1 Fadi Alsalamin scandal with an Israeli officer - exclusive - watched before the deletion - Fadi Elsalameen The details of the assassination of President Arafat_06-12-2016_docx Quds.rar Many of these executables are associated with various short links created using Bit.ly , a URL shortening service . Similar to our approach with Symantec 's report on Hidden Lynx , we used Recorded Future to organize the technical details about the DeputyDog attacks to reveal technical information described in the open source reporting across multiple campaigns . In lieu of manually editing an HTML file on a hop point , we have also observed APT1 intruders uploading new ( already-edited ) HTML files . Lesser - known threat actors want to piggyback off having a big name associated with them , like DarkSide , to intimidate their actors or lend more credence to the effectiveness of their threats .


Most of these commands are related to gathering information from the infected machine ( number of CPU cores , users , scheduled tasks , running processes , OS installed , and CPU and memory information ) via the dota3 payload , as well as changing the password to a random string also stored in /tmp/up.txt .


After building an initial rapport with targets , the actors behind these social media accounts would instruct victims to install an additional app for easier communication . It mainly targets Microsoft Outlook , a widely used mail client , but also targets The Bat! , a mail client very popular in Eastern Europe . A new service is then created using the service parser function ProcessScCommand . None Read about adversaries tracked by CrowdStrike in 2021 in the and in the • None Learn more about how can help your organization prepare to defend against sophisticated threats , respond and recover from incidents with speed and precision , and fortify your cybersecurity practices .


] com/gate_cb8a5aea1ab302f0_c online 185.158.248 [ . The Trojan is quite similar to the .NET RocketMan Trojan and can handle the same commands; additionally , it includes the #screen” command to take a screenshot . A paper from FireEye in 2013 on several campaigns using PIVY included menuPass as one of them .


FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform . In 2015 , the Metel gang began to target banks and financial institutions directly .


Command & Control Communication The C2 communication of Zyklon is proxied through the Tor network . For example , DeltaAlfa specifies a DDoS bot family identified as Alfa .


This technique enables the malware to efficiently run while evading unpacking techniques from the AntiVirus-integrated UPX library .


Our first observation of an attempted attack related to this campaign dates back to November 2015 , although Symantec telemetry data indicates that the campaign may have already existed in early 2015 or perhaps even earlier . Subdomains at phmail.us have been linked to malicious activity dating back as far as December 2011 .


In our analysis , we distinguish between two separate campaigns happening simultaneously .


Gorgon used numerous decoy documents and phishing emails , both styles of attacks lacked overall sophistication . It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns .


Shamoon2 : 5e5ea1a67c2538dbc01df28e4ea87472 .


Once executed , Vcrodat loads an encrypted payload on to the victim 's computer . Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() .


The threat actor Rocke was first reported by Cisco Talos in late July 2018 . During the 2013 attacks , the Wild Neutron actor successfully compromised and leveraged the website www.iphonedevsdk.com , which is an iPhone developers forum .


However , we have not seen Bart since , suggesting that this was either an experiment or that the ransomware did not function as expected for TA505 .


TA505 introduced Jaff ransomware in May 2017 .


Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor.Sogu .


While accessing the domain from a browser you get a login page very similar to other malware panels . The backdoors Lazarus are deploying are difficult to detect and a significant threat to the privacy and security of enterprises , allowing attackers to steal information , delete files , install malware , and more . Proofpoint is tracking this attacker , believed to operate out of China , as TA459 .


We can compare it to the sample e338d49c270baf64363879e5eecb8fa6bdde8ad9 used in May 2017 by Group 74 .


NEWMSG – write an SMS to the device memory containing the text and sender number sent from C & C . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions . The EternalBlue exploits from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 .


c0cfd462ab21f6798e962515ac0c15a92036edd3e2e63639263bf2fd2a10c184 d791e0ce494104e2ae0092bb4adc398ce740fef28fa2280840ae7f61d4734514 38dcec47e2f4471b032a8872ca695044ddf0c61b9e8d37274147158f689d65b9 27cea60e23b0f62b4b131da29fdda916bc4539c34bb142fb6d3f8bb82380fe4c this SWC was used to specifically target Turkish goverment . XGen security also powers Trend Micro ’s suite of security solutions : Hybrid Cloud Security and User Protection . We initially tracked this activity as UNC3810 before merging the cluster with Sandworm .


September 08 , 2020 TikTok Spyware A detailed analysis of spyware masquerading as TikTok A recent threat to ban TikTok in the United States has taken the internet by storm and received mixed reactions from social media and internet users . As with the 2016 series of virtual bank heists , including the Bangladesh Bank heist , FASTCash illustrates that Lazarus possesses an in-depth knowledge of banking systems and transaction processing protocols and has the expertise to leverage that knowledge in order to steal large sums from vulnerable banks . Analysisof these larger convoluted clusters is ongoing .


Interestingly , the two communication apps described above as being targeted by the HenBox variant listed in Table 3 do not appear in this updated list . APT41 regularly leverages code-signing certificates to sign malware when targeting both gaming and nongaming organizations . The Dukes are known to employ a vast arsenal of malware toolsets , which we identify as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , CloudDuke , SeaDuke , HammerDuke , PinchDuke , and GeminiDuke .


In this section we describe in more detail the commands performed manually by the operators through their Delphi backdoor .


Gold Lowell responded by modifying a registry entry to disable the endpoint tool 's scanning functionality . The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems .


The attackers ’ final step was to exfiltrate data off the victim ’s network and onto Suckfly ’s infrastructure .


APT28 is using novel techniques involving the EternalBlue exploit and the open source tool Responder to spread laterally through networks and likely target travelers . Finally , there are many similarities between Gazer and other second stage backdoors used by the Turla group such as Carbon and Kazuar .


These attacks against Albanian government institutions by the Sofacy Group were documented and reported by consultancy corporate PwC in December 2014 .


About a decade ago , attackers wielding banking Trojans could simply use stolen credentials to access a victim ’ s online banking account and perform money transfers . PUTTER PANDA is likely to continue to aggressively target Western entities that hold valuable information or intellectual property relevant to these interests . We also identified another sample of ThreeDollars , created on January 15 , 2017 with the file name strategy preparation.dot .


The third type of information will be sent when RuMMS intercepts any SMS messages , including the balance inquiry results when it contacts the SMS code of a particular financial service . Additionally , the scope of organizations targeted by this group has expanded to not only include organizations within Saudi Arabia , but also a company in Qatar and government organizations in Turkey , Israel and the United States . JhoneRAT : Cloud based python RAT targeting Middle Eastern countries . The Twitter handle used by Hack520 indicates also an “ est ” portion .


Despite broad scrutiny and reports on MuddyWater attacks , the activity continues with only incremental changes to the tools and techniques .


In addition to the Mimikatz tool , the actor uploaded other tools to the webshell hosted at this second organization . es.exe : Mimikatz with custom loader , da53dcaeede03413ba02802c4be10883c4c28d3d28dee11734f048b90eb3d304 .


Since last week , iSIGHT Partners has worked to provide details on the power outage in Ukraine to our global customers . According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability .


In the 2016 Internet Crime Report published by the FBI , BEC was specifically highlighted as a " Hot Topic " , having been attributed to more than US$360 million in losses and gaining status as its own category of attack . The SWC of a Uyghur cultural website suggests intent to target the Uyghur ethnic group , a Muslim minority group primarily found in the Xinjiang region of China .


My initial thought was the worst-case scenario – they ’ve been compromised and are distributing malware ! I immediately downloaded the file from the website , but everything looked normal .


