On infected PCs , TrickBot displays a query for the mobile phone number and the device type used for banking and then prompts users to install an alleged security app. ” When banking Trojans ask for this type of information , it usually means the next step will be an attempt to infect the victim ’ s mobile device . We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 . Recent investigations by FireEye 's Mandiant incident response consultants combined with FireEye iSIGHT Threat Intelligence analysis have given us a more complete picture of a suspected Iranian threat group , that we believe has been operating since at least 2014 .


large manufacturing companies , particularly those supplying defense organizations , energy companies , embassies in Washington , DC representing countries in the Middle East , Europe , and Asia , likely to target U.S. based users involved in international relations , non-governmental organizations ( NGOs ) , particularly those focused on international relations and defense , government organizations .


The threat actor had a specific pattern of behavior that allowed us to understand their modus operandi : they used one server with the same IP address for multiple operations . Over the course of three years of observation of campaigns targeting civil society and human rights organizations , from records of well over two hundred spearphishing and other intrusion attempts against individuals inside of Iran and in the diaspora , a narrative of persistent intrusion efforts emerges .


APT28 Targets Hospitality Sector , Presents Threat to Travelers .


Based on our KSN statistics , there are several infected individuals , exclusively in Italy . This is yet another similarity with previous MuddyWater campaigns , which were known to have targeted multiple Turkish government entities . The group has conducted intrusions to steal money via targeting ATM systems , card processing , payment systems and SWIFT systems .


The following screenshot shows the contacts being stolen and written in a local array , which is then sent to C & C : Uninstalling apps Uninstalling apps is another function favored by developers of Android spyware and malware . Silence conducted the first stage of their Asian campaign , organising a massive phishing attack aimed at receiving an up-to-date list of current recipients in different countries for further targeted attacks delivering their malicious software . This isn't the first time we've seen Cobalt makes this error—back in March , an attack focussing on 1,880 targets across financial institutions in Kazakhstan had the same flaw .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . Starting in March 2018 , we observed a significant change in the campaign : it now leverages the open source exploitation framework Metasploit before dropping the custom Mosquito backdoor .


Using RDP and stolen credentials from the initially compromised host , the threat actor then proceeded to move laterally around the victim network and was able to deploy GandCrab across several other hosts . In the first attack , Butterfly gained a foothold by first attacking a small European office belonging to one firm and using this infection to then move on to its US office and European headquarters .


As soon as the user clicks the spyware ’ s icon for the first time , nothing seems to happen and the icon disappears from the home screen . Since our last public report , Silence has sent out more than 170 , 000 recon emails to banks in Russia , the former Soviet Union , Asia and Europe . Charming Kitten is an Iranian cyberespionage group operating since approximately 2014 .


Just like in previous examples , the malware author does not use this package . These threats are capable of opening a back door and stealing information from victims' computers . From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE , a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control ( C2 ) server . GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic , 9002 for C2 requests , 33666 as a WebSocket , and 8090 to download files.[15 ] GravityRAT has used HTTP over a non - standard port , such as TCP port 46769.[16 ] HARDRAIN binds and listens on port 443 with a FakeTLS method.[17 ] HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.[18 ] Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic , creating port - protocol mismatches.[19][20 ] MacMa has used TCP port 5633 for C2 Communication.[21 ]


July 16 On the mobile front , a fake news app designed to bypass Google Play was discovered . As part of our monitoring of Iranian threat agents activities , we have detected that since October 2016 and until the end of January 2017 , the Jerusalem Post , as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens . this did not work for functions with three or more dispatchers . However , not all insider threats are intentional , according to an Insider Threat Report from Crowd Research Partners .


This is an area where virus writers are actively working , resulting in a large number of technological innovations . The group , believed to be based in China , has also targeted defense contractors , colleges and universities , law firms , and political organizations — including organizations related to Chinese minority ethnic groups . In case hpqhvsei.dll is loaded by a different process than hpqhvind.exe , the malicious code will not be decrypted and executed . Indicators of Attack are different from Indicators of Compromise IoC , the latter describing evidence of compromised network security .


Here is a list of broadcast actions : android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.USER_PRESENT android.intent.action.PHONE_STATE android.net.wifi.SCAN_RESULTS android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.SCREEN_OFF android.intent.action.SCREEN_ON Furthermore , it has similar code logic as previous ones wuaupdt.exe in this attack appears in previous Donot attack , and C2 addresses are same to previous ones . Another time , the execution flow moves from “ exit.exe to “ i.cmd ” .


We hope that this writeup of our journey through all the multiple layers of protection , obfuscation , and anti-analysis techniques of FinFisher will be useful to other researchers studying this malware . They move laterally and escalate system privileges to extract sensitive information — whenever the attacker wants to do so.4 ,5 Because some RATs used in targeted attacks are widely available , determining whether an attack is part of a broader APT campaign can be difficult . The backdoor also contains an export that loads the C2 communication module reflectively to the memory from resource passed as parameter and then calls its " CreateInstance " export . The availability of such builders allows novice actors to generate their own customized ransomware variants .


traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors . Thanks to information we have been able to collect during the course of our research , such as characteristics of the group 's malware and development cycle , our research strongly supports the claim that the Infy group is of Iranian origin and potentially connected to the Iranian state .


As Unit 42 have observed throughout our tracking of the OilRig group , adopting proven tactics has been a common behavior over time . Based on our research , SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans . It is interesting to note that Turla operators used the free email provider GMX again , as in the Outlook Backdoor and in LightNeuron . This new research confirms our forecast and shows that the Turla group does not hesitate to use open-source pen-testing frameworks to conduct intrusion . Neptun is installed on Microsoft Exchange servers and is designed to passively listen for commands from the attackers . One attack during this campaign involved the use of infrastructure belonging to another espionage group known as Crambus aka OilRig , APT34 . Waterbug has been using Meterpreter since at least early 2018 and , in this campaign , used a modified version of Meterpreter , which was encoded and given a .wav extension in order to disguise its true purpose . In all likelihood , Waterbug’s use of Crambus infrastructure appears to have been a hostile takeover . One of the most interesting things to occur during one of Waterbug’s recent campaigns was that during an attack against one target in the Middle East , Waterbug appeared to hijack infrastructure from the Crambus espionage group and used it to deliver malware on to the victim’s network . These three recent Waterbug campaigns have seen the group compromise governments and international organizations across the globe in addition to targets in the IT and education sectors . Curiously though , Waterbug also compromised other computers on the victim’s network using its own infrastructure . Symantec believes that the variant of Mimikatz used in this attack is unique to Waterbug . Aside from the attack involving Crambus infrastructure , this sample of Mimikatz has only been seen used in one other attack , against an education target in the UK in 2017 . The first observed evidence of Waterbug activity came on January 11 , 2018 , when a Waterbug-linked tool (a task scheduler named msfgi.exe ) was dropped on to a computer on the victim’s network . In the case of the attack against the Middle Eastern target , Crambus was the first group to compromise the victim’s network , with the earliest evidence of activity dating to November 2017 . Waterbug’s intrusions on the victim’s network continued for much of 2018 . Symantec did not observe the initial access point and the close timeframe between Waterbug observed activity on the victim’s network and its observed use of Crambus infrastructure suggests that Waterbug may have used the Crambus infrastructure as an initial access point .


Debug BuildConfig with the version After a deep analysis of all discovered versions of Skygofree , we made an approximate timeline of the implant ’ s evolution . The OceanLotus reflects a very strong confrontational ability and willing to attack by keep evolving their techniques . It is responsible for the Operation SMN campaign .


Other groups , such as Buhtrap , Corkow and Carbanak , were already known to target and successfully steal money from financial institutions and their customers in Russia . The first time this happened was at the beginning of the month , when Proofpoint researchers blew the lid off a cyber-espionage campaign named Operation Transparent Tribe , which targeted the Indian embassies in Saudi Arabia and Kazakhstan .


Loaders are typically responsible for loading a DLL component into memory given that a DLL cannot operate in a standalone mode such as an executable . Leader is Bookworm 's main module and controls all of the activities of the Trojan , but relies on the additional DLLs to provide specific functionality .


The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities . For example , at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network .


It installs malicious modules with different functionality into the system . From early 2014 until December 2018 , ns0.idm.net.lb pointed to 194.126.10.18 , which appropriately enough is an Internet address based in Lebanon . The scale and impact of APT1 ’s operations compelled us to write this report . Together with our partner CrySyS Lab , we ’ve discovered two new , previously - unknown infection mechanisms for Miniduke .


