However , around a month ago , Rocke started targeting systems that run Jenkins by attempting to exploit CVE-2018-1000861 and CVE-2019-1003000 . A ransomware variant dubbed PyLocky was observed in September 2018 being distributed by a phishing campaign using an invoicing theme .


The updated DealersChoice documents used a similar process to obtain a malicious Flash object from a C2 server , but the inner mechanics of the Flash object contained significant differences in comparison to the original samples we analyzed .


MITRE TAGS Action Tag ID App auto-start at device boot T1402 Input prompt T1411 Capture SMS messages T1412 Application discovery T1418 Capture audio T1429 Location tracking T1430 Access contact list T1432 Access call log T1433 Commonly used port T1436 Standard application layer protocol T1437 Masquerage as legitimate application T1444 Suppress application icon T1508 Capture camera T1512 Screen capture T1513 Foreground persistence T1541 DualToy : New Windows Trojan Sideloads Risky Apps to Android and iOS Devices We started connecting the dots when we discovered that the Okrum backdoor was used to drop a Ketrican backdoor , freshly compiled in 2017 . The group focuses on targeting Korean think tank as well as DPRK/nuclear-related targets .


Svpeng is only currently attacking clients of Russian banks . Turla is a notorious group that has been targeting diplomats . Winnti : hpqhvsei.dll . The messages show that Harrison was hired in March 2010 to help promote Ashley Madison online , but the messages also reveal Harrison was heavily involved in helping to create and cultivate phony female accounts on the service .


Although there are obvious differences between the legitimate file and the malicious one , filtering out the malicious file would involve going through a data set with noise from millions of possible file names , software publishers , and certificates .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel® Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication . The attack wave started in late July 2011 and continued into midSeptember 2011 .


] cc/3 * * * * * 1 ” . The FBI issued a rare bulletin admitting that a group named APT6 hacked into US government computer systems as far back as 2011 and for years stole sensitive data . Once executed , two files were dropped on the targeted system : a decoy document (a picture) and a fake svchost.exe binary .


The email was made to look like as if an investigation report related to Uri terror attack was shared by the MHA official .


In the actual targeted attack detected by the Hungarian National Security Agency , they used components of the TeamViewer tool combined with other malware modules . According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability .


FireEye Labs detects this phishing attack and customers will be protected against the usage of these sites in possible future campaigns . The following examples were developed using a Winnti installer that was used in attacks in December 2016 .


The service continues by loading an ELF , created by Baidu , which is capable of tracking the device location before setting up a monitor to harvest phone numbers associated with outgoing calls for those numbers with a country code “ +86 ” prefix , which relates to the People ’ s Republic of China . Both APT41 and the actors in the CCleaner incident used TeamViewer during initial compromise . APT28 is using novel techniques involving the EternalBlue exploits and the open source tool Responder to spread laterally through networks and likely target travelers .


There is no doubt that BitPaymer ransomware operations are proving successful for Indrik Spider , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan . We assess with high confidence that these operations are distinctly different and independent from the operations performed by DNSpionage , which we reported on in November 2018 .


Most of the strings inside the module are encrypted with a homebrew XOR-based algorithm .


Some IoT devices may even communicate basic telemetry back to the device manufacturer or have means to receive software updates .


MUMMY SPIDER is a criminal entity linked to the core development of the malware most commonly known as Emotet or Geodo . Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


Fake SMS message luring users to enter a fake website , which contains the malicious APK ( JPCERT report ) . Other commodity RAT malware families , such as AdwindRAT and RevengeRAT , were also linked to suspected APT33 domain activity . A second group , which we call GCMAN because the malware is based on code compiled on the GCC compiler , emerged recently using similar techniques to the Metel Group to infect banking institutions and attempt to transfer money to e-currency services .


Also , the software vulnerabilities pointed out in the FOTA software by Strazzere in 2015 could have been taken advantage of by cybercriminals looking to steal bank account details or execute other frauds . INF ﬁles have been used in the past by MuddyWater , although they were launched using Advpack.dll and not IEAdvpack.dll . The actors have also conducted spearphishing .


Two suspicious artifacts have been retrieved from two separate servers within the Die Linke infrastructure .


Zen does n't even check for the root privilege : it just assumes it has it . The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage . Based on our visibility and available data , we only attribute one campaign to the Chinese APT group APT16 . The duration of manipulation may be temporary or longer sustained , depending on operator detection .


Following the trail further , we traced malicious traffic back to where it originated from and looked for additional evidence to indicate that the attacker persistently used the same infrastructure .


This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 .


All of the 4 previously mentioned toolsets were written in a minimalistic style commonly seen with malware ; MiniDuke even goes as far as having many components written in Assembly language .


A complete list of sample hashes is available here . Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server . As part of our monitoring of Iranian threat agents activities , we have detected that since October 2016 and until the end of January 2017 , the Jerusalem Post , as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens .


Interestingly , the command and control server includes a publicly accessible interface to work with the victims : Some of the commands with rough translations : The command-and-control server is running Windows Server 2003 and has been configured for Chinese language : This , together with the logs , is a strong indicator that the attackers are Chinese-speaking . Moreover , they used the same exploit kit Niteris as that in the Corkow case . The Operation Aurora , named by McAfee and announced in January 2010 , and the WikiLeaks document disclosures of 2010 have highlighted the fact that external and internal threats are nearly impossible to prevent .


] comrose-sturat [ . Just like with RedOctober , the top target of Cloud Atlas is Russia , followed closely by Kazakhstan , according to data from the Kaspersky Security Network ( KSN ) . Occasionally , APT1 attackers have installed C2 server components on systems in their hop infrastructure rather than forwarding connections back to C2 servers in Shanghai . All they need to do is deploy and configure the provided phishing kit with an API key .


The GoogleUpdate.exe component is responsible for communicating with the remote C&C server . The oldest sample we've seen up to now is from November 2013 .


Figure 6 . Based on our research , SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans . McAfee Advanced Threat Research analysts have uncovered a global data reconnaissance campaign assaulting a wide number of industries including critical infrastructure , entertainment , finance , health care , and telecommunications .


But I never received such files from their command and control server . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) . Though our visibility of APT1 ’s activities is incomplete , we have analyzed the group ’s intrusions against nearly 150 victims over seven years . While inspecting one of the C&C servers of Miniduke , we have found files that were not related to the C&C code , but seemed to be prepared for infecting visitors using web - based vulnerabilities .


ISMDoor is able to exfiltrate data , take screenshots , and execute arbitrary commands on the victim 's machine . The vast majority of systems communicating with Bookworm C2 servers are within the Bangkok metropolitan LOC where a majority of the government of Thailand exists .


Gaza Cybergang Group 1 , also dubbed MoleRATs : MoleRATs has been active since at least 2012 .


TG-3390 : backup.darkhero.org .


In 2015 and 2016 , GOLD LOWELL frequently exploited JBoss enterprise applications using several versions of this open-source JBoss exploitation tool . Since the last report , PassCV has significantly expanded its targets to include victims in the United States , Taiwan , China and Russia .


Password generation for compressed files takes place client-side with each device using a unique key in most scenarios . Citrix told Threatpost that this is indeed the same password-spraying attack it announced itself last week – but it wouldn't confirm the other details in Resecurity 's post , including the attribution . APT1 also used more generic names referencing topics like software : Most do n’t even do much besides Since the most common allowed domain is google-analytics.com ( 17 K websites )


HenBox masquerades as apps such as VPN and Android system apps and often installs legitimate versions of these apps along with HenBox to trick users into thinking they downloaded the legitimate app . Cisco telemetry confirmed that the actors behind Sea Turtle maintained access to the ICS-Forth network from an operational command and control (C2) node . The agroup targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


Through research , 360 Helios Team has found that , since 2007 , the Poison Ivy Group has carried out 11 years of cyber espionage campaigns against Chinese key units and departments , such as national defense , government , science and technology , education and maritime agencies . The vulnerability is bypassing most mitigations; however , as noted above , FireEye email and network products detect the malicious documents .


So if you have Android 4.4.4 or some more recent version of this OS on your device , your chances of getting infected with Triada are significantly lower . Beginning in August 2016 , a group calling itself the Shadow Brokers began releasing tools it claimed to have originated from the Equation Group . APT34 loosely aligns with public reporting related to the group " OilRig " .


The file is named netwf.dat .


LEAD also steals code-signing certificates to sign its malware in subsequent attacks .


TYPE_VIEW_FOCUSED Represents the event of setting input focus of a View . In many attacks , the group has succeeded in compromising Microsoft Exchange or Lotus Domino email servers in order to intercept company emails and possibly use them to send counterfeit emails . AveMaria : 185.61.138.249 tain.warzonedns.com noreply377.ddns.net 185.162.131.97 91.192.100.62 server.mtcc.me doddyfire.dyndns.org 212.8.240.116 168.167.45.162 toekie.ddns.net warmaha.warzonedns.com . As a result , we decided to call this variant FakeSG .


