Once inside the network of a hospitality company , APT28 sought out machines that controlled both guest and internal Wi-Fi networks .


China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool . Some examples of the files used in the email attachment include the following :


This infamous RAT has been associated with many different Chinese threat actors , including APT10 , APT1 , and DragonOK . For example , the actors behind FrozenCell used a spoofed app called Tawjihi 2016 , which Jordanian or Palestinian students would ordinarily use during their general secondary examination .


One might argue that since this took place after the exploits were publicly mentioned , the Dukes simply copied them .


de.postbank.finanzassistent pl.bph de.comdirect.android com.starfinanz.smob.android.sfinanzstatus de.sdvrz.ihb.mobile.app pl.ing.mojeing com.ing.mobile pl.ing.ingksiegowosc com.comarch.security.mobilebanking com.comarch.mobile.investment.ing com.ingcb.mobile.cbportal de.buhl.finanzblick pl.pkobp.iko pl.ipko.mobile pl.inteligo.mobile de.number26.android PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched . The complex infection chain begins with a weaponized Ofﬁce document named “ f.doc ” . Schools , colleges , and universities must somehow reconcile tight budgets with the need to deploy a sophisticated enough detection and response capability to find and evict stealthy adversaries like Vice Society .


Upon creation the class will start to take screenshots that will be stopped and uploaded to the C2 once the service ca n't find the targeted applications running . they have been last known to employ malware in February 2016 . Research into this HIGHTIDE campaign revealed APT12 targeted multiple Taiwanese Government organizations between August 22 and 28 . APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . Perhaps the most worrying discovery we made was that Thrip had targeted a satellite communications operator .


TG-3390 actors keep track of and leverage existing ASPXTool web shells in their operations , preferring to issue commands via an internally accessible web shell rather than HttpBrowser or PlugX .


Later , they were also associated with botnet IDs 7200 and 7500 .


Dropping Cluster Bombs RCSAndroid is a threat that works like a cluster bomb in that it deploys multiple dangerous exploits and uses various techniques to easily infect Android devices . Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa . The value of the variable is assigned to a specific register in each block then compared in a control flow dispatcher and other condition blocks . The initial payloads and second stage backdoors were removed from the system .


That finally started to change in 2013 .


HammerDuke is a set of backdoors that was first seen in the wild in February 2015 , while SeaDuke is a crossplatform backdoor that was , according to Symantec , first spotted in the wild in October 2014 .


For now , that is the only way how cybercriminals can profit from Triada , but don ’ t forget that it ’ s a modular Trojan , so it can be turned into literally everything on one command from the C & C server . Instead of Flash exploits , older Wild Neutron exploitation and watering holes used what was a Java zero-day at the end of 2012 and the beginning of 2013 , detected by Kaspersky Lab products as Exploit.Java.CVE-2012-3213.b . Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14 , 2017 , FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


They have taken interest in subject matter of direct importance to the Democratic People's Republic of Korea (DPRK) such as Korean unification efforts and North Korean defectors . First observed in mid-2014 , this malware shared code with the Bugat ( aka Feodo ) banking Trojan .


After successful execution , Downeks returns the results to the C2 S-TOOL server .


Moreover , there is a special handler for the accelerometer that is able to calculate and log the device ’ s speed : This feature is used in particular by the command “ tk0 ” that mutes the device , disables keyguard , turns off the brightness , uses wakelock and listens to device sensors . In this analysis , we observed the return of HIDDEN COBRA 's Bankshot malware implant surfacing in the Turkish financial system . APT33 : ae1d75a5f87421953372e79c081e4b0a929f65841ed5ea0d380b6289e4a6b565 S-SHA2 Remcos . Neither France or Germany have been spared by the growing menace of ransomware , either .


A cybersecurity company focusing on protecting industrial control systems .


Correlating these bytes to the standard configuration of Poison Ivy , we can observe the following :


Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities . As in the past , these messages have been sent accounts believed to be fake and accounts compromised by Infy , including Kurdish activists that had previously been compromised by the Flying Kitten actor group .


We were able to identify that 8,929 files had been exfiltrated from compromised devices and that the overwhelming majority of these , 97 percent , were highly likely encrypted images taken using the device camera . We suspect the Kazuar tool may be linked to the Turla threat actor group ( also known as Uroburos and Snake ) , who have been reported to have compromised embassies , defense contractors , educational institutions , and research organizations across the globe . It sets the service status to RUNNING and finally calls the ShellMain function of ZxShell . This campaign has a multi - stage attack chain that begins with a phishing email delivered to victims impersonating CoinPayments , a legitimate global cryptocurrency payment gateway .


Some of the apps we discovered resided on Google Play for several years , but all were recently updated . We assess with high confidence that the Winnti umbrella is associated with the Chinese state intelligence apparatus , with at least some elements located in the Xicheng District of Beijing . The thread KeyloggerThread is spawned and is responsible for doing keylogging on the target workstation . None Use of Python for malware development and/or packaging : We expect to continue to observe attackers compiling or packaging their OT malware via methods such as PyInstaller ( IRONGATE ) or Py2Exe ( TRITON ) given the proliferation of OT malware developed or packaged using Python in recent years .


They most commonly target Brazilian merchants , though others use the same tactics to exploit entities outside Brazil . Targeted sectors of Molerats include governmental and diplomatic institutions , including embassies ; companies from the aerospace and defence Industries ; financial institutions ; journalists ; software developers .


And finally , as every elephant , Babar has big ears and the malware is able to listen to conversations and log them by using the dsound and winmm libraries . It is possible that CVE-2017-8759 was being used by additional actors .


We identified file creation times for numerous files that TEMP.Veles created during lateral movement on a target ’s network .


From their high volume 0day deployment to their innovative and broad malware set , Sofacy is one of the top groups that we monitor , report , and protect against . 2017 was not any different in this regard .


Our investigation revealed an attack where the GCMAN group then planted a cron script into bank 's server , sending financial transactions at the rate of $200 per minute . Whenever users reboot their device or open up Network Speed Master , SWAnalytics will fetch the latest configuration file from http[:]//mbl[.]shunwang[.]com/cfg/config[.]json” .


For instance , Russian operators , such as Sandworm Team , have compromised Western ICS over a multi-year period without causing a disruption . Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library ( .dll )


A short , constant string of characters is inserted at strategic points to break up keywords : At runtime , the delimiter is removed before using the string : API OBFUSCATION SMS and toll fraud generally requires a few basic behaviors ( for example , disabling WiFi or accessing SMS ) , which are accessible by a handful of APIs . Deepen told Threatpost the group has been operating since at least since 2008 and has targeted China and US relations experts , Defense Department entities , and geospatial groups within the federal government . ZXHttpServer Run a custom HTTP server . In the case of the exploit method described here as OWASSRF , the endpoint is not used , in lieu , and the request will not be dropped .


] comakashipro [ . In order to initially compromise the designated targets , the attackers typically distributed specifically-crafted malicious documents containing Infy through spearphishing attacks . About half of APT1 ’s known zones were named according to three themes : news , technology and business . It even can restrict forms to be sent only to specific hosts , using the form - action directive .


After compromising an initial victim's system ( patient 0 ) , the threat actors use the Baidu search engine to search for the victim's organization name .


The addition of mobile threat defense into these capabilities means that Microsoft Defender for Endpoint ( previously Microsoft Defender Advanced Threat Protection ) now delivers protection on all major platforms . Unit 42 researchers have been tracking Gorgon Group for criminal and targeted attacks . The modified tool was tested with an ANEL 5.4.1 payload dropped from a malicious document with the following hash ( previously reported by FireEye ) : The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim 's Facebook account and ultimately hijack any Facebook Business account that the victim has sufficient access to .


It is possible that CVE-2017-8759 was being used by additional actors . March by security researchers from Kaspersky Labs .


VOODOO BEAR appears to be integrated into an organization that also operates or tasks multiple pro-Russian hacktivist entities . The admin@338 used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


The Democratic National Committee ’s ( DNC ) June 2016 announcement attributing its network breach to the Russian Government triggered an international debate over Russia ’s sponsorship of information operations against the U.S.


SHA256 f19bc664558177b7269f52edcec74ecdb38ed2ab9e706b68d9cbb3a53c243dec .


Finally , since publishing the 9002 blog , Unit 42 has also seen the aforementioned 9002 C2 used as a Poison Ivy C2 with a Myanmar political-themed lure . With the contents of the emails , included links and decoy PDFs all involving taxes , the attackers are apparently targeting the financial departments of organizations in the Balkans region . While Volexity does not typically engage in attempting attribution of any threat actor , Volexity does agree with previously reported assessments that OceanLotus is likely operating out of Vietnam .


The head of Germany ’s domestic intelligence agency , Bundesamt für Verfassungsschutz ( BfV ) , also attributed the June 2015 compromise of the Bundestag ’s networks to APT28 .


