The group has focused on targets associated with governments and related organizations in South and Southeast Asia .


Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005 .


The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm .


The group conducted a campaign in May 2016 and has heavily targeted Turkish victims .


PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics .


APT33 ：O Elfin APT33 is a suspected Iranian threat group that has carried out operations since at least 2013 .


The group has targeted organizations across multiple industries in the United States , Saudi Arabia , and South Korea , with a particular interest in the aviation and energy sectors .


APT37 ：O ScarCruft , Reaper , Group123 , TEMP.Reaper APT37 is a suspected North Korean cyber espionage group that has been active since at least 2012 .


The group has targeted victims primarily in South Korea , but also in Japan , Vietnam , Russia , Nepal , China , India , Romania , Kuwait , and other parts of the Middle East .


APT37 has also been linked to following campaigns between 2016-2018 : Operation Daybreak , Operation Erebus , Golden Time , Evil New Year , Are you Happy? , FreeMilk , Northern Korean Human Rights , and Evil New Year 2018 .


APT38 ：O APT38 is a financially-motivated threat group that is backed by the North Korean regime .


The group mainly targets banks and financial institutions and has targeted more than 16 organizations in at least 13 countries since at least 2014 . APT3 : Gothic Panda , Pirpi , UPS Team , Buckeye , Threat Group-0110 , TG-0110 .


APT3 is a China based threat group that researchers have attributed to China's Ministry of StateSecurity .


This group is responsible for the campaigns known as Operation Clandestine Fox , Operation Clandestine Wolf , and Operation Double Tap .


As of June 2015 , the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong .


MITRE has also developed an APT3 Adversary Emulation Plan .


APT30 is a threat group suspected to be associated with the Chinese government .


While Naikon shares some characteristics with APT30 , the two groups do not appear to be exact matches .


APT32 : SeaLotus , OceanLotus , APT-C-00 .


APT32 is a threat group that has been active since at least 2014 .


The group has targeted multiple private sector industries as well as with foreign governments , dissidents , and journalists with a strong focus on Southeast Asian countries like Vietnam , the Philippines , Laos , and Cambodia .


They have extensively used strategic web compromises to compromise victims .


The group is believed to be Vietnam based .


FIN7 : Carbanak Group .


FIN7 is a financially-motivated threat group that has primarily targeted the U.S. retail , restaurant , and hospitality sectors since mid-2015 .


They often use point-of-sale malware .


A portion of FIN7 was run out of a front company called Combi Security .


FIN7 is sometimes referred to as Carbanak Group , but these appear to be two groups using the same Carbanak malware and are therefore tracked separately .


FIN8 is a financially motivated threat group known to launch tailored spearphishing campaigns targeting the retail , restaurant , and hospitality industries .


Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017 .


The group has mainly targeted victims in the defense , military , and government sectors .


DarkHydrus  is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016 .


The group heavily leverages open-source tools and custom payloads for carrying out attacks .


Deep Panda : Shell Crew , WebMasters , KungFu Kittens , PinkPanther , Black Vine .


Deep Panda is a suspected Chinese threat group known to target many industries , including government , defense , financial , and telecommunications .


The intrusion into healthcare company Anthem has been attributed to Deep Panda .


This group is also known as Shell Crew , WebMasters , KungFu Kittens , and PinkPanther .


Deep Panda appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion .


Some analysts track Deep Panda and O APT19 S-APT as the same group , but it is unclear from open source information if the groups are the same .


Dragonfly : Energetic Bear .


Dragonfly  is a cyber espionage group that has been active since at least 2011 .


They initially targeted defense and aviation companies but shifted to focus on the energy sector in early 2013 .


They have also targeted companies related to industrial control systems .


A similar group emerged in 2015 and was identified by Symantec as O Dragonfly 2.0 .


There is debate over the extent of the overlap between O Dragonfly S-APT and O Dragonfly 2.0 , but there is sufficient evidence to lead to these being tracked as two separate groups .


Dragonfly 2.0 : Berserk Bear .


There is debate over the extent of overlap between O Dragonfly 2.0 and O Dragonfly , but there is sufficient evidence to lead to these being tracked as two separate groups .


Due to overlapping TTPs , including similar custom tools , O DragonOK is thought to have a direct or indirect relationship with the threat group Moafee .


It is known to use a variety of malware , including Sysget / HelloBridge , PlugX , PoisonIvy , FormerFirstRat , NFlog , and NewCT .


Dust Storm is a threat group that has targeted multiple industries in Japan , South Korea , the United States , Europe , and several Southeast Asian countries .


CopyKittens  is an Iranian cyber espionage group that has been operating since at least 2013 .


It has targeted countries including Israel , Saudi Arabia , Turkey , the U.S. , Jordan , and Germany .


Tick Group Continues Attacks .


The " Tick " group has conducted cyber espionage attacks against organizations in the Republic of Korea and Japan for several years .


The group is known to use custom malware called Daserf , but also employs multiple commodity and custom tools , exploit vulnerabilities , and use social engineering techniques .


With multiple tools and anonymous infrastructure , they are running longstanding and persistent attack campaigns .


We have observed that the adversary has repeatedly attacked a high-profile target in Japan using multiple malware families for the last three years .


Symantec was first to publicly report on Tick , followed by LAC in 2016 .


These reports discussed the group ’s malware , Daserf ( a.k.a Muirim or Nioupale ) and some additional downloader programs .


Though Daserf wasn’t a popular attack tool at the time of publishing the two reports , it dates back to at least 2011 .


Using AutoFocus , we were able to identify the link among Daserf and two other threats , 9002 and Invader .


These threats shared infrastructure between July 2012 and April 2013 .


Invader ( a.k.a Kickesgo ) is a backdoor that injects its main code into a legitimate process , such as explorer.exe , and has following functions :


Logs keystrokes and mouse movement Captures screenshots Opens cmd.exe shell Enumerates processes Executes programs Removes itself Enumerates all opening TCP and UDP ports .


9002 is the infamous RAT frequently seen in targeted attacks reported by various security vendors , including Palo Alto Networks .


Interestingly , the C2 servers linking 9002 to Daserf were described in the report of an Adobe Flash Zero-day attack from FireEye in 2013 .


