PaloAltorecently discovered a new Android Trojan called SpyNote which facilitates remote spying.


A backdoor also known as: W32.HfsAutoB.F81D Trojan.Mikhail.Win32.4 Trojan.Ransom.Mischa.2 Ransom_MISCHA.SM Win32.Trojan.WisdomEyes.16070401.9500.9999 Ransom_MISCHA.SM Win32.Trojan-Ransom.Petya.D Trojan-Ransom.Win32.Mikhail.a Trojan.Win32.Petya.96256 Trojan.Encoder.4544 Trojan.Petr.a TR/AD.Petya.Y.rxxx Trojan[Ransom]/Win32.Mikhail Ransom:Win32/Mischa.A Trojan-Ransom.Win32.Mikhail.a Trojan/Win32.Mischa.C1478164 Hoax.Mikhail Trojan.Mikhail!


A backdoor also known as: Doc.Exploit.DDEautoexec-6346603-0 Exploit.Xml.DDEAuto.euqmxe Trojan[Exploit]/MSOffice.DDE.c Win32.Outbreak


The end result is a new banking Trojan in the wild.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9899 HV_ROGUE_CG152C85.RDXN Heur.Packed.Unknown TR/Spy.Banker.45879 TrojanProxy:BAT/Banker.G Win32/RiskWare.PEMalform.E


A backdoor also known as: Trojan-Proxy/W32.Steredir.504832 Trojan/Proxy.Steredir.c Trojan-Proxy.Win32.Steredir.c Trojan.Win32.Steredir.fqli Troj.Proxy.W32.Steredir.c!c TrojWare.Win32.TrojanProxy.Steredir.C Trojan.Stedir.11 Trojan.Steredir.Win32.7 Trojan-Dropper.Delf W32/Risk.RESM-4501 TrojanProxy.Steredir.c TR/Proxy.Steredir.C Trojan[Proxy]/Win32.Steredir Win32.Troj.Steredir.c.kcloud Trojan.Heur.EFD23B1 Trojan.Win32.Proxy.504832 Trojan-Proxy.Win32.Steredir.c TrojanProxy:Win32/Steredir.C Win32/TrojanProxy.Steredir.C Trojan.PR.Steredir!cYzY1isGQt0 W32/Steredir.C!tr


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 BehavesLike.Win32.Trojan.gc Trojan.MSIL.Bladabindi.1 HackTool:MSIL/Injector.A Trojan.LVBP.ED Backdoor.Win32.DarkKomet


A backdoor also known as: Backdoor.Win32.Hupigon!O TrojanDropper.Dowque.A8 Backdoor.Hupigon.Win32.182 Backdoor/Hupigon.dkwt TROJ_DOWQUE.NY Win32.Trojan.Delf.b W32/Backdoor2.CWRX Backdoor.Graybird TROJ_DOWQUE.NY Win.Worm.Autorun-12451 Backdoor.Win32.Hupigon.56864 Backdoor.W32.Hupigon.l9fO BackDoor.Graybird.75 BehavesLike.Win32.SpywareLyndra.tc W32/Backdoor.DAWT-3367 Backdoor/Huigezi.2008.qny BDS/Farfli.kj.2 Win32.TrojDownloader.dl.kcloud TrojanDropper:Win32/Dowque.A Trojan/Win32.Hupigon.C29670 Backdoor.Bot Win32/Delf.NSN Backdoor.Win32.Hupigon.dkw Backdoor.Hupigon!hgCryiT987Y Backdoor.Win32.HacDef W32/Injector.fam!tr Trojan.Win32.Downloader.M


The file is named in such a way as to confuse WordPress administrators who are familiar with XML-RPC.


A backdoor also known as: HackTool.Win64.PSWDump.f BehavesLike.Win64.SoftPulse.lh HackTool.Mimikatz HackTool.Win64.PSWDump.f


The story was about a new vulnerability for *nix-based systems – EternalRed aka SambaCry.


There have been an emegerence of new domains for FighterPOS recently and I discovered a whole load of other possible domains that could be used for the command and control.


The service connects back to the attacker machine and waits for commands which will be given by the attacker.


Crooks behind MajikPOS have various tricks up their sleeves.


TA473 has continuously leveraged an unpatched Zimbra vulnerability in publicly facing webmail portals that allows them to gain access to the email mailboxes of government entities in Europe.


Presumably from the same author of Petya, which was first seen in December 2016, and the Petya-Mischa combo, which hit users back in July 2016, Janus Cybercrime Solution's latest creation is another step in the evolution of their ransomware-as-a-service expansion.


Our research indicates that the group has sufficient financial resources to purchase the source code of a widely available malware tool, and the human resources to design improved versions of its own backdoors based on this.


A backdoor also known as: Trojan.Downloader.JRQH Trojan.Downloader.JRQH Win32.Trojan.WisdomEyes.16070401.9500.9945 Win32.Trojan-Downloader.Banload.J Trojan-Downloader.MSIL.Banload.bgr Trojan.Downloader.JRQH Trojan.Win32.Banload.dzssxt Trojan.Downloader.JRQH Trojan.Downloader.JRQH Trojan-Downloader.MSIL.Banload.bgr TrojanDownloader:MSIL/Banload.T Trojan/Win32.Banload.C829219 Trojan.Banker.ABR Trj/GdSda.A Msil.Trojan-downloader.Banload.Efkz Trojan-Downloader.MSIL.Banload


Trigona ransomware is a relatively new strain that security researchers first discovered in late October 2022.


A backdoor also known as: HW32.Packed.A537 Packed.Win32.TDSS!O RiskWare.Tool.CK BehavesLike.Win32.Downloader.dc TR/Bumat.A.2896 Win32.Troj.Undef.kcloud Win-Trojan/Xema.variant PE:Malware.XPACK-HIE/Heur!1.9C48 Trojan.Crypt W32/Malware_fam.NB Win32/Trojan.648


We observed legitimate exfiltrated files of the following types of data : Contact information Compressed recorded audio in the Adaptive Multi-Rate ( amr ) file format Images captured from the device camera Images stored on both internal device and SDCard storage that are listed in the MediaStore Device geolocation information SMS content Chrome browser search history and bookmarks Call log information Cell tower information Device network metadata ; such as phone number , device software version , network country , network operator , SIM country , SIM operator , SIM serial , IMSI , voice mail number , phone type , network type , data state , data activity , call state , SIM state , whether device is roaming , and if SMS is supported .


This post describes the new campaign.


A backdoor also known as: HW32.Packed.2431 Trojan.MSIL.FKV WS.Reputation.1 Stimilik.S Trojan.Win32.Confuser.dkqarl BehavesLike.Win32.Kudj.gc Trojan/Win32.Stealer PUA.MSIL.Confuser


Attackers also used the name of the top NIC official in the signature of the email, this is to make it look like the email was sent by a high ranking Government official working at NIC National Informatics Centre.


PaloAlto observed a targeted attack in November directed at an individual working for the French Ministry of Foreign Affairs.


HMRC taxes application with reference L4TI 2A0A UWSV WASP received


The infection attempts occurred in September and October of 2015 as public frustration grew at the Mexican government's seemingly contradictory statements about the Narvarte case


A backdoor also known as: Worm/W32.Mydoom.28864 W32.Mydoom.M W32/Mydoom.o@MM W32/Mydoom.m I-Worm.Mydoom!qBn5HU3v+Lw W32/Mydoom.O@mm W32.Mydoom.M@mm MyDoom.L@mm Win32/Mydoom.O Win32.Mydoom.m Worm.Mydoom-27 Email-Worm.Win32.Mydoom.m I-Worm.Win32.Mydoom.28864.A Email-Worm.Win32.Mydoom!IK Worm.Win32.Mydoom.R Win32.HLLM.MyDoom.54464 Worm/Mydoom.O.1 W32/Mydoom.o@MM Worm/Sramota.bef Worm/Win32.Mydoom Worm:Win32/Mydoom.O@mm W32/Mydoom.O@mm Win32/Mydoom.worm.49344.B Email-Worm.Win32.Mydoom.m Win32/Mydoom.R Worm.Mail.Mydoom.dh Email-Worm.Win32.Mydoom W32/Mydoom.M!dam I-Worm/Mydoom.O W32/Mydoom.N.worm


The news organization provides reporting on its website in English, Georgian, and Russian.


Mandiant suspects UNC2970 specifically targeted security researchers in this operation.


A backdoor also known as: W32.FamVT.LoringK.Trojan Backdoor.Bot.158614 Trojan-Dropper.Win32!O TrojanDropper.Loring.A11 Backdoor.Bot.158614 Backdoor.IRCBot Trojan/IRCBot.ov WORM_KWBOT.AR W32/Risk.VXNU-4867 W32.Kwbot.Worm Win32/Loring.A WORM_KWBOT.AR Win.Trojan.Obfuscated-1662 Backdoor.Bot.158614 Trojan.Win32.Reconyc.gunk Backdoor.Bot.158614 Trojan.Win32.IRCBot.dmigck Dropper.Loring.291411 Backdoor.Bot.158614 Backdoor.Bot.158614 Trojan.MulDrop5.7150 Trojan.Reconyc.Win32.6040 WORM/IrcBot.86875 Trojan[Backdoor]/Win32.IRCBot Win32.Troj.Loring.EA.kcloud Backdoor.Bot.D26B96 Troj.Dropper.W32.Loring.l8Ew Worm/Win32.IRCBot.R3593 TScope.Trojan.Delf Trojan.IRCBot.OV Win32/IRCBot.OV Trojan.DR.Loring!O3IAMVgzzx8 Trojan-Dropper.Win32.Loring


A backdoor also known as: Trojan/Injector.iuc Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Pushbot.AJZ WORM_PALEVO.SMA Win.Trojan.Ircbrute-54 Trojan.Win32.Ircbrute.eqsrw Trojan.Spambot.9818 Trojan.Injector.Win32.53831 WORM_PALEVO.SMA BehavesLike.Win32.PWSZbot.lh Backdoor.Win32.IRCBot Trojan/Win32.Unknown Trojan:Win32/Ircbrute.B Trojan.Graftor.DCFC Worm/Win32.Ckbface.R16129 Trojan.Injector!aNdlYeuOVuU


While the malware was not detectable by endpoint antivirus products, RSA Security Analytics was able to identify and alert on its network traffic, and RSA ECAT subsequently identified the malware.