The pattern of infrastructure hosting suggests that the group parks its domains when not in use , an operational security technique that limits exposure of the group's overall hosting infrastructure .


If you follow the military analogy — those are the scouts . In this report , we'll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . In December 2015 , Symantec published a post about " two Iran-based attack groups that appear to be connected , Cadelle and Chafer " that " have been using Backdoor.Cadelspy and Backdoor.Remexi to spy on Iranian individuals and Middle Eastern organizations " .


As mentioned above , the threat used to compromise the targeted networks is Poison Ivy , a Remote Access Tool ( RAT ) .


FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including government institutions .


Recently , FireEye released a great report on one of the more active groups , now known as APT30 . The second Windows vulnerability ( CVE-2017-0143 ) was patched in March 2017 after it was discovered to have been used by two exploit tools EternalRomance and EternalSynergy that were also released as part of the Shadow Brokers leak .


They are mostly Western names , but there were some Arabic names in a few of the samples .


The compromised information was later leaked online .


In particular , DHS recommends that more research should be conducted on the North Korean cyber activity that has been reported by cybersecurity and threat research firms .


With the move to targeting select victims for high-value payouts , the INDRIK SPIDER adversary group is no longer forced to scale its operations , and now has the capacity to tailor its tooling to the victim 's environment and play a more active role in the compromise with " hands on keyboard " activity . ScarCruft also attacked a diplomatic agency in Hong Kong , and another diplomatic agency in North Korea .


On April 27 , the attackers scanned the corporate internal network for hosts with ports 8080 , 5900 , and 40 open .


Gaza Cybergang Group 2 with the Micropsia backdoor :


Just an hour and a half later they had compiled and delivered another AZZY x64 backdoor ( md5: 9D2F9E19DB8C20DC0D20D50869C7A373 , compiled August 4th , 2015 ) .


The nativesend method uses the Java Native Interface ( JNI ) to fetch and call the Android SMS API . However , to increase success rates APT20 can use zero-day exploits , so even a properly patched system would be compromised . CloseFW Switch off Windows Firewall . The group appears to commonly deploy double extortion of the victims that have been listed on the leak site , several of them have had some portion of their exfiltrated data exposed .


In the following weeks , FireEye released threat intelligence products and updated malware profiles to customers while developing new detection techniques for APT32’s tools and phishing lures . The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


His group configured the DCLeaks and Guccifer 2.0 blogs and social media accounts that would later be used to spread data stolen from the DNC , DCCC , and Clinton campaigns .


The group also creates and maintains scheduled tasks to achieve this purpose .


] infomavis-dracula [ . Until late December 2015 , in nearly every Infy message documented since our tracking began in May 2013 , no attempt included strong tailoring of the approach , often not even including an email body , instead relying on cryptic filenames and email subjects to attract interest . For example , “ shanghai ” is not a street name . Monitor for newly constructed services / daemons that may attempt to hide artifacts associated with their behaviors to evade detection .


Flash exploit triggers CVE-2015-3043 , executes shellcode .


PwC UK and BAE Systems , working closely with industry and government , have uncovered a new , unparallelled campaign which we refer to as Operation Cloud Hopper . While investigating KerrDown we found multiple RAR files containing a variant of the malware .


It steals credentials from various FTP clients , Outlook , and Internet Explorer .


Many of these samples appear to be designed specifically to attempt to slip into the Play Store undetected and are not seen elsewhere . APT Anchor Panda is a Chinese threat actor group who target maritime operations . S-TOOLwill recognize the outgoing connection as originated by the browser instead of the ZxShell service host process . Attackers send these emails to multiple accounts , hoping that someone will believe the story , and pay up .


The new Android ransomware variant overcomes these barriers by evolving further than any Android malware we ’ ve seen before . Several additional documents surfaced between January 17 and February 3 . This allows an analyst to quickly check if there are any lost blocks by control flow unflattening . one base64 encoded string but multiple , separated by a character .


To facilitate lateral movement , the adversaries deploy ASPXTool web shells to internally accessible systems running IIS .


All of the victims are located in Italy . When we first discovered the OilRig attack campaign in May 2016 , we believed at the time it was a unique attack campaign likely operated by a known , existing threat group . In fact , this is one of the first checks it performs when it is executed . Cisco Talos is aware of the recent advisory published by the U.S. Department of Health and Human Services ( HHS ) warning the healthcare industry about Rhysida ransomware activity .


In addition , admin.nslookupdns [ . APT41 has also deployed rootkits and Master Boot Record (MBR) bootkits on a limited basis to hide their malware and maintain persistence on select victim systems . In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines .


Dragos instead focuses on threat behaviors and appropriate detection and response .


Sets file creation timestamp to that of “ %SYSTEM%\sfc.dll ” .


In other words , TrickMo ’ s service will start either after the device becomes interactive or after a new SMS message is received . Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . During this testing , we saw document filenames that contain the C2 we witnessed in the targeted attack above , specifically the filenames XLS-withyourface.xls and XLS-withyourface – test.xls .


For the initial infection , PLATINUM typically sends malicious documents that contain exploits for vulnerabilities in various software programs , with links or remotely loaded components ( images or scripts or templates ) that are delivered to targets only once . The exploit document carrying this alternate KeyBoy configuration also used a decoy document which was displayed to the user after the exploit launched .


The source code for the malware powering this botnet was eventually leaked online .


Summary PHA authors go to great lengths to come up with increasingly clever ways to monetize their apps . The PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) . APT18 . The web page “ JavaApplet.html ” loads “ JavaApplet.class ” that implements a Java exploit for the recently discovered vulnerability CVE-2013 - 0422 .


APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia . The Taidoor attackers have been actively engaging in targeted attacks since at least March 4 , 2009 .


The first function is used for contact information stealing : the function upCon steals all contacts in the contact list and their information . The other overlapping files are tools used by the adversary to locate other systems on the network etool.exe , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 checker1.exe and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket psexec.exe . Honeybee appears to target humanitarian aid and inter-Korean affairs .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . this library includes two drivers compiled on August 22 and September 4 , 2014 .


Analysis of the emails has shown that the attachment contains an exploit for the CVE-2017-11882 vulnerability . That said , the " fingerprints " left on the samples by the attackers – including techniques used to achieve unauthorized code execution – suggest that the BARIUM APT is behind the effort , according to the researchers .


They pack the malware with a powerful commercial tool called Enigma Packer and implement language checks to ensure the victims are Arabic speaking .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . Taking that into account , we classify the Lamberts as the same level of complexity as Regin , ProjectSauron , Equation and Duqu2 , which makes them one of the most sophisticated Cyber Espionage toolkits we have ever analysed .


Because the rootkit resides within a computer ’s flash memory , it allows the attackers to maintain a persistent presence on a compromised machine even if the hard drive is replaced or the operating system is reinstalled .


Gustuff advertising screenshot The companies advertised in the image above were from Australia , which matches up with the campaign we researched . The tactical malware , historically EvilGrab , and now ChChes ( and likely also RedLeaves ) , is designed to be lightweight and disposable , often being delivered through spear phishing . We are not able to calculate the total count of affected users based only on our data ; however , we estimate that the real scale of the problem is much bigger and is possibly affecting over a million users worldwide . Network traffic and process related telemetry to / from host(s ) operating the MicroSCADA software .


Stealing SMS Figure 10 : Stealing SMS messages . It is noteworthy that the attackers never used the FuzzBunch framework in its attacks . The group uses custom malware as well as “ living off the land ” techniques .


Confucius' operations include deploying bespoke backdoors and stealing files from their victim 's systems with tailored file stealers , some of which bore resemblances to Patchwork 's . CTU researchers have observed the threat group obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both .


The Dukes actively targeted Ukraine before the crisis , at a time when Russia was still weighing her options , but once Russia moved from diplomacy to direct action , Ukraine was no longer relevant to the Dukes in the same way .


In Asia there are numerous companies producing Android-based devices and Android apps , and many of them offer users their own app stores containing programs that can not be found in Google Play . This time the group chose a national data center as its target from an unnamed country in Central Asia in an attempt to gain " access to a wide range of government resources at one fell swoop " . This executable is from HP and is usually installed with their printing and scanning software called “ HP Digital Imaging ” . So , instead of wasting time trying to figure out what is going on , I debugged the script using the browser .


In other words , the C2 server can specify the message contents to be sent , the time period in which to forward the voice call , and the recipients of outgoing messages . Victims of BlackOasis have been observed in the following countries : Russia , Iraq , Afghanistan , Nigeria , Libya , Jordan , Tunisia , Saudi Arabia , Iran , Netherlands , Bahrain , United Kingdom and Angola . At the end , “ templates.vbs ” script will force the machine to reboot . PBI Research Services also reported a data breach that exposed information for 4.75 million people .


Coinminer.Linux.MALXMR.SMDSL64 : 649280bd4c5168009c1cff30e5e1628bcf300122b49d339e3ea3f3b6ff8f9a79 .