These domains were registered through the privacy protection services in 2008 and 2011 .


krjregh.sacreeflame.com lywja.healthsvsolu.com .


Though we don’t know the targets of these malware samples at the time of writing this article , we suspect the same group is behind these threats for a number of reasons .


The samples of Daserf that shared infrastructure were submitted to VirusTotal only from Japan multiple times in 2013 .


As noted in a later section , another Invader sample shared different C2 servers with Daserf .


Symantec reported that Tick exploited additional Adobe Flash and Microsoft Office vulnerabilities .


SecureWorks said the adversary group is abusing a previously undisclosed vulnerability in Japanese Software Asset Management system on endpoints .


Therefore , Tick or their digital quartermaster is capable of deploying new and unique exploits .


In July 2016 , we identified a compromised website in Japan that was hosting a Daserf variant .


The web server was also a C2 server for another threat , Minzen ( a.k.a , XXMM , Wali , or ShadowWali ) .


The threat often uses compromised web servers in Japan and the Republic of Korea .


As Kaspersky and Cybereason recently posted , Minzen is a modular malware that has both 32-bit and 64-bit components in its resource section or configuration data in its body .


One of the Minzen samples ( SHA256 : 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 ) found in the Republic of Korea in December 2016 installs simple backdoor module as a final payload on a compromised computer .


It opens a TCP port and receives commands from a remote attacker .


According to the debug path in the body , the author of the tool called it “ NamelessHdoor , ” and its internal version is identified as “ V1.5. ”


The payload is based on “ Nameless Backdoor ” which has been publicly available for more than ten years .


The oldest code we could identify was hosted on a famous Chinese source code sharing site since 2005 .


The author of the NamelessHdoor appears to have created additional versions of the Nameless Backdoor by removing unnecessary functions , and added open-source DLL injection code from ReflectiveDLLLoader .


There is minimal public information regarding the Nameless Backdoor , except for the interesting report from Cyphort in 2015 .


The researcher of the company analyzed multiple threats , including Invader , Nioupale (Daserf ) and Hdoor found in an attack against an Asian financial institution .


We examined the sample described in the report as Hdoor and found it ’s a previous version of the NamelessHdoor we discovered in the Minzen sample , but without support for DLL injection .


It turned out that the DLL files we found are a custom variant of Gh0st RAT , and the EXE files download the RAT .


Since the source code is publicly available , Gh0st RAT has been used by multiple actors for years .


The domain , softfix.co.kr was registered in 2014 .


One of subdomains , news.softfix.co.kr was the C2 server of Daserf ( 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423 ) .


Another subdomain , bbs.softfix.co.kr was hosted on same IP address as bbs.gokickes.com , which was reported as the C2 server of Invader by Cyphort .


We also identified www.gokickes.com was the C2 of another Invader variant ( 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb ) .


In addition to the infrastructure , the attacker also shared code .


The Gh0st downloaders employ simple substitution ciphers for hiding strings .


We also identified another malware family , HomamDownloader , sharing some servers with Daserf .


An overview of the connections among these threats is discussed in below .


HomamDownloader is a small downloader program with minimal interesting characteristics from a technical point of view .


HomamDownloader was discovered to be delivered by Tick via a spearphishing email .


The adversary crafted credible email and attachment after understanding the targets and their behavior .


The email below was sent from a personal email account with a subject line of “ New Year Wishes on January 1st ” .


The message asked the recipient to rename the attachment extension from “ ._X_ ” to “ .exe ” and opening it with the password specified in the email to view the Happy New Year eCard in the correct and polite language .


In addition to the social engineering email technique , the attacker also employs a trick to the attachment .


The actor embedded malicious code to a resource section of the legitimate SFX file created by a file encryption tool , and modified the entry point of the program for jumping to the malicious code soon after the SFX program starts .


The malicious code drops HomamDownloader , then jumps back to the regular flow in the CODE section , which in turn asks the user the password and decrypts the file .


Therefore , once a user executes the attachment and sees the password dialog on SFX , the downloader dropped by the malicious code starts working even if the user chooses the Cancel on the password window .


Should the user become aware of the infection later , it may be difficult to find the cause due to the fact that the original embedded file contained within the SFX is benign .


Tick was spotted last year , but they are actively and silently attacking various organizations in South Korea and Japan for a number of years .


While some of the group ’s tools , tactics , and procedures ( TTPs ) have been covered within this article , it is likely there is much that still remains uncovered .


Daserf : 04080fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a .


Daserf : f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 .


Daserf : e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 .


Daserf : 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd355cd .


Daserf : 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423 .


Invader : 0df20ccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 .


Invader : e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e .


Invader : 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb . 9002 . 9002 . 9002 .


Minzen : 797d9c00022eaa2f86ddc9374f60d7ad92128ca07204b3e2fe791c08da9ce2b1 .


Minzen : 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 .


Minzen : 26727d139b593486237b975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82 .


NamelessHdoor : dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f .


Gh0stRAt Downloader : ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 .


Gh0stRAt Downloader : e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c .


Custom Gh0st : 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 .


Datper : 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849 .


HomamDownloader : a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 .


C2 : lywjrea.gmarketshop.net .


C2 : krjregh.sacreeflame.com .


C2 : psfir.sacreeflame.com .


C2 : lywja.healthsvsolu.com .


C2 : phot.healthsvsolu.com .


C2 : blog.softfix.co.kr .


C2 : news.softfix.co.kr .


C2 : www.gokickes.com .


C2 : log.gokickes.com .


The group is responsible for the campaign known as Operation Wilted Tulip .


Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security ( GDGS ) and has operated since at least 2012 .


Darkhotel  is a threat group that has been active since at least 2004 .


The group has conducted activity on hotel and business center Wi‑Fi and physical connections as well as peer-to-peer and file sharing networks .


The actors have also conducted spearphishing .


Unknown .


They appear to focus on targeting individuals of interest to Iran who work in academic research , human rights , and media , with most victims having been located in Iran , the US , Israel , and the UK .


Charming Kitten usually tries to access private email and Facebook accounts , and sometimes establishes a foothold on victim computers as a secondary objective .


The group 's TTPs overlap extensively with another group , O Magic Hound , resulting in reporting that may not distinguish between the two groups' activities .


Cleaver : Threat Group 2889 , TG-2889 .


Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver .


Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 ( TG-2889 ) .


Cobalt Group : Cobalt Gang , Cobalt Spider .


The group has conducted intrusions to steal money via targeting ATM systems , card processing , payment systems and SWIFT systems .


Cobalt Group has mainly targeted banks in Eastern Europe , Central Asia , and Southeast Asia .


One of the alleged leaders was arrested in Spain in early 2018 , but the group still appears to be active .


The group has been known to target organizations in order to use their access to then compromise additional victims .


Reporting indicates there may be links between O Cobalt Group and both the malware O Carbanak and the group O Carbanak .


Taidoor is a threat group that has operated since at least 2009 and has primarily targeted the Taiwanese government .


TEMP.Veles ： XENOTIME .


TEMP.Veles is a Russia based threat group that has targeted critical infrastructure .


The group has been observed utilizing TRITON , a malware framework designed to manipulate industrial safety systems .


The White Company is a likely state-sponsored threat actor with advanced capabilities .


From 2017 through 2018 , the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan .


Molerats : Operation Molerats , Gaza Cybergang .


Molerats is a politically-motivated threat group that has been operating since 2012 .


The group 's victims have primarily been in the Middle East , Europe , and the United States .


MuddyWater : Seedworm , TEMP.Zagros .


MuddyWater is an Iranian threat group that has primarily targeted Middle Eastern nations , and has also targeted European and North American nations .


The group 's victims are mainly in the telecommunications , government ( IT services ) , and oil sectors .


Activity from this group was previously linked to FIN7 , but the group is believed to be a distinct group possibly motivated by espionage .


Naikon is a threat group that has focused on targets around the South China Sea .


The group has been attributed to the Chinese People ’s Liberation Army ’s ( PLA ) Chengdu Military Region Second Technical Reconnaissance Bureau ( Military Unit Cover Designator 78020 ) .


While Naikon shares some characteristics with APT30 , the two groups do not appear to be exact matches .


APT39 : Chafer .


APT39 is Iranian cyber espionage group that has been active since at least 2014 .


They have targeted the telecommunication and travel industries to collect personal information that aligns with Iran 's national priorities .


APT41 is a group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity .


APT41 has been active since as early as 2012 .


The group has been observed targeting healthcare , telecom , technology , and video game industries in 14 countries .


Axiom : Group72 .


Axiom is a cyber espionage group suspected to be associated with the Chinese government .


It is responsible for the Operation SMN campaign .


Though both this group and O Winnti Group use the malware O Winnti , the two groups appear to be distinct based on differences in reporting on the groups' TTPs and targeting .


Suckfly is a China based threat group that has been active since at least 2014 .


TA459 is a threat group believed to operate out of China that has targeted countries including Russia , Belarus , Mongolia , and others .


TA505 is a financially motivated threat group that has been active since at least 2014 .


The group is known for frequently changing malware and driving global trends in criminal malware distribution .


Magic Hound : Rocket Kitten , Operation Saffron Rose , Ajax Security Team , Operation Woolen-Goldfish , Newscaster , Cobalt Gypsy , APT35 .


Magic Hound is an Iranian-sponsored threat group operating primarily in the Middle East that dates back as early as 2014 .


The group behind the campaign has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia . menuPass : Stone Panda , APT10 , Red Apollo , CVNX , HOGFISH . menuPass is a threat group that appears to originate from China and has been active since approximately 2009 .


The group has targeted healthcare , defense , aerospace , and government sectors , and has targeted Japanese victims since at least 2014 .


In 2016 and 2017 , the group targeted managed IT service providers , manufacturing and mining companies , and a university .


Moafee is a threat group that appears to operate from the Guandong Province of China .


Due to overlapping TTPs , including similar custom tools , Moafee is thought to have a direct or indirect relationship with the threat group DragonOK .


SilverTerrier is a Nigerian threat group that has been seen active since 2014 .


SilverTerrier mainly targets organizations in high technology , higher education , and manufacturing .


Operation Soft Cell is a group that is reportedly affiliated with China and is likely state-sponsored .


The group has operated since at least 2012 and has compromised high-profile telecommunications networks .


Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia , particularly government entities , since at least 2015 .


Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan , the Philippines , and Hong Kong .


Tropic Trooper focuses on targeting government , healthcare , transportation , and high-tech industries and has been active since 2011 .


Turla : Waterbug , WhiteBear , VENOMOUS BEAR , Snake , Krypton .


Turla is a Russian-based threat group that has infected victims in over 45 countries , spanning a range of industries including government , embassies , military , education , research and pharmaceutical companies since 2004 .


Heightened activity was seen in mid-2015 .


Turla is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware .


Turla ’s espionage platform is mainly used against Windows machines , but has also been seen used against macOS and Linux machines .


Winnti Group : Blackfly .


Winnti Group is a threat group with Chinese origins that has been active since at least 2010 .


The group has heavily targeted the gaming industry , but it has also expanded the scope of its targeting .


Some reporting suggests a number of other groups , including Axiom , APT17 , and Ke3chang , are closely linked to Winnti Group .


Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists , activists , and dissidents since at least 2012 .


Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates ( UAE ) government , but that has not been confirmed .


The group appears to have targeted academic institutions , but its motives remain unclear .


Strider : ProjectSauron . Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia , China , Sweden , Belgium , Iran , and Rwanda .


Putter Panda : APT2 , MSUpdater .


Rancor is a threat group that has led targeted campaigns against the South East Asia region .


Rancor uses politically-motivated lures to entice victims to open malicious documents .


The group uses a Trojan by the same name ( RTM ) .


FIN4 is a financially motivated threat group that has targeted confidential information related to the public financial market , particularly regarding healthcare and pharmaceutical companies , since at least 2013 .


FIN4 is unique in that they do not infect victims with typical persistent malware , but rather they focus on capturing credentials authorized to access email and other non-public correspondence .


FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information .


The group has been active since at least 2008 and has targeted the restaurant , gaming , and hotel industries .


The group is made up of actors who likely speak Russian .


FIN6 : ITG08 .


FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces .


This group has aggressively targeted and compromised point of sale ( PoS ) systems in the hospitality and retail sectors .


Leviathan : TEMP.Jumper , APT40 , TEMP.Periscope .