A backdoor also known as: Trojan.Script.400873 Exploit/PDF-URI2.AS Exploit-PDF.f Exploit.W32.Pidief!c PDF.Exploit.Pidief.an Bloodhound.PDF.9 Trojan.Script.400873 Exploit.Win32.Pidief.asz Trojan.Script.400873 Exploit.Script.Pidief.ibwe PDF.S.Exploit.10714 Win32.Exploit.Pidief.Anfp Trojan.Script.400873 Exploit.JS.Pdfka.MJ Trojan.Script.400873 Exploit.PDF.303 HEUR_PDFEXP.B BehavesLike.PDF.Trojan.lr Exploit:Win32/Pdffir.A Trojan.Script.D61DE9 Exploit.Win32.Pidief.asz PDF/Pidief.EI Trojan.Script.400873 Exploit.Win32.Pidief.asz JS.Crypt.BSP Exploit.JS.Pdfka JS/Pdfka.BSP!exploit virus.pdf.20090837.1


A backdoor also known as: W32.DropperZbotS.Trojan Trojan-Spy.Win32.Zbot!O Trojan.AutoIt.Pik.A Backdoor/Poison.evja Trojan.Zbot Trojan.Win32.Autoit.pik Trojan.Win32.Autoit.exoora Trojan.Win32.Z.Autoit.955563 Troj.W32.Autoit!c BehavesLike.Win32.Dropper.dc Trojan.Win32.Injector Trojan.Autoit.kzp TR/AD.Zbot.cgaww Trojan.Win32.Autoit.pik Trojan:Win32/Krilog.A Trojan.Autoit.F Win32/Injector.Autoit.AOI Win32.Trojan.Autoit.Edne W32/Autoit.NWS!tr


A backdoor also known as: W32.DakusarDRW.Trojan Trojan.Blocker.Win32.34866 Trojan.DownLoader24.32105 BehavesLike.Win32.Shodi.tc Worm:Win32/Icorimg.A Trojan.Strictor.D1C7BA HEUR/Fakon.mwf Trojan.Worm!33g50yRKTx8 Trojan.FLCM!tr


Upon further inspection, the RAT appeared to share many similarities with an old Chinese backdoor known as Hacker's Door first released publicly in 2004 and updated in 2005.


A backdoor also known as: BackDoor-CMQ.dldr Win32.Trojan.WisdomEyes.16070401.9500.9999 TROJ_HORST.SMPE Monitor.W32.WebWatcher.lt5Y TROJ_HORST.SMPE BackDoor-CMQ.dldr Trojan.Graftor.D476C BScope.Malware-Cryptor.Win32.313 Trojan.Win32.Cosmu W32/Dloader.BOW!tr.dldr


The campaign was active between November 2016 and January 2017, targeting a limited number of people.


Quasar is a .NET Framework-based open-source RAT.


A backdoor also known as: Trojan.Win32.Z.Delf.2373896 Troj.Spy.W32.Zbot.lw7D Win32.Trojan-downloader.Rakhni.Html Trojan-Downloader.Win32.Delf W32/Application.AJYX-3726 TrojanDownloader.Rakhni.ec TR/Dldr.Delf.tbxxd W32/Dloader.CDW!tr Trojan[Downloader]/Win32.Rakhni Trojan.Application.Bundler.InstallMonster.392 Trojan-Downloader.Win32.Rakhni.jqc Trj/CI.A Win32/Trojan.036


While it is not clear whether the primary goal of the attack was delivering the malicious payload or capturing the targets OWA credentials, this attack uses an OWA phish to additionally pushes a malicious document with a Veil-Framework payload capable of downloading further malware.


Installed with backdoored software, for example:- Telegram.exe - mech_korolya_artura_2017.HDRip.exe


Founded in 2013, the Android Marcher mobile malware has widely been targeting Google Play -- harvesting user credentials and credit card data.


Ransomware persists as one of the top crimeware threats thus far into 2016.


A backdoor also known as: W32.FamVT.AxVDb.Trojan Trojan.Rincux.AW Trojan.Injector.26488 Trojan.Rincux.AW Trojan.Injector Tool.StormAttack.Win32.10 Win32.Trojan.WisdomEyes.16070401.9500.9999 Backdoor.Trojan Win.Trojan.Rincux-6417593-0 Trojan-DDoS.Win32.StormAttack.c Trojan.Rincux.AW Trojan.Win32.Tdss.bziyas Trojan.Rincux.AW TrojWare.Win32.Magania.~AAC DDoS.Storm.156 BehavesLike.Win32.Backdoor.km TrojanDDoS.StormAttack.a Trojan[Rootkit]/Win32.TDSS DDoS:Win32/Stormser.A Trojan.Rincux.AW Trojan-DDoS.Win32.StormAttack.c BScope.Trojan.Win32.Inject.2 Trojan-Downloader.Win32.Pangu W32/ServStart.AS!tr


Daserf's main purpose is information stealing and the Trojan is capable of gathering information from infected computers and relaying it back to attacker-controlled servers.


A backdoor also known as: Trojan-Dropper.Win32.Flystud!O Trojan.Hookmoot.S217748 Trojan.Symmi.D7D5 Win32.Worm.FlyStudio.mc Trojan.Dropper Win32/SillyAutorun.ALB Win.Trojan.Rootkit-7763 Win32.Trojan.FlyStudio.A Trojan-GameThief.Win32.OnLineGames.boif Trojan.Win32.QQPass.esaped Troj.Dropper.W32.Flystud.lBWL Trojan.MulDrop5.5320 Dropper.Flystud.Win32.139 BehavesLike.Win32.Autorun.vc Trojan/PSW.OnLineGames.cvvq RKIT/Tiny.BK.2 Trojan:Win32/Englov.A Trojan-GameThief.Win32.OnLineGames.boif HEUR/Fakon.mwf Rootkit.Tiny Trojan.AutoRun Win32/FlyStudio.A Trojan.TenThief.QQPsw.tss Worm.Autorun!1DOkY6YfgQ8 Rootkit.Win32.Tiny W32/BDoor.DRV!tr Win32/Trojan.dd5


But we recently identified an app that demonstrated new ways of successfully evading Apple's code review.


The stolen credentials may be used for remote access into the victim network if applicable.


A backdoor also known as: Trojan.Darkshell BehavesLike.Win32.Ipamor.nm Trojan[Downloader]/Win32.Delf Trojan:WinNT/Darkshell.C Trojan/Win32.CSon.R1800 Trojan.Win32.Scar.mg


A backdoor also known as: W32.HfsAutoB.B01D Troj.Crypt.Tpm!c BehavesLike.Win32.PWSQQPass.vc Trojan:Win32/Valan.A


It can also imitate a legitimate website to lure you into revealing your sensitive information.


Dyreza originally focused on intercepting end-user bank logins, and later expanded to job hunting, file hosting, domain registration, website hosting, file hosting, tax services, and online retail categories


Brain Test has been removed from Google Play since September 24.


A backdoor also known as: W32.FamVT.DinwoodAATTC.Worm Trojan.Zenshirsh.SL7 TSPY_EYDROP.SMA Win32/Oflwr.A!crypt TSPY_EYDROP.SMA Win.Worm.Allaple-5 Trojan-Dropper.Win32.Dinwod.acqn Trojan.Win32.Dinwod.ejafor Troj.Dropper.W32.Dinwod.toVw TrojWare.Win32.TrojanDropper.Dinwod.A Trojan.Inject1.58305 BehavesLike.Win32.Dropper.wh TrojanDropper.Dinwod.ale Worm[NET]/Win32.Nimda.gic Trojan-Dropper.Win32.Dinwod.acqn Trojan/Win32.OnlineGameHack.C33730 TrojanDropper.Dinwod Trojan.Dropper Trojan.DR.Dinwod!dCCk6/8cSJk


A backdoor also known as: Trojan.Win32.Symmi!O WS.Reputation.1 OnLineGames.IRMW Win32/Oflwr.A!crypt Riskware.Win32.FakeLPK.cwuava BackDoor.BlackHole.21297 TR/Obfuscated.XZ.937 HackTool.Sniffer.WpePro PSW.OnlineGames4.BEIZ


A backdoor also known as: Trojan.Connapts Trojan/Small.ndx Trojan.Heur.LP.EDC094 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.MLW.dylhy W32/Trojan.CISW-8628 Backdoor.Bot/Variant Trojan/Win32.Xema.C93063 W32/Small.NDX!tr Win32/Backdoor.796


This spring, the author of the NukeBot banking Trojan published the source code of his creation.


A backdoor also known as: Adware.ELEXCRTD.Win32.5604 Trojan.Johnnie.D709 not-a-virus:AdWare.Win32.Elex.sgn Adware.Mutabaha.1819 RiskTool.Uncheckit.l TR/Chuckenit.dglxl Trojan:Win32/Chuckenit.A not-a-virus:AdWare.Win32.Elex.sgn


This blog post highlights the technical innovations that we found in the latest versions of Carbon we have discovered.


A backdoor also known as: Backdoor.Slingup BKDR_SLINGUP.M W32/Zbot.AAJD Backdoor.Trojan BKDR_SLINGUP.M Trojan.Win32.Yakes.pqep Trojan.Win32.Inject.ecmohu Trojan.Win32.Z.Yakes.672768 Troj.W32.Yakes.tn6w BackDoor.Tordev.8 Trojan.Win32.Injector W32/Zbot.EUMY-8878 TR/Injector.juol Trojan/Win32.Yakes Trojan:Win32/Casidel.A Trojan.Win32.Yakes.pqep Trojan.Yakes Trojan.Yakes Trj/CI.A Win32/Injector.CXUT Win32.Trojan.Yakes.Ehid Trojan.Yakes!YuLYvE8ikp0 W32/Injector.CGQK!tr Win32/Trojan.621


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G Virus.Virut.Win32.27 W32/Virut.AI W32.Virut.CF Win32/Virut.17408 PE_VIRUX.A-1 Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.tt Virus.Win32.Virut.CE Trojan.MulDrop1.57199 PE_VIRUX.A-1 BehavesLike.Win32.Virut.dc W32/Virut.AI Win32/Virut.bn Trojan[Dropper]/Win32.Injector Win32.Virut.nc.53248 Virus.Win32.Virut.ce Win32/Virut.F Virus.Virut.06 Win32.Virut.E Win32/Virut.NBP IM-Worm.Win32.Zeroll W32/Sality.AO Virus.Win32.VirutChangeEntry.A


Spreads via password guessing over networks


A backdoor also known as: Trojan.Kitoles Trojan.Ransom.Scarab Win32.Trojan.WisdomEyes.16070401.9500.9547 W32/Trojan.LUOM-4097 Ransom.CryptXXX Win.Ransomware.Scarab-6336012-1 Win32.Trojan-Ransom.Amnesia.J52DUW Trojan.Win32.Encoder.ewdzie Trojan.Win32.Z.Securityshield.193058 Trojan.Encoder.23898 Trojan-Ransom.FileCoder Trojan.Purga.w Trojan.Ransom.Scarab.3 Ransom:Win32/Kitoles.A Trojan/Win32.Scarab.R213792 Trojan-Ransom.Purga Win32.Trojan.Filecoder.Phqc Win32/Trojan.Ransom.089


This specific downloader, Cmstar, is associated with the Lurid downloader also known as Enfal'.


Recently Malwarebytes got access to several elements of the espionage toolkit that has been captured attacking Vietnamese institutions.


I am not entirely sure what it is but it has some indications of fareit Trojan.


