Their infrastructure also relies on the use of dynamic DNS services pointing to commercial hosting and self-hosted servers .


They also sell credentials from the affected systems , allowing other cybercriminals to have remote access to hotel front desks infected by the campaign .


We monitored the activities of these groups and the new malware they are creating for over a year .


With a high degree of confidence , we can confirm that at least two distinct groups are focused on attacking this sector ; there is also a third group , though it is unclear if its focus is solely on this sector or if carries out other types of attacks .


One of the tactics used in operations by these groups is highly targeted spear-phishing messages .


They register typo-squatting domains , impersonating legitimate companies .


The emails are well written , with an abundance of detail .


They explain why the company has chosen to book that particular hotel .


By checking the sender information , it ’s possible to determine whether the company actually exists .


However , there is a small difference between the domain used to send the email and the real one .


This spear-phishing message , written in Portuguese , has a malicious file attached misusing the name of a real attorney office , while the domain sender of the message was registered one day before , using a typo-squatting domain .


The group goes further in its social engineering effort : to convince the hotel personnel about the legitimacy of their request , a copy of the National Registry of Legal Entities card ( CNPJ ) is attached to the quotation .


The attached file , Reserva Advogados Associados.docx ( Attorneys Associates Reservation.docx ) , is a malicious Word file that drops a remote OLE object via template injection to execute macro code .


The macro code inside the remote OLE document contains PowerShell commands that download and execute the final payload .


In the RevengeHotels campaign , the downloaded files are .NET binaries protected with the Yoda Obfuscator .


After unpacking them , the code is recognizable as the commercial RAT RevengeRAT .


An additional module written by the group called ScreenBooking is used to capture credit card data .


It monitors whether the user is browsing the web page .


In the initial versions , back in 2016 , the downloaded files from RevengeHotels campaigns were divided into two modules : a backdoor and a module to capture screenshots .


Recently we noticed that these modules had been merged into a single backdoor module able to collect data from clipboard and capture screenshots .


In this example , the webpage that the attacker is monitoring is booking.com ( more specifically , the page containing the card details ) .


The code is specifically looking for data in Portuguese and English , allowing the attackers to steal credit card data from web pages written in these languages .


In the ProCC campaigns , the downloaded files are Delphi binaries .


The backdoor installed in the machine is more customized than that used by RevengeHotels : it ’s developed from scratch and is able to collect data from the clipboard and printer spooler , and capture screenshots .


Because the personnel in charge of confirming reservations usually need to pull credit card data from OTA websites , it ’s possible to collect card numbers by monitoring the clipboard and the documents sent to the printer .


According to the relevant underground forums and messaging groups , these criminals also infect front desk machines in order to capture credentials from the hotel administration software ; they can then steal credit card details from it too .


Some criminals also sell remote access to these systems , acting as a concierge for other cybercriminals by giving them permanent access to steal new data by themselves .


Some Brazilian criminals tout credit card data extracted from a hotel ’s system as high quality and reliable because it was extracted from a trusted source , i.e. , a hotel administration system .


The majority of the victims are associated with the hospitality sector .


Based on the routines used , we estimate that this attack has a global reach .


Based on data extracted from Bit.ly statistics , we can see that potential victims from many other countries have at least accessed the malicious link .


This data suggests that the number of countries with potential victims is higher than our telemetry has registered .


RevengeHotels is a campaign that has been active since at least 2015 , revealing different groups using traditional RAT malware to infect businesses in the hospitality sector .


While there is a marked interest in Brazilian victims , our telemetry shows that their reach has extended to other countries in Latin America and beyond .


The use of spear-phishing emails , malicious documents and RAT malware is yielding significant results for at least two groups we have identified in this campaign .


Other threat actors may also be part of this wave of attacks , though there is no confirmation at the current time .


If you want to be a savvy and safe traveler , it ’s highly recommended to use a virtual payment card for reservations made via OTAs , as these cards normally expire after one charge .


While paying for your reservation or checking out at a hotel , it ’s a good idea to use a virtual wallet such as Apple Pay , Google Pay , etc .


RevengeHotels : 74440d5d0e6ae9b9a03d06dd61718f66 .


RevengeHotels : e675bdf6557350a02f15c14f386fcc47 .


RevengeHotels : df632e25c32e8f8ad75ed3c50dd1cd47 .


RevengeHotels : a089efd7dd9180f9b726594bb6cf81ae .


RevengeHotels : 81701c891a1766c51c74bcfaf285854b .


APT1 .


Since 2004 , Mandiant has investigated computer security breaches at hundreds of organizations around the world.The majority of these security breaches are attributed to advanced threat actors referred to as the “ Advanced Persistent Threat ” ( APT ) .


We first published details about the APT in our January 2010 M-Trends report .


As we stated in there port , our position was that “ The Chinese government may authorize this activity , but there ’s no way to determine the extent of its involvement. ” Now , three years later , we have the evidence required to change our assessment .


The details we have analyzed during hundreds of investigations convince us that the groups conducting these activities are based primarily in China and that the Chinese Government is aware of them .


Mandiant continues to track dozens of APT groups around the world ; however , this report is focused on the most prolific of these groups .


We refer to this group as “ APT1 ” and it is one of more than 20 APT groups with origins inChina .


APT1 is a single organization of operators that has conducted a cyber espionage campaign against a broad range of victims since at least 2006 .


From our observations , it is one of the most prolific cyber espionage groups in terms of the sheer quantity of information stolen .


The scale and impact of APT1 ’s operations compelled us to write this report .


The activity we have directly observed likely represents only a small fraction of the cyber espionage that APT1 has conducted .


Though our visibility of APT1 ’s activities is incomplete , we have analyzed the group ’s intrusions against nearly 150 victims over seven years .


From our unique vantage point responding to victims , we tracked APT1 back to four large networks in Shanghai , two of which are allocated directly to the Pudong New Area .


We uncovered a substantial amount of APT1 ’s attack infrastructure , command and control , and modus operandi ( tools , tactics , and procedures ) .


In an effort to underscore there are actual individuals behind the keyboard , Mandiant is revealing three personas we have attributed to APT1 .


These operators , like soldiers , may merely be following orders given to them by others .


We believe that APT1 is able to wage such a long-running and extensive cyber espionage campaign in large part because it receives direct government support .


In seeking to identify the organization behind this activity ,our research found that People ’s Liberation Army ( PLA ’s ) Unit 61398 is similar to APT1 in its mission , capabilities , and resources .


PLA Unit 61398 is also located in precisely the same area from which APT1 activity appears to originate .


APT1 is believed to be the 2nd Bureau of the People ’s Liberation Army ( PLA ) General Staff Department ’s ( GSD ) 3rd Department , which is most commonly known by its Military Unit Cover Designator ( MUCD ) as Unit 61398 .


The nature of “ Unit 61398 ’s ” work is considered by China to be a state secret ; however , we believe it engages in harmful “ Computer Network Operations. ” Unit 61398 is partially situated on Datong Road in Gaoqiaozhen , which is located in the Pudong New Area of Shanghai .


The central building in this compound is a 130,663 square foot facility that is 12 stories high and was built in early 2007 .


APT1 has systematically stolen hundreds of terabytes of data from at least 141 organizations , and has demonstrated the capability and intent to steal from dozens of organizations simultaneously .


Since 2006 , Mandiant has observed APT1 compromise 141 companies spanning 20 major industries .


APT1 has a well-defined attack methodology , honed over years and designed to steal large volumes of valuable intellectual property .


Once APT1 has established access , they periodically revisit the victim ’s network over several months or years and steal broad categories of intellectual property , including technology blueprints , proprietary manufacturing processes , test results , business plans , pricing documents , partnership agreements , and emails and contact lists from victim organizations ’ leadership .


APT1 uses some tools and techniques that we have not yet observed being used by other groups including two utilities designed to steal email — GETMAIL and MAPIGET .


Establishing a foothold involves actions that ensure control of the target network ’s systems from outside the network .


APT1 establishes a foothold once email recipients open a malicious file and a backdoor is subsequently installed .


A backdoor is software that allows an intruder to send commands to the system remotely .


In almost every case , APT backdoors initiate outbound connections to the intruder ’s “ command and control ” ( C2 ) server .


APT intruders employ this tactic because while network firewalls are generally adept at keeping malware outside the network from initiating communication with systems inside the network , they are less reliable at keeping malware that is already inside the network from communicating to systems outside .


We will describe APT1 ’s backdoors in two categories : “ Beachhead Backdoors ” and “ Standard Backdoors. ”


Beachhead backdoors are typically minimally featured .


They offer the attacker a toe-hold to perform simple tasks like retrieve files , gather basic system information and trigger the execution of other more significant capabilities such as a standard backdoor .


APT1 ’s beachhead backdoors are usually what we call WEBC2 backdoors .


WEBC2 backdoors are probably the most well-known kind of APT1 backdoor , and are the reason why some security companies refer to APT1 as the “ Comment Crew. ” A WEBC2 backdoor is designed to retrieve a webpage from a C2 server .


It expects the webpage to contain special HTML tags ; the backdoor will attempt to interpret the data between the tags as commands .


Older versions of WEBC2 read data between HTML comments , though over time WEBC2 variants have evolved to read data contained within other types of tags .


From direct observation , we can confirm that APT1 was using WEBC2 backdoors as early as July 2006 .


However , the first compile time35 we have for WEBC2 is 2004-01-23 , suggesting that APT1 has been crafting WEBC2 backdoors since early 2004 .


Based on the 400+ samples of WEBC2 variants that we have accumulated , it appears that APT1 has direct access to developers who have continually released new WEBC2 variants for over six years .


WEBC2 backdoors are often packaged with spear phishing emails .


Once installed , APT1 intruders have the option to tell victim systems to download and execute additional malicious software of their choice .


WEBC2 backdoors work for their intended purpose , but they generally have fewer features than the “ Standard Backdoors ” described below .


The standard , non-WEBC2 APT1 backdoor typically communicates using the HTTP protocol ( to blend in with legitimate web traffic ) or a custom protocol that the malware authors designed themselves .


These backdoors give APT intruders a laundry list of ways to control victim systems .