They should still be on the lookout for these kinds of trojans , as the attackers could target corporate accounts that contain large amounts of money . Since late 2016 , PwC UK and BAE Systems have been assisting victims of a new cyber espionage campaign conducted by APT10 . OceanLotus : a2719f203c3e8dcdcc714dd3c1b60a4cbb5f7d7296dbb88b2a756d85bf0e9c1e Loader #1 . KillNet Appears to Increase Capabilities


Technical Analysis The malware consists of 2 applications : The Dropper : Brain Test ( Unpacked – com.mile.brain , Packed – com.zmhitlte.brain ) This is installed from Google Play and downloads an exploit pack from the server to obtain root access on a device . The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . We observed the deployment and testing of multiple versions of Quasar malware , and the introduction of the bespoke malware families ChChes and RedLeaves .


More likely , this is a case of common attack tools being re-used between different threat actor groups . Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations . The Sofacy threat group continues to target government organizations in the EU , US , and former Soviet states to deliver the Zebrocy tool as a payload .


During this stage of the activation cycle , the malware increases the beaconing time to avoid detection . This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia . Rmcmd : In April , Talos discovered a new ransomware actor , RA Group , conducting double extortion attacks using their ransomware variant based on leaked Babuk source code .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry . Around the same time , WildFire also captured an e-mail containing a Word document ( " hello.docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient .


In 2011 MSK stopped following Daylight Saving Time ( DST ) and was set to UTC+4 year-round , then reset to UTC +3 yearround in 2014 .


In mid-August , the OilRig threat group sent what appeared to be a highly targeted phishing email to a high-ranking office in a Middle Eastern nation . The attacks in that case took place in late September to early October 2016 and the attackers stored the MoonWind samples as RAR files , while in the November attacks the RATs were stored as executables .


The Federal Service for Technical and Export Control ( FTEC ) which is responsible for export control , intellectual property , and protecting confidential information .


Suite 3000 was repeatedly found in each instance .


The regsvr32.exe executable can be used to download a Windows Script Component file (SCT file) by passing the URL of the SCT file as an argument . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) .


Analysis of the additional spyware modules is future work . In addition to using PlugX and Poison Ivy ( PIVY ) , both known to be used by the group , they also used a new Trojan called " ChChes " by the Japan Computer Emergency Response Team Coordination Center ( JPCERT ) . The routine that reads configuration from resources and decompresses the C2 communication library is then called by temporarily replacing the pointer to CComCriticalSection function with the pointer to that routine . Another detection opportunity identified by Mandiant was source IP addresses that access multiple user accounts in a short period of time recorded in the ns.log files or forwarded logs via syslog .


As we saw in both 2016 and 2017 , disruptions to Necurs went hand-in-hand with quiet periods from TA505 .


Code structure Obviously , this code is not obfuscated when compared with the previous version it becomes clear that this is the same code base . Chafer , uses Backdoor.Remexi . These documents were also emailed to organizations in Japan and Taiwan . During C0018 , the threat actors opened a variety of ports , including ports 28035 , 32467 , 41578 , and 46892 , to establish RDP connections.[9 ]


The figure below shows a fragment of encrypted JAR stored in .rodata section of a shared object shipped with the APK as well as the XOR key used for decryption . As a result , it is already flagged as Bahamut by antivirus engines . The architecture of this dropper is different from the others : it starts extracting the main driver from itself . A new report from the Malwarebytes Threat Intelligence team shows 1,900 total ransomware attacks within just four countries — the US , Germany , France , and the UK — in one year .


Recommendations Popular mobile platforms like Android are common targets for organized or commercialized monitoring operations . During intense intelligence gathering over the last 24 months , we observed the technical capabilities of the Operation Cleaver team rapidly evolve faster than any previously observed Iranian effort . The unflattening algorithm requires mapping information between block comparison variable and the actual block number ( mblock_t : :s erial ) In 2009 , the Winnti group shifted to targeting gaming companies in South Korea using a self - named data- and file - stealing malware .


Some of these might have been used on old campaigns or were already prepared for new campaigns . We have observed that in cases where APT10 has infiltrated a target via an MSP , it continues to use the MSPs credentials . The attack took place between June and November 2018 and according to our telemetry , it affected a large number of users . – Consistent with KillNet activity in 2022 , the majority of claimed attacks in 2023 targeted entities in the U.S. and Europe .


This is custom malware , which despite large file size ( 1,1 MB ) , provides limited functionality .


The majority of the overall samples came from the following four sites :


These targets have included organizations such as ministries of foreign affairs , embassies , senates , parliaments , ministries of defense , defense contractors , and think tanks .


They also changed the final Windows payload significantly from the well-known Fallchill malware used in the previous attack .


] com ’ was registered via GoDaddy , and uses privacy protection service . Just last week Lazarus were found stealing millions from ATMs across Asia and Africa . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) .


Table 2 below lists some of these apps with their respective metadata . To witnesses , the spy appears to be running a program showing videos (e.g VLC) , presenting slides (Prezi) , playing a computer game (Breakout2 , 2048) or even running a fake virus scanner . APT17 , also known as DeputyDog , is a China-based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


Report_URL : https://blog-assets.f-secure.com/wp-content/uploads/2020/03/18122307/F-Secure_Dukes_Whitepaper.pdf


Furthermore , we found that in just the first two weeks of 2017 , there have been more than 120 such spyware variants already built using the same SpyNote Trojan builder as SpyNote RAT and roaming in the wild . The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine . The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled .


Moreover , they used the same exploit kit Niteris as that in the Corkow case . In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group Symantec calls Dragonfly ( which Dragos associates with DYMALLOY ) .


The strings inside the binary are encrypted using 3DES and XOR and reversed .


When users try to close the ads , the new functionality causes already downloaded apps to run in a virtual machine . Furthermore , like many other identified Lazarus Group families , these tools showcase the group 's creative solutions , such as the PapaAlfa , which makes it difficult to immediately identify potentially malicious activity on a compromised network . Notestuk ( Backdoor.Notestuk ) ( aka TURNEDUP ) : Malware that can be used to open a backdoor and gather information from a compromised computer . Healthcare has seen increasing email attacks from threat actors for a number of reasons .


The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes . Barium specializes in targeting high value organizations holding sensitive data , by gathering extensive information about their employees through publicly available information and social media , using that information to fashion phishing attacks intended to trickthose employees into compromising their computers and networks .


Most of the network traffic we ’ ve observed is HTTP . Because APT38 is backed by ( and acts on behalf of ) the North Korean regime , we opted to categorize the group as an " APT " instead of a " FIN " . Control flow flattening is an obfuscation method where programs do not cleanly flow from beginning to end . None LIGHTWORK is a disruption tool written in C++ that implements the IEC-104 protocol to modify the state of RTUs over TCP .


] 87:28833 61 [ . The Sofacy group created the Komplex Trojan to use in attack campaigns targeting the OS X operating system – a move that showcases their continued evolution toward multi-platform attacks . The PowerShell script will first create an instance of the .Net Webclient class and then enumerate the available methods using the GetMethods() call ( highlighted in the image in red ) . Considering that both Royal and BlackSuit were active last month , however , a rebrand probably is n’t happening any time soon .


The group had obtained the certificates through pre-attack operations before commencing targeted attacks against a number of government and commercial organizations spread across multiple continents over a two-year period .


Other samples were also noticed , posing as a client of a ticket-finding service or as an app store for Android . Distinct changes to Azazel by the Winnti developers include the addition of a function named ‘Decrypt2’ , which is used to decode an embedded configuration similar to the core implant . This evolution is illustrated across 4 campaigns : one in 2014 , one in 2016 and finally two in 2017 .


It appears that they introduced Shifu after high-profile law enforcement actions impacted Dridex distribution .


These additional samples behaved similarly to the initial files ;


Next , the dropper checks its own parent process for indications that it is running in a sandbox setup . We have also seen Magic Hound using DropIt as a binder , specifically dropping a legitimate decoy executable along with the malicious executable onto the target host . Winnti : T1032 Standard Cryptographic Protocol ( RC4 , RC5 ) . title : MicroSCADA SCILC Command Execution description : Identification of Events or Host Commands that are related to the MicroSCADA SCILC programming language and specifically command execution author : Mandiant date : 2023/02/27 logsource : product : windows service : security detection : selection : NewProcessName|endswith : - \scilc.exe CommandLine|contains : -


When specific versions are discovered that may cause issues for the RAT , it promptly exits .


The loader Trojan uses this batch file to run the embedded DLL payload .


Currently , this only affects Russian banks , but the technology behind Svpeng could easily be used to target other banking applications . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including embassies . The primary attack vectors are watering-hole , spear phishing , and other web-based attacks . KillMilk continues to be a central coordinator for the KillNet Collective , despite claims of leaving the group in mid-2022 .


After reestablishing access , the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used .


PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts . The NetTraveler trojan has been known to be used in targeted cyber espionage attacks for more than a decade by nation state threat actors and continues to be used to target its victims and exfiltrate data .


This intelligence has been critical to protecting and informing our clients , exposing this threat , and strengthening our confidence in attributing APT28 to the Russian Government .


The ActionScript will read each byte of the C2 response and get the hexadecimal value .


We found no similarities to commercial spyware products or to other known spyware variants , which suggests BusyGasper is self-developed and used by a single threat actor . Because of this , additional HIDDEN COBRA malware may be present on systems compromised with FALLCHILL . Activity ceased until the attackers returned on March 5 and were observed using Quasar RAT to download a second custom AutoIt FTP Exfiltration tool known as FastUploader from http://192.119.15.36:880/ftp.exe . Techniques include reading SAM and LSA secrets from registries , dumping NTLM hashes , plaintext credentials , and Kerberos keys , as well as dumping the NTDS.dit Active Directory database .


This code modification marks an unusual departure from the typical AZZY backdoors , with its C&C communication functions moved to an external DLL file .


A TrickMo version from January 2020 contained code that checks if the app is running on a rooted device or an emulator to prevent analysis . According to Wikipedia , the CSS was formed in 1972 to integrate the NSA and the Service Cryptologic Elements ( SCE ) of the U.S armed forces . In addition to Helminth , the ISMDoor implant is likely used by the Iran-based adversary to attack targets particularly those in the Middle East region .


This investigation shows multiple similarities to previous attacks attributed to a group called MoleRATs ( aka The Gaza Cybergang ) , an Arabic-speaking , politically motivated group that has operated in the Middle East since 2012 .


The malware then builds two DLLs in memory – they are 32 and 64-bit DLLs that have identical functionality . 360 and Tuisec already identified some Gorgon Group members .


The “ idXXXXX.top ” pattern immediately stands out and may suggest a pattern in the static configuration for the initial domains used by the DGA for Nymaim since the previous two started with “ ejX.com .


cfd77ddc5c1ebb8498c899a68ea75d2616c1c92a0e618113d7c9e5fcc650094b Flash Player com.gzhlubw.pmevdiexmn 3f2ed928789c200e21fd0c2095619a346f75d84f76f1e54a8b3153385850ea63 Target list The actual observed list of mobile apps targeted by Cerberus contains a total of 30 unique applications . The SectorJ04 group has shown a pattern of hacking activities that have changed from targeted attacks to a large-scale distribution of spam . Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data Exfiltration and to provide remote access to infected machines .


Kaspersky Internet Security for Android detects all three of Triada ’ s modules , so it can save your money from cybercriminals that are behind Triada . We believe the groups moved to use CVE-2018-0798 instead of the other Microsoft Equation Editor Remote Code Execution (RCE) vulnerabilities because the former is more reliable as it works on all known versions of Equation Editor . During the past few months , APT34 has been able to quickly incorporate exploits for at least two publicly vulnerabilities ( CVE-2017-0199 and CVE-2017-11882 ) to target organizations in the Middle East .


FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware or as a file downloaded unknowingly by users when visiting sites compromised by HIDDEN COBRA actors . Unit 42 does not have detailed targeting information for all known Bookworm samples , but we are aware of attempted attacks on at least two branches of government in Thailand .


The red fields are used as the shortcode and keyword for SMS billing . Curiously , Bahamut appears to track password attempts in response to failed phishing attempts or to provoke the target to provide more passwords . In our analysed sample the “ Loveusd.sys ” driver is installed with the name “ USBHPMS ” . In some cases , the threat actors may have been using compromised organizations to gain access to other victims in supplychaintype attacks .


CTU researchers have not observed TG-4127 use this technique ( using Bitly short links ) to target the U.S. Republican party or the other U.S. presidential candidates whose campaigns were active between mid-March and mid-May : Donald Trump , Bernie Sanders , Ted Cruz , Marco Rubio , and John Kasich .


The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer .


It was executed from the Telegram messenger download folder :


By adding the previously calculated offset , it can get the address of the mmap function in the target process memory . The main reason for the increase in Potao detections in 2014 and 2015 were infections through USB drives . APT17 : de56eb5046e518e266e67585afa34612 . These new infection vectors rely on Java and IE vulnerabilities to infect the victim ’s PC .


In this blog , we ’ ll detail the innovative ways in which this ransomware surfaces its ransom note using Android features we haven ’ t seen leveraged by malware before , as well as incorporating an open-source machine learning module designed for context-aware cropping of its ransom note . Unit 42 researchers have been tracking an active campaign . . The IP range for “ PIG GOD ” is 43[.]255[.]188.0/22 , which appears to be hosted in Hong Kong as seen in the information we found : The domain 66[.]to leads to another website that shows Hack520 ’s pet pig .


This shows how the attackers use this backdoor in a surgical way to exclusively attack specific targets .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address .


Both of these infection vectors are highly indiscriminate and untargeted when compared to spearphishing , the usual infection vector of choice for the Dukes .


VERSIONING Bread has also leveraged an abuse tactic unique to app stores : versioning . Barium Defendants install the malicious " Win32/Barlaiy " malware and the malicious " Win32/PlugX.L " malware on victim computers using the means described above . We used the ZxShell package for version 3.10 ( SHA256 : 1622460afbc8a255141256cb77af61c670ec21291df8fe0989c37852b59422b4 ).The convenient thing about this is that the CNC panel worked with any version , 3.10 and above . Lowcode automation of processes can make the required actions fast , reliable , and repeatable .


Using this artifact , we were able to pivot and discover another attack campaign using the DealersChoice exploit kit with similar victimology to what we saw in February .


It considers the age of the file , its global prevalence , and the presence and validity of a digital signature along with the method of service creation .


It was late 2018 when Riltok climbed onto the international stage . Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits . The decoy document of the 2 last campaigns suggests that the targets are public organisations .


This file requires the target to attempt to open the .lnk file , which redirects the user to a Windows Scripting Component ( .wsc ) file , hosted on an adversary-controlled microblogging page . Last week we discussed Numbered Panda , a group that is also based out of China and is fairly well known to the security community , though by many names .


Never click on unknown links received through ads , SMS messages , emails , or the like . Furthermore , from 2015 to 2019 , we detected new versions of known malware families attributed to the Ke3chang group – BS2005 backdoors from operation Ke3chang and the RoyalDNS malware , reported by NCC Group in 2018 . Group7 : APT15 , Mirage , Vixen Panda , GREF , Playful Dragon , RoyalAPT .


The new one with the title " Coralco Archimedes , '' and an older version with the title " Wolf Intelligence : '' New panel Old panel The new panel name contains " Coralco '' in its name . In February 2015 , Kaspersky Lab 's Global Research and Analysis Team ( GReAT ) released its research into the Carbanak campaign targeting financial institutions . Some samples alternatively use an FGKD.jsp or an FPK.jsp file . Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected .


The threat actors are adept at identifying key data stores and selectively exfiltrating all of the high-value information associated with their goal .


The Spark backdoor communicates with the C2 servers over the HTTP protocol .


Discovery T1418 Application Discovery Sends list of installed apps on device . Aside from the attack involving Crambus infrastructure , this sample of Mimikatz has only been seen used in one other attack , against an education target in the UK in 2017 . The Advanced Threat Research team uncovered activity related to this campaign in March 2018 , when the actors targeted Turkish banks .


Screenshots : captures an image of the current screen via the raw frame buffer . The current campaign is a sharp escalation of detected activity since summer 2017 . Winnti : 44260a1d 2018-08-15 10:59:09 https://dump.gxxservice.com/common/up/up_base.php . The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier .


A full description of this zero-day attack can be found in this blog post by Kaspersky Lab 's Vyacheslav Zakorzhevsky . This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies .


But the categories targeted by this group seem to be broadening with the inclusion of VPN software . In one instance , APT37 weaponized a video downloader application with KARAE malware that was indiscriminately distributed to South Korean victims through torrent websites . After that, it checks if the iterator divided by (captureScreenTimeOut/captureActiveWindowTimeOut) has a remainder of . We propose to reach an agreement and conclude a deal .


Users are cautioned to research and check reviews before they download apps . Starting in February 2018 , Unit 42 identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States . The following changes are minor compared with above referenced ones . For connections that occur internally within an enclave ( such as those between a proxy or pivot node and other nodes ) , commonly used protocols are SMB , SSH , or RDP .


Initiating the MQTT client . Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 . This malware has previously been associated with an APT actor that Symantec calls Chafer . In todays world of evolving malware , there are likely a lot of threats antivirus does nt know about .


Seemingly random activity patterns in infrastructure deployment and usage , along with the ability to use a wide variety of geographically diverse infrastructure , help the threat actors avoid detection .


These particular detections are interesting because they indicate an attempted selective 2nd stage deployment of a backdoor maintaining filestealer , keylogger , and remoteshell functionality to a system of interest .


