Within each variant , the malicious code present in each sample may look nearly identical with only one evasion technique changed . In 2016 , for instance , we found their campaigns attacking Japanese organizations with various malware tools , notably the Elirks backdoor . In versions 3.22 and 3.39 the routine changes . None Organizations should apply the November 8 , 2022 patches for Exchange to prevent exploitation since the URL rewrite mitigations for ProxyNotShell are not effective against this exploit method .


TG-3390 : castle.blackcmd.com .


In March 2016 , CTU researchers identified a spearphishing campaign using Bitly accounts to shorten malicious URLs .


The threat actors , observed by FireEye Labs , use a variety of different methods to either compromise or acquire already compromised payment card credentials , including sharing or purchasing dumps online , hacking vulnerable merchant websites and compromising payment card processing devices . In some other cases , LEAD gains access to a target by brute-forcing remote access login credentials , performing SQL injection , or exploiting unpatched web servers , and then they copy the Winnti installer directly to compromised machines .


Like many such groups , PLATINUM seeks to steal sensitive intellectual property related to government interests , but its range of preferred targets is consistently limited to specific governmental organizations , defense institutes , intelligence agencies , diplomatic institutions , and telecommunication providers in South and Southeast Asia . Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China .


When root privilege is gained , a shell backdoor and malicious RCSAndroid agent APK file will be installed The second method is to use a stealthy backdoor app such as ANDROIDOS_HTBENEWS.A , which was designed to bypass Google Play . While FIN7 has embedded VBE as OLE objects for over a year , they continue to update their script launching mechanisms . . A careful analysis of the domain registrations from this threat actor between 2014 and 2015 allowed us to identify one profile used to register several domains that were used as C&C servers for a particular malware family employed by the Winnti group .


This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries . Confucius' backdoors are delivered through Office documents exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .


The malicious apps can steal personally identifiable and financial data and install additional apps . First attack of this campaign took place in May 2018 . The “ wprgxyeqd79.exe ” sample actually is a Self Extracting Archive ( SFX S-TOOL/SFA ) containing four files designed to be extracted in the %TEMP% folder .


However , based upon the timeframe of subsequent telemetry we observe , we understand the attack chain as follows :


The similarity to common spam may however also serve a more devious purpose .


We see that this file drops 2 additional files : netwf.bat and netwf.dll .


Then , it will add the result of the public method localDate.getTime ( ) , which simply gets the current date . TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems . Data about Wingbird activity indicates that it is typically used to attack individuals and individual computers instead of networks .


MALWARE TECHNICAL DETAILS During our investigation , researchers uncovered a malware known as " Gustuff. '' . In order to gain any further credentials , APT10 will usually deploy credential theft tools such as mimikatz or PwDump , sometimes using DLL load order hijacking , to use against a domain controller , explained further in Annex B . ASUS Live Update is an utility that is pre-installed on most ASUS computers and is used to automatically update certain components such as BIOS , UEFI , drivers and applications . The contents found in secure[.]66[.]to often lead to zhu[.]vn , which is Hack520 ’s domain for hosting his own private blog .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . The zero-day vulnerability found and reported by Symantec CVE-2019-0703 occurs due to the ACT the Windows SMB Server handles certain requests .


This script relays commands and output between the controller and the system . Buhtrap is the first hacker group using a network worm to infect the overall bank infrastructure that significantly increases the difficulty of removing all malicious functions from the network .


" Accessing these devices and their sensitive data creates a new and steady stream of revenue for cybercriminals , '' Check Point researchers wrote in a recently published report . We determined that these backdoors were installed on the targets ' machines on September 19 2018 , based mainly on the service creation time of the loader component . APT33 : 8.26.21.117 srvhost.servehttp.com . The login , as mentioned above , was also designed to look legitimate .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell . Thrip was attempting to remotely install a previously unknown piece of malware ( Infostealer.Catchamas ) on computers within the victim 's network .


The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio . Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant .


Agent Smith : A New Species of Mobile Malware July 10 , 2019 Check Point Researchers recently discovered a new variant of mobile malware that quietly infected around 25 million devices , while the user remains completely unaware . The self-extracting RAR writes a legitimate executable , an actor-created DLL called Loader.dll and a file named readme.txt to the filesystem and then executes the legitimate executable . Again , the attacker ’s intention appeared to be espionage . “ Unlike other FinFisher customers or users who focus mostly on domestic operations , BlackOasis focuses on external operations and go after a wide range of targets around the world , ” explained Costin Raiu , director of the global research and analysis team at Kaspersky Lab . GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic , 9002 for C2 requests , 33666 as a WebSocket , and 8090 to download files.[15 ] GravityRAT has used HTTP over a non - standard port , such as TCP port 46769.[16 ] HARDRAIN binds and listens on port 443 with a FakeTLS method.[17 ] HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.[18 ] Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic , creating port - protocol mismatches.[19][20 ] MacMa has used TCP port 5633 for C2 Communication.[21 ]


This special exception handler is needed to manage some memory buffers protection and special exceptions that are used to provide more stealthy execution . A case of these obscure lines can be found in a blogpost published in coordination and parallel to this report - " Flying Kitten to Rocket Kitten , A Case of Ambiguity and Shared Code " 3 by Collin Anderson and Claudio Guarnieri . Upon execution , the launcher will attempt to hook legitimate wininet.dll library by overwriting its entry point in memory with the address of a malicious routine . During the course of researching the Winnti group , we came across previously unreported malware samples that we attributed to the group based on the malware arsenal and the use of registered domains as attack infrastructure .


For example , the Android malware that both deploy share the same strings of code for their decoding algorithm . Another set of attacks called Operation Erebus leverages another Flash exploit , CVE-2016-4117 , and relies on watering hole attacks as a means of propagation . According to the website , that domain supposedly belongs to a legitimate security company “ fully owned by the Russian Government ” ( sic . ) and having offices in “ Moscow , Saint Petersburg and Yekaterinburg ” , but the address says the company is located in Trump Tower , in New York . For Greatness specifically , anyone implementing multi - factor authentication should opt for code - based authentication through their MFA app of choice , such as Cisco Duo , rather than the easier - to - break method of a simple “ yes ” or “ no ” push notification .


In addition to modules , CozyDuke can also be instructed to download and execute other , independent executables .


According to our research , TrickMo is still under active development as we expect to see frequent changes and updates . These findings also suggest that the threat groups have robust exploit developing capabilities because CVE-2018-0798 is not widely reported on and it is typically not incorporated into publicly available weaponizers . The attacks delivered a PowerShell backdoor called QUADAGENT , a tool attributed to the OilRig group by both ClearSky Cyber Security and FireEye .


Comparing this development to their previous attacks , we think Outlaw may be aiming to go after enterprises that have yet to update their systems , assessing security and changes with their previously infected hosts , finding new and old targets , and possibly testing their updates in the wild .


This might allow a second attacker to install code of their choice – for example , their own Quasar RAT – on the original attacker ’s server .


Please see the IOCs section for all app and package name combinations . FireEye Threat Intelligence assesses with high confidence that APT41 carries out an array of financially motivated intrusions , particularly against the video game industry , including stealing source code and digital certificates , virtual currency manipulation , and attempting to deploy ransomware . These URIs result in the download of an installer , which creates a PE of the malware typically known as HTTPBrowser , but called Token Control by the Wekby group themselves ( based upon the PDB strings found within many of the samples ) .


What it does The surveillance functionality of Desert Scorpion resides in a second stage payload that can only be downloaded if the victim has downloaded , installed , and interacted with the first-stage chat application . Today we'd like to share some of our findings , and add something new to what 's currently common knowledge about Lazarus Group activities , and their connection to the much talked about February 2016 incident , when an unknown attacker attempted to steal up to $851M USD from Bangladesh Central Bank . SHIPPING_MX00034900_PL_INV_pdf.zip : 9474e1517c98d4165300a49612888d16643efbf6 . CrowdStrike incident responders found that renamed Plink and AnyDesk executable creation timestamps on affected backend Exchange servers were closely correlated with PowerShell execution events in the Remote PowerShell logs , indicating the threat actor leveraged the newly discovered exploit chain to drop other tooling for persistent access to the affected Exchange servers .


Downeks uses third party websites to determine the external IP of the victim machine , possibly to determine victim location with GeoIP .


In addition , the credit card grabber target list was expanded with Snapchat and Viber . APT10 actors then compressed proprietary data from Visma using WinRAR (deployed by the attackers) and exfiltrated to a Dropbox account using the cURL for Windows command-line tool . The group is known to use custom malware called Daserf , but also employs multiple commodity and custom tools , exploit vulnerabilities , and use social engineering techniques .


Change archive command After this activation cycle , the malware will start the collection of information activities and dissemination . The MuddyWater campaign was first sighted in 2017 when it targeted the Saudi government using an attack involving PowerShell scripts deployed via Microsoft Office Word macro . It then begins to beacon to a configured domain of connect.bafunpda.xyz on TCP port 8081 . There are currently five behavioral - based rules defined by Apple .