The BISCUIT backdoor ( so named for the command “ bdkzt ” ) is an illustrative example of the range of commands that APT1 has built into its “ standard ” backdoors .


Some APT backdoors attempt to mimic legitimate Internet traffic other than the HTTP protocol .


When network defenders see the communications between these backdoors and their C2 servers , they might easily dismiss them as legitimate network traffic .


APT1 .


APT1 maintains an extensive infrastructure of computers around the world .


We have evidence suggesting that APT1 manually controls thousands of systems in support of their attacks , and have directly observed their control over hundreds of these systems .


Although they control systems in dozens of countries , their attacks originate from four large networks in Shanghai — two of which are allocated directly to the Pudong New Area , the home of Unit 61398 .


The sheer number of APT1 IP addresses concentrated in these Shanghai ranges , coupled with Simplified Chinese keyboard layout settings on APT1 ’s attack systems , betrays the true location and language of the operators .


To help manage the vast number of systems they control , APT1 has registered hundreds of domain names , the majority of which also point to a Shanghai locale .


The domain names and IP addresses together comprise APT1 ’s command and control framework which they manage in concert to camouflage their true origin from their English speaking targets .


As covered in the previous “ Attack Lifecycle ” section , WEBC2 backdoor variants download and interpret data stored between tags in HTML pages as commands .


They usually download HTML pages from a system within APT1 ’s hop infrastructure .


We have observed APT1 intruders logging in to WEBC2 servers and manually editing the HTML pages that backdoors will download .


Because the commands are usually encoded and difficult to spell from memory , APT1 intruders typically do not type these strings , but instead copy and paste them into the HTML files .


They likely generate the encoded commands on their own systems before pasting them in to an HTML file hosted by the hop point .


For example , we observed an APT attacker pasting the string “ czo1NA== ” into an HTML page .


That string is the base64 encoded version of “ s : 54 ” , meaning “ sleep for 54 minutes ” ( or hours , depending on the particular backdoor ) .


In lieu of manually editing an HTML file on a hop point , we have also observed APT1 intruders uploading new ( already-edited ) HTML files .


When APT1 attackers are not using WEBC2 , they require a “ command and control ” ( C2 ) user interface so they can issue commands to the backdoor .


This interface sometimes runs on their personal attack system , which is typically in Shanghai .


In these instances , when a victim backdoor makes contact with a hop , the communications need to be forwarded from the hop to the intruder ’s Shanghai system so the backdoor can talk to the C2 server software .


We have observed 767 separate instances in which APT1 intruders used the publicly available “ HUC Packet Transmit Tool ” or HTRAN on a hop .


As always , keep in mind that these uses are confirmed uses , and likely represent only a small fraction of APT1 ’s total activity .


The HTRAN utility is merely a middle-man , facilitating connections between the victim and the attacker who is using the hop point .


Typical use of HTRAN is fairly simple : the attacker must specify the originating IP address ( of his or her workstation in Shanghai ) , and a port on which to accept connections .


For example , the following command , which was issued by an APT1 actor , will listen for incoming connections on port 443 on the hop and automatically proxy them to the Shanghai IP address 58.247.242.254 on port 443 .


Occasionally , APT1 attackers have installed C2 server components on systems in their hop infrastructure rather than forwarding connections back to C2 servers in Shanghai .


In these instances they do not need to use a proxy tool like HTRAN to interact with victim systems .


However , it does mean that the intruders need to be able to interface with the ( often graphical ) C2 server software running on the hop .


We have observed APT1 intruders log in to their hop point , start the C2 server , wait for incoming connections , and then proceed to give commands to victim systems .


WEBC2 variants may include a server component that provides a simple C2 interface to the intruder .


This saves the intruder from having to manually edit webpages .


That is , this server component receives connections from victim backdoors , displays them to the intruder , and then translates the intruder ’s commands into HTML tags that the victim backdoors read .


In the last two years alone , we have confirmed 937 APT1 C2 servers — that is , actively listening or communicating programs — running on 849 distinct IP addresses .


However , we have evidence to suggest that APT1 is running hundreds , and likely thousands , of other servers ( see the Domains section below ) .


The programs acting as APT1 servers have mainly been : FTP , for transferring files ; web , primarily for WEBC2 ; RDP , for remote graphical control of a system ; HTRAN , for proxying ; and C2 servers associated with various backdoor families .


The Domain Name System ( DNS ) is the phone book of the Internet .


In the same way that people program named contacts into their cell phones and no longer need to remember phone numbers , DNS allows people to remember names like “ google.com ” instead of IP addresses .


When a person types “ google.com ” into a web browser , a DNS translation to an IP address occurs so that the person ’s computer can communicate with Google .


Names that can be translated through DNS to IP addresses are referred to as Fully Qualified Domain Names ( FQDNs ) .


A DNS zone represents a collection of FQDNs that end with the same name , and which are usually registered through a domain registration company and controlled by a single owner .


For example , “ hugesoft.org ” is an FQDN but also represents a zone .


The FQDNs “ ug-co.hugesoft.org ” and “ 7cback.hugesoft.org ” are part of the “ hugesoft.org ” zone and are called “ subdomains ” of the zone .


The person who registered “ hugesoft.org ” may add as many subdomains as they wish and controls the IP resolutions of these FQDNs .


APT1 has registered at least 107 zones since 2004 .


Within these zones , we know of thousands of FQDNs that have resolved to hundreds of IP addresses ( which we suspect are hops ) and in some instances to APT1 ’s source IP addresses in Shanghai .


The first zone we became aware of was “ hugesoft.org ” , which was registered through eNom , Inc. in October 2004 .


The registrant supplied “ uglygorilla@163.com ” as an email address .


The supplied registration information , which is still visible in public “ whois ” data as of February 3, 2013 .


The supplied registrant information does not need to be accurate for the zone to be registered successfully .


For example , “ shanghai ” is not a street name .


Nevertheless , it is noteworthy that Shanghai appeared in the first known APT1 domain registration , along with a phone number that begins with China ’s “ +86 ” international code .


In fact , Shanghai was listed as the registrant ’s city in at least 24 of the 107 ( 22% ) registrations .


Overall , the combination of a relatively high number of “ Shanghai ” registrations with obviously false registration examples in other registrations suggests a partially uncoordinated domain registration campaign from 2004 until present , in which some registrants tried to fabricate non-Shanghai locations but others did not .


This is supported by contextual information on the Internet for the email address “ lfengg@163.com , ” which was supplied in the registration information for seven of the 107 zones .


On the site “ www.china-one.org , ” the email address “ lfengg@163.com ” appears as the contact for the Shanghai Kai Optical Information Technology Co. , Ltd. , a website production company located in a part of Shanghai that is across the river from PLA Unit 61398 .


About half of APT1 ’s known zones were named according to three themes : news , technology and business .


These themes cause APT1 command and control addresses to appear benign at first glance .


However , we believe that the hundreds of FQDNs within these zones were created for the purpose of APT1 intrusions . ( Note : these themes are not unique to APT1 or even APT in general . ) The news-themed zones include the names of well-known news media outlets such as CNN , Yahoo and Reuters .


However , they also include names referencing English-speaking countries , such as “ aunewsonline.com ” ( Australia ) , “ canadatvsite.com ” ( Canada ) , and “ todayusa.org ” ( U.S . ) .


Below is a list of zones registered by APT1 that are newsthemed :


aoldaily.com aunewsonline.com canadatvsite.com canoedaily.com cnndaily.com cnndaily.net cnnnewsdaily.com defenceonline.net freshreaders.net giftnews.org reutersnewsonline.com rssadvanced.org saltlakenews.org sportreadok.net todayusa.org usapappers.com usnewssite.com yahoodaily.com .


The technology-themed zones reference well-known technology companies ( AOL , Apple , Google , Microsoft ) , antivirus vendors ( McAfee , Symantec ) , and products ( Blackberry , Bluecoat ) .


APT1 also used more generic names referencing topics like software :


globalowa.com gmailboxes.com hugesoft.org idirectech.com ifexcel.com infosupports.com livemymsn.com mcafeepaying.com microsoft-update-info.com micyuisyahooapis.com msnhome.org pcclubddk.net progammerli.com softsolutionbox.net symanteconline.net webservicesupdate.com .


Finally , some zones used by APT1 reflect a business theme .


The names suggest websites that professionals might visit :


advanbusiness.com businessconsults.net businessformars.com companyinfosite.com conferencesinfo.com copporationnews.com .


APT1 intruders often use the FQDNs that are associated with legitimate websites hosted by their hop points .


We consider these domains to be “ hijacked ” because they were registered by someone for a legitimate reason , but have been leveraged by APT1 for malicious purposes .


APT1 uses hijacked FQDNs for two main purposes .


First , they place malware ( usually in ZIP files ) on the legitimate websites hosted on the hop point and then send spear phishing emails with a link that includes the legitimate FQDN .


APT12 .


This research paper will delve into another prominent group of attackers referred to as “ IXESHE ” ( pronounced “ i-sushi ” ) , based on one of the more common detection names security companies use for the malware they utilize .


This campaign is notable for targeting East Asian governments , electronics manufacturers , and a telecommunications company .


The IXESHE campaign makes use of targeted emails with malicious attachments to compromise victims ’ systems .


The emails are often tailored for specific victims and contain malicious attachments that are almost always “ weaponized ” .PDF files with known exploits that drop malware executables onto targeted systems .


In addition , the IXESHE attackers conducted two specific attacks that leveraged zero-day exploits—one in 2009 and another in 2011 .


The IXESHE attackers almost always make use of compromised servers as command-and-control ( C&C ) servers .


In some cases , the compromised servers are hosted on target organizations ’ networks after successful infiltration so the attackers can increase their control of the victims ’ infrastructure .


Using this approach , the attackers amassed at least 60 C&C servers over time .


This technique also allows the attackers to cover their tracks , as having the C&C server in the victims ’ corporate networks means very little C&C traffic leaves them .


The attackers ’ deliberate use of compromised machines and dynamic Domain Name System ( DNS ) services allows them to hide traces of their presence by confusing their activities with data belonging to legitimate individuals .