We have been monitoring the activities of this group and believe they are operating from China . Group-IB reports that MoneyTaker uses both borrowed and their own self-written tools .


During 2016 , Symantec observed some overlap between the command and control ( C&C ) infrastructure used by Earworm and the C&C infrastructure used by Grizzly Steppe ( the U.S. government code name for APT28 and related actors ) , implying a potential connection between Earworm and APT28 .


Of note , the macro contained a DownloadFile() function that would use URLDownloadToFileA , but this was never actually used .


Indeed , due to its ability to hide it ’ s icon from the launcher and impersonates any popular existing apps on a device , there are endless possibilities for this sort of malware to harm a user ’ s device . The developers of Bookworm use these modules in a rather unique way , as the other embedded DLLs provide API functions for Leader to carry out its tasks . These activity groups are also unusual in that they use the same zero-day exploit to launch attacks at around the same time in the same region . Some TrickBot samples have used HTTP over ports 447 and 8082 for C2 .


In order to carry out this operation , it uses publicly available tools , including Mimikatz ( Hacktool.Mimikatz ) and an open-source tool that exploits a known Windows privilege escalation vulnerability ( CVE-2016-0051 ) on unpatched computers . Dell SecureWorks researchers unveiled a report on Threat Group-3390 that has targeted companies around the world while stealing massive amounts of industrial data .


U.S. President Donald Trump has ordered ByteDance , the parent company of TikTok , to sell its U.S. TikTok assets and also issued executive orders that would ban the social media apps TikTok and WeChat from operating in the U.S. if the sale doesn ’ t happen in the next few weeks . The attack , which starts with a malicious attachment disguised as a top secret US document , weaponizes TeamViewer , the popular remote access and desktop sharing software , to gain full control of the infected computer . While reviewing a 2015 report of a Winnti intrusion at a Vietnamese gaming company , we identified a small cluster of Winnti samples designed specifically for Linux .


Nitro 's campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes . this SWC was used to specifically target Turkish .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . In this case , the file used the software name " Cyberlink " , and a description of " CLMediaLibrary Dynamic Link Library " and listing version 4.19.9.98 .


There are two more reasons why Triada is so hard to detect and why it had impressed our researchers so much . Nevertheless , resourceful threat actors such as ScarCruft will probably continue to deploy zero-day exploits against their high profile targets . It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries .


The name Spark is derived from the PDB path left in a few of the backdoor binaries :


This allows the application to appear legitimate , especially given these applications icons and user interface . Additionally , with the assistance of our FireEye Labs Advanced Reverse Engineering (FLARE) , Intelligence , and Advanced Practices teams , we identified three new malware families and a reappearance of PICKPOCKET , malware exclusively observed in use by APT34 . The GCMAN group has moved beyond banks and is now targeting the budgeting and accounting departments in any organization of interest to them , using the same APT-style tools and techniques .


Or thirdly , the Dukes may have invested so much into these campaigns that by the time FireEye published their alert , the Dukes felt they could not afford to halt the campaigns .


Smishing : The Major Way To Distribute RuMMS We have not observed any instances of RuMMS on Google Play or other online app stores . These attacks have involved social engineering , spearphishing attacks , exploitation of Microsoft Windows operating systems vulnerabilities , Microsoft Active Directory compromises , and the use of remote administration tools ( RATs ) in targeting and harvesting sensitive competitive proprietary operations and project-financing information with regard to oil and gas field bids and operations . By simply opening the SFX archive , it is possible to notice two different ﬁles that are shown below and named respectively “ 8957.cmd ” and “ 28847 ” . In one particular forum post , Hack520 mentions that he was previously jailed for a period of 10 months in a blog post dated May 31 , 2009 .


But before we go into the details of what the latest version of Rotexy can do and why it ’ s distinctive , we would like to give a summary of the path the Trojan has taken since 2014 up to the present day . The Korean-language Word document manual.doc appeared in Vietnam on January 17 , with the original author name of Honeybee . Lazarus group could have been active since late 2016 , was used in a recent campaign targeting financial institutions using watering hole attacks .


The extent of information that these kinds of threats can steal is also significant , as it lets attackers virtually take over a compromised device . While Silence had previously targeted Russian banks , Group-IB experts also have discovered evidence of the group 's activity in more than 25 countries worldwide . While tracking numerous threat actors on a daily basis during the final days of 2018 and at the beginning of 2019 , we discovered various activity clusters sharing certain TTPs associated with the FIN7 intrusion set . and % HiddenKey% as part of its persistence via the Windows registry.[6 ] OSX / Shlayer has used the mktemp utility to make random and unique filenames for payloads , such as export tmpDir="$(mktemp -d /tmp / XXXXXXXXXXXX ) " or mktemp -t Installer .


5ac6901b232c629bc246227b783867a0122f62f9e087ceb86d83d991e92dba2f Adobe Flash Player solution.rail.forward 7eb239cc86e80e6e1866e2b3a132b5af94a13d0d24f92068a6d2e66cfe5c2cea Adobe Flash Player com.pubhny.hekzhgjty 14a1b1dce69b742f7e258805594f07e0c5148b6963c12a8429d6e15ace3a503c APT10 actors gained initial access to the Visma network around August 17 , 2018 . HomamDownloader was discovered to be delivered by Tick via a spearphishing email .


Overall , Cerberus has a pretty common feature list and although the malware seems to have been written from scratch there does not seem to be any innovative functionality at this time . Backdoor installed in the infected system distributed additional botnet malware , ransomware and email stealers . In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets .


] today PHA Family Highlights : Zen and its cousins January 11 , 2019 Google Play Protect detects Potentially Harmful Applications ( PHAs ) which Google Play Protect defines as any mobile app that poses a potential security risk to users or to user data—commonly referred to as " malware . Since that time , the group attacked companies in California , Utah , Oklahoma , Colorado , Illinois , Missouri , South Carolina , North Carolina , Virginia and Florida . Between November 26, 2015, and December 1, 2015, known and suspected China based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries . This activity suggested exploitation of CVE-2021 - 26858 .


For this purpose , these actors often use tools such as Technitium MAC Address Changer . APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors .


Both groups can set permissions on specific files to Everyone , and work in tandem with the PLATINUM backdoors . WildFire correctly classifies NetTraveler as malicious .


The CIA's Mobile Devices Branch (MDB) developed numerous attacks to remotely hack and control popular smart phones . This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics .


The main DLL is called " Reznov.DLL . China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool . We expect APT33 activity will continue to cover a broad scope of targeted entities , and may spread into other regions and sectors as Iranian interests dictate .


Here ’ s another example of such an attack hitting Windows users : Going back to the Android Package ( APK ) file was attached to the e-mail , this is pushing an Android application named “ WUC ’ s Conference.apk ” . PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched . It was during operator X 's network monitoring that the attackers placed Naikon proxies within the countries ' borders , to cloak and support real-time outbound connections and data Exfiltration from high-profile victim organizations .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . The DLL exploited another previously unknown vulnerability ( designated CVE-2015-2546 ) in the Windows kernel , which enabled it to elevate privileges for the Word executable and subsequently install a backdoor through the application .


China Chopper contains a remote shell (Virtual Terminal) function that has a first suggested command of netstat an|find ESTABLISHED . The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon .


Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique . We revealed a Chinese-based adversary we crypt as Anchor Panda , a group with very specific tactics , techniques , and procedures ( TTPs ) and a keen interest in maritime operations and naval and aerospace technology .


During the trojan registration stage , the trojan exfiltrates private information such as the phone 's model , IMEI , phone number and country . The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . Similarly , APT37 targeting of a company located in Middle East in 2017 is also consistent with North Korean objectives given the entity 's extensive relationships inside North Korea .


The method is a well-known trick used by penetration testers that was automated and generalized by FinFisher The procedure starts by enumerating the KnownDlls object directory and then scanning for section objects of the cached system DLLs . COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites . We came across multiple variations of this DLL containing different parent process names , possibly targeted specifically to the victim’s environment . then the data decoded with Base64 and sent to C2 server IP using POST request to the subdirectory .


89eecd91dff4bf42bebbf3aa85aa512ddf661d3e9de4c91196c98f4fc325a018 9edee3f3d539e3ade61ac2956a6900d93ba3b535b6a76b3a9ee81e2251e25c61 0e48e5dbc3a60910c1460b382d28e087a580f38f57d3f82d4564309346069bd1 c113cdd2a5e164dcba157fc4e6026495a1cfbcb0b1a8bf3e38e7eddbb316e01f This Naikon report will be complemented by a follow-on report that will examine the Naikon TTP and the incredible volume of attack activity around the South China Sea that has been going on since at least 2010 . Rancor : CC081FFEA6F4769733AF9D0BAE0308CA0AE63667FA225E7965DF0884E96E2D2A . These observations leave open the possibility that COSMICENERGY was developed with malicious intent , and at a minimum that it can be used to support targeted threat activity in the wild .