Leviathan is a cyber espionage group that has been active since at least 2013 .


The group generally targets defense and government organizations , but has also targeted a range of industries including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities in the United States , Western Europe , and along the South China Sea .


Lotus Blossom : DRAGONFISH , Spring Dragon .


Machete : El Machete .


Machete is a group that has been active since at least 2010 , targeting high-profile government entities in Latin American countries .


admin@338 is a China based cyber threat group .


It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial , economic , and trade policy , typically using publicly available RATs such as PoisonIvy , as well as some non-public backdoors .


APT1 : Comment Crew , Comment Group , Comment Panda .


APT12 : IXESHE , DynCalc , Numbered Panda , DNSCALC .


APT12 is a threat group that has been attributed to China .


The group has targeted a variety of victims including but not limited to media outlets , high-tech companies , and multiple governments .


FANCY BEAR ( also known as Sofacy or APT28 ) is a separate Russian-based threat actor , which has been active since mid 2000s , and has been responsible for targeted intrusion campaigns against the Aerospace , Defense , Energy , Government and Media sectors .


However , three themes in APT28 's targeting clearly reflects LOCs of specific interest to an Eastern European government , most likely the Russian government .


Our visibility into the operations of APT28 - a group we believe the Russian government sponsors - has given us insight into some of the government 's targets , as well as its objectives and the activities designed to further them .


APT28 is using novel techniques involving the EternalBlue exploits and the open source tool Responder to spread laterally through networks and likely target travelers .


The Sofacy threat group continues to target government organizations in the EU , US , and former Soviet states to deliver the Zebrocy tool as a payload .


Importantly , PinchDuke trojan samples alACTs contain a notable text string , which we believe is used as a campaign identifier by the Dukes group to distinguish between multiple attack campaigns that are run in parallel .


Secondly , the value the Dukes intended to gain from these MiniDuke campaigns may have been so great that they deemed it worth the risk of getting noticed .


This assertion of time zone is also supported by timestamps found in many GeminiDuke samples , which similarly suggest the group work in the Moscow Standard TIME timezone , as further detailed in the section on the technical analysis of GeminiDuke .


APT38 .


From March 18 to 26 we observed the malware operating in multiple LOCs of the world .


KONNI : A Malware Under The Radar For Years .


During this time it has managed to avoid scrutiny by the security community .


The current version of the malware allows the operator to steal files , keystrokes , perform screenshots , and execute arbitrary code on the infected host .


Talos has named this malware KONNI .


Throughout the multiple campaigns observed over the last 3 years , the actor has used an email attachment as the initial infection vector .


They then use additional social engineering to prompt the target to open a .scr file , display a decoy document to the users , and finally execute the malware on the victim's machine .


The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost .


The malware has evolved over time .


In this article , we will analyse this evolution: at the beginning the malware was only an information stealer without remote administration , it moved from a single file malware to a dual file malware (an executable and a dynamic library ) , the malware has supported more and more features over the time , the decoy documents have become more and more advanced .


The different versions contain copy/pasted code from previous versions .


Moreover the new version searches for files generated by previous versions .


This evolution is illustrated across 4 campaigns : one in 2014 , one in 2016 and finally two in 2017 .


The decoy document of the 2 last campaigns suggests that the targets are public organisations .


Both documents contained email addresses , phone numbers and contacts of members of official organizations such as United Nations , UNICEF , and Embassies linked to North Korea .


In this campaign , the dropper filename was beauty.scr .


Based on the compilation date of the two binaries , this campaign took place in September 2014 .


Once executed , two files were dropped on the targeted system : a decoy document (a picture) and a fake svchost.exe binary .


Both files were stored in "C:\Windows" .


The fake svchost binary is the KONNI malware .


The first task of the malware is to generate an ID to identify the infected system .


This ID is generated based on the installation date of the system .


The second task of malware is to ping the CC and get orders .


The malware includes 2 domains: phpschboy.prohosts.org , jams481.site.bz .


The developer used the Microsoft Winsocks API to handle the network connection .


Surprisingly , this isn't the easiest or the most efficient technical choice for HTTP connection .


The malware samples we analysed connected to only one URI: <c2-domain>/login.php .


This version of KONNI is not designed to execute code on the infected system .


The purpose is to be executed only once and steal data on the infected system , here are the main features : Keyloggers , Clipboard stealer , Firefox profiles and cookies stealer , Chrome profiles and cookies stealer , Opera profiles and cookies stealer .


The name of the .scr file was directly linked to tension between North Korea and USA in March 2016 more information .


Based on the compilation dates of the binaries , the campaign took place in the same period .


An interesting fact : the dropped library was compiled in 2014 and appears in our telemetry in August 2015 .


Indicating that this library was probably used in another campaign .


The .scr file contains 2 Office documents .


The first document was in English and a second in Russian .


In the sample only the English version can be displayed to the user (that is hardcoded in the sample) .


The Russian document is not used by the sample , we assume that the author of the malware forgot to remove the resource containing the Russia decoy document .


The malware author changed the malware architecture , this version is divided in two binaries: conhote.dll , winnit.exe .


Another difference is the directory where the files are dropped , it's no longer C:\Windows but rather the local setting of the current user (%USERPROFILE%\Local Settings\winnit\winnit.exe) .


Thanks to this modification , the malware can be executed with a non-administrator account .


The .dll file is executed by the .exe file .


In this version , a shortcut is created in order to launch winnit.exe in the following path %USERPROFILE%\Start Menu\Programs\Startup\Anti virus service.lnk .


As you can see the attacker has went to great lengths to disguise his service as a legitimate Antivirus Service by using the name 'Anti virus service.lnk' .


This is of course simple but often it can be enough for a user to miss something malicious by name .


As in the previous version , the ID of the infected system is generated with exactly the same method .


The C2 is different and the analysed version this time only contains a single domain: dowhelsitjs.netau.net .


In this version , the developer used a different API , the Wininet API which make more sense for Web requests .


Moreover the C2 infrastructure evolved too , more .php files are available through the web hosting: <c2-domain>/login.php <c2-domain>/upload.php <c2-domain>/download.php .


This version includes the stealer features mentioned in the previous version and additionally Remote Administration Tool features such as file uploading/download and arbitrary command execution .