If the value of this field failed to arrive from the C & C , it was selected from the file data.db using a pseudo-random algorithm . Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs . These and other tools used by the Lazarus group can be mitigated by routinely scanning the network for any malicious activity to help prevent the malware from entering and spreading through an organization .


Dragos identified several compromises of ICS vendors and manufacturers in 2018 by activity associated with XENOTIME , providing potential supply chain threat opportunities and vendor-enabled access to asset owner and operator ICS networks .


We have also observed and notified STRONTIUM attacks against Olympic organizing committees , anti-doping agencies , and the hospitality industry .


Variants of malware and tools used by HIDDEN COBRA actors include Destover , Wild Positron E-MAL/Duuzer , and Hangman .


Based on information gained from discussion with the initial TRITON / TRISIS responders and subsequent work on follow-on activity by this entity , Dragos developed a comprehensive ( public ) picture of adversary activity roughly matching FireEye ’s analysis published in April 2019 , described in various media .


In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 . Bellingcat also reported the domain had been used previously to host potential decoy documents as detailed in VirusTotal here using http://voguextra.com/decoy.doc .


Unit 42 tracks the toolkits delivering FakeM under the names MNKit , WingD and Tran Duy Linh . Gallmaker 's targets are embassies of an Eastern European country .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . The Lamberts toolkit spans across several years , with most activity occurring in 2013 and 2014 .


This particular strain of Adware was found in 206 applications , and the combined download count has reached almost 150 million . Since at least the beginning of 2014 , APT38 operations have focused almost exclusively on developing and conducting financially motivated campaigns targeting international entities , whereas TEMP.Hermit is generally linked to operations focused on South Korea and the United States . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . Madi was found capturing computer screens , recording audio and stealing screenshots , keystrokes , documents and e-mail correspondence from " Middle Eastern critical infrastructure engineering firms , government agencies , financial houses and academia .


In July of 2015 , we identified a full e-mail uploaded to an antivirus scanning service that carried a Scarlet Mimic exploit document . In March 2017 , Wikileaks published details about an exploit affecting Mikrotik called ChimayRed .


From the emails ( and the attachments ) it looks like the goal of the attackers was to infect and take control of the systems and also to spy on the actions of the Indian Government post the Jammu & Kashmir protest and Uri Terror attack .


CTU researchers recommend the following practices to prevent or detect TG-3390 intrusions :


Ploutus-D will load KXCashDispenserLib” library implemented by Kalignite Platform (K3A.Platform.dll) to interact with the XFS Manager and control the Dispenser (see Figure 13) . Our research indicates that it has started targeting Japanese users .


The article describes the malicious document and the Seduploader reconnaissance malware , especially the difference with the previous versions .


In May 2016 , two apparently unrelated activity groups , PROMETHIUM and NEODYMIUM , conducted attack campaigns in Europe that used the same zeroday exploit while the vulnerability was publicly unknown . The subject is a series of targeted attacks against private companies .


The open source and several other samples we found give a dynamically-assigned 1 byte ID at compile time .


As is characteristic for obfuscated threats , the malware has encrypted binary code stored in the Assets folder : When the malware runs for the first time , the static block of the main class is run . MyWeb is the second-generation malware used by Ke3chang . Furthermore, the email address used in Reply-To is from a free email client . This new ransomware variant does n't have any novel features or functionality and points to the challenges organizations are facing as the landscape continues to shift and a plethora of new actors join their ranks .


The BokBot malware provides LUNAR SPIDER affiliates with a variety of capabilities to enable credential theft and wire fraud , through the use of webinjects and a malware distribution function . They tried new techniques to steal from banking systems , including AWS CBR ( the Russian Central Bank 's Automated Workstation Client ) , ATMs , and card processing .


It 's often hard for average users to know if their phones have been rooted , and Shedun apps often wait some period of time before displaying obtrusive ads or installing apps . The campaign 's use of an SMB worm to distribute WCry contributed to the ransomware 's virulence . APT33 : 64.251.19.216 [REDACTED].myftp.biz . Considering that both Royal and BlackSuit were active last month , however , a rebrand probably is n’t happening any time soon .


Then , a request is formed in such a way that an activity that installs the application is called , bypassing all security checks . The infection vector is similar , it uses a similar modified mimikatz application , and it uses a third-party remote access tool , changes system settings to allow concurrent RDP sessions , and so on . The decryption process involves ADD and XOR operations , using a key hardcoded in the binary . We should note that SocGholish used to retrieve media files from separate web requests until more recently when it started using self - contained Base64 encoded images .


In this case we found traces of dx/dexmerge compilers , which means that , this time , the attackers just imported the original source code into an Android IDE ( such as Android Studio , for instance ) and compiled it with their own modifications . When Buhtrap was targeting businesses , the decoy documents would typically be contracts or invoices . Members from our team have already presented on the conflict of these two threat actors at security conferences .


Hopefully this analysis has been helpful in understanding how truly connected some of these infrastructures can be and how with a little digging , you can uncover a substantial amount of operationally useful indicators to protect you and yours .


In some versions of Asacub , strings in the app are encrypted using the same algorithm as data sent to C & C , but with different keys . Within six hours of entering the environment , the threat actors compromised multiple systems and stole credentials for the entire domain . Collection of results and data from scanning in this manner might be easier to sort ( while allowing them to stay under the radar ) , as compared to getting feedback from zombie bots deployed around the world simultaneously . That Budworm continues to use a known malware SysUpdate , alongside techniques it is known to favor , such as DLL sideloading using an application it has used for this purpose before , indicate that the group is nt too concerned about having this activity associated with it if it is discovered .


At execution , it installs an application-defined Windows hook .


It will appear differently to users depending on the language set on the device . They were also behind an attack on the World Anti-Doping Agency (WADA) , in which they leaked confidential information about several drug tests . “ winserv.exe ” file .


Many hacktools are made for less than ethical purposes and are freely available , so this was an initial red flag , which led us to investigate further .


Armed with this code , we removed this first layer of anti-analysis protection . On November 10 , 2015 , Lotus Blossom sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs . Once the service runs , it appends the extension .mui to its DLL path , reads that file and decrypts it using RC5 . In one particular forum post , Hack520 mentions that he was previously jailed for a period of 10 months in a blog post dated May 31 , 2009 .


Collection T1417 Input Capture Records user input data . In the case of the attack against the Middle Eastern target , Crambus was the first group to compromise the victim’s network , with the earliest evidence of activity dating to November 2017 . Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years .


Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials . Versions of this particular orchestrator were found on other victims , together with White Lambert samples , indicating a close relationship between the White and Pink Lambert malware families .


The PassCV group continues to be extremely effective in compromising both small and large game companies and surreptitiously using their code-signing certificates to infect an even larger swath of organizations . Since that analysis , CTU researchers have observed multiple BRONZE UNION threat campaigns that illustrate the evolution of the group 's methods and espionage objectives .


While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization . t's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost .


ORat malware sample : a0758535cf8eb689782b95d3791d23d5 , 774a9c3ff01a3e734b7bec0c312120126295fad9 , 2e8762c984468ee309dad30a6c5f6d3308676ac721357da442a8a5b9d9d65d82 .


In the screenshots below , Windows Defender ATP clearly presents the Winnti installation where an installer drops a DLL to disk , loads the DLL using rundll32 , sets the DLL as a service , and saves a copy of itself in C:\Windows\Help .


The new SOL protocol within the PLATINUM file-transfer tool makes use of the AMT Technology SDK 's Redirection Library API ( imrsdk.dll ) . Secondly , when the emails were being sent to a broad set of recipients , the mails purported to be a necessary security update .


Both init and init2 scripts make sure all other running mining services are killed , and that all the files in the working directory are executed by giving 777 permissions .


PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts . This suggests to us that Thrip 's motives go beyond spying and may also include disruption .


Files Description CMDS * .txt Text files with commands to execute supersu.apk SuperSU ( eu.chainfire.supersu , https : //play.google.com/store/apps/details ? Working with U.S. Government partners , DHS and FBI identified Trojan malware variants used by the North Korean government - referred to by the U.S. Government as BADCALL . APT33 : 213.252.244.14 service-avant.com . Individuals who have access to critical information or systems can easily choose to misuse that accessto the detriment of their organization .


Afterwards , they establish phishing sites on these domains that spoof the look and feel of the victim ’s web-based email services in order to steal their credentials .


In several cases , the Cobalt compromised company infrastructure and employee accounts in order to send phishing messages to partner companies in North and South America , Europe , CIS countries , and Central and Southeast Asia . By pivoting off the registration details and servers data of the two domains we discovered others registered by the threat agent .