Looking at threat intelligence derived from tracking APT campaigns over time primarily based on the network traffic generated by the malware used , we were able to develop indicators of compromise for the IXESHE campaign .


The malware samples used in this campaign were not very complicated by nature but do give the attackers almost complete control over their targets ’ compromised systems .


Most of the IP addresses of IXESHE ’s victims are linked to DSL networks , which made it difficult to determine their identities .


Careful research , however , allowed the identification of some of the attackers ’ victims : East Asian governments , Taiwanese electronics manufacturers , A telecommunications company .


Campaign victims were identified by using Whois records and open source research .


Trend Micro generally notifies customers that are believed to have been specifically targeted by APT campaigns .


The IXESHE attackers have been actively launching highly targeted attacks since at least July 2009 .


Available data on the IXESHE campaign indicates that targeted emails with malicious .PDF file attachments were the attackers ’ vector of choice .


In most cases , the attacks involved Adobe Acrobat , Reader , and Flash Player exploits such as : CVE-2009-4324 , CVE-2009-0927 , CVE-2011-0609 , CVE-2011-0611 .


It should also be noted that this campaign used CVE-2009-4324 and CVE-2011-0609 exploits when these were still unpatched or considered zero-day vulnerabilities .


The IXESHE attackers also used an exploit that affected Microsoft Excel — CVE-2009-3129 .


Every IXESHE case we examined revealed that the original infection vector was a targeted email with a PDF exploit as attachment .


Older versions also used an XLS exploit .


Opening the .PDF file drops and executes a malware in a victim ’s system .


The malware displays a blank .PDF file or a decoy document related to the targeted attack .


The emails normally come from compromised personal accounts or are entirely spoofed .


emails from spoofed senders were usually sent via mail servers in the United States and China .


The malware also sets the executable file ’s attributes to “ Hidden. ” Some of the file names the attackers used include : winhlps.exe , acrotry.exe , AcroRd32.exe , Updater.exe .


In order for the malware to survive rebooting , it normally creates the following registry run key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run .


The registry run key , in turn , points to the malware that has been dropped .


The value name of this entry varies from sample to sample .


Some of the names the attackers used for it include : Adobe Assistant , Migrated .


Upon installation , the malware starts communicating with one of its C&C servers .


Most of the samples appeared to have at least three C&C servers hard coded for redundancy .


Some samples alternatively use an FGKD.jsp or an FPK.jsp file .


The Base64 blob is of particular interest .


It makes use of a custom Base64 alphabet .


Once decoded , this blob reveals a standardized structure of the information sent to the registered C&C server , which includes the following details : Computer name , Local IP address , Proxy server IP and port , Malware ID .


To date , we have seen several custom Base64 alphabets , including : +NO5RZaGHviIjhYq8b4ndQ=p012ySTcCDrs/xPgUz67FM3wemKfkJLBo9VtWXlEuA , HZa4vjIiGndQ=p012y+NO5RST/xPgUz67FMhYq8b3wemKfkJLBocCDrs9VtWXlEu , j4vpGZaHnIdQ=i012y+N/zPgUO5RSTx67FMhYb8q3we mKckJLBofCDrs9VtWXlEu , p12kJLBofCDrs9VtWXlEuainyj4vd+=H0GZIQNO5RST/ zPgUx67FMhYb8q3wemKc , aZHGviIj4ndQ=p012y+NO5RST/xPgUz67FMhYq8b3wemKfkJLBocCDrs9VtWXlEu , ZvQIajHi4ndG=p012y+NO5RST/xPgUz67FMhYq8b3wemKfkJLBocCDrs9VtWXlEu .


Some similarities exist across different versions of the Base64 alphabet , which indicates that these are most likely not completely randomly generated .


Instead , the attackers manually cut and pasted older versions after altering some parts .


The malware ID seems to be a campaign code with a different IP address for each attack .


Some of the campaign codes we have seen include : CRML_0505 , CRML_MIL , Firebox4 , JUST_0525 , ML0628 , MW0629 , OM222 .


The IXESHE campaign has been successfully executing targeted attacks since 2009 .


The attackers primarily use malicious .PDF files that exploit vulnerabilities in Adobe Reader , Acrobat , and Flash Player , including the use of two zero-day exploits—one in 2009 and another in 2011 .


While the attackers primarily targeted East Asian governments in the past , they have also started targeting a telecommunications company and electronics manufacturers .


They kept track of their targeted attacks by embedding a “ campaign tag ” in the malware that appears to describe when each attack was launched and , in some cases , the nature of its target .


We found more than 40 of these campaign tags .


The IXESHE attackers are notable for their use of compromised machines within a target ’s internal network as C&C servers .


This helped disguise their activities .


In addition , the attackers ’ use of the proxy tool , HTran , also helped mask their true location .


While their identities remain unknown , the attackers behind the IXESHE campaign demonstrated that they were both determined and capable .


While the malware used in the attacks were not very complicated by nature , these proved very effective .


APT12 .


The attackers referred to as APT12 ( also known as IXESHE , DynCalc , and DNSCALC ) recently started a new campaign targeting organizations in Japan and Taiwan .


APT12 is believed to be a cyber espionage group thought to have links to the Chinese People's Liberation Army .


APT12 's targets are consistent with larger People's Republic of China ( PRC ) goals .


Intrusions and campaigns conducted by this group are in-line with PRC goals and self-interest in Taiwan .


Additionally , the new campaigns we uncovered further highlight the correlation between APT groups ceasing and retooling operations after media exposure , as APT12 used the same strategy after compromising the New York Times in Oct 2012 .


Much like Darwin ’s theory of biological evolution , APT12 been forced to evolve and adapt in order to maintain its mission .


FireEye researchers discovered two possibly related campaigns utilizing two other backdoors known as THREEBYTE and WATERSPOUT .


Both backdoors were dropped from malicious documents built utilizing the “ Tran Duy Linh ” exploit kit , which exploited CVE-2012-0158 .


These documents were also emailed to organizations in Japan and Taiwan .


While APT12 has previously used THREEBYTE , it is unclear if APT12 was responsible for the recently discovered campaign utilizing THREEBYTE .


Similarly , WATERSPOUT is a newly discovered backdoor and the threat actors behind the campaign have not been positively identified .


However , the WATERSPOUT campaign shared several traits with the RIPTIDE and HIGHTIDE campaign that we have attributed to APT12 .


From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE , a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control ( C2 ) server .


RIPTIDE ’s first communication with its C2 server fetches an encryption key , and the RC4 encryption key is used to encrypt all further communication .


In June 2014, Arbor Networks published an article describing the RIPTIDE backdoor and its C2 infrastructure in great depth .


The blog highlighted that the backdoor was utilized in campaigns from March 2011 till May 2014 .


Following the release of the article , FireEye observed a distinct change in RIPTIDE ’s protocols and strings .


We suspect this change was a direct result of the Arbor blog post in order to decrease detection of RIPTIDE by security vendors .


The changes to RIPTIDE were significant enough to circumvent existing RIPTIDE detection rules .


FireEye dubbed this new malware family HIGHTIDE .


On Sunday August 24, 2014 we observed a spear phish email sent to a Taiwanese government ministry .


Attached to this email was a malicious Microsoft Word document ( MD5: f6fafb7c30b1114befc93f39d0698560 ) that exploited CVE-2012-0158 .


It is worth noting that this email appeared to have been sent from another Taiwanese Government employee , implying that the email was sent from a valid but compromised account .


HIGHTIDE : 6e59861931fa2796ee107dc27bfdd480 .


The HIGHTIDE backdoor connected directly to 141.108.2.157 .


If you compare the HTTP GET request from the RIPTIDE samples to the HTTP GET request from the HIGHTIDE samples you can see the malware author changed the following items : User Agent , Format and structure of the HTTP Uniform Resource Identifier ( URI ) .


FireEye observed APT12 deliver these exploit documents via phishing emails in multiple cases .


Based on past APT12 activity , we expect the threat group to continue to utilize phishing as a malware delivery method . 0824.1.doc : f6fafb7c30b1114befc93f39d0698560 , CVE-2012-0158 .


Jason_invitation.doc : 00a95fb30be2d6271c491545f6c6a707 , CVE-2012-0158 .


When the file is opened , it drops HIGHTIDE in the form of an executable file onto the infected system .


RIPTIDE and HIGHTIDE differ on several points : executable file location , image base address , the User-Agent within the GET requests , and the format of the URI .


The RIPTIDE exploit document drops its executable file into the C:\Documents and Settings\{user}\Application Data\Location folder while the HIGHTIDE exploit document drops its executable file into the C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\ folder .


All but one sample that we identified were written to this folder as word.exe .


The one outlier was written as winword.exe .


Research into this HIGHTIDE campaign revealed APT12 targeted multiple Taiwanese Government organizations between August 22 and 28 .


On Monday August 25, 2014 we observed a different spear phish email sent from lilywang823@gmail.com to a technology company located in Taiwan .


This spear phish contained a malicious Word document that exploited CVE-2012-0158 .


The MD5 of the exploit document was e009b95ff7b69cbbebc538b2c5728b11 .


Similar to the newly discovered HIGHTIDE samples documented above , this malicious document dropped a backdoor to C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe .


THREEBYTE : 16e627dbe730488b1c3d448bfc9096e2 .


This backdoor sent the following callback traffic to video.csmcpr.com .


The THREEBYTE spear phishing incident ( while not yet attributed ) shared the following characteristics with the above HIGHTIDE campaign attributed to APT12 : The THREEBYTE backdoor was compiled two days after the HIGHTIDE backdoors ;


Both the THREEBYTE and HIGHTIDE backdoors were used in attacks targeting organizations in Taiwan ;


Both the THREEBYTE and HIGHTIDE backdoors were written to the same filepath of C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe ;


APT12 has previously used the THREEBYTE backdoor .


On August 25, 2014, we observed another round of spear phishing emails targeting a high-technology company in Japan .


Attached to this email was another malicious document that was designed to exploit CVE-2012-0158 .


This malicious Word document had an MD5 of 499bec15ac83f2c8998f03917b63652e and dropped a backdoor to C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe .


The backdoor had the following properties :


WATERSPOUT :


f9cfda6062a8ac9e332186a7ec0e706a .


The backdoor connects to a command and control server at icc.ignorelist.com .


Similar to RIPTIDE and HIGHTIDE , the WATERSPOUT backdoor is an HTTP based backdoor that communicates with its C2 server .


Although there are no current infrastructure ties to link this backdoor to APT12 , there are several data points that show a possible tie to the same actors :


Same initial delivery method ( spear phishing email ) with a Microsoft Word Document exploiting CVE-2012-0158 .


The same “ Tran Duy Linh ” Microsoft Word Exploit Kit was used in delivery of this backdoor .


Similar Targets were observed where the threat actors utilized this backdoor : Japanese Tech Company , Taiwanese Government Organizations , Organizations in the Asia-Pacific Region that are of Interest to China .


The WATERSPOUT backdoor was written to the same file path as the HIGHTIDE backdoors : C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe , C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\winword.exe .


WATERSPOUT was compiled within two days of the last HIGHTIDE backdoor and on the same day as the THREEBYTE backdoor .


APT12 closely monitors online media related to its tools and operations and reacts when its tools are publicly disclosed .


APT12 has the ability to adapt quickly to public exposures with new tools , tactics , and procedures ( TTPs ) .


Public disclosures may result in an immediate change in APT12 ’s tools .


These changes may be temporary and FireEye believes they are aimed at decreasing detection of their tools until a more permanent and effective TTP change can be implemented ( e.g. , WATERSPOUT ) .


Although these points do not definitively tie WATERSPOUT to APT12 , they do indicate a possible connection between the WATERSPOUT campaign , the THREEBYTE campaign , and the HIGHTIDE campaign attributed to APT12 .


These development efforts may have resulted in the emergence of the WATERSPOUT backdoor .


Though public disclosures resulted in APT12 adaptations , FireEye observed only a brief pause in APT12 activity before the threat actors returned to normal activity levels .


Similarly , the public disclosure of APT12 ’s intrusion at the New York Times also led to only a brief pause in the threat group ’s activity and immediate changes in TTPs .


The pause and retooling by APT12 was covered in the Mandiant 2014 M-Trends report .


Currently , APT12 continues to target organizations and conduct cyber operations using its new tools .


Most recently , FireEye observed HIGHTIDE at multiple Taiwan-based organizations and the suspected APT12 WATERSPOUT backdoor at a Japan-based electronics company .


APT12 .


The attackers behind the breach of the New York Times ’ computer network late last year appear to be mounting fresh assaults that leverage new and improved versions of malware .


The new campaigns mark the first significant stirrings from the group since it went silent in January in the wake of a detailed expose of the group and its exploits — and a retooling of what security researchers believe is a massive spying operation based in China .


The newest campaign uses updated versions of Aumlib and Ixeshe .


Aumlib , which for years has been used in targeted attacks , now encodes certain HTTP communications .


FireEye researchers spotted the malware when analyzing a recent attempted attack on an organization involved in shaping economic policy .


And a new version of Ixeshe , which has been in service since 2009 to attack targets in East Asia , uses new network traffic patterns , possibly to evade traditional network security systems .


The updates are significant for both of the longstanding malware families ; before this year , Aumlib had not changed since at least May 2011, and Ixeshe had not evolved since at least December 2011 .


Cybercriminals are constantly evolving and adapting in their attempts to bypass computer network defenses .


But , larger , more successful threat actors tend to evolve at a slower rate .


As long as these actors regularly achieve their objective ( stealing sensitive data ) , they are not motivated to update or rethink their techniques , tactics , or procedures ( TTPs ) .


These threat actors ’ tactics follow the same principles of evolution – successful techniques propagate , and unsuccessful ones are abandoned .


Attackers do not change their approach unless an external force or environmental shift compels them to .


As the old saying goes : If it ain’t broke , don’t fix it .


So when a larger , successful threat actor changes up tactics , the move always piques our attention .


Naturally , our first priority is ensuring that we detect the new or altered TTPs .


But we also attempt to figure out why the adversary changed — what broke? — so that we can predict if and when they will change again in the future .


We observed an example of this phenomenon around May .


The previous versions of Aumlib had not changed since at least May 2011, and Ixeshe had not evolved since at least December 2011 .


We cannot say for sure whether the attackers were responding to the scrutiny they received in the wake of the episode .


But we do know the change was sudden .


Akin to turning a battleship , retooling TTPs of large threat actors is formidable .


Such a move requires recoding malware , updating infrastructure , and possibly retraining workers on new processes .


The following sections detail the changes to Backdoor.APT.Aumlib and Backdoor.APT.Ixeshe .


Backdoor.APT.Aumlib :


A recently observed malware sample ( hash value 832f5e01be536da71d5b3f7e41938cfb ) appears to be a modified variant of Aumlib .


The sample , which was deployed against an organization involved in shaping economic policy , was downloaded from the following URL :


status.acmetoy.com /DD/ myScript.js or status.acmetoy.com /DD/ css.css .


This output reveals the following changes when compared with earlier variants :


The POST URI is changed to /bbs/ search.asp ( as mentioned , earlier Aumlib variants used a POST URI of /bbs/ info.asp . ) The POST body is now encoded .


These subtle changes may be enough to circumvent existing IDS signatures designed to detect older variants of the Aumlib family .


The sample 832f5e01be536da71d5b3f7e41938cfb shares code with an older Aumlib variant with the hash cb3dcde34fd9ff0e19381d99b02f9692 .


The sample cb3dcde34fd9ff0e19381d99b02f9692 connected to documents.myPicture.info and www.documents.myPicture.info and as expected generated the a POST request to /bbs/ info.asp .


Backdoor.APT.Ixeshe :


Ixeshe has been used in targeted attacks since 2009, often against entities in East Asia .


The network traffic is encoded with a custom Base64 alphabet .


We analyzed a recent sample that appears to have targeted entities in Taiwan , a target consistent with previous Ixeshe activity .


This sample ( aa873ed803ca800ce92a39d9a683c644 ) exhibited network traffic that does not match the earlier pattern and therefore may evade existing network traffic signatures designed to detect Ixeshe related infections .


APT16 .


Between November 26, 2015, and December 1, 2015, known and suspected China based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries .


Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability , and the local Windows privilege escalation vulnerability CVE-2015-1701 .


The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO , or a backdoor that we refer to as ELMER .


On November 26, 2015, a suspected China based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


As shown in Figure 1, the emails originated from the Yahoo ! email address mts03282000@yahoo.co.jp , and contained the subject “ Sending of New Year No .


Foreword ” .


Each phishing message contained the same malicious Microsoft Word attachment .


The malicious attachment resembled an article hosted on a legitimate Japanese defense-related website , as both discussed national defense topics and carried the same byline .


The lure documents also used the Japanese calendar , as indicated by the 27th year in the Heisei period .


This demonstrates that the threat actors understand conventional Japanese date notation .


Following the exploitation of the EPS and CVE-2015-1701 vulnerabilities , the exploit payload drops either a 32-bit or 64-bit binary containing an embedded IRONHALO malware sample .


The encoded payload is written to a temporary file , decoded and executed in a hidden window .


The encoded and decoded payloads are written to files named igfxHK[%rand%].dat and igfxHK[%rand%].exe respectively , where [%rand%] is a 4-byte hexadecimal number based on the current timestamp .


IRONHALO : AcroRd32Info.exe.exe a8ccb2fc5fec1b89f778d93096f8dd65 .


IRONHALO persists by copying itself to the current user ’s Startup folder .


This variant sends an HTTP request to a legitimate Japanese website using a malformed User-Agent string , as shown in Figure 2 .


The threat actors likely compromised the legitimate site and attempted to use it as a staging server for second-stage payloads .


On December 1, 2015, threat actors launched two additional spear phishing attacks exploiting the undisclosed EPS vulnerability and CVE-2015-1701 .


Unlike the Nov. 26 campaign , these attacks targeted Taiwanese governmental and media and entertainment organizations .


Moreover , the exploit dropped a different malware payload , a backdoor we refer to as ELMER .


The first spear phishing message was sent to a Taiwanese governmental employee on Dec. 1 .


The attachment was created using the traditional Chinese character set , and contained a flowchart that appeared to be taken from the legitimate Taiwanese government auction website http://shwoo.gov.taipei/buyer_flowchart.asp .


The second December spear phishing attack targeted Taiwan based news media organizations .


The emails originated from the address dpptccb.dpp@msa.hinet.net , and contained the subject DPP's Contact Information Update .


Based on the email address naming convention and message subject , the threat actors may have tried to make the message appear to be a legitimate communication from the Democratic Progressive Party ( DPP ) , Taiwan ’s opposition party .


Unlike the previous exploit documents , this malicious attachment did not contain any visible text when opened in Microsoft Word .


The exploit documents delivered during the December campaigns dropped a binary containing an embedded variant of a backdoor we refer to as ELMER .


ELMER is a non-persistent proxy-aware HTTP backdoor written in Delphi , and is capable of performing file uploads and downloads , file execution , and process and directory listings .


To retrieve commands , ELMER sends HTTP GET requests to a hard-coded C2 server , and parses the HTTP response packets received from the C2 server for an integer string corresponding to the command that needs to be executed .


Table 2 lists the ELMER backdoors observed during the December campaigns .


The ELMER variant 6c33223db475f072119fe51a2437a542 beaconed to the C2 IP address 121.127.249.74 over port 443 .


APT16 .


This is based on the use of the known APT16 domain rinpocheinfo.com , as well as overlaps in previously observed targeting and tactics , techniques and procedures ( TTPs ) .


Taiwanese citizens will go to the polls on January 16 , 2016 , to choose a new President and legislators .


According to recent opinion polls , the Democratic Progressive Party ( DPP ) candidate Tsai Ing-wen is leading her opponents and is widely expected to win the election .


The DPP is part of the pan-green coalition that favors Taiwanese independence over reunification with the mainland , and the party ’s victory would represent a shift away from the ruling Kuomintang ’s closer ties with the PRC .


Since 1949 , Beijing has claimed Taiwan as a part of China and strongly opposes any action toward independence .