The library is only used to perform keylogging and clipboard stealing .


Indeed , the malware author moved this part of the code from the core of the malware to a library .


An interesting element is that the malware looks for filenames created with the previous version of KONNI .


This implies that the malware targeted the same people as the previous version and they are designed to work together .


The malware internally uses the following files : solhelp.ocx sultry.ocx helpsol.ocx psltre.ocx screentmp.tmp (log file of the keylogger) spadmgr.ocx apsmgrd.ocx wpg.db .


In this campaign , the malware author uses the following name: Pyongyang Directory Group email April 2017 RC_Office_Coordination_Associate.scr. The decoy document shown after infection is an Office document containing email addresses , phone numbers and contacts of members of official organizations such as the United Nations , UNICEF , Embassies linked to North Korea .


The .scr files drops two files: an executable and a library .


As in the previous version , the persistence is achieved by a Windows shortcut (in this case adobe distillist.lnk ) .


Contrary to the previous version , the developers moved the core of malware to the library .


The executable performs the following tasks: If the system is a 64-bit version of Windows , it downloads and executes a specific 64-bit version of the malware thanks to a powershell script .


Loading the dropped library .


The library contains the same features as the previous version as well as new ones .


This version of KONNI is the most advanced with better coding .


The malware configuration contains one Command and Control: pactchfilepacks.net23.net .


A new URI is available: <c2-domain>/uploadtm.php .


This URI is used with a new feature implemented in this version: the malware is able to perform screenshot (thanks to the GDI API) and uploads it thank to this URL .


The malware checks if a file used on a previous version of KONNI is available on the system .


Here is the complete list of files internally used by the RAT: error.tmp (the log file of the keylogger) tedsul.ocx helpsol.ocx trepsl.ocx psltred.ocx solhelp.ocx sulted.ocx .


The handling of instructions has improved too .


Here are the 7 actions that the infected machine can be instructed to perform: Delete a specific file .


Upload a specific file based on a filename .


Upload a specific file based on the full path name .


Create a screenshot and uploads it on the C2 .


Download a file from the Internet .


Execute a command .


When the attacker wants to gather information on the infected system (action 5) , it retrieves the following information: Hostname IP address Computer name Username name Connected drive OS version Architecture Start menu programs Installed software .


The last identified campaign where KONNI was used was named Inter Agency List and Phonebook - April 2017 RC_Office_Coordination_Associate.scr .


This file drops exactly the same files than the previous campaign but the decoy document is different .


This document contains the name , phone number and email address of members of agencies , embassies and organizations linked to North Korea .


The analysis shows us the evolution of KONNI over the last 3 years .


The last campaign was started a few days ago and is still active .


The infrastructure remains up and running at the time of this post .


The RAT has remained under the Radar for multiple years .


An explanation could be the fact that the campaign was very limited nature , which does not arouse suspicion .


This investigation shows that the author has evolved technically (by implementing new features) and in the quality of the decoy documents .


The campaign of April 2017 used pertinent documents containing potentially sensitive data .


Moreover the metadata of the Office document contains the names of people who seems to work for a public organization .


We don't know if the document is a legitimate compromised document or a fake that the attacker has created in an effort to be credible .


Clearly the author has a real interest in North Korea , with 3 of the 4 campaigns are linked to North Korea .


Additional ways our customers can detect and block this threat are listed below .


CWS or WSA web scanning prevents access to malicious websites and detects malware used in these attacks .


The Network Security protection of IPS and NGFW have up-to-date signatures to detect malicious network activity by threat actors .


Umbrella , our secure internet gateway (SIG) , blocks users from connecting to malicious domains , IPs , and URLs , whether users are on or off the corporate network .


SHA256 : 413772d81e4532fec5119e9dce5e2bf90b7538be33066cf9a6ff796254a5225f .


Filename: beauty.scr .


SHA256 : eb90e40fc4d91dec68e8509056c52e9c8ed4e392c4ac979518f8d87c31e2b435 .


Filename: C:\Windows\beauty.jpg .


File type: JPEG image data , JFIF standard 1.02 .


SHA256 : 44150350727e2a42f66d50015e98de462d362af8a9ae33d1f5124f1703179ab9 .


Hilename: C:\Windows\svchost.exe .


File type: PE32 executable (GUI) Intel 80386 , for MS Windows .


phpschboy.prohosts.org .


jams481.site.bz .


SHA256 : 94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5 .


Filename: How can North Korean hydrogen bomb wipe out Manhattan.scr .


SHA256 : 56f159cde3a55ae6e9270d95791ef2f6859aa119ad516c9471010302e1fb5634 .


Filename: conhote.dll .


SHA256 : 553a475f72819b295927e469c7bf9aef774783f3ae8c34c794f35702023317cc .


Filename: winnit.exe .


SHA256 : 92600679bb183c1897e7e1e6446082111491a42aa65a3a48bd0fceae0db7244f .


Filename: Anti virus service.lnk . dowhelsitjs.netau.net .


SHA256 : 69a9d7aa0cb964c091ca128735b6e60fa7ce028a2ba41d99023dd57c06600fe0 .


Filename: Pyongyang Directory Group email April 2017.RC_Office_Coordination_Associate.scr .


SHA256 : 4585584fe7e14838858b24c18a792b105d18f87d2711c060f09e62d89fc3085b .


Filename: adobe distillist.lnk .


SHA256 : 39bc918f0080603ac80fe1ec2edfd3099a88dc04322106735bc08188838b2635 .


Filename: winload.exe .


SHA256 : dd730cc8fcbb979eb366915397b8535ce3b6cfdb01be2235797d9783661fc84d .


Filename: winload.dll .


Pactchfilepacks.net23.net . checkmail.phpnet.us .


Documents with the flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


Leafminer attempts to infiltrate target networks through various means of intrusion : watering hole websites , vulnerability scans of network services on the internet , and brute-force login attempts .


The EternalBlue exploits from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 .


Some of the documents exploited CVE-2017-0199 to deliver the payload .


The Leviathan generally emailed Microsoft Excel documents with malicious macros to US universities with military interests , most frequently related to the Navy .


FireEye is highlighting a Cyber Espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40 .


We assess with moderate confidence that APT40 is a state-sponsored Chinese Cyber Espionage operation .


