FireEye identified overlaps between the domain registration details of CyberCaliphate ’s website and APT28 infrastructure .


Backdoor.APT.PittyTiger1.3 ( aka CT RAT ) – This malware is likely used as a second-stage backdoor . On it , MoneyTaker install a legitimate tool for penetration testing – Metasploit .


The group has also been reported as Leviathanby other security firms . After the executable is executed , it downloads Pony and Vawtrak malware variants to steal data .


The operators retrieve these files on the machine using the DOWNLOAD_LIST command .


Called “ DEFENSOR ID ” , the banking trojan was available on Google Play at the time of the analysis . At the end of August 2018 , the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components . Evidence suggest that the Lazarus Group uses compromised infrastructure as the public-facing touchpoint for the majority of their malware samples .


Details : Name : Super Mario Run Package Name : net.droidjack.server MD5 : 69b4b32e4636f1981841cbbe3b927560 Technical Analysis : The malicious package claims to be the Super Mario Run game , as shown in the permissions screenshot below , but in reality this is a malicious RAT called DroidJack ( also known as SandroRAT ) that is getting installed . In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television . The fileless attack was delivered via Microsoft Word documents that exploited a former zero-day vulnerability in Word , CVE-2017-0199 , to install a fileless attack variant of the Helminth Trojan agent . For more information , contact : intelreports@kaspersky.comPowerShell event logs for the creation of an arbitrary process from PowerShell .


If the privileges are revoked successfully , the Trojan relaunches the cycle of requesting administrator privileges . We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded . WCry uses a combination of the RSA and AES algorithms to encrypt files .


SHA256 : d773b12894d4a0ffb0df328e7e1aa4a7112455e88945a10471650e503eecdb3d .


" Mundizza '' is a dialectal word , a derivative of the proper Italian word " immondizia '' that translates to " trash '' or " garbage '' in English . This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . In fact , it is almost unusual in its unsophistication . Regardless of the cause , these leaks are having a significant effect on the threat landscape , making it easier for novice or unskilled actors to develop their own ransomware variants without much effort or knowledge .


This archive is stored in the same host has the webviews . The group is known for espionage campaigns in the Middle East . Once loaded and the export entry of Rmcmd is called , it creates a Windows B-TOOL S-OS mutex named gkdflbmdfk . By understanding the TTPs of the leaked source codes , defenders will gain invaluable insights that are helpful in identifying and mitigating any existing security weakness in their environment and improving their security defense against these attack vectors .


] 204 [ . This whitepaper explores the tools - such as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , etc- of the Dukes , a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making . If the DownloadString method is located it will contact the hard coded C2 requesting a file , which is downloaded and then invoked ( highlighted in blue ) . Another common delivery mechanism for ransomware attacks is via phishing emails , compounding the problem for security teams already overburdened with managing an evergrowing volume of suspicious messages that require review .


ONLINE – send information about Trojan ’ s current status to C & C : whether it has device administrator privileges , which HTML page is currently displayed , whether screen is on or off , etc . Once exploit has been achieved , Nidiran is delivered through a self-extracting executable that extracts the components to a .tmp folder after it has been executed . Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft .


Artifact #2 operates as a backchannel for the attacker to maintain a foothold inside the compromised network .


The ‘ onload5 ’ function is responsible for adding the newly loaded SWF object as a child object .


With each networked IoT device having its own separate network stack , it ’s quite easy to see the need for better enterprise management , especially in today ’s “ bring your own device ” world .


July 13 Further analysis of the hacking team dump revealed that the company used UEFI BIOS rootkit to keep their Remote Control System ( RCS ) agent installed in their targets ’ systems . If successful , Cobalt goes on to attack financial institutions outside the country . . A typical log entry showing access to the PowerShell backend is detailed in the Remote PowerShell HTTP logs , located in , such as in the example below : CrowdStrike incident responders discovered Remote PowerShell logs similar to log entries for ProxyNotShell exploitation to gain initial access , suggesting the attacker leveraged Remote PowerShell .


Coronavirus Update App Leads to Project Spy Android and iOS Spyware We discovered a cyberespionage campaign we have named Project Spy infecting Android and iOS devices with spyware by using the coronavirus disease ( Covid-19 ) as a lure . Without Symantec 's advanced AI-based capabilities , Gallmaker 's activities may well have remained undetected . for example , Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader , one of the most popular PDF reader alternatives to Adobe Acrobat .


On the other hand , ShadowBrokers group made headlines in 2016 when it claimed to have robbed various exploitation tools used by the NSA including the notorious ETERNALBLUE that was a vital component in the WannaCry ransomware campaign causing damages to systems worldwide . It's coincident that both 'darkhydrus' APT group name and ‘Williams’ user name in PDB path found in this Twitter user .


As shown within the timeline above , the WINDSHIFT activity observed by Unit 42 falls between January and May of 2018 . Silence conducted a massive phishing campaign posing as the Central Bank of the Russian Federation .


It does so by calling a sub-function to decrypt the content , using the value stored in the ‘ r1 ’ variable as a key .


Typically , APT10 tends to employ a namesquatting scheme in their domains that aims to confuse the observer by posing as a legitimate domain . This sample was also found to be deployed using the CVE-2012-0158 vulnerability .


] 6 , was previously hosting the domain next.nextuptravel [ . They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword.exe . Poison Ivy includes features common to most Windows-based RATs , including key logging , screen capturing , video capturing , file transfers , system administration , password theft , and traffic relaying .


The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April . The Turla group is known to be painstaking and work in stages , first doing reconnaissance on their victims' systems before deploying their most sophisticated tools such as Carbon .


The malware samples were mainly distributed through a series of malicious subdomains registered under a legitimate domain belonging to a well-known shared hosting service provider in Russia . PROMETHIUM and NEODYMIUM both used a zero-day exploit that executed code to download a malicious payload . Ssdeep : 768:u0foGtYZKQ5QZJQ6hKVsEEIHNDxpy3TI3dU4DKfLX9Eir : uG1aKQ5OwCrItq3TgGfLt9r . It now appears those attacks were perpetrated by Harrison , who sent emails from different accounts at the free email service Vistomail pretending to be Bradshaw , his then - girlfriend and their friends .


Researchers at Kaspersky Lab privately disclosed the flaw to Adobe after exploits against the zero-day were used in March by the ScarCruft APT gang in what Kaspersky Lab is calling Operation Daybreak . The FBI said the " group of malicious cyber actors " ( known as APT6 or 1.php ) used dedicated top-level domains in conjunction with the command and control servers to deliver " customized malicious software " to government computer systems .


The goal of the attackers appears to be to collect intellectual property such as design documents , formulas , and manufacturing processes . After reestablishing access , the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used .


This change came hand in hand with a new overlay target list , no longer targeting social apps , but focusing on banking instead . we assess with high confidence that these incidents were conducted by APT10 also known as Stone Panda , menuPass , CVNX in an effort to gain access to networks and steal valuable intellectual property or gain commercial advantage . We have observed that the adversary has repeatedly attacked a high-profile target in Japan using multiple malware families for the last three years .


This is done using a series of syscalls as outlined below . The attackers try to lure targets through spear phishing emails that include compressed executables . They simply use the website for legitimate purposes , such as posting forum threads or creating profile pages . If the target system meets the pre - defined requirements , the malware will use Twitter ( unbeknownst to the user ) and start looking for specific tweets from pre - made accounts .


This spyware sample communicates over dynamic DNS . this RTF exploits again the CVE-2017_1882 on eqnedt32.exe . Night Dragon is a campaign name for activity involving a threat group that has conducted activity originating primarily in China .


Of the 195 functions of the new sample , 149 are strictly identical , 16 match at 90% and 2 match at 80% .


The server sends back encoded json containing URL , class name and method name . Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly , we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office . The archive contains an .exe file , sometimes disguised as a Microsoft Word file , a video , or another file format , using the corresponding icon .


CTU researchers have observed the threat actors installing a credential logger and backdoor on Microsoft Exchange servers , which requires a technical grasp of Internet Information Services ( IIS ) .


Playing further off the suggested GAS Tecnologia link , the app promises better security for its users . TA505 is also using FlowerPippi (Backdoor.Win32.FLOWERPIPPI.A) , a new backdoor that we found them using in their campaigns against targets in Japan , India , and Argentina . Regardless of their sophistication or refinement , the malware families within the Lazarus Group 's India and Lima classes perform at a reasonable level for their designed purpose : the introduction and persistence of malware from the Lazarus Group on a victim 's infrastructure .