This matches our observations of C2 servers as shown in Figure 7 . However , the attack on January 16 did not involve ThreeDollars at all . Indeed , some VMs do not have serial numbers and the macro is executed only if a serial number exists . Ashley Madison ’s parent company — Toronto - based Avid Life Media — filed a trademark infringement complaint in 2010 that succeeded in revealing a man named Dennis Bradshaw as the owner .


From there , infected phones display illegitimate ads and install fraudulent apps after certain events , such as rebooting , the screen turning on or off , a detection that the user is present , or a change in Internet connectivity . WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data . APT33 : 64.251.19.232 mynetwork.ddns.net . They also list nebiltech[.]shop in their IOCs which is a domain we sometimes saw injected near the Google Tag Manager script , but not within it .


We found two functions : The first function is http : //s.psserviceonline [ . Kaspersky found the BlackOasis group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . The DNSMessenger malware is a shared tool , used by FIN7 , MuddyWater and perhaps other groups .


Targets The initial version of Ginp had a generic credit card grabber overlay screen used for all targeted applications . In September 2018 , one of our clients (and a supplier as well) , Visma , reached out to us for assistance in investigating an incident uncovered on their network following a breach notification by Rapid7 . The author of the NamelessHdoor appears to have created additional versions of the Nameless Backdoor by removing unnecessary functions , and added open-source DLL injection code from ReflectiveDLLLoader .


This was the case in two known intrusions in 2015 , where attackers named the implant DLL “ ASPNET_FILTER.DLL ” to disguise it as the DLL for the ASP.NET ISAPI Filter .


The campaign , which we refer to as Operation Cloud Hopper , has targeted managed IT service providers ( MSPs ) , allowing APT10 unprecedented potential access to the intellectual property and sensitive data of those MSPs and their clients globally . In December 2017 , FireEye publicly released our first analysis on the TRITON attack where malicious actors used the TRITON custom attack framework to manipulate industrial safety systems at a critical infrastructure facility and inadvertently caused a process shutdown .


This is a common trick played by malware developers , making the user think the app may have been removed . In November 2018 , Silence tried their hand at targeting the Asian market for the first time in their history . These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider .


Second Phase The second phase dex file contains 3 main services that are being used : • ConnManager - handles connections to the C & C • ReceiverManager - waits for incoming calls / app installations • TaskManager - manages the data collection tasks The C & C server address is different than the one that is used by the first phase , so the app reconnects to the new server as well as starts the periodic data collector tasks . APT33 's targeting of organizations involved in aerospace and energy most closely aligns with nation-state interests , implying that the threat actor is most likely government sponsored . For both the receiving of C2 commands and exfiltration, Remexi uses the Microsoft Background Intelligent Transfer Service (BITS ) mechanism to communicate with the C2 over . Notably , the main function contains logic flaws that cause it to only be able to connect to an MSSQL server and upload ( LIGHTWORK ) to it , before immediately attempting to clean itself up .


The campaign we observed used four stages of PowerShell scripts without writing the the payloads to individual files .


It turns out that those smaller Trojans face serious problems trying to get root access on Android 4.4.4 and above , because a lot of vulnerabilities were patched in these versions . These include CVE-2010-3962 as part of an attack campaign in 2010 and CVE-2014-1776 in 2014 . In July 2017 , we observed APT34 targeting a Middle East organization using a PowerShell-based backdoor that we call POWRUNER and a downloader with domain generation algorithm functionality that we call BONDUPDATER , based on strings within the malware .


CTU researchers divided the threat intelligence about TG-3390 into two sections : strategic and tactical .


Icons used for EventBot masqueraded as legitimate with these icons.application . We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester . Additionally , the targeting of a French diplomat based in Taipei , Taiwan aligns with previous targeting by these actors , as does the separate infrastructure .


com.circle.android com.coinbase.android com.walmart.android com.bestbuy.android com.ebay.gumtree.au com.ebay.mobile com.westernunion.android.mtapp com.moneybookers.skrillpayments com.gyft.android com.amazon.mShop.android.shopping com.comarch.mobile.banking.bgzbnpparibas.biznes pl.bnpbgzparibas.firmapp com.finanteq.finance.bgz pl.upaid.bgzbnpp NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird . Starting from those ﬁndings , Cybaze-Yoroi ZLab team decided to deep dive into a technical analysis of the latest Pterodo implant . In addition , Hack520 ’s tweets always show photos of the same animal , which is likely his pet pig .


THE DUKES 7 YEARS OF RUSSIAN CYBER ESPIONAGE .


Extract current GPS coordinates of the phone . The threat actor behind ProjectSauron commands a top-of-the-top modular cyber-espionage platform in terms of technical sophistication , designed to enable long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods . As soon as the victim double-clicks on the dropper , they are presented with the decoy document . We highly suspect the “ Pig network ” to have also been used as a bulletproof hosting service for cybercriminals who are unrelated to the Winnti group .


Table 3 ( above ) summarizes the commands supported by the variants used in the attack against Ukrainian government organizations . In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 .


spear phishing : analytics-google.org .


Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 . the United Kingdom had data stolen by members of Emissary Panda .


Below is a list of the payloads used by the Skygofree implant in the second and third stages . OceanLotus’ targets are global . Suckfly is a China based threat group that has been active since at least 2014 .


and were signed using the name of an engineer who appears to hold equity in Connexxa . Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt . The MuddyWater campaign was first sighted in 2017 when it targeted the Saudi government using an attack involving PowerShell scripts deployed via Microsoft Office Word macro .


Today , the number of deployed IoT devices outnumber the population of personal computers and mobile phones , combined .


The attacks described here begin with a banking credential phishing scheme , followed by an attempt to trick the victim into installing Marcher , and finally with attempts to steal credit card information by the banking Trojan itself . Just months after the APT32 watering hole activity against ASEAN-related websites was observed in Fall 2017 , this new activity clearly indicates the association (ASEAN) clearly remains a priority collection target in the region . Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora .


The ultimate goal of this threat is to mine Monero cryptocurrency in compromised Linux machines . Wild Neutron 's attack took advantage of a Java zero-day exploit and used hacked forums as watering holes .


] net svc [ . In another modification , first observed in the most recent October 11 Parliamentarian operation ( version agewkassif ) , the developer (s ) of KeyBoy began using a string obfuscation routine in order to hide many of the critical values referenced within the malware . About four months after The New York Times publicized an attack on its network , the attackers behind the intrusion deployed updated versions of their Backdoor.APT.Aumlib and Backdoor.APT.Ixeshe malware families . We will continue to monitor these campaigns and in particular SocGholish to see if the web delivery landscape changes .


LATINUM makes a concerted effort to hide their infection tracks , by self-deleting malicious components , or by using server side logic in ' one shot mode ' where remotely hosted malicious components are only allowed to load once . Our analysis shows that actors attempted to exploit CVE-2012-0158 to install NetTraveler Trojan .


Like CozyDuke , OnionDuke appears to have been designed with versatility in mind , and takes a similarly modular platform approach .


Noting who is targeted , with what malware , and with what types of lures provide clues with which organizations can improve their security posture .


In the wild , these are only distributed as a direct download from unofficial Web pages ( “ third-party ” app ) and not through legitimate app stores . Although the APT38 's primary targets appear to be Financial Exchange banks and other financial organizations , they have also Financial Exchange targeted countries ' media organizations with a focus on the financial sector . maturity level , There are more unused URLs in the script .


if less or equal ( signed ) 0x5 MOV Move the value of a register into the VM descriptor ( same as opcode 0x1F ) 0x6 JO Jump if overflow 0x7 PUSH Push the internal VM value to the stack 0x8 ZERO Reset the internal VM value to 0 ( zero ) 0x9 JP Jump if parity even 0xA WRITE Write into an address 0xB ADD Add the value of a register to the internal VM value 0xC JNS Jump if not signed 0xD JL Jump if less ( signed ) 0xE The timeline in Figure 2 shows that the Emissary Trojan was first created ( version 1.0 ) in May 2009 and quickly received an update that resulted in version 1.1 in June 2009 . Is it simply financial gain? Are there any reasons why the three affected products are from Asian developers and for the Asian market? Do these attackers use a botnet as part of a larger espionage operation? ESET products detect this threat as Win32/HackedApp.Winnti.A , Win32/HackedApp.Winnti.B , the payload as Win32/Winnti.AG , and the second stage as Win64/Winnti.BN . The United States government also threatened to step in when it looked like a U.S. company was going to purchase NSO Group , an infamous Israeli maker of the Pegasus spyware .


APT10 has been observed to exfiltrate stolen intellectual property via the MSPs , hence evading local network defences . In this report we continue our research of the actor 's operations with a specific focus on a selection of custom information technology ( IT ) tools and tactics the threat actor leveraged during the early stages of the targeted attack lifecycle .