Working with U.S. Government partners , DHS and FBI identified Internet Protocol ( IP ) addresses associated with a malware variant , known as DeltaCharlie , used to manage North Korea 's distributed denial-of-service ( DDoS ) botnet infrastructure .


Following is the HTTP response from the C2 server , containing the encrypted configuration : EventBot Encrypted HTTP response returned from the C2 Encrypted HTTP response returned from the C2 . Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam . The MPK bot is not publicly available and had previously been attributed to an adversary group called " Rocket Kitten " which has often been thought to be a state sponsored adversary operating in the Middle East region .


Investigators indicated that the actors may have gained access to DCCC systems as early as March .


The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information . The threat is likely targeting employees of various Palestinian government agencies , security services , Palestinian students , and those affiliated with the Fatah political party .


Although BokBot has aided the distribution of TrickBot since 2017 , the development of custom TrickBot modules for the specific campaign has not been observed before . BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China .


Multiple China-based cyber threat groups have targeted international media organizations in the past .


The admin@338 has targeted international media organizations in the past .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations .


The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


Once the LOWBALL malware calls back to the Dropbox account , the admin@338 will create a file called upload.bat which contains commands to be executed on the compromised computer .


We observed the admin@338 upload a second stage malware , known as BUBBLEWRAP ( also known as Backdoor.APT.FakeWinHTTPHelper ) to their Dropbox account along with the following command .


We have previously observed the admin@338 group use BUBBLEWRAP .


The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets .


The admin@338 linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


The group targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


The agroup targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


The admin@338 , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


In August 2013 , FireEye reported that admin@338 had been using the Poison Ivy RAT in its operations .


In March 2014 , the admin@338 leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank .


In March 2014 , the group leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank .


According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


The admin@338 's Dropbox accounts have also been found to contain a different backdoor dubbed BUBBLEWRAP .


Researchers have pointed out that it is not uncommon for China-based threat groups to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement .


Researchers have pointed out that it is not uncommon for admin@338 to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement .


This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose .


The attackers used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


The admin@338 used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


FireEye analysts documented the admin@338 group 's activities in a previous paper titled Poison Ivy : Assessing Damage and Extracting Intelligence paper .


The spear-phishing campaign against Asian entities isn't isolated , the admin@338 also started another attack against the US-based think tank on 14th March .


Our analysis has led us to conclude that APT1 is likely government-sponsored and one of the most persistent of China 's cyber threat actors .


FireEye said it has tracked admin@338 's activity since 2013 and the group has largely targeted organizations involved in financial , economic , and trade policy .


The simplest conclusion based on these facts is that APT1 is operating in China , and most likely in Shanghai .


These data sets show that APT1 is either operating in China during normal Chinese business hours or that APT1 is intentionally going to painstaking lengths to look like they are .


APT1 has used and steadily modified BISCUIT since as early as 2007 and continues to use it presently .


While APT1 intruders occasionally use publicly available backdoors such as Poison Ivy and Gh0st RAT .


Given the mission , resourcing , and location of PLA Unit 61398 , we conclude that PLA Unit 61398 is APT1 .


APT1 were a highly prolific cyber-attack group operating out of China .


APT1 is a China-based cyber-espionage group , active since mid-2006 .


APT12 's targets are consistent with larger People 's Republic of China ( PRC ) goals .


Since the release of the Arbor blog post , FireEye has observed APT12 use a modified backdoor that we call HIGHTIDE .


However , the malware shared several traits with the RIPTIDE and HIGHTIDE backdoor that we have attributed to APT12 .


From October 2012 to May 2014 , FireEye observed APT12 utilizing RIPTIDE , that communicates via HTTP to a hard-coded command and control ( C2 ) server .


Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 .


FireEye believes the change from RIPTIDE to HIGHTIDE represents a temporary tool shift to decrease malware detection while APT12 developed a completely new malware toolset .


They have largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


A China-based cyber threat group , which FireEye tracks as an uncategorized advanced persistent threat ( APT ) group and other researchers refer to as admin@338 , may have conducted the activity .


The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


About four months after The New York Times publicized an attack on its network , the APT12 behind the intrusion deployed updated versions of their Backdoor.APT.Aumlib and Backdoor.APT.Ixeshe malware families .


With this in mind , this week we are providing some indicators for a China based adversary who we crypt as " NUMBERED PANDA " Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc .


Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc .


The new campaigns mark the first significant stirrings from the APT12 since it went silent in January in the wake of a detailed expose of the group and its exploits — and a retooling of what security researchers believe is a massive spying operation based in China .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries .


On November 26 , 2015 , a suspected China-based APT16 sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


On November 26 , 2015 , a suspected China-based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


While attribution of the first two spear phishing attacks is still uncertain , we attribute the second December phishing campaign to the China-based APT group that we refer to as APT16 .


APT16 actors sent spear phishing emails to two Taiwanese media organizations .


On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website .


It is possible , although not confirmed , that APT16 was also responsible for targeting this government agency , given both the timeframe and the use of the same n-day to eventually deploy the ELMER backdoor .


Despite the differing sponsorship , penetration of Hong Kong and Taiwan-based media organizations continues to be a priority for China-based APT16 .


The suspected APT16 targeting of the Taiwanese government agency – in addition to the Taiwanese media organizations – further supports this possibility .


APT17 was embedding the encoded CnC IP address for the BLACKCOFFEE malware in legitimate Microsoft TechNet profiles pages and forum threads , a method some in the information security community call a " dead drop resolver " .


APT17 , also known as DeputyDog , is a China-based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


FireEye has monitored APT17 's use of BLACKCOFFEE variants since 2013 to masquerade malicious communication as normal web traffic by disguising the CnC communication as queries to web search engines .


The use of BLACKCOFFEE demonstrates APT17 's evolving use of public websites to hide in plain sight .


TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology .


The APT18 then installed the hcdLoader RAT , which installs as a Windows service and provides command line access to the compromised system .


The malware used by the Wekby group has ties to the HTTPBrowser malware family , and uses DNS requests as a command and control mechanism .


These URIs result in the download of an installer , which creates a PE of the malware typically known as HTTPBrowser , but called Token Control by the Wekby group themselves ( based upon the PDB strings found within many of the samples ) .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and political , financial , pharmaceutical and energy sectors that could benefit the Chinese economy .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy .


APT28 malware , in particular the family of modular backdoors that we call CHOPSTICK , indicates a formal code development environment .


However , three themes in APT28 's targeting clearly reflects areas of specific interest to an Eastern European government , most likely the Russian government .


We identified three themes in APT28 's lures and registered domains , which together are particularly relevant to the Russian government .


Georgian military security issues , particularly with regard to U.S. cooperation and NATO , provide a strong incentive for Russian state-sponsored threat actors to steal information that sheds light on these topics .


APT28 's malware settings suggest that the developers have done the majority of their work in a Russian language build environment during Russian business hours , which suggests that the Russian government is APT28 's sponsor .


We believe that APT28 's targeting of the MOD aligns with Russian threat perceptions .


We assess that APT28 is most likely sponsored by the Russian government .


Given the available data , we assess that APT28 's work is sponsored by the Russian government .


The targets of TG-4127 include military , government and defense sectors .


Some of APT28 's more commonly used tools are the SOURFACE downloader , its second stage backdoor EVILTOSS , and a modular family of implants that we call CHOPSTICK .


Our visibility into the operations of APT28 - a group we believe the Russian Government sponsors - has given us insight into some of the government 's targets , as well as its objectives and the activities designed to further them .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government .


After compromising a political organization , APT28 will steal internal data .


On December 29 , 2016 , the Department of Homeland Security ( DHS ) and Federal Bureau of Investigation ( FBI ) released a Joint Analysis Report confirming FireEye 's long held public assessment that the Russian Government sponsors APT28 .


