virtual machine . The HTA files contained job descriptions and links to job postings on popular employment websites . One of the payloads we encountered was encoded inside an image of Kaito Kuroba1 , the gentleman thief character from a popular Japanese manga series . Exploitation of CVE-2023 - 4966 will not crash the NSPPE process and generate memory core dump files .


For example , the US ( with around 303k infections ) , Saudi Arabia ( 245k ) , Australia ( 141k ) and the UK ( 137k ) . Confucius targeted a particular set of individuals in South Asian countries , such as military personnel and businessmen , among others . In addition , the contents of each Loader DLL E-TOOL differs from package to package , as does the encrypted data included in the ZIP file . This second , partially obfuscated web shell , named iisstart.aspx ( MD5 : 0fd9bffa49c76ee12e51e3b8ae0609ac ) , was more advanced and contained functions to interact with the file system .


Parts of the PUTTER PANDA toolset and tradecraft have been previously documented , both by CrowdStrike , and in open source , where they are referred to as the MSUpdater group . In the previous pages we have presented our findings based on ESET detection telemetry and our analysis of Win32/Potao and Win32/FakeTC samples .


In case of mha-report.doc the malicious activity triggered only when the show document button was clicked , when this event occurs the macro code calls a subroutine CommandButton1_Click() which in turn calls a malicious obfuscated function ( Bulbaknopka() ) .


Seeing that the developer did not take any measures to protect his identity , it seems likely that his intentions weren ’ t dishonest at first – and this is also supported by the fact that not all his published apps contained unwanted ads . DarkPulsar is a very interesting administrative module for controlling a passive backdoor named ' sipauth32.tsp ' that provides remote control , belonging to this category . Documents with the flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


Once the victim presses the Enable content button , the embedded macro is executed .


The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 . Skipper , which has been linked to Turla in the past , was found alongside Gazer in most cases we investigated .


MCI is Saudi Arabia ’s Ministry of Commerce and Investment .


The second notable cluster comprises of two campaigns that were possibly aimed at gathering information on Georgia S-LOC-NATO relations .


sendAll function used to spread malicious messages to the contact list . We also observed the actors uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before . Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


However , GPP does not treat new apps and updates any differently from an analysis perspective . According to a 49-page report published Thursday , all of the attacks are the work of Chinese government 's intelligence apparatus , which the report 's authors dub the Winnti Umbrella . Keylogging , ZXARPS ( IP and URL spoofing ) , and SYNFlood are some of the interesting features added to version 3.2 . The content of the form is legitimate and targets Ukrainian government organizations , as seen in the image below .


Once it has been installed , it requests permissions from the user so that it can steal sensitive data , manipulate SMS messages , and potentially infect contacts of the user . The main payload is usually Imminent Monitor RAT; however , at the beginning of 2018 , we also observed the use of LuminosityLink RAT , NetWire RAT , and NjRAT . both attributed to Chinese government affiliated groups .


The iOS versions were available outside the app store , through phishing sites , and abused the Apple Developer Enterprise program . This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies . Depending on each sample , the content of document is either a fake resume application , or a letter from the Ministry of Justice in Lebanon or Saudi Arabia .


Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection . Delivering a backdoor and spyware , Desert Falcons 's campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video .


The Base64-encoded data is inserted into the following json object , which contains the individual names .


Recent campaigns see APT28 group return to covert intelligence gathering operations in Europe and South America .


] com svc [ . They are often targeted simultaneously with other ethnic minorities and religious groups in China . FireEye researchers spotted the malware when analyzing a recent attempted attack on an organization involved in shaping economic policy . The source code is loaded from one of several domains impersonating Google ( google - analytiks[.]com ) or Adobe ( updateadobeflash[.]website ): That code contains all the web elements ( images , fonts , text ) needed to render the fake browser update page .


For Android 4.4.4 and older , the Trojan will patch method _Z30dvmHeapSourceStartupBeforeForkv from libdvm.so , and for Android 5 and newer it will patch method nativeForkAndSpecialize from libandroid_runtime.so . Desert Falcons is keenly aware of the information they can derive from these devices and are using multi-stage ( phishing + an executable ) , multi-platform ( Android + desktop ) attacks to accomplish their spying . While there is a marked interest in Brazilian victims , our telemetry shows that their reach has extended to other countries in Latin America and beyond . Since the original announcement , we have observed several new attacks using the same exploit ( CVE-2013 - 0640 ) which drop other malware .


Cannon logs into the trala.cosh2@post.cz account via POP3S looking for emails with a subject that matches the unique system identifier .


Furthermore , APT32 continues to threaten political activism and free speech in Southeast Asia and the public sector worldwide . In the past , Scarlet Mimic has primarily targeted individuals who belong to these minority groups as well as their supporters , but we've recently found evidence to indicate the group also targets individuals working inside government anti-terrorist organizations .