Although it 's not pretty simple to hack Android devices and gadgets , sometimes you just get lucky to find a backdoor access . BRONZE UNION has consistently demonstrated the capability to conduct successful large-scale intrusions against high-profile networks and systems . Outlaw : fc57bd66c27066104cd6f8962cd463a5dfc05fa59b76b6958cddd3542dfe6a9a Cryptocurrency miner Coinminer.Linux.MALXMR.SMDSL32 . What prompted the data scientist Bullock to reach out were gobs of anti - Semitic diatribes from Harrison , who had taken to labeling Biderman and others “ greedy Jew bastards . ”


Wild Neutron 's attack took advantage of a Java zero-day exploit and used hacked forums as watering holes . The attacks discussed in this blog are related to an APT campaign commonly referred to as " th3bug " , named for the password the actors often use with their Poison Ivy malware .


Distribution Cybercriminals made use of some exceptionally sophisticated methods to infect mobile devices . March by security researchers from Kaspersky Labs . Unlike previous ShadowPad variants documented in our white paper on the arsenal of the Winnti Group , this launcher is not obfuscated using VMProtect . Victims of the campaign , which researchers named Out to Sea PDF , include diplomatic organizations , technology companies , and medical organizations in Israel , Tunisia , and the UAE .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . Taking that into account , we classify the Lamberts as the same level of complexity as Regin , ProjectSauron , Equation and Duqu2 , which makes them one of the most sophisticated Cyber Espionage toolkits we have ever analysed .


After inspecting the njRAT builder kit it was determined that this individual customized the existing njRAT builder kit to bypass security products .


That post included download links for a slew of NSA hacking tools and exploits , many of which could be used to break into hardware firewall appliances , and in turn , corporate or government networks . Barium has targeted Microsoft customers both in Virginia , the United States , and around the world .


The group is reported to have previously attacked government institutions , parliaments , senates , diplomatic functions , and even Olympic and other sports bodies .


405655be03df45881aa88b55603bef1d .


These emails were designed to trick recipients into supposedly changing their email passwords on a fake webmail domain .


SHA256 : 8ab1712ce9ca2d7952ab763d8a4872aa6a278c3f60dc13e0aebe59f50e6e30f6 The TrickMo Factor The TrickBot Trojan was one of the most active banking malware strains in the cybercrime arena in 2019 . Since 2015 , APT38 has attempted to steal hundreds of millions of dollars from financial institutions . Since then we have identified a number of attacks over a two-year period , beginning in April 2014 , which we attribute to Suckfly .


When malicious attachments are used , they may either be designed to exploit a vulnerability in a popular software assumed to be installed on the victim ’s machine , such as Microsoft Word or Adobe Reader , or the attachment itself may have its icon and filename obfuscated in such a way that the file does not appear to be an executable .


The Awen webshell deployed in the exploitation of this SharePoint vulnerability had a SHA256 hash of 5d4628d4dd89f31236f8c56686925cbb1a9b4832f81c95a4300e64948afede21 .


It is also much harder for network defenders or researchers to track a campaign where the infrastructure is a moving target . We collected two sets of Clayslide samples that appear to be created during the OilRig actor 's development phase of their attack lifecycle . Exploring it , it is possible to see several ﬁles inside of it , as well as the 6323 ﬁle . However , if the adversary exploits a ZeroDay vulnerability and develops a new virus to infiltrate the system , traditional signaturebased network security tools will fail to defend against the attack .


This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries . One of the top targets is the Japan Pension Service , but the list of targeted industries includes government and government agencies , local governments , public interest groups , universities , banks , financial services , energy and so on .


Quasar version 1.3.0.0 changed the encryption key generation , and stopped saving the password in the sample .


In some instances , the malware may have been present on victims' networks for a significant period .


In our case , the administrator phone number belongs to a mobile network in Australia . Over the past year , we've seen the group extensively targeting a wide gamut of entities in various sectors , including Governments , Academy , Crypto-Currency , Telecommunications and the Oil sectors . The data transmitted are XOR encoded . The first 6 Variables numbered lines were nt used anywhere in the code .


Their software , once surreptitiously installed on a target 's cell phone or computer , can be used to monitor the target 's communications , such as phone calls , text messages , Skype calls , or emails . The first sample being captured was in April 2018 and since that we observed a lot more related ones .


July 21 Analysis of the RCSAndroid spying tool revealed that Hacking Team can listen to calls and roots devices to get in . CopyKittens often uses the trial version of Cobalt Strike , a publicly available commercial software for " Adversary Simulations and Red Team Operations " . Hex-Rays kernel doesn’t optimize some functions in MMAT_GLBOPT2 if it judges the optimization within the level is not required . To get in , the attacker used spear phishing emails with a self - extracting archive attachment pretending to be a voicemail .


Of the four , KeyBase stands out due to its rapid rise in popularity , with a peak deployment of 160 samples per month and usage by 46 separate SilverTerrier actors , followed by a fairly rapid decline . The group , believed to be based in China , has also targeted defense contractors , colleges and universities , law firms , and political organizations — including organizations related to Chinese minority ethnic groups .


After the VM code has checked again the user environment , it proceeds to extract and execute the final un-obfuscated payload sample directly into winlogon.exe ( alternatively , into explorer.exe ) process . FireEye 's publication of " Operation Saffron Rose " report , which described Flying Kitten 's operations against aviation firms , led to the dismantling of Flying Kitten 's infrastructure and the apparent end of its activities . If successful , every time the system loads wininet.dll , the entry point of the subsequently dropped backdoor DLL will be executed before the original wininet entry point . They have employed many unique capabilities , including gaining initial access through a software supply chain vulnerability .


CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering . However , Kaspersky Security Network (KSN) records also contain links that victims clicked from the Outlook web client outlook.live.com” as well as attachments arriving through the Outlook desktop application .


Iterating once again over the 171 samples and scraping out the HTTP POST requests , I ended up with the below set of domains :


First off , the Trojan registers in the administration panel and receives the information it needs to operate from the C & C ( the SMS interception templates and the text that will be displayed on HTML pages ) : Rotexy intercepts all incoming SMSs and processes them according to the templates it received from the C & C . This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . We concluded that Lazarus Group was responsible for WannaCry , a destructive attack in May that targeted Microsoft customers .


fields [ ] . Bookworm has little malicious functionality built-in , with its only core ability involving stealing keystrokes and clipboard contents . In the past , BlackOasis messages were designed to appear like news articles from 2016 about political relations between Angola and China . During C0018 , the threat actors opened a variety of ports , including ports 28035 , 32467 , 41578 , and 46892 , to establish RDP connections.[9 ]


In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task . Create a link file in the startup folder for AutoHotkeyU32.exe , allowing the attack to persist even after a system restart .


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . Turla is a notorious group that has been targeting diplomats .


The Trojan gets the list of bank phone numbers from its C & C server . One big unknown was the infection vector for Turla ( aka Snake or Uroburos ) . Command line shell for remote administration . These groups can steal information and argue that they are practicing free speech , but more often than not , these groups will employ a DDoS Distributed Denial of Service attack to overload a website with too much traffic and cause it to crash .


Even such targets however appear to be consistent with the overarching theme , given the drug trade ’s relevance to security policy .


Thus , it is not surprising to see them engage in intrusions against the same victim , even when it may be a waste of resources and lead to the discovery and potential compromise of mutual operations .


The panels also contain Thai JavaScript comments and the domain names also contain references to Thai food , a tactic commonly employed to entice users to click/visit these C2 panels without much disruption . BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms . This technique also allows the attackers to cover their tracks , as having the C&C server in the victims ’ corporate networks means very little C&C traffic leaves them . The new campaign , which we call FakeSG , also relies on hacked WordPress websites to display a custom landing page mimicking the victim 's browser .


In this case , a URL used to download the PowerShell component shared a naming convention found in the IBM report , http://69.87.223.26:8080/eiloShaegae1 and connected to the IP address used by the previous three samples .


In July 2017 , INDRIK SPIDER joined the movement of targeted ransomware with BitPaymer . Silence is a group of Russian-speaking hackers , based on their commands language , the location of infrastructure they used , and the geography of their targets ( Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan ) .


Sending text “ call on ” will activate the USSD payment confirmation service . We expect APT34 will continue to evolve their malware and tactics as they continue to pursue access to entities in the Middle East region . It is hard for the targets to identify legitimate and malicious traffic to cloud provider infrastructure . Mandiant has observed UNC2970 , APT43 , and UNC4899 all utilize similar infrastructure .


OnionDuke first caught our attention because it was being spread via a malicious Tor exit node .


Later stages of the intrusions rely upon Winnti for persistent access .


Users rarely check the full URL associated with short links , so threat groups can use URL-shortening services to effectively hide malicious URLs .