A backdoor also known as: Trojan.Dos.Bonk.C DoS.Win32.Bonk!O Dos.Bonk Win32.Trojan.Bonk.Tcwa W32/Tool.FPXO-2436 DoS.Win32.Bonk.c Trojan.Dos.Bonk.C Trojan.Win32.Bonk.ddda TrojWare.Win32.DoS.Bonk.C Trojan.Dos.Bonk.C Trojan.Inject.654 BehavesLike.Win32.ExploitMydoom.mm Backdoor.Win32.HacDef W32/VirTool.RO TR/RedCap.kudtu DoS:Win32/Bonk.C Trojan.Dos.Bonk.C DoS.Win32.Bonk.c Trojan.Dos.Bonk.C Trojan.Asthma.23305 Trojan.Dos.Bonk.C Trojan.Dos.Bonk.C Win32/DoS.Bonk.C DoS.Bonk!CFlP7tiJI8A DoS/Bonk.A


A backdoor also known as: Trojan.Duqu Trojan.Duqu.Win32.13 TROJ_DUQU.DEC Win32.Trojan.WisdomEyes.16070401.9500.9587 Win32/Duqu.A TROJ_DUQU.DEC Win.Trojan.Duqu-14 Trojan.Win32.Duqu.evvbpp Trojan.Duqu.2 W32/Trojan.CVVB-9378 TR/Offend.6750706 W32/Duqu.A!tr Trojan:Win32/Duqu.C Worm/Win32.Stuxnet.R608 Trojan.Duqu!ZB0mf9vKpU8 Trojan.Win32.Urelas Win32/Trojan.d72


A backdoor also known as: W32.HfsAutoB.10E5 Trojan-Dropper.Win32.Decay!O Troj.Dropper.W32.Decay.fvr!c Trojan/Dropper.Decay.dst Trojan.Razy.DD584 W32/Dropper.ANEZ TROJ_DECAY.SM Trojan-Dropper.Win32.Decay.fvr Trojan.Win32.Decay.biarma TrojWare.Win32.TrojanDropper.Decay.ghu Trojan.MulDrop6.60922 TROJ_DECAY.SM BehavesLike.Win32.Virut.lc W32/Risk.RTXX-1196 TrojanDropper.Decay.bo TR/Drop.Decay.ayb Trojan[Dropper]/Win32.Decay TrojanDropper:Win32/Decay.A Dropper.Decay.47104.B Trojan-Dropper.Win32.Decay.fvr Win32.Trojan.Yoybot.A Dropper/Win32.Decay.R2060 TrojanDropper.Decay Backdoor.Win32.Poison W32/Decay.FVR!tr


Uptycs research team has discovered a malware family that controls its operations over the messaging service Telegram.


A backdoor also known as: Ransom_Blulock.R002C0CKC17 Trojan.Ransomlock.AI Ransom_Blulock.R002C0CKC17 Win32.Worm.FlyStudio.C not-a-virus:RiskTool.Win32.FlyStudio.awnz Trojan.Win32.Z.Strictor.901632.H TrojWare.Win32.FlyStudio.~UJ Trojan.Winlock.11779 TR/Strictor.901632.1 Trojan.Strictor.DC183 not-a-virus:RiskTool.Win32.FlyStudio.awnz Ransom:Win32/Blulock.A Trojan/Win32.Ransomlock.R135596 Trojan.FlyStudio Trj/CI.A Trojan.Win32.Winlock.f Ransom.FUL!tr


A backdoor also known as: Trojan.Pucedoor.Win32.63 Troj.W32.Pucedoor!c W32/Trojan.MNET-5041 Trojan.Pucedoor Trojan.Win32.Pucedoor.aa Trojan.Win32.AD.eoqlfa Trojan.Win32.Z.Pucedoor.15360 Trojan.Pucedoor.d TR/Pucedoor.hopld Trojan/Win32.Pucedoor Trojan:Win32/Mirsonk.A Trojan.Mikey.D109B5 Trojan.Win32.Pucedoor.aa Trojan/Win32.Pucedoor.R216811 Trj/CI.A Win32.Trojan.Pucedoor.Sxxz Win32/Trojan.Proxy.62e


A backdoor also known as: Trojan/MSILPack.a Trojan.MSIL.VB!/kGPqcrNINQ TROJ_FAM_0000b54.TOMA Packed.MSIL.MSILPack.a Worm.Win32.Rebhip!IK Packed:W32/DonutCrypt.A Trojan.MulDrop1.40622 TROJ_FAM_0000b54.TOMA Packed.MSIL.is TrojanDropper:MSIL/VB.K Packed/Win32.MSILPack Worm.Win32.Rebhip MSIL/AntiAV.NET!tr Trj/Dropper.AJX


A backdoor also known as: Backdoor.Senna KIT/SennaSpy.30 HackTool[Constructor]/Win32.SennaSpy VTool.SennaSpy.30.kcloud Constructor:Win32/Sennaspy.3_0 Constructor.Win32.SennaSpy Win32/Constructor.Spy.58d


We also discovered, based on the samples we gathered, that the malware, which we call CloudTap, has been in use for over a year.


Last week Forcepoint tracked an interesting e-mail campaign that was distributing double zipped files with Windows Script Files WSFs inside.


Symantec has blocked attempts to infect customers in Poland, Mexico and Uruguay by the same exploit kit that infected the Polish banks.


A backdoor also known as: Backdoor/Small.acc Backdoor.Trojan Backdoor.Win32.Small.acc Trojan.Win32.Small.gcwll Backdoor.W32.Small.acc!c Win32.Backdoor.Small.Egnw Backdoor.Small.Win32.7271 Backdoor/Small.dwv BDS/Dalbot.147456 Trojan[Backdoor]/Win32.Small Backdoor.Win32.A.Small.147456 Backdoor.Win32.Small.acc Trojan/Win32.Dalbot.C330242 Backdoor.Small W32/Small.ACC!tr.dldr


They are known to run watering hole and spearphishing campaigns to better pinpoint their targets.


An investigation by Wiz Threat Research has revealed that tens of thousands of websites in East Asia have been hijacked, redirecting users to adult-themed content over the last few months.


A backdoor also known as: W32.FamVT.ExpiroPC.PE Trojan.Symmi.D5257 Troj.Downloader.W32!c Trojan.Click2.53876 BehavesLike.Win32.Comame.pc TrojanProxy:Win32/Potukorp.A Trj/CI.A W32/Farfli.WF!tr


A backdoor also known as: Trojan.Dynamer.S467543 Trojan.Injector.Win32.474808 Trojan/Injector.dkps Trojan.Zbot.191 Win32.Trojan.WisdomEyes.16070401.9500.9969 Ransom_NATAS.SM1 Win.Ransomware.Satan-5713061-0 Trojan.Win32.DKPS.elolak Trojan.Win32.Z.Satan.189345 TrojWare.Win32.Lepoh.A Trojan.Packed2.39908 Ransom_NATAS.SM1 BehavesLike.Win32.Trojan.cc Ransom:Win32/Nasan.B!bit Ransom.Satan/Variant Trojan.Packed Ransom.Satan Win32/Filecoder.Natas.A Win32.Trojan.Filecoder.Hqlr Trojan-Ransom.Satan Win32/Trojan.BO.91d


A backdoor also known as: Trojan.Selfdel.B7 PUP.Optional.InstallMonster Win32.Trojan.Kryptik.zv Trojan.Win32.InstallCube.echedc Application.Win32.ICLoader.VAL Trojan.InstallCube.1058 Trojan.Win32.Crypt Trojan.ExtenBro.od Pua.Downloadmanager GrayWare[AdWare]/Win32.SmartInstaller Trojan.Barys.DD4DA Trojan:Win32/Selfdel.B PUP/Win32.ICLoader.R181040 TScope.Malware-Cryptor.SB Trj/CI.A Trojan.ExtenBro! Win32/Trojan.d13


A backdoor also known as: Ransom.SintaCry BehavesLike.Win32.Trojan.tc Ransom:Win32/SintaCry.A Win32.Trojan-Ransom.CryPy.C Trojan/Win32.CryptXXX.C1966139 Python/Filecoder.AB Trojan.Win32.CryPy.a


A backdoor also known as: HW32.Packed.7656 Spyware.OnlineGames Trojan.Barys.156 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32.Application.PUPStudio.A BehavesLike.Win32.Backdoor.tc TrojanDownloader:Win32/Neglemir.A PUA.RiskWare.DYAMAR


A backdoor also known as: W97M/Downloader.clk W97M.Downloader W2KM_POWLOAD.UHAOEBF Macro.Trojan.Dropperd.Auto W2KM_POWLOAD.UHAOEBF W97M/Downloader.ciz Malicious_Behavior.SB virus.office.qexvmc.1070


A backdoor also known as: TrojanDownloader.Rovnix.AB4 Trojan.Rovnix Trojan/Rovnix.af Trojan.Cidox.E TROJ_ROVNIX.SMA0 Win.Trojan.Rovnix-7 Trojan.Win32.Rovnix.dxtqfl Trojan.Win32.Z.Rovnix.78336.D[h] Trojan.Rovnix.Win32.624 TROJ_ROVNIX.SMA0 Trojan.Rovnix.cl W32/Rovnix.AG!tr Trojan/Win32.Rovnix Trojan.Razy.D3C8A Troj.W32.Rovnix!c Trojan/Win32.Rovnix TrojanDownloader:Win32/Rovnix.A Trojan.Win32.Rovnix.jg Trojan.Rovnix!Bc+f/jzbrBg Trojan.Win32.Rovnix Atros2.AGYW Trj/Rovnix.B Win32/Trojan.bb6


While we do not know for sure the source of these details, they frequently appear on public websites, such as LinkedIn or the company's own website.


A backdoor also known as: TrojanDownloader.Delf Downloader.Delf.Win32.55939 Win.Trojan.Delf-6394424-2 Trojan-Downloader.Win32.Delf.kqql Trojan.Win32.Delf.evdbxm Trojan.Win32.Z.Delf.912896 Troj.Downloader.W32.Delf!c Trojan.DownLoad3.47593 Trojan-Downloader.Win32.Delf W32/Trojan.NTEF-5615 TR/Downloader.lpmfp Trojan-Downloader.Win32.Delf.kqql Downloader/Win32.Delf.C2285081 Trj/GdSda.A Win32.Trojan-downloader.Delf.Ammc W32/Delf.CGH!tr.dldr


A backdoor also known as: Exp.SWF.CVE-2017-11292.1 Trojan.Maljava SWF/Exploit.CVE-2017-11292.A DOC.Z.CVE-2017-1129.10752 Exploit.CVE-2017-11292.1 SWF_EXPLOIT.YYRZ Trojan.DWCI-31 EXP/CVE-2017-11292.B Trojan[Exploit]/SWF.CVE-2017-11292.a Trojan:O97M/Gamafeshi.A Trojan.SWF.Exploit


The hacker proceeded to leak archives of internal Hacking Team tools and communications.