By doing so , attackers can easily set up the Trojan to communicate back to them without any need for high-end servers . And the dropper execute the iassvcs.exe to make a side loading and make the persistence . OilRig : IRN2 , HELIX KITTEN , APT34 .


They continue to be persistent in their attack campaigns and continue to use similar tooling as in the past .


C2 servers are shared by multiple samples . The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 . The macro contains a virtual machine detection technique based on the serial number of the disks available in the victim environment . This is consistent with the group ’s prior activity scanning and exploiting internet facing servers for initial access .


One of the tools seen above that caught our interest was the Dumpert tool , which is freely available on Outflanknl ’s GitHub repository .


EventBot is under active development and is evolving rapidly ; new versions are released every few days with improvements and new capabilities . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups . iDefense assesses with high confidence that this campaign is associated with the threat group DRAGONFISH ( also known as Lotus Blossom and Spring Dragon ) .


Communication with the C & C In order to communicate with its C & C , the app uses the MQTT ( Message Queuing Telemetry Transport ) protocol , which is transported over TCP port 1883 . However , over the past few years , we have been tracking a separate , less widely known suspected Iranian group with potential destructive capabilities , whom we call APT33 . The attackers were using an improved version of Remexi in what the victimology suggests might be a domestic cyber-espionage . Once the malware is dropped and executed through the lure documents , the Foudre backdoor connects to the HTTP commandandcontrol C2 server and downloads a selfextracting archive with fullfeatured Tonnerre malware .


To spread through the hospitality company ’s network , APT28 used a version of the EternalBlue SMB exploit .


AutoFocus customers can track these samples with the Zebrocy and Cannon WildFire detects the delivery documents , Zebrocy and Cannon payloads discussed in this blog with malicious verdicts .


Scarlet Mimic has carried out attacks using both spear-phishing and watering holes since at least 2009 with increasingly advanced malware , and has deployed malware to attack multiple operating systems and platforms . In the case of this malware , the activity groups strongly associated with Winnti are BARIUM and LEAD .


Some of the icons used can be seen below . According to reports , the Philippines is the most exposed country in ASEAN to the cyberattacks known as advanced persistent threats , or APTs . FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran , use of Iranian infrastructure , and targeting that aligns with nation-state interests .


Most recently these included PDF attachments with embedded Microsoft Word documents bearing malicious macros that call PowerShell commands that install Dridex .


Strings ( c2 domains and functionality , error messages , etc ) are custom encrypted per deployment .


The first anti-sandbox technique is the loader checking the code segment . To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys . Winnti : T1022 Data Encrypted . Another finding in the activity of ' Sharpshooter ' were a set of unobfuscated connections from IP addresses in Windhoek , a city in Namibia , Africa .


But devices sold outside of Amazon " might not have ever seen fixes , '' he says . However , Beginning on 25 June 2019 , we started observing multiple commodity campaigns Mostly dropping AsyncRAT using the updated RTF weaponizer with the same exploit (CVE-2018-0798) . C2 : lywja.healthsvsolu.com .


It is not common to use this program to distribute malware , although there have been past cases where malware authors have done so . If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign .


Alternatively , OurMine might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address . However , some phishing emails were sent to bank employees in more than 25 countries of Central and Western Europe , Africa and Asia including : Kyrgyzstan , Armenia , Georgia , Serbia , Germany , Latvia , Czech Republic , Romania , Kenya , Israel , Cyprus , Greece , Turkey , Taiwan , Malaysia , Switzerland , Vietnam , Austria , Uzbekistan , Great Britain , Hong Kong , and others .


Pivoting off of this artifact provided us additional Zebrocy samples .


As MainService is the main controller , the developer has taken the appropriate actions to keep it functional and running at all times . Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability . An expansion into Linux tooling indicates iteration outside of their traditional comfort zone .


APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . The witnessed techniques , tactics and procedures ( TTPs ) are in-line with what we usuallysee in Turla 's operation : a first stage backdoor , such as Skipper , likely delivered through spearphishing followed by the appearance on the compromised system of a second stage backdoor , Gazerin this case .


] com webmail [ . For example , we have observed frequent reuse of older ( patched ) exploits in malware operations against the Tibetan community . But , larger , more successful threat actors tend to evolve at a slower rate . This shorcut uses the WebDav HTTP protocol extension to retrieve the file launcher-upd.hta from a remote server : This heavily obfuscated script is responsible for the execution of PowerShell that downloads the final malware payload ( NetSupport RAT ) .


Below are descriptions of some of the most interesting . AA triggered an alert at a large telecoms operator in Southeast Asia . As usual , all the module timestamps are spread over a short time range , which could suggest the use of a build framework to compile these modules . Currently , Mandiant has observed the deployment of Atera , AnyDesk , and SplashTop to establish and maintain a foothold following exploitation of CVE-2023 - 4966 .


In its analysis , CSIS notes that MazarBOT was reported by Recorded Future last November as being actively sold in Russian underground forums and intriguingly , the malware will not activate on Android devices configured with Russian language settings . Its activity subsequently increased in the second quarter of 2018 , with a particular spike in April 2018 . Other additional modifications were made to the code ( e.g , writing a new algorithm for finding control flow dispatcher and first block , In the past , we have seen such occurrences with Magecart threat actors for example in the breach of the Umbro website .


CrowdStrike® Falcon® Intelligence™ also observed a strong correlation between Dridex infections and BitPaymer ransomware . Afterwards , the installer malware creates a downloader and a configuration file from its resource and executes it .


The reasons for this are unknown , but , we could suggest that they did not want to utilize any exploits to ensure they remained viable for any other operations .


Depending on the settings read from the configuration file , the scope may be narrowed to files with particular extensions and/or files created after a specified date .


To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer . Finally , some of the victims are also infected with other Turla-related malware such as ComRAT or Gazer .


Symantec monitors for this type of activity to help prevent organizations from being tied to malicious actions undertaken with their stolen certificates .


The compilation timestamp therefore had to have been faked .


Falcon Intelligence has had unique insight into the email dialogue between a victim and an INDRIK SPIDER operator . The other one , " Operation Erebus " employs an older exploit , for CVE-2016-4117 and leverages watering holes .


The second file , happiness.txt , contains custom code in binary format that is encrypted and used by xxxx.exe .


The information given dates back to 2011 and nothing else has been published since . FireEye believes that two actors – Turla and an unknown financially motivated actor – were using the first EPS zero-day CVE-2017-0261 , and APT28 was using the second EPS zero-day CVE-2017-0262 along with a new Escalation of Privilege (EOP) zero-day CVE-2017-0263 .


The PLATINUM tool is , to our knowledge , the first malware sample observed to misuse chipset features in this way . The attacks were traced back to a computer system that was a virtual private server ( VPS ) located in the United States .


This is a PowerShell script that downloads and runs the ZeroT payload cgi.exe .


PLATINUM often spear phishes its targets at their non-official or private email accounts , to use as a stepping stone into the intended organization 's network . Unit 42 's analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan .


Stealing and Concealing SMS Messages As some banks still use SMS-based transaction authorization , TrickMo is configured to automatically steal all SMS messages that are stored on the device . Like many such groups , PLATINUM seeks to steal sensitive intellectual property related to government interests , but its range of preferred targets is consistently limited to specific governmental organizations , defense institutes , intelligence agencies , diplomatic institutions , and telecommunication providers in South and Southeast Asia . During the past month , Unit 42 observed several attacks against a Middle Eastern government leveraging an updated version of the BONDUPDATER malware , which now includes the ability to use TXT records within its DNS tunneling protocol for its C2 communications .


If the targeted device is not vulnerable to these exploits , then the app attempts to use a superuser binary pre-positioned at /system/csk to elevate privileges . The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period . A semicolon-separated list of executable filenames . COSMICENERGY is the latest example of specialized OT malware capable of causing cyber physical impacts , which are rarely discovered or disclosed .


The same event interception is used to place the webview overlay when the user tries to access the targeted applications , allowing it to display its overlay , thus intercepting the credentials . In addition to DustySky , the attackers use publicly available tools such as the following Remote Administration Tools ( RAT ) : Poison Ivy , Nano Core , XtremeRAT , DarkComet and Spy-Net . In addition , we discovered the group using Derusbi , which is a malware family believed to be unique to a small subset of Chinese cyber espionage groups . A month later , GReAT discovered two more previously unknown infection mechanisms for MiniDuke , which relied on Java and Internet Explorer vulnerabilities to infect the victim ’s PC .


After we blocked those samples , they moved a significant portion of malicious functionality into the native library , which resulted in a rather peculiar back and forth between Dalvik and native code : COMMAND & CONTROL Dynamic Shortcodes & Content Early versions of Bread utilized a basic command and control infrastructure to dynamically deliver content and retrieve billing details . Our initial observation of the Bahamut group originated from in-the-wild attempts to deceive targets into providing account passwords through impersonation of platform providers . It adds the SeLoadDriver privilege to its access token and proceeds to install the driver as a fake disk filter driver . In its spear phish , CloudLook also used a self - extracting archive containing a PDF file that lured its victims with information regarding world terrorism .