The Magic Hound campaign used Word and Excel documents containing malicious macros as a delivery method , specifically attempting to load MagicHound.Rollover . The malware is not obfuscated so we easily found interesting strings here .


While we now know that CozyDuke had been under development since at least the end of 2011 , it was not until the early days of July 2014 that the first large-scale CozyDuke campaign that we are aware of took place .


] cashnow [ . Our investigations revealed that the attackers drove around several cities in Russia , stealing money from ATMs belonging to different banks . If the immediate value for block comparison variable is not found in the flattened blocks , Threat intelligence is simply information about threats .


Publicly available Bitly data reveals how many of the short links were clicked , likely by a victim opening a spearphishing email and clicking the link to the fake Gmail login page .


The fake website hosting server for the UnionCryptoTrader case will be described next .


Given the DroidVPN look and feel being used by this variant of HenBox , it ’ s highly likely the uyghurapps [ . They are a very , very persistent group , ” says Costin Raiu , who has been watching Winnti since 2011 . With this in mind , this week we are providing some indicators for a China based adversary who we crypt as " NUMBERED PANDA " Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc .


Leveraging this feature , the malware developer can root the device using a range of vulnerabilities , well-known or zero-day . Group-IB specialists tracked a massive mailout of emails containing a malicious Microsoft Word attachment titled Договор.doc” [Contract.doc] . In several cases , the Cobalt compromised company infrastructure and employee accounts in order to send phishing messages to partner companies in North and South America , Europe , CIS countries , and Central and Southeast Asia .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . Venomous Bear has deployed malware to targets using several novel methods .


From our trend analysis seen in Figure 3 , Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August . To obtain logins and passwords they applied keyloggers built into Corkow , as well as a commonly used feature of Mimikatz , dumping clear text Windows credentials from LSA .


FakeSpy first targeted South Korean and Japanese speakers . NewsBeef attacks against Saudi Arabian organizations and individuals (as well as targets in the European Union) are likely to continue . There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors .


Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor . After further analysis , it was discovered that the RTF files were exploiting the CVE-2018-0798 vulnerability in Microsoft ’s Equation Editor ( EQNEDT32 ) .


Dynamic overlays When victims open up a targeted app , Marcher smoothly displays an overlay , a customized WebView , looks in its application preferences ( main_prefs.xml ) and decides which specified URL is needed for the targeted app . From early June , when the cyber-attack on the Japan Pension Service started to be reported widely , various Japanese organizations would have started to deploy protection measures . Adobe issued a fix Monday to its users in the form of a software update . For example , Registry keys and other configuration settings can be used to modify protocol and port pairings.[3 ] APT - C-36 has used port 4050 for C2 communications.[4 ]


Local and Remote Shells In order to execute commands on the infected devices , as well as to provide a reverse shell to the Command & Control operators , Exodus Two immediately attempts to execute a payload it downloads with the name null . Suckfly 's attacks on government organizations that provide information technology services to other government branches is not limited to India . The letter ends with “ Death to Israel ” and “ Humiliation and shame to the tyrant America ” 65c8b9e9017ac84d90553a252c836c38b6a3902e5ab24d3a4b8a584e2d615fcc . This is just another example of how these groups can now quickly develop their own ransomware variants by standing on the shoulders of those criminals who had their previous work exposed publicly .


The email contains a Microsoft Office document as an attachment .


YouTube channel of the malicious developer His YouTube channel provided us with another valuable piece of information : he himself features in a video tutorial for one of his other projects . Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . Filename: Pyongyang Directory Group email April 2017.RC_Office_Coordination_Associate.scr .


A Google authorization token is a way to access the Google account and the related services of a user . BRONZE BUTLER has used a broad range of publicly available ( Mimikatz and gsecdump ) and proprietary ( Daserf and Datper ) tools . The added code requires that the mblock_t pointer information is passed from the argument of optinsn_t : :f unc to trace back previous instructions using the mblock_t linked list . Table 1 : Malicious OT files Filename Hash Purpose a.iso Unknown Contains attacker ’s files lun.vbs 26e2a41f26ab885bf409982cb823ffd1


Top 20 countries targeted by Hummingbad/Shedun . We concluded that Lazarus Group was responsible for WannaCry , a destructive attack in May that targeted Microsoft customers . APT33 : 8.26.21.222 mynetwork.ddns.net . If implemented correctly , PIEHOP can connect to a user supplied remote MSSQL server for uploading LIGHTWORK and issuing remote commands specifically targeting RTU , and then delete itself .


However , there is a need for broader focus across IoT in general , both from security teams at organizations that need to be more aware of these types of threats , as well as from IoT device makers who need to provide better enterprise support and monitoring capabilities to make it easier for security teams to defend their networks .


As we did not identify a pattern in the order which the commands are invoked , we believe the operators are executing them manually .


The authors of the malware didn’t appear to have spent any effort in concealing indicators or obfuscating code – the IP address with which it tries to communicate is hardcoded in clear-text inside the binary .


UPDATE – download APK file from C & C and install it . In the first week of May 2016 , FireEye 's DTI identified a wave of emails containing malicious attachments being sent to multiple banks in the Middle East region . During our investigation , there was a breakthrough discovery that helped connect Leafminer to a number of attacks observed on systems in the Middle East and identify the toolkit used in the group 's efforts of intrusion , lateral movement , and Exfiltration .


Captured credentials are DES encrypted using the password " 12345678 " and are written to the log.txt file in the root directory .


The UnionCryptoTrader Windows version has the following window showing a price chart for several cryptocurrency exchanges .


While cmd.exe is a console application , it still requires GUI like functionality and other support to interact with the operating system .


Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day . The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon .


In the case of Artifact #1 , the name of the pipe is ahexec , computers over the network could access the pipe server by simply opening a file handle on \ServerNamepipeahexec .


Threat actors like Confucius and Patchwork are known for their large arsenal of tools and ever-evolving techniques that can render traditional security solutions — which are often not designed to handle the persistent and sophisticated threats detailed in this blog — ineffective . TG-3390 can quickly leverage compromised network infrastructure during an operation and can conduct simultaneous intrusions into multiple environments .


] website 107 [ . The Elfin group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries . Persistence modules are based on scheduled tasks and system . The request header is included in the binary as follows


The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine . The reality is that IT departments of small to large-sized organizations are not equipped to handle the more advanced threats that groups like Confucius use in their attacks .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . By using such features and tools , attackers are hoping to blend in on the victim 's network and hide their activity in a sea of legitimate processes .


These malware families have a rich history of being used in many targeted attacks against government and private organizations . Kessem .


The malware checks whether its running on a 32-bit or 64-bit system to determine which PowerShell script to grab from the command and control (C2) server . DarkPulsar is a very interesting administrative module for controlling a passive backdoor named ' sipauth32.tsp ' that provides remote control , belonging to this category .


Cybereason Mobile detects EventBot and provides the user with immediate actions . It is possible that CVE-2017-8759 was being used by additional actors . The threat actor has previously been the subject of a range of open source reporting , including most notably a report by FireEye comprehensively detailing the threat actor 's use of the Poison Ivy malware family and blog posts by Trend Micro3 similarly detailing the use of EvilGrab malware .


init . 93ce211a71867017723cd78969aa4cac9d21c3d8f72c96ee3e1b2712c0eea494


It then starts the final detonator function to load the dropped .dex file into memory and triggers the main payload . APT15 then used a tool known as RemoteExec . This remote access Trojan has the capability that allows an attacker to completely take control of the compromised . None Organizations should apply the November 8 , 2022 patches for Exchange to prevent exploitation since the URL rewrite mitigations for ProxyNotShell are not effective against this exploit method .


Once infected , the C&C commands for the infected system launches a loud scanning activity and spreads the botnet by sending a “ whole kit ” of binary files at once with naming conventions same as the ones already in the targeted host , likely banking on breaking through via “ security through obscurity. ” They attempted to evade traffic inspection by encoding the code for the scanner with base-64 .


Rooting trojan com.android.world.news bd233c1f5c477b0cc15d7f84392dab3a7a598243efa3154304327ff4580ae213 Zen trojan com.lmt.register eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d Mobile Campaign ‘ Bouncing Golf ’ Affects Middle East We uncovered a cyberespionage campaign targeting Middle WildFire properly classifies BBSRAT malware samples as malicious . The first file is an Extensible Markup Language ( XML ) file that can be opened and viewed in a text editor . We have discovered and analysed two previously unknown infector vectors that were used in the MiniDuke attacks .


During installation , Riltok asks the user for permission to use special features in AccessibilityService by displaying a fake warning : If the user ignores or declines the request , the window keeps opening ad infinitum . FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests . An interesting fact : the dropped library was compiled in 2014 and appears in our telemetry in August 2015 .