Encounter In early 2019 , the Check Point Research team observed a surge of Android malware attack attempts against users in India which had strong characteristics of Janus vulnerability abuse ; All samples our team collected during preliminary investigation had the ability to hide their app icons and claim to be Google related updaters or vending modules ( a key component of Google Play framework ) . Threat actors have delivered Bookworm as a payload in attacks on targets in Thailand . All 13 countries where Kaspersky reportedly observed BlackOasis activity are connected to Saudi Arabia in one of three ways : economically ; from a national security perspective ; or due to established policy agreements . WIRTE has used HTTPS over ports 2083 and 2087 for C2.ZxShell can use ports 1985 and 1986 in HTTP / S communication.[47 ] Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level .


Such a framework typically consists of five elements :


Ultimately , APT35 had used access to hundreds of mailboxes to read email communications and steal data related to Middle East organizations , which later became victims of destructive attacks . Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 .


Attackers send a spear phishing email to employees at the target organization .


Shamoon2 : 5.254.100.200 Shamoon2 : URLs .


All modules set hidden attributes to their files : Module Paths Exfiltrated data format msconf.exe % APPDATA % /myupd/gen/ % Y % m % d- % H % M % S_filesystem.zip ( file structure dump ) system.exe % APPDATA % /myupd/aud/ % d % m % Y % H % M % S.wav ( surrounding sounds ) update.exe % APPDATA % /myupd_tmp/txt/ % APPDATA % /myupd/txt/ % Y % m In theory , Shun Wang Technologies could have collected a third of China’s population names and contact numbers if not more . FIN6 : ITG08 .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system .


drivres-update.info softupdates.info The module uses a hardcoded URL ( “ /check/ “ ) for sending HTTP POST requests to its C2 servers .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . Black Lambert was seen only briefly and we assume it was " retired " from the arsenal after being discovered by FireEye in 2014 .


UNBLOCK – unblock the telephone ( revoke device administrator privileges from the app ) . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East . The researchers found that there are common elements in the macro and in the first- stage RAT used in this campaign , with former campaigns of the NICKEL ACADEMY ( Lazarus ) threat group .


The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes . APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


Th 64KB buffer is used as a VM descriptor data structure to store data and the just-in-time ( JIT ) generated code to run . Based on the targeting and lures , Unit 42 assesses that the Lotus Blossom actors ' collection requirements include militaries and government agencies in Southeast Asia . Early in the payload , the malware checks to see if the system language is Russian or Chinese . e.g. , uses character as a separator and that contains valid IP list uses as a separator .


We believe this HTTP GET request was the actor visiting the webshell after exploitation and prior to executing commands .


The following is a summary of observed WINDSHIFT activity which targeted a Middle Eastern government agency . We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit .


XLoader Disguises as Android Apps , Has FakeSpy Links This new XLoader variant poses as a security app for Android devices , and uses a malicious iOS profile to affect iPhone and iPad devices . In March 2014 , the group leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank . Name Delivery Server . COSMICENERGY is the latest example of specialized OT malware capable of causing cyber physical impacts , which are rarely discovered or disclosed .


We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 . Bahamut targeted similar Qatar-based individuals during their campaign .


Oftentimes , the emailed link is a bit.ly shortened link , used to potentially evade detection . The attackers originally embedded an implant into the malicious document as a hypertext application (HTA) file , and then quickly moved to hide it in an image on a remote server and used obfuscated Visual Basic macros to launch the decoder script . Equation is a sophisticated threat group that employs multiple remote access tools .


It leverages webinjects and SMS reading capabilities to bypass two-factor authentication , and is clearly targeting financial applications . In their latest leak , they have released the UNITEDRAKE NSA exploit , which is a remote access and control tool that can remotely target Windows-based systems to capture desired information and transfer it to a server . As a result of our analysis of APT10 's activities , we believe that it almost certainly benefits from significant staffing and logistical resources , which have increased over the last three years , with a significant step-change in 2016 .


In this version of Rotexy , dynamic generation of lowest-level domains was not used . The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period . FBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation .


Reports indicate fake versions of the Amaq app exist , likely in order to spy on those that use it . APT41 is unique among tracked China-based actors in that it leverages non-public malware typically reserved for espionage operations in what appears to be activity that falls outside the scope of state-sponsored missions . APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy .


This entry was posted on Thu Dec 14 10:00 EST 2017 and filed under Malware , Nathan Brubaker , Christopher Glyer , Blake Johnson , Dan Caban , Marina Krotofil , ICS Security , and Dan Scali . The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period .


This allows the PHA authors to monetize their apps more effectively than through regular advertising . Obviously , the developers behind NetTraveler have taken steps to try to hide the malware 's configuration . Since 1949 , Beijing has claimed Taiwan as a part of China and strongly opposes any action toward independence . The U.S. Cybersecurity and Infrastructure Security Agency ( CISA ) released a detailed timeline on the campaign , stating that an investigation from Microsoft revealed that “ advanced persistent threat ( APT ) actors accessed and exfiltrated unclassified Exchange Online Outlook data ” after users reported suspicious activities in their Microsoft 365 cloud environment .


The group demonstrates malleability and innovation in maintaining and producing familiar SPLM functionality , but the pragmatic and systematic approach towards producing undetected or difficult-to-detect malware continues .


Based on these and other similar stylistic differences observed between CozyDuke and its older siblings , we speculate that while the older Duke families appear to be the work of someone with a background in malware writing ( or at the least in hacking ) , CozyDuke ’s author or authors more likely came from a software development background .


But , behind the scenes , the malware has not been removed ; instead it starts preparing its onslaught of attacks . In total , Silence sent out about 80 , 000 emails , with more than half of them targeting Taiwan , Malaysia , and South Korea . The Charming Kitten' focus appears to be individuals of interest to Iran in the fields of academic research .


The threat actors used social engineering to convince users to run an embedded macro in a Microsoft Word document that launched a malicious PowerShell payload .


We initially reported on this threat group and their UPDATESEE malware in our FireEye Intelligence Center in February 2016 . Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . Notably , APT41 was observed using proof-of-concept exploit code for CVE-2019-3396 within 23 days after the Confluence .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . The attack leveraged malware we called ' BlackLambert ' , which was used to target a high profile organization in Europe .


Moreover , the backdoor contains a list of filenames related to credentials from software listed below ( database names ) :


An interesting feature of this family of banking Trojans is the simultaneous use of three command sources : Google Cloud Messaging ( GCM ) service – used to send small messages in JSON format to a mobile device via Google servers ; malicious C & C server ; incoming SMS messages . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " . Lazarus actors commonly maintain persistence on a victim 's system by installing the malware-as-a-service .


Again , much of the modification work focused on removing redundant code in an attempt to appear different from earlier versions of the loader .


WRITE_EXTERNAL_STORAGE - Allows the application to write to external storage . Several spear-phishing campaigns attributed to Carbanak , all occurring between March and May 2018 , were analyzed by security researchers in 2018 . The crew combines both regular crime and targeted attack objectives using the same domain infrastructure over time , rarely changing their TTPs .


While the stolen certificates were different , and stolen in separate instances , they were both used with custom malware in targeted attacks originating from China .


IOCS Hashes 139edb1bc033725539b117f50786f3d3362ed45845c57fe1f82e7ed72b044367 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e5f346d8f312cc1f93c2c6af611e2f50805c528934786ea173cabc6a39b14cda This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics . APT12 . Both of these campaigns use a similar structure with compromised WordPress sites hosting the lure shortcuts and a WebDav server that loads NetSupport RAT .


The MiniDuke toolset consists of multiple downloader and backdoor components , which are commonly referred to as the MiniDuke “ stage 1 ” , “ stage 2 ” , and “ stage 3 ” components as per Kaspersky ’s original MiniDuke whitepaper .


Since releasing our 2014 report , we continue to assess that APT28 is sponsored by the Russian Government .


Threat actors used different websites to host different payloads at different times . On January 8 , 2018 , Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East . In the three documents , an additional Office document containing a Macro is downloaded and executed . Based on these findings , CrowdStrike assesses it is highly likely that the OWA technique employed is in fact tied to CVE-2022 - 41080 .


The json format is typically { “mth ” :


And this just means attackers will continue to be successful . Machete is interested in files that describe navigation routes and positioning using military grids . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank .


Another lull in November 2016 saw the complete absence of Locky and Dridex , while high-volume campaigns reappeared in December , albeit at lower volumes than during the Q3 2016 peak .


Most of the Equation Group 's targets have been in Iran , Russia , Pakistan , Afghanistan , India , Syria , and Mali . However , some phishing emails were sent to bank employees in more than 25 countries of Central and Western Europe , Africa and Asia including : Kyrgyzstan , Armenia , Georgia , Serbia , Germany , Latvia , Czech Republic , Romania , Kenya , Israel , Cyprus , Greece , Turkey , Taiwan , Malaysia , Switzerland , Vietnam , Austria , Uzbekistan , Great Britain , Hong Kong , and others .