In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations , and characterized APT28 's activity as aligning with the Russian Government 's strategic intelligence requirements .


In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations' , and characterized APT28 's activity as aligning with the Russian Government 's strategic intelligence requirements .


APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


Our investigation of APT28 's compromise of WADA 's network , and our observations of the surrounding events reveal how Russia sought to counteract a damaging narrative and delegitimize the institutions leveling criticism .


For full details , please reference our 2014 report , APT28 : A Window into Russia 's Cyber Espionage Operations .


The APT28 , which is linked to the Russian government , returned to low-key intelligence-gathering operations during 2017 and into 2018 , targeting a range of military and government targets in Europe and South America .


Several sources consider APT28 a group of CyberMercs based in Russia .


The primary targets of APT28 are potential victims in several countries such as Ukraine , Spain , Russia , Romania , the United States and Canada .


We have reasons to believe that the operators of the APT28 network are either Russian citizens or citizens of a neighboring country that speak Russian .


Finally , the use of recent domestic events and a prominent US military exercise focused on deterring Russian aggression highlight APT28 's ability and interest in exploiting geopolitical events for their operations .


In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM , JHUHUGIT , AZZY and a few others .


The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


Their evolving and modified SPLM , CHOPSTICK , XAgent code is a long-standing part of Sofacy activity , however much of it is changing .


Compared to other backdoor tools associated with the Sofacy group , the use of Zebrocy in attack campaigns is far more widespread .


As alluded to in our previous blog regarding the Cannon tool , the Sofacy group ( AKA Fancy Bear , APT28 , STRONTIUM , Pawn Storm , Sednit ) has persistently attacked various government and private organizations around the world from mid-October 2018 through mid-November 2018 .


Russian citizens—journalists , software developers , politicians , researchers at universities , and artists are also targeted by Pawn Storm .


While the JHUHUGIT ( and more recently , " JKEYSKW " ) implant used in most of the Sofacy attacks , high profile victims are being targeted with another first level implant , representing the latest evolution of their AZZY Trojan .


Once a foothold is established , Sofacy trys to upload more backdoors , USB stealers as well as other hacking tools such as " Mimikatz " for lateral movement .


Once a foothold is established , they try to upload more backdoors , USB stealers as well as other hacking tools such as " Mimikatz " for lateral movement .


Komplex shares a significant amount of functionality and traits with another tool used by Sofacy – the Carberp variant that Sofacy had used in previous attack campaigns on systems running Windows .


The Sofacy group created the Komplex Trojan to use in attack campaigns targeting the OS X operating system – a move that showcases their continued evolution toward multi-platform attacks .


The Komplex Trojan revealed a design similar to Sofacy 's Carberp variant Trojan , which we believe may have been done in order to handle compromised Windows and OS X systems using the same C2 server application with relative ease .


This whitepaper explores the tools - such as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , etc- of the Dukes , a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making .


The origins of the Duke toolset names can be traced back to when researchers at Kaspersky Labs coined the term " MiniDuke " to identify the first Duke-related malware they found .


As researchers continued discovering new toolsets that were created and used by the same group that had been operating MiniDuke , and thus the threat actor operating the toolsets started to be commonly referred to as " Dukes " .


Importantly , PinchDuke trojan samples always contain a notable text string , which we believe is used as a campaign identifier by the Dukes group to distinguish between multiple attack campaigns that are run in parallel .


This neatly ties together many of the tools used by the Dukes group , as versions of this one loader have been used to load malware from three different Dukes-related toolsets CosmicDuke , PinchDuke , and MiniDuke – over the course of five years .


In the latter case however , the Dukes group appear to have also simultaneously developed an entirely new loader , which we first observed being used in conjunction with CosmicDuke during the spring of 2015 .


The Dukes could have ceased all use of CosmicDuke ( at least until they had developed a new loader ) or retired it entirely , since they still had other toolsets available .


For these CozyDuke campaigns however , the Dukes appear to have employed two particular later-stage toolsets , SeaDuke and HammerDuke .


All of the available evidence however does in our opinion suggest that the group operates on behalf of the Russian Federation .


Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years .


APT29 has used The Onion Router and the TOR domain fronting plugin meek to create a hidden , encrypted network tunnel that appeared to connect to Google services over TLS .


Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY .


Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years .


In the investigations Mandiant has conducted , it appeared that APT29 deployed POSHSPY as a secondary backdoor for use if they lost access to their primary backdoors .


POSHSPY is an excellent example of the skill and craftiness of APT29 .


FireEye assesses that APT32 leverages a unique suite of fully-featured malware , in conjunction with commercially-available tools , to conduct targeted operations that are aligned with Vietnamese state interests .


In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 .


From 2016 through 2017 , two subsidiaries of U.S. and Philippine consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations .


From 2016 through 2017 , two consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


In 2015 and 2016 , two Vietnamese media outlets were targeted with malware that FireEye assesses to be unique to APT32 .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam 's manufacturing , consumer products , and hospitality sectors .


APT32 operations are characterized through deployment of signature malware payloads including WINDSHIELD , KOMPROGO , SOUNDBITE , and PHOREAL .


In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines .


APT32 often deploys these backdoors along with the commercially-available Cobalt Strike backdoor .


Based on incident response investigations , product detections , and intelligence observations along with additional publications on the same operators , FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests .


OceanLotus , also known as APT32 , is believed to be a Vietnam-based APT group that has become increasingly sophisticated in its attack tactics , techniques , and procedures ( TTPs ) .


While Volexity does not typically engage in attempting attribution of any threat actor , Volexity does agree with previously reported assessments that OceanLotus is likely operating out of Vietnam .


During that phase , the APT32 operated a fileless PowerShell-based infrastructure , using customized PowerShell payloads taken from known offensive frameworks such as Cobalt Strike , PowerSploit and Nishang .


However , over the past few years , we have been tracking a separate , less widely known suspected Iranian group with potential destructive capabilities , whom we call APT33 .


Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 .


We assess APT33 works at the behest of the Iranian government .


APT33 has targeted organizations – spanning multiple industries – headquartered in the United States , Saudi Arabia and South Korea .


Cybereason also attributes the recently reported Backdoor.Win32.Denis to the OceanLotus Group , which at the time of this report 's writing , had not been officially linked to this threat actor .


APT33 has shown particular interest in organizations in the aviation sector , as well as organizations in the energy sector with ties to petrochemical production .


From mid-2016 through early 2017 , APT33 compromised a U.S. organization in the aerospace sector and targeted a business conglomerate located in Saudi Arabia with aviation holdings .


From mid-2016 through early 2017 , APT33 compromised organizations located in Saudi Arabia and U.S. in the aerospace sector .


During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals .


More recently , in May 2017 , APT33 appeared to target a Saudi organization and a South Korean business conglomerate using a malicious file that attempted to entice victims with job vacancies for a Saudi Arabian petrochemical company .


More recently , in May 2017 , APT33 appeared to target organizations in Saudi and South Korea using a malicious file that attempted to entice victims with job vacancies .


We assess the targeting of multiple companies with aviation-related partnerships to Saudi Arabia indicates that APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia .


APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia .


The generalized targeting of organizations involved in energy and petrochemicals mirrors previously observed targeting by other suspected Iranian threat groups , indicating a common interest in the sectors across Iranian actors .


APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


APT33 registered multiple domains that masquerade as Saudi Arabian aviation companies and Western organizations that together have partnerships to provide training , maintenance and support for Saudi 's military and commercial fleet .


We identified APT33 malware tied to an Iranian persona who may have been employed by the Iranian government to conduct cyber threat activity against its adversaries .