The lure documents analyzed by Cybereason in this attack concentrate on the following themes :


What ’ s more interesting , and much less common , is the inclusion of the com.xiaomi.smarthome.receive_alarm intent filter . We suggest that APT41 sought to target in-game currency but found they could not monetize the specific targeted game , so the group resorted to ransomware to attempt to salvage their efforts and profit from the compromise . Finally , the use of recent domestic events and a prominent US military exercise focused on deterring Russian aggression highlight APT28 's ability and interest in exploiting geopolitical events for their operations .


TrickMo ’ s Persistence Capabilities When it comes to Android-based devices , many applications must find a way to run on the device after a system reboot . The group also uses the SQL injection (SQLi) tools Havij Advanced SQL Injection Tool and SQLi Dumper version 7.0 (Figure 4) to scan for and exploit vulnerabilities in targeted eCommerce sites . In the past , we had primarily associated the OilRig campaign with using the Clayslide documents to deliver as a payload a Trojan we named Helminth ; in this instance , the payload was instead a variant of the ISMDoor Trojan with significant modifications which we are now tracking as ISMAgent .


10001580: Init 10001620: InternetExchange 10001650: SendData This external library implements a simple Wininet-based transport for the main module .


Figure 6 . ScarCruft has a keen interest in North Korean affairs , attacking those in the business sector who may have any connection to North Korea , as well as diplomatic agencies around the globe . If the victim appears valuable to the attackers , a GRIFFON implant installer is pushed to the victim’s workstation . Cisco Talos researchers recently discovered Greatness , one of the most advanced phishing - as - a - service tools ever seen in the wild .


Once executed , the module attempts to get root privileges on the device by exploiting the following vulnerabilities : CVE-2013-2094 CVE-2013-2595 CVE-2013-6282 CVE-2014-3153 ( futex aka TowelRoot ) CVE-2015-3636 Exploitation process After an in-depth look , we found that the exploit payload code shares several similarities with the public project android-rooting-tools . The last process is utilized as part of the loading process for Cotx RAT and involves the legitimate Symantec binary noted above . Turla : Waterbug , WhiteBear , VENOMOUS BEAR , Snake , Krypton .


The following screenshots show what type of information is collected in both steps of the overlay attack : Ginp overlaysGinp overlaysGinp overlaysGinp overlays Based on Anubis Once the Anubis bot code got leaked , it was just a matter of time before new banking Trojans based on Anubis would surface . This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 . We examined the sample described in the report as Hdoor and found it ’s a previous version of the NamelessHdoor we discovered in the Minzen sample , but without support for DLL injection .


In this case , like others before , the event of a popular game release became an opportunity to trick unsuspecting users into downloading the RAT . The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors . 3.doc : d4eb4035e11da04841087a181c48cd85f75c620a84832375925e6b03973d8e48 . The second , CVE-2022 - 41080 , has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022 - 41040 used in the ProxyNotShell exploit chain , and it has been marked “ exploitation more likely . ”


Meanwhile in early-to-mid 2017 , SPLM / CHOPSTICK / XAgent detections in Central Asia provided a glimpse into ongoing focus on ex-Soviet republics in Central Asia .


This technique makes use of debuggers and software breakpoints useless . Organizations in the government , energy , and technology sectors have been targeted by Magic Hound , specifically organizations based in or doing business in Saudi Arabia . While continuing to monitor activity of the OceanLotus APT Group , BlackBerry Cylance researchers uncovered a novel payload loader that utilizes steganography to read an encrypted payload concealed within a .png image file . An example of these log entries can be found below : By correlating the user , IP address and GUID from the Remote PowerShell HTTP logs to the Exchange frontend , CrowdStrike found a request using the mailbox to the following OWA URL , , corresponding to the IIS log entry below : The backend request for the new exploitation chain is similar to the example shown below : This request seemed to show a novel , previously undocumented , way to reach the PowerShell remoting service through the OWA frontend endpoint , instead of leveraging the endpoint .


DNS queries distribution over time The campaign does n't seem to be growing at a fast pace . The 13th FYP was released in March 2016 and the sectors and organisations known to be targeted by APT10 are broadly in line with the strategic aims documented in this plan . OceanLotus : SOFTWARE\App\AppX06c7130ad61f4f60b50394b8cba3d35f\Applicationz 7244 . Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns ( e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s ) ) .


It spreads under the name AvitoPay.apk ( or similar ) and downloads from websites with names like youla9d6h.tk , prodam8n9.tk , prodamfkz.ml , avitoe0ys.tk , etc . Carbanak is a backdoor used by the attackers to compromise the victim . We analyzed a new RATANKBA variant ( BKDR_RATANKBA.ZAEL–A ) , discovered in June 2017 , that uses a PowerShell script instead of its more traditional PE executable form—a version that other researchers also recently identified .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . Some of the known filenames for Gray Lambert are mwapi32.dll and poolstr.dll – it should be pointed though that the filenames used by the Lamberts are generally unique and have never been used twice .


In the case of CVE-2010-0232 , the exploit appears to be based directly on the proof of concept code published by security researcher Tavis Ormandy when he disclosed the vulnerability .


The group attempted to deploy this spearphish attachment to push a small 30kb backdoor known as GAMEFISH to targets in Europe at the beginning of 2017 .


This does however still rule out the possibility that the Dukes simply obtained copies of the exploit binaries described by FireEye and repurposed them .


According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors .


Figure 6 : bit.ly statistics for the fake Bank Austria Android app download link From this small sample , we see that 7 % of visitors clicked through to download the application , which is actually a version of the Marcher banking Trojan named “ BankAustria.apk ” , continuing the fraudulent use of the bank ’ s branding to fool potential victims . The threat actors were able to maintain long term persistent access to many of these networks by utilizing compromised credentials . APT3 is a China based threat group that researchers have attributed to China's Ministry of StateSecurity .


To overcome this issue , “ Agent Smith ” found another solution . The first encounter with Buhtrap was registered back in 2014 . If the process is not halted , Dexphot decompresses the password-protected ZIP archive from the MSI package . However , the template source code is quite different and the payload delivery uses different infrastructure .


TG-3390 : apigmail.com .


HenBox has ties to infrastructure used in targeted attacks with a focus on politics in South East Asia . The delivery of KopiLuwak in this instance is currently unknown as the MSIL dropper has only been observed by Proofpoint researchers on a public malware repository . Researchers have pointed out that it is not uncommon for admin@338 to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement .


Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps , first stealing the victim ’ s login credentials , then stealing the credit card details ( to “ validate ” the user identity ) , as shown in the screenshots hereafter : The following code snippet shows that after the second overlay is filled-in and validated , it disappears and the targeted application is added to the list of packages names to be ignored for future overlays attacks . Recorded Future’s Insikt Group has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 . The oldest code we could identify was hosted on a famous Chinese source code sharing site since 2005 .


SuperService also tracks its own status and relaunches if stopped . The archive contains an .exe file , sometimes disguised as a Microsoft Word file , a video , or another file format , using the corresponding icon . The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April .


The njRAT used in this cyber attack was built from this builder kit .


The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . The primary backdoor used in the Epic attacks is also known as " WorldCupSec " , " TadjMakhal " , " Wipbot " or " Tavdig " .


The new text ( in Chinese , about relations between China , Japan and the disputed “ Senkaku Islands / Diaoyudao Islands / Diaoyutai Islands ” ) is shown to the victims and reads as following : When opened in a browser , this is what the command-and-control index page looks like : The text on the top means “ Title Title Title ” in Chinese , while the other strings appear to be random characters typed from the keyboard . If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros . All 13 countries where Kaspersky reportedly observed BlackOasis activity are connected to Saudi Arabia in one of three ACTs : economically ; from a national security perspective ; or due to established policy agreements .


We found get.adobe.go-microstf.com hosted at 104.218.120.128 around the time this campaign was ongoing , November 2016 .


The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China . he Trojan , a hybrid of Nymaim and Gozi malware , initially formed in April and thrives on carrying out redirection attacks via DNS poisoning .


The executable file , xxxx.exe in this case , is then executed .


Once started , the code in the main thread resolves the basic API functions it needs and loads an additional library from the following location : “ %TEMP%\tf394kv.dll ” .


A few days back , we wrote about an Android Marcher trojan variant posing as the Super Mario Run game for Android . The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China . Morphisec researchers began investigating the attacks on April 24 and continue to uncover more details . As we commonly see in the ransomware space , this threat is delivered through a variety of mechanisms which can include phishing and being dropped as secondary payloads from command and control ( C2 ) frameworks like Cobalt Strike .


Threat actors continue to exploit the CVE-2019-0604 vulnerability to compromise SharePoint servers , which is a vulnerability that Microsoft released a patch for in March 2019 .


A buffer overflow vulnerability exists in Adobe Flash Player ( <=17.0.0.134 ) when parsing malformed FLV objects .