The malware appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD (via Bitcoin) to decrypt the data . However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers .


Besides providing the ability to execute arbitrary commands on the target system , these utilities normally don’t raise suspicion as they are commonly whitelisted by Antivirus and other commercial security software .


But two tools used were unique to the group : ASPXTool , an Internet Information Services ( IIS ) specific " Web shell " used to gain access to servers inside a target 's network ; and the OwaAuth credential stealing tool and Web shell , used to attack Microsoft Exchange servers running the Web Outlook interface . Malicious programs intentionally scan for machines with an automated Bank-Customer system of the Central bank of Russia ( further referred to as BCS CBR ) .


The most popular member of the Android/AdDisplay.Ashas family on Google Play was “ Video downloader master ” with over five million downloads Ashas functionality All the apps provide the functionality they promise , besides working as adware . In mid-2018 , Kaspersky's report on Operation AppleJeus” highlighted the focus of the Lazarus threat actor on cryptocurrency exchanges . The malware checks if a file used on a previous version of KONNI is available on the system .


Most of them use the same mutex structure , share the same fake icon and unique metadata details , file writes , registry operations , and fake common program metadata , as seen in DustySky samples .


Call an attacker-specified number Uninstall apps Check if a device is rooted Hide its icon Retrieve list of files on external storage If running on a Huawei device it will attempt to add itself to the protected list of apps able to run with the screen off Encrypts some exfiltrated data Desert Scorpion 's second stage masquerades as a generic " settings '' application . We would like to add some strong facts that link some attacks on banks to Lazarus , and share some of our own findings as well as shed some light on the recent TTPs used by the attacker , including some yet unpublished details from the attack in Europe in 2017 . Elfin continues to be focused heavily on Saudi Arabia , which accounted for 42 percent of attacks observed by Symantec since the beginning of 2016 . Tortoiseshell Facebook Attack Campaign


COMMON FEATURES Permissions When installed , EventBot requests the following permissions on the device : SYSTEM_ALERT_WINDOW - allow the app to create windows that are shown on top of other apps . The contents of the decoy PDF is a job descriptions with the South Korean Coast Guard . Of note , this is three years earlier than the oldest Elise sample we have found , suggesting this group has been active longer than previously documented .


Finally , it is worth noting that while most of the compilation timestamps for CosmicDuke samples appear to be authentic , we are aware of a few cases of them being forged .


The tool then starts a new web browser instance on the attacker’s system and submits credentials on the real VPN portal . In this blog , FireEye Labs dissects this new ATM malware that we have dubbed RIPPER and documents indicators that strongly suggest this piece of malware is the one used to steal from the ATMs at banks in Thailand .


android.intent.action.SIM_STATE_CHANGED System notification that the SIM card has changed or been removed . APT41 has been observed inserting malicious code into legitimate video game files to distribute malware . The espionage group , which according to the U.S. Department of Homeland Security ( DHS ) and the Federal Bureau of Investigation ( FBI ) is linked to the Russian government , returned to low-key intelligence-gathering operations during 2017 and into 2018 , targeting a range of military and government targets in Europe and South America .


the explorer.exe or winlogon.exe process ; also protected by VM obfuscation .cab Config Main configuration file ; encrypted setup.cab Unknown Last section of the setup executable ; content still unknown .7z Plugin Malware plugin used to spy the victim network communications wsecedit.rar Stage 6 Main malware executable After writing some of these files , the malware decides which kind of installation to perform based on the current privilege provided by the hosting process ( for example , if a Microsoft Office process was used as exploit vector ) : Installation process under In early 2017 , Mandiant responded to an incident involving APT35 targeting an energy company . The decryption is performed with the use of the StreamTransformationFilter class with the StreamTransformation cipher set to AES CBC decryption mode . The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


It is a toolkit similar to Metasploit or PowerShell Empire and is freely available to anyone on Github .


If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros . WannaCry incorporated the leaked EternalBlue exploit that used two known vulnerabilities in Windows CVE-2017-0144 and CVE-2017-0145 to turn the ransomware into a worm , capable of spreading itself to any unpatched computers on the victim's network and also to other vulnerable computers connected to the internet .


Please note that these unblocking instructions are based on an analysis of the current version of Rotexy and have been tested on it . The scanner was identified as the Acunetix Web Vulnerability Scanner which is a commercial penetration testing tool that is readily available as a 14-day trial . Known targets of the Leviathan have been involved in the maritime industry , and research institutes , academic organizations , and private firms in the United States .


This tells us that it is possible either the threat actors or at least one of the targets is located in that area .


Based on analysis of the group 's SWCs , TG-3390 operations likely affect organizations in other countries and verticals . If it is not in Switzerland , the traffic will proceed as normal .


The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience . The first of which we call ' CONFUCIUS_A ' , a malware family that has links to a series of attacks associated with a backdoor attack method commonly known as SNEEPY ( aka ByeByeShell ) first reported by Rapid7 in 2013 .


Since TrickMo ’ s HTTP traffic with its C & C server is not encrypted , it can easily be tampered with . This whitepaper explores the tools - such as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , etc- of the Dukes , a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making . The threat actor behind ProjectSauron commands a top-of-the-top modular cyber-espionage platform in terms of technical sophistication , designed to enable long-term campaigns through stealthy survival mechanisms coupled with multiple Exfiltration methods .


While Google implemented multiple mechanisms , like two-factor-authentication , to prevent hackers from compromising Google accounts , a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in . The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . If the setl is always sub-instruction during the optimization , These groups commonly share infrastructure to complete their actions on objectives .


Based on this information , CTU researchers assess that TG-3390 aims to collect defense technology and capability intelligence , other industrial intelligence , and political intelligence from governments and NGOs . Dragos instead focuses on threat behaviors and appropriate detection and response .


Along with the subsequent Process Activity using the newly built PowerShell command , which aligns with what was commented out of the first sample analyzed .


Google Apps allows organizations to use Gmail as their organizational mail solution .


It was configured to activate via SMS sent from a Czech Republic number . If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation . and green-colored flattened blocks . It is only when evaluating indicators of attack in the big picture , that the patterns of data collection and attempts to access the network start resembling an adversary with malicious intent .


Take note of the following best practices to prevent this threat from getting in your device : Disable app installations from unknown , third-party sources . However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team . some blocks are deleted by the optimization after defeating opaque predicates , PBI Research Services also reported a data breach that exposed information for 4.75 million people .


This delay means that a typical testing procedure , which takes less than 10 minutes , will not detect any unwanted behavior . It contains a Word document in plaintext ( written to Bienvenue_a_Sahaja_Yoga_Toulouse.doc ) , along with an executable ( Update.exe ) and DLL ( McUpdate.dll ) . The analysis shows us the evolution of KONNI over the last 3 years .


“ We ’ re appreciative of both Check Point ’ s research and their partnership as we ’ ve worked together to understand these issues , ” said Adrian Ludwig , Google ’ s director of Android security . From November 2015 through the end of 2016 , APT38 was involved in at least nine separate compromises against banks . When a binary is loaded into IDA Pro , You 'll uncover why the US has seen a significant uptick in ransomware incidents across the board , especially in sectors like education .


Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload . The actors appear to follow a set playbook , as the observed TTPs are fairly static within each attack in this campaign .


PlugX C2 server : ipsoftwarelabs.com .


CTU researchers have observed the threat group obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both .


This service , along with the API , was fully decommissioned in March 2019 . By pivoting off the registration details and servers data of the two domains we discovered others registered by the threat agent . The backdoor had the following properties : They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration .


Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack . CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 .


The following factors supporting this assessment are further detailed in this post .


Based on this discovery , we began to look for other binaries signed with the South Korean mobile software developer's certificate .


We identified 42 apps on Google Play as belonging to the campaign , which had been running since July 2018 . In a recent campaign , Kaspersky observed ScarCruft using a multi-stage binary to infect several victims and ultimately install a final payload known as ROKRAT – a cloud service-based backdoor . The executable performs the following tasks: If the system is a 64-bit version of Windows , it downloads and executes a specific 64-bit version of the malware thanks to a powershell script .


In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 . The document attached to this e-mail exploits CVE-2012-0158 .


The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format . The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 .


The most significant change in this particular Trojan ’ s history was the encryption of data sent between the device and C & C . Based on BRONZE UNION 's targeting activity , CTU researchers assess it is highly likely that the group focuses on political and defense organization networks . Users can consider adopting security solutions that can defend against malicious bot-related activities such as Outlaw ’s through a cross-generational blend of threat defense techniques . Adversaries may also use CLIs to install and run new software , including malicious tools that may be installed over the course of an operation .