APT33 's targeting of organizations involved in aerospace and energy most closely aligns with nation-state interests , implying that the threat actor is most likely government sponsored .


APT33 leverages popular Iranian hacker tools and DNS servers used by other suspected Iranian threat groups .


This coupled with the timing of operations – which coincides with Iranian working hours – and the use of multiple Iranian hacker tools and name servers bolsters our assessment that APT33 may have operated on behalf of the Iranian government .


The publicly available backdoors and tools utilized by APT33 – including NANOCORE , NETWIRE , and ALFA Shell – are all available on Iranian hacking websites , associated with Iranian hackers , and used by other suspected Iranian threat groups .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


Specifically , the targeting of organizations in the aerospace and energy sectors indicates that the APT33 is likely in search of strategic intelligence capable of benefitting a government or military sponsor .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military aviation capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


We expect APT33 activity will continue to cover a broad scope of targeted entities , and may spread into other regions and sectors as Iranian interests dictate .


The Elfin espionage group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries .


On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " ( referred to as GroupB in this blog post ) to APT33 , operating at the behest of the Iranian government .


The Elfin group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries .


On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " to APT33 , operating at the behest of the Iranian government .


APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea .


In 2017 , APT37 expanded its targeting beyond the Korean peninsula to include Japan , Vietnam and the Middle East , and to a wider range of industry verticals , including chemicals , electronics , manufacturing , aerospace , automotive and healthcare entities .


In 2017 , APT37 targeted a company in Middle East that entered into a joint venture with the North Korean government to provide telecommunications service to the country .


While not conclusive by itself , the use of publicly available Iranian hacking tools and popular Iranian hosting companies may be a result of APT33 's familiarity with them and lends support to the assessment that APT33 may be based in Iran .


North Korean defector and human rights-related targeting provides further evidence that APT37 conducts operations aligned with the interests of North Korea .


In 2017 , APT37 targeted a Middle Eastern company that entered into a joint venture with the North Korean government to provide telecommunications service to the country ( read on for a case study ) .


APT37 targeted a research fellow , advisory member , and journalist associated with different North Korean human rights issues and strategic organizations .


APT37 distributed SLOWDRIFT malware using a lure referencing the Korea Global Forum against academic and strategic institutions located in South Korea .


We believe a organization located in Middle East was targeted by APT37 because it had been involved with a North Korean company and a business deal went bad .


In one instance , APT37 weaponized a video downloader application with KARAE malware that was indiscriminately distributed to South Korean victims through torrent websites .


FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims .


FireEye iSIGHT Intelligence confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims .


In April 2017 , APT37 targeted South Korean military and government organizations with the DOGCALL backdoor and RUHAPPY wiper malware .


It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations .


We assess with high confidence that APT37 acts in support of the North Korean government and is primarily based in North Korea .


The compilation times of APT37 malware is consistent with a developer operating in the North Korea time zone ( UTC +8:30 ) and follows what is believed to be a typical North Korean workday .


The majority of APT37 activity continues to target South Korea , North Korean defectors , and organizations and individuals involved in Korean Peninsula reunification efforts .


Similarly , APT37 targeting of a company located in Middle East in 2017 is also consistent with North Korean objectives given the entity 's extensive relationships inside North Korea .


Similarly , APT37 targeting of a Middle Eastern company in 2017 is also consistent with North Korean objectives given the entity 's extensive relationships inside North Korea .


In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company .


Though they have primarily tapped other tracked suspected North Korean teams to carry out the most aggressive actions , APT37 is an additional tool available to the regime , perhaps even desirable for its relative obscurity .


ScarCruft is a relatively new APT group , victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania .


Certain details , such as using the same infrastructure and targeting , make us believe that Operation Daybreak is being done by the ScarCruft APT group .


Prior to the discovery of Operation Daybreak , we observed the ScarCruft APT launching a series of attacks in Operation Erebus .


Operation Daybreak appears to have been launched by unknown attackers to infect high profile targets through spear-phishing e-mails .


Operation Daybreak appears to have been launched by APT37 to infect high profile targets through spear-phishing e-mails .


On occasion the APT37 directly included the ROKRAT payload in the malicious document and during other campaigns the attackers leveraged multi-stage infection processes .


In the early part of 2017 , Group123 started the " Evil New Year " campaign .


In November 2017 , Talos observed the latest Group123 campaign of the year , which included a new version of ROKRAT being used in the latest wave of attacks .


Group123 is constantly evolving as the new fileless capability that was added to ROKRAT demonstrates .


In this campaign , the Group123 used a classical HWP document in order to download and execute a previously unknown malware : NavRAT .


However , we asses with medium confidence that NavRAT is linked to Group123 .


APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world 's largest cyber heists .


APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world .


APT38 is believed to operate more similarly to an espionage operation , carefully conducting reconnaissance within compromised financial institutions and balancing financially motivated objectives with learning about internal systems .


The group has compromised more than 16 organizations in at least 13 different countries , sometimes simultaneously , since at least 2014 .


APT38 shares malware code and other development resources with TEMP.Hermit North Korean cyber espionage activity , although we consider APT38 .


We consider APT38 's operations more global and highly specialized for targeting the financial sector .


APT38 is a financially motivated group linked to North Korean cyber espionage operators , renown for attempting to steal hundreds of millions of dollars from financial institutions and their brazen use of destructive malware .


Because APT38 is backed by ( and acts on behalf of ) the North Korean regime , we opted to categorize the group as an " APT " instead of a " FIN " .


Over time these malware similarities diverged , as did targeting , intended outcomes , and TTPs , almost certainly indicating that TEMP.Hermit activity is made up of multiple operational groups primarily linked together with shared malware development resources and North Korean state sponsorship .


Based on observed activity , we judge that APT38 's primary mission is targeting financial institutions and manipulating inter-bank financial systems to raise large sums of money for the North Korean regime .


Since 2015 , APT38 has attempted to steal hundreds of millions of dollars from financial institutions .


APT38 has pursued their main objective of targeting banks and financial entities since at least 2014 .


We surmise that the targeting of banks , media , and government agencies is conducted in support of APT38 's primary mission .


The APT38 targeted news outlets known for their business and financial sector reporting , probably in support of efforts to identify and compromise additional financial institutions .


APT38 also targeted financial transaction exchange companies likely because of their proximity to banks .


Given the lapse in time between the spear-phishing and the heist activity in the above example , we suggest two separate but related groups under the North Korean regime were responsible for carrying out missions ; one associated with reconnaissance ( TEMP.Hermit or a related group ) and another for the heists ( APT38 ) .


APT38 , in particular , is strongly distinguishable because of its specific focus on financial institutions and operations that attempt to use SWIFT fraud to steal millions of dollars at a time .


We can confirm that the APT38 operator activity is linked to the North Korean regime , but maintains a set of common characteristics , including motivation , malware , targeting , and TTPs that set it apart from other statesponsored operations .


As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions to raise money for the North Korean regime .


As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions and financial systems to raise money for the North Korean regime .


Although the APT38 's primary targets appear to be Financial Exchange banks and other financial organizations , they have also Financial Exchange targeted countries ' media organizations with a focus on the financial sector .


Since at least the beginning of 2014 , APT38 operations have focused almost exclusively on developing and conducting financially motivated campaigns targeting international entities , whereas TEMP.Hermit is generally linked to operations focused on South Korea and the United States .


TEMP.Hermit is generally linked to operations focused on South Korea and the United States .


While North Korean cyber operations against specific countries may have been driven by diplomatic factors and perceived insults against Pyongyang , the application of increasingly restrictive and numerous financial sanctions against North Korea probably contributed to the formation of APT38 .