This reconnaissance malware has been used by Group 74 for years and it is composed of 2 files : a dropper and a payload .


Since at least 2007 , APT28 has engaged in extensive operations in support of Russian strategic interests .


Researching the domain go-microstf.com , hosted at 45.63.10.99 , revealed yet another iteration of malicious executables .


This backdoor first emerged in January 2019 and has been continuously active since then .


In this context , there is indeed no need to execute the stage 4 malware . The campaigns delivered PupyRAT , an open-source cross-platform remote access trojan ( RAT ) . The main differences are : The social media platform says it tied the groups malware samples to a specific Iranianbased IT contractor called Mahak Rayan Afraz , which has previously provided malware to the IRGC , indicating a link between the Tortoiseshell group and the Iranian government .


The RC4 key is hardcoded in EventBot . Unlike earlier attacks when Bemstour was delivered using Buckeye's Pirpi backdoor , in this attack Bemstour was delivered to the victim by a different backdoor Trojan (Backdoor.Filensfer) . The Magic Hound campaign used Word and Excel documents containing malicious macros as a delivery method , specifically attempting to load MagicHound.Rollover .


Falcon Intelligence has observed MYTHIC LEOPARD using this technique for several years to install multiple first-stage implants and downloaders , including the isqlmanager and Waizsar RAT malware families . PLATINUM has used several zero-day exploits against their victims .


If the value does not match , the app skips the “ disclosure ” page and billing process and brings the user straight to the app content . In the 2017 ShadowPad attack , the update mechanism for Korean server management software provider NetSarang was compromised to serve up an eponymous backdoor . ObReferenceObjectByHandle is a Kernel routine designed to validate a target object and return the pointer to its object body ( and even its handle information ) , starting from the object handle ( even the user-mode one ) . An example of these log entries can be found below : By correlating the user , IP address and GUID from the Remote PowerShell HTTP logs to the Exchange frontend , CrowdStrike found a request using the mailbox to the following OWA URL , , corresponding to the IIS log entry below : The backend request for the new exploitation chain is similar to the example shown below : This request seemed to show a novel , previously undocumented , way to reach the PowerShell remoting service through the OWA frontend endpoint , instead of leveraging the endpoint .


The dates on the “ x ” axis show the dates when we first saw these apps in the wild . Recent investigations by FireEye 's Mandiant incident response consultants combined with FireEye iSIGHT Threat Intelligence analysis have given us a more complete picture of a suspected Iranian threat group , that we believe has been operating since at least 2014 . The more recent document is from mid-January and alleged to be from a United Arab Emirate organization . Babuk , a Russian ransomware group that emerged in 2021 , has conducted a series of high - profile ransomware attacks across various industries , including government , healthcare , logistics , and professional services .


The Sofacy group uses such tools as well .


Rather than being written to disk as individual script files , the PowerShell payloads were stored in the registry .


In the past , XLoader showed the ability to mine cryptocurrency on PCs and perform account phishing on iOS devices . FireEye analysts documented the admin@338 group 's activities in a previous paper titled Poison Ivy : Assessing Damage and Extracting Intelligence paper . Our first post about analyzing malware with DNS tunneling capabilities focuses on how the PoisonFrog malware uses DNS tunneling to send and receive victim information and commands . If this is a potential threat vector for the organization , dual controls need to be put in place .


The output in Figure 3 shows the Process ID ( PID ) of the csrss.exe process to be 716 .


COZY BEAR ( also referred to in some industry reports as CozyDuke or APT 29 ) is the adversary group that last year successfully infiltrated the unclassified networks of the White House , State Department , and US Joint Chiefs of Staff .


The desktop components of this attack , previously discovered by Palo Alto Network , are known as KasperAgent and Micropsia . Attackers went on to use the Trojan to steal $4 million from 24 banks , including 22 in the United States and two in Canada , in just two weeks . However , the first compile time35 we have for WEBC2 is 2004-01-23 , suggesting that APT1 has been crafting WEBC2 backdoors since early 2004 . The samples we have observed seemed not to be malware targeted for the game fans but a malware module which accidentally got into [ the ] wrong place .


Backdoor.SofacyX ( also known as X-Agent ) is a second stage piece of malware , capable of stealing information from the infected computer .


Although Downeks has been publicly examined to some extent , our analysis found several features not previously described .


JUNE AND SEPTEMBER 2014 , APT28 employed “ Sedkit ” in conjunction with strategic web compromises to deliver “ Sofacy ” malware on Polish Government websites , and the websites of Polish energy company Power Exchange .


The threat actors work to overcome existing security controls , or those put in place during an engagement , to complete their mission of exfiltrating intellectual property .


Cannon acknowledges the receipt of file path by sending an email to sahro.bella7@post.cz with s.txt ( contains {SysPar = 65} string ) as the attachment , ok3 within the body and a subject with the unique system identifier via SMTPS from one of the three accounts from Step 1 .


The target is encouraged to download an archive file in a rar or zip format that contains an executable file masquerading as a Microsoft Word document .


FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform . Figure 9a , below , shows detections of encounters with the Barium actors and their infrastructure , including infected computers located in Virginia , and Figure 9b , below , shows detections of encounters throughout the United States .


This will be the trigger for the service to start the beaconing . In September 2018 , we found evidence of Seedworm and the espionage group APT28 ( aka Swallowtail , Fancy Bear ) , on a computer within the Brazil-based embassy of an oil-producing nation . DDKONG Plugin : SHA256 : 0EB1D6541688B5C87F620E76219EC5DB8A6F05732E028A9EC36195D7B4F5E707 . There is high turnover of staff , especially in entrylevel positions , which makes it difficult to ensure all staff have cybersecurity training .


While it ’s possible that this is a coincidence , the rest of the evidence makes it unlikely for these two malware to target the same organizations by chance .


The CrowdStrike has been tracking this particular unit since 2012 , under the codename PUTTER PANDA , and has documented activity dating back to 2007 . In March 2014 , the gang behind Potao started using a new infection vector .


It collects information about the smartphone ( IMEI , country , service provider , operating system language ) and sends it to the host via the HTTP POST request . Turla is a notorious group that has been targeting government officials . The IoCs are also available in our GitHub repository . Other big stories in June include a suspected LockBit affiliate arrest , the Royal ransomware gang toying with a new encryptor , and a notable increase in attacks on the Manufacturing sector .


Figure 1 shows a sample phishing email used by HawkEye operators in this latest campaign . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


Giving an attacker access to a mobile device can have severe business consequences , especially if the end user is using their mobile device to discuss sensitive business topics or access enterprise financial information . In July of 2015 , we identified a full e-mail uploaded to an antivirus scanning service that carried a Scarlet Mimic exploit document . This report is an initial public release of research PwC UK and BAE Systems have conducted into new , sustained global campaigns by an established threat actor against managed IT service providers and their clients as well as several directly targeted organisations in Japan .


In the following image , we can see how the malware receives a JSON object from the C & C server containing the command to start recording , the targeted apps and the recorded video size ratio . Georgian military security issues , particularly with regard to U.S. cooperation and NATO , provide a strong incentive for Russian state-sponsored threat actors to steal information that sheds light on these topics . Another such an exceptional espionage platform is " ProjectSauron , also known as " Strider " .


We believe that this is the reason the DEFENSOR ID trojan requests the user to allow “ Modify system settings ” . In the campaign that targeted Japan , Philippines , and Argentina on June 20 , we found what seems to be a new , undisclosed malware , which we named Gelup . The Lazarus Group 's objective was to gain access to the target 's environment and obtain key military program insight or steal money .


Similar to other malware seen in the past , Charger checks the local settings of the device and does not run its malicious logic if the device is located in Ukraine , Russia , or Belarus . In two months , the group returned to their proven method and withdrew funds again through ATMs . During the investigation into FIN7 , our threat-hunting systems found an interesting overlap in between the infrastructure of FIN7 and AveMaria . It even can restrict forms to be sent only to specific hosts , using the form - action directive .


It encodes strings into binary arrays , making it hard to inspect them . We conclude that the actor behind the attack is Silence group , a relatively new threat actor that's been operating since mid-2016 . Thirty percent of the targets were small and medium-sized companies that were suppliers or service providers for bigger players and 21% were various types of manufacturing companies . Looking at the top 3 M domains , only 210 K use CSP .


Since then , the number and diversity of components has increased drastically .


TG-3390 actors frequently change the C2 domain's A record to point to the loopback IP address 127.0.0.1 , which is a variation of a technique known as " parking " .


The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 . The RAT , however , had a multitude of functionalities (as listed in the table below) such as to download and execute , compress , encrypt , upload , search directories , etc .


The end of January 2015 saw the start of the most high- volume Duke campaign seen thus far , with thousands of recipients being sent spear-phishing emails that contained links to compromised websites hosting CozyDuke .


Figure 2 below shows how the delivery document initially looks and the transformation the content undergoes as the macro runs .