A backdoor also known as: Backdoor/W32.Small.8192.U Backdoor.Win32.Small!O Backdoor.Small Backdoor/Small.aad BKDR_SMALL.LIY Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/MalwareS.BJDC BKDR_SMALL.LIY Win.Trojan.Small-15022 Backdoor.Win32.Small.aad Trojan.Win32.Small.cgfnz Backdoor.Win32.A.Small.8192.J Backdoor.Win32.Small.~C W32/Risk.EHGV-6738 Backdoor/Small.cqd W32.Malware.Downloader BDS/Small.L Trojan[Backdoor]/Win32.Small Backdoor.W32.Small.aad!c Backdoor.Win32.Small.aad Backdoor:Win32/Neporoot.A Trojan/Win32.Downloader.C113283 Backdoor.Small Trj/CI.A Win32.Backdoor.Small.Eckj Trojan.DL.Troxen!zKvgG9AM1Ro Backdoor.Win32.Small W32/CMDer.AA!tr


A backdoor also known as: Worm.Skypii Trojan/Injector.aech Trojan.Johnnie.D5D69 W32.Phopifas Win.Trojan.Zbot-63011 Trojan-Dropper.Win32.Injector.tsab Trojan.Win32.Zbot.crqlec Trojan.Win32.Z.Johnnie.44972 Trojan.MulDrop2.64582 Trojan.Win32.Injector W32/Trojan.GAQU-5890 TR/Buzus.A.287 Worm:Win32/Skypii.A Trojan-Dropper.Win32.Injector.tsab Trojan/Win32.Inject.R57535 BScope.Adware.Softpulse Win32.Trojan-dropper.Injector.Hyah W32/Inject.AEC!tr Win32/Trojan.Downloader.31f


A backdoor also known as: Trojan.Brancud Dropper.Wlord.Win32.197 Trojan/Dropper.Wlord.vg Trojan.Barys.D14BD W32/Backdoor2.FFAV Win.Trojan.Delf-10381 Trojan.Win32.Pigeon.edgwvf NetWorm.Win32.Kolab.~F BackDoor.Pigeon.14364 BehavesLike.Win32.HLLP.vc Trojan.Win32.ProcessHijack W32/Backdoor.UDBV-8754 Win32.Troj.Wlord.vg.kcloud Spyware.Wlord.Dr.2888704 TrojanDropper.Wlord Win32/TrojanDropper.Delf.NQG Win32.Trojan-dropper.Wlord.Wncj Trojan.DR.Wlord!ooBDWiiijA4 Win32/Trojan.f50


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9947 Trojan.Razy.D1B384 Backdoor:MSIL/Gataspi.A Backdoor.NanoCore Trj/GdSda.A


A backdoor also known as: Backdoor.Win32.Proxyier!O DNSChanger.cw Trojan.Zusy.Elzob.D136F TROJ_DNSCHANGER_0000063.TOMA Win32.Trojan.WisdomEyes.16070401.9500.9713 TROJ_DNSCHANGER_0000063.TOMA Win.Trojan.B-445 Backdoor.Win32.Simda.ph Trojan.Win32.Simda.bxootp Backdoor.Proxyier.Win32.9 BehavesLike.Win32.Backdoor.fc Backdoor/Proxyier.o Trojan/Win32.Proxyier Trojan:Win64/Simda.A Backdoor.Win32.Simda.ph Trojan/Win32.Jorik.R13830 SScope.Trojan-Proxy.1821 Trojan.FakeAlert Trojan.Win32.FakeAV W32/Binder.RZ!tr


The malware infected a wide spread of Android users in China, stealing their bank credentials and other sensitive personal information.


UrlZone is a banking trojan that appeared in 2009.


There has been considerable discussion about domain fronting following the release of a paper detailing these techniques.


This attack was dubbed Dark Seoul'; it involved wreaking havoc on affected systems by wiping their hard drives, in addition to seeking military intelligence.


Last week, Patrick Wardle published a very nice analysis of a new Backdoor and Dropper used by HackingTeam, which is apparently alive and well.


Indicators imply an exploitation attempt, that may not have been successful.


A backdoor also known as: Pdf.Fareit.A PDF/PowerShell.C Exploit.PDF.16243 HEUR_PDF.PS TrojanDownloader:Win32/Perferd.A PDF/Exploit.S3 PDF/PowerShell.ECC!tr


A backdoor also known as: Trojan.Python.Simplified.b Trojan.Py2Exe.HackSpy.ekhfvk Trojan.DownLoader25.20169 Trojan.Python.Simplified.b Trojan:Win32/Pitroj.A Trj/CI.A Win32.Trojan.Simplified.Dxmm W32/Python_Simplified.B!tr Win32/Trojan.IM.2b4


Over the past month, Palo Alto Networks has observed two spam campaigns targeting users residing in Italy.


possibly working independently while sharing information between themselves, are exploiting the Elasticsearch vulnerability primarily to establish widespread DDoS botnet infrastructures.


A cross-platform win32-based Mirai spreader and botnet is in the wild and previously discussed publicly.


When DualToy began to spread in January 2015, it was only capable of infecting Android devices.


This group is well known for a widely publicized attack involving the compromise of Forbes.com, in which the site was used to compromise selected targets via a watering hole to a zero-day Adobe Flash exploit.


For example, intended victims frequently have titles of Chief Financial Officer, Head of Finance, Senior Vice President, Director and other high level roles.


Links returned by a Google search, however, are not guaranteed to be safe.


This paper has already stated that we believe the Dukes to be a Russian state-sponsored cyberespionage operation .


This file contains all HTML , CSS and PNG files necessary to create overlays . However , the group behind MuddyWater has been known to target other countries in the Middle East , Europe and the US . Derusbi : File Type :P E32 executable ( DLL ) Intel 80386, for MS Windows . UNC2639 was first identified exploiting multiple zero - day vulnerabilities in Microsoft Exchange in early March 2021 .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 Administrator permissions are required for hot patching , and the technique used by PLATINUM does not attempt to evade this requirement through exploitation . Based on Kaspersky Lab 's analysis of NetTraveler 's C&C data , there were a total of 350 victims in 40 countries across including the United States , Canada , United Kingdom , Russia , Chile , Morocco , Greece , Belgium , Austria , Ukraine , Lithuania , Belarus , Australia , Hong Kong , Japan , China , Mongolia , Iran , Turkey , India , Pakistan , South Korea , Thailand , Qatar , Kazakhstan , and Jordan .


The implant can log in to the attackers email inbox , parse emails for commands in a special “ Cmd ” folder and save any payloads to a device from email attachments . Bankshot was first reported by the Department of Homeland Security on December 13 , 2017 , and has only recently resurfaced in newly compiled variants . APT33 : 6401abe9b6e90411dc48ffc863c40c9d9b073590a8014fe1b0e6c2ecab2f7e18 S-SHA2 SniffPass . This enables GOGETTER to maintain persistence across reboots .


PROMETHIUM is an activity group that has been active since at least 2012 . The attackers have targeted a large number of organizations globally since early 2017 , with the main focus on the Middle East and North Africa ( MENA ) , especially Palestine .


We expect it to churn out new variants with even more sophisticated techniques . traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors . TAU modified the original HexRaysDeob to make it work for APT10 ANEL obfuscations . In the case of a traditional ProxyNotShell exploit chain , the attack sequence is done in two steps :


It has several protections in place , both in the C2 and the malware 's code . An additional campaign has also been observed targeting Japanese entities . The actor behind the ShadowPad incident has been publicly identified by Microsoft in court documents as BARIUM . Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns ( e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s ) ) .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . OurMine is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


Decrypting the assets After being decrypted , the asset turns into the .dex file . RoyalDNS - required APT15 . The image file “order.jpg” contained in the first ZIP structure is actually a non-malicious PNG formatted image . Therefore , there are cases where these vulnerabilities are accessible via the internet .


The infographic in Figure 1 traces the earliest known dates on which TA505 began distributing particular malware strains , beginning with Dridex in 2014 and most recently when they elevated GlobeImposter and Philadelphia from small , regionally targeted ransomware variants to global threats .


For more information related to HIDDEN COBRA activity , go to https://www.us-cert.gov/hiddencobra .


Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year . The targets and themes of Bahamut 's campaigns have consistently fallen within two regions – South Asia ( primarily Pakistan , specifically Kashmir ) and the Middle East ( from Morocco to Iran ) .


] net is not awfully well maintained or updated to the latest apps available . Henkel confirms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions . While attribution of the first two spear phishing attacks is still uncertain , we attribute the second December phishing campaign to the China-based APT group that we refer to as APT16 .


Donot , named and tracked by PatchSky , is an attack group that mainly targets countries such as Pakistan in South Asia . Early in Q2 , Kaspersky identified an interesting Lazarus attack targeting a mobile gaming company in South Korea that we believe was aimed at stealing application source code . In a recent campaign , Kaspersky observed ScarCruft using a multi-stage binary to infect several victims and ultimately install a final payload known as ROKRAT – a cloud service-based backdoor . ESET recently analyzed a new Mac OS sample from the OceanLotus group that had been uploaded to VirusTotal . The threat actor behind the campaign , which Kaspersky believes to be the PLATINUM APT group , uses an elaborate , previously unseen , steganographic technique to conceal communication . FireEye defined APT40 as the Chinese state-sponsored threat actor previously reported as TEMP.Periscope , Leviathan and TEMP.Jumper . In January , Kaspersky identified new activity by the Transparent Tribe APT group aka PROJECTM and MYTHIC LEOPARD , a threat actor with interests aligned with Pakistan that has shown a persistent focus on Indian military targets . OceanLotus was another actor active during this period , using a new downloader called KerrDown , as reported by Palo Alto . ESET recently uncovered a new addition to OceanLotus’s toolset targeting Mac OS . In mid-2018 , Kaspersky's report on Operation AppleJeus” highlighted the focus of the Lazarus threat actor on cryptocurrency exchanges . Kaspersky also observed some activity from Gaza Team and MuddyWater . Kaspersky wrote about LuckyMouse targeting national data centers in June . Kaspersky also discovered that LuckyMouse unleashed a new wave of activity targeting Asian governmental organizations just around the time they had gathered for a summit in China . Kaspersky have observed similar activity in the past from groups such as Oilrig and Stonedrill , which leads us to believe the new attacks could be connected , though for now that connection is only assessed as low confidence . In August 2019 , FireEye released the Double Dragon” report on our newest graduated threat group , APT41 . Today , FireEye Intelligence is releasing a comprehensive report detailing APT41 , a prolific Chinese cyber threat group that carries out state-sponsored espionage activity in parallel with financially motivated operations . Group-IB experts continuously monitor the Silence’ activities . Group-IB has uncovered a hacker group , MoneyTaker , attacking banks in the USA and Russia . Group-IB reveals the unknown details of attacks from one of the most notorious APT groups , Lazarus . Finally , Kaspersky produced a summary report on Sofacy’s summertime activity . Kaspersky were also able to produce two reports on Korean speaking actors , specifically involving Scarcruft and Bluenoroff . Analysis of the payload allowed us to confidently link this attack to an actor Kaspersky track as BlackOasis . Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day .