The permissions on the first version of the malware lay out the foundations of a spying trojan . Most of the Blue and Green Lambert samples have two C&C servers hardcoded in their configuration block : a hostname and an IP address . While the malware used in the attacks were not very complicated by nature , these proved very effective . A possible solution would come from adaptive URLs , adding the ID as part of the URL or subdomain to allow admins to set CSP rules that restrict data exfiltration to other accounts .


Figure 3 below shows a diff with the LuckyStrike macro on the left and Sofacy macro on the right , where everything except the file path and randomly generated values in the macro are exactly the same , including the obfuscation attempts that use concatenation to build strings .


In the case of this spyware , search for app named TikTok Pro . The malicious actors behind the Okrum malware were focused on the same targets in Slovakia that were previously targeted by Ketrican 2015 backdoors . Kimsuky is a North Korean based threat group that has been active since at least September 2013 .


The extraction method is the same , but the encryption algorithm ( also XOR ) is much simpler . In July 2017 , FireEye observed APT34 targeting an organization in the Middle East using the POWRUNER PowerShell-based backdoor and the downloader BONDUPDATER , which includes a domain generation algorithm ( DGA ) for command and control . The alpha channel byte remains unchanged . In particular , we managed to gather details on an individual using the handle Hack520 , who we believe is connected to Winnti .


] com md5c [ . APT41 operations against higher education , travel services , and news/media firms provide some indication that the group also tracks individuals and conducts surveillance . Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years .


The actor sends an email to trala.cosh2@post.cz with the unique system identifier as a subject with a file path that the Cannon Trojan will use to save the secondary payload .


CTU researchers discovered evidence that the threat actors were not only leveraging the company 's remote access infrastructure , but were also using the company 's endpoint management platform , Altiris , to move laterally through the network .


Adding connections to FakeSpy We have been seeing activity from XLoader since 2018 , and have since followed up our initial findings with a detailed research revealing a wealth of activity dating back to as early as January 2015 , which outlined a major discovery—its connection to FakeSpy . The APT18 then installed the hcdLoader RAT , which installs as a Windows service and provides command line access to the compromised system . Ping mode will also be set if exceptions occur more than three times during text . It is accessed using a path confusion exploit , CVE-2022 - 41040 , allowing the attacker to reach the backend for arbitrary URLs .


This fake notification tactic is used to redirect the user 's attention , meanwhile the app hides itself , making the user believe the app to be faulty . We can observe that the sample is very recent , created on Thursday , July 4 . The decoded configuration is similar in structure to the version Kaspersky classifies as Winnti 2.0, as well as samples in the 2015 Novetta report .


BLOCKER_EXTORTIONIST_START – display HTML page of the ransomware . This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . Furthermore , the Leafminer arsenal server hosted a Python script to scan for this vulnerability .


From our analysis of the TrickMo mobile malware , it is apparent that TrickMo is designed to break the newest methods of OTP and , specifically , TAN codes often used in Germany . We believe Emissary Panda exploited a recently patched vulnerability in Microsoft SharePoint tracked by CVE-2019-0604 , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell . In the January 16 , 2018 attack , we observed OilRig attacking an organization it previously targeted in January 2017 .


Also , when an SMS arrives , the Trojan puts the phone into silent mode and switches off the screen so the user doesn ’ t notice that a new SMS has arrived . Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system . Today , the governments of the United States , United Kingdom , Australia , Canada , New Zealand and Japan have all announced that the government of North Korea is responsible for the activities of ZINC/Lazarus .


By integrating the findings with prior research , it was possible to connect MONSOON directly with infrastructure used by the HANGOVER group via a series of strong connections . In late September 2015 Mofang used the website of Myanmara 's national airline hosted at www.flymna.com for an attack against an organization in Myanmar .


Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org . The presence of code to exfiltrate data to removable drives when there is physical access to a compromised computer may indicate that Machete operators could have a presence in one of the targeted countries , although we cannot be certain . During this heist , APT38 waited for a holiday weekend in the respective countries to increase the likelihood of hiding the transactions from banking authorities .


Manufacturers should be keeping close tabs on what software ends up on their devices . Moving through the infection process , NetWitness Endpoint detects the initial exploit CVE-2017-1182 in action as the Microsoft Equation Editor , EQNEDT32.exe , scores high for potentially malicious activity . C2 : log.gokickes.com .


Since the initial appearance of Operation AppleJeus , we can see that over time the authors have changed their modus operandi considerably .


While the report appears to contain numerous inaccuracies , some of the indicators of compromises are legitimate and appear to be correctly attributed to Sofacy .


We suspect that the group sought access to these networks to obtain information that would enable it to monitor communications passing through the providers' systems . The threat actors target a wide range of organizations : CTU researchers have observed TG-3390 actors obtaining confidential data on defense manufacturing projects , but also targeting other industry verticals and attacking organizations involved in international relations .