Depending on placement , a Web shell can provide continued access to victims ' environments , re-infect victim systems , and facilitate lateral movement .


On November 10 , 2015 , threat actors sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


These emails included recruitment-themed lures and links to malicious HTML Application files .


APT34 often uses compromised accounts to conduct spear-phishing operations .


Magic Hound will often find simpler ACTs for effective compromise , such as creative phishing and simple custom malware .


Attackers can point and click their ACT through a compromised network and exfiltrate data .


The threat actor 's known working hours align to Chinese Standard TIME ( CST ) and its targeting corresponds to that of other known China-based threat actors , which supports our assessment that these campaigns are conducted by APT10 .


Moafee and DragonOK both use a well-known proxy tool – HUC Packet Transmit MAL ( HTRAN ) – to disguise their geographical locations .


We believe APT34 is involved in a long-term Cyber Espionage operation largely focused on reconnaissance efforts to benefit Iranian nation-state interests and has been operational since at least 2014 .


APT34 uses a mix of public and non-public tools and often uses compromised accounts to conduct spear-phishing operations .


Russia .


While we know the attackers used a custom dropper to install the back door , we do not know the delivery vector .


While tracking what days of the week Suckfly used its hacktools , we discovered that the group was only active Monday through Friday .


Of note , this methodology of naming abstracts aACT the " who " element – XENOTIME may represent a single discrete entity ( such as a Russian research institution ) or several entities working in coordination in a roughly repeatable , similar manner across multiple events .


CTU researchers have evidence that the TG-3390 compromised U.S. and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations .


Malware used by the threat group can be configured to bypass network-based detection ; however , the threat actors rarely modify host-based configuration settings when deploying payloads .


In addition to using SWCs to target specific types of organizations , TG-3390 uses spearphishing emails to target specific victims .


Using a U.S. based C2 infrastructure to compromise targets in the U.S. helps TG-3390 actors avoid geo-blocking and geo-flagging measures used in network defense .


CTU researchers have observed TG-3390 activity between 04:00 and 09:00 UTC , which is 12:00 to 17:00 local time in China ( UTC +8 ) .


TG-3390 uses DLL side loading , a technique that involves running a legitimate , typically digitally signed , program that loads a malicious DLL .


They then identify the Exchange server and attempt to install the OwaAuth web shell .


Emissary Panda has used many ACTs with the most notable being the exploits from the Hacking Team leak .


Taiwan has been a regular target of Cyber Espionage threat actors for a number of years .


The China-backed Barium APT is suspected to be at the helm of the project .


targeted attacks .


The developers of Bookworm use these modules in a rather unique ACT , as the other embedded DLLs provide API functions for Leader to carry out its tasks .


We believe that the IP addresses from Canada , Russia and NorACT are analysis systems of antivirus companies or security researchers .


They have different functions and ACTs of spreading , but the same purpose — to steal money from the accounts of businesses .


Periodically , the malware tries to contact the command-and-control ( C&C ) server with the username encoded into parameters .


Patchwork uses email as an entry point , which is why securing the email gateACT is important .


Talos reported that these DNS hijacks also paved the ACT for the attackers to obtain SSL encryption certificates for the targeted domains ( webmail.finance.gov.lb ) , which allowed them to decrypt the intercepted email and VPN credentials and view them in plain text .


Kessem .


attacks using this tool were still active as of April 2016 .


Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles , collaborative document editing sites , and blogs for C&C .


LEAD and Barium are not known for large-scale spear-phishing , so it is unlikely that SOC personnel would have to deal with multiple machines having been compromised by these groups at the same time .


Lurk uses a form of steganography : that's where one file is hidden aACT inside another file of a completely different sort , such as an image , audio , or video file .


" With our latest research we now see how Greenbug has shifted aACT from HTTP-based C2 communication with Ismdoor .


com to establish free subdomains in their infrastructure .


In the second set they are making use of a dynamic DNS service by ChangeIP .


com .


Upon successful exploitation , the attachment will install the Trojan known as NetTraveler using a DLL side-loading attack technique .


attacks on the chemical industry are merely their latest attack wave .


Like BlackEnergy ( a.k.a. Sandworm , Quedagh ) , Potao is an example of targeted espionage ( APT ) malware detected mostly in Ukraine and a number of other CIS countries , including Russia , Georgia and Belarus .


The ScarCruft group keeps expanding its Exfiltration targets to steal further information from infected hosts and continues to create tools for additional data Exfiltration .


Earlier this month , we caught another zero-day Adobe Flash Player exploits deployed in targeted attacks .


attacks start with spear-phishing emails that include a link to a website hosting an exploit kit associated with ScarCruft and used in other attacks .


Another set of attacks called Operation Erebus leverages another flash exploit , CVE-2016-4117 , and relies on watering hole attacks as a means of propagation .


Silence try to apply new techniques and ACTs of stealing from various banking systems , including AWS CBR , ATMs , and card processing .


The spear-phishing infection vector is still the most popular ACT to initiate targeted campaigns .


The second Windows vulnerability ( CVE-2017-0143 ) was patched in March 2017 after it was discovered to have been used by two exploit tools EternalRomance and EternalSynergy that were also released as part of the Shadow Brokers leak .