The malware simulates clicks on app advertisements provided by legitimate ad networks and forces the app to install on a device . APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns . the pattern matching function replaces dword_745BB58C * ( dword_745BB58C – 1 ) Investigate anomalous activity and correlate findings with process telemetry .


Chunghwa Post - The government-owned corporation Chunghwa is the official postal service of Taiwan . Since late March , suspected APT33 threat actors have continued to use a large swath of operational infrastructure , well in excess of 1 , 200 domains , with many observed communicating with 19 different commodity RAT implants . The GCMAN group has moved beyond banks and is now targeting the budgeting and accounting departments in any organization of interest to them , using the same APT-style tools and techniques .


Targeting antivirus companies appears to have been the primary goal of Fxmps' latest network intrusions . The PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) .


This indicates that the authors are trying to hide some messages showed by the system during the setup process . The resume contained the PupyRAT backdoor , which communicated with known APT35 infrastructure . Performing the same steps in CyberChef , it is possible to decode the encrypted payload , which should yield x86 shellcode , starting with a call immediate opcode sequence . If the main function is called with only , it will only perform its cleanup routine and immediately terminate .


] 205 [ . The Dukes actively targeted Ukraine before the crisis , at a time when Russia was still weighing her options , but once Russia moved from diplomacy to direct action , Ukraine was no longer relevant to the Dukes in the same way . It should be noted that the contents of o402ek2m.php were updated by the attackers to reference different pastebin uploads throughout this campaign . JumpCloud confirmed the commands framework was used for malicious data injections in their security incident disclosure .


We were also able to find a related webshell based on the threat group ’s tool reuse , specifically a custom Mimikatz sample .


For example , when a button is clicked , a view is focused , etc . The second group , known as DragonOK , targets high-tech and manufacturing companies in Japan and Taiwan . ShadowHammer : https://liveupdate01s.asus.com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER359.zip . Umbrella , Cisco ’s secure internet gateway ( SIG ) , blocks users from connecting to malicious domains , IPs and URLs , whether users are on or off the corporate network .


The number at the end of the password corresponds to the year of the intrusion .


However , his study results are out of the scope of our research . The malware appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD (via Bitcoin) to decrypt the data . SHA256 : 94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5 .


Lookout Discovers Phishing Sites Distributing New IOS And Android Surveillanceware April 8 , 2019 For the past year , Lookout researchers have been tracking Android and iOS surveillanceware , that can exfiltrate contacts , audio recordings , photos , location , and more from devices . Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa . Over the past year , we've seen the group extensively targeting a wide gamut of entities in various sectors , including Governments , Academy , Crypto-Currency , Telecommunications and the Oil sectors .


The report authors renamed the malware " FriedEx " . ScarCruft has a keen interest in North Korean affairs , attacking those in the business sector who may have any connection to North Korea , as well as diplomatic agencies around the globe .


Figure 11 . We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . SHA256 : 69a9d7aa0cb964c091ca128735b6e60fa7ce028a2ba41d99023dd57c06600fe0 .


Kaspersky Lab has detected a new method of first infection that uses a drive-by-download with a flash exploit ( CVE-2015-5119 , the one leaked from The Hacking Team incident ) . ALLANITE activity closely resembles Palmetto Fusion described by the US Department of Homeland Security .


If a typical user tries to get rid of the malicious app , chances are that only the shortcut ends up getting removed . However , the unique malware variant , BlackEnergy 3 , reemerged in Ukraine early in 2015 , where we had first found Sandworm Team . The RAT has remained under the Radar for multiple years .


While analyzing a campaign run by the Gamaredon group , FortiGuard Labs discovered the tools they used to prepare the attack and found artifacts left behind by the actors that allowed us to perform a large amount of forensic analysis . The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 . The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 ( EternalBlue ) that we saw uploaded to the other errr.aspx webshell . According to Microsoft’s advisory , this vulnerability was patched on March 12 , 2019 and we first saw the webshell activity on April 1 , 2019 . We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 ( EternalBlue ) vulnerability patched in MS17-010 . Once the adversary established a foothold on the targeted network , they used China Chopper and other webshells to upload additional tools to the SharePoint server to dump credentials , perform network reconnaissance and pivot to other systems . We also observed Emissary Panda uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before . Consequently , the Linux malware ecosystem is plagued by financial driven crypto-miners and DDoS botnet tools which mostly target vulnerable servers . We also observed the actors uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before . It has been active since at least 2013 , and has targeted individuals likely involved with the Ukrainian government . The group’s implants are characterized by the employment of information stealing tools among them being screenshot and document stealers delivered via a SFX , and made to achieve persistence through a scheduled task . The finding shows that EvilGnome operates on an IP address that was controlled by the Gamaredon group two months ago . FIN7 operations are linked to numerous intrusion attempts having targeted hundreds of companies since at least as early as 2015 . The FIN7 intrusion set continued its tailored spear phishing campaigns throughout last year . In addition , during the investigation , we discovered certain similarities to other attacker groups that seemed to share or copy the FIN7 TTPs in their own operations . In 2018-2019 , researchers of Kaspersky Lab’s Global Research and Analysis Team analyzed various campaigns that used the same Tactics Tools and Procedures (TTPs) as the historic FIN7 , leading the researchers to believe that this threat actor had remained active despite the 2018 arrests . One of the domains used by FIN7 in their 2018 campaign of spear phishing contained more than 130 email APTes , leading us to think that more than 130 companies had been targeted by the end of 2018 . Interestingly , following some open-source publications about them , the FIN7 operators seems to have developed a homemade builder of malicious Office document using ideas from ThreadKit , which they employed during the summer of 2018 . The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation . The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method . Given FIN7’s previous use of false security companies , we decided to look deeper into this one . This activity cluster , which Kaspersky Lab has followed for a few years , uses various implants for targeting mainly banks , and developers of banking and money processing software solutions . FIN7’s last campaigns were targeting banks in Europe and Central America . After a successful penetration , FIN7 uses its own backdoors and the CobaltStrike framework or Powershell Empire components to hop to interesting parts of the network , where it can monetize its access . AveMaria is a new botnet , whose first version we found in September 2018 , right after the arrests of the FIN7 members . This threat actor stole suspected of stealing €13 million from Bank of Valetta , Malta earlier this year . In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc. , and can act as a keylogger . They also use AutoIT droppers , password-protected EXE files and even ISO images . To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT . Interestingly , this actor targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center . At the end of 2018 , while searching for new FIN7 campaigns via telemetry , we discovered a set of activity that we temporarily called CopyPaste” from a previously unknown APT . FIN7 and Cobalt used decoy 302 HTTP redirections too , FIN7 on its GRIFFON C2s before January 2018 , and Cobalt , on its staging servers , similar to CopyPaste . Quite recently , FIN7 threat actors typosquatted the brand Digicert” using the domain name digicert-cdn[.]com , which is used as a command and control server for their GRIFFON implants . The first of them is the well-known FIN7 , which specializes in attacking various companies to get access to financial data or PoS infrastructure . The second one is CobaltGoblin Carbanak EmpireMonkey , which uses the same toolkit , techniques and similar infrastructure but targets only financial institutions and associated software/services providers . we observe , with various level of confidence , that there are several interconnected groups using very similar toolkits and the same infrastructure to conduct their cyberattacks . The last piece is the newly discovered CopyPaste group , who targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center . At the end of 2018 , the cluster started to use not only CobaltStrike but also Powershell Empire in order to gain a foothold on the victims’ networks . FIN7 thus continues to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework . MuddyWater is widely regarded as a long-lived APT group in the Middle East . From February to April 2019 , MuddyWater launched a series of spear-phishing attacks against governments , educational institutions , financial , telecommunications and defense companies in Turkey , Iran , Afghanistan , Iraq , Tajikistan and Azerbaijan . FIN7 thus continue to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework . We also unearthed and detailed our other findings on MuddyWater , such as its connection to four Android malware variants and its use of false flag techniques , among others , in our report New MuddyWater Activities Uncovered: Threat Actors Used Multi-Stage Backdoors , False Flags , Android malware , and More . Instead , the campaign used compromised legitimate accounts to trick victims into installing malware . Notably , the group’s use of email as infection vector seems to yield success for their campaigns . We also observed MuddyWater’s use of multiple open source post-exploitation tools , which they deployed after successfully compromising a target . The attacker also connected to the compromised servers from IP addresses that were linked to dynamic domain names used as C&Cs by the delivered payloads . The main payload is usually Imminent Monitor RAT ; however , at the beginning of 2018 , we also observed the use of LuminosityLink RAT , NetWire RAT , and NjRAT . In a case in June 2019 , we also noticed Warzone RAT being used . Xpert RAT reportedly first appeared in 2011 . The first version of Proyecto RAT” was published at the end of 2010 . But with the West African gang we’ve named Scattered Canary , we have a deeper look at how business email compromise is connected to the rest of the cybercrime .