Keylogger log location : Users\hJTQwqwwSCkZU\AppData\Roaming\GoogleDesktop\<date> .


The phone number is fetched from a response from the C & C server and is stored in str3 variable , which further is utilized using the tel : function . Buckeye's exploit tool , EternalRomance , as well as EternalSynergy , can exploit the CVE-2017-0143 message type confusion vulnerability to perform memory corruption on unpatched victim computers . The group has been active since at least 2010 and has targeted organizations in the aerospace , government , defense , technology energy , and manufacturing sectors .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills . DoublePulsar is then used to inject a secondary payload , which runs in memory only .


While details would vary , all of the identified copies of this spyware shared a similar disguise . The payload embedded within the ISMInjector sample delivered in this attack is a variant of the ISMAgent backdoor that we had discussed in detail in our blog discussing a targeted attack on a Saudi Arabian technology company . Finally , the RAT is able to download files encoded in base64 on Google Drive . [ As the documentary points out , the domain AshleyMadisonSucks.com was eventually transferred to Ashley Madison , which then shrewdly used it for advertising and to help debunk theories about why its service was supposedly untrustworthy ] .


Hunter queried the following URIs in a specific order to determine if the associated software configurations are insecure .


As part of our investigation into this malware , we emulated an infected Android device in order to communicate with the RuMMS C2 server . Unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals . The dropped sample is an SFX archive , like the tradition of Gamaredon implants . Last month , NoEscape posted 7 victims on their leak site .


Xpert RAT reportedly first appeared in 2011 . Bellingcat also reported the domain had been used previously to host potential decoy documents as detailed in VirusTotal here using http://voguextra.com/decoy.doc .


Network Security appliances such as Next-Generation Firewall ( NGFW ) , Next-Generation Intrusion Prevention System ( NGIPS ) , and Meraki MX can detect malicious activity associated with this threat . Cisco Talos assesses with moderate confidence that a campaign we recently discovered called " BlackWater " is associated with suspected persistent threat actor MuddyWater . MOF files are compiled scripts that describe Common Information Model ( CIM ) classes , which are compiled into the WMI repository . Given that threat actors use red team tools and public exploitation frameworks for targeted threat activity in the wild , we believe COSMICENERGY poses a plausible threat to affected electric grid assets .


After connecting to its C2 server , RCSession checks in with an encrypted beacon and then awaits instruction .


While the counterfeit games claim to provide similar functionality to the popular apps , they are simply used to display ads through a custom advertisement SDK . To conduct targeted attacks , MoneyTaker use a distributed infrastructure that is difficult to track . Table 2 lists the ELMER backdoors observed during the December campaigns . Our recent reporting states that these operations are very likely aimed at stealing information and gaining persistent remote access .


It reinforces the need for comprehensive defense powered by broad visibility into attack surfaces as well as domain experts who track the threat landscape and uncover notable threats that might be hiding amidst massive threat data and signals . it is a typical first stage backdoor commonly found in APT attacks . This provides researchers and analyst broad tool to attack this type of obfuscation , We note that the MicroSCADA control system became a Hitachi Energy product in 2022 after a divestiture from ABB .


Royal Mail - British postal service and courier company . Based on this information , it is possible that upon the exposure of the Nasr Institute as a front for Iranian state-sponsored offensive cyber activity , employees transitioned over to other entities , such as Kavosh , to protect their identities and minimize further exposure . In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . However , to increase success rates APT20 can use zero-day exploits , so even a properly patched system would be compromised .


On top of our analysis of recent trends , M-Trends 2017 contains insights from our FireEye as a Service (FaaS) teams for the second consecutive year . APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


Several of the main components of RuMMS are shown in Figure 2 . In these websites they hosted malware that was digitally signed with a valid , likely stolen code signing certificate . As visible in the previous ﬁgure , the only difference between the ﬁles are in the variable , registry key and path used by Word rather than by Excel . All of these things point to threat actors and groups like Winnti will continue to try different methods of attack .


Here is an approximate diagram of the opcode data structure : Figure 5 . The Lotus Blossom actors using Emissary have been active for at least seven years in Southeast Asia . If for a particular reason you need them , reach out to us at threatintel@eset.com . Also , ideology as a motivator could mean your group is the target of nation states .


Secureworks researchers investigated activities associated with the BRONZE BUTLER (also known as Tick) threat group , which likely originates in the People . To learn more about this campaign , you may refer to our report , Operation Pawn Storm Using Decoys to Evade Detection . Additionally , we discovered a new DNS hijacking technique that we assess with moderate confidence is connected to the actors behind Sea Turtle . Talos now has moderate confidence that the threat actors behind Sea Turtle have been using another DNS hijacking technique . This technique was also observed against a government organizations in the Middle East and North African region . Cisco telemetry confirmed that the actors behind Sea Turtle maintained access to the ICS-Forth network from an operational command and control (C2) node . Our telemetry indicates that the actors maintained access in the ICS-Forth network through at least April 24 , five days after the statement was publicly released . This full-blown spying framework consists of two packages named ‘Tokyo’ and ‘Yokohama’ . Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue . The first confirmed date when TajMahal samples were seen on a victim’s machine is August 2014 . More details about TajMahal are available to customers of the Kaspersky Intelligence Reporting service .


1 . Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers . We believe APT34 is involved in a long-term Cyber Espionage operation largely focused on reconnaissance efforts to benefit Iranian nation-state interests and has been operational since at least 2014 .


Some are carried out well , others , like WolfRAT , are designed with an overload of functionality in mind as opposed to factoring any sensible approach to the development aspect . Trochilus was first reported by Arbor Networks in their Seven Pointed Dagger report tying its use to other targeted Southeast Asia activity . APT12 has the ability to adapt quickly to public exposures with new tools , tactics , and procedures ( TTPs ) . Now , there is a potential new competitor in the " fake updates " landscape that looks strangely familiar .


To do this the attackers used a signed credential-dumping tool to obtain the victim 's account credentials .


The malicious document – Hotel_Reservation_Form.doc ( MD5 : 9b10685b774a783eabfecdb6119a8aa3 ) , contains a macro that base64 decodes a dropper that then deploys APT28 ’s signature GAMEFISH malware ( MD5 : 1421419d1be31f1f9ea60e8ed87277db ) , which uses mvband.net and mvtband.net as command and control ( C2 ) domains .


The small or limited number is understandable given the nature of this campaign , but we also expect it to increase or even diversify in terms of distribution . We will publish more details about the attack once Adobe patches the vulnerability , which should be on June 16 . Attackers make mistakes , and FIN7 are no exception . This makes Greatness particularly well - suited for phishing business users .


On Nov14 , 2017 , FireEye observed APT34 using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East . The first of which we call ' CONFUCIUS_A ' , a malware family that has links to a series of attacks associated with a backdoor attack method commonly known as SNEEPY ( aka ByeByeShell ) first reported by Rapid7 in 2013 .


A complete list of hashes can be found here . OutExtra.exe is a signed legitimate application from Microsoft named finder.exe . APT16 is a China based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations .


The Trojan download window Asacub masquerades under the guise of an MMS app or a client of a popular free ads service . Incident response engagements have given CTU researchers insight into the tactics TG-3390 employs during intrusions . In a previous execution ( published in June 2019 ) , we observed that dota2 had its own folder but it was hardly executed , indicating that this version is the updated iteration . A rough translation of this message is as follows : Hack520 seems to be very interested in hosting services and his profile fits that of a system administrator profile with some programming and hacking skills .


As of this publication , BRONZE UNION remains a formidable threat group that targets intellectual property and executes its operations at a swift pace . This seems confusing as FireEye earlier publicly declared the TRITON as a discrete entity , linked to a Russian research institution , and christened it as " TEMP.Veles " .


As MoleRATs most prominently targets Palestinian territories , its spear phishing attacks often use attached malicious documents on topical Palestinian Authority-related issues to lure their victims .


The Zen trojan After achieving persistence , the trojan downloads additional payloads , including another trojan called Zen . Attacks on the chemical industry are merely their latest attack wave . ELMER : CVE-2015-1701 . Adversaries may manipulate physical process control within the industrial environment .


Report_URL : https://dragos.com/resource/xenotime/


Such a diversity of protocols gives the attackers more flexible control . NewsBeef continues to deploy malicious macro-enabled Office documents , poisoned legitimate Flash and Chrome installers , PowerSploit , and Pupy tools . The group 's victims have primarily been in the Middle East , Europe , and the United States .


ESET researchers and colleagues from other companies have documented these components ; however , in this article we will focus on what ’s beyond the compromise , what the operators do once a victim system is running a Zebrocy Delphi backdoor .