Microsoft is aware of CVE-2015-1701 and is working on a fix .


XENOTIME configured TRISIS based on the specifics and functions of the Triconex system within the industrial control ( ICS ) environment .


FakeSpy uses an anti-debugging technique by creating another child process of itself . During our research into this attack campaign , Unit 42 gathered several tools that the Emissary Panda uploaded to the three webshells at the two government organizations . Some of the malicious documents were test files without the implant .


As we have seen in some previous targeted malware attacks , the attackers in this incident are taking advantage of services like changeip.com to establish free subdomains in their infrastructure . When the adversaries' operations are live , they modify the record again to point the C2 domain to an IP address they can access .


Earlier this month , Securelist 's technology caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . APT40 is described as a moderately sophisticated cyber-espionage group which combines access to significant development resources with the ability to leverage publicly available tools .


This mistake in operational security allowed us to gain visibility into exfiltrated content for a number of devices . Only one client , based in Iran , continued to communicate with the infrastructure . Below is a list of zones registered by APT1 that are newsthemed : As Google Analytics is allowed in the CSP configuration of many major sites , this demo shows how an attacker can bypass this security protection and steal data .


An example SMS message is shown in Figure 1 . Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information . Finally , it will be run using “ post.php ” as argument . But while it was clear earlier on that attackers were actively exploiting CVE-2023 - 34362 , it was only a few days later that it became clear that Cl0p was behind the attacks .


Android remains a prime target for malicious attacks . This is a hacking group with Chinese origins which targets selected organisations related with education , energy and technology . The suspicious sample detected by Augur is actually a new 32-bit ShadowPad launcher . The malware then checks the command execution functionality using a command that vary across the samples .


SeaDuke is made interesting by the fact that it is written in Python and designed to be cross-platform so that it works on both Windows and Linux .


In this scenario , one or more persons – likely including at least one CNIIHM employee , based on the moniker discussed above – would have had to conduct extensive , high-risk malware development and intrusion activity from CNIIHM ’s address space without CNIIHM ’s knowledge and approval over multiple years .


The second method uses intents , broadcasts , and receivers to execute HenBox code . In June 2018 , APT41 sent spear-phishing emails using an invitation lure to join a decentralized gaming platform linked to a cryptocurrency service (Figure 5) that had positioned itself as a medium of exchange for online games and gambling sites . On December 29 , 2016 , the Department of Homeland Security ( DHS ) and Federal Bureau of Investigation ( FBI ) released a Joint Analysis Report confirming FireEye 's long held public assessment that the Russian government sponsors APT28 .