The Chinese government is therefore concerned whether a DPP victory might weaken the commercial and tourism ties between China and Taiwan , or even drive Taiwan closer to independence .


In 2005 , the Chinese government passed an “ anti-secession ” law that signified its intention to use “ non-peaceful ” means to stymie any Taiwanese attempt to secede from China .


APT16 actors sent spear phishing emails to two Taiwanese media organization addresses and three webmail addresses .


The message subject read “ DPP ’s Contact Information Update ” , apparently targeting those interested in contact information for DPP members or politicians .


The Chinese government would benefit from improved insight into local media coverage of Taiwanese politics , both to better anticipate the election outcome and to gather additional intelligence on politicians , activists , and others who interact with journalists .


This tactic is not without precedent ; in 2013 , the New York Times revealed it had been the target of China based actors shortly after it reported on the alleged mass accumulation of wealth by then-Prime Minister Wen Jiabao and his family .


The actors likely sought information on the newspaper ’s sources in China , who could be silenced by the government .


Compromising these Taiwanese news organizations would also allow the actors to gain access to informants or other protected sources , who might then be targeted for further intelligence collection or even retribution .


The webmail addresses , while unknown , were possibly the personal-use addresses of the individuals whose corporate domain emails were targeted .


As corporate networks become more secure and users become more vigilant , personal accounts can still offer a means to bypass security systems .


This tactic exploits users ’ reduced vigilance when reading their own personal email , even when using corporate IT equipment to do so .


One of the media organizations involved in this latest activity was targeted in June 2015 , while its Hong Kong branch was similarly targeted in August 2015 .


APT16 actors were likely also responsible for the June 2015 activity .


They sent spear phishing messages with the subject “ 2015 Taiwan Security and Cultural Forum Invitation Form ” , and used a different tool – a tool that we refer to as DOORJAMB – in their attempt to compromise the organization .


A different group , known as admin@338 , used LOWBALL malware during its Hong Kong activity .


Despite the differing sponsorship , penetration of Hong Kong and Taiwan based media organizations continues to be a priority for China based threat groups .


The difference in sponsorship could be the result of tasking systems that allocate targeting responsibility to different groups based on their targets ’ geographic location .


In other words , while media organizations are important targets , it is possible that two separate groups are responsible for Hong Kong and Taiwan , respectively .


IRONHALO : CVE-2015-1701 .


ELMER : CVE-2015-1701 .


These clusters of activity raise interesting questions about the use of an identical silently-patched vulnerability , possibly by multiple threat groups .


Both Japan and Taiwan are important intelligence collection targets for China , particularly because of recent changes to Japan ’s pacifist constitution and the upcoming Taiwanese election .


Based on our visibility and available data , we only attribute one campaign to the Chinese APT group APT16 .


APT17 .


FireEye Threat Intelligence and the Microsoft Threat Intelligence Center investigated a command-and-control ( C2 ) obfuscation tactic used on Microsoft ’s TechNet , a web portal for IT professionals .


TechNet ’s security was in no way compromised by this tactic , which is likely possible on other message boards and forums .


FireEye Threat Intelligence assesses that APT17 , a China based threat group , was behind the attempt .


Other groups have used legitimate websites to host C2 IP address in the past .


APT17 was embedding the encoded C2 IP address for the BLACKCOFFEE malware in legitimate Microsoft TechNet profiles pages and forum threads , a method some in the information security community call a “ dead drop resolver. ” Encoding the IP address makes it more difficult to identify the true C2 address for network security professionals .


Few security companies have publicly discussed this tactic .


After discovering the BLACKCOFFEE activity , the FireEye-Microsoft team encoded a sinkhole IP address into the profile pages and forum threads and locked the accounts to prevent the threat actors from making any changes .


This collaborative approach allowed the team to observe the malware and its victims .


Though the security community has not yet broadly discussed this technique , FireEye has observed other threat groups adopting these measures and expect this trend to continue on other community sites .


Today , FireEye released Indicators of Compromise ( IOCs ) for BLACKCOFFEE and Microsoft released signatures for its anti-malware products .


APT17 , also known as DeputyDog , is a Chinabased threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


BLACKCOFFEE ’s functionality includes uploading and downloading files ; creating a reverse shell ; enumerating files and processes ; renaming , moving , and deleting files ; terminating processes ; and expanding its functionality by adding new backdoor commands .


FireEye has monitored APT17 ’s use of BLACKCOFFEE variants since 2013 to masquerade malicious communication as normal web traffic by disguising the C2 communication as queries to web search engines .


The use of BLACKCOFFEE demonstrates threat actors ’ evolving use of public websites to hide in plain sight .


In the past , threat actors would modify easily compromised websites to host C2 commands and configuration , as observed in the China based APT1 ’s WEBC2 suite of backdoors .


Now , threat actors are using well-known websites—that they do not need to compromise to host C2 IP addresses .


They simply use the website for legitimate purposes , such as posting forum threads or creating profile pages .


APT17 went further to obfuscate their C2 IP address and employed a multi-layered approach for the malware to finally beacon the true C2 IP .


They used legitimate infrastructure—the ability to post or create comments on forums and profile pages—to embed a string that the malware would decode to find and communicate with the true C2 IP address .


This additional obfuscation puts yet another layer between APT17 and the security professionals attempting to chase them down .


This BLACKCOFFEE variant contains one or more URLs that link to the biography sections of attacker-created profiles as well as forum threads that contain comments from those same profiles .


A URL is randomly selected and the malware searches at that location for an encoded IP address located between two tags , “ @MICR0S0FT ” and “ C0RP0RATI0N ” .


The malware then communicates directly with the retrieved and decoded IP address to receive commands and send stolen information .


If the C2 server is discovered or shut down , the threat actors can update the encoded IP address on TechNet to maintain control of the victims ’ machines .


BLACKCOFFEE supports an initial set of fifteen commands , including creating a reverse shell , uploading and downloading files , and enumerating files and processes .


The attackers can also extend BLACKCOFFEE ’s functionality through additional commands sent as shellcode .


APT17 : de56eb5046e518e266e67585afa34612 .


APT17 : 195ade342a6a4ea0a58cfbfb43dc64cb .


APT17 : 4c21336dad66ebed2f7ee45d41e6cada .


APT17 : 0370002227619c205402c48bde4332f6 .


APT17 : ac169b7d4708c6fa7fee9be5f7576414 .


APT17 : 130.184.156.62 .


APT17 : 69.80.72.165 .


APT17 : 110.45.151.43 .


APT17 : 121.101.73.231 .


APT18 .


Dell SecureWorks Counter Threat Unit ( CTU ) analysts were recently engaged with a client thought to have been compromised by a threat group CTU researchers have named Threat Group-0416 ( TG-0416 ) .


Various artifacts from the initial phases of the incident provided strong indications of the existence of this particular threat group within the client's infrastructure .


The threat actors achieved an initial foothold into the infrastructure via phishing email that convinced victims to install the Xyligan remote access Trojan ( RAT ) on a system .


The threat actors then installed the hcdLoader RAT , which installs as a Windows service and provides command line access to the compromised system .


Using host-based digital forensic analysis , CTU analysts observed the intruders using the native ‘ at.exe ’ Windows task scheduler tool to move laterally within the infrastructure .


Many threat groups use lateral movement techniques , but this engagement allowed CTU analysts to not only further validate indicators of lateral movement , but also to look a bit closer at those indicators and expand the cluster of indicators surrounding the use of at.exe for lateral movement within the infrastructure .


Threat actors accessed the source host via the hcdLoader RAT .


The sole indicator on the source host that at.exe had been run was an application Prefetch file ( C:\Windows\Prefetch\AT.EXE-BB02E639.pf ) that was created when the tool was executed .


Beyond the file system metadata for the Prefetch file ( creation and last modification times ) and the last execution time within the file metadata , CTU analysts did not observe any indicators of value on the source host .


Two files are created for the task at approximately the same time : C:\Windows\System32\Tasks\At1 and C:\Windows\Tasks\At1.job .


The first file is an Extensible Markup Language ( XML ) file that can be opened and viewed in a text editor .


The second file follows a decodable binary format .


The operating system also creates a registry key within the software registry hive that is specifically associated with the creation of the scheduled task on the destination host : Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\At1 .


The Task Scheduler service names the tasks , so subsequent tasks are named At2 , At3 , and so on .


FIN7.5 : the infamous cybercrime rig FIN7 continues its activities .


On August 1, 2018 , the US Department of Justice announced that it had arrested several individuals suspected of having ties to the FIN7 cybercrime rig .


Interestingly , this threat actor created fake companies in order to hire remote pentesters , developers and interpreters to participate in their malicious business .


The main goal behind its malicious activities was to steal financial assets from companies , such as debit cards , or get access to financial data or computers of finance department employees in order to conduct wire transfers to offshore accounts .


In 2018-2019 , researchers of Kaspersky Lab ’s Global Research and Analysis Team analyzed various campaigns that used the same Tactics Tools and Procedures ( TTPs ) as the historic FIN7 , leading the researchers to believe that this threat actor had remained active despite the 2018 arrests .


Kaspersky Lab has been able to retrieve some of these exchanges from a FIN7 target .


The spear phishing campaigns were remarkably sophisticated from a social engineering perspective .


In various cases , the operators exchanged numerous messages with their victims for weeks before sending their malicious documents .


The emails were efficient social-engineering attempts that appealed to a vast number of human emotions ( fear , stress , anger , etc. ) to elicit a response from their victims .


One of the domains used by the attackers in their 2018 campaign of spear phishing contained more than 130 email aliases , leading us to think that more than 130 companies had been targeted by the end of 2018 .


We have seen two types of documents sent to victims in these spear phishing campaigns .


The first one exploits the INCLUDEPICTURE feature of Microsoft Word to get context information about the victim’s computer , and the availability and version number of Microsoft Word .


The second one , which in many cases is an Office document protected with a trivial password , such as “ 12345 ” , “ 1234 ” , etc. , uses macros to execute a GRIFFON implant on the target’s computer .


In various cases , the associated macro also scheduled tasks to make GRIFFON persistent .