Microsoft Defender for Endpoint on Android , now generally available , extends Microsoft ’ s industry-leading endpoint protection to Android . The attackers have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors . and if it adopted in other families . Actors behind many of these new ransomware variants , including Sirattacker , Chaos 2.0 , Chaos 4.0 , DCrypt , and Shadow Men Team , are demanding payments ranging from USD $ 3.50 to $ 4,390 in Bitcoin from victims .


Further analysis of both malware revealed that their main targets are very similar , as seen in the screenshot below .


While examining 25f0d1cbcc53d8cfd6d848e12895ce376fbbfaf279be591774b28f70852a4fd8 , we were able to pivot from its C2


Windows Defender ATP displays these activities as process trees in a machine timeline for the infected computer .


The configuration contains a list of steps to execute with URLs and JavaScript . We have not found evidence of Bahamut engaging in crime or operating outside its limited geographic domains , although this narrow perspective could be accounted for by its compartmentalization of operations . Finally it spawns 2 system threads . I will use Qiling in the emulation .


Upon opening of the MS Word document , our embedded file exploits CVE-2017-11882 to drop a malicious fake Norton Security Shell Extension module , 'NavShExt.dll' , which is then injected into iexplore.exe to install the backdoor , begin collection , and activate command and control . Execute a command through exploits for CVE-2017-11882 .


X-Force IRIS researchers had been tracking earlier activity associated with similar malicious , PowerShell-laden documents themed as resumes and human resources documents , some of which related to organizations in Saudi Arabia .


Orangeworm 's secondary targets include Manufacturing , Information Technology , Agriculture , and Logistics . We are also grateful to the Private Office of his Holiness the Dalai Lama , the Tibetan Government-in-Exile , the missions of Tibet in London , Brussels , and New York , and Drewla ( a Tibetan NGO ) .


In 2018 , the most actively distributed versions were 5.0.0 and 5.0.3 . CTU researchers have evidence that the TG-3390 compromised U.S and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations . Comparing this development to their previous attacks , we think Outlaw may be aiming to go after enterprises that have yet to update their systems , assessing security and changes with their previously infected hosts , finding new and old targets , and possibly testing their updates in the wild . None Read about adversaries tracked by CrowdStrike in 2021 in the and in the • None Learn more about how can help your organization prepare to defend against sophisticated threats , respond and recover from incidents with speed and precision , and fortify your cybersecurity practices .


Its creators reduced the app ’ s malicious surface to the bare minimum by removing all potentially malicious functionalities but one : abusing Accessibility Service . It used GitHub and Slack as tools for communication between the malware and its controller . In terms of form factor , PapaAlfa comes in two flavors : service DLL and standalone executable .


COZYDUKE : First known activity January 2010 , Most recent known activity : Spring 2015 , Other names CozyBear , CozyCar , Cozer , EuroAPT , C&C communication methods HTTP(S) , Twitter ( backup ) , Known toolset components Dropper , Modular backdoor , Multiple persistence components , Information gathering module , Screenshot module , Password stealing module , Password hash stealing module .


WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data . After the infection stage , criminals move laterally with the help of legitimate and pentesting tools , stealing passwords from their initial victims ( entry point ) to gain access to the computers within the organization that have access to money transactions .


The dropped file was analyzed in an isolated environment ( without actually allowing it to connect to the c2 server ) .


Since in Android 8.0 ( SDK API 26 ) the system is able to kill idle services , this code raises a fake update notification to prevent it : Cybercriminals have the ability to control the implant via HTTP , XMPP , binary SMS and FirebaseCloudMessaging ( or GoogleCloudMessaging in older versions ) protocols . The NewsBeef actor deployed a new toolset in a campaign that focused primarily on Saudi Arabian targets . Molerats is a politically-motivated threat group that has been operating since 2012 .


The following are tools that TEMP.Periscope has leveraged in past operations and could use again , though these have not been seen in the current wave of activity:Beacon: a backdoor that is commercially available as part of the Cobalt Strike software platform , commonly used for pen-testing network environments . This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . While PLEAD and KIVARS are most likely to be used in first phase attacks , Waterbear can be seen as a secondary backdoor installed after attackers have gained a certain level of privilege .


The tools and techniques used throughout these attacks are consistent with several Chinese threat actors , such as APT10 , a threat actor believed to operate on behalf of the Chinese Ministry of State Security . Later that month , the same tactics and patterns were seen in attempts against an Iranian women 's activist – an individual commonly targeted by Iranian actors , such as Charming Kitten and the Sima campaign documented in our 2016 Black Hat talk .


Although tracking threats like Winnti involves old-fashioned investigative work , Microsoft Threat Intelligence analysts take advantage of machine learning to work at scale .


Interestingly , early “ clean ” versions contain varying levels of signals that the updates will include malicious code later . While not detected at the time , Microsoft 's antivirus and security products now detect this Barium malicious file and flag the file as " Win32/ShadowPad.A " . There are some built in functions on the side for the more common features . The sample of LIGHTWORK we obtained includes eight hardcoded IEC-104 information object addresses ( IOA ) , which typically correlate with input or output data elements on a device and may correspond to power line switches or circuit breakers in an RTU or relay configuration .


It will check the version of Android installed and decide which library should be patched . This threat is another proof point that attackers are clearly incorporating the mobile device into their surveillance campaigns as a primary attack vector . RevengeHotels is a campaign that has been active since at least 2015 , revealing different groups using traditional RAT malware to infect businesses in the hospitality sector . ItaDuke because it reminded us of Duqu and because of the ancient Italian comments in the shellcode copied from Dante Alighieri - s ? Divine Comedy .


To provide context around such alerts , Windows Defender ATP also features a short summary of the group ’s history , goals , methods , and tools , with links to extensive documentation for technically minded users .


In over half of the targeted threat response engagements performed by the Dell SecureWorks Counter Threat Unit Special Operations ( CTU-SO ) team in the past year , the threat actors accessed the target environment using compromised credentials and the companies' own virtual private network ( VPN ) or other remote access solutions .


The developer of this particular payload configured it to use the following URL to communicate with as its C2 : http://188.241.58.170/local/s3/filters.php .


Trojan anatomy The family was named Riltok after the librealtalk-jni.so library contained in the APK file of the Trojan . McAfee concludes that some groups—and especially the Poetry Group —have shifted tactics to use Citadel in ways other than what it was originally intended for . The .dll file is executed by the .exe file .


One representative sample Chrysaor app that we analyzed was tailored to devices running Jellybean ( 4.3 ) or earlier . Between August 2 and 4 , the actor sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors . Wait time is chosen randomly in the range 2/3 t to 5/3 . The Winnti group diversified its targets to include enterprises such as those in pharmaceutics and telecommunications .


They noted that this node appeared to be maliciously modifying any executables that were downloaded through it over a HTTP connection .


Since then , the implant ’ s functionality has been improving and remarkable new features implemented , such as the ability to record audio surroundings via the microphone when an infected device is in a specified location ; the stealing of WhatsApp messages via Accessibility Services ; and the ability to connect an infected device to Wi-Fi networks controlled by cybercriminals . The group has been quite visible since the initial 2017 Malwarebytes report on their elaborate espionage attack against the Saudi Arabian government . Cleaver : Threat Group 2889 , TG-2889 .


Upon creation , this activity launches a thread that will loop on a 50-second interval . In early 2016 the Callisto Group began sending highly targeted spear phishing emails with malicious attachments that contained , as their final payload , the " Scout " malware tool from the HackingTeam RCS Galileo platform . HIGHTIDE : 6e59861931fa2796ee107dc27bfdd480 . Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443 .


data/configuration Exfiltration ;


Our research exposes how the malware roots infected devices and steals authentication tokens that can be used to access data from Google Play , Gmail , Google Photos , Google Docs , G Suite , Google Drive , and more . Early APT38 operations suggest that the group began targeting financial institutions with an intent to manipulate financial transaction systems at least as early as February 2014 , although we did not observe fraudulent transactions until 2015 . optblock_t for defeating control flow flattening ( defined as CFUnflattener ) In any case , the VBA code still runs whenever the files are executed .


We assess that the Lazarus group has been more careful in its attacks following the release of Operation AppleJeus and they have employed a number of methods to avoid being detected .


Targeted senior figures managed communications and media affairs , policy , speech writing , finance , and travel , while junior figures arranged schedules and travel for Hillary Clinton's campaign trail .


The malware leverages an exploit , codenamed EternalBlue” , that was released by the Shadow Brokers on April 14 , 2017 . Gallmaker 's targets are embassies of an Eastern European country .