The FBI has publicly attributed this activity to a nation-state actor and took subsequent actions to disrupt this botnet , although the devices would remain vulnerable to re-infection unless proper firmware or security controls were put in place by the user .


This command can be used not just to update the app but to install any other software on the infected device . Their next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting , again attempting to extract all Word documents . As of early June 2018 , the server hosted 112 files in a subdirectory that could be accessed through a public web shell planted by the Leafminer .


One of the tell-tale signs of an obfuscated malware is the absence of code that defines the classes declared in the manifest file . During our period of visibility into the BS2005 " moviestar " campaign against various ministries of foreign affairs in Europe , FireEye discovered that the Ke3chang had initially tested the malware in virtual machines , prior to compromising actual targets . We spotted a courier themed spam campaign on our Secure Email Gateway (SEG ) cloud . After further research , we were able to link Hack520 to different network administration activities , notably with a Virtual Private Server ( VPS ) hosting service .


] it Firenze server2mi.exodus.connexxa [ . Dragos identified several compromises of ICS vendors and manufacturers in 2018 by activity associated with XENOTIME , providing potential supply chain threat opportunities and vendor-enabled access to asset owner and operator ICS networks . URL : http://nicoledotson.icu/debby/weatherford/Ekspertyza . Once they successfully breached a network , MuddyWater attempted to steal credentials and move laterally .


We believe that during the spring of 2010 , the credential and file stealing capabilities of PinchDuke were slowly ported to CosmicDuke , effectively making PinchDuke obsolete .


PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file . Bookworm 's functional code is radically different from PlugX and has a rather unique modular architecture that warranted additional analysis by Unit 42 .


The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware . Previously , Cloud Atlas dropped its validator” implant named PowerShower” directly , after exploiting the Microsoft Equation vulnerability CVE-2017-11882 mixed with CVE-2018-0802 .


Yes , we are talking about SuperMarioRun , which was recently launched by Nintendo only for iOS users . A BASF spokeswoman tells us in an email that in July 2015 , hackers had successfully overcome the rst levels” of defense . Rather , the Gallmaker 's attack activity we observed is carried out exclusively using LotL tactics and publicly available hack tools .


Although something had already been published , we decided to do something different with the data we acquired . On April 24 , 2019 , Fxmsp claimed to have secured access to three leading antivirus companies . This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams . We will continue to monitor these campaigns and in particular SocGholish to see if the web delivery landscape changes .


We believe that an industry-wide collaboration and information-sharing is important in defending customers against this complex piece of malware . In 2011 , three years after the most recent release of PIVY , attackers used the RAT to compromise security firm RSA and steal data about its SecureID authentication system . While we are still in the process of analyzing this backdoor’s full functionality , it seems to be similar to the Remy backdoor described in our previous whitepaper on OceanLotus malware . The group behind the Winnti malware ( which we will call the Winnti group for brevity ) sprung up as a band of traditional cyber crooks , comprising black hats whose technical skills were employed to perpetrate financial fraud .


Orangeworm 's secondary targets include Manufacturing , Information Technology , Agriculture , and Logistics . We chose the name ' MoonWind ' based on debugging strings we saw within the samples , as well as the compiler used to generate the samples .


APT32 actors continue to deliver the malicious attachments via spear-phishing emails . This focus on training aligns with LYCEUM’s targeting of executives , HR staff , and IT personnel .


Since then we have identified a number of attacks over a two-year period , beginning in April 2014 , which we attribute to Suckfly .


As a result of a lot of hard work done by our security research teams , we revealed today a new and alarming malware campaign . APT38 's operations began in February 2014 and were likely influenced by financial sanctions enacted in March 2013 that blocked bulk cash transfers and restricted North Korea 's access to international banking systems . Rolles also provides an overview of each obfuscation technique in the same post . Hildegard has used an IRC channel for C2 communications.[6 ]


In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 . CVE-2018-0798 is an RCE vulnerability , a stack buffer overflow that can be exploited by a threat actor to perform stack corruption .


BRONZE PRESIDENT Targets NGOs .


Call Command Figure 9 : The calling functionality . CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 . Threat Group-3390 is a Chinese threat group that extensively used strategic Web compromises to target victims .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . The detection evasion techniques we observed in the Okrum malware include embedding the malicious payload within a legitimate PNG image , employing several anti-emulation and anti-sandbox tricks , as well as making frequent changes in implementation .


] 175 [ . On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " to APT33 , operating at the behest of the Iranian government . Mechanisms vary for different OS . How to locate where stack strings are decoded Every Block of stack strings ends with followed by a .


Enable a secure lock screen : Pick a PIN , pattern , or password that is easy for you to remember and hard for others to guess . This means that the Leafminer group is targeting electric utilities . The embedded payload data has a specific structure , that is parsed by the added unpacking code . Rhysida ’s encryption algorithm is relatively straightforward and uses the ChaCha20 encryption algorithm .


That is actually how the bad guys decided to monetize the Trojan . Researchers at Kaspersky Lab privately disclosed the flaw to Adobe after exploits against the zero-day were used in March by the ScarCruft APT gang in what Kaspersky Lab is calling Operation Daybreak . The two variants of Helminth do require different delivery methods , with the script variant relying on an Excel spreadsheet for delivery , while the executable variant is more traditional in the fact that it can be installed without a delivery document .


The Trojan displays a phishing page ( bank.html ) prompting the user to enter their bank card details . We identified an overlap in the domain voguextra.com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post . This means that the Leafminer group is targeting electric utilities .


Throughout the final quarter of 2016 and first month of 2017 , FireEye Dynamic Threat Intelligence (DTI) observed consistent Magnitude EK hits from several customers , the majority of whom reside in the APAC region . Per the complaint , the email account watsonhenny@gmail.com was used to send LinkedIn invitations to employees of a bank later targeted by APT38 .


The path that is used for the uploads is : http : // /apps/d/p/op.php The communication looks like this : First Phase The first phase of the app ’ s attack flow collects device information and a list of apps installed on the device . We assess the targeting of multiple companies with aviation-related partnerships to Saudi Arabia indicates that APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia . This blogpost is based in our original report shared with our APT Intelligence Reporting customers last November 2018 . That 's because a new ransomware called BlackSuit had appeared which shared 98 percent of its code with the infamous Royal ransomware .


The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 . Once BARIUM has established rapport , they spear-phish the victim using a variety of unsophisticated malware installation vectors , including malicious shortcut ( .lnk ) files with hidden payloads , compiled HTML help ( .chm ) files , or Microsoft Office documents containing macros or exploits .


NetWire , DarkComet , NanoCore , LuminosityLink , Remcos and Imminent Monitor are all designed to provide remote access to compromised systems . Given our increased confidence that Bahamut was responsible for targeting of Qatari labor rights advocates and its focus on the foreign policy institutions other Gulf states , Bahamut 's interests are seemingly too expansive to be limited one sponsor or customer .


In one case from 2013 , the target was sent a malicious document through a spear phishing email message . The group 's spearphish toolset includes PDF exploits , Adobe Flash Player exploits , and the common CVE-2012-0158 Word exploits including those generated from the infamous " Tran Duy Linh " kit .


Error Registration Ok Empty SendSMS RequestGoogleCC Wipe OpenBrowser SendUSSD RequestSMSList RequestAppList RequestLocation ShowNotification SetLockPassword LockNow MuteSound LoadScript LoadPlugin ServerChange StartApp CallPhone SetPingTimer SMSBroadcast RequestContacts AddInject RemoveInject Evaluate Another feature of this trojan is the ability to register injects , which are JavaScript snippets of code . In May 2019 , the threat group launched a campaign against oil and gas organizations in the Middle East . Based on observed activity , we judge that APT38 's primary mission is targeting financial institutions and manipulating inter-bank financial systems to raise large sums of money for the North Korean regime .


The group also uses the SQL injection (SQLi) tools Havij Advanced SQL Injection Tool and SQLi Dumper version 7.0 (Figure 4) to scan for and exploit vulnerabilities in targeted eCommerce sites . It was during operator X 's network monitoring that the attackers placed Naikon proxies within the countries ' borders , to cloak and support real-time outbound connections and data Exfiltration from high-profile victim organizations .


This technique bypasses AppLocker restrictions and permits the execution of code within the SCT file .


This tool has been used by several Chinese-affiliated threat actors , such as APT 27 and APT 40 . Clever Kitten actors have a strong affinity for PHP server-side attacks to make access ; this is relatively unique amongst targeted attackers who often favor targeting a specific individual at a specific organization using social engineering .


The GolfSpy malware embedded in the apps is hardcoded with an internal name used by the attacker . Nevertheless , resourceful threat actors such as ScarCruft will probably continue to deploy zero-day exploits against their high profile targets . The second one , which in many cases is an Office document protected with a trivial password , such as “ 12345 ” , “ 1234 ” , etc. , uses macros to execute a GRIFFON implant on the target’s computer . Whether known as commodity malware or “ as - a - service , ” threat actors have long been turning to their fellow adversaries in the hopes of selling off their tools and opening a new stream of revenue .