The new builder inserts random values in the Author and Company metadata fields .


Moreover , the builder allows these to modify different IOCs , such as the filenames of wscript.exe or sctasks.exe copies , etc .


The GRIFFON implant is a lightweight JScript validator-style implant without any persistence mechanism .


The malware is designed for receiving modules to be executed in-memory and sending the results to C2s .


We were able to obtain four different modules during the investigation .


This module mainly relies on WMI and Windows objects to deliver results , which will be sent back to the operators .


Interestingly , more than 20 artifacts are retrieved from the system by this implant during the reconnaissance stage , from the date and time of operating system installation and membership in a Windows domain to a list of and the resolutions of the workstation’s monitors .


The second module is used by the operators to execute an obfuscated PowerShell script , which contains a Meterpreter downloader widely known as “ Tinymet “ .


This downloader , seen in past FIN7 campaigns , downloads a one-byte XOR encrypted ( eg. with the key equal to 0x50 or 0x51 ) piece of meterpreter shellcode to execute .


The third module allows the operators to take a screenshot of the remote system .


To do that , it also drops a PowerShell script on the workstation to execute .


The script executes an open-source .NET class used for taking a screenshot .


The resulting screenshot is saved at “ %TMP%/image.png ” , sent back to the attackers by the GRIFFON implant and then deleted .


The last retrieved module is a persistence module .


If the victim appears valuable to the attackers , a GRIFFON implant installer is pushed to the victim’s workstation .


This module stores another instance of the GRIFFON implant inside the registry to achieve persistence .


Here is a PowerLinks style method used by the attackers to achieve persistence and execute the GRIFFON implant at each user logon .


Through its light weight and modular architecture , the GRIFFON implant is the perfect validator .


Even though we have been able to retrieve four different modules , it is possible that the FIN7 operators have more modules in their toolsets for achieving their objectives on the victim’s workstation .


Attackers make mistakes , and FIN7 are no exception .


The major error made by its operators allowed us to follow the command and control server of the GRIFFON implant last year .


In order to trick blue teams and other DFIR analysts , the operators created fake HTTP 302 redirection to various Google services on their C2s servers .


This error allowed us to follow the infrastructure week by week , until an individual pushed on Twitter the heuristic to track their C2 at the end of December 2018 .


A few days after the tweet , in January 2019 , the operators changed their landing page in order to prevent this type of tracking against their infrastructure .


During the investigation related to the GRIFFON infrastructure , we found a strange overlap between the WHOIS record of an old GRIFFON C2 and the website of a fake company .


According to the website , that domain supposedly belongs to a legitimate security company “ fully owned by the Russian Government ” ( sic . ) and having offices in “ Moscow , Saint Petersburg and Yekaterinburg ” , but the address says the company is located in Trump Tower , in New York .


Given FIN7 ’s previous use of false security companies , we decided to look deeper into this one .


As we were looking at the content of the website , it became evident that almost all of the text used was lifted from legitimate security-company websites .


Phrases and sentences were borrowed from at least the following companies/sites : DKSec – www.dksec.com , OKIOK – www.okiok.com/services/tailored-solutions , MainNerve – www.mainnerve.com , Datics – www.datatics.com/cyber-security , Perspective Risk – www.perspectiverisk.com , Synack – https://www.synack.com/company , FireEye – https://www.fireeye.com/services/penetration-testing.html .


This company seems to have been used by the FIN7 threat actor to hire new people as translators , developers and pentesters .


During our research , we found various job advertisements associated with the company on freelance and remote-work websites .


While tracking numerous threat actors on a daily basis during the final days of 2018 and at the beginning of 2019 , we discovered various activity clusters sharing certain TTPs associated with the FIN7 intrusion set .


The link between these threat actors and FIN7 is still weak , but we decided to disclose a few hints regarding these in this blog post .


In his history , FIN7 has overlapped several times with Cobalt in terms of TTPs .


After a successful penetration , it uses its own backdoors and the CobaltStrike framework or Powershell Empire components to hop to interesting parts of the network , where it can monetize its access .


FIN7 ’s last campaigns were targeting banks in Europe and Central America .


A few interesting overlaps in recent FIN7 campaigns : Both used macros to copy wscript.exe to another file , which began with “ ms ” ( mses.exe – FIN7 , msutil.exe – EmpireMonkey ) .


Both executed a JScript file named “ error ” in %TEMP% ( Errors.txt in the case of FIN7 , Errors.bat for EmpireMonkey ) .


Both used DocuSign decoy documents with different macros .


The macros popped the same “ Document decryption error ” error message—even if macro code remain totally different .


We have a high level of confidence in a historic association between FIN7 and Cobalt , even though we believe that these two clusters of activity are operated by different teams .


We have medium confidence that this botnet falls under the FIN7 umbrella .


Since the beginning of 2019 , we have collected more than 1300 samples and extracted more than 130 C2s .


What is interesting , in some emails , they ask targets to phone them if they have any questions , like the FIN7 guys do .


During the investigation into FIN7 , our threat-hunting systems found an interesting overlap in between the infrastructure of FIN7 and AveMaria .


Basically , two servers in the same IP range and AS14576 ( autonomous system ) share a non-standard SSH port , which is 222 .


One of the servers is a Griffon C2, and the other one , an AveMaria C2 .


Distribution of targets is another factor suggesting that these two malware families may be connected .


We analyzed AveMaria targets during February and March of 2019 .


The spearphishing emails were sent to various kinds of businesses only and did not target individuals .


Thirty percent of the targets were small and medium-sized companies that were suppliers or service providers for bigger players and 21% were various types of manufacturing companies .


We also spotted several typical FIN7 targets , such as retailers and hotels .


Most AveMaria targets ( 72% ) were in the EU .


This set of activity relied on open-source tools , such as Powershell Empire , and well-documented red teaming techniques , in order to get a foothold within the victim’s networks and avoid detection .


The links between CopyPaste and FIN7 are still very weak .


It is possible that the CopyPaste operators were influenced by open-source publications and do not have any ties with FIN7 .


During 2018 , Europol and DoJ announced the arrest of the leader of the FIN7 and Carbanak cybercrime groups .


It was believed that the arrest of the group leader will have an impact on the group’s operations .


However , recent data seems to indicate that the attacks have continued without significant drawbacks .


One may say CobaltGoblin and FIN7 have even extended the number of groups operating under their umbrella .


They rely on a Griffon JS backdoor and Cobalt , and in recent attacks , Powershell Empire .


The second one is CobaltGoblin , which uses the same toolkit , techniques and similar infrastructure but targets only financial institutions and associated software/services providers .


We link the AveMaria botnet to these two groups with medium confidence : AveMaria ’s targets are mostly suppliers for big companies , and the way AveMaria manages its infrastructure is very similar to FIN7 .


It is possible that the operators of this cluster of activity were influenced by open-source publications and do not have any ties with FIN7 .


All of the aforementioned groups greatly benefit from unpatched systems in corporate environments .


They thus continue to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework .


So far , the groups have not used any zero-days .


FIN7 phishing documents may seem basic , but when combined with their extensive social engineering and focused targeting , they are quite successful .


As with their previous fake company “ Combi Security ” , we are confident that they continue to create new personas for use in either targeting or recruiting under a “ new ” brand , “ IPC ” .


AveMaria : 185.61.138.249 tain.warzonedns.com noreply377.ddns.net 185.162.131.97 91.192.100.62 server.mtcc.me doddyfire.dyndns.org 212.8.240.116 168.167.45.162 toekie.ddns.net warmaha.warzonedns.com .


CopyPaste : digi-cert.org somtelnetworks.com geotrusts.com secureclientupdate.com digicertweb.com sport-pesa.org itaxkenya.com businessdailyafrica.net infotrak-research.com nairobiwired.com k-24tv.com .


FIN7 : hpservice-cdn.com realtek-cdn.com logitech-cdn.com pci-cdn.com appleservice-cdn.com servicebing-cdn.com .


ScarCruft continues to evolve, introduces Bluetooth harvester .


We recently discovered some interesting telemetry on this actor , and decided to dig deeper into ScarCruft ’s recent activity .


This shows that the actor is still very active and constantly trying to elaborate its attack tools .


Based on our telemetry , we can reassemble ScarCruft ’s binary infection procedure .


It used a multi-stage binary infection to update each module effectively and evade detection .


In addition , we analyzed the victims of this campaign and spotted an interesting overlap of this campaign with another APT actor known as DarkHotel .


As in Operation Daybreak , this actor performs sophisticated attacks using a zero-day exploit .


However , sometimes using public exploit code is quicker and more effective for malware authors .


We witnessed this actor extensively testing a known public exploit during its preparation for the next campaign .


In order to deploy an implant for the final payload , ScarCruft uses a multi-stage binary infection scheme .


As a rule , the initial dropper is created by the infection procedure .


In order to evade network level detection , the downloader uses steganography .


The downloaded payload is an image file , but it contains an appended malicious payload to be decrypted .


The final payload created by the aforementioned process is a well known backdoor , also known as ROKRAT by Cisco Talos .


This cloud service-based backdoor contains many features .


One of its main functions is to steal information .


Upon execution , this malware creates 10 random directory paths and uses them for a specially designated purpose .


The malware creates 11 threads simultaneously : six threads are responsible for stealing information from the infected host , and five threads are for forwarding collected data to four cloud services ( Box , Dropbox , Pcloud and Yandex ) .


When uploading stolen data to a cloud service , it uses predefined directory path such as /english , /video or /scriptout .


The ScarCruft group keeps expanding its Exfiltration targets to steal further information from infected hosts and continues to create tools for additional data Exfiltration .


This malware is responsible for stealing Bluetooth device information .


It is fetched by a downloader , and collects information directly from the infected host .


This malware uses Windows Bluetooth APIs to find information on connected Bluetooth devices and saves the following information .


We have found several victims of this campaign , based on our telemetry – investment and trading companies in Vietnam and Russia .


We discovered one victim from Russia that also triggered a malware detection while staying in North Korea in the past .


The fact that this victim visits North Korea makes its special and suggests that it may have valuable information about North Korean affairs .