But on rare occasions , a customer decides to go public with information about their incident and give us permission to share our knowledge of the adversary tradecraft with the broader community and help protect even those who do not happen to be our customers .


The properties of the artifact show that the same authors of the malware seem to have called it Xtunnel .


The malware sets a registry value ( whose name is read from the configuration file ) to “ C : \Windows\system32\rundll32.exe c : \ProgramData\AuditApp\d3d9.dll , Control_Run ” . APT35 also installed BROKEYOLK , a custom backdoor , to maintain persistence on the compromised host . One of the AES implementations makes use of the Intel AES-NI encryption instruction set which is supported by several modern Intel and AMD CPUs . By analyzing the source code , researchers can identify similar patterns and techniques used by different threat actors , providing defenders with a way to proactively detect and block the new variants at the initial stage of an attack .


24 Aug 2016 - 02:05PM Android/Twitoor is a backdoor capable of downloading other malware onto an infected device . Scattered Canary’s fraudulent history can be traced as far back as October 2008 , when the group first arrived on the cybercriminal circuit . cyberattacks against high-value targets in Ukraine in December 2015 and December 2016 .


The Kaspersky Labs analysis of the Duke malware authors ’ working times is supported by our own analysis , as well as that performed by FireEye .


cmd.exe /c dir rasext.dll , cmd.exe /c dir msctfp.dat , cmd.exe /c tasklist /svc | findstr RasMan , cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan\ThirdParty /v DllName /d rasext.dll /f .


Of those , 21 were still available at the time of discovery . ESET recently analyzed a new Mac OS sample from the OceanLotus group that had been uploaded to VirusTotal . Loading the dropped library .


By targeting high-tech and manufacturing operations in Japan and Taiwan , DragonOK may be acquiring trade secrets for a competitive economic advantage . The dropped PE file has the distinctive file name 8.t” .


DanderSpritz is the framework for controlling infected machines , different from FuZZbuNch as the latter provides a limited toolkit for the post-exploitation stage with specific functions such as DisableSecurity and EnableSecurity for DarkPulsar . The Windows 10 Creators Update will bring several enhancements to Windows Defender ATP that will provide SOC personnel with options for immediate mitigation of a detected threat .


The shell backdoor then installs the RCSAndroid agent . From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space . the original implementation of the code only works in MMAT_LOCOPT maturity level . Adversaries may manipulate physical process control within the industrial environment .


From our trend analysis seen in Figure 3 , Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August . Later that month , the same tactics and patterns were seen in attempts against an Iranian women 's activist – an individual commonly targeted by Iranian actors , such as Charming Kitten and the Sima campaign documented in our 2016 Black Hat talk .


The sample we analyzed is using RijndaelManaged with ECB mode and PKCS7 padding .


Estimating the damages is challenging , but as we learned , the criminals are siphoning off assets in transactions that do not exceed $15,000 each . The SWC of a Uyghur cultural website suggests intent to target the Uyghur ethnic group , a Muslim minority group primarily found in the Xinjiang region of China .


The version of the legitimate DroidVPN embedded inside this HenBox variant is the same version of DroidVPN available for download from uyghurapps [ . Winnti is targeting high-tech companies as well as chemical and pharmaceutical companies . Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries .


Perpetrated by an Arabic-Speaking APT Group : The modus-operandi of the attackers in conjunction with the social engineering tactics and decoy content seem aligned with previous attacks carried out by the Arabic-speaking APT group MoleRATs ( aka Gaza Cybergang ) .


Kelihos , like many others , implemented a sophisticated spam engine that automatically constructs spam messages from templates and additional inputs to avoid any patterns that can be used in filters . The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


WolfRAT is a specifically targeted RAT which we assess to be aimed at Thai individuals and , based on previous work from Wolf Research , most likely used as an intelligence-gathering tool or interception tool . On June 7 , 2013 , Rapid7 released an analysis of malware dubbed ' KeyBoy ' , also exploiting unknown vulnerabilities in Microsoft Office , similarly patched by MS12-060 , but allegedly targeting interests in Vietnam and India . FireEye believes the change from RIPTIDE to HIGHTIDE represents a temporary tool shift to decrease malware detection while APT12 developed a completely new malware toolset . We first heard of this new campaign thanks to a Mastodon post by Randy McEoin .


Use stringent file reputation settings .


The two C&C ’s hardcoded in the configuration block of the main binary are :


The domain on this campaign was registered on Jan. 19 , 2019 . Our report will detail the most recent campaigns conducted by APT10 , including the sustained targeting of MSPs , which we have named Operation Cloud Hopper , and the targeting of a number of Japanese institutions . OceanLotus : worker.baraeme.com:8888 11b4 . The Platform can look for indicators across file attachments , embedded links , and more and provides inplatform scoring .


On the Windows XP platform , this support is provided by the csrss.exe process .


This malware in turn intercepts fraudulent Lazarus cash withdrawal requests and sends fake approval responses , allowing the attackers to steal cash from ATMs . TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems .


As root , the application copies su binary to /system/bin directory and silently downloads apk file from the server . According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . DustySky has been developed and used since May 2015 by Molerats ( aka " Gaza cybergang " ) , a terrorist group whose main objective in this campaign is intelligence gathering .


After all , Stuxnet , widely regarded as the world ’s first known cyberweapon , was signed using stolen certificates from companies based in Taiwan with dates much earlier than Suckfly .


The doping allegations and prospective ban from the Games further ostracized Russia , and likely provided motivation to actively counter the allegations by attempting to discredit anti-doping agencies and policies .


Much of the activity was observed in the United States (Figure 11) , and the most targeted industry vertical was Aerospace/Defense Contractors (Figure 12) . A preliminary analysis caught the attention of our Threat Analysis and Intelligence team as it yielded interesting data that , among other things , shows that Silence was targeting employees from financial entities , specifically in the Russian Federation and the Republic of Belarus .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal . Primary targets for this adversary are in the government , aerospace , NGO , defense , cryptology and education sectors .


When required , the Trojan sends an SMS to the specified phone number with the information it has received from the intercepted message . The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 . In November 2017 , Secureworks Counter Threat Unit™ ( CTU ) researchers discovered the North Korean cyber threat group , known as Lazarus Group and internally tracked as NICKEL ACADEMY by Secureworks , had launched a malicious spearphishing campaign using the lure of a job opening for the CFO role at a European-based cryptocurrency company .


The two executables related to Hermes are bitsran.exe and RSW7B37.tmp . The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign .


” : ” load ” } Propagation The banking Trojan is propagated via phishing SMS containing a link and an offer to view a photo or MMS . After gaining access to a target network in one intrusion analyzed by CTU researchers , TG-3390 actors identified and exfiltrated data for specific projects run by the target organization , indicating that they successfully obtained the information they sought . Another variant executes a set of commands once a system is successfully compromised . Bullock had spent many hours poring over the hundreds of thousands of emails that the Ashley Madison hackers stole from Biderman and published online in 2015 .


In this instance , the backdoor posts the data to the domain Nysura.com ( For more domains , please see the IOC section of this research ) .


Unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals . XENOTIME used credential capture and replay to move between networks , Windows commands , standard command-line tools such as PSExec , and proprietary tools for operations on victim hosts .


The infected application contains its payload inside the DEX file . These sub-domains simulate sub-sections of the main newspapers in Spain plus some international ones like the Guardian and the Washington Post . It replaces the contents of the legitimate process with malicious code . The RAT 's main binary is launched from " C:\Users\%username%\AppData\Roaming\BranScale\client32.exe " .


Background Uncovering PHAs takes a lot of detective work and unraveling the mystery of how they 're possibly connected to other apps takes even more . On it , MoneyTaker install a legitimate tool for penetration testing – Metasploit . Following the exploitation of the EPS and CVE-2015-1701 vulnerabilities , the exploit payload drops either a 32-bit or 64-bit binary containing an embedded IRONHALO malware sample . If the system is in a single - system domain , it will execute on the local computer .


Our researchers are working closely with Google to investigate the source of the Gooligan campaign . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank . it is important to understand Hex-Rays maturity levels . None The bottom line is that BadBlood is not one of its kind however , for Charming Kitten , it implies a shift in target and collection priorities as they usually target dissidents , academics , diplomats , and journalists in order to further Iranian IRGC interests .


These targets include foreign affairs government organizations both localized and abroad , and defense organizations ’ presence localized , located in Europe and also located in Afghanistan .


If any application from that list was found , it utilizes the Janus vulnerability to inject the “ boot ” module into the repacked application . The threat actors have continually used Flash Player installers and Flash slideshows for decoys . 2 、An MSI package file downloaded from one of the URLs ; During the SolarWinds Compromise , APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement .


The files appear to include logs from 2013 that show the NSA was also targeting oil and investment companies across the Middle East . The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People 's Republics .


It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in . We believe Emissary Panda exploited a recently patched vulnerability in Microsoft SharePoint tracked by CVE-2019-0604 , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell .


Red Alert 2.0 is a banking bot that is currently very active online , and presents a risk to Android devices . Given the lapse in time between the spear-phishing and the heist activity in the above example , we suggest two separate but related groups under the North Korean regime were responsible for carrying out missions ; one associated with reconnaissance ( TEMP.Hermit or a related group ) and another for the heists ( APT38 ) . HexRaysDeob is an IDA Pro plugin written by Rolf Rolles to address obfuscation seen in binaries . Simultaneously , a threat researcher outside of CrowdStrike discovered an attacker ’s tooling via an open repository , downloaded all of the tools , and made them available through a MegaUpload link in a Twitter post.2


While the URL acts similarly to how eye-watch.in : 443 delivers payloads , we also saw the URL leveraging and exploiting security flaws in Flash : CVE-2015-8651 , CVE-2016-1019 , and CVE-2016-4117 . At the beginning of March 2018 , as part of our regular tracking of Turla 's activities , we observed some changes in the Mosquito campaign .


Sofacy Continues Global Attacks and Wheels Out New Cannon Trojan .


Communication between both Trojans and their C & C servers is based on the same principle , the relative addresses to which Trojans send network requests are generated in a similar manner , and the set of possible commands that the two Trojans can perform also overlaps . Recently , CTU researchers responded to an intrusion perpetrated by Threat Group-1314 , one of numerous threat groups that employ the " living off the land " technique to conduct their intrusions . Once infected , the C&C commands for the infected system launches a loud scanning activity and spreads the botnet by sending a “ whole kit ” of binary files at once with naming conventions same as the ones already in the targeted host , likely banking on breaking through via “ security through obscurity. ” They attempted to evade traffic inspection by encoding the code for the scanner with base-64 . In April 2021 , a new campaign by OilRig was discovered by researchers at Checkpoint in which the group employed a new backdoor variant dubbed SideTwist against what appears to be a Lebanese target .


As many people use their mobile devices for online shopping and even to manage their bank accounts , the mobile arena became increasingly profitable for cyber criminals . In order to carry out this operation , it uses publicly available tools , including Mimikatz ( Hacktool.Mimikatz ) and an open-source tool that exploits a known Windows privilege escalation vulnerability ( CVE-2016-0051 ) on unpatched computers . MSPs therefore represent a high-payoff target for espionagefocused threat actors such as APT10 .


Also , the longer the delay , the lower the risk of the user associating the unwanted ads with a particular app . We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages . The last campaign was started a few days ago and is still active .


In June 2018 , APT41 sent spear-phishing emails using an invitation lure to join a decentralized gaming platform linked to a cryptocurrency service (Figure 5) that had positioned itself as a medium of exchange for online games and gambling sites . Throughout our investigation , we have found evidence that shows operational similarities between this implant and Gamaredon Group .


A XENOTIME to Remember : Veles in the Wild .


It contains encrypted java archive “ start.ogg ” in the assets directory and dynamically loads code with dalvik.system.DexClassLoader . One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . This operation has targeted managed IT service providers , the compromise of which provides APT10 with potential access to thousands of further victims .


First described by Kaspersky in 2014 and later by Cylance in 2017 , Machete is a piece of malware found to be targeting high profile individuals and organizations in Latin American countries . The initial indicator of the attack was a malicious Web shell that was detected on an IIS server , coming out of the w3wp.exe process .


X-Force IRIS researchers studied Shamoon ’s attack life cycle and observed its tactics at Saudi-based organizations and private sector companies .


Again , this deployment was likely a part of their focus on NATO targets .


Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015 . Throughout the years , the Mofang group has compromised countless servers belonging to government or other Myanmar related organizations , in order to stage attacks .


We don't have hard evidence of how Suckfly obtained information on the targeted user , but we did find a large open-source presence on the initial target .


A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . We also observed exploits against older ( patched ) vulnerabilities , social engineering techniques and watering hole strategies in these attacks .


Second , the hex-encoded string is the C&C used by the custom backdoor while in the Delphi backdoor the C&C is embedded in the configuration .


We detonated the file in VxStream ’s automated malware analysis capability and found testproj.exe dropped a benign Microsoft Word document that pulls a jpg file from treestower.com .


Many of the default strings in this application are in Arabic , including the name . In 2010 US-based HBGary investigated an information security incident related to the Winnti group at one of HBGary 's customers – an American video game company . If a user or an application modifies the ZxShell service registry key , the code restores the original infected service key and values . The majority of the Excel campaigns show some element of luring the user to enable macros in Excel with specific content using Ukrainian language .


On March 12 and March 14 , we observed the Sofacy group carrying out an attack on a European government agency involving an updated variant of DealersChoice .


] 102 2020-04-14 http : //pub.douglasshome [ . Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina . menuPass also heavily favors spear phishing , and so takes steps to socially engineer their spear phishes for maximum appearance of legitimacy .


Being aware of this fact can help create defensive strategies , as well as prepare for upcoming attacks . Instead , we observed the two Russian espionage groups compromise the same systems and engage separately in the theft of identical credentials . The processor function builds a list of files from the files with content that match rcvd* in the receivebox . Vice Society ’s targeting of education is undoubtedly deliberate and has likely allowed the gang to develop domain - specific techniques and expertise .


In the observed version of the implant it doesn ’ t have an interface to work with the skype_sync2.exe module . From our first malicious sample encounter back in mid-September until now , we have observed 12 infected applications , the majority of which are in the system utility category . Lotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia .


It comes fully loaded with a number of plug-ins to give an attacker complete control of the compromised computer .


The group targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy . Attackers behind Dyre have used similar tactics in the past but have only deployed their attacks in English speaking countries and Spain .


It appears hacking group Outlaw , which has been silent for the past few months , was simply developing their toolkit for illicit income sources .


Recently there was a huge wave of SMS messages , as well as Whatsapp messages , making the rounds asking users to download the latest version of TikTok at hxxp : //tiny [ . Throughout our investigation , we have found evidence that shows operational similarities between this implant and Gamaredon Group . Distinct changes to Azazel by the Winnti developers include the addition of a function named ‘ Decrypt2 ’ , which is used to decode an embedded configuration similar to the core implant .


The data entered by the user is sent to the cybercriminals . When G-Data published on Turla/Uroburos back in February , several questions remained unanswered . ZxShell ( aka Sensocode ) is a Remote Administration Tool ( RAT ) used by Group 72 to conduct cyber-espionage operations . If we look at our previous cyberattack incident , a spear phishing attack likely left indications of malicious browser redirects and malware installation attempts .


Sending text “ confirm 1 ” will include proof of payment . The OilRig group ( AKA APT34 , Helix Kitten ) is an adversary motivated by espionage primarily operating in the Middle East region . The fact that this attacker decided to leverage cloud services and four different services — and not their own infrastructure — is smart from an opsec point of view . Monitor and analyze traffic flows that do not follow the expected protocol standards and traffic flows ( e.g extraneous packets that do not belong to established flows , or gratuitous or anomalous traffic patterns ) .


The data targeted for theft also have similar formats . ScarCruft has several ongoing operations , utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer . Kaspersky Lab has been able to retrieve some of these exchanges from a FIN7 target . But a potential of attackers to misuse such access to infect hundreds of millions of Internet users creates a great risk . "


This type of activity and the malicious use of stolen certificates emphasizes the importance of safeguarding certificates to prevent them from being used maliciously .


In early versions of Asacub , .com , .biz , .info , .in , .pw were used as top-level domains . CTU researchers assess with high confidence that TG-3390 uses information gathered from prior reconnaissance activities to selectively compromise users who visit websites under its control . The honeynet graphs , which show activity peaks associated with specific actions , also suggest that the scans were timed . When ransomware source code or builders are leaked , it becomes easier for aspiring cybercriminals who lack the technical expertise to develop their own ransomware variants by making only minor modifications to the original code .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . A variety of malware , including the PlugX tool , was shared with other known Chinese threat groups .


Note : Industrial safety instrumented systems comprise part of a multi-layer engineered process control framework to protect life and environment .


At this point , the attackers know the user has opened the document and send another spear-phishing email , this time containing an MS Word document with an embedded executable . In August and October 2016 we observed a malware operation targeting members of the Tibetan Parliament ( the highest legislative organ of the Tibetan government in exile , formally known as Central Tibetan Administration ) .


Quasar serve does not verify that the size , filename , extension , or header of the uploaded file is the same as requested .