Unfortunately , we can’t get all the related files as some payloads were only executed in memory .


Researchers from the IBM X-Force Incident Response and Intelligence Services ( IRIS ) team identified a missing link in the operations of a threat actor involved in recent Shamoon malware attacks against Gulf state organizations .


In the image below , we see a log TrickMo sent to the attacker upon becoming the default SMS app . The Poseidon Group actively targets this sort of corporate environment for the theft of intellectual property and commercial information , occasionally focusing on personal information on executives . In this case , the attackers maintained a presence on the target 's network for nearly six months between September 2016 and March 2017 .


For example , we found a piece of a particularly sophisticated Android ransomware with novel techniques and behavior , exemplifying the rapid evolution of mobile threats that we have also observed on other platforms . One interesting note about the criminal activity of Gorgon Group is their usage of Bitly . . The differences between commercial spyware and digital extortion attacks You may have received an email something like , “ We know you ’ve visited this adult website .


RATANKBA is delivered to its victims using a variety of lure documents , including Microsoft Office documents , malicious CHM files , and different script downloaders . We believe that it is likely threat actors will continue development Bookworm , and will continue to use it for the foreseeable future .


Therefore , “ Agent Smith ” decompiles both the original application and the malicious payload and fuses them together . It is thus interesting to see Buhtrap add strategic web compromises to their arsenal . This is the first of several instances of Dexphot employing living-off-the-land techniques , the use of legitimate system processes for nefarious purposes . Now , there is a potential new competitor in the " fake updates " landscape that looks strangely familiar .


APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia . The Infy group also appears to engage in espionage activities against foreign governments and businesses .


Zen 's rooting trojan apps target a specific device model with a very specific system image . In this case , it was a group commonly referred to as " Nitro " , which was coined by Symantec in its 2011 whitepaper . They sent spear phishing messages with the subject “ 2015 Taiwan Security and Cultural Forum Invitation Form ” , and used a different tool – a tool that we refer to as DOORJAMB – in their attempt to compromise the organization . Talos Takes Ep .


But our researchers have predicted that these small Trojans would certainly be used to download some really bad malware that can actually harm the owners of the infected devices . In this report , we'll review how the NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . In recent OilRig attacks , the threat actors purport to be legitimate service providers offering service and technical troubleshooting as a social engineering theme in their spear-phishing attacks .


They have also been seen using Heartbleed vulnerability in order to directly get valid credentials . MoneyTaker has primarily been targeting card processing systems , including the AWS CBR ( Russian Interbank System ) and purportedly SWIFT ( US ) .


BrainTest leverages an anti-uninstall watchdog that uses two system applications to monitor the removal of one of the components and reinstall the component . Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) . Once executed , tactical malware contains the capability to profile the network and manoeuvre through it to identify a key system of interest .


and addressed to Yahya Al-Sinwar , who Hamas elected as its leader in Gaza in February 2017 .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . In Russia , there were several relatively large cybercriminal groups engaged in financial theft via attacks on RBS .


) Technical Analysis App Name : TikTok Pro Hash : 9fed52ee7312e217bd10d6a156c8b988 Package Name : com.example.dat.a8andoserverx Upon installation , the spyware portrays itself as TikTok using the name TikTok Pro . Gamaredon Group infects victims using malicious attachments , delivered via spear phishing techniques . Winnti Linux variant ’s core functionality is within ‘ libxselinux ’ .


This process is defined in the app ’ s AndroidManifest.xml config file , as shown in the following snippet . This was the first instance we have observed of APT41 targeting pro-democracy groups in Hong Kong . Our visibility into the operations of APT28 - a group we believe the Russian government sponsors - has given us insight into some of the government 's targets , as well as its objectives and the activities designed to further them .


Recognizing the significance of this threat group , Unit 42 continues to track the evolution of Nigerian cybercrime under the code name SilverTerrier . It's possible TG-3390 used a waterhole to infect data center employees .


The mediaserver will first builds a new unique track , start to play the track , loop play all audio buffer , then finally stop the playback . Without any insight into the evidence Kaspersky has obtained , we can only repeat our view that Anunak has targeted only banks in Russia and we have no concrete reports of compromised banks outside of Russia directly related to this criminal group . As an example in the following obfuscated function , Ready to learn more about Malwarebytes for Business ?


According to security 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor . While the URL acts similarly to how eye-watch.in : 443 delivers payloads , we also saw the URL leveraging and exploiting security flaws in Flash : CVE-2015-8651 , CVE-2016-1019 , and CVE-2016-4117 .