ScarCruft infected this victim on September 21, 2018 .


GreezeBackdoor is a tool of the DarkHotel APT group , which we have previously written about .


In addition , this victim was also attacked by the Konni malware on 03 April 2018 .


The Konni malware was disguised as a North Korean news item in a weaponized documents ( the name of the document was “ Why North Korea slams South Korea ’s recent defense talks with U.S-Japan.zip ” ) This is not the first time we have seen an overlap of ScarCruft and DarkHotel actors .


Members from our team have already presented on the conflict of these two threat actors at security conferences .


We have also shared more details with our threat intelligence customers in the past .


They are both Korean-speaking threat actors and sometimes their victimology overlaps .


But both group seem to have different TTPs ( Tactics , Techniques and Procedures ) and it leads us to believe that one group regularly lurks in the other ’s shadow .


The ScarCruft has shown itself to be a highly-skilled and active group .


It has a keen interest in North Korean affairs , attacking those in the business sector who may have any connection to North Korea , as well as diplomatic agencies around the globe .


ScarCruft tools : 02681a7fe708f39beb7b3cf1bd557ee9 Bluetooth info harvester .


ScarCruft tools : C781f5fad9b47232b3606e4d374900cd Installer .


ScarCruft tools : 032ed0cd234f73865d55103bf4ceaa22 Downloader .


ScarCruft tools : 22aaf617a86e026424edb7c868742495 AV Remover .


ScarCruft tools : 07d2200f5c2d03845adb5b20841faa94 AV Remover .


GreezaBackdoor of DarkHotel : 5e0e11bca0e94914e565c1dcc1ee6860 .


TA505 is Expanding its Operations In the last few days , during monitoring activities , Yoroi CERT noticed a suspicious attack against an Italian organization .


The threat group is also known for its recent attack campaign against Bank and Retail business sectors , but the latest evidence indicates a potential expansion of its criminal operation to other industries too .


Dropper : 0c88e285b6fc183c96b6f03ca5700cc9ca7c83dfccc6ad14a946d1868d1cc273 Excel file with malicious macro .


The intercepted attack starts with a spear phishing email embedding a spreadsheet .


The document is weaponized with malicious macro code triggered when the user opens the document to see the content under the obfuscated view .


To understand its capabilities , the macro code has been isolated and analyzed in detail .


Surprisingly , the source code is composed by more than 1600 lines of code and it is highly obfuscated .


Paying more attention during the code analysis , we discovered that it is full of junk instructions used to declare and initialize variables never used .


Only a small portion of this code is actually used to start the infection , the rest is just junk code .


Once the macro is executed , the malware downloads two files from “ kentona[.su ” , using an SSL encrypted communication , and stores them in “ C:\Users\Public ” path : “ rtegre.exe ” and “ wprgxyeqd79.exe ” .


Generic : aafa83d5e0619e69e64fcac4626cfb298baac54c7251f479721df1c2eb16bee7 Trojan ( Executable file ) .


Trojan : 6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2 SFX ( self-extracting archive ) ( Executable file ) .


The “ wprgxyeqd79.exe ” sample actually is a Self Extracting Archive ( SFX ) containing four files designed to be extracted in the %TEMP% folder .


After that , it executes “ exit.exe ” which launches the “ i.cmd ” batch script .


This new script performs a ping to “ www[.cloudflare[.com ” for three times with a delay of 3000ms , testing the connectivity of the victim machine .


If the host is successfully reached , the script renames a file named “ kernel.dll ” , obviously not the real one , in “ uninstall.exe ” , another misleading name .


Then it invokes the renamed executable and runs it passing a series of parameter : “ uninstall.exe x -pQELRatcwbU2EJ5 -y ”


These parameters are needed to self-decrypt the “ uninstall.exe ” file which is again another SFX archive .


The “ -p ” parameter , indeed , specify the password of the archive to be extracted .


The crucial file , at this point of the infection , is the SFX executable named “ uninstall.exe ” .


It has a structure similar to previous “ wprgxyeqd79.exe ” file : two of their files have the same name , but the content of this new SFX is extracted in the “ %ALLUSERSPROFILE%\Windows Anytime Upgrade ” directory .


Another time , the execution flow moves from “ exit.exe to “ i.cmd ” .


The script is quite different from the previous one : it guarantees its persistence on the victim machine through the setting of “ HKCU\Software\Microsoft\Windows\CurrentVersion\Run ” registry key , creating a new entry named “ Windows Anytime Upgrade ” which points to “ winserv.exe ” , just stored into the same folder .


Thus , the script provides to run “ winserv.exe ” .


An interesting part of the script is the continuous killing of every “ rundll32.exe ” process running into the victim machine , generates a huge amount of noise , as visible in the following process explorer view .


Anyway , just before the kill loop , the real malicious payload is executed : the


“ winserv.exe ” file .


Analyzing it in depth , we discover it actually is the RMS ( Remote Manipulator System ) client by TektonIT , encrypted using the MPress PE compressor utility , a legitimate tool , to avoid antivirus detection .


TektonIT RMS acts as a remote administration tool , allowing the attacker to gain complete access to the victim machine .


Together with the RMS executable , there is another file named “ settings.dat ” containing the custom configuration prepared by the attacker .


It contains information like : Server address and port the client will connect to ; The password chosen by the attacker for the remote access ; The ID associated to the victim client .


All these information are automatically loaded by the RMS executable and firstly stored in the registry key “ HKCU\Software\tektonik\Remote MANIPULATOR System\Host\parameters ” .


At the next startup , the software will directly load the configuration from the just created key .


The client establishes a new connection with the remote command and control server hosted on a Bulgarian remote host 217.12.201.159 , part of a Virtual Dedicated Server subnet of the AS-21100, operated by ITL LLC .


After the reconstruction of the full infection chain , we noticed strong similarities with a recent spear-phishing attack campaign against an unspecified US retail company .


The comparison of the infection chains reveals in both cases the attacker used a couple of SFX stages to deploy the “ RMS ” software : a legitimate remote administration tool produced by the Russian company “ TektonIT ” .


The tool is able to grant remote access and full , direct control of the infected machine to the group .


Also , some code pieces are directly re-used in the


analyzed campaigns , such as the “ i.cmd ” and “ exit.exe ” files , and , at the same time , some new components have been introduced , for instance the “ rtegre.exe ” and the “ veter1605_MAPS_10cr0.exe ” file .


During the analysis , we also noticed the “ veter1605_MAPS_10cr0.exe ” file slightly changed run after run , a few hours after the initial discovery the infection chain dropped it with different icons , different suffix , from “ cr0 ” to “ cr24 ” , and appendix from “ veter1605_ ” to “ veter2005_ ” .


This may indicate the campaign is still ongoing .


The peculiarity of this recent attack wave is it actually hit a company not strictly in the Banking or Retail sector , as they recently did , suggesting the threat group could be potentially widening their current operations .


Dropurl : kentona[.su – 47.245.58.124 https://kentona[.su/xpepriubgpokejifuv7efrhguskdgfjn/ananas.exe https://kentona[.su/xpepriubgpokejifuv7efrhguskdgfjn/pasmmm.exe C2: 217[.12.201.159 TA505 : 0c88e285b6fc183c96b6f03ca5700cc9ca7c83dfccc6ad14a946d1868d1cc27325 TA505 : 1ee1ba514212f11a69d002005dfc623b1871cc808f18ddfa2191102bbb9f623b TA505 : fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 TA505 : c69ce39ac3e178a89076136af7418c6cb664844b0ce5cb643912ed56c373a08a TA505 : 5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3 .


Winnti : More than just Windows and Gates .


The Winnti malware family was first reported in 2013 by Kaspersky Lab .


Since then , threat actors leveraging Winnti malware have victimized a diverse set of targets forvaried motivations .


While the name ‘ Winnti ’ in public reporting was previously used tosignify a single actor , pronounced divergence in targeting and tradecraft betweencampaigns has led industry consensus to break up the tracking of the continued use ofthe Winnti malware under different actor clusters .


The underlying hypothesis is that themalware itself may be shared ( or sold ) across a small group of actors .


In April 2019 , reports emerged of an intrusion involving Winnti malware at a GermanPharmaceutical company .


Following these reports , Chronicle researchers doubled downon efforts to try to unravel the various campaigns where Winnti was leveraged .


Analysisof these larger convoluted clusters is ongoing .


While reviewing a 2015 report of a Winnti intrusion at a Vietnamese gaming company , we identified a small cluster of Winnti samples designed specifically for Linux .


The following is a technical analysis of thisvariant .


The Linux version of Winnti is comprised of two files : a main backdoor ( libxselinux ) and a library ( libxselinux.so ) used to hide it ’s activity on an infected system . ‘ libxselinux.so ’ — the userland rootkit . libxselinux.so.old : 11a9f798227be8a53b06d7e8943f8d68 906dc86cb466c1a22cf847dda27a434d04adf065 4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a IP .


Ids.me .


The library used to hide Winnti ’s system activity is a copy of the open-source userland rootkit Azazel , with minor changes .


When executed , it will register symbols for multiple commonly used functions , including : open() , rmdir() , and unlink() , and modify their returns to hide the malware ’s operations .


Unlike standard Azazel which is configured to hide network activity based on port ranges , the Winnti modified version keeps a list of process identifiers and network connections associated with the malware ’s activity .


This modification likely serves to simplify the operator ’s sample configuration process by not having to denote specific ports to hide .


Strings within this sample associated with the malware ’s operations are encoded using a single-byte XOR encoding .


The following is an example Python function to decode these strings . libxselinux.old : 7f4764c6e6dabd262341fd23a9b105a3 dc96d0f02151e702ef764bbc234d1e73d2811416 ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23 IP .


Winnti Linux variant ’s core functionality is within ‘ libxselinux ’ .


Upon execution , an embedded configuration is decoded from the data section using a simple XOR cipher .


The decoded configuration is similar in structure to the version Kaspersky classifies as Winnti 2.0, as well as samples in the 2015 Novetta report .


Embedded in this sample ’s configuration three command-and-control server addresses and two additional strings we believe to be campaign designators .


Winnti ver.1 , these values were designated as ‘ tag ’ and ‘ group ’ .