The example below steals Facebook data : All the other hardcoded applications targeted by the payload : Package name Name jp.naver.line.android LINE : Free Calls & Messages com.facebook.orca Facebook messenger com.facebook.katana Facebook com.whatsapp WhatsApp com.viber.voip Viber Parser payload Upon receiving a specific command , the implant can download a special payload to grab sensitive information from external applications . With deception and false flags increasingly being employed by threat actors , attribution is a hard and complicated task that requires solid evidence , especially in complex regions such as the Middle East . Some reporting suggests a number of other groups , including Axiom , APT17 , and Ke3chang , are closely linked to Winnti Group .


The app also creates hooks to prevent the phone from rebooting , going to sleep or allowing the user from pressing hardware buttons during the account creation process . These attacks are primarily targeting private industry in search of key intellectual property for competitive advantage , military institutions , and governmental organizations often in search of documents related to current political events and human rights organizations . FireEye has monitored APT17 ’s use of BLACKCOFFEE variants since 2013 to masquerade malicious communication as normal web traffic by disguising the C2 communication as queries to web search engines . These malicious PDF files were rigged with exploits attacking Adobe Reader versions 9 , 10 and 11 , bypassing its sandbox .


Yet the document cache published April 8 provides evidence that the NSA had once launched a series of successful computer-based intrusions against multiple high-profile foreign targets , including the Office of the President of Iran and the Russian Federal Nuclear Center . We named the actor DustSquad and have provided private intelligence reports to our customers on four of their campaigns involving custom Android and Windows malware .


Confucius' backdoors are delivered through Office documents exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 . ALLANITE conducts malware-less operations primarily leveraging legitimate and available tools in the Windows operating system .


EventBot loaded library The loaded library dropped on the device . The earliest use of the exploit ITW we were able to identify and confirm is a sample (e228045ef57fb8cc1226b62ada7eee9b) dating back to October 2018 (VirusTotal submission of 2018-10-29) with the RTF creation time 2018-10-23 . APT35 typically targets military , diplomatic and government , media , energy , engineering , business services and telecommunications sectors in U.S. and the Middle East .


Zen requires root to work correctly on the Android operating system . The goal of the attackers appears to be to collect intellectual property such as design documents , formulas , and manufacturing processes . These clusters of activity raise interesting questions about the use of an identical silently-patched vulnerability , possibly by multiple threat groups . Methods of manipulating control can include changes to set point values , tags , or other parameters .


This allows the malicious activity to evade detection .


Conclusion As our computing increasingly crosses multiple screens , we should expect to see threats extending across mobile and desktop environments . The attacker is provided with a USB containing malware developed for the CIA for this purpose , which is inserted into the targeted computer . Some analysts track Deep Panda and APT19 as the same group , but it is unclear from open source information if the groups are the same .


Around 2011 , the infamous Zeus Trojan started using web injects that tricked users into downloading a mobile component called “ ZitMo ” ( Zeus in the Mobile ) . The attackers involved in these email campaigns leveraged a variety of distribution mechanisms to deliver the information stealing FormBook malware . The group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries .


Additionally , as previously mentioned , the decoy document subject matter would likely be of interest to a few different potential targets in the Palestinian Territories .


But even though they share the use of Winnti , the BARIUM and LEAD activity groups are involved in very different intrusion scenarios .


Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system . So far , Unit 42 has seen infrastructure overlaps with servers hosting C2 servers for samples of the FFRAT , PlugX , Poison Ivy and Scieron Trojans , suggesting that the threat actors use these tools as the payload in their attacks .


In keeping with its shift to more overt tactics , the group appeared to publicly take credit for the attack , leaking the information on a website using the name “ Fancy Bears ” , an industry codename that was already widely used for the group .


Cobalt Strike payload : 7101fff478290d4db8a1c11a8d3b40cb , 4c81777551a772218519fb6dd1a6672aade4a936 , bdf1452b55b9974f3e9a4aea4439769a02fd931660ed655df92519a2a4df1261 .


We discovered 561MB of exfiltrated data from 24 compromised Android devices while investigating this threat . Recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the GozNym group appears up to the task . Based on the 400+ samples of WEBC2 variants that we have accumulated , it appears that APT1 has direct access to developers who have continually released new WEBC2 variants for over six years . But a potential of attackers to misuse such access to infect hundreds of millions of Internet users creates a great risk . "


In another instance , the DDE attack was used to deliver an open-source penetration testing toolkit called Koadic .


It seems , “ Agent Smith ” prey list does not only have popular yet Janus vulnerable apps to ensure high proliferation , but also contain competitor apps of actor ’ s legitimate business arm to suppress competition . Group-IB specialists detected various sites used by criminals to spread the Trojan : mail tracking websites , news portals , electronic books , computer graphics resources , music portals , etc . They register typo-squatting domains , impersonating legitimate companies . Several Democratic lawmakers released a report last week that accused TaxAct , H&R Block and TaxSlayer of embedding Meta and Google ’s tracking pixels on their sites , potentially violating U.S. law and sharing taxpayers ’ information with those companies .


] net www [ . The Arbor report describes the ongoing use of these four vulnerabilities in a series of espionage campaigns against not only Tibetan groups , but also others related to Hong Kong , Taiwan , and Uyghur interests . Attackers do not change their approach unless an external force or environmental shift compels them to . Following a successful infection , callbacks are made to the RAT 's command and control server at 94.158.247[.]27 .


Resistance to anti-malware protection The ability of malicious software to operate continuously on the victim ’ s mobile device is an important aspect of its development . the targets of the hacking group were in the automotive . It replaces the original instructions at 0x10BA with an unconditional jump ( jmp – 0xE9 ) to the address of the function from hpqhvsei.dll that decrypts and executes the encrypted payload embedded in the launcher . In 2015 GReAT reported that CozyDuke often spear phishes targets with emails containing a link to a hacked website .


Conclusions Cybereason Mobile Detects and Stops FakeSpy Indicators of Compromise INTRODUCTION For the past several weeks , Cybereason has been investigating a new version of Android malware dubbed FakeSpy , which was first identified in October 2017 and reported again in October 2018 . Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East (including targets inside Iran itself) , as well as across Europe and in the United States . Previously , LookingGlass reported on a campaign they named " Operation Armageddon " , targeting individuals involved in the Ukrainian military and national security establishment .


To provide a sense of the limited functionality within the webshell itself , the bitreeview.aspx AntSword webshell deployed in this attack ( SHA256: 15ecb6ac6c637b58b2114e6b21b5b18b0c9f5341ee74b428b70e17e64b7da55e ) was only 162 bytes .


Depending if the victim has any of the targeted applications , the anti-virus installed or geographic location , the malware can harvest credentials from the targeted applications , exfiltrate all personal information or simply use the victim 's device to send SMS to spread the trojan The malware deploys overlaying webviews to trick the user and eventually steal their login credentials . MuddyWater is a relatively new APT that surfaced in 2017 . The malware behavior and code share similarities with an older KHRAT sample from May 2018 . Otherwise , your data will be sold to DarkNetDarkWeb .


Microsoft labels activity groups using code names derived from elements in the periodic table .


The current attack took advantage of the compromise of a high-profile Tibetan activist . The sctrls backdoor we came across is delivered via RTF files exploiting CVE-2015-1641 . While Night Dragon attacks focused specifically on the energy sector , the tools and techniques of this kind can be highly successful when targeting any industry .


This ransomware family ’ s long history tells us that its evolution is far from over . The Ke3chang attackers have been active since at least 2010 . in order to break the techniques we have to understand both of the obfuscation mechanisms and disassembler tool internals before we can automate the process . This includes hosting C&C domains that were used by Winnti such as mtrue.com , shenqi[.]kr and zhu[.]kr .


Moreover , as we use mobile devices to access the web and phishing templates extend to mobile environments , we should expect to see a greater variety of integrated threats like the scheme we detail here . The attacker then infects and exfiltrates data to removable media . Dragonfly : Energetic Bear .


The overall image of these ties is below in Figure 5 and paints a picture of an adversary with at least 5 malware families in their toolbox dating back to at least 2015 . The group will also use a compromised account to create scheduled tasks on systems or modify legitimate Windows services to install the HIGHNOON and SOGU backdoors . As we now know , by February 2013 the Dukes group had been operating MiniDuke and other toolsets for at least 4 and a half years .


Stage 2 : Exodus Two The Zip archive returned by the check-in performed by Exodus One is a collection of files including the primary payload mike.jar and several compiled utilities that serve different functions . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East . For example , the VM or the sandbox must have the keyboard layout of the targeted countries and a disk serial number . While the Kritec skimmer hangs around the Google Tag Manager script , we believe it is not related to the other active campaigns .


Both the client and server uses the same API , but the client serializer cannot serialize server objects , because they are not the same as their “ mirrored ” objects inside the client .