For example , numerous malware families register themselves as services during installation to guarantee persistence across reboots .


r1-r4 : This is a local privilege escalation ( root ) exploit , which includes : CVE-2013-6282 , camerageroot ( http : //www.77169.org/exploits/2013/20130414031700 ) , a rooting tool for mtk6592 and addtional exploit . In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves . DragonOK appears to operate out of China 's Jiangsu Province .


The threat actors steal data from compromised systems over a long period of time , which likely indicates a long-term objective of monitoring the target's network .


Dropper payload – downloader DLL Internal name : msdetltemp.dll File format : PE32 DLL File size : 73 728 bytes MD5: f6f88caf49a3e32174387cacfa144a89 Linker version : 11.0 , Microsoft Visual Studio Linker timestamp : 2015.02.10 07:20:02 ( GMT ) Exported functions :


In 2014 , Unit 42 released a report titled " 419 Evolution " that documented one of the first known cases of Nigerian cybercriminals using malware for financial gain . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East .


Once launched , null will first verify whether it is able to fork on the system and that there is no other instance of itself currently running by checking whether the local port number 6842 is available . It has conducted attacks on similar organizations in Saudi Arabia , likely because of the access that those organizations have . Daily_Report.docx : The Winnti group diversified its targets to include enterprises such as those in pharmaceutics and telecommunications .


The payload will execute shell code to steal data from various applications . The attackers have taken great care to stay under the radar , imitating another attack group in the region . The group has heavily targeted the gaming industry , but it has also expanded the scope of its targeting .


However , among our Downeks samples , we found new versions apparently written in .NET .


“ .clic ” and “ k ( ) ; ” ) . We suspect that the group sought access to these networks to obtain information that would enable it to monitor communications passing through the providers' systems . ZXHttpProxy Run a HTTP proxy server on the workstation . It is still unclear whether its authors have any links to known cybercrime organizations .


Figure 25 : infected Android version distribution To further analyze “ Agent Smith ” ’ s infection landscape , we dived into the top 10 infected countries : Country Total Devices Total Infection Event Count Avg . Back in February , Trend Micro noted the similarities between the Patchwork and Confucius groups and found that , in addition to the similarities in their malware code , both groups primarily went after targets in South Asia . The domain address usually ends in a .info or .net TLD , while the file name for the actual payload consists of random characters , similar to the randomness previously seen being used to generate file names and scheduled tasks . In this case , Mandiant observed the process w3wp.exe , ( the IIS process associated with the Exchange web front - end ) spawning cmd.exe to write a file to disk .


Upon opening of the MS Word document , our embedded file exploits CVE-2017-11882 to drop a malicious fake Norton Security Shell Extension module , 'NavShExt.dll' , which is then injected into iexplore.exe to install the backdoor , begin collection , and activate command and control . Curiously , Bahamut appears to track password attempts in response to failed phishing attempts or to provoke the target to provide more passwords .


The new class is called NotificationListener and extends the NotificationListenerService class . By relying on a native PDF command to navigate to a new URL , Zirconium successfully circumvented Chrome 's anti-redirect protection . APT12 has previously used the THREEBYTE backdoor . Proxy : Multi - hop Proxy A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 ( RDP ) , 139 ( Netbios ) , and 445 ( SMB ) enabling full remote access from outside the network and has also used TOR .004


Since Shamoon incidents feature the infiltration and escalation stages of targeted attacks , X-Force IRIS responders sought out the attackers ’ entry point .


Kaspersky Lab products detect it as Trojan.AndroidOS.Dvmap.a . If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs . In the RevengeHotels campaign , the downloaded files are .NET binaries protected with the Yoda Obfuscator . Uncovering weaknesses in Apple macOS and VMWare vCenter : 12 vulnerabilities in RPC implementation •


DHS has previously released Alert TA14-353A , which contains additional details on the use of a server message block ( SMB ) worm tool employed by these actors .


The agent appears to have been under development for at least five years and consists of three stages . From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space . From January 2018 to March 2018 , through FireEye 's Dynamic Threat Intelligence , we observed attackers leveraging the latest code execution and persistence techniques to distribute malicious macro-based documents to individuals in Asia and the Middle East .


These entities are not regionally congruent , and the only shared victimology involves their organizational functions .


The Trojan allows the criminals to remotely control the victim ’ s computer and is capable of recording sound from a microphone . The backdoor will load the encrypted configuration file and decrypt it , then use Secure Sockets Layer ( SSL ) protocol to connect to command-and-control ( C&C ) servers . This suggests that this config is added manually to the sample after having been built . As we commonly see in the ransomware space , this threat is delivered through a variety of mechanisms which can include phishing and being dropped as secondary payloads from command and control ( C2 ) frameworks like Cobalt Strike .


As is common for malware , the GeminiDuke infostealer uses a mutex to ensure that only one instance of itself is running at a time .


These campaigns differ in tools , server infrastructure , and nuances in decoy content and intended targets .