APT38 's operations began in February 2014 and were likely influenced by financial sanctions enacted in March 2013 that blocked bulk cash transfers and restricted North Korea 's access to international banking systems .


APT37 ( Reaper ) , another North Korean state-sponsored group , targeted a Middle Eastern financial company , but there was no evidence of financial fraud .


APT37 , another North Korean state-sponsored group , targeted a Middle Eastern financial company , but there was no evidence of financial fraud .


Early APT38 operations suggest that the group began targeting financial institutions with an intent to manipulate financial transaction systems at least as early as February 2014 , although we did not observe fraudulent transactions until 2015 .


We do not have evidence that the earliest targeted financial institutions were victimized by fraudulent transactions before APT38 left the compromised environments , possibly indicating that APT38 was conducting reconnaissance-only activity at that time .


In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank .


From November 2015 through the end of 2016 , APT38 was involved in at least nine separate compromises against banks .


Per the complaint , the email account watsonhenny@gmail.com was used to send LinkedIn invitations to employees of a bank later targeted by APT38 .


Further , the recent DOJ complaint provides insight into initial compromise techniques conducted by North Korean operators against APT38 targets , which may have been leveraged as part of the initial compromise into the targeted organizations .


This is corroborated by our identification of TEMP.Hermit 's use of MACKTRUCK at a bank , preceding the APT38 operation targeting the bank 's SWIFT systems in late 2015 .


APT38 relies on DYEPACK , a SWIFT transaction-hijacking framework , to initiate transactions , steal money , and hide any evidence of the fraudulent transactions from the victimized bank .


The APT38 uses DYEPACK to manipulate the SWIFT transaction records and hide evidence of the malicious transactions , so bank personnel are none the wiser when they review recent transactions .


During this heist , APT38 waited for a holiday weekend in the respective countries to increase the likelihood of hiding the transactions from banking authorities .


During one reported incident , APT38 caused an outage in the bank 's essential services .


We attribute APT38 to North Korean state-sponsored operators based on a combination of technical indicators linking the activity to Pyongyang and details released by DOJ implicating North Korean national Park Jin Hyok in a criminal conspiracy .


As detailed in the DOJ complaint , a sample of WHITEOUT malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank .


APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition .


Malware overlaps between APT38 and TEMP.Hermit highlight the shared development resources accessible by multiple operational groups linked to North Korean state-sponsored activity .


APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry .


This is evidence of shared motivation and intent to target the SWIFT system by the North Korean operators performing the reconnaissance and APT38 which later targeted that organization .


Although APT38 is distinct from other TEMP.Hermit activity , both groups operate consistently within the interests of the North Korean state .


Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea .


As detailed in the DOJ complaint , a sample of WHITEOUT ( aka Contopee ) malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank .


Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea 's Reconnaissance General Bureau ( RGB ) .


APT38 's targeting of financial institutions is most likely an effort by the North Korean government to supplement their heavily-sanctioned economy .


We have moderate confidence APT39 operations are conducted in support of Iranian national interests based on regional targeting patterns focused in the Middle East .


APT39 's focus on the widespread theft of personal information sets it apart from other Iranian groups FireEye tracks , which have been linked to influence operations , disruptive attacks , and other threats .


APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns .


Other groups attributed to Iranian attackers , such as Rocket Kitten , have targeted Iranian individuals in the past , including anonymous proxy users , researchers , journalists , and dissidents .


Remexi is a basic back door Trojan that allows Cadelle to open a remote shell on the computer and execute commands .


Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands .


One group , which we call Cadelle , uses Backdoor.Cadelspy , while the other , which we've named Chafer , uses Backdoor.Remexi and Backdoor.Remexi.B .


APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol ( RDP ) , Secure Shell ( SSH ) , PsExec , RemCom , and xCmdSvc .


The APT39 were using an improved version of Remexi in what the victimology suggests might be a domestic cyber-espionage operation .


A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group .


A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group .


The Middle Eastern hacker group in this case is codenamed " BlackOasis " .


Kaspersky found the BlackOasis group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


BlackOasis ' interests span a wide gamut of figures involved in Middle Eastern politics .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japanese organizations such as government agencies ( including defense ) as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets .


In fact , REDBALDKNIGHT has been zeroing in on Japanese organizations as early as 2008 — at least based on the file properties of the decoy documents they've been sending to their targets .


Secureworks® incident responders and Counter Threat Unit™ ( CTU ) researchers investigated activities associated with the BRONZE BUTLER ( also known as Tick ) threat group , which likely originates in the People .


Targeting data supports the belief that APT39 's key mission is to track or monitor targets of interest , collect personal information , including travel itineraries , and gather customer data from telecommunications firms .


BRONZE BUTLER has used a broad range of publicly available ( Mimikatz and gsecdump ) and proprietary ( Daserf and Datper ) tools .


BRONZE BUTLER are also fluent in Japanese , crafting phishing emails in native Japanese and operating successfully within a Japanese-language environment .


BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


BRONZE BUTLER uses credential theft tools such as Mimikatz and WCE to steal authentication information from the memory of compromised hosts .


While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


Several xxmm samples analyzed by CTU researchers incorporate Mimikatz , allowing BRONZE BUTLER to issue Mimikatz commands directly from xxmm .


BRONZE BUTLER compromises organizations to conduct cyberespionage , primarily focusing on Japan .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when the group compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when BRONZE BUTLER compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


In some cases , the attackers used the Society for Worldwide Interbank Financial Telecommunication ( SWIFT ) network to transfer money to their accounts .


Carbanak is a backdoor used by the attackers to compromise the victim .


Carbanak is also aware of the IFOBS banking application and can , on command , substitute the details of payment documents in the IFOBS system .


Sensitive bank documents have be found on the servers that were controlling Carbanak .


Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa .


FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015 .


As with previous campaigns , and as highlighted in our annual M-Trends 2017 report , FIN7 is calling stores at targeted organizations to ensure they received the email and attempting to walk them through the infection process .


While FIN7 has embedded VBE as OLE objects for over a year , they continue to update their script launching mechanisms .


This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies .


The group has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space .


Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems .


The first successful bank robbery was committed by this group in January 2013 .


To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer .


We have no evidence of compromises against banks in Western Europe or United States , but it should be noted that the attackers methods could be utilized against banks outside of Russia as well .


Additionally the reports on Carbanak show a different picture , where banks targeted outside of Russia , specifically Europe , USA and Japan are mentioned , which does not match our research .


Without any insight into the evidence Kaspersky has obtained , we can only repeat our view that Anunak has targeted only banks in Russia and we have no concrete reports of compromised banks outside of Russia directly related to this criminal group .


Charming Kitten is an Iranian cyberespionage group operating since approximately 2014 .


These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider .


The Charming Kitten' focus appears to be individuals of interest to Iran in the fields of academic research .


Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as OilRig and CopyKittens .


Flying Kitten ( which is another name given by the security industry to Charming Kitten ) was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of the IRI ( Islamic Republic of Iran ) government and foreign espionage targets .


Flying Kitten was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of government and foreign espionage targets .


At certain times , Mesri has been a member of an Iran-based hacking group called the Turk Black Hat security team " .


During intense intelligence gathering over the last 24 months , we observed the technical capabilities of the Operation Cleaver team rapidly evolve faster than any previously observed Iranian effort .


TinyZBot is a bot written in C# and developed by the Cleaver team .


Some of the teams publicly known today include Iranian Cyber Army , Ashiyane , Islamic Cyber Resistance Group , Izz ad-Din al-Qassam Cyber Fighters , Parastoo , Shabgard , Iran Black Hats and many others 9 .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team .