RedDrip Team (formerly SkyEye Team ) has been to OceanLotus to keep track of high strength , groupactivity , found it in the near future to Indochinese Peninsula countries since 2019 On April 1 , 2019 , RedDrip discovered a Vietnamese file name Hop dong sungroup.rar in the process of daily monitoring the attack activities of the OceanLotus . COCCOC is a Vietnam was founded in 2013 . In fact , according to reports of various security vendors , OceanLotus also attacked several countries , including Cambodia , Thailand , Laos , even some victims in Vietnam , like opinion leaders , media , real estate companies , foreign enterprises and banks . Unlike the 2016 variants of Ratsnif that stored all packets to a PCAP file . these threat actors targeted a number of government agencies threat actors targeted a number of government agencies in East Asia . Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Maudi Surveillance Operation which was previously reported in 2013 . specifically CVE-2018-0798 , before downloading subsequent payloads . The dropped PE file has the distinctive file name 8.t” . The last process is utilized as part of the loading process for Cotx RAT and involves the legitimate Symantec binary noted above . These conflicts have even resulted in Haftar leading an attack on the capital city in April . The attackers have targeted a large number of organizations globally since early 2017 . Attackers were initially discovered while investigating a phishing attack that targeted political figures in the MENA region . Group's targets include high-profile entities such as parliaments , senates , top state offices and officials , political science scholars , military and intelligence agencies , ministries , media outlets , research centers , election commissions , Olympic organizations , large trading companies , and other unknown entities . Cisco Talos recently published a blogpost describing targeted attacks in the Middle East region which we believe may be connected . Operation Parliament appears to be another symptom of escalating tensions in the Middle East region . The attackers have taken great care to stay under the radar , imitating another attack group in the region . With deception and false flags increasingly being employed by threat actors , attribution is a hard and complicated task that requires solid evidence , especially in complex regions such as the Middle East . The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware . The malware starts communicating with the C&C server by sending basic information about the infected machine . The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests . What lied beneath this facade was a well-engineered campaign of phishing attacks designed to steal credentials and spy on the activity of dozens of journalists , human rights defenders , trade unions and labour rights activists , many of whom are seemingly involved in the issue of migrants’ rights in Qatar and Nepal . We refer to this campaign and the associated actor as Operation Kingphish Malik” , in one of its written forms in Arabic , translates to King” . It is worth noting that in December 2016 , Amnesty International published an investigation into another social engineering campaign perpetrated by a seemingly fake human rights organization known as Voiceless Victims , which targeted international human rights and labour rights organizations campaigning on migrant workers’ rights in Qatar . It appears that the attackers may have impersonated the identity of a real young woman and stole her pictures to construct the fake profile , along with a professional biography also stolen from yet another person . In the course of this email correspondence , the attacker — Safeena” — then sent what appeared to be invitations to access several documents on Google Drive . The attackers were meticulous in making their phishing page as credible as possible . Among the targets of this campaign is the International Trade Union Confederation .


The PowerShell version of the Trojan also has the ability to get screenshots .


The Trojan is quite similar to the .NET RocketMan Trojan Obviously and can handle the same commands; additionally , it includes the #screen” command to take a screenshot .


Winnti mode of operation to collect information on the organizational charts of companies , on cooperating departments , on the IT systems of individual business units , and on trade secrets , obviously . Hackers usually take precautions , which experts refer to as Opsec .


The Winnti group’s Opsec was dismal to say the least . This mode of operation is typical of many hacker groups—and especially of Winnti .


By 2014 , the Winnti malware code was no longer limited to game manufacturers . Winnti is targeting high-tech companies as well as chemical and pharmaceutical companies . Winnti is attacking companies in Japan , France , the U.S. and Germany . The Winnti hackers broke into Henkel’s network in 2014 . Henkel confirms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions . Far from attacking Henkel and the other companies arbitrarily , Winnti takes a highly strategic approach . The hackers behind Winnti have also set their sights on Japan’s biggest chemical company , Shin-Etsu Chemical . In the case of another Japanese company , Sumitomo Electric , Winnti apparently penetrated their networks during the summer of 2016 . Winnti hackers also penetrated the BASF and Siemens networks . Thanks to this tool , we found out back in March 2019 that the Bayer pharmaceutical group had been hacked by Winnti . At Gameforge , the Winnti hackers had already been removed from the networks when a staff member noticed a Windows start screen with Chinese characters . To witnesses , the spy appears to be running a program showing videos , presenting slides ( Prezi ) , playing a computer game or even running a fake virus scanner .


Group-IB specialists have established that the aim of the attack was to deliver and launch the second stage of Silence’s Trojan , known as Silence.MainModule .


Silence attacked financial organisations in the UK . Silence conducted the first stage of their Asian campaign , organising a massive phishing attack aimed at receiving an up-to-date list of current recipients in different countries for further targeted attacks delivering their malicious software . The attackers used the server deployed on 6 June 2019 to control compromised workstations in these banks . On 24 March 2019 , Silence.ProxyBot ( MD5 2fe01a04d6beef14555b2cf9a717615c ) was uploaded to VirusTotal from an IP address in Sri Lanka . On October 18th , 2018 , the group sent out emails to British financial companies as part of their preparatory campaign . Group-IB experts established that the server 185.20.187.89 started functioning no later than 28 January 2019 . According to local media reports , in 2019 Silence successfully withdrew money from the Bangladeshi bank twice within 2 months . To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank . As we described in Silence: Moving into the darkside report , Silence has experience with theft using compromised card processing systems . In February 2019 , Russian media7 reported a Silence attack on IT Bank in the city of Omsk . On 16 January 2019 , Silence sent out phishing emails with malicious attachments disguised as invitations to the International Financial Forum iFin-2019 .