For context , embedded Winnti campaign designators have ranged from target names , geographic areas , industry , and profanity .


Winnti malware handles outbound communications using multiple protocols including : ICMP , HTTP , as well as custom TCP and UDP protocols .


Use of these protocols is thoroughly documented in the Novetta and Kaspersky reports .


While the outbound communication mechanisms are well documented , less attention has been paid to a feature of recent versions of Winnti we came across in the Linux variant ( as well as Windows ) that allows the operators to initiate a connection directly to an infected host , without requiring a connection to a control server .


This secondary communication channel may be used by operators when access to the hard-coded control servers is disrupted .


Additionally , the operators could leverage this feature when infecting internet-facing devices in a targeted organization to allow them to reenter a network if evicted from internal hosts .


This passive implant approach to network persistence has been previously observed with threat actors like Project Sauron and the Lamberts .


Initial technical information about this feature was shared by the Thyssenkrupp CERT in the form of an Nmap script that could be used to identify Winnti infections through network scanning .


This script identifies infected hosts by first sending a custom hello packet , immediately followed by an encoded request for host information , and then parsing the response .


The initial request , referred to as the helo/hello request in the Nmap script , is comprised of four DWORDs .


The first three are generated by rand() and the fourth is computed based on the first and third .


When received by a Winnti infected host , it will validate the received packet and listen for a second inbound request containing tasking .


This second request ( Encoded Get System Information Request ) is encoded using the same method as the custom TCP protocol used for communication with command-and-control servers , which uses a four-byte XOR encoding .


Before acting on the request , Winnti will validate the third DWORD contains the magic value 0xABC18CBA before executing tasking .


Clusters of Winnti related activity have become a complex topic in threat intelligence circles , with activity vaguely attributed to different codenamed threat actors .


The threat actors utilizing this toolset have repeatedly demonstrated their expertise in compromising Windows based environments .


An expansion into Linux tooling indicates iteration outside of their traditional comfort zone .


This may indicate the OS requirements of their intended targets but it may also be an attempt to take advantage of a security telemitry blindspot in many enterprises , as is with Penquin Turla and APT28 ’s Linux XAgent variant .


Utilizing a passive listener as a communications channel is characteristic of the Winnti developers ’ foresight in needing a failsafe secondary command-and-control mechanisms .


The group has shown interest in prominent figures in the United Nations , as well as opposition bloggers , activists , regional news correspondents , and think tanks .


A group known by Microsoft as O NEODYMIUM is Oreportedly associated closely with O BlackOasis operations , but evidence that the group names are aliases has not been identified .


BRONZE BUTLER : REDBALDKNIGHT , Tick .


BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008 .


The group primarily targets Japanese organizations , particularly those in government , biotechnology , electronics manufacturing , and industrial chemistry .


Carbanak : Anunak , Carbon Spider .


Carbanak is a threat group that mainly targets banks .


It also refers to malware of the same name ( Carbanak ) .


It is sometimes referred to as O FIN7 , but these appear to be two groups using the same O Carbanak  malware and are therefore tracked separately .


Gamaredon Group is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government .


GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency sevises .


Gorgon Group is a threat group consisting of members who are suspected to be Pakistan based or have other connections to Pakistan .


The group has performed a mix of criminal and targeted attacks , including campaigns against government organizations in the United Kingdom , Spain , Russia , and the United States .


Sandworm Team : Quedagh , VOODOO BEAR .


Sandworm Team is a Russian cyber espionage group that has operated since approximately 2009 .


The group likely consists of Russian pro-hacktivists .


Sandworm Team targets mainly Ukrainian entities associated with energy , industrial control systems , SCADA , government , and media .


Sandworm Team has been linked to the Ukrainian energy sector attack in late 2015 .


Scarlet Mimic is a threat group that has targeted minority rights activists .


This group has not been directly linked to a government source , but the group 's motivations appear to overlap with those of the Chinese government .


While there is some overlap between IP addresses used by Scarlet Mimic Panda , it has not been concluded that the groups are the same .


Silence is a financially motivated threat actor targeting financial institutions in different countries .


The group was first seen in June 2016 .


Their main targets reside in Russia , Ukraine , Belarus , Azerbaijan , Poland and Kazakhstan .


They compromised various banking systems , including the Russian Central Bank 's Automated Workstation Client , ATMs , and card processing .


Threat Group-1314 : TG-1314 .


Threat Group-1314 is an unattributed threat group that has used


compromised credentials to log into a victim ’s remote access infrastructure .


Threat Group-3390 : TG-3390 ,Emissary Panda , BRONZE UNION , APT27 , Iron Tiger , LuckyMouse .


Threat Group-3390 is a Chinese threat group that extensively used strategic Web compromises to target victims .


The group has been active since at least 2010 and has targeted organizations in the aerospace , government , defense , technology ,O energy , and manufacturing sectors .


Thrip is an espionage group that has targeted satellite communications ,telecoms ,and defense contractor companies in the U.S. and Southeast Asia .


The group uses custom malware as well as “ living off the land ” techniques .


NEODYMIUM is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims .


The group has demonstrated similarity to another activity group called O PROMETHIUM due to overlapping victim and campaign characteristics .


NEODYMIUM is reportedly associated closely with O BlackOasis operations , but evidence that the group names are aliases has not been identified .


Night Dragon is a campaign name for activity involving a threat group that has conducted activity originating primarily in China .


OilRig : IRN2 , HELIX KITTEN , APT34 .


OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014 .


The group has targeted a variety of industries , including financial , government , energy , chemical , and telecommunications , and has largely focused its operations within the Middle East .


It appears the group carries out supply chain attacks , leveraging the trust relationship between organizations to attack their primary targets .


FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran , use of Iranian infrastructure , and targeting that aligns with nation-state interests .


This group was previously tracked under two distinct groups , APT34 and OilRig , but was combined due to additional reporting giving higher confidence about the overlap of the activity .


APT16 is a China based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations .


APT17 : Deputy Dog .


APT17 is a China based threat group that has conducted network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


APT18 : TG-0416 , Dynamite Panda , Threat Group-0416 .


APT18 a threat group that has operated since at least 2009 and has targeted a range of industries , including technology , manufacturing , human rights groups , government , and medical .


Group5 is a threat group with a suspected Iranian nexus , though this attribution is not definite .


The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes , normally using Syrian and Iranian themes .


Group5 has used two commonly available remote access tools ( RATs ) , njRAT , as well as an Android RAT , DroidJack .


Honeybee is a campaign led by an unknown actor that targets humanitarian aid organizations and has been active in Vietnam , Singapore , Argentina , Japan , Indonesia , and Canada .


It has been an active operation since August of 2017 and as recently as February 2018 .


Group7 : APT15 , Mirage , Vixen Panda , GREF , Playful Dragon , RoyalAPT .


Ke3chang  is a threat group attributed to actors operating out of China .


Ke3chang  has targeted several industries , including oil , government , military , and more .


Kimsuky : Velvet Chollima .


Kimsuky is a North Korean based threat group that has been active since at least September 2013 .


The group focuses on targeting Korean think tank as well as DPRK/nuclear-related targets .


The group was attributed as the actor behind the Korea Hydro & Nuclear Power Co.compromise .


Lazarus Group : HIDDEN COBRA , Guardians of Peace , ZINC , NICKEL ACADEMY .


Lazarus Group is a threat group that has been attributed to the North Korean government .


The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta .


Malware used by Lazarus Group correlates to other reported campaigns , including Operation Flame , Operation 1Mission , Operation Troy , DarkSeoul , and Ten Days of Rain .


In late 2017 , Lazarus Group used KillDisk , a disk-wiping tool , in an attack against an online casino based in Central America .


North Korean group definitions are known to have significant overlap , and the name Lazarus Group is known to encompass a broad range of activity .


Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea .


Some organizations track North Korean clusters or groups such as Bluenoroff , APT37 , and APT38 separately , while other organizations may track some activity associated with those group names by the name Lazarus Group .


Leafminer : Raspite .


Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017 .


Elderwood : Elderwood Gang , Beijing Group , Sneaky Panda .


The group has targeted defense organizations , supply chain manufacturers , human rights and nongovernmental organizations ( NGOs ) , and IT service providers .


Equation is a sophisticated threat group that employs multiple remote access tools .


The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives .


FIN10 is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016 .


The group uses stolen data exfiltrated from victims to extort organizations .


Patchwork : Dropping Elephant , Chinastrats , MONSOON , Operation Hangover .


Patchwork is a cyberespionage group that was first observed in December 2015 .


While the group has not been definitively attributed , circumstantial evidence suggests the group may be a pro-Indian or Indian entity .


Patchwork has been seen targeting industries related to diplomatic and government agencies .


Much of the code used by this group was copied and pasted from online forums .


Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018 .


PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control .


Unknown .


Release_Time : unknow Report_URL : https://attack.mitre.org/groups/ APT19 ： Codoso , C0d0so0 , Codoso Team , Sunshop Group .


APT19 a Chinese-based threat group that has targeted a variety of industries , including defense , finance , energy , pharmaceutical , telecommunications , high tech , education , manufacturing , and legal services .


In 2017 , a phishing campaign was used to target seven law and investment firms .


Some analysts track APT19 Panda the same group , but it is unclear from open source information if the groups are the same .


APT28 : SNAKEMACKEREL , Swallowtail , Group 74 , Sednit , Sofacy , Pawn Storm , Fancy Bear , STRONTIUM , Tsar Team , Threat Group-4127 , TG-4127 .


APT28 a threat group that has been attributed to Russia's Main Intelligence Directorate of the Russian General Staff by a July 2018 U.S. Department of Justice indictment .


This group reportedly compromised the Hillary Clinton campaign , the Democratic National Committee , and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election .


APT28 has been active since at least 2004 .


APT29 : YTTRIUM , The Dukes , Cozy Bear , CozyDuke .


APT29 is threat group that has been attributed to the Russian government and has operated since at least 2008 .


This group reportedly compromised the Democratic National Committee starting in the summer of 2015 .


PLATINUM is an activity group that has targeted victims since at least 2009 .