PittyTiger leverages social engineering to deliver spearphishing emails , in a variety of languages including English , French and Chinese , and email phishing pages to their targets . After successfully infecting one of the computers and gaining initial access to the system , the attackers perform reconnaissance of the local network in order to gain domain administrator privileges and eventually consolidate control over the network .


Join us in a live webinar as we discuss this threat group whom we assess to be working on behalf of the Iranian Government , with a mission that would benefit nation-state geopolitical and economic needs . There is a file shortcut embedded in the malicious .docx file—one that will download an executable file from Dropbox that executes once clicked by the user .


Volexity has also found that , in addition to sending malware lures , the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages . Chafer , uses Backdoor.Remexi .


SpyNote RAT is capable of performing a variety of alarming functions that includes : Activating the device ’ s microphone and listening to live conversations Executing commands on the device Copying files from the device to a Command & Control ( C & C ) center Recording screen captures Viewing contacts Reading SMS messages The screenshot below shows part of the sandbox ’ s report on the SpyNote RAT ’ s signature and detected functions : The fake Netflix app we are analyzing in this blog appears to be built using an updated version of SpyNote RAT builder , Prior to April 2018 , as described in Group-IB’s Silence: Moving into the darkside report , Silence’s target interests were primarily limited to former Soviet and Eastern European countries including Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan . The first successful bank robbery was committed by this group in January 2013 .


In this case , a threat actor has been targeting customers of Bank Austria , Raiffeisen Meine Bank , and Sparkasse since at least January 2017 . This new Lotus Blossom campaign delivers a malicious RTF document posing as an ASEAN Defence Minister's Meeting (ADMM) directory (decoy) that also carries an executable (payload) embedded as an OLE object , the Elise backdoor . Elderwood : Elderwood Gang , Beijing Group , Sneaky Panda .


Some hackers even went onto use the Cisco exploits in the wild . Once the Barium Defendants have access to a victim computer through the malware described above , they monitor the victim 's activity and ultimately search for and steal sensitive documents ( for example , Exfiltration of intellectual property regarding technology has been seen ) , and personal information fi"om the victim 's network .


Moreover , Wh1sks was able to find out the email addresses of five people who have subscribed to the Shadow Brokers' monthly dump service . The installed EXE file is almost exactly the same as the DLL version of Bisonal variant used against the Russian organization . The targets are military or defense industry in particular countries , it used DDNS for C2 servers , and tracked connections from their victims by using target or campaign codes , as well as disguising the malware as document file , and using a dropper to install the malware and decoy file . A previous campaign of this APT group was uncovered by Talos in June 2017 , and since then very little of this operation was seen in the wild . ined in the archive is called DriverInstallerU.exe” but its metadata shows that its original name is Interenet Assistant.exe” . After reviewing all the malware functionalities , we are confident in saying that the attackers look for victims who answer well-defined characteristics and believe that further stages of the attack are delivered only to those who fit the specific victim profile . In this sample , however , the module names were changed from actors and characters’ names to car models , namely BMW_x1” , BMW_x2” and up to BMW_x8” . But , thanks to the attackers known affection for decoy documents that pose as news summaries , we were able to date the campaign back to March 2018 . With the experience gained from the APT attack that began in March 2017 , it seems this campaign has evolved into an attack with new capabilities , and an even more specific target , over a year later . These unknown actors continued launching DDoS attacks over the next few years . For simplicity , Kaspersky is calling them the BlackEnergy APT group . Since the middle of 2015 , one of the preferred attack vectors for BlackEnergy in Ukraine has been Excel documents with macros that drop the Trojan to disk if the user chooses to run the script in the document . A very good analysis and overview of the BlackEnergy attacks in Ukraine throughout 2014 and 2015 was published by the Ukrainian security firm Cys Centrum the text is only available in Russian for now , but can be read via Google Translate . The earliest signs of destructive payloads with BlackEnergy go back as far as June 2014 . BlackEnergy is a highly dynamic threat actor and the current attacks in Ukraine indicate that destructive actions are on their main agenda , in addition to compromising industrial control installations and espionage activities . Kaspersky will continue to monitor the BlackEnergy attacks in Ukraine and update our readers with more data when available . From Buhtrap perpetrating cybercrime for financial gain , its toolset has been expanded with malware used to conduct espionage in Eastern Europe and Central Asia . Throughout our tracking , we've seen this group deploy its main backdoor as well as other tools against various victims , but June 2019 was the first time we saw the Buhtrap group use a zero-day exploit as part of a campaign . In that case , we observed Buhtrap using a local privilege escalation exploit , CVE-2019-1132 , against one of its victims . However , as the shift in targets occurred before the source code leak , we assess with high confidence that the same people behind the first Buhtrap malware attacks against businesses and banks are also involved in targeting governmental institutions . When Buhtrap was targeting businesses , the decoy documents would typically be contracts or invoices . The Buhtrap group is well known for its targeting of financial institutions and businesses in Russia . Figure 2 is a typical example of a generic invoice the group used in a campaign in 2014 . When the group's focus shifted to banks , the decoy documents were related to banking system regulations or advisories from FinCERT , an organization created by the Russian government to provide help and guidance to its financial institutions . We confirmed that this is a DarkHydrus Group's new attack targeting Middle East region . In July 2018 , Palo Alto disclosed DarkHydrus Group which showed its special interest to governments in Middle East . Prior to that report , we published detail analysis on malware exploiting CVE-2018-8414 vulnerability (remote code execution in SettingContent-ms) , which is believed a work of DarkHydrus . However , the final payload is something that welivesecurity have never seen associated with Buhtrap . It's coincident that both 'darkhydrus' APT group name and ‘Williams’ user name in PDB path found in this Twitter user . In recent APT incidents , Dark Hydruns tend to adopt Office VBA macro instead of Office 0day vulnerability in the consideration of cost reduction . ASERT uncovered a credential theft campaign we call LUCKY ELEPHANT where attackers masquerade as legitimate entities such as foreign government , telecommunications , and military . From at least February 2019 to present , the actors in the LUCKY ELEPHANT campaign copied webpages to mimic South Asian government websites as well as Microsoft Outlook 365 login pages and hosted them on their own doppelganger domains , presumably to trick victims into providing login credentials . ASERT suspects that the Actors use phishing emails to lure victims to the doppelganger websites and entice users to enter their credentials . It is important to note that one domain , yahoomail[.]cf is only associated with this group from February 2019 onward . In late 2018 , the domain was associated with a different APT group / campaign of Chinese origin . Based on our analysis into the activity , ASERT deems with moderate confidence that an Indian APT group is behind the LUCKY ELEPHANT campaign . The targets are typical of known Indian APT activity and the infrastructure was previously used by an Indian APT group . DoNot Team has a history of heavily targeting Pakistan , in addition to other neighboring countries . The 360 Intelligence Center observed four distinct campaigns against Pakistan since 2017 (link) , recently targeting Pakistani businessmen working in China . DoNot Team’s confirmed use of this IP dates back to September 2018 , with a six-month gap until it was used to host doppelganger domains for the LUCKY ELEPHANT campaign in early February .


The click fraud PHA requests a URL to the advertising network directly instead of proxying it through an additional SDK . In this report , we'll review how NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . In 2005 , the Chinese government passed an “ anti-secession ” law that signified its intention to use “ non-peaceful ” means to stymie any Taiwanese attempt to secede from China . While CISA or Microsoft have yet to disclose any specific vulnerabilities the actors exploited , the CISA report does say that the APT used a Microsoft account consumer key to forge tokens and impersonate targeted users .


The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations . It was a targeted attack we are calling " Machete " .


PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions .


Office 365 ATP sandbox employs special mechanisms to avoid being detected by similar checks . APT32 poses a threat to companies doing business or preparing to invest in Vietnam . The .png cover file is actually a valid image file that is not malicious on its own . This new ransomware variant does n't have any novel features or functionality and points to the challenges organizations are facing as the landscape continues to shift and a plethora of new actors join their ranks .


Although the current target list is limited to Spanish apps , it seems that the actor is taking into account that the bot should also be able to target other countries , seeing that the path used in the inject requests contains the country code of the targeted institution . Additionally , the same DLL sideloading technique observed in the Visma attack was used , and many of the tools deployed by the APT10 shared naming similarities as well 1.bat , cu.exe , ss.rar , r.exe , pd.exe . We also identified another malware family , HomamDownloader , sharing some servers with Daserf .


Called Greenbug , this group is believed to be instrumental in helping Shamoon steal user credentials of targets ahead of Shamoon 's destructive attacks . In particular , the threat actors have exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code .


The attack On March 24th , 2013 , the e-mail account of a high-profile Tibetan activist was hacked and used to send spear phishing e-mails to their contact list . Just recently , PIVY was the payload of a zero-day exploit in Internet Explorer used in what is known as a " strategic web compromise " attack against visitors to a U.S. government website and a variety of others . The attackers appeared to be Chinese-speaking and targeted mainly top-level government agencies and civil and military organizations in countries such as the Philippines , Malaysia , Cambodia , Indonesia , Vietnam , Myanmar , Singapore , Nepal .