This connection suggests that the group uses phishing emails with ZIP attachments that contain LNK files as an initial access vector .


We decided to spend some time to investigate around this malware and found out that it was used exclusively by a single group of attackers . Myanmar has been the target of Mofang 's attacks for years before the campaign related to the sez .


Comparing the GeminiDuke compilation timestamps , which always reference the time in the UTC+0 timezone , with the local time timestamps used as mutex names , and adjusting for the presumed timezone difference , we note that all of the mutex names reference a time and date that is within seconds of the respective sample ’s compilation timestamp .


The list of information collected includes :


MITRE ATT & CK techniques Tactic ID Name Description Initial Access T1475 Deliver Malicious App via Authorized App Store The malware impersonates legitimate services on Google Play Persistence T1402 App Auto-Start at Device Boot An Android application can listen for the BOOT_COMPLETED broadcast , ensuring that the app 's functionality will be activated every time the device starts Impact T1472 Generate Fraudulent Advertising Revenue Generates revenue by automatically displaying ads The Rotexy mobile Trojan – banker and ransomware 22 NOV 2018 On Whitefly first infects its victims using a dropper in the form of a malicious.exe or .dll file that is disguised as a document or image . Therefore , it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer .


There are several strings and labels still mentioning 'test ' or 'testcc ' — even the URL used for the credit card data exfiltration is named " testcc.php . The developer consistently used Accept-Enconding” (note the extra ‘n’) in all DanBot samples analyzed by CTU researchers . APT38 also targeted financial transaction exchange companies likely because of their proximity to banks .


In activity analyzed by CTU researchers , TG-3390 executed the Hunter web application scanning tool against a target server running IIS .


In this way , the malware authors can submit their app and add the malicious capabilities only after their app is live on the Play Store . During that phase , the APT32 operated a fileless PowerShell-based infrastructure , using customized PowerShell payloads taken from known offensive frameworks such as Cobalt Strike , PowerSploit and Nishang . Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities Throughout the autumn of 2018 we analyzed a long-standing (and still active at that time) cyber-espionage campaign that was primarily targeting foreign diplomatic entities based in Iran . STRATOFEAR ( com.google.kservice , us.zoom . ZoomService )


] fun , you-foto [ . TG-3390 SWCs may be largely geographically independent , but the group 's most frequently used C2 registrars and IP net blocks are located in the U.S . 0c458dfe0a2a01ab300c857fdc3373b75fbb8ccfa23d16eff0d6ab888a1a28f6 The utility is located in the “ \sc\prog\exec ” folder within the MicroSCADA installation directory , amongst other utilities , libraries , and resources used by MicroSCADA .


Another profile using the handle on a Russian social network currently shows multiple photos of the user in proximity to Moscow for the entire history of the profile .


TEMP.Periscope BackgroundActive since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities . Recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the GozNym group appears up to the task .


] 205 [ . We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit . The script will take an embedded PE file that has been base64 encoded and inject that into the current PowerShell process . Mandiant identified UNC4899 targeting MacOS keychains and reconnaissance data associated with executives and internal security teams .


Cannon takes a screenshot and saves it to a file named ops .


Highlights Samples of the malicious code found in BrainTest have been found on Google Play , and its creator has used multiple methods to evade detection by Google including Bypassing Google Bouncer by detecting if the malware is being run from an IP or domain mapped to Google Bouncer and , if so , it will not perform its intended malicious activities . We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . APT10 achieves persistence on its targets primarily by using scheduled tasks or Windows services in order to ensure the malware remains active regardless of system reboots .


The Sofacy group continues their targeted attack campaigns in 2018 .


The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits , including the EternalBlue exploit used in the WannaCry attack from May 2017 . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


Snake Wine was first publicly disclosed by FireEye in this report . In July of 2015 , we identified a full e-mail uploaded to an antivirus scanning service that carried a Scarlet Mimic exploit document .


These signatures and rules should be used to supplement analysis and should not be used as a sole source of attributing this activity to HIDDEN COBRA actors .


These campaigns are specifically directed at entities and individuals in the Palestinian territories .


The initial sample we intercepted was a Microsoft Word document ( SHA256 : 2cfc4b3686511f959f14889d26d3d9a0d06e27ee2bb54c9afb1ada6b8205c55f ) with the filename crash list ( Lion Air Boeing 737 ).docx using the author name Joohn .


Whitefly has consistently used a technique known as search order hijacking to run Vcrodat . If the lateral movement with credentials fails , then the malware uses PingCastle MS17-010 scanner (PingCastle is a French Active Directory security tool) to scan that particular host to determine if its vulnerable to EternalBlue , and uses it to spread to that host .


Such an action can be performed at any moment , regardless of the current application or user location in that application . We do not know whether using PIVY is an attempt by those behind the Molerats campaign to frame China-based threat actors for their attacks or simply evidence that they have added another effective , publicly-available RAT to its arsenal . In late June 2018 , Unit 42 revealed a previously unknown cyber espionage group we dubbed Rancor , which conducted targeted attacks in Southeast Asia E-LOC throughout 2017 and 2018 . The session takeovers bypassed password and multi - factor authentication .


Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe . The two malware families themselves are also very similar , and therefore we think that the shared technique is an indication of a single developer , or development company , behind both CONFUCIUS_A and CONFUCIUS_B .


Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 . Also our visibility as a vendor does not cover every company in the world ( at least so far ; ) ) and the Kaspersky Security Network ( KSN ) did not reveal other attacks except those against gaming companies .


MainService is the brain of this spyware and controls almost everything—from stealing the victim 's data to deleting it . SPEAR has observed numerous different XOR keys utilized by Ghost Dragon . Before acting on the request , Winnti will validate the third DWORD contains the magic value 0xABC18CBA before executing tasking .


Threat groups outside of China are unlikely to target the Uyghur people .


A company representative declined to comment for this post . This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets Bitcoin users and global financial organizations . LaZagne ( SecurityRisk.LaZagne ) : A login/password retrieval tool . Talos provided a highly informative article on the PREDATOR commercial spyware , which has been around since 2019 .


Notice notice the use of the mistaken “ Word ” instead of “ World ” : “ On behalf of all at the Word Uyghur Congress ( WUC ) , the Unrepresented Nations and Peoples Organization ( UNPO ) and the Society for Threatened Peoples ( STP ) , Human Rights in China : Implications for East Turkestan , Tibet and Southern Mongolia In what was an unprecedented coming-together of leading Uyghur , Mongolian , Tibetan and Chinese activists , as well as other leading international experts , we were greatly humbled In May 2016 , two apparently unrelated activity groups , PROMETHIUM and NEODYMIUM , conducted attack campaigns in Europe that used the same zeroday exploit while the vulnerability was publicly unknown . In the spring of 2014 , we noticed an increase in the volume of attack activity by the Naikon APT .


The core malware extracts the device ’ s installed app list . The campaign code " 20150920 " is associated with this decoy , which is a week prior to media articles announcing that the Crown Price of Thailand Maha Vajiralongkorn will lead the Bike for Dad 2015 event . Dexphot then used fileless techniques to run malicious code directly in memory , leaving only a few traces that can be used for forensics . APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations .


The raw wave audio buffer frame can be dumped in the getNextBuffer ( ) function . Charming Kitten is an Iranian cyberespionage group operating since approximately 2014 . the v3 and v7 variables are assigned to the block comparison variable ( b_cmp ) Function has a couple of Anti debugging Anti Emulation checks .


To make the fraudulent withdrawals , Lazarus first breaches targeted banks' networks and compromises the switch application servers handling ATM transactions . In 2016 , CTU researchers observed the group using native system .


'' Strazzere says he also failed to reach MediaTek , a Taiwanese fabless semiconductor manufacturer whose chipsets that powered BLU phones also contained Adups software . CVE-2018-0798 is an RCE vulnerability , a stack buffer overflow that can be exploited by a threat actor to perform stack corruption . C2 : lywjrea.gmarketshop.net .


Our analysis shows the DEFENSOR ID trojan can execute 17 commands received from the attacker-controlled server such as uninstalling an app , launching an app and then performing any click/tap action controlled remotely by the attacker ( see Figure 5 ) . On June 17 , we observed the campaign’s spam emails delivering malware-embedded Excel files directly as an attachment . McAfee Advanced Threat Research ( ATR ) analysts have discovered an aggressive Bitcoin-stealing phishing campaign by the international cybercrime group Lazarus that uses sophisticated malware with long-term impact .