The Cobalt group 's traditional " stomping grounds " are the Eastern Europe , Central Asia , and Southeast Asia .


Against targets in the CIS countries , the Cobalt also used their own infrastructure , which included rented dedicated servers .


In several cases , the Cobalt compromised company infrastructure and employee accounts in order to send phishing messages to partner companies in North and South America , Europe , CIS countries , and Central and Southeast Asia .


To ensure remote access to the workstation of an employee at a target organization , the Cobalt group ( as in previous years ) uses Beacon , a Trojan available as part of commercial penetration testing software .


Artifacts indicated the involvement of the Cobalt that , according to Positive Technologies information , from August to October had performed similar successful attacks in Eastern Europe , and it 's likely that this group may will soon become active in the West .


In a recent spear-phishing campaign , the Cobalt Hacking Group used a remote code execution vulnerability in Microsoft Office software to connect to its command and control server via Cobalt Strike .


The basic principles of targeted attacks on financial institutions have not changed since 2013 when the Anunak , Corkow , Buhtrap , and Lurk groups began conducting the first attacks on Russian banks .


In a recent spear-phishing campaign , the Cobalt Group used a known CVE to connect to its C&C server via Cobalt Strike , but ended up revealing all targets .


This isn't the first time we've seen Cobalt makes this error—back in March , an attack focussing on 1,880 targets across financial institutions in Kazakhstan had the same flaw .


The Carbanak attacks targeting over a 100 financial institutions worldwide .


The leader of the crime gang behind the Carbanak and Cobalt malware attacks targeting over a 100 financial institutions worldwide has been arrested in Alicante , Spain , after a complex investigation conducted by the Spanish National Police .


Since 2013 , the Cobalt have attempted to attack banks and financial institutions using pieces of malware they designed .


Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt .


The organised crime group started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world .


One of the Cobalt Group 's latest campaigns , an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor , was investigated and presented by the Talos research team .


The Cobalt started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world .


The Cobalt group misused Cobalt Strike , for instance , to perpetrate ATM cyber heists and target financial institutions across Europe , and interestingly , Russia .


The hacking group misused Cobalt Strike , for instance , to perpetrate ATM cyber heists and target financial institutions across Europe , and interestingly , Russia .


If successful , Cobalt goes on to attack financial institutions outside the country .


The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled .


As part of our monitoring of Iranian threat agents activities , we have detected that since October 2016 and until the end of January 2017 , the Jerusalem Post , as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens .


CopyKittens use several self-developed malware and hacking tools that have not been publicly reported to date , and are analyzed in this report : TDTESS backdoor ; Vminst , a lateral movement tool ; NetSrv , a Cobalt Strike loader ; and ZPP , a files compression console program .


CopyKittens often uses the trial version of Cobalt Strike , a publicly available commercial software for " Adversary Simulations and Red Team Operations " .


Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent .


The group , which we have given the name Gallmaker , has been operating since at least December 2017 , with its most recent activity observed in June 2018 .


Rather , the Gallmaker 's attack activity we observed is carried out exclusively using LotL tactics and publicly available hack tools .


Gallmaker used lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange ( DDE ) protocol in order to gain access to victim machines .


Back in 2013 , CopyKittens used several Facebook profiles to spread links to a website impersonating Haaretz news , an Israeli newspaper .


Gallmaker 's activity appears to be highly targeted , with its victims all related to government , military , or defense sectors .


Gallmaker 's targets are embassies of an Eastern European country .


There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors .


The group has carried out attacks most months since December 2017 .


Its activity subsequently increased in the second quarter of 2018 , with a particular spike in April 2018 .


The fact that Gallmaker appears to rely exclusively on LotL tactics and publicly available hack tools makes its activities extremely hard to detect .


The Gamaredon Group primarily makes use of compromised domains , dynamic DNS providers , Russian and Ukrainian country code top-level domains ( ccTLDs ) , and Russian hosting providers to distribute their custom-built malware .


Gallmaker may well have continued to avoid detection were it not for Symantec 's technology .


In this instance , Symantec identified the specific PowerShell commands used by Gallmaker as being suspicious , leading to the discovery of this new campaign .


Without Symantec 's advanced AI-based capabilities , Gallmaker 's activities may well have remained undetected .


Previously , LookingGlass reported on a campaign they named " Operation Armageddon " , targeting individuals involved in the Ukrainian military and national security establishment .


The earliest discovered sample ( based on compile times and sandbox submission times ) distributed by this threat group resembles the descriptions of Gamaredon provided by Symantec and Trend Micro .


The scripts would also use wget to send POST requests to command and control ( C2 ) servers that would contain information about the compromised system .


The batch script would then attempt to have the VNC program connect to a command and control ( C2 ) server to enable the server to control the compromised system .


While the most recent samples observed still use batch scripts and SFX files , the Gamaredon Group has moved away from applications like wget , Remote Manipulator Tool , VNC and ChkFlsh.exe .


The threat group using these implants has been active since at least 2014 and has been seen targeting individuals likely involved in the Ukrainian government .


Some of the samples share delivery mechanisms and infrastructure with samples which are detected by a few antivirus vendors as Gamaredon .


Periodically , researchers at Palo Alto Networks hunt through WildFire execution reports , using AutoFocus , to identify untagged samples ' artifacts in the hopes of identifying previously undiscovered malware families , behaviors , and campaigns .


Today at the Security Analyst Summit ( SAS 2016 ) , Kaspersky Lab is announcing the discovery of two new gangs engaged in APT-style bank robberies – Metel and GCMAN – and the reemergence of the Carbanak group with new targets in its sights .


In 2015 , Kaspersky Lab researchers conducted Incident Response for 29 organizations located in Russia and infected by these three groups .


Kaspersky Lab is releasing crucial Indicators of Compromise ( IOCs ) and other data to help organizations search for traces of these attack groups in their corporate networks .


In all , Kaspersky Lab discovered Metel in more than 30 financial institutions .


It is highly likely that this threat is far more widespread and we urge financial institutions around the world to scan their networks for signs of the Metel malware .


A second group , which we call GCMAN because the malware is based on code compiled on the GCC compiler , emerged recently using similar techniques to the Metel Group to infect banking institutions and attempt to transfer money to e-currency services .


Our investigations revealed that the attackers drove around several cities in Russia , stealing money from ATMs belonging to different banks .


Once inside the network , the GCMAN group uses legitimate and penetration testing tools such as Putty , VNC , and Meterpreter for lateral movement .


During that time they poked 70 internal hosts , compromised 56 accounts , making their way from 139 attack sources ( TOR and compromised home routers ) .


Kaspersky Lab 's research team responded to three financial institutions in Russia that were infected with the GCMAN malware .


In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company .


Recently Subaat drew our attention due to renewed targeted attack activity .


Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec , in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking , which we are calling Gorgon Group .


Starting in February 2018 , Palo Alto Networks identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


Starting in February 2018 , Palo Alto Networks Unit 42 identified a


of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


The GCMAN group has moved beyond banks and is now targeting the budgeting and accounting departments in any organization of interest to them , using the same APT-style tools and techniques .


Starting in February 2018 , Unit 42 identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


APT38 's increasingly aggressive targeting against banks .


APT38 has paralleled North Korea 's worsening financial condition .


On much of the C2 infrastructure we identified several crimeware family samples .


While investigating the domains and infrastructure used by the phishing components of Gorgon Group , Unit 42 researchers witnessed several common operational security flaws with Gorgon Group 's actors throughout their many campaigns .


360 and Tuisec already identified some Gorgon Group members .