] me under names in the format : photo_ [ number ] _img.apk , mms_ [ number ] _img.apk avito_ [ number ] .apk , mms.img_ [ number ] _photo.apk , mms [ number ] _photo.image.apk , mms [ number ] _photo.img.apk , mms.img.photo_ [ number ] .apk , photo_ [ number ] _obmen.img.apk . The threat actors create PlugX DLL stub loaders that will run only after a specific date . S-SHA2init2 . To continue the home security analogy , if the window was nt left open , the attacker would likely have gone somewhere else , and the same principle applies in the digital world .


This simple measure prevents the Trojan from running and being analyzed in dynamic analysis environments ( sandboxes ) and on the test devices of malware analysts . This report includes details related to the major hacking targets of the SectorJ04 group in 2019 , how those targets were hacked , characteristics of their hacking activities this year and recent cases of the SectorJ04 group’s hacking . One group , which we call Cadelle , uses Backdoor.Cadelspy , while the other , which we've named Chafer , uses Backdoor.Remexi and Backdoor.Remexi.B .


mcpef.apk ( SHA256 : a8e7dfac00adf661d371ac52bddc03b543bd6b7aa41314b255e53d810931ceac ) : The malicious system application downloaded from server ( package name – com.android.music.helper ) . Even if CVE-2015-2546 affected Windows 10 , the exploitation would have required much more technical prowess to succeed ; ultimately , SMEP makes it more difficult for attackers . However , FireEye researchers do not have enough insight to reliably report a definitive connection to the Moafee and DragonOK groups .


The names of the files and their content play a major part in luring victims to open them , as they usually relate to current topics pertaining to Hamas , the Palestinian National Authority , or other recent events in the Middle East .


Specifically , the app was an Android Package ( APK ) file that will be discussed in more detail shortly . The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine . The simplest conclusion based on these facts is that APT1 is operating in China , and most likely in Shanghai .


The code contains multiple comments in Italian , here is the most noteworthy example : “ Receive commands from the remote server , here you can set the key commands to command the virus ” Here are the available commands : Name Description cd Change current directory to specified quit Close the socket nggexe Execute received command via Python ’ s subprocess.Popen ( ) without outputs ngguploads Upload specified file to the specified URL nggdownloads Download content from the specified URLs and save to specified file nggfilesystem Dump file structure of Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year . FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information .


Collect information about the infected machine .


However , we were able to successfully analyze Suckfly malware samples and extract some of the communications between the Nidiran back door and the Suckfly command and control ( C&C ) domains .


We came across the names Photo , Message , Avito Offer , and MMS Message . CTU researchers have not observed TG-3390 actors performing reconnaissance prior to compromising organizations . Running the script removes the remaining files and scripts from previous attacks , keeping a low profile to evade detection . “ It appears to be the email address Will used for his profiles , ” the IT director replied .


It enables the bot to stream screenshots and send them to the C2 so that actors can see what is happening on the screen of the infected device . This indictment attributed the intrusions to APT10 , a group that had been conducting the malicious activities for over a decade on behalf of the MSS , China’s civilian human intelligence agency . One of the Minzen samples ( SHA256 : 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 ) found in the Republic of Korea in December 2016 installs simple backdoor module as a final payload on a compromised computer .


The encryption key is different from the one used for sending stolen data via HTTP . Currently , the group is engaged in two major operations : Operation Daybreak and Operation Erebus . The new GRIFFON implant is written to the hard drive before each execution , limiting the “ file-less ” aspect of this method . Greatness incorporates features seen in some of the most advanced PaaS offerings , such as multi - factor authentication ( MFA ) bypass , IP filtering and integration with Telegram bots .


The spaghetti code in FinFisher dropper This problem is not novel , and in common situations there are known reversing plugins that may help for this task . The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign . This is , however , only for appearance because the real size or the PE file is between 63 KB and 72 KB , depending on the version . That makes highfidelity threat intelligence and a proactive security stance critically important to success in 2023 .


The Trojan requests Device Administrator rights The Trojan requests permission to use AccessibilityService After installation , the Trojan starts communicating with the cybercriminals ’ C & C server . CTU researchers have observed TG-3390 compromising a target organization 's externally and internally accessible assets , such as an OWA server , and adding redirect code to point internal users to an external website that hosts an exploit and delivers malware . The Shellbot disguises itself as a process named rsync , commonly the binary seen on many Unix- and Linux-based systems to automatically run for backup and synchronization . Anonymous Sudan has targeted organizations associated with infrastructure and key services , including in government and private sectors .


But Dvmap is very special rooting malware . In 2015 , the Metel gang began to target banks and financial institutions directly . It monitors whether the user is browsing the web page . On December 17th , the Ukrainian capital Kiev was hit by a blackout .


Audit existing firewall rules and close all ports that are not explicitly needed for business .


] ponethus [ . Through the information exchanges used by people in the security industry , we learned that several Russian banks were struggling with malicious programs created specifically to attack a particular type of legal banking software . Some of the names the attackers used for it include : Adobe Assistant , Migrated . Stolen credentials can be resold to other threat actors tied to ransomware gangs .


The Center for Applied Research creates means and methods for protecting critical infrastructure from destructive information and technological impacts .


. In order to understand SWAnalytics’ impact , we turned to public download volume data available on Chandashi , one of the app store optimization vendors specialized in Chinese mobile application markets . SecureWorks® Counter Threat Unit™ ( CTU ) researchers analyzed a phishing campaign that targeted a Middle Eastern organization in early January 2017 .


The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems . Patchwork uses email as an entry point , which is why securing the email gateACT is important .


The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon . Buhtrap resurfaced in the beginning of 2017 in the TwoBee campaign , where it served primarily as means of malware delivery .


EventBot is a mobile banking trojan and infostealer that abuses Android ’ s accessibility features to steal user data from financial applications , read user SMS messages , and steal SMS messages to allow the malware to bypass two-factor authentication . According to our statistics , as of the beginning of 2015 this botnet encompassed over 250 000 infected devices worldwide including infecting more than 100 financial institutions with 80% of them from the top 20 list . The actor 's targeting is consistent with Chinese state interests and there are multiple technical artifacts indicating the actor is based in China .


While there is not yet a patch available for the Windows vulnerability , updating Adobe Flash to the latest version will render this in-the-wild exploit innocuous .


Based on the samples we collected and traced to 456 distinct IPs , we expect the group to be more active in the coming months as we observed changes on the versions we acquired .


Furthermore , there are indications that APT32 actors are targeting peripheral network security and technology infrastructure corporations . In the latest attack , Donot group is targeting Pakistani businessman working in China


By researching historical data relevant to C&C 176.31.112.10 , we discovered that on February 16th 2015 , the server was sharing an SSL certificate with another IP address allocated to CrookServers and also hosted at OVH : 213.251.187.145 .


The updates expanded scanner parameters and targets , looped execution of files via error messages , improved evasion techniques for scanning activities , and improved mining profits by killing off both the competition and their own previous miners .


DoublePulsar is then used to inject a secondary payload , which runs in memory only . Without going too deep into the rabbit hole , there are several indicators pointing to an Iranian nexus , including language artifacts in the tool-marks used by the attacker , as well as network activity tying this actor to a very specific location that we have high confidence in not being spoofed .


Once successfully executed , the macro will install a payload and save a document to the system .


The toolset includes reams of documentation explaining how the cyber weapons work , as well as details about their use in highly classified intelligence operations abroad . The structure of the fake App Store matches the application bundle structure and provides both English and German interfaces .


The stolen data is copied into a hidden directory as “ %MYPICTURES%\%volume serial number% “ , from where it can be exfiltrated by the attackers using one of the AZZY implants .


It contains an additional meta tag at the end of the web page source code , " refreshing " ( redirecting ) the site visitor to the weaponized document . com .


CTU researchers assess with moderate confidence that the group is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government .


Upon reviewing the traffic from these IP S-PROT addresses , system owners may find that some traffic corresponds to malicious activity and some to legitimate activity .


The sux library appears to be a customized super user ( su ) tool that includes code from the com.koushikdutta.superuser app and carries the equivalent of a super user ( su ) binary in order to run privileged commands on the system . Alternatively , it is also possible that APT41 injected malicious code into the package prior to compilation , circumventing the need to steal the code-signing certificate and compile it on their own . While the JHUHUGIT ( and more recently , " JKEYSKW " ) implant used in most of the Sofacy attacks , high profile victims are being targeted with another first level implant , representing the latest evolution of their AZZY Trojan .