Cannon runs the downloaded file from the specified path .


For example , the Ztorg Trojan has been uploaded to Google Play almost 100 times since September 2016 . Hackers used the remote access to detect servers of their interest in the internal network . An additional module written by the group called ScreenBooking is used to capture credit card data . # 147 : The dangers of " Mercenary " groups and the spyware they create Upcoming events where you can find Talos “ Most prevalent malware files ” is taking a break this week for maintenance .


Lastly , the entire json object is encoded with Base64 and undergoes another stage of encryption , and then sent to the server :


] com w3.changeip [ . APT41 also deploys the SOGU and CROSSWALK malware families as means to maintain presence . In addition to the notably overt and large-scale campaigns with CozyDuke and CloudDuke , the Dukes also continued to engage in more covert , surgical campaigns using CosmicDuke .


The next step for the actor was to build MitM servers that impersonated legitimate services to capture user credentials . Due to tools and tactics in use we attribute the campaign to LuckyMouse Chinese-speaking actor ( also known as EmissaryPanda and APT27 ) .


CTU researchers infer intent by aggregating observations , analyzing a threat group's activity , and placing the information in a wider context .


This software is free and distributed under LGPL license . No zero-day vulnerabilities were used to breach targeted networks , instead " TG-3390 relied on old vulnerabilities such as CVE-2011-3544 " — a near-year-old Java security hole — " and CVE-2010-0738 to compromise their targets " , Dell SecureWorks' researchers reported . In May 2016 , two apparently unrelated activity groups , PROMETHIUM and NEODYMIUM , conducted attack campaigns in Europe that used the same zeroday exploit while the vulnerability was publicly unknown .


Further analysis of the iOS app “ Concipit1248 ” showed that the server used , spy [ . A second group , which we call GCMAN because the malware is based on code compiled on the GCC compiler , emerged recently using similar techniques to the Metel Group to infect banking institutions and attempt to transfer money to e-currency services . in block number 7 but the edi value is assigned in block number 1 and 2 . As we ’ve already previously discussed in our 2017 predictions , these groups will constantly evolve and employ unique and advanced attack techniques .


Click fraud PHAs simulate user clicks on ads instead of simply displaying ads and waiting for users to click them . A report published by Kaspersky Labs in 2011 on NetTraveler also mentions the C2 servers were being hosted by Krypt Technolgies . The DPP is part of the pan-green coalition that favors Taiwanese independence over reunification with the mainland , and the party ’s victory would represent a shift away from the ruling Kuomintang ’s closer ties with the PRC . Chinese state - sponsored actors reportedly accessed email accounts belonging to several U.S.-based organizations and federal government agencies , including the State Department .


Why you need the Bank Austria Security App : Due to outdated technology of the mobile network important data such as mTan SMS and online banking connections are transmitted unencrypted . Obtaining access to this ccTLD registrars would have allowed attackers to hijack any domain that used those ccTLDs . The group conducted a campaign in May 2016 and has heavily targeted Turkish victims .


A very unique technique is being used to inject this Trojan into an Android system where an attacker places a component of it into the boot partition of the file system and modify the 'init ' script ( initialize the operating system ) to re-load the malware as you switch on your android . The decoy slideshows all contain photos from very meaningful events to individuals in Thailand , suggesting that the actors continually look for impactful events to use to disguise their attacks . The nature of “ Unit 61398 ’s ” work is considered by China to be a state secret ; however , we believe it engages in harmful “ Computer Network Operations. ” Unit 61398 is partially situated on Datong Road in Gaoqiaozhen , which is located in the Pudong New Area of Shanghai . According to HTTP headers of the server , the applet was uploaded on February 11 , 2013 , one month after the Metasploit code was published and two days before Oracle issued a security alert regarding the vulnerability .


The recent activity X-Force IRIS is seeing from the Shamoon attackers has so far been detected in two waves , but those are likely to subside following the public attention the cases have garnered since late 2016 .


Analysis of one of the threat actor ’s documents found that if the macro executes , it launches two separate PowerShell Scripts .


Some hackers even went onto use the Cisco exploits in the wild . Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware .


Our eyes fell on the latest version of the Trojan , which is designed to steal money from owners of Android devices connected to the mobile banking service of one of Russia ’ s largest banks . To better understand how the adversary was operating and what other actions they had performed , CTU researchers examined cmd.exe and its supporting processes to uncover additional command line artifacts . As we ’ve observed with cybercriminal groups that aim to maximize profits for every campaign , silence does n’t necessarily mean inactivity . None LIGHTWORK is a disruption tool written in C++ that implements the IEC-104 protocol to modify the state of RTUs over TCP .


Finally , research yielded a relatively unique sample .


REQUEST_INSTALL_PACKAGES - make a request to install packages . ined in the archive is called DriverInstallerU.exe but its metadata shows that its original name is Interenet Assistant.exe . All of the Emissary we've collected are written in Traditional Chinese , which is used primarily in Taiwan and Hong Kong .


Geo-location . Specifically , Suckfly used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows . In early May 2016 , both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe .


If the mobile operator does n't enforce proper client isolation , it is possible that the infected devices are also exposed to the rest of the cellular network . While we know the attackers used a custom dropper to install the back door , we do not know the delivery vector . An .mp3 file of a song by the famous Syrian singer Asala Nasri ( song name : Fen Habibi , translation : “ where is my loved one? ” ) 4583b49086c7b88cf9d074597b1d65ff33730e1337aee2a87b8745e94539d964 . Since the beginning of 2023 , the majority of observed KillNet targeting has focused on the U.S. , Europe , and international institutions such as NATO .


] zqo-japan [ . After compromising a political organization , APT28 will steal internal data . The controller responds with the 253.25.42.87 A record . CrowdStrike incident responders found that renamed Plink and AnyDesk executable creation timestamps on affected backend Exchange servers were closely correlated with PowerShell execution events in the Remote PowerShell logs , indicating the threat actor leveraged the newly discovered exploit chain to drop other tooling for persistent access to the affected Exchange servers .


Most of these data-stealing capabilities were present in the oldest variants of CARBANAK that we have seen and some were added over time . Operation Daybreak appears to have been launched by ScarCruft in March 2016 and employs a previously unknown ( 0-day ) Adobe Flash Player exploit .


We have previously detected groups we suspect are affiliated with the North Korean government compromising electric utilities in South Korea , but these compromises did not lead to a disruption of the power supply . Recently , Trend Micro researchers came across a new mobile malware family which we have called GnatSpy .


In this case , however , the hacktool had an unusual characteristic not typically seen with this type of file ; it was signed with a valid code-signing certificate .


The targeting of private sector interests by APT32 is notable and FireEye believes the actor poses significant risk to companies doing business in , or preparing to invest in , the country . Since last week , iSIGHT Partners has worked to provide details on the power outage in Ukraine to our global customers .


'' This DLL contains one root class called " eClient , '' which is the core of the trojan . Cisco Talos discovered significant China Chopper activity over a two-year period beginning in June 2017 , which shows that even nine years after its creation , attackers are using China Chopper without significant modifications . The Elfin espionage group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries .


He posted a tweet to The New York Times report , sarcastically writing , " If only two people had called this company out for their backdoors several times over the last few years . The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 . Gh0stRAt Downloader : e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c .


Given this , and the naming convention of the submissions ( .virus ) , the submitter hash most likely belongs to an AV vendor or sandboxing environment that automatically submits samples to online malware databases . One is called XAgent detected as IOS_XAGENT.A and the other one uses the name of a legitimate iOS game , MadCap detected as IOS_ XAGENT.B . ClearSky 's September 2014 blog post first described active attacks using a piece of malware they dubbed ' Gholee ' ( as appears in a malicious payload export function , potentially named after a popular Iranian singer9 ) .


] netupload404 [ . Unit 42 published a blog at the beginning of May titled " Prince of Persia " , in which we described the discovery of a decade-long campaign using a formerly unknown malware family , Infy , that targeted government and industry interests worldwide . However , we have evidence to suggest that APT1 is running hundreds , and likely thousands , of other servers ( see the Domains section below ) . Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation , such as through the use of virtualization technology.[4 ] Bundlore uses the mktemp utility to make unique file and directory names for payloads , such as TMP_DIR=`mktemp


We identified a malware testing environment that we assess with high confidence was used to refine some TEMP.Veles tools .


NTDS.dit contains Active Directory data , including password hashes for all users on a domain .


The string of comma separated hexadecimal values is passed as a parameter when loading the SWF file downloaded in ‘ onload2 ’ .


Most samples of the malware reportedly function as a basic reconnaissance tool and downloader .


It was implemented by sending an SMS message containing a one-time password ( OTP ) to the client ’ s mobile device . The group uses legitimate administration tools to fly under the radar in their post-exploitation phase , which makes detection of malicious activity , as well as attribution more complicated . ] com , which we previously identified in October 2017 to be an OilRig C2 .