After installing this AntSword webshell , the actor no longer uses the Awen webshell and issues the first command to AntSword 35 seconds after the last command issued to the Awen webshell .


zygotedaemoni686 2019-01-08 04:55:00 3c9f08b3280851f54414dfa5a57f40d3b7be7b73736fa0ba21b078e75ce54d33 sapp.apk 2019-01-08 04:53:00 4bf1446c412dd5c552539490d03e999a6ceb96ae60a9e7846427612bec316619 placeholder 2018-03-29 16:31:00 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 During the past month , Unit 42 observed several attacks against a Middle Eastern government leveraging an updated version of the BONDUPDATER malware , which now includes the ability to use TXT records within its DNS tunneling protocol for its C2 communications . JhoneRAT : 29886dbbe81ead9e9999281e62ecf95d07acb24b9b0906b28beb65a84e894091 . Adversaries may perform data destruction over the course of an operation .


Based on analysis of the data and malware samples we have collected , Unit 42 believes the attacks described herein are the work of a group or set of cooperating groups who have a single mission , collecting information on minority groups who reside in and around northwestern China . APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns .


This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . According to ClearSky , the suspected Lazarus operatives looked to leverage a vulnerability in outdated WinRAR file-archiving software that hackers have been exploiting since it was disclosed last month .


To enable connections to the infected computer using the Remote Desktop Protocol ( RDP ) , Carbanak sets Termservice service execution mode to Auto . Another set of attacks called Operation Erebus leverages another flash exploit , CVE-2016-4117 , and relies on watering hole attacks as a means of propagation .


Another option is to simply halt and quarantine the Winnti implant itself , stopping the intrusion on a single machine .


If the user unlocks their device , they will see a black screen while the app drops the call , resets call settings and prepares for the user to interact with the device normally . Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities . The rest of the content is a byte for byte copy . The new exploit method bypasses URL rewrite mitigations for the endpoint provided by Microsoft in response to •


The setup code receives an installation command from the previous stage . APT35 has historically used unsophisticated tools like those listed below in Figure 3 . Both values are supplied from an array of 256 pseudo-random bytes hardcoded in the binary’s .rdata section . Methods of manipulating control can include changes to set point values , tags , or other parameters .


Instances of this spyware were found on the Google Play Store , disguised as service applications from mobile operators . APT34 uses a mix of public and non-public tools ( Fig.2 ) and often uses compromised accounts to conduct spear-phishing operations . The first is responsible for checking if the system has the targeted keyboard layout — this is exclusively in Arabic-speaking countries . Our 2023 Ransomware Report unpacks the action in four zones : the US , Germany , France , and the UK .


In this case Attackers again spoofed an email id associated with Indian Ministry of Home Affairs and the mail was sent on September 1,2016 to an email id associated Thailand Indian embassy , this email was later forwarded on Oct 24th,2016 from a spoofed email of Thailand Indian embassy to various email recipients connected to the Indian Ministry of External Affairs ( MEA ) .


cf32479ed30ae959c4ec8a286bb039425d174062b26054c80572b4625646c551 .


Several other hacker groups have also begun targeting some of the same chemical companies in this time period .


This translates to “ The Complete Details of Fuqaha ’s Assassination ”


Rotexy will perform further actions after it receives the corresponding commands : START , STOP , RESTART — start , stop , restart SuperService . We had previously observed this author name in use once before , in the very first ThreeDollars document we collected that we had reported on in August 2017 . There are several indicators , which have led CTU researchers to believe with high confidence that NICKEL ACADEMY is behind the current spearphishing campaign .


The top level malware , CE8B99DF8642C065B6AF43FDE1F786A3 ( named by its authors “ msdeltemp.dll ” according to internal strings , and compiled July 28th , 2015 ) is a rare type of the Sofacy AZZY implant .


The Trojan works by creating an overlay whenever the user launches the banking application . ScarCruft is a relatively new APT group , victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania . Among the artifacts related to malware authors, we found in the binaries a .pdb path containing the Windows user name “Mohamadreza . The discovery of COSMICENERGY illustrates that the barriers to entry for developing offensive OT capabilities are lowering as actors leverage knowledge from prior attacks to develop new malware .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . Prior to that report , we published detail analysis on malware exploiting CVE-2018-8414 vulnerability (remote code execution in SettingContent-ms) , which is believed a work of DarkHydrus .


The creators of the Spark backdoor use a few techniques that are intended to keep the backdoor under-the-radar , including :


android.intent.action.CONNECTIVITY_CHANGE System notification that a change in network connectivity has occurred , either lost or established . APT41 has blatantly engaged in financially motivated activity targeting the video game industry , including manipulating virtual currencies . The primary targets of APT28 are potential victims in several countries such as Ukraine , Spain , Russia , Romania , the United States and Canada .


Cybercriminals also exploit the Master Key vulnerability and have learned to embed unsigned executable files in Android installation packages . If the address falls within ranges that the attackers are interested in , the malicious site waits for their next page view to drop an exploit on the desirable target 's PC . After having been decrypted , ShadowPad ’s shellcode is executed . But then , following an upsurge in attacks in the second half of 2014 , GReAT characterized MiniDuke , CosmicDuke and the actor ’s Nemesis Gemina project - targeting government , diplomatic , energy , military and telecom operators - as ‘ one of the world ’s most unusual APT operations ’ due to : • Its use of a customized backdoor written in Assembler using ‘ old school ’ virus writing techniques and habits • Stealthy transfer of updates as executables hidden inside GIF files ( a form of steganography )


We watched WolfRAT evolve through various iterations which shows that the actor wanted to ensure functional improvements — perhaps they had deadlines to meet for their customers , but with no thought given to removing old code blocks , classes , etc . It is highly likely MoonWind is yet another new tool being used by the group or groups responsible for that activity , indicating they are not only still active but continuing to evolve their playbook . These changes may be temporary and FireEye believes they are aimed at decreasing detection of their tools until a more permanent and effective TTP change can be implemented ( e.g. , WATERSPOUT ) . The threat actors are distributing NetSupport RAT either as a zipped download or via an Internet shortcut .


HenBox appears to primarily target the Uyghurs – a minority Turkic ethnic group that is primarily Muslim and lives mainly in the Xinjiang Uyghur Autonomous Region in North West China . This full-blown spying framework consists of two packages named ‘Tokyo’ and ‘Yokohama’ . The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


It then loads the contents of the encrypted file and injects it into the explorer.exe and iexplore.exe processes .


Alpha’s early role was fairly simple: engage with individuals , who he chose based on the goods they were selling , and then provide personal shipping addresses back to Omega . In this report , we'll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan .


In Clever Kitten 's attacks , the goal is lateral movement ; this is an attempt to move further into the target environment in order to begin intelligence collection . CTU researchers have observed the Threat Group-3390 obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both .


Upon further inspection , we have observed that this RAT extracts WhatsApp data too . An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong . Name SHA256 . If more groups start adopting CL0P 's zero - day exploitation techniques , the ransomware landscape could tilt from service - oriented attacks to a more aggressive , vulnerability - focused model — a move that could skyrocket the impact of attacks .


The domain was registered on March 8th , 2013 : Registration Service Provided By : SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO. , LTD. Domain Name : DLMDOCUMENTSEXCHANGE.COM Registration Date : 08-Mar-2013 Expiration Date : 08-Mar-2014 Status : LOCKED The domain registration data indicates the following owner : Registrant Contact Details : peng jia peng jia ( bdoufwke123010 @ gmail.com ) beijingshiahiidienquc.d beijingshi beijing,100000 While we were unable to recover the initial vulnerability used , it is possibly the same CVE-2014-0515 Adobe Flash exploit first reported by Cisco TRAC in late July . The discovery by Kaspersky marks at least the fifth zero-day exploit used by BlackOasis and exposed by security researchers since June 2015 .


] com nampriknum [ . In August and October 2016 we observed a malware operation targeting members of the Tibetan Parliament ( the highest legislative organ of the Tibetan government in exile , formally known as Central Tibetan Administration ) . These threat actors ’ tactics follow the same principles of evolution – successful techniques propagate , and unsuccessful ones are abandoned . The RAT 's main binary is launched from " C:\Users\%username%\AppData\Roaming\BranScale\client32.exe " .


C & C Communications Exfiltrating Device Data To communicate with its master , TrickMo ’ s code contains a hardcoded URL of the C & C server . Emotet is a type of general-purpose malware that evolved from a well-known banking Trojan , " Cridex " , which was first discovered in 2014 . During the summer of 2018 , HELIX KITTEN actors were observed targeting entities in the Middle East — of note , targets appeared to be located in Bahrain and Kuwait .


In addition to the continued evolution of the group ’s first stage tools , we have also noted APT28 : Leveraging zero-day vulnerabilities in Adobe Flash Player , Java , and Windows , including CVE-2015-1701 , CVE-2015-2424 , CVE-2015-2590 , CVE-2015-3043 , CVE-2015-5119 , and CVE-2015-7645 .


No other parts of the C2 infrastructure amongst these domains contained any overlapping artifacts .


One of these files was deployed in a TEMP.Veles target ’s network .


On January 10 , 2020 , we used Shodan to search for Internet accessible servers running versions of SharePoint vulnerable to CVE-2019-0604 .