RATs such as NjRat and infostealers like Lokibot were leveraging the same C2 infrastructure as that of the targeted attacks .


it 's not known if the attackers physically reside in Pakistan .


While it 's not known if the attackers physically reside in Pakistan , all members of Gorgon Group purport to be in Pakistan based on their online personas .


Starting in mid-February , Unit 42 researchers have been tracking an active campaign sharing a significant portion of infrastructure leveraged by Gorgon Group for criminal and targeted attacks .


Unit 42 researchers have been tracking Gorgon Group for criminal and targeted attacks .


As part of the investigation , Unit 42 researchers were able to identify an interesting characteristic about how the Gorgon Group crew uses shared infrastructure between cybercrime and targeted attacks .


The crew combines both regular crime and targeted attack objectives using the same domain infrastructure over time , rarely changing their TTPs .


One interesting note about the criminal activity of Gorgon Group is their usage of Bitly .


Between April 1 , 2018 and May 30 , 2018 , we observed the domain stevemike-fireforce.info used in a Gorgon Group cybercrime campaign involving more than 2,300 emails and 19 documents in the initial attack .


Similar to that of their targeted attacks , Gorgon Group leveraged Bitly for distribution and shortening of C2 domains .


Beginning in early March 2018 , Unit 42 started observing targeted attacks against Russian , Spanish and United States government agencies operating in Pakistan .


Leveraging click counts for the campaign for Bitly , we were able to see Gorgon Group 's activity volume increase throughout April .


As we continued to investigate , it became apparent that Gorgon Group had been consistently targeting worldwide governmental organizations operating within Pakistan .


Starting in mid-February .


Additionally , during that time , members of Gorgon Group were also performing criminal operations against targets across the globe , often using shared infrastructure with their targeted attack operations .


Unit 42 researchers have been tracking an active campaign .


Beginning in early March 2018 , Unit 42 started observing Gorgon group attacks against Russian , Spanish and United States government agencies operating in Pakistan .


Like all of Gorgon Group 's members , Fudpage 's online profile , infrastructure utilization and standardization , connects them back to Gorgon Group .


Ultimately , this lead us to the conclusion that several of Gorgon Group 's members have a nexus in Pakistan .


Gorgon Group isn't the first actor group we've witnessed dabble in both nation state level and criminal attacks .


Overall , in spite of the lack of sophistication in Gorgon Group 's activity , they were still relatively successful ; once again proving that simple attacks on individuals without proper protections , work .


On January 15 , Advanced Threat Research discovered an operation using a new variant of the SYSCON backdoor .


The Korean-language Word document manual.doc appeared in Vietnam on January 17 , with the original author name of Honeybee .


While Gorgon Group has been making minor changes in their methodologies , they are still actively involved in both targeted and criminal attacks .


This key was also used in the Honeybee campaign and appears to have been used since August 2017 .


Several additional documents surfaced between January 17 and February 3 .


Some of the malicious documents were test files without the implant .


From our analysis , Honeybee submitted most of these documents from South Korea , indicating that some of the targeting was in South Korea .


Honeybee attacked beyond the borders of South Korea to target Vietnam , Singapore , Argentina , Japan , Indonesia , and Canada .


Honeybee appears to target humanitarian aid and inter-Korean affairs .


McAfee Advanced Threat Research team 's analysis , we find multiple components from this operation are unique from a code perspective , even though the code is loosely based on previous versions of the SYSCON backdoor .


Large-scale cyber espionage campaigns such as " GhostNet " .


As the crisis in Syria escalates , FireEye researchers have discovered a cyber espionage campaign , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe .


As the crisis in Syria escalates , FireEye researchers have discovered a threat group , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe .


We believe that the Ke3chang attackers are operating out of China and have been active since at least 2010 .


FireEye gained visibility into one of 23 known command-and-control ( CnC ) servers operated by the Ke3chang actor for about one week .


Each attack comprises a variety of phases , including reconnaissance , exploitation , command and control , lateral movement , and exfiltration .


The Ke3chang attackers have been active since at least 2010 .


traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


The Ke3chang have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , chemicals , manufacturing , mining sectors .


August 2013 , FireEye gained visibility on one of 22 CnC servers used at that time by the Ke3chang attackers .


In this report , we present the historical intelligence we have gathered on the Ke3chang campaign , as well as an in-depth assessment of the ongoing Syrian-themed attacks against these MFAs .


Over the years , the Ke3chang attackers have used three types of malware that we call : " BS2005 " , " BMW " , and " MyWeb " .


it is a typical first stage backdoor commonly found in APT attacks .


The attackers have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


All of the CnC communications are performed over the HTTP protocol .


The current Ke3chang campaign leverages the BS2005 malware , while older activity from 2010 - 2011 leveraged BMW , followed by the MyWeb malware sporadically used in between .


A trait common to all three malware families we analyzed is that they use the IWebBrowser2 COM interface to perform their CnC communication .


Three months after the Olympics-themed attacks , FireEye observed a new BS2005 campaign labeled " newtiger " , which is possibly a reference to an older 2010 campaign labeled " tiger " .


Using information from the FireEye DTI cloud , FireEye observed that Ke3chang targeted a single firm .


The Ke3chang attackers used the older " MyWeb " malware family from 2010 to 2011 .


The Ke3chang attackers used the older MyWeb malware family from 2010 to 2011 .


During our period of visibility into the BS2005 " moviestar " campaign against various ministries of foreign affairs in Europe , FireEye discovered that the Ke3chang had initially tested the malware in virtual machines , prior to compromising actual targets .


The MyWeb sample that FireEye analyzed has a compile date of 1/20/2011 .


At least one of the attacks in this campaign leveraged a European security and defense-themed lure , which aligns with the targeting preferences for this group .


MyWeb is the second-generation malware used by Ke3chang .


ministries of foreign affairs in Europe have been targeted and compromised by a threat actor we call Ke3chang .


This attack used the crisis in Syria as a lure to deliver malware to its targets .


Tracking the malicious activities of the elusive Ke3chang APT group , ESET researchers have discovered new versions of malware families linked to the group , and a previously unreported backdoor .


Furthermore , FireEye has presented evidence indicating that the Ke3chang attackers have been active since at least 2010 and have attacked targets related to G20 meetings in the past .


During our brief window of visibility into one of the known 22 CnC nodes , FireEye observed the Ke3chang conducting reconnaissance and moving laterally throughout the compromised networks .


Ke3chang attackers are operating within China .


In May 2017 , NCC Group 's Incident Response team reacted to an ongoing incident .


which provides a range of services to UK Government .


APT15 was targeting information related to UK government departments and military technology .


backdoors that now appear to be part of APT15 's toolset .


This report demonstrates that Ke3chang is able to successfully penetrate government targets using exploits for vulnerabilities that have already been patched and despite the fact that these ministries have defenses in place .


RoyalDNS - required APT15 .


The Ke3chang group also used keyloggers and their own .NET tool to enumerate folders and dump data from Microsoft Exchange mailboxes .


APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets .


This time , APT15 opted for a DNS based backdoor : RoyalDNS .


APT15 then used a tool known as RemoteExec .


APT15 then used a tool known as RemoteExec ( similar to Microsoft .


Coincidentally , following the recent hack of a US Navy contractor and theft of highly sensitive data on submarine warfare , we have found evidence of very recent activity by a group referred to as APT15 , known for committing cyber espionage which is believed to be affiliated with the Chinese government .


APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more .


Other names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon .


ther names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon .


There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group .


There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group ; although posted in March 2018 , it refers to a campaign in 2017 .


both attributed to Chinese government affiliated groups .


cyber actors of the North Korean to target the media , aerospace , financial , and critical infrastructure sectors in the United States and globally .


Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets , keyloggers , remote access tools ( RATs ) , and wiper malware .


Variants of malware and tools used by HIDDEN COBRA actors include Destover and Hangman .


DHS has previously released Alert TA14-353A .


Our analysis shows that the cybercriminals behind the attack against an online casino in Central America , and several other targets in late-2017 , were most likely the infamous Lazarus hacking group .


The Lazarus Group was first identified in Novetta 's report Operation Blockbuster in February 2016 .


cyberattacks against high-value targets in Ukraine in December 2015 and December 2016 .


In all of these incidents , the Lazarus utilized similar toolsets , including KillDisk that was executed on compromised machines .


We are confident this KillDisk malware was deployed by Lazarus , rather than by another , unrelated attacker .


This recent attack against an online casino in Central America suggests that hacking tools from the Lazarus toolset are recompiled with every attack ( we didn't see these exact samples anywhere else ) .


Utilizing KillDisk in the attack scenario most likely served one of two purposes : the attackers covering their tracks after an espionage operation , or it was used directly for extortion or cyber-sabotage .


Today we'd like to share some of our findings , and add something new to what 's currently common knowledge about Lazarus Group activities , and their connection to the much talked about February 2016 incident , when an unknown attacker attempted to steal up to $851M USD from Bangladesh Central Bank .


Since the Bangladesh incident there have been just a few articles explaining the connection between Lazarus Group and the Bangladesh bank heist .


However , from this it 's only clear that Lazarus might have attacked Polish banks .


Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers .


Considering that the afterhack publications by the media mentioned that the investigation stumbled upon three different attackers , it was not obvious whether Lazarus was the one responsible for the fraudulent SWIFT transactions , or if Lazarus had in fact developed its own malware to attack banks ' systems .


We would like to add some strong facts that link some attacks on banks to Lazarus , and share some of our own findings as well as shed some light on the recent TTPs used by the attacker , including some yet unpublished details from the attack in Europe in 2017 .


Lazarus attacks are not a local problem and clearly the group 's operations span across the whole world .


Lazarus was previously known to conduct cyberespionage and cybersabotage activities , such as attacks on Sony Pictures Entertainment with volumes of internal data leaked , and many system harddrives in the company wiped .


We believe that Lazarus Group is very large and works mainly on infiltration and espionage operations , while a substantially smaller units within the group , which we have dubbed Bluenoroff , is responsible for financial profit .


Lazarus regrouped and rushed into new countries , selecting mostly poorer and less developed locations , hitting smaller banks because they are , apparently , easy prey .


To date , the Lazarus group has been one of the most successful in launching large scale operations against the financial industry .


We believe that Lazarus will remain one of the biggest threats to the banking sector , finance , and trading companies , as well as casinos for the next few years .


We believe Lazarus started this watering hole attack at the end of 2016 after their other operation was interrupted in South East Asia .


We believe they started this watering hole campaign at the end of 2016 after their other operation was interrupted in South East Asia .


A rudimentary but somewhat clever design , KiloAlfa provides keylogging capability for the Lazarus Group 's collection of malicious tools .


The design of KiloAlfa is broken down into two basic components : the persistence functionality and the keylogging functionality .


The persistence functionality of KiloAlfa allows the malware to self-install on a victim 's machine when activated ( described below ) .


Evidence suggest that the Lazarus Group uses compromised infrastructure as the public-facing touchpoint for the majority of their malware samples .


PapaAlfa is believed to be one of the proxy malware components that the Lazarus Group uses to hide the true command and control server ( s ) for operations .


Rather , PapaAlfa could be considered a smart proxy due in part to the fact that the Lazarus can easily switch the backend destination address and port without having to reestablish control over the infected machine hosting the PapaAlfa malware .


In terms of form factor , PapaAlfa comes in two flavors : service DLL and standalone executable .


The IndiaBravo-PapaAlfa installer is responsible for installing the service DLL variant .


While the tools profiled in this report are not inherently malicious , their capabilities are nonetheless integral to the Lazarus Group 's cyber operations , both espionage and destructive in nature , making them inherently dangerous to potential victims .


These tools often lay the groundwork for further malicious activity , such as the targeting of antivirus capabilities and the disabling of firewalls , both of which are very fundamental defensive measures .


Furthermore , like many other identified Lazarus Group families , these tools showcase the group 's creative solutions , such as the PapaAlfa , which makes it difficult to immediately identify potentially malicious activity on a compromised network .


The first class , colloquially known as " wipers " , are a class of malware has the primary intent of destroying data on a victim 's machine .


DDoS malware floods a target 's network-connected service with an excessive number of request at once in order to overload the capacity of the server .


For example , DeltaAlfa specifies a DDoS bot family identified as Alfa .


The naming scheme used by Novetta for the malware identified during Operation Blockbuster consists of at least two identifiers which each identifier coming from the International Civil Aviation Organization ( ICAO ) 's phonetic alphabet ,2 commonly referred to as the NATO phonetic alphabet .


Loaders are typically responsible for loading a DLL component into memory given that a DLL cannot operate in a standalone mode such as an executable .


This report will explore the various installers , uninstallers and loaders Novetta has observed the Lazarus Group using .


This reverse engineering report looks at the RATs and staging malware found within the Lazarus Group 's collection .


Regardless of their sophistication or refinement , the malware families within the Lazarus Group 's India and Lima classes perform at a reasonable level for their designed purpose : the introduction and persistence of malware from the Lazarus Group on a victim 's infrastructure .


While the capabilities for the installers , loaders , and uninstallers in this report are relatively straight forward and single-focused , analysis of these malware families provide further insight into the capabilities of the Lazarus Group .


The Lazarus Group employs a variety of RATs that operate in both client mode and server mode .


The most common communication mode for a RAT is to act as a client to a remote server .


The Lazarus Group employs a variety of RATs and staging malware to conduct cyber operations , many of which contain significant code overlap that points to at least a shared development environment .


While some members within the Romeo and Sierra groups may not implement sound authentication strategies , shift their design focus in abrupt and unusual manners , and fail to understand the pitfalls of distributed command networks , on the whole the families within the Lazarus Group 's collection of RATs and staging malware perform their tasks with surprising effectiveness .


McAfee Advanced Threat Research analysts have discovered an aggressive Bitcoin-stealing phishing campaign by the international cybercrime group Lazarus that uses sophisticated malware with long-term impact .


McAfee Advanced Threat Research ( ATR ) analysts have discovered an aggressive Bitcoin-stealing phishing campaign by the international cybercrime group Lazarus that uses sophisticated malware with long-term impact .


The use of decoy documents also reveals some of the potential targets of the Lazarus group 's malicious activity , specifically the use spear phishing attacks observed targeting South Korean government and aerospace organizations .


The campaign lasted from April to October and used job descriptions relevant to target organizations , in both English and Korean language .


The Lazarus Group 's objective was to gain access to the target 's environment and obtain key military program insight or steal money .


In this latest discovery by McAfee , despite a short pause in similar operations , the Lazarus group targets financial organizations .


This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans .


This Malware Analysis Report ( MAR ) is the result of analytic efforts between the Department of Homeland Security ( DHS ) and the Federal Bureau of Investigation ( FBI ) .


When victims open malicious documents attached to the emails , the malware scans for Bitcoin activity and then establishes an implant for long-term data-gathering .


According to trusted third-party reporting , HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace , telecommunications , and finance industries .


The malware is a fully functional RAT with multiple commands that the actors can issue from a command and control ( C2 ) server to a victim 's system via dual proxies .


FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware or as a file downloaded unknowingly by users when visiting sites compromised by HIDDEN COBRA actors .