Users of iOS can remove the malicious profile using the Apple Configurator 2 , Apple ’ s official iOS helper app for managing Apple devices . The targets were similar to a 2015 TG-4127 campaign — individuals in Russia and the former Soviet states , current and former military and government personnel in the U.S. and Europe , individuals working in the defense and government supply chain , and authors and journalists — but also included email accounts linked to the November 2016 United States presidential election . The text mode sender uses the same hardcoded transaction ID 0xa4a3; however, instead of sending queries for TXT resource records, the malware uses A resource . Rhysida will enumerate through directories and files in directories starting from “ A : ” to “ Z : ” drives , ensure they ’re missing from the “ exclude list ” and then “ process , ” i.e. , encrypt the files .


] infogoogle-support-team [ . As in the past , these messages have been sent accounts believed to be fake and accounts compromised by Infy , including Kurdish activists that had previously been compromised by the Flying Kitten actor group . In fact , Shanghai was listed as the registrant ’s city in at least 24 of the 107 ( 22% ) registrations . Monitor for contextual data about an account , which may include a username , user ID , environmental data that may attempt to hide artifacts associated with their behaviors to evade detection .


Method onPostExecute : to handle instructions from remote C2 Figure 6 shows an example response sent back from one C2 server . In May 2016 , we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware . The attackers put great effort to carefully select the targets located in specific countries based on the victim 's keyboard layout . The actor hunts for confidential information stored in the networks of governmental organizations , political groups and think tanks , as well as various individuals involved in defense and geopolitical related research .


It contains an additional meta tag at the end of the web page source code , " refreshing " ( redirecting ) the site visitor to the weaponized document . Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014 , however , it's likely that activity began well before this date .


They also included Dynamic Data Exchange ( DDE ) and Windows Script Component ( SCT ) abuse to their tactics , as well as started exploiting recently reported vulnerabilities . For the sake of this analysis we'll take the Vietnamese backdoor as an example ; the one found in the Indian attack operates in the exact same ACT .


BRONZE PRESIDENT also uses widely available or modified open-source tools , which could be a strategic effort to reduce the risk of attribution or to minimize the need for tool development resources .


Indian government org #2 is responsible for implementing network software for different ministries and departments within India 's central government .


The choice of a particular payload is determined by the implant ’ s version , and it can be downloaded from the command and control ( C & C ) server soon after the implant starts , or after a specific command . OceanLotus malware family samples used no earlier than 2017 . TA505 is a financially motivated threat group that has been active since at least 2014 .


There are previous reports of threat actors including APT10 and APT1 using dynamic DNS . Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware .


During our analysis of this sample , we did notice that the class itself is never called or used by the malware . Taking that into account , we classify the Lamberts as the same level of complexity as Regin , ProjectSauron , Equation and Duqu2 , which makes them one of the most sophisticated cyber espionage toolkits we have ever analysed . Additionally , the new campaigns we uncovered further highlight the correlation between APT groups ceasing and retooling operations after media exposure , as APT12 used the same strategy after compromising the New York Times in Oct 2012 . For example , Registry keys and other configuration settings can be used to modify protocol and port pairings.[3 ] APT - C-36 has used port 4050 for C2 communications.[4 ]


This image file exists on the third page of the document , so the user would have to scroll down in the document to this third page to get the SWF file to run .


Our research demonstrates the efforts used by attackers to reduce the risk of detection of the Spark backdoor by various security products .


This library is used because it uses the only ( publicly known ) way to retrieve this information on Android 6 ( using the process OOM score read from the /proc directory ) . Kaspersky Lab also found some watering hole attacks , including one on a website belonging to a prominent member of the Japanese government . The incident , as described by security researchers with Moscow-based cybersecurity firm Kaspersky Lab , shines a rare light on the opaque although apparently vibrant market for software exploits and spyware , which in this case appears to have been purchased by a nation-state . Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis / parsing of network data .


The ORat tool , which appears to be used less frequently by the group , communicates over TCP port 80 using a raw socket protocol ( not HTTP ) .


The aggressive nature of Sandworm Team 's previous activity in Europe and the United States exposed their interest in targeting critical systems and indicated preparation for cyber attack . The group is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


Unit 42 analyzed the use of these six malware families and found that Nigerian actors are currently producing an average of 146 unique samples of malware per month ( see Figure 6 ) . Turla is a notorious group that has been targeting government officials .


Utilizing Diamond Model methodology for characterizing activity by behaviors attached to victims , we began tracking TRITON / TRISIS and immediate enabling activity as a distinct activity group ( collection of behaviors , infrastructure , and victimology ) designated XENOTIME .


The third timer will fire every 10 seconds and will attempt to register the device into the C2 and register wake-up locks on the system to control the device 's status . Once they have found a victim , they then deploy remote manipulation system binaries (RMS) via self-extracting archives and batch command files . The majority of APT37 activity continues to target South Korea , North Korean defectors , and organizations and individuals involved in Korean Peninsula reunification efforts .


88034e0eddfdb6297670d28ed810aef87679e9492e9b3e782cc14d9d1a55db84 e08f08f4fa75609731c6dd597dc55c8f95dbdd5725a6a90a9f80134832a07f2e 01c5b637f283697350ca361f241416303ab6123da4c6726a6555ac36cb654b5c 1fb06666befd581019af509951320c7e8535e5b38ad058069f4979e9a21c7e1c This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . Rancor : 83d1d181a6d583bca2f03c3c4e517757a766da5f4c1299fbbe514b3e2abd9e0d . Second , as COSMICENERGY was potentially developed as part of a red team , this discovery suggests that the barriers to entry are lowering for offensive OT threat activity since we normally observe these types of capabilities limited to well resourced or state sponsored actors .


FakeSpy has been in the wild since 2017 ; this latest campaign indicates that it has become more powerful . Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations . Gallmaker may well have continued to avoid detection were it not for Symantec 's technology .


Infrastructure At the time of writing the following domains have either been used by this family or are currently active . One possible hit was triggered when we observed Mevade , an unusual piece of malware that appeared late in 2013 . In these instances , when a victim backdoor makes contact with a hop , the communications need to be forwarded from the hop to the intruder ’s Shanghai system so the backdoor can talk to the C2 server software . Greatness offers the ability for users to bypass targets ’ multi - factor authentication protections , IP filtering and integration with Telegram bots .


Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents . Prior to the distribution of new versions of the agent , the Infy developers appear to consistently conduct tests from local hosts , which indicates that the control and maintenance of the software occurs in the Khorasan Razavi province of Iran , potentially in the city of Mashhad .


The archive contains two files ; the first is an executable file , while the second is a decoy PDF document .


‘ SimBad ’ comes with a respected list of capabilities on the user ’ s device , such as removing the icon from the launcher , thus making it harder for the user to uninstall , start to display background ads and open a browser with a given URL . In some cases , the attackers used the Society for Worldwide Interbank Financial Telecommunication ( SWIFT ) network to transfer money to their accounts . Suckfly conducted a multistage attack against an e-commerce organization .


Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data exfiltration and to provide remote access to infected machines . Researchers at Kaspersky Lab privately disclosed the flaw to Adobe after exploits against the zero-day were used in March by the ScarCruft APT gang in what Kaspersky Lab is calling Operation Daybreak .


Quasar is a .NET Framework-based open-source RAT .


BRONZE PRESIDENT 's C2 techniques are dictated by its remote access tools .


Access to an individual's personal or corporate email account provides a substantial amount of useful intelligence , and threat actors could also leverage the access to launch additional attacks to penetrate the network of an associated organization .


As a result of our ongoing efforts , we identified significant changes to the group ’s attack methodology .


Figure 20 : dropper app category distribution Among the vast number of variants , the top 5 most infectious droppers alone have been downloaded more than 7.8 million times of the infection operations against innocent applications : Figure 21 : Top 5 most infectious droppers The “ Agent Smith ” campaign is primarily targeted at Indian users , who represent 59 % of the impacted population . The decoy documents dropped suggest that the targets are likely to be politically or militarily motivated , with subjects such as Intelligence reports and political situations being used as lure documents . exe , a password-protected ZIP file , and a batch file that checks for currently installed antivirus products . This activity suggested exploitation of CVE-2021 - 26858 .


TG-3390 conducts SWCs or sends spearphishing emails with ZIP archive attachments .


Potential targets The actors behind FrozenCell used an online service that geolocates mobile devices based on nearby cell towers to track targets . When the New York Times and Mandiant last year unmasked a large scale Chinese hacking operation , pinpointing its location down to the building , the report drew mainstream attention to what security professionals already well knew : sophisticated threat actors carry out persistent cyber operations over months and years . To help manage the vast number of systems they control , APT1 has registered hundreds of domain names , the majority of which also point to a Shanghai locale . But other bad actors have since adopted this businesses model , offering every from command and control servers to phishing bots - as - a - service .


In October 2019 , third-party researchers described a phishing campaign that used C2 infrastructure that CTU researchers attribute to BRONZE PRESIDENT .


In particular , we identified advanced methods consistent with nation-state level capabilities including deliberate targeting and ‘ access management ’ tradecraft – both groups were constantly going back into the environment to change out their implants , modify persistent methods , move to new Command & Control channels and perform other tasks to try to stay ahead of being detected .