PROMETHIUM uses a unique set of tools and methods to perform actions like lateral movement and data exfiltration . XENOTIME rose to prominence in December 2017 when Dragos and FireEye jointly published details of TRISIS destructive malware targeting Schneider Electric 's Triconex safety instrumented system .


These socially engineered emails contain web links of weaponized documents containing exploits or macros . Cadelle , uses Backdoor.Cadelspy .


The regular expressions suggest that the C2 server responds with content that is meant to resemble HTTP Live Steaming ( HLS ) traffic , which is a protocol that uses HTTP to deliver audio and video files for streaming .


The group continued this pattern with occasional URL campaigns and attached HTML files bearing malicious links .


All of these domains are registered to ‘ Li Jun Biao ’ on Bizcn , Inc , a Chinese Internet application service provider . From February to April 2019 , MuddyWater launched a series of spear-phishing attacks against governments , educational institutions , financial , telecommunications and defense companies in Turkey , Iran , Afghanistan , Iraq , Tajikistan and Azerbaijan . APT15 then used a tool known as RemoteExec ( similar to Microsoft .


This technique is associated with the Korplug S-MAL/Plug-x malware and is frequently used in China based cyberespionage activity .


Specifically , on the 19th of January 2010 security researcher Tavis Ormandy disclosed a local privilege escalation vulnerability ( CVE-2010-0232 ) affecting Microsoft Windows .


However , full details on XENOTIME and other group tools , techniques , procedures , and infrastructure is available to network defenders via Dragos WorldView .


As detailed in the previous section , this malware is able to manipulate and exfiltrate emails . It is worth noting that attackers used the same compromised websites to spread Buhtrap as those that had been used for the Corkow Trojan .


A full list of the domains can be seen here .


'' This class will open a WebView with a Google-themed page asking for payment in order to use the Google services . Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe . On occasion the APT37 directly included the ROKRAT payload in the malicious document and during other campaigns the attackers leveraged multi-stage infection processes .


If you want to know more about them — our researchers have an article about them on Securelist . Our analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . In these websites they hosted malware that was digitally signed with a valid , likely stolen code signing certificate .


RuMMS samples and C2 servers Figure 8 shows how these samples , C2 servers and hosting websites are related to each other , including when they were compiled or observed . This latest attack consisted of three waves between May and June 2018 . We identified three malicious Microsoft Office B-IDTY I-TOOL documents that download and load an additional Office document with a Macro . “ And his access was never shut off until today ? , ” asked the company ’s general counsel Mike Dacks .


At this time of writing , FireEye Multi Vector Execution (MVX) engine is able to recognize and block this threat . This alert 's IOC files provide HIDDEN COBRA indicators related to FALLCHILL .


TimeReceiver android.intent.action.ACTION_TIME_CHANGED System notification that the time was set . Selective deployment of ROCKBOOT suggests that APT41 reserves more advanced TTPs and malware only for high-value targets . Several sources consider APT28 a group of CyberMercs based in Russia .


The most advanced mobile malicious programs today are Trojans targeting users ’ bank accounts – the most attractive source of criminal earnings . The malicious loader will use dynamic-link library ( DLL ) hijacking — injecting malicious code into a process of a file/application — on sidebar.exe and launch dllhost.exe ( a normal file ) . Once installed on the system , ShadowPad starts a hidden and suspended Microsoft Windows Media Player wmplayer.exe process and injects itself into that process . Although we have not identified sufficient evidence to determine the origin or purpose of COSMICENERGY , we believe that the malware was possibly developed by either Rostelecom - Solar or an associated party to recreate real attack scenarios against energy grid assets .


Unlike HammerDuke however , the URLs for the images downloaded by GeminiDuke are hardcoded in its initial configuration , rather than retrieved from Twitter .


The Conversations modified samples differ from the original one in the getKnownHosts method that was modified to replace the main XMPP host with the attackers ’ C2 server : It appears that the attackers were using a specific C2 for the use of that app . From Buhtrap perpetrating cybercrime for financial gain , its toolset has been expanded with malware used to conduct espionage in Eastern Europe and Central Asia . But before the ScarCruft infection , however , another APT group also targeted this victim with the host being infected with GreezeBackdoor on March 26, 2018 .


Furthermore , it can grant the “ com.qualcmm.timeservices ” app Device Administrator rights without any interaction with the user , just by running commands . Working backwards from each Internet address , I was able to see that in the last few months of 2018 the hackers behind DNSpionage succeeded in compromising key components of DNS infrastructure for more than 50 Middle Eastern companies and government agencies , including targets in Albania , Cyprus , Egypt , Iraq , Jordan , Kuwait , Lebanon , Libya , Saudi Arabia and the United Arab Emirates . We first published details about the APT in our January 2010 M-Trends report . These URLs provide access to the C2s , which then provide potential commands and encrypted transfers of additional backdoors onto the system via GIF files .


It checks for different kinds of emulators , including QEMU , Genymotion , BlueStacks and Bignox . Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document . Kaspersky Lab verdicts for the malware used in this and related attacks . None After initial access via this new exploit method , the threat actor leveraged maintain access , and performed anti - forensics techniques on the Microsoft Exchange server in an attempt to hide their activity .


For system administrators and information security professionals , configuring the router to be more resistant to attacks like DNS cache poisoning can help mitigate similar threats . Lazarus was linked to the $81 million theft from the Bangladesh central bank in 2016 , along with a number of other bank heists . Since then , threat actors leveraging Winnti malware have victimized a diverse set of targets forvaried motivations .


Fast forward five months to the current attacks and we see exploitation of the same vulnerability at government organizations in two different countries compared to the April attacks .


Using a profiling script to deploy zero-days and other tools more selectively , decreasing the chance that researchers and others will gain access to the group ’s tools .


Chrysaor was never available in Google Play and had a very low volume of installs outside of Google Play . Another intrusion approach used by Leafminer seems a lot less sophisticated than the previously described methods but can be just as effective : using specific hacktools to guess the login passwords for services exposed by a targeted system . Yet again , new supply-chain attacks recently caught the attention of ESET Researchers . The attackers also leveraged DLL sideloading in that campaign to load their HyperBro malware .


PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more . It employs AES in addition to SID tricks , making it difficult to decrypt sensitive data .


Transparent Tribe has been active for several years and conducting suspected intelligence collection operations against South Asian political and military targets . Kaspersky Lab products detect the Octopus Trojan as Trojan.Win32.Octopus.gen .


It loads code from encrypted resources dynamically , which most detection engines can not penetrate and inspect . A preliminary analysis caught the attention of our Threat Analysis and Intelligence team as it yielded interesting data that , among other things , shows that Silence was targeting employees from financial entities , specifically in the Russian Federation and the Republic of Belarus . We also spotted several typical FIN7 targets , such as retailers and hotels . Most do n’t even do much besides Since the most common allowed domain is google-analytics.com ( 17 K websites )


CTU researchers have evidence that the TG-3390 compromised U.S and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations . The first ( port 5555 ) proxy first finds the IP parameter .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 . The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll .


The payload features are similar to the previous versions of Seduploader .


This information can provide an initial means by which to assess the scope of the breach .


At the same time , cybercriminals are reluctant to change the method of communication with the C & C server , since this would require more effort and reap less benefit than modifying the executable file . BRONZE UNION threat campaigns that illustrate the evolution of the group 's methods and espionage objectives . Users can also adopt a multilayered security solution that can protect systems from the gateway to the endpoint , actively blocking malicious URLs by employing filtering , behavioral analysis , and custom sandboxing . Later in the month , Microsoft officially confirmed that numerous outages of its products were a direct result of DDoS attacks conducted by Anonymous Sudan .


PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries . The C&C server ( 82.137.255.56 ) used by the above backdoors was used by APT-C-27 ( Goldmouse ) many times since 2017 .


The following are IOCs related to this domain :


addWifiConfig method code fragments ‘ camera ’ – this command records a video/capture a photo using the front-facing camera when someone next unlocks the device . For example , on a Saudi government website , the NewsBeef APT delivered packed JavaScript into the bottom of a referenced script that is included in every page served from the site the packed and unpacked JavaScript is shown below . They have targeted the telecommunication and travel industries to collect personal information that aligns with Iran 's national priorities .


Strazzere advises that consumers should look at the pedigree of mobile manufacturers and take a close look at their security track record before making a decision on what device to buy . In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document . Unknown .


Our data shows , on average , about three requests per hour to the drop host . These aims outlined in the FYP will largely dictate the growth of businesses in China and are , therefore , likely to also form part of Chinese companies ' business strategies . OceanLotus : SOFTWARE\Classes\CLSID\{57C3E2E2-C18F-4ABF-BAAA-9D17879AB029} 11b4 . In the UK , Vice Society accounts for a staggering proportion of known ransomware attacks on education — almost 70 % .