Threat Actor Profile : TA505 , From Dridex to GlobeImposter .


November 16 , 2016 In what 's being chalked up as an apparent mistake , more than 120,000 Android phones sold in the U.S. were shipped with spying code that sent text messages , call logs and other sensitive data to a server in Shanghai . This slight delay may point to the handing over of active exploitation duties to other operator(s) in a multi-team APT10 effort within the Ministry of State Security for the attack . The actor embedded malicious code to a resource section of the legitimate SFX file created by a file encryption tool , and modified the entry point of the program for jumping to the malicious code soon after the SFX program starts .


Also , by creating this type of API access , Turla could use one accessible server as a single point to dump data to and exfiltrate data from . Since late 2018 , based upon the most-recent posting , FireEye appears to have " walked back " the previously-used terminology of TEMP.Veles and instead refers rather cryptically to the " TRITON actor " , while Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME .


] databit [ . In late September 2015 Mofang used the website of Myanmar 's national airline hosted at www.flymna.com for an attack against an organization in Myanmar . The sample 832f5e01be536da71d5b3f7e41938cfb shares code with an older Aumlib variant with the hash cb3dcde34fd9ff0e19381d99b02f9692 . Based on our telemetry , we have identified an array of affected victims including US - based retailers , local governments , a university , and an engineering firm .


It is also possible that this functionality is under development , making this placeholder code incomplete . Cylance determined that the ‘Ghost Dragon’ group utilized specifically tailored variants of Gh0st RAT , which the group modified from the 3.6 version of the source code released in 2008 . The first three are generated by rand() and the fourth is computed based on the first and third .


As the previous picture demonstrated , the followed Vector object ’s length field being overflowed as 0x80007fff , which enables the attacker to read/write arbitrary data within user space .


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests . During the months that followed in which we tracked Confucius' activities , we found that they were still aiming for Pakistani targets .


The Hillary Clinton email leak was the center of the latest scandal in the news caused by Threat Group-4127 ( TG-4127 ) .


The bootkit Android.Oldboot has infected more than 350,000 android users in China , Spain , Italy , Germany , Russia , Brazil , the USA and some Southeast Asian countries . It was a targeted attack we are calling " Machete " . In seeking to identify the organization behind this activity ,our research found that People ’s Liberation Army ( PLA ’s ) Unit 61398 is similar to APT1 in its mission , capabilities , and resources . Clients using Internet Explorer version 8 are served with “ about.htm ” , for other versions of the browser and for any other browser capable of running Java applets , the JavaScript code loads “ JavaApplet.html ” .


NOVEMBER 2016 , The OSCE confirmed that it had suffered an intrusion , which a Western intelligence service attributed to APT28 .


The group Magic Hound is linked via infrastructure and tools to the Rocket Kitten threat actor group although Palo Alto cannot confirm the extent of any relationship between the two groups .


APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors . In wake of these events , a security firm Resecurity reached out to NBC news and claimed that they had reasons to believe that the attacks were carried out by Iranian-linked group known as IRIDIUM .


It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries . From our first malicious sample encounter back in mid-September until now , we have observed 12 infected applications , the majority of which are in the system utility category .


Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe . Dokument 09.06.2017.zip .


Cannon acknowledges the receipt of file download by sending an email to sahro.bella7@post.cz with l.txt ( contains 090 string ) as the attachment , ok2 within the body and a subject with the unique system identifier via SMTPS from one of the three accounts from Step 1 .


These malware pose as legitimate Facebook or Chrome applications . The targeting of Pakistan , Bangladesh , Sri Lanka , Maldives , Myanmar , Nepal , and the Shanghai Cooperation Organization are all historical espionage targets by India . Generic : aafa83d5e0619e69e64fcac4626cfb298baac54c7251f479721df1c2eb16bee7 Trojan S-MAL/Downloader ( Executable file ) .


One method , which was popular in Germany , is known as mobile TAN ( mTAN ) . Related or not , one thing is certain : the actor ( s ) using these customized BlackEnergy malware are intent on stealing information from the targets . Since May 2016 , we have continued to monitor and uncover various attacks and tools associated with the OilRig group .


QiAnXin identified this APT group coded as ‘APT-C-35’ in 2017 , who is mainly targeting Pakistan and other South Asian countries for cyber espionage . In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks . For over eighteen months from March 2017 until November 2018 , Scattered Canary’s frequent enterprise-focused credential phishing campaigns almost exclusively targeted businesses in the United States and Canada . In July 2018 , following a trend we have observed across the entire BEC threat landscape , Scattered Canary changed their preferred cash out mechanism from wire transfers to gift cards . Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials . Using personal information obtained from various sources , Scattered Canary started perpetrating fraud against US federal and state government agencies . In total , 35 actors have been tied to Scattered Canary’s operations since the group emerged in 2008 . Just as with romance scams , actors make use of scripts and templates they can copy-and-paste without having to create something on their own . When it comes to engaging targets , Scattered Canary frequently maximized efficiencies through the use of scripts , or as some members of the group call them , formats.” These formats are templated text documents that can contain several layers of phishing messages to send to potential victims . Recently , we unveiled the existence of a UEFI rootkit , called LoJax , which we attribute to the Sednit group . If Scattered Canary can be seen as a microcosm for the rapidly evolving organizations behind today’s most pernicious email scams , this report demonstrates that a much more holistic approach—one based on threat actor identity rather than type of fraudulent activity—is required to detect email fraud and protect organizations . This is a first for an APT group , and shows Sednit has access to very sophisticated tools to conduct its espionage operations . Three years ago , the Sednit group unleashed new components targeting victims in various countries in the Middle East and Central Asia . In the past , Sednit used a similar technique for credential phishing . At the end of August 2018 , the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components . As we explained in our most recent blogpost about Zebrocy , the configuration of the backdoor is stored in in the resource section and is split into four different hex-encoded , encrypted blobs . The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability . It used GitHub and Slack as tools for communication between the malware and its controller . On July 9 , we discovered a new version of SLUB delivered via another unique watering hole website . This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative ( ZDI ) that was just patched this April .


At the time of writing , to our knowledge no other third-party app stores , nor the official Google Play store , were or are hosting this malicious HenBox variant masquerading as DroidVPN . Far from attacking Henkel and the other companies arbitrarily , Winnti takes a highly strategic approach . APT16 actors sent spear phishing emails to two Taiwanese media organizations .


The oldest app of the second campaign was last updated in April 2016 , meaning that the malicious code hid for a long time on the Play store undetected . Their operations against gaming and technology organizations are believed to be economically motivated in nature . It starts by initializing a random number generator and reading 100 bytes inside the ZxShell Dll at a hardcoded location . Using tools that are more lightweight and generic than those observed in prior OT incidents , the actor likely decreased the time and resources required to conduct a cyber physical attack .


Mobile devices are at the frontier of cyber espionage , and other criminal motives . Also our visibility as a vendor does not cover every company in the world ( at least so far ; ) ) and the Kaspersky Security Network ( KSN ) did not reveal other attacks except those against gaming companies . The plugin registry key HKLM\SYSTEM\CurrentControlSet\Control\zxplug is opened and each value is queried . RA Group , in its ongoing campaigns , has targeted the U.S. , South Korea , Taiwan , the U.K. and India across several business verticals , including manufacturing , wealth management , insurance providers , pharmaceuticals and financial management consulting companies .


further straining the relationship between Hamas and the Palestinian Authority who governs the West Bank .


The result of the password validation will always be wrong , but after the apparent validation attempt , the decoy PDF document is opened .


In the examined version , it was downloaded from : hxxp : //url [ . The malware starts communicating with the C&C server by sending basic information about the infected machine . Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates ( UAE ) government , but that has not been confirmed .


+86.01078456689 The command-and-control server is hosting an index page which also serves an APK file : The referenced “ Document.apk ” is 333583 bytes in size , MD5 : c4c4077e9449147d754afd972e247efc . PLEAD also uses CVE-2017-7269 , a buffer overflow vulnerability Microsoft Internet Information Services ( IIS ) 6.0 to compromise the victim 's server . A cursory review of BlackOasis ' espionage campaign suggests there is some overlap between the group 's actions and Saudi Arabia 's geopolitical interests .


The group has focused mainly on governmental targets in Iraq and Saudi Arabia , according to past telemetry . This time the document purported to be about the involvement of the Emir of Qatar in funding ISIS , which was seemingly copied from a website critical of Qatar .


intelnetservice.com intelsupport.net The export called “ Applicate ” runs a standard Windows application message loop until a “ WM_ENDSESSION ” message is received .


File Server ( http : //www.psservicedl [ . The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . The Seedworm group controls its Powermud backdoor from behind a proxy network to hide the ultimate command-and-control ( C&C ) location .


The exploit installs Silence’s loader , designed to download backdoors and other malicious programs . In the 2017 ShadowPad attack , the update mechanism for Korean server management software provider NetSarang was compromised to serve up an eponymous backdoor .


Of these , CosmicDuke and MiniDuke appear to have been in more active use , while receiving only minor updates .


It ’s worth mentioning that , according to X-Force IRIS , the initial compromise took place weeks before the actual Shamoon deployment and activation were launched .


Some of the documents exploited CVE-2017-0199 to deliver the payload . Around the same time , WildFire also captured an e-mail containing a Word document ( " hello.docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient .


First , the app has to turn off SELinux protection . This attack campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes . In the past , threat actors would modify easily compromised websites to host C2 commands and configuration , as observed in the China based APT1 ’s WEBC2 suite of backdoors . This downloader is unique per system and contains a customized backdoor written in Assembler .


The malicious documents seen in recent activity refer to a number of topics , including recent military promotions within the Pakistan Army , information related to the Pakistan Atomic Energy Commission , as well as Pakistan 's Ministry of the Interior . The EternalBlue exploits from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 .


This malware also contains a screen recorder . The Lamberts toolkit spans across several years , with most activity occurring in 2013 and 2014 . APT12 is believed to be a cyber espionage group thought to have links to the Chinese People's Liberation Army . For example , HTTPS over port 8088[1 ] or port 587[2 ] as opposed to the traditional port 443 .


After infestation , Weeping Angel places the target TV in a 'Fake-Off' mode , so that the owner falsely believes the TV is off when it is on . We encountered the first document exploit called " THAM luan - GD - NCKH2.doc " a few days ago , which appears to be leveraging some vulnerabilities patched with MS12-060 .


This vulnerability was discovered by FireEye in September 2017 , and it is a vulnerability we have observed being exploited in the wild . Carbanak is a backdoor used by the attackers to compromise the victim .


Moving through the infection process , NetWitness Endpoint detects the initial exploit CVE-2017-1182 in action as the Microsoft Equation Editor , EQNEDT32.exe , scores high for potentially malicious activity . Bahamut spearphishing attempts have also been accompanied with SMS messages purporting to be from Google about security issues on their account , including a class 0 message or " Flash text " . These text messages did not include links but are intended to build credibility around the fake service notifications later sent to the target 's email address .