Several days ago , the e-mail account of a high-profile Tibetan activist was hacked and used to send targeted attacks to other activists and human rights advocates . In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch . The oil and gas infrastructure nexus observed in connection with greensky27.vicp.net and other Unit 78020 ( Naikon ) infrastructure suggests targeting patterns supportive of the PRC 's strategic interests over energy resources within the South China Sea and Southeast Asia .


DLL side loading has been used to maintain persistence on the compromised system .


ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints . We believe that the IP addresses from Canada , Russia and NorACT are analysis systems of antivirus companies or security researchers .


These spear-phishing emails would contain links that eventually lead the victim to becoming infected with CozyDuke .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . However , the attack is different in two respects : unlike other APTs , the main focus of Blue Termite is to attack Japanese organizations ; and most of their C2s are located in Japan .


As a countermeasure , financial institutions introduced various second factor authentication ( 2FA ) methods . Other groups , such as Buhtrap , Corkow and Carbanak , were already known to target and successfully steal money from financial institutions and their customers in Russia . The samples of ThreeDollars we collected in these attacks are structurally very similar to the first sample we analyzed in October 2017 , down to the lure image used to trick the recipient into clicking the " Enable Content " button to execute the malicious macro .


The family was suspected to be developed by the Iron cybercrime group and it's also associated with the Xbash malware we reported on in September of 2018 . Wild Neutron 's attacks in 2015 uses a stolen code signing certificate belonging to Taiwanese electronics maker Acer and an unknown Flash Player exploit .


One in five notifications of STRONTIUM activity were tied to attacks against non-governmental organizations , think tanks , or politically affiliated organizations around the world .


APT28 is using novel techniques involving the EternalBlue exploit and the open source tool Responder to spread laterally through networks and likely target travelers . Adobe on Thursday patched a zero-day vulnerability in Flash Player that has been used in targeted attacks carried out by a new APT group operating primarily against high-profile victims in Russia and Asia .


The more complex the obfuscation , the longer it will take an antivirus solution to neutralize the malicious code . Designated as Threat Group 3390 and nicknamed " Emissary Panda " by researchers , the hacking group has compromised victims' networks largely through " watering hole " attacks launched from over 100 compromised legitimate websites , sites picked because they were known to be frequented by those targeted in the attack . The part of the code that is patched is located at the very beginning of the main function of hpqhvind.exe . Once a system was exploited a unique downloader was dropped onto the victim ’s disk , containing a customized micro backdoor written in Assembler .


XLoader can also load multiple malicious modules to receive and execute commands from its remote command-and-control ( C & C ) server , as shown below : Here ’ s a list of the modules and their functions : sendSms — send SMS/MMS to a specified address setWifi — enable or disable Wi-Fi connection gcont — collect all the device ’ s contacts lock — currently just an input lock status in the settings ( pref ) file , but may be used as a screenlocking ransomware bc — collect all contacts Lazarus is a very active attack group involved in both cyber crime and espionage . The comparison of the infection chains reveals in both cases the attacker used a couple of SFX stages to deploy the “ RMS ” software : a legitimate remote administration tool produced by the Russian company “ TektonIT ” .


Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14 , 2017 , FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East . According to our estimations , this group has been active for several years and specializes in cyberattacks against the online video game industry .


However , a coincidence seems unlikely , and CTU researchers suspect that TG-4127 used the spearphishing emails or similar techniques to gain an initial foothold in the DNC network .


Although this file itself is not particularly interesting , the older ( native ) Downeks versions also creates a file in Appdata\Roaming , with identical data .


There is no evidence that Suckfly gained any benefits from attacking the government organizations , but someone else may have benefited from these attacks .


] com http : //www.i4vip [ . If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation . The Seedworm group is the only group known to use the Powermud backdoor .


UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques . Moving through the infection process , NetWitness Endpoint detects the initial exploit CVE-2017-1182 in action as the Microsoft Equation Editor , 'EQNEDT32.exe' , scores high for potentially malicious activity .


From the 185.25.50.93 C2 IP , we discovered another hard-coded user agent being used by Zebrocy :


From where we sit , 2017 Sofacy activity starts with a heavy focus on NATO and Ukrainian partners , coinciding with lighter interest in Central Asian targets , and finishing the second half of the year with a heavy focus on Central Asian targets and some shift further East .


It is clear that on all stages there are at least two layers . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign . Looks for a Windows pipe named \\.\pipe\_kernel32.dll.ntdll.dll.user32.dll . The new documentary , The Ashley Madison Affair , begins airing today on Hulu in the United States and on Disney+ in the United Kingdom .


The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors .


Version # 2 : June - Aug. 2019 — Domain : somtum [ . Cadelle , uses Backdoor.Cadelspy . FireEye researchers discovered two possibly related campaigns utilizing two other backdoors known as THREEBYTE and WATERSPOUT . APT33 has used HTTP over TCP ports 808 and 880 for command and control.[1 ]


We believe that Bookworm samples use the static date string as campaign codes , which we used to determine the approximate date of each attack that we did not have detailed targeting information . They have different functions and ACTs of spreading , but the same purpose — to steal money from the accounts of businesses .


Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 . Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft .


Pin request overlay This overlay asks the user to provide their PIN to unlock the mobile device , which is immediately exfiltrated to the C2 . Entities in these sectors are often " enabling victims " as telecommunications providers or IT services agencies and vendors could provide Seedworm actors with further victims to compromise . Derusbi : SHA256 : 83d1d181a6d583bca2f03c3c4e517757a766da5f4c1299fbbe514b3e2ab . These individuals are targeting companies due to a difference in values .


Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique . Additionally , the same DLL sideloading technique observed in the Visma attack was used , and many of the tools deployed by the APT10 shared naming similarities as well 1.bat , cu.exe , ss.rar , r.exe , pd.exe . Most interestingly , Rapid7 observed the use of the Notepad++ updater gup.exe as a legitimate executable to sideload a malicious DLL (libcurl.dll) in order to deploy a variant of the UPPERCUT backdoor also known as ANEL .


In this blog , we look at the Winnti malware implant as used by two known activity groups BARIUM and LEAD .


The other overlapping files are tools used by the adversary to locate other systems on the network etool.exe , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 checker1.exe and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket psexec.exe . Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier .


In addition to the feature base it already possesses and the money that can be made from the rental , it could evolve to compete with the mightiest Android banking Trojans . Spam emails and attachments written in Chinese were found in May , and the SectorJ04 group at that time targeted industrial sectors such as electronics and telecommunications , international schools and manufacturing . While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


People who want to know if their Android devices are infected can download the Check Point app here . While the capabilities for the installers , loaders , and uninstallers in this report are relatively straight forward and single-focused , analysis of these malware families provide further insight into the capabilities of the Lazarus Group . Pupy RAT ( Backdoor.Patpoopy ) : Commodity RAT that can open a backdoor on an infected computer . None : While OT - oriented malware families can be purpose built for a particular target environment , malware that takes advantage of insecure by design OT protocols , such as LIGHTWORK ’s abuse of the IEC-104 protocol , can be modified and employed multiple times to target multiple victims .


Once PoisonIvy was installed , it contacted a C&C server on TCP port 80 using an encrypted communication protocol .


Since Ginp is already using some code from the Anubis Trojan , it is quite likely that other , more advanced features from Anubis or other malware , such as a back-connect proxy , screen-streaming and RAT will also be added in the future . In early 2017 , APT10 began conducting attacks against global managed IT service providers (MSPs) that granted them unprecedented access to MSPs and their customers’ networks . In July 2016 , we identified a compromised website in Japan that was hosting a Daserf variant .


The payload uses the Android Accessibility Service to get information directly from the displayed elements on the screen , so it waits for the targeted application to be launched and then parses all nodes to find text messages : Note that the implant needs special permission to use the Accessibility Service API , but there is a command that performs a request with a phishing text displayed to the user to obtain such permission . We refer to this campaign and the associated actor as Operation Kingphish Malik” , in one of its written forms in Arabic , translates to King” . Strider : ProjectSauron . Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia , China , Sweden , Belgium , Iran , and Rwanda .


The dropped file ( officeupdate.exe ) is then executed by the macro code using the PowerShell script . njRAT is a Remote Access Tool ( RAT ) used mostly by the actor groups in the middle east .


Those apps use the same techniques to monetize their actions . Throughout the years , the Mofang group has compromised countless servers belonging to government or other Myanmar related organizations , in order to stage attacks . Taiwanese citizens will go to the polls on January 16 , 2016 , to choose a new President and legislators . There are multiple Cisco Secure protections in place to defend against the types of spam used in these campaigns .


This analysis will be revisited below , along with an examination of two other PUTTER PANDA tools : pngdowner and httpclient . These could be tools to circumvent internet censorship , such as Softether VPN 4.12” and psiphon3” , or Microsoft Office activators” .