This version has some small modifications which seems to be unused , as the malware behaviour is the same as the previous version . The backdoor was deployed using the Notepad++ updater and sideloading malicious DLL , as noted in APT10’s targeting of Japanese corporations in July 2018 . These threats shared infrastructure between July 2012 and April 2013 .


The system service ‘ AccountManagerService ’ looks for the application that can process this request . " Buhgalter " means " accountant " in Russian . The files are given new , random names , which are generated by concatenating words and numbers based on the time of execution ( for example , C:\Users\<user>\Favorites\\Res.Center.ponse\<numbers> ) . Compromised websites ( WordPress appears to be the top target ) are injected with a code snippet that replaces the current webpage with the aforementioned fake updates templates .


The indicators associated with the blog article are available in the ThreatConnect Technical Blogs and Reports source here .


We observe similar keyboard patterns in other samples : “ 567%^& ” , “ zxc!@#ASD ” .


Once in a while , it sends a packet to its C & C server containing the collected device data along with all the saved SMS messages . LATINUM makes a concerted effort to hide their infection tracks , by self-deleting malicious components , or by using server side logic in ' one shot mode ' where remotely hosted malicious components are only allowed to load once . The email had no subject and what initially drew our attention to OilRig 's attack was the content of the spear phishing email .


In a case in June 2019 , we also noticed Warzone RAT being used . According to Deepen , APT6 has been using spear phishing in tandem with malicious PDF and ZIP attachments or links to malware infected websites that contains a malicious SCR file .


And TikTok is no exception . The initial infection vector used by the threat actor also changed over time , during 2018 we have seen multiple uses of self-extracting archives instead of malicious documents with AutoHotKey , which displayed a decoy image to the user . Ids.me .


TOOLS AND TECHNIQUES OF THE DUKES .


Download additional payloads .


As the pattern of chemical industry targets emerged , we internally code-named the attack campaign Nitro .


myyoula.ru sell-avito.ru sell-youla.ru sentel8ju67.com subito-li.pw subitop.pw web-gumtree.com whitehousejosh.com whitekalgoy3.com youlaprotect.ru Examples of malware 0497b6000a7a23e9e9b97472bc2d3799caf49cbbea1627ad4d87ae6e0b7e2a98 417fc112cd0610cc8c402742b0baab0a086b5c4164230009e11d34fdeee7d3fa Trend Micro also reported MuddyWater’s use of a new multi-stage PowerShell-based backdoor called POWERSTATS v3 . In this campaign , the malware author uses the following name: Pyongyang Directory Group email April 2017 RC_Office_Coordination_Associate.scr. The decoy document shown after infection is an Office document containing email addresses , phone numbers and contacts of members of official organizations such as the United Nations , UNICEF , Embassies linked to North Korea .


This file discusses the supposed announcement banning the rival Fatah political party , which controls the West Bank , from Gaza .


When a victim tries to access the URL in the SMS body , the C2 will check if the mobile device meets the criteria to receive the malware ( see infrastructure section ) . APT10 withdrew from direct targeting using Poison Ivy in 2013 and conducted its first known retooling operation , upgrading its capabilities and replatforming to use PlugX . OceanLotus : background.ristians.com:8888 11b4 . They contain some invalid URLs and IPs .


CTU researchers found no evidence of multiple operators working simultaneously against a single organization .


URL Status IP Domain registration date http : //ora.studiolegalebasili [ . As Proofpoint has not yet observed this attack in the wild it is likely that there is an additional component that leads to the execution of the MSIL payload . FireEye 's publication of " Operation Saffron Rose " report , which described Flying Kitten 's operations against aviation firms , led to the dismantling of Flying Kitten 's infrastructure and the apparent end of its activities .


Windows Defender ATP provides extensive information about activity groups responsible for the attacks , enabling customers to understand aspects of the attack that may not be obtained by network and endpoint sensors , such as common social engineering lures and the regional nature of an attack .


String Resources Used to Store App Data Red Alert 2.0 stores its data in an atypical location ( inside the Strings.xml file embedded in the app ) to fetch its critical data , such as the C2 address . However , we asses with medium confidence that NavRAT is linked to Group123 . was applied to APT10 ANEL and Dharma ransomware packer . Another area where we may want to consider this motivation is the human factor .


While both RTM and Buhtrap are looking for a quite similar process list , the infection vectors are quite different . Based on analysis of the data and malware samples we have collected , Unit 42 believes the attacks described herein are the work of a group or set of cooperating groups who have a single mission , collecting information on minority groups who reside in and around northwestern China .


The main purpose of this module is to exfiltrate Skype call recordings . In mid-September , an app named ‘Network Speed Master’ stood out on our radar with its rather unusual behavior patterns . Leviathan : TEMP.Jumper , APT40 , TEMP.Periscope .


The payment portal was initially similar to the one used by Locky and Bart .


SHA256 : 905f6a62749ca6f0fd33345d6a8b1831d87e9fd1f81a59cd3add82643b367693 .


Botnets can make considerably more money than autonomous Trojans . TAA not only flagged this malicious use of PsExec , it also told us what the attackers were using it for . Since this compilation timestamp dates back two weeks before this campaign , it ’s likely that it has n’t been tampered with by the attackers . An example of these log entries can be found below : By correlating the user , IP address and GUID from the Remote PowerShell HTTP logs to the Exchange frontend , CrowdStrike found a request using the mailbox to the following OWA URL , , corresponding to the IIS log entry below : The backend request for the new exploitation chain is similar to the example shown below : This request seemed to show a novel , previously undocumented , way to reach the PowerShell remoting service through the OWA frontend endpoint , instead of leveraging the endpoint .


Like the photo displayed in the first decoy file we found , this document references the death of Mazen Fuqaha .


PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched . If the hypothesis is correct and the Turla threat group is using Kazuar , we believe they may be using it as a replacement for Carbon and its derivatives .


http://188.241.58.170/live/owa/office.dotm .


In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger . So far , it appears threat actors have deployed the Bookworm Trojan primarily in attacks on targets in Thailand .


The malicious application da.hao.pao.bin ( Chunghwa Post ) loads a library file libmsy.so used to execute the packed mycode.jar file . Of particular note is their use of tools to identify systems vulnerable to CVE-2017-0144 , which is the same vulnerability exploited by EternalBlue that is best known for its use in the WannaCry attacks of 2017 . Overall , in spite of the lack of sophistication in Gorgon Group 's activity , they were still relatively successful ; once again proving that simple attacks on individuals without proper protections , work .


Next , the malware enumerates all .exe programs in the % System % folder and looks for an original signed Windows binary that imports from at least one KnownDll and from a library that is not in the KnownDll directory . The connections associated with these profiles indicate the threat actor began using the persona to target organizations in April 2016 . Some of these names include processes related to security software : Ashley Madison ’s long - suspected army of fake female accounts came to the fore in August 2012 after the former sex worker turned activist and blogger Maggie McNeill published screenshots apparently taken from Ashley Madison ’s internal systems suggesting that a large percentage of the female accounts on the service were computer - operated bots .


Many of these servers are control panels for video surveillance systems developed by the Italian company eSurv , based in Catanzaro , in Calabria , Italy . Taidoor actively sent out malicious documents and maintained several IP addresses for command and control . This is why we chose to name the malware Pierogi , after the popular East European dish . Talos discovered multiple vulnerabilities in Foxit PDF Reader that could allow an adversary to execute , arbitrary code on the targeted machine .


In the case of this ransomware , using the model would ensure that its ransom note—typically fake police notice or explicit images supposedly found on the device—would appear less contrived and more believable , increasing the chances of the user paying for the ransom . In this report , we present the historical intelligence we have gathered on the Ke3chang campaign , as well as an in-depth assessment of the ongoing Syrian-themed attacks against these MFAs . New patterns and data-flow tracking for opaque predicates . An adversary could potentially instruct a control systems device to perform an action that will cause an Impact


Although Poison Ivy has been a proven threat for some time , the delivery mechanism for this backdoor uses recent publicly available techniques that differ from previously observed campaigns .


If the device does not meet the criteria , it wo n't receive any data , otherwise , it will be redirected to a second server to receive a copy of the malware to install on their device . It is highly likely that this is due to the release of the 2013 FireEye report . OceanLotus : enum.arkoorr.com:8531 11b4 . Open Babel allows users to “ search , convert , analyze , or store data from molecular modeling , chemistry , solid - state materials , biochemistry , or related areas , ” according to its website , and is used in other popular pieces of software in the science field .


Shutdown / restart the computer .


The examples below show the plaintext key “ TEST ” to decrypt encoded hexadecimal strings ( jUtils.decrypt ( ) ) . Interestingly , this actor targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center . Ke3chang attackers are operating within China .


GeminiDuke and CozyDuke on the other hand appear to have been less used in actual operations , but did undergo much more significant development .