Once we looked into the file , we quickly found out that the inner-workings of the APK included a malicious payload , embedded in the original code of the application . PyLocky was found to be targeting entities in France and Germany . We witnessed this actor extensively testing a known public exploit during its preparation for the next campaign . Fake browser updates are a very common decoy used by malware authors .


Conclusion This trojan shows a new path for threats to evolve . Aside from deploying novel malware , LYCEUM’s activity demonstrates capabilities CTU researchers have observed from other threat groups and reinforces the value of a few key controls . TEMP.Hermit is generally linked to operations focused on South Korea and the United States .


Both versions are designed to collect system information and running processes and send them to the designated C2 server using http POST to the URI used in both cases is /agr-enum/progress-inform/cube.php?res= .


We believe Sofacy used this tool , as the macro within their delivery document closely resembles the macros found within Luckystrike .


Both INDRIK SPIDER ( with BitPaymer ransomware ) and GRIM SPIDER ( with Ryuk ransomware ) have made headlines with their high profile victims and ransom profits , demonstrating that big game hunting is a lucrative enterprise . A powerful threat actor known as " Wild Neutron " ( also known as " Jripbot " and " Morpho " ) has been active since at least 2011 , infecting high profile companies for several years by using a combination of exploits , watering holes and multi-platform malware .


In this campaign , adversaries did not use any exploit .


The stream of bytes is sent over TCP to the client .


Figure 8 . Additionally , there is evidence to suggest APT33 targeted Saudi Arabian and Western organizations that provide training , maintenance and support for Saudi Arabia 's military and commercial fleets . The malicious DLL exports the same function names as the original mcvsocfg.dll library . HHS HC3 warned that the stolen credentials may have been used to compromise a number of healthcare organizations and enterprises in other industries .


7bb719f1c64d627ecb1f13c97dc050a7bb1441497f26578f7b2a9302adbbb128 .


Do not download mobile apps from unofficial or unauthorized sources . This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample . Spring Dragon 's infiltration techniques there were not simply spearphish .


The implants are highly configurable via encrypted configuration files , which allow the adversary to customize various components , including C2 servers , the list of initial tasks to carry out , persistence mechanisms , encryption keys and others .


] com/ ) : This server provides APK files with advertising network . A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . There was a mistake in the original Morphisec analysis which linked these attacks to FIN7 .


Researchers at Palo Alto have attributed sloo.exe and related activities to threat actors of a likely Iranian state-sponsored origin which they ’ve named Magic Hound .


In the most recent variant , Sofacy modified the internals of the malicious scripts , but continues to follow the same process used by previous variants by obtaining a malicious Flash object and payload directly from the C2 server .


A lockdown activity , which is a transparent window shown at the top of the screen that contains a “ loading ” cursor . Alternatively , the attackers might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address . The group 's targets include a number of organizations and individuals located in Russia .


In more up-to-date versions of Android , EventBot will ask for permissions to run in the background before deleting itself from the launcher . DoublePulsar is then used to inject a secondary payload , which runs in memory only . It is highly likely the Lotus Blossom used spear-phishing attacks containing links to these malicious documents as a delivery mechanism .


This is a good example where two-factor authentication based on SMS would fail since the attacker can read the SMS . APT10 primarily used PlugX malware from 2014 to 2016 , progressively improving and deploying newer versions , while simultaneously standardising their command and control function . OceanLotus : cd67415dd634fd202fa1f05aa26233c74dc85332f70e11469e02b370f3943b1d Loader #2 . Additionally , by using leaked source code , threat actors can confuse or mislead investigators , as security professionals may be more likely to misattribute the activity to the wrong actor .


The system verifies the signature of the legitimate file while installing the malicious file . There has also been at least one victim targeted by a spear-phishing attack . In the case we examined , the path was C:\ProgramData\DRM\CLR\CLR.exe . The campaign started in at least June 2023 , and the ransom note appears to mimic certain aspects of the ransom note used in the global WannaCry attacks from 2017 .


For the Delphi version , the following registry key and value are used for persistence :


Both CloudDuke backdoor variants support simple backdoor functionality , similar to SeaDuke .


LINKS TO WOLF INTELLIGENCE During the Virus Bulletin conference in 2018 , CSIS researchers Benoît Ancel and Aleksejs Kuprins did a presentation on Wolf Research and the offensive arsenal developed by the organization . The police suspected Lurk of stealing nearly three billion rubles , using malicious software to systematically withdraw large sums of money from the accounts of commercial organizations , including banks . Older versions also used an XLS exploit . The source code is loaded from one of several domains impersonating Google ( google - analytiks[.]com ) or Adobe ( updateadobeflash[.]website ): That code contains all the web elements ( images , fonts , text ) needed to render the fake browser update page .


As has been previously reported , some versions of the Android malware were present in the Google Play Store . We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn't possible for us to verify this link .


] com Malicious Twitter accounts : https : //twitter.com/lucky88755 https : //twitter.com/lucky98745 https : //twitter.com/lucky876543 https : //twitter.com/luckyone1232 https : //twitter.com/sadwqewqeqw https : //twitter.com/gyugyu87418490 https : //twitter.com/fdgoer343 https : //twitter.com/sdfghuio342 https : //twitter.com/asdqweqweqeqw https : //twitter.com/ukenivor3 The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 . The document contained a VBS macro that once decompressed was approximately 650 lines of code . Bullock had spent many hours poring over the hundreds of thousands of emails that the Ashley Madison hackers stole from Biderman and published online in 2015 .


The file is a 64bit-compatible compiled binary of the open source utility Winexe .


We ’ll cover more recent 2018 change in their targeting and the malware itself at SAS 2018 .


In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document . Compared to Patchwork , whose Trojanized documents exploit at least five security flaws , Confucius' backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .


Its main task is to bypass the two-factor authentication of the client in the online banking system . Thus , it is clear they are trying to be as stealthy as possible by hiding in the network traffic of the targeted organizations . There are newer versions , up to version 3.39 as of October 2014 . An exhaustive analysis of domains registered to the various Vistomail pseudonyms used by Harrison shows he also ran Bash - a - Business[.]com , which Harrison dedicated to “ all those sorry ass corporate executives out there profiting from your hard work , organs , lives , ideas , intelligence , and wallets . ”


Static analysis tools like IDA may not be useful in analyzing custom code that is interpreted and executed through a VM and a new set of instructions . In addition , we observed a TTP shift post publication with regards to their malware delivery ; they started using compromised but legitimate domains to serve their malware . Supply-chain attacks are hard to detect from the consumer perspective . Several issues in Foxit PDF reader could lead to arbitrary code execution Foxit PDF Reader is one of the most popular PDF readers on the market , offering many similar features to Adobe Acrobat .


Their evolving and modified SPLM / CHOPSTICK / XAgent code is a long-standing part of Sofacy activity , however much of it is changing .


we assess with high confidence that these incidents were conducted by APT10 also known as Stone Panda , menuPass , CVNX in an effort to gain access to networks and steal valuable intellectual property or gain commercial advantage . The first attack started in early July with a ShimRatReporter payload .


This alone would attract a whole new audience–and a new stream of revenue–for Yingmob . Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others . APT33 : 64.251.19.214 [REDACTED].sytes.net . The Stuxnet Virus identified in 2010 that was used to destroy the Iranian centrifuges is but one relevant example of such a motivation .


The DLL exploited another previously unknown vulnerability ( designated CVE-2015-2546 ) in the Windows kernel , which enabled it to elevate privileges for the Word executable and subsequently install a backdoor through the application . Hackers use Metasploit to conduct all these activities : network reconnaissance , search for vulnerable applications , exploit vulnerabilities , escalate systems privileges , and collect information .


Use of email theme related to the Geo-political events that is of interest to the targets .


Below are some of the elements showing the relation . In order to exfiltrate the compromised data , APT10 employed custom malware that used Dropbox as its C2 . The domain , softfix.co.kr was registered in 2014 .


Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt . This documentation provides new insight into intrusion efforts conducted by at least four discrete Iranian threat actors , Rocket Kitten , Infy , Sima , and Operation Cleaver , including groups and tools that have not been previously disclosed .


SCHTASKS /Create /f /SC minute /TN runawy /mo 5 /tr C:\Users\<USER>\runawy.exe .


The app ties together two malware families - Desert Scorpion and another targeted surveillanceware family named FrozenCell - that we believe are being developed by a single , evolving surveillanceware actor called APT-C-23 targeting individuals in the Middle East . DHS has previously released Alert TA14-353A . Older versions of 7Zip also behave like PowerArchiver and WinRAR . 7Zip version 9.22 and older saw the executable as . Simultaneously , a threat researcher outside of CrowdStrike discovered an attacker ’s tooling via an open repository , downloaded all of the tools , and made them available through a MegaUpload link in a Twitter post.2


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities .


83be35956e5d409306a81e88a1dc89fd . 45.63.10.99 . 69.87.223.26 .


Bdo is the Russian translation for RBS ( Remote Banking System ) so it is clear that RBS is a target for this malware . In this latest incident , the group registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day .


Many other banking malware families followed suit and released their own Android malware components designed to steal those OTPs and TANs . APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel files to deliver their initial exploits . The use of infrastructure tied to Iranian operations , timing and alignment with the national interests of Iran also lead FireEye to assess that APT34 acts on behalf of the Iranian government .


The remaining 80% of STRONTIUM attacks have largely targeted organizations in the following sectors : government , IT , military , defense , medicine , education , and engineering .


While one family relies on a small number of supported commands and simple shells , the other delves into more convoluted methods of injections , checks , and supported feature sets . NetTraveler has been used to target diplomats , embassies and government institutions for over a decade , and remains the tool of choice by the adversaries behind these cyber espionage campaigns .


] 230 [ . The Dukes could have ceased all use of CosmicDuke ( at least until they had developed a new loader ) or retired it entirely , since they still had other toolsets available . Once the raw contents of the pastebin.com post were downloaded , that data would also be executed in memory . " Iran often adopts an asymmetric warfare strategy to accomplish its political and military goals , and its development of cyberwarfare capabilities adds to this asymmetric toolkit , allowing the country a lowcost means to conduct espionage and attack stronger adversaries .


The APC routine creates a thread in the context of the svchost.exe process that will map and execute the stage 5 malware into the winlogon.exe process . The report specifies the Magic Hound targeted political , military and defense industry in the US , UK and Israel . The launcher binary , which contains the final backdoor , is RC4 encrypted and wrapped in a layer of obfuscated shellcode . Adversaries may manipulate control systems devices or possibly leverage their own , to communicate with and command physical control processes .


Going back to the PowerShell command , the initial reason I stopped to look at it was due to the way they concatenated variables to form the download command and output .