After publishing our initial series of blogposts back in 2016 , Kaspersky has continued to track the ScarCruft threat actor . These include CVE-2010-3962 as part of an attack campaign in 2010 and CVE-2014-1776 in 2014 . Beginning in August 2016 , a group calling itself the Shadow Brokers began releasing tools it claimed to have originated from the Equation Group . Over the coming months , it progressively released more tools , until April 2017 , when it released a final , large cache of tools , including the DoublePulsar backdoor , the FuzzBunch framework , and the EternalBlue , EternalSynergy , and EternalRomance exploit tools . However , Buckeye had already been using some of these leaked tools at least a year beforehand . The earliest known use of Equation Group tools by Buckeye is March 31 , 2016 , during an attack on a target in Hong Kong . Beginning in March 2016 , Buckeye began using a variant of DoublePulsar (Backdoor.Doublepulsar) , a backdoor that was subsequently released by the Shadow Brokers in 2017 . However , while activity involving known Buckeye tools ceased in mid-2017 , the Bemstour exploit tool and the DoublePulsar variant used by Buckeye continued to be used until at least September 2018 in conjunction with different malware . During this attack , the Bemstour exploit tool was delivered to victims via known Buckeye malware (Backdoor.Pirpi) . One hour later , Bemstour was used against an educational institution in Belgium . Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor . DoublePulsar is then used to inject a secondary payload , which runs in memory only . A significantly improved variant of the Bemstour exploit tool was rolled out in September 2016 , when it was used in an attack against an educational institution in Hong Kong . When used against 32-bit targets , Bemstour still delivered the same DoublePulsar backdoor . Bemstour was used again in June 2017 in an attack against an organization in Luxembourg . Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam . Development of Bemstour has continued into 2019 . Unlike earlier attacks when Bemstour was delivered using Buckeye's Pirpi backdoor , in this attack Bemstour was delivered to the victim by a different backdoor Trojan (Backdoor.Filensfer) . The most recent sample of Bemstour seen by Symantec appears to have been compiled on March 23 , 2019 , eleven days after the zero-day vulnerability was patched by Microsoft . Filensfer is a family of malware that has been used in targeted attacks since at least 2013 . The zero-day vulnerability found and reported by Symantec (CVE-2019-0703) occurs due to the ACT the Windows SMB Server handles certain requests . While Symantec has never observed the use of Filensfer alongside any known Buckeye tools , information shared privately by another vendor included evidence of Filensfer being used in conjunction with known Buckeye malware (Backdoor.Pirpi) . CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 . Buckeye's exploit tool , EternalRomance , as well as EternalSynergy , can exploit the CVE-2017-0143 message type confusion vulnerability to perform memory corruption on unpatched victim computers . In the case of the Buckeye exploit tool , the attackers exploited their own zero-day vulnerability (CVE-2019-0703) . It is noteworthy that the attackers never used the FuzzBunch framework in its attacks . FuzzBunch is a framework designed to manage DoublePulsar and other Equation Group tools and was leaked by the Shadow Brokers in 2017 . There are multiple possibilities as to how Buckeye obtained Equation Group tools before the Shadow Brokers leak . However , aside from the continued use of the tools , Symantec has found no other evidence suggesting Buckeye has retooled . this RTF exploits again the CVE-2017-1882 on eqnedt32.exe . And the dropper execute the iassvcs.exe to make a side loading and make the persistence . This IP is very interesting because it connects with tele.zyns.com and old infrastructures used by chinese APT or DDOS Chinese team against the ancient soviet republics . Over the past three years , Filensfer has been deployed against organizations in Luxembourg , Sweden , Italy , the UK , and the U.S . All zero-day exploits known , or suspected , to have been used by this group are for vulnerabilities in Internet Explorer and Flash . According to reports , the Philippines is the most exposed country in ASEAN to the cyberattacks known as advanced persistent threats , or APTs . Our analysis of this malware shows that it belongs to Hussarini , also known as Sarhust , a backdoor family that has been used actively in APT attacks targeting countries in the ASEAN region since 2014 . OutExtra.exe is a signed legitimate application from Microsoft named finder.exe . In addition to file-based protection , customers of the DeepSight Intelligence Managed Adversary and Threat Intelligence (MATI) service have received reports on Buckeye , which detail methods of detecting and thwarting activities of this group . However , in this attack , this file is used to load the Hussarini backdoor via DLL hijacking . Today , this malware is still actively being used against the Philippines . Hussarini was first mentioned in APT campaigns targeting the Philippines and Thailand in 2014 . Further analysis showed that the Iron cybercrime group used two main functions from HackingTeam's source in both IronStealer and Iron ransomware . Xagent” is the original filename Xagent.exe whereas seems to be the version of the worm . Xagent – A variant of JbossMiner Mining Worm” – a worm written in Python and compiled using PyInstaller for both Windows and Linux platforms . Its activities were traced back to 2010 in FireEye's 2013 report on operation Ke3chang – a cyberespionage campaign directed at diplomatic organizations in Europe . We have been tracking the malicious activities related to this threat actor and discovered a previously undocumented malware family with strong links to the Ke3chang group – a backdoor we named Okrum . Furthermore , from 2015 to 2019 , we detected new versions of known malware families attributed to the Ke3chang group – BS2005 backdoors from operation Ke3chang and the RoyalDNS malware , reported by NCC Group in 2018 . Ke3chang behind the attacks seemed to have a particular interest in Slovakia , where a big portion of the discovered malware samples was detected; Croatia , the Czech Republic and other countries were also affected . Our technical analysis of the malware used in these attacks showed close ties to BS2005 backdoors from operation Ke3chang , and to a related TidePool malware family discovered by Palo Alto Networks in 2016 that targeted Indian embassies across the globe . The story continued in late 2016 , when we discovered a new , previously unknown backdoor that we named Okrum . The malicious actors behind the Okrum malware were focused on the same targets in Slovakia that were previously targeted by Ketrican 2015 backdoors . We started connecting the dots when we discovered that the Okrum backdoor was used to drop a Ketrican backdoor , freshly compiled in 2017 . In 2017 , the same entities that were affected by the Okrum malware and by the 2015 Ketrican backdoors again became targets of the malicious actors . This time , the attackers used new versions of the RoyalDNS malware and a Ketrican 2017 backdoor . According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 . In addition to file-based protection , customers of the DeepSight has received reports on Buckeye , which detail methods of detecting and thwarting activities of this group . In 2018 , we discovered a new version of the Ketrican backdoor that featured some code improvements . According to our telemetry , Okrum was used to target diplomatic missions in Slovakia , Belgium , Chile , Guatemala , and Brazil , with the attackers showing a particular interest in Slovakia . Indeed , we have detected various external tools being abused by Okrum , such as a keylogger , tools for dumping passwords , or enumerating network sessions . The detection evasion techniques we observed in the Okrum malware include embedding the malicious payload within a legitimate PNG image , employing several anti-emulation and anti-sandbox tricks , as well as making frequent changes in implementation . The unnamed company makes products used in the military and aerospace industries , and the hackers could have been after commercial secrets or more traditional espionage , according to ClearSky , the cybersecurity firm that exposed the operation . North Korean dictator Kim Jong Un has set ambitious economic goals , and some cybersecurity analysts have predicted he will unleash the Pyongyang-affiliated hackers to meet those deadlines by targeting multinational companies’ trade secrets . According to ClearSky , the suspected Lazarus operatives looked to leverage a vulnerability in outdated WinRAR file-archiving software that hackers have been exploiting since it was disclosed last month . This new Lotus Blossom campaign delivers a malicious RTF document posing as an ASEAN Defence Minister's Meeting (ADMM) directory (decoy) that also carries an executable (payload) embedded as an OLE object , the Elise backdoor . Just months after the APT32 watering hole activity against ASEAN-related websites was observed in Fall 2017 , this new activity clearly indicates the association (ASEAN) clearly remains a priority collection target in the region . Researchers implicated Lazarus Group because of digital clues including a malicious implant known as Rising Sun that has been attributed to the group . The attackers originally embedded an implant into the malicious document as a hypertext application (HTA) file , and then quickly moved to hide it in an image on a remote server and used obfuscated Visual Basic macros to launch the decoder script . Lazarus used the open-source tool Invoke-PSImage , released December 20 , to embed the PowerShell script into the image file . Once the script runs , it passes the decoded script from the image file to the Windows command line in a variable $x , which uses cmd.exe to execute the obfuscated script and run it via PowerShell . The Department of Homeland Security (DHS) issued an alert about this activity on Jan. 24 2019 , warning that an attacker could redirect user traffic and obtain valid encryption certificates for an organization's domain names . In the Sea Turtle campaign , Talos was able to identify two distinct groups of victims . The first group , we identify as primary victims , includes national security organizations , ministries of foreign affairs , and prominent energy organizations . The threat actors behind the Sea Turtle campaign show clear signs of being highly capable and brazen in their endeavors . In most cases , threat actors typically stop or slow down their activities once their campaigns are publicly revealed . The threat actors behind the Sea Turtle campaign were successful in compromising entities by manipulating and falsifying DNS records at various levels in the domain name space . If an attacker was able to compromise an organization's network administrator credentials , the attacker would be able to change that particular organization's DNS records at will . If the attackers were able to obtain one of these EPP keys , they would be able to modify any DNS records that were managed by that particular registrar . Captured legitimate user credentials when users interacted with these actor - controlled servers . The diagram below illustrates how we believe the actors behind the Sea Turtle campaign used DNS hijacking to achieve their end goals . As of early 2019 , the only evidence of the spear-phishing threat vector came from a compromised organization's public disclosure . On January 4 , Packet Clearing House , which is not an Internet exchange point but rather is an NGO which provides support to Internet exchange points and the core of the domain name system , provided confirmation of this aspect of the actors’ tactics when it publicly revealed its internal DNS had been briefly hijacked as a consequence of the compromise at its domain registrar . During a typical incident , the actor would modify the NS records for the targeted organization , pointing users to a malicious DNS server that provided actor-controlled responses to all DNS queries . The next step for the actor was to build MitM servers that impersonated legitimate services to capture user credentials . In addition to the MitM server IP addresses published in previous reports , Talos identified 16 additional servers leveraged by the actor during the observed attacks . The attackers would then use the certificate on actor-controlled servers to perform additional MitM operations to harvest additional credentials . In some cases , the victims were redirected to these actor-controlled servers displaying the stolen certificate . One notable aspect of the campaign was the actors' ability to impersonate VPN applications , such as Cisco Adaptive Security Appliance (ASA) products , to perform MitM attacks . At this time , we do not believe that the attackers found a new ASA exploit . Rather , they likely abused the trust relationship associated with the ASA's SSL certificate to harvest VPN credentials to gain remote access to the victim's network . As an example , DNS records indicate that a targeted domain resolved to an actor-controlled MitM server . In another case , the attackers were able to compromise NetNod , a non-profit , independent internet infrastructure organization based in Sweden . Using this access , the threat actors were able to manipulate the DNS records for sa1[.]dnsnode[.]net . This redirection allowed the attackers to harvest credentials of administrators who manage domains with the TLD of Saudi Arabia (.sa) . In one of the more recent campaigns on March 27 , 2019 , the threat actors targeted the Sweden-based consulting firm Cafax . We assess with high confidence that Sea Turtle was targeted in an attempt to re-establish access to the NetNod network , which was previously compromised by this threat actor . Obtaining access to this ccTLD registrars would have allowed attackers to hijack any domain that used those ccTLDs . These actors perform DNS hijacking through the use of actor-controlled name servers . Sea Turtle have been more aggressive in their pursuit targeting DNS registries and a number of registrars , including those that manage ccTLDs . These actors use Let's Encrypts , Comodo , Sectigo , and self-signed certificates in their MitM servers to gain the initial round of credentials . These actors have been more aggressive in their pursuit targeting DNS registries and a number of registrars , including those that manage ccTLDs . Once they have access to the network , they steal the organization's legitimate SSL certificate and use it on actor-controlled servers . we believe that the Sea Turtle campaign continues to be highly successful for several reasons . Had more ccTLDs implemented security features such as registrar locks , attackers would be unable to redirect the targeted domains . The attackers stole organizations' SSL certificates associated with security appliances such as ASA to obtain VPN credentials , allowing the actors to gain access to the targeted network . The threat actors were able to maintain long term persistent access to many of these networks by utilizing compromised credentials . Cisco Talos will continue to monitor Sea Turtle and work with our partners to understand the threat as it continues to evolve to ensure that our customers remain protected and the public is informed . If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file . Create a link file in the startup folder for AutoHotkeyU32.exe , allowing the attack to persist even after a system restart . More importantly , one of these files also enables the download of TeamViewer , a remote access tool that gives threat actors remote control over the system . Such attacks highlight the need for caution before downloading files from unknown sources and enabling macro for files from unknown sources . The agency's hacking division freed it from having to disclose its often controversial operations to the NSA (its primary bureaucratic rival) in order to draw on the NSA's hacking capacities . By the end of 2016 , the CIA's hacking division , which formally falls under the agency's Center for Cyber Intelligence (CCI) , had over 5000 registered users and had produced more than a thousand hacking systems , trojans , viruses , and other weaponized malware . Such is the scale of the CIA's undertaking that by 2016 , its hackers had utilized more code than that used to run Facebook . Wikileaks has carefully reviewed the Year Zero disclosure and published substantive CIA documentation while avoiding the distribution of 'armed' cyberweapons until a consensus emerges on the technical and political nature of the CIA's program and how such 'weapons' should analyzed , disarmed and published . These redactions include ten of thousands of CIA targets and attack machines throughout Latin America , Europe and the United States . The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell's 1984 , but Weeping Angel , developed by the CIA's Embedded Devices Branch (EDB) , which infests smart TVs , transforming them into covert microphones , is surely its most emblematic realization . After infestation , Weeping Angel places the target TV in a 'Fake-Off' mode , so that the owner falsely believes the TV is off when it is on . As of October 2014 the CIA was also looking at infecting the vehicle control systems used by modern cars and trucks . The CIA's Mobile Devices Branch (MDB) developed numerous attacks to remotely hack and control popular smart phones . Despite iPhone's minority share (14.5%) of the global smart phone market in 2016 , a specialized unit in the CIA's Mobile Development Branch produces malware to infest , control and exfiltrate data from iPhones and other Apple products running iOS , such as iPads . The attack against Samsung smart TVs was developed in cooperation with the United Kingdom's MI5/BTSS . CIA's arsenal includes numerous local and remote zero days developed by CIA or obtained from GCHQ , NSA , FBI or purchased from cyber arms contractors such as Baitshop . These techniques permit the CIA to bypass the encryption of WhatsApp , Signal , Telegram , Wiebo , Confide and Cloackman by hacking the smart phones that they run on and collecting audio and message traffic before encryption is applied . The CIA also runs a very substantial effort to infect and control Microsoft Windows users with its malware . CIA's malware includes multiple local and remote weaponized zero days , air gap jumping viruses such as Hammer Drill which infects software distributed on CD/DVDs , infectors for removable media such as USBs , systems to hide data in images or in covert disk LOCs Brutal Kangaroo and to keep its malware infestations going . Many of these infection efforts are pulled together by the CIA's Automated Implant Branch (AIB) , which has developed several attack systems for automated infestation and control of CIA malware , such as Assassin and Medusa . The CIA has developed automated multi-platform malware attack and control systems covering Windows , Mac OS X , Solaris , Linux and more , such as EDB's HIVE and the related Cutthroat and Swindle tools , which are described in the examples section below . By hiding these security flaws from manufacturers like Apple and Google the CIA ensures that it can hack everyone &mdsh; at the expense of leaving everyone hackable . Once in Frankfurt CIA hackers can travel without further border checks to the 25 European countries that are part of the Shengen open border LOC — including France , Italy and Switzerland . A number of the CIA's electronic attack methods are designed for physical proximity . The attacker is provided with a USB containing malware developed for the CIA for this purpose , which is inserted into the targeted computer . The attacker then infects and exfiltrates data to removable media . As an example , specific CIA malware revealed in Year Zero is able to penetrate , infest and control both the Android phone and iPhone software that runs or has run presidential Twitter accounts . For example , the CIA attack system Fine Dining , provides 24 decoy applications for CIA spies to use . For example , Comodo was defeated by CIA malware placing itself in the Window's Recycle Bin . CIA hackers discussed what the NSA's Equation Group hackers did wrong and how the CIA's malware makers could avoid similar exposure . The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation . This information is used by the CIA's 'JQJIMPROVISE' software (see below) to configure a set of CIA malware suited to the specific needs of an operation . Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies . HIVE is a multi-platform CIA malware suite and its associated control software . A series of standards lay out CIA malware infestation patterns which are likely to assist forensic crime scene investigators as well as Apple , Microsoft , Google , Samsung , Nokia , Blackberry , Siemens and anti-virus companies attribute and defend against attacks . In April 2013 , Kaspersky Lab reported that a popular game was altered to include a backdoor in 2011 . Yet again , new supply-chain attacks recently caught the attention of ESET Researchers . Given that these attacks were mostly targeted against Asia and the gaming industry , it shouldn’t be surprising they are the work of the group described in Kaspersky’s Winnti – More than just a game” . The OSB functions as the interface between CIA operational staff and the relevant technical support staff . A sustained cyberespionage campaign targeting at least three companies in the United States and Europe was uncovered by Recorded Future and Rapid7 between November 2017 and September 2018 . The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant . The attackers then enumerated access and conducted privilege escalation on the victim networks , utilizing DLL sideloading techniques documented in a US-CERT alert on APT10 to deliver malware . On the two other victim networks , the attackers deployed a unique version of the UPPERCUT (ANEL) backdoor , known to have only been used by APT10 . APT10 actors then compressed proprietary data from Visma using WinRAR (deployed by the attackers) and exfiltrated to a Dropbox account using the cURL for Windows command-line tool . UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques . we assess with high confidence that these incidents were conducted by APT10 also known as Stone Panda , menuPass , CVNX in an effort to gain access to networks and steal valuable intellectual property or gain commercial advantage . On top of the breadth , volume , and targets of attacks that APT10 has conducted since at least 2016 , we now know that these operations are being run by the Chinese intelligence agency , the Ministry of State Security (MSS) . Utilizing actors working for shell companies such as Huaying Haitai Science and Technology Development Co Ltd , the MSS has conducted an unprecedented campaign , dubbed Operation Cloud Hopper , ” against managed IT service providers (MSPs) designed to steal intellectual property and enable secondary attacks against their clients . We assess that APT10 likely compromised Visma with the primary goal of enabling secondary intrusions onto their client networks , and not of stealing Visma intellectual property . In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage . The backdoor was deployed using the Notepad++ updater and sideloading malicious DLL , as noted in APT10’s targeting of Japanese corporations in July 2018 . That attack was attributed to perpetrators Kaspersky called the Winnti Group . APT10 is a threat actor that has been active since at least 2009 . APT10 has historically targeted healthcare , defense , aerospace , government , heavy industry and mining , and MSPs and IT services , as well as other sectors , for probable intellectual property theft . We believe APT10 is the most significant Chinese state-sponsored cyber threat to global corporations known to date . In the blog , Intrusion Truth identified APT10 as having utilized several Tianjin-based companies , including Huaying Haitai Science and Technology Development Co. Ltd. and Laoying Baichen Instruments Equipment Co. Ltd . Based on the technical data uncovered , and in light of recent disclosures by the U.S. Department of Justice on the ongoing activities of Chinese state-sponsored threat actors . Our research from 2017 concluded that Guangdong ITSEC (and therefore the MSS) directed the activities of a company named Boyusec , which was identified as a shell company for APT3 . Access to the networks of these third-party service providers grants the MSS the ability to potentially access the networks of hundreds , if not thousands , of corporations around the world . The December APT10 indictment noted that the group’s malicious activities breached at least 45 companies and managed service providers in 12 countries , including Brazil , Canada , Finland , France , Germany , India , Japan , Sweden , Switzerland , the United Arab Emirates , the United Kingdom , and the United States . In all three incidents , APT10 gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials . In all three incidents , the attackers gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials . In all three incidents , APT10 actors used previously acquired legitimate credentials , possibly gained via a third-party supply chain compromise in order to gain initial access to the law firm and the apparel company . In early 2017 , APT10 began conducting attacks against global managed IT service providers (MSPs) that granted them unprecedented access to MSPs and their customers’ networks . 'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/Exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS ( JukeBox ) and Linux ( DanceFloor ) . . During this operation (dubbed ‘Cloud Hopper” because of the group’s use of popular western cloud-based services) , APT10 utilized both new malware (Quasar RAT , Trochilus , RedLeaves , ChChes as well as some familiar old tools . Most recently , on December 20 , 2018 , the U.S. Department of Justice charged two hackers associated with the Chinese Ministry of State Security (MSS) with global computer intrusion campaigns targeting intellectual property . This indictment attributed the intrusions to APT10 , a group that had been conducting the malicious activities for over a decade on behalf of the MSS , China’s civilian human intelligence agency . The Visma group operates across the entire Nordic region along with Benelux , Central , and Eastern Europe . Recorded Future has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 . We were particularly interested in identifying whether any customers of the targeted MSPs were subsequently compromised by APT10 , given their potential access through compromised MSP networks . Recorded Future’s Insikt Group has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 . In September 2018 , one of our clients (and a supplier as well) , Visma , reached out to us for assistance in investigating an incident uncovered on their network following a breach notification by Rapid7 . This was followed by an initial exploitation , network enumeration , and malicious tool deployment on various Visma endpoints within two weeks of initial access . On August 30 , 2018 , APT10 deployed their first modified version of Trochilus that had its C2 communications encrypted using Salsa20 and RC4 ciphers instead of the more common RC4-encrypted Trochilus variant seen in the wild . This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 . The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process . APT10 also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API . In order to exfiltrate the compromised data , APT10 employed custom malware that used Dropbox as its C2 . They also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API . Our research partner Rapid7 investigated the Dropbox use and found that the attackers had used the same account to store exfiltrated data from a global apparel company . They also identified broadly similar TTPs being used in the attack against a U.S. law firm specializing in intellectual property law . Rapid7’s investigation revealed the law firm was first targeted in late 2017 , followed by the apparel company a few months later , and finally , the Visma attack in August 2018 . In one of the attacks , Rapid7 identified the attackers escaping a Citrix application in order to run the payload script on the victim desktop . Additionally , the same DLL sideloading technique observed in the Visma attack was used , and many of the tools deployed by the APT10 shared naming similarities as well 1.bat , cu.exe , ss.rar , r.exe , pd.exe . Most interestingly , Rapid7 observed the use of the Notepad++ updater gup.exe as a legitimate executable to sideload a malicious DLL (libcurl.dll) in order to deploy a variant of the UPPERCUT backdoor also known as ANEL . APT10 used this approach to deploy UPPERCUT when targeting Japanese corporations in July 2018 . APT10 actors gained initial access to the Visma network around August 17 , 2018 . While we are confident that APT10 actors gained access to the Visma network in August using stolen employee Citrix remote desktop credentials , it is not clear how or when these credentials were initially compromised . Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials . After almost two weeks , on August 30 , 2018 , APT10 attackers used their access to the network to move laterally and made their first deployment of an RC4- and Salsa20-encrypted variant of the Trochilus malware using a previously associated DLL sideloading techniquE . This means that APT10 actors had two separate access points into the Visma network . This slight delay may point to the handing over of active exploitation duties to other operator(s) in a multi-team APT10 effort within the Ministry of State Security for the attack . Other examples of malicious infrastructure registered with internet.bs include domains for APT28’s VPNFilter malware campaign and the registration of the cyber-berkut . org domain that was affiliated with the pro-Russian and potentially Russian state-linked threat actor CyberBerkut . KHRAT is a backdoor trojan purported to be used with the China-linked cyberespionage group DragonOK . In early 2018 , Rapid7 identified that APT10 compromised an apparel company , based upon detections and intelligence gathered from the U.S.-based law firm breach . The attacker gained access to the victim’s internet-accessible Citrix systems and authenticated to them from networks associated with low-cost VPN providers owned by VPN Consumer Network . Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe.” The attackers used identical TTPs for executing malware and Mimikatz as observed before , by using DLL sideloading with known good binaries that had DLL search order path issues . Rapid7 reviewed malware discovered in the victim’s environment and found implants that used Dropbox as the C2 . The attackers used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script . APT10 used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script . For Exfiltration of stolen data , APT10 used WinRAR and renamed rar.exe” to r.exe” to create archives , upload them with curl.exe” (renamed to c.exe”) , and again , use the cloud storage provider Dropbox . Rapid7 discovered that additional data was placed into the Dropbox accounts under control of the attacker during the compromise and was able to attribute data that was placed into it as being owned by Visma . Once on the Visma network , APT10 attackers used the Microsoft BITSAdmin CLI tool to copy malicious tools from a suspected attacker-controlled C2 hosted on 173.254.236[.]158 to the \ProgramData\temp\ directory on the infected host . Rapid7 then provided a breach notification to Visma to alert them to this compromise in September 2018 . We believe APT10 is the most significant known Chinese state-sponsored cyber threat to global corporations . APT10's unprecedented campaign against MSPs , alleged to have included some of the largest MSPs in the world , in order to conduct secondary attacks against their clients , grants the Chinese state the ability to potentially access the networks of hundreds (if not thousands) of corporations around the world . This campaign brings to light further evidence supporting the assertions made by the Five Eyes nations , led by the U.S. Department of Justice indictment against APT10 actors outlining the unprecedented scale of economic cyberespionage being conducted by the Chinese Ministry of State Security . This report , alongside the plethora of other reporting on APT10 operations , acutely highlights the vulnerability of organizational supply chains .