The Dukes primarily use spear-phishing emails when attempting to infect victims with their malware .


First , it creates a new directory : “ %LOCAL_APPDATA%\Microsoft\Windows ” .


Near the end of February , CrowdStrike Intelligence observed another incident in which similar manual lateral movement techniques were used to deploy GandCrab across multiple hosts in an enterprise . However , technology is not the only sector the group has focused on and Symantec has found evidence that Butterfly has attacked three major European pharmaceutical firms .


If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros . ALLANITE uses email phishing campaigns and compromised websites called watering holes to steal credentials and gain access to target networks , including collecting and distributing screenshots of industrial control systems .


Cyber Espionage in the Middle East : The Cybereason Nocturnus team has discovered several recent , targeted attacks in the Middle East .


All of these targets are large corporations that play a major role in India ’s economy .


The threat actors use the Hunter and nbtscan tools , sometimes renamed , to conduct network reconnaissance for vulnerable servers and online systems .


Unlike the simplistic MiniDuke toolset , CozyDuke is a highly versatile , modular , malware “ platform ” whose functionality lies not in a single core component but in an array of modules that it may be instructed to download from its C&C server .


b45defca452a640b303288131eb64c485f442aae0682a3c56489d24d59439b47 d9601735d674a9e55546fde0bffde235bc5f2546504b31799d874e8c31d5b6e9 2ce54d93510126fca83031f9521e40cd8460ae564d3d927e17bd63fb4cb20edc 67b1a1e7b505ac510322b9d4f4fc1e8a569d6d644582b588faccfeeaa4922cb7 APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making . FTP server was not accessible any more at the time of our . “ It appears to be the email address Will used for his profiles , ” the IT director replied .


DarkPulsar is a very interesting administrative module for controlling a passive backdoor named ' sipauth32.tsp ' that provides remote control , belonging to this category . Nevertheless , resourceful threat actors such as ScarCruft will probably continue to deploy zero-day exploits against their high profile targets .


It ’s interesting to note that this version of SPLM implements communications that are fully encrypted over HTTPS .


TG-3390 : 72.11.141.133 .


Neptun is installed on Microsoft Exchange servers and is designed to passively listen for commands from the attackers . PLEAD also uses CVE-2017-7269 , a buffer overflow vulnerability Microsoft Internet Information Services ( IIS ) 6.0 to compromise the victim 's server .


The malware now targets more countries all over the world by masquerading as official post office and transportation services apps . In a case in June 2019 , we also noticed Warzone RAT being used . DLL hijacking techniques have been seen in the past with the APT15 group .


The malware uses fake version information to appear as a Microsoft update program , as well as Google Desktop once unpacked .


In this blog post we provide additional information linking TEMP.Veles and their activity surrounding the TRITON intrusion to a Russian government-owned research institute .


SHA256 : ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8 SHA256 : 12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8 SHA256 : cb85072e6ca66a29cb0b73659a0fe5ba2456d9ba0b52e3a4c89e86549bc6e2c7 SHA256 : 23411bb30042c9357ac4928dc6fca6955390361e660fec7ac238bbdcc8b83701 Sofacy : Cdnverify.net Sofacy Filename : Upcoming_Events_February_2018.xls .


Finally , it is worth noting that the Dukes are known to sometimes re-infect a victim of one of their malware tools with another one of their tools .


] 923915 [ . Compared to other backdoor tools associated with the Sofacy group , the use of Zebrocy in attack campaigns is far more widespread . For example the subject in all the samples was a combination of a US state and a common first name ( like Utah Erick or Tennessee Dayna ) . Most fraudsters create one - time email addresses or use stolen email addresses , both of which are easy to create or obtain .


During multiple intrusions , the threat actors employed various tools and techniques to understand the network environments .


The BRONZE PRESIDENT intrusions observed by CTU researchers appear to have taken place over several months or years .


On initial inspection , the content appears to be the expected legitimate content , however , closer examination of the document shows several abnormal artifacts that would not exist in a legitimate document .


Sandworm Team may have opted for a ' hide in plain sight ' approach to evade detections from rootkit scanners , such as GMER and RootkitRevealer , that checks for system anomalies . Russian citizens—journalists , software developers , politicians , researchers at universities , and artists are also targeted by Pawn Storm .


Lured Into Deploying a Backdoor : The attackers use specially crafted lure content to trick targets into opening malicious files that infect the victim ’s machine with a backdoor .


These artifacts indicate that FakeSpy 's campaign is still live and under development . In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger . Tracking the malicious activities of the elusive Ke3chang APT group , ESET researchers have discovered new versions of malware families linked to the group , and a previously unreported backdoor .


Instead , the Spring Dragon group is known to have employed spearphish exploits , strategic web compromises , and watering holes attack . Our investigation also led to the discovery of dozens of email addresses registered by Turla operators for this campaign and used to receive exfiltrated data from the victims .


After the payload is extracted , decrypted , and mapped in the process memory , the malware calls the new DLL entry point , and then the RunDll exported function . To sum up , the HBO hacker - Behzad Mesri is a member of Turk Black Hat along with ArYaIeIrAn , who provides infrastructure for Charming Kitten activity via PersianDNS / Mahanserver together with Mohammad Rasoul Akbari , who is a Facebook friend of Behzad Mesri 's . There is no proper DLL injection routine – the payload is just decompressed to the memory as-is – so the malware needs to fix all the pointers in the decompressed code , which is done on a one-by-one basis using hardcoded values and offsets . The output is then executed using and the return value is checked to determine the functions return value , if it is 0 , return 0 if not , it will call twice


Then it executes an additional command based on the contents of this file .


Beside the obfuscation and the environment checks , the malware also has some interesting anti-sandbox mechanisms . MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call " POWERSTATS " . Unfortunately at the time of discovery , the hosted file is unavailable . An example of these log entries can be found below : By correlating the user , IP address and GUID from the Remote PowerShell HTTP logs to the Exchange frontend , CrowdStrike found a request using the mailbox to the following OWA URL , , corresponding to the IIS log entry below : The backend request for the new exploitation chain is similar to the example shown below : This request seemed to show a novel , previously undocumented , way to reach the PowerShell remoting service through the OWA frontend endpoint , instead of leveraging the endpoint .


During the account sign-up process , Google may flag the account creation attempt as suspicious and prompt the app to solve a CAPTCHA . The attackers first researched desired targets and then sent an email specifically to the target . Other groups have used legitimate websites to host C2 IP address in the past . On Feb 12th 2013 , FireEye announced the discovery of an Adobe Reader 0 - day exploit which is used to drop a previously unknown , advanced piece of malware .


URLs go-microstf.com . 69.87.223.26:8080/eiloShaegae1 . go-microstf.com/checkfile.aspx .


FormBook OverviewFormBook is a data stealer and form grabber that has been advertised in various hacking forums since early 2016 . They tried new techniques to steal from banking systems , including AWS CBR ( the Russian Central Bank 's Automated Workstation Client ) , ATMs , and card processing .


The C2 server will then provide a secondary payload to the beacon in ASCII hexadecimal representation , which the Trojan will decode and write to the following location : %APPDATA%\Roaming\Audio\soundfix.exe .


upload , download , load modules , get screenshot .


AntSword is a modular webshell that involves a very simple webshell that the actor would deploy to the compromised server and a client application referred to as the AntSword Shell Manager .


In June 26 2019 a group called “ Green Leakers ” on telegram published screenshots of the C2 admin panel as you can see below along with screenshot of the muddyc3 c2 source code . they announced that they are selling all the leaked tools for 0.5BTC .


ESET recently analyzed a new Mac OS sample from the OceanLotus group that had been uploaded to VirusTotal . If it did , the malware downloaded additional modules , including ones allowing for the automatic creation of unauthorized payment orders , changing details in legal payment orders , etc .


upAppinfos function used for obtaining the device IMEI and all of its installed applications . The finding shows that EvilGnome operates on an IP address that was controlled by the Gamaredon group two months ago . it is a typical first stage backdoor commonly found in APT attacks .


SectorJ04 used the spear phishing email to spread malicious Excel or malicious Word files , and downloaded the MSI files from the attacker’s server when the malicious documents were run . Interestingly , while most Blue Lambert variants have version numbers in the range of 2.x , Green Lambert is mostly in 3.x versions .


Make sure that all other apps installed and the device operating systems are updated to the latest version . Gorgon Group used common URL shortening services to download payloads . jnz in JZMapper ) The PDFs used highly relevant , well - crafted content that fabricated human rights seminar information and Ukraine ’s foreign policy and NATO membership plans , and were rigged with exploits attacking Adobe Reader versions 9 , 10 and 11 , bypassing its sandbox .


Sophos detects all the samples of this Trojan family as Andr/Banker-GWC and Andr/Spybot-A . As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions and financial systems to raise money for the North Korean regime . microcode data structures , I Enabled PowerShell Logging and Transcript logging that get the full PowerShell session with the output .