Further analysis revealed a well-established collection of fake social media profiles that appear intended to build trust and rapport with potential victims . The malicious samples we found are the early stage malware most often delivered by spear-phishing e-mails .


With the malware now in place , a number of actions can be performed , including allowing attackers to secretly monitor and control smartphones via a backdoor , send messages to premium-rate numbers , and intercept two-factor authentication codes sent by online banking apps and the like . There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors . Typically this event occurs a few times to several times , Honeypot Alerts Set up a honeypot mechanism to attract interest from adversaries .


The user ’s development patterns appear to pay particular attention to AV evasion and alternative code execution techniques .


The use of tools not previously observed by CTU researchers suggests that the group could have access to malware development capabilities .


The class “ org.starsizew.Ac ” is designed for this purpose ; its only task is to check if the main service is running , and restart the main service if the answer is no . The campaign appears highly targeted and delivers a backdoor we have called ' Helminth ' . First of all the macro will set the registry key “ HKEY_CURRENT_USER\Software\Microsoft\Ofﬁce\ ” & Application.Version & _ ” \Word\Security\ ” and then will set up two scheduled tasks that will start respectively every 12 and 15 minutes : the ﬁrst one will run a “ IndexOfﬁce.vbs ” in the path “ %APPDATA%\Microsoft\Ofﬁce\ ” and the second one will run “ IndexOfﬁce.exe ” in the same path . " If you ve read about recent cyber attacks in the news , you might be wondering why cyber criminals try to hack into other systems and what motivates them .


The dropper drops the Spark backdoor binary and a shortcut file used to initiate persistence in the following locations .


Additionally , these decoy documents are hosted on legitimate websites including a government website belonging to the Cambodia Government and in at least once case , Facebook . Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe .


We were able to identify several victims in this Operation AppleJeus sequel .


X-Force IRIS researchers further identified that the threat actor behind the malicious documents served many of them using a URL-shortening scheme in the following pattern : briefl.ink/{a-z0-9}[5] .


An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong . The method , which technically redirects users through local DNS poisoning , requires a fair bit of work ; recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the group behind GozNym – Nymaim – appear up to the task .


As discussed in the Actions on objectives section , the threat actors appear to wait until they have established a foothold .


How it works When the malware is first started on the device it will begin by removing its icon from the app drawer , hiding from the end user . APT10 has historically targeted healthcare , defense , aerospace , government , heavy industry and mining , and MSPs and IT services , as well as other sectors , for probable intellectual property theft . 9002 is the infamous RAT frequently seen in targeted attacks reported by various security vendors , including Palo Alto Networks .


It also has engaged in network reconnaissance against targets of interest to TEMP.Veles .


It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks . TClient is actually one of Tropic Trooper 's other backdoors .


] 205 3b89e5cd49c05ce6dc681589e6c368d9 ir.abed.dastan dexlib 2.x 185.141.60 [ . Similar to the Bisonal variant targeting the Russian organization , this sample was also disguised as PDF document . This cloud service-based backdoor contains many features .


Rotexy may start requesting device administrator privileges again in an infinite loop ; in that case , restart the device in safe mode and remove the malicious program . Careto 's Mask campaign we discovered relies on spear-phishing e-mails with links to a malicious website . The Leviathan generally emailed Microsoft Excel documents with malicious macros to US universities with military interests , most frequently related to the Navy .


Reduce privileges to only those needed for a user 's duties .


After gaining access to each of the IoT devices , the actor ran tcpdump to sniff network traffic on local subnets .


The timeline of modification dates within the ZIP also suggest the actor changed the Russian version to English in sequential order , heightening the possibility of a deliberate effort to mask its origins .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . The Magic Hound has repeatedly used social media to identify and interact with employees at targeted organizations and then used weaponized Excel documents .


TG-3390 uses older exploits to compromise targets , and CTU researchers have not observed the threat actors using zero-day exploits as of this publication .


Apple has confirmed that the iOS apps are not functioning based on analysis of the codes , and stated that the sandbox is able to detect and block these malicious behaviors . However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . #3 and #4 as successors of #11 ) While a sudden dip in attacks is n't too unusual for top ransomware gangs , it 's worth mentioning that in last month ’s review we speculated that Royal might be going through a rebrand .


Each of them consists of a set of plugins designed for different tasks : while FuzzBunch plugins are responsible for reconnaissance and attacking a victim , plugins in the DanderSpritz framework are developed for managing already infected victims . In 2016 , for instance , we found their campaigns attacking Japanese organizations with various malware tools , notably the Elirks backdoor .


Attaching with IDA Pro via WinDbg as in Figure 11 shows that the program counter points to the infinite loop written in memory allocated by flare-qdb . We concluded that Lazarus Group was responsible for WannaCry , a destructive attack in May that targeted Microsoft customers .


Rar.exe : Legitimate WinRAR , 26d9212ec8dbca45383eb95ec53c05357851bd7529fa0761d649f62e90c4e9fd . atec.exe : Compiled Impacket atexec tool , a4aca75bcc8f18b8a2316fd67a7e545c59b871d32de0b325f56d22584038fa10 . dmp.exe : Dumpert tool , e4e05c9a216c2f2b3925293503b5d5a892c33db2f6ea58753f032b80608c3f2e .


If your account has been breached , the following steps are required : A clean installation of an operating system on your mobile device is required ( a process called “ flashing ” ) . Malware overlaps between APT38 and TEMP.Hermit highlight the shared development resources accessible by multiple operational groups linked to North Korean state-sponsored activity . it is replaced with another expression for the deobfuscation . What the team uncovered was that the former MiniDuke attackers were still active , and using extremely effective social engineering techniques involving sending malicious PDF documents to compromise their victims .


To further illustrate , here is a timeline of Operation Emmental and its potential relationship to OSX_DOK.C :


: A9 : D5:95 : A9:91 : C2:91:77:5D:30 : F6 SHA1 Hash : 32:17 : E9:7E:06 : FE:5D:84 : BE:7C:14:0C : C6:2B:12:85 : E7:03:9A:5F The app requests extensive permissions during installation that enable a range of activities supported by the malware . Create a link file in the startup folder for AutoHotkeyU32.exe , allowing the attack to persist even after a system restart . MITRE has also developed an APT3 Adversary Emulation Plan .


Like many threat groups , TG-3390 conducts strategic web compromises ( SWCs ) , also known as watering hole attacks , on websites associated with the target organization's vertical or demographic to increase the likelihood of finding victims with relevant information .


Lookout said in its own blog post published Wednesday that its threat detection network has recently observed a surge of Shedun attacks , indicating the scourge wo n't be going away any time soon . The researchers found that there are common elements in the macro and in the first- stage RAT used in this campaign , with former campaigns of the NICKEL ACADEMY ( Lazarus ) threat group . APT33 : 192.119.15.35 [REDACTED].ddns.net . The threat actor cleared Windows Event Logs on affected backend Exchange servers so further information was not available regarding the PowerShell commands leveraged by the threat actors .


Sample configuration file of the Trojan Through AccessibilityService , the malware monitors AccessibilityEvent events . According to security 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor . As in the previous version , the ID of the infected system is generated with exactly the same method .


Instead , in Version 0.0.0.2 , EventBot dynamically loads its main module . The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 . In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch .


Usually , PHA authors attempt to install their harmful apps on as many devices as possible . As of early June 2018 , the server hosted 112 files in a subdirectory that could be accessed through a public web shell planted by the Leafminer . APT33 : 192.119.15.35 [REDACTED].ddns.net . The series features interviews with security experts and journalists , Ashley Madison executives , victims of the breach and jilted spouses .


FireEye observed this framework on compromised Turkish sites and Montenegrin sites over the past year . Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document .


The campaigns used a mix of attached zipped scripts ( WSF , VBS ) , malicious Microsoft Office documents ( Word , Excel ) , HTML attachments , password-protected Microsoft Word documents , links to malicious JavaScript , and other vectors .


The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload . The scanner was identified as the Acunetix Web Vulnerability Scanner which is a commercial penetration testing tool that is readily available as a 14-day trial .


We detect the malware used in this attack as “ Backdoor.AndroidOS.Chuli.a ” . Longhorn , which we internally refer to as " The Lamberts " , first came to the attention of the ITSec community in 2014 , when our colleagues from FireEye discovered an attack using a zero day vulnerability ( CVE-2014-4148 ) . On November 15 , 2016 , an actor related to the OilRig campaign began testing the Clayslide delivery documents .


Additionally , the apparent timezone of the timestamps in all of the GeminiDuke samples compiled during the winter is UTC+3 , while for samples compiled during the summer , it is UTC+4 .


Those vulnerabilities could have enabled someone to gain broad access to an Android device . This report , alongside the plethora of other reporting on APT10 operations , acutely highlights the vulnerability of organizational supply chains . NamelessHdoor : dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f .


When the document was opened in Word , it exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer . Over the years they've used application components from Norman , McAfee and Norton .


One reason for the distinction may be differences in evidence , as FireEye ’s public reporting notes two distinct events of which they are aware of and have responded to related to “ the TRITON actor ” while Dragos has been engaged several instances – thus , Dragos would possess more evidence to cement the definition of an activity group , while FireEye ’s data collection-centric approach would require far more observations to yield an “ APT ” .


For example , the password " admin-windows2014 " shown in Figure 14 was changed to "admin-windows2015" for TG-3390 intrusions conducted in 2015 .


Figure 2 – Granting Permissions The following permissions are granted to the app : Figure 3 – Permissions Granted to App A closer look at the code reveals the application gathers a list of installed applications to compare the results against a list of targeted applications ( Figure 4 ) . However , an investigation by Symantec has found that the group has been active since at least March 2012 and its attacks have not only continued to the present day , but have also increased in number . The last piece is the newly discovered CopyPaste group , who targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center . Instead , victims would end up infecting their computers with the NetSupport RAT , allowing threat actors to gain remote access and deliver additional payloads .


2c50eedc260c82dc176447aa4116ad37112864f4e1e3e95c4817499d9f18a90d .


Unwary users who click the seemingly innocuous link will have their device infected with RuMMS malware . In May 2016 , both PROMETHIUM and NEODYMIUM were observed to launch attack campaigns . The downloaded document has a “ .dot ” extension , used by Microsoft Ofﬁce to save templates for different documents with similar formats . The attackers are known for their targeting of highvalue victims , often focusing on organizations in the government , technology , and defense sectors .


Issue remote mouse clicks and keyboard strokes .


The best bet for Readers who want to make sure their phone is n't infected is to scan their phones using the free version of the Lookout Security and Antivirus app . Last week Microsoft , working together with Facebook and others in the security community , took strong steps to protect our customers and the internet from ongoing attacks by an advanced persistent threat actor known to us as ZINC , also known as the Lazarus Group . APT33 : 91.230.121.143 remote-server.ddns.net . The group , which was primarily motivated by profit , is noted for utilizing self - developed technically - proficient tools for their attacks .


In the campaign that targeted Japan , Philippines , and Argentina on June 20 , we found what seems to be a new , undisclosed malware , which we named Gelup . Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent .


These included the use of certificate pinning and public key encryption for C2 communications , geo-restrictions imposed by the C2 when delivering the second stage , and the comprehensive and well implemented suite of surveillance features . These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider . The group is known for espionage campaigns in the Middle East .


checkApps : Asks the malware to see if the packages sent as parameters are installed . The Seedworm group is the only group known to use the Powermud backdoor . The hidden window created by the malware filters on any user input ( e.g . keyboard or mouse activity ) . According to Kaspersky telemetry , targeted organizations included think tanks and individuals working in various areas related to security and geopolitics .


It sends “ home ” key data about the affected device : device type , OS version , language , number of installed apps , free storage space , battery status , whether the device is rooted and Developer mode enabled , and whether Facebook and FB Messenger are installed . Kaspersky have observed similar activity in the past from groups such as Oilrig and Stonedrill , which leads us to believe the new attacks could be connected , though for now that connection is only assessed as low confidence . Upload a specific file based on a filename .


Table 1 not only shows the commands used for discovery , but also the commands used to deploy another webshell to the server using the echo command to write base64 encoded data to a.txt and using the certutil application to decode and save to bitreeview.aspx .


APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns . In May 2015 , Palo Alto Networks WildFire detected two e-mails carrying malicious documents from a genuine and compromised Israeli Gmail account , sent to an Israeli industrial organization .


Many of these individuals held communications , media , finance , or policy roles .


FireEye Intelligence assesses with high confidence that intrusion activity that led to deployment of TRITON was supported by the Central Scientific Research Institute of Chemistry and Mechanics ( CNIIHM ; a.k.a. ЦНИИХМ ) , a Russian government-owned technical research institution located in Moscow .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . Once inside networks , the group generally targeted Windows network domain controllers and Exchange e-mail servers , targeting user credentials to allow them to move to other systems throughout the targeted network .


Interestingly , there is a domain which used to point there , “ DlmDocumentsExchange.com ” . the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated . Last year , Microsoft researchers described Neodymium 's behavior as unusual : " unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals .


Previously , it had used exploits to deliver and execute the first stage malware , while in this campaign the group relied entirely on social engineering to lure victims into running the first part of the chain .


In order to exfiltrate data from a network segment not connected to the Internet , the threat actor deployed a modified version of hTran . The banking malware GozNym has legs ; only a few weeks after the hybrid Trojan was discovered , it has reportedly spread into Europe and begun plaguing banking customers in Poland with redirection attacks .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . Adobe Flash Player exploit .


Then the Trojan will put the patched library back into the system directory . We believe that this is a new variant of VAMP , indicating that the threat actors behind APT-C-23 are still active and continuously improving their product . RevengeHotels : 74440d5d0e6ae9b9a03d06dd61718f66 . The PDFs were highly relevant and well - crafted content that fabricated human rights seminar information ( ASEM ) and Ukraine - s foreign policy and NATO membership plans .


Between August 2 and 4 , the actor sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors . Once the user enters an account and password , it will initiate POST using AJAX .


DroidJack RAT starts capturing sensitive information like call data , SMS data , videos , photos , etc . The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences . The attackers actually based their attack on an existing Proof-of-Concept method that was published by researchers after the patch release . In the case of the exploit method described here as OWASSRF , the endpoint is not used , in lieu , and the request will not be dropped .


No Chrysaor apps were on Google Play . RASPITE 's activity to date currently focuses on initial access operations within the electric utility sector . The code added to the executable decrypts and launches the backdoor in-memory before resuming normal execution of the C Runtime initialization code and all the subsequent code of the host application . The eventual execution of the attack coincided with the start of a multi - day set of coordinated missile strikes on critical infrastructure across several Ukrainian cities , including the city in which the victim was located .


These simple attacks taking advantage of weak device management are likely to expand as more IoT devices are deployed in corporate environments .


As we noted in M-Trends 2016 , Mandiant’s Red Team can obtain access to domain administrator credentials within roughly three days of gaining initial access to an environment , so 99 days is still 96 days too long . In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines .


Based on the metadata of the Office documents and the PE files , the attackers had created the file on Wednesday , the 4th of October .


The actor delivered two more files into the victim ’s system folder : rasext.dll and msctfp.dat .


The hacker 's name is Gnosticplayers , and since February 11 the hacker has put up for sale data for 32 companies in three rounds [stories on Round 1 , Round 2 , and Round 3] on Dream Market , a dark web marketplace . PassCV continues to maintain a heavy reliance on obfuscated and signed versions of older RATs like ZxShell and Ghost RAT , which have remained a favorite of the wider Chinese criminal community since their initial public release .


Hamas is not widely known for having a sophisticated mobile capability , which makes it unlikely they are directly responsible for ViperRAT . The group 's main objective is to steal source codes . If so , it spawns the service watchdog thread . Wall to Wall reached out in July 2022 about collaborating with Bullock after KrebsOnSecurity published A Retrospective on the 2015 Ashley Madison Breach .


Third place is shared by Italy , Ukraine , and the United Kingdom . Waterbug also used an older version of PowerShell , likely to avoid logging . Throughout the multiple campaigns observed over the last 3 years , the actor has used an email attachment as the initial infection vector .


These activities depend on the device configuration . Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload . Reverse Shell : The sample of PIEHOP we obtained contains programming logic errors that prevent it from successfully performing its IEC-104 control capabilities , but we believe these errors can be easily corrected .


The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components . The group used a number of tools common to other Chinese hacking groups , but they had a few unique tools of their own with interfaces developed for Standard ( Simplified ) Chinese .


BusyGasper – the unfriendly spy 29 AUG 2018 In early 2018 our mobile intruder-detection technology was triggered by a suspicious Android sample that , as it turned out , belonged to an unknown spyware family . This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets financial organizations . Mimikatz ( Hacktool.Mimikatz ) : Tool designed to steal credentials . Although we have not identified sufficient evidence to determine the origin or purpose of COSMICENERGY , we believe that the malware was possibly developed by either Rostelecom - Solar or an associated party to recreate real attack scenarios against energy grid assets .


APT32 often deploys these backdoors along with the commercially-available Cobalt Strike BEACON backdoor . Other groups , such as Buhtrap , Corkow and Carbanak , were already known to target and successfully steal money from financial institutions and their customers in Russia .


To catch these threats , security solutions used heuristics that focused on detecting this behavior . Overall , in spite of the lack of sophistication in Gorgon Group 's activity , they were still relatively successful ; once again proving that simple attacks on individuals without proper protections , work . ( A typical web request to the frontend to exploit the SSRF vulnerability on CVE-2022 - 41040 involves some variation of path confusion that references the endpoint as shown below : The backend request for a typical ProxyNotShell exploitation is shown below : Once the PowerShell remoting service can be reached , the second step involves vulnerability CVE-2022 - 41082 being exploited in order to execute arbitrary commands .


It is a custom obfuscation partly based on base85 encoding , which is in itself unusual , in malware . However , we have also observed attacks against surrounding nations and beyond , including targets in India and the USA . The macro in this document gets executed when the user views the document and clicks Enable Content , at which point the macro locates and executes the data located under the Company field in the document ’s properties . All downloaders attempt to download an image file from a URL .


The DEFENSOR ID app made it onto the heavily guarded Google Play store thanks to its extreme stealth . The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability . Rather , PapaAlfa could be considered a smart proxy due in part to the fact that the Lazarus can easily switch the backend destination address and PROT without having to reestablish control over the infected machine hosting the PapaAlfa malware .


Threat Group 3390 Cyberespionage .


The actor has used several notable techniques in these incidents such as sniffing passwords from Wi-Fi traffic , poisoning the NetBIOS Name Service , and spreading laterally via the EternalBlue exploit .


The authors are trying to latch onto the popularity of the Super Mario Run game to target eagerly waiting Android users . In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television . Investigators put the origin of the attack as Iranian ; Morphisec ’s research supports this conclusion and attributes the attacks to the same infamous hacker group responsible for the OilRig malware campaigns . This sample works in tandem with PIEHOP , which sets up the execution .


type , network type , data state , data activity , call state , SIM state , whether device is roaming , and if SMS is supported . We used a combination of tools such as NoFuserEx , ConfuserEx Fixer , ConfuserEx Switch Killer , and de4d0t in order to deobfuscate the code for in depth analysis . Because of this , the allocated heaps will not be freed . Anonymous Sudan appeared to be a core driver of claimed attacks targeting countries further afield , and it is primarily responsible for the recent surge of Israeli targeting ; however , nearly half of claimed Anonymous Sudan attacks still focused on U.S. or European organizations .


For example , version 9.0.7 ( 2017 ) featured the following set of commands : 2 , 4 , 8 , 11 , 12 , 15 , 16 , 17 , 18 , 19 , 20 . In other cases , threat actors placed web shells on externally accessible servers , sometimes behind a reverse proxy , to execute commands on the compromised system . This was also reinforced by their naming conventions , wherein different versions are simply named after the code iterations , following a specific format regardless of the actual function of the code . But a layered , comprehensive cyber security strategy can do even more to keep your organization safe and secure .


After alternating for over four months with Dridex , Locky became the payload of choice for TA505 , eclipsing earlier campaigns in terms of volume and reach .


Upon execution , it will communicate with an attacker-controller website to download a variant of the Pony malware , pm.dll” along with a standard Vawtrak trojan . All of these early WhiteBear targets were related to embassies and diplomatic/foreign affair organizations .


We have seen different HawkEye campaigns infecting organizations across many sectors globally , and stealing user credentials for diverse online services . Russian citizens—journalists , software developers , politicians , researchers at universities , and artists are also targeted by Pawn Storm .


For now , users can make the best of the knowledge they have now to significantly reduce the effectivity of such malware . Given the available data , we assess that APT28 's work is sponsored by the Russian government . Similar to text mode receiver, after AdrGen builds the string, a function to manually build and send the DNS query packet is . Suspicious Login Patterns on NetScaler


A recent whois of “ goldncup.com ” . In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines . The large grouping on the right of the diagram are direct variants of the sample referenced in this write up . One interesting detail about Hack520 is his apparent love for pigs , as seen in his use of the word in his email addresses .


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer . In August 2015 a new incident related to the Corkow ( Metel ) Trojan was detected .


Tor onto users ’ Android smartphones and uses it to connect anonymously to the net before sending a text message containing the victim ’ s location to an Iranian mobile phone number . Gallmaker 's targets are embassies of an Eastern European country . then calls optblock_t : :f unc callback . The regex , and thus the rule , will match only the requests made to the endpoint of the Microsoft Exchange server .


STEALING SENSITIVE INFORMATION FakeSpy has multiple built in information stealing capabilities . Lastly , we saw the actor uploading a custom backdoor called HyperBro , which has been associated with Emissary Panda operations in the past . Honeybee attacked beyond the borders of South Korea to target Vietnam , Singapore , Argentina , Japan , Indonesia , and Canada .