Perhaps the Dukes group thought that by faking a timestamp from before the earliest one cited in the whitepaper , they might be able to confuse researchers .


All nine certificates were used maliciously in 2015 .


Beginning in May 2017 , FireEye observed a number of Ukrainian websites compromised with BACKSWING v1 , and in June 2017 , began to see content returned from BACKSWING receivers . ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints .


FireEye Labs recently detected a limited APT campaign exploiting zero-day vulnerabilities in Adobe Flash and a brand-new one in Microsoft Windows .


MD5s : c4c4077e9449147d754afd972e247efc Document.apk 0b8806b38b52bebfe39ff585639e2ea2 WUC ’ s Conference.apk Triada : organized crime on Android Triada is a modular mobile Trojan that actively uses root privileges to substitute system files and uses several clever methods to become almost invisible March 3 , 2016 You know how armies typically move : first come the scouts to make sure everything is ok. Then the heavy troops The first time the Lambert family malware was uncovered publicly was in October 2014 , when FireEye posted a blog about a zero day exploit ( CVE-2014-4148 ) used in the wild . The actor then made subtle modifications to the file and uploaded the newly created file to the same popular antivirus testing website in order to determine how to evade detection .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 . We started connecting the dots when we discovered that the Okrum backdoor was used to drop a Ketrican backdoor , freshly compiled in 2017 .


Small Trojans like Leech , Ztorg and Gopro now download one of the most advanced mobile Trojans our malware analysts have ever encountered — we call it Triada . The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Artifacts identified within the malware samples related to these attacks also suggest the targeting of the defense industry in Saudi Arabia , which appears to be related to an earlier wave of attacks carried out in the fall of 2015 .


A recent whois of “ goldncup.com ” . Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam 's manufacturing , consumer products , and hospitality sectors . The graph highlights the at least 3 different variants of Ursnif that were being hosted on the bevendbrec.com site . The fact the attackers were attempting to connect in realtime with victims over phones and video conferences for conversations rather than just engaging over email is also unusual , suggesting confidence in the attackers skills in English and in impersonation although it is not clear if any conversations ended up taking place .


The “ VPN Filter ” malware has also been attributed to STRONTIUM by the FBI .


The Dukes primarily target Western governments and related organizations , such as government ministries and agencies , political think tanks , and governmental subcontractors .


Given that this is an active threat , we ’ ve been working behind-the-scenes with our customers to ensure both personal and enterprise customers are protected from this threat and only decided to come forward with this information after the research team at Kaspersky released a report earlier today . WhiteBear is a parallel project or second stage of the Skipper Turla cluster of activity documented in another private intelligence report " Skipper Turla – the White Atlas framework " from mid-2016 . Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes . The videos were quickly passed around offices while users ’ systems were silently infected in the background , and many of the APT ’s components were signed with phony Intel and AMD digital certificates .


While we believe CosmicDuke to be an entirely custom- written toolset with no direct sharing of code with other Duke toolsets , the high-level ways in which many of its features have been implemented appear to be shared with other members of the Duke arsenal .


Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before . Hackers used the remote access to detect servers of their interest in the internal network .


The commands received via GCM can not be blocked immediately on an infected device . Armed with this information about the malware and living off the land tactics being used by this group of attackers whom we named Thrip , we broadened our search to see if we could find similar patterns that indicated Thrip had been targeting other organizations . As with previous ShadowPad variants , the Config module ( 102 ) contains an encrypted string pool that can be accessed from any other module . If an adversary can send an unauthorized command message to a control system , then it can instruct the control systems device to perform an action outside the normal bounds of the device 's actions .


220.158.216.127 to gather additional Zebrocy samples as well as a weaponized document .


Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 . Designated as Threat Group 3390 and nicknamed " Emissary Panda " by researchers , the hacking group has compromised victims' networks largely through " watering hole " attacks launched from over 100 compromised legitimate websites , sites picked because they were known to be frequented by those targeted in the attack .


The use of the CARBANAK malware in FIN7 operations also provides limited evidence that these campaigns are linked to previously observed CARBANAK operations leading to fraudulent banking transactions , ATM compromise , and other monetization schemes . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks . In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task .


During one intrusion , the threat actors extensively used this tool to execute WMI commands on remote hosts in the environment .


Also , we found the IP address 185.25.50.93 hosting C2 services for a Delphi backdoor that ESET ’s report states is the final stage payload for these attacks .


The first attack vector is to compromise the out of band authentication for online banks that rely on SMS using SMS forwarding . XBOW 's capabilities are derived from BIFROSE and KIVARS ; Shrouded Crossbow gets its name from its unique mutex format . txt . These restrictions are specified by a list of allowed URIs .


Files of the FLV file format contain a sequence of Tag structures .


Both WERDLOD and OSX_DOK.C targeted financial institutions , with a particular focus on banks in Switzerland .


Callisto Group appears to be intelligence gathering related to European foreign and security policy . In particular , TG-3390 has exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code .


In earlier versions , the something part of the relative path was a partially intelligible , yet random mix of words and short combinations of letters and numbers separated by an underscore , for example , “ bee_bomb ” or “ my_te2_mms ” . Like many threat groups , TG-3390 conducts strategic web compromises ( SWCs ) , also known as watering hole attacks , on websites associated with the target organization 's vertical or demographic to increase the likelihood of finding victims with relevant information . This time , the group explored unpatched systems vulnerable to CVE-2016-8655 and Dirty COW exploit ( CVE-2016-5195 ) as attack vectors . According to the Education Data Initiative , " Public education spending in the United States falls short of global benchmarks and lags behind economic growth . "


Specifically , Lookout determined these were trojanized versions of the apps SR Chat and YeeCall Pro . First , Turla steals emails by forwarding all outgoing emails to the attackers . ZxShell implemented its own version of the Windows B-TOOL S-OS SC command . The second step is simply the same exploit used in the second step of ProxyNotShell , allowing code execution through PowerShell remoting .