Typical web servers and applications only require GET , POST , and HEAD .


The average user might not have the necessary skills to distinguish legitimate sites from malicious ones . This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted with the Machete malware . Early APT38 operations suggest that the group began targeting financial institutions with an intent to manipulate financial transaction systems at least as early as February 2014 , although we did not observe fraudulent transactions until 2015 .


Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system . Delivering a backdoor and spyware , this campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video .


This will take the user through several steps until it collects all the necessary credit card information , which will be checked online and exfiltrated to the C2 . X-Force IRIS determined that the More_eggs backdoor later downloaded additional files , including a signed binary shellcode loader and a signed Dynamic Link Library (DLL) , as described below , to create a reverse shell and connect to a remote host . In the early part of 2017 , Group123 started the " Evil New Year " campaign .


Decoy documents – This campaign used PowerShell to download benign documents from the Internet and launch them in a separate Microsoft Word instance to minimize user suspicion of malicious activity .


Even threats like DNS cache poisoning employ social engineering , so users should also be more prudent against suspicious or unknown messages that have telltale signs of malware . WannaCry incorporated the leaked EternalBlue exploit that used two known vulnerabilities in Windows CVE-2017-0144 and CVE-2017-0145 to turn the ransomware into a worm , capable of spreading itself to any unpatched computers on the victim's network and also to other vulnerable computers connected to the internet . The underlying hypothesis is that themalware itself may be shared ( or sold ) across a small group of actors .


APT33 sent spear phishing emails to employees whose jobs related to the aviation industry . they have been last known to employ malware in February 2016 .


The application recording is implemented via two methods : Using the Android MediaRecorder class to capture a video of the screen when the targeted application is presented to the user Using the accessibility service to save a text file containing the data of all the objects on the screen Both files are later sent to the C & C server of the attacker . First , the attacker’s mission is to disrupt an operational process rather than steal data . Symantec will continue to search for more Remsec modules and targets in order to build upon our understanding of Strider and better protect our customers .


Check Point reached out to Google on September 10 , 2015 , and the app containing the malware was removed from Google Play on September 15 , 2015 . One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . The 13th FYP was released in March 2016 and the sectors and organisations known to be targeted by APT10 are broadly in line with the strategic aims documented in this plan . These aims outlined in the FYP will largely dictate the growth of businesses in China and are , therefore , likely to also form part of Chinese companies ' business strategies .


Aside from the use of the custom trojan CapturaTela , the actor makes extensive use of several other remote access Trojans to perform its malicious activities . Silence try to apply new techniques and ACTs of stealing from various banking systems , including AWS CBR , ATMs , and card processing .


This version brings back the ACCESS_SUPERUSER and READ_FRAME_BUFFER permissions . This stands in opposition to the data gathered from export timestamps and C&C domain activity that points to Green Lambert being considerably older than the Blue variant . On Sunday August 24, 2014 we observed a spear phish email sent to a Taiwanese government ministry . Sandworm Team has used port 6789 to accept connections on the group 's SSH server.[34 ] Silence has used port 444 when sending data about the system from the client to the server.[35 ] StrongPity has used HTTPS over port 1402 in C2 communication.[36 ] SUGARUSH has used port 4585 for a TCP connection to its C2 .


Finally , the specific overlays are designed for Australian financial institutions , and Australia is one of the geographic regions that is accepted by the C2 . Several of these provide enterprise services or cloud hosting , supporting our assessment that APT10 are almost certainly targeting MSPs . OceanLotus : SOFTWARE\Classes\CLSID\{E3517E26-8E93-458D-A6DF-8030BC80528B} 7244 . As for who was hit the hardest , around 16 percent of ransomware incidents affecting State , Local , Tribal , and Tribunal ( SLTT ) governments were from LockBit , says the MS - ISAC .


) If the application hasn ’ t received instructions about the rules for processing incoming SMSs , it simply saves all SMSs to a local database and uploads them to the C & C . The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 . Bankshot is designed to persist on a victim 's network for further exploitation ; thus the Advanced Threat Research team believes this operation is intended to gain access to specific financial organizations .


These apps also had a large amount of downloads between 4 and 18 million , meaning the total spread of the malware may have reached between 8.5 and 36.5 million users . However , based on the findings shared in this report we assess with high confidence that the actor 's primary long-term mission is politically focused . These bytes are XOR encrypted with the byte-key 0x85 and contains a list of remote hosts where to connect . If you can not apply the KB5019758 patch immediately , you should disable OWA until the patch can be applied .


For example : WireLurker installed malicious apps on non-jailbroken iPhones Six different Trojan , Adware and HackTool families launched “ BackStab ” attacks to steal backup archives of iOS and BlackBerry devices The HackingTeam ’ s RCS delivered its Spyware from infected PCs and Macs to jailbroken iOS devices and BlackBerry phones Recently , we discovered another Windows Trojan we named “ DualToy ” which side loads malicious or risky apps to both Android and iOS devices via a USB connection . In addition to file-based protection , customers of the DeepSight has received reports on Buckeye , which detail methods of detecting and thwarting activities of this group . The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta .


Using names as keywords is an identical technique to that of the data structure logic previously documented by 360 ’s blog post .


In addition to the large number of Zebrocy attacks we discovered , we also observed instances of the Sofacy group leveraging the Dynamic Data Exchange ( DDE ) exploit technique previously documented by McAfee .


They go on to discuss how Nymaim uses a static configuration to contact that domain , which will return IP ’s that go into a DGA and output the actual IP addresses needed for C2 communication .


It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries . We noticed that this malware will not work for Mozilla Firefox or Google Chrome since these two browsers have their own root certificates .


The malware creates a global event named 0x0A7F1FFAB12BB2 and drops some files under a folder located in C : \ProgramData or in the user application data folder . Many of the fake personas utilized by APT35 claimed to be part of news organizations , which led to APT35 being referred to as the Newscaster Team . The loader uses the AES128 implementation from the open-source Crypto++2 library . The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier .


Earlier this month , we caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . The group subsequently stole communications related to the firm 's business relationship with a national military , including inventories and memoranda about specific products they provided .


Asset file before and after decryption Once the encrypted executable is decrypted and dropped in the storage , the malware has the definitions for all the components it declared in the manifest file . This time , APT15 opted for a DNS based backdoor : RoyalDNS . The second ZIP structure contains SHIPPING_MX00034900_PL_INV_pdf.exe , which is a NanoCore . The CozyDuke malware utilizes a backdoor and dropper , and exfiltrates data to a C2 server .


With default settings , SWAnalytics will scan through an Android device’s external storage , looking for directory tencent/MobileQQ/WebViewCheck” . Of particular note is their use of tools to identify systems vulnerable to CVE-2017-0144 , which is the same vulnerability exploited by EternalBlue that is best known for its use in the WannaCry attacks of 2017 .


Ironically the decoy document is a deceptive flyer relating to the Cyber Conflict U.S. conference .


Through correlation of technical indicators and command and control infrastructure , FireEye assess that APT28 is probably responsible for this activity .


This behavior negatively impacts advertisement networks and their clients because advertising budget is spent without acquiring real customers , and impacts user experience by consuming their data plan resources . In this report , we'll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . The Chinese government is therefore concerned whether a DPP victory might weaken the commercial and tourism ties between China and Taiwan , or even drive Taiwan closer to independence . While the full scope of the hack is still under investigation , reports indicate that the actors were primarily trying to steal sensitive information .


Earlier this year , we discovered apps hiding a JAR in the data section of an ELF file which it then dynamically loads using DexClassLoader . FIF is notable for its links to the Lashkar-e-Taiba ( LeT ) terrorist organization , which has committed mass-casualty attacks in India in support of establishing Pakistani control over the disputed Jammu and Kashmir border region . Apart from user-mode ZxShell droppers mentioned earlier , there is a file ( SHA256 : 1e200d0d3de360d9c32e30d4c98f07e100f6260a86a817943a8fb06995c15335 ) that installs a kernel device driver called loveusd.sys . None After initial access via this new exploit method , the threat actor leveraged maintain access , and performed anti - forensics techniques on the Microsoft Exchange server in an attempt to hide their activity .


Runtastic sample permission prompt Runtastic sample permission prompt Checking foreground app Marcher is one of the few Android banking Trojans to use the AndroidProcesses library , which enables the application to obtain the name of the Android package that is currently running in the foreground . Kaspersky Lab has detected a new method of first infection that uses a drive-by-download with a flash exploit ( CVE-2015-5119 , the one leaked from The Hacking Team incident ) . A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . For example , HTTPS over port 8088[1 ] or port 587[2 ] as opposed to the traditional port 443 .