TA505 is also using FlowerPippi ( Backdoor.Win32.FLOWERPIPPI.A ) , a new backdoor that we found them using in their campaigns against targets in Japan , India , and Argentina . TA505 targeted Middle Eastern countries in a June 11 campaign that delivered more than 90% of the total spam emails to the UAE , Saudi Arabia , and Morroco . It fetches the same FlawedAmmyy downloader .msi file , then downloads the FlawedAmmyy payload . TA505 used Wizard (.wiz) files in this campaign , with FlawedAmmyy RAT as the final payload . On June 14 , we saw TA505’s campaign still targeting UAE with similar tactics and techniques , but this time , some of the spam emails were delivered via the Amadey botnet . It later delivered an information stealer named EmailStealer , ” which stolesimple mail transfer protocol ( SMTP ) credentials and email addresses in the victim’s machine . On June 18 , the majority of the campaign’s spam emails were sent with the subject , Your RAKBANK Tax Invoice / Tax Credit Note” or Confirmation . This campaign used the abovementioned .HTML file , malicious Excel/Word document VBA macro , the FlawedAmmyy payload , and Amadey . On June 24 , we found another campaign targeting Lebanon with the ServHelper malware . On June 17 , we observed the campaign’s spam emails delivering malware-embedded Excel files directly as an attachment . On June 20 , we spotted the campaign’s spam emails delivering .doc and .xls files . Nonetheless , these spam emails were not delivered to the UAE or Arabic-speaking users , but to banks in Asian countries such as India , Indonesia , and the Philippines . After our analysis , we found that Proofpoint reported this malware as AndroMut as well . In the campaign that targeted Japan , Philippines , and Argentina on June 20 , we found what seems to be a new , undisclosed malware , which we named Gelup . Another new malware we found that TA505 is using in their campaigns last June 20 against targets in Japan , the Philippines , and Argentina is FlowerPippi . The malicious email contains a highly suspicious sample which triggered the ZLAB team to investigate its capabilities and its possible attribution , discovering a potential expansion of the TA505 operation . The attack , as stated by CyberInt , leveraged a command and control server located in Germany related to the TA505 actor: a very active group involved in cyber-criminal operation all around the world , threatening a wide range of high profile companies , active since 2014 . The comparison of the infection chains reveals in both cases TA505 used a couple of SFX stages to deploy the RMS” software: a legitimate remote administration tool produced by the Russian company TektonIT . The TA505 group is one of the most active threat groups operating since 2014 , it has traditionally targeted Banking and Retail industries , as we recently documented during the analysis of the Stealthy email Stealer” part of their arsenal . Also , some code pieces are directly re-used in the analyzed campaigns , such as the i.cmd” and exit.exe” files , and , at the same time , some new components have been introduced , for instance the rtegre.exe” and the veter1605_MAPS_10cr0.exe” file . In 2018 , Kaspersky Labs published a report that analyzed a Turla PowerShell loader that was based on the open-source project Posh-SecMod . Turla is believed to have been operating since at least 2008 , when it successfully breached the US military . This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products . However , it is likely the same scripts are used more globally against many traditional Turla targets in Western Europe and the Middle East . In some samples deployed since March 2019 , Turla developers modified their PowerShell scripts in order to bypass the Antimalware Scan Interface ( AMSI ) .


It also reconfigures the Microsoft Sysinternals registry to prevent pop-ups when running the PsExec tool . Waterbug also used an older version of PowerShell , likely to avoid logging . In one of these campaigns , Waterbug used a USB stealer that scans removable storage devices to identify and collect files of interest . The malware then uses WebDAV to upload the RAR archive to a Box account .


The DeepSight Managed Adversary and Threat Intelligence team co-authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug ( aka Turla ) Cyber Espionage group , and methods of detecting and thwarting activities of this adversary . The DeepSight MATI team authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug Cyber Espionage group , and methods of detecting and thwarting activities of this adversary . While reviewing a 2015 report⁵ of a Winnti intrusion at a Vietnamese gaming company , we identified a small cluster of Winnti⁶ samples designed specifically for Linux⁷ . Following these reports , Chronicle researchers doubled down on efforts to try to unravel the various campaigns where Winnti was leveraged . Distinct changes to Azazel by the Winnti developers include the addition of a function named ‘Decrypt2’ , which is used to decode an embedded configuration similar to the core implant . Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits . We will see more from Zebrocy into 2019 on government and military related organizations . The PowerShell script will look at the architecture of the system to check which malicious DLL files should be downloaded . In the same year , Silence conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans . The FBI issued a rare bulletin admitting that a group named APT6 hacked into US government computer systems as far back as 2011 and for years stole sensitive data . FireEye iSIGHT Intelligence believes that APT37 is aligned with the activity publicly reported as Scarcruft and Group123 . Trend Micro attributes this activity to MuddyWater , an Iran-nexus actor that has been active since at least May 2017 . FireEye assess that the actors employing this latest Flash zero-day are a suspected North Korean group we track as TEMP.Reaper . FireEye has observed other suspected North Korean threat groups such as TEMP.Hermit employ wiper malware in disruptive attacks . On Nov14 , 2017 , FireEye observed APT34 using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East . Kaspersky reveals that APT33 is a capable group that has carried out Cyber Espionage operations since at least 2013 . APT33 is the only group that Kaspersky has observed use the DROPSHOT dropper . The Cyber Espionage group APT32 heavily obfuscates their backdoors and scripts , and Mandiant consultants observed APT32 implement additional command argument obfuscation in April 2017 . In all Mandiant investigations to date where the CARBANAK backdoor has been discovered , the activity has been attributed to the FIN7 threat group . Kaspersky released a similar report about the same group under the name Carbanak in February 2015 . FireEye assesses that APT32 leverages a unique suite of fully-featured malware . FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam’s manufacturing , consumer products , and hospitality sectors . The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on these backdoor families based on Mandiant investigations of APT32 intrusions . FireEye assesses that APT32 is a Cyber Espionage group aligned with Vietnamese government interests . In May and June 2017 , FireEye has associated this campaign with APT19 , a group that we assess is composed of freelancers , with some degree of sponsorship by the Chinese government . APT10 is a Chinese Cyber Espionage group that FireEye has tracked since 2009 . In addition to the spear phishes , FireEye ISIGHT Intelligence has observed APT10 accessing victims through global service providers . FireEye’s visibility into the operations of APT28 – a group we believe the Russian government sponsors – has given us insight into some of the government’s targets , as well as its objectives and the activities designed to further them . FireEye has tracked and profiled APT28 group through multiple investigations , endpoint and network detections , and continuous monitoring . In April 2015 , FireEye uncovered the malicious efforts of APT30 , a suspected China-based threat group . FireEye iSIGHT Intelligence has been tracking a pair of cybercriminals that we refer to as the Vendetta Brothers . Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack .


The initial indicator of the attack was a malicious Web shell that was detected on an IIS server , coming out of the w3wp.exe process .


The malware may inject itself into browser processes and explorer.exe .


The samples we identified target the ATM vendor Diebold .


There was code to download a decoy document from the Internet and open it in a second winword.exe process using the Start-Process cmdlet .


One of them – ipv4.dll – has been placed by the APT with what is , in fact , a downloader for other malicious components .


Documents with the flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


Some of the documents exploited CVE-2017-0199 to deliver the payload .


These emails included recruitment-themed lures and links to malicious HTML Application ( HTA ) files .


Upon successful exploitation , the attachment will install the Trojan known as NetTraveler using a DLL side-loading attack technique .


this RTF exploits again the CVE-2017-1882 on eqnedt32.exe .


This includes Python scripts . Usually , the Stageless Meterpreter has the Ext_server_stdapi.x64.dll” , Ext_server_extapi.x64.dll” , and Ext_server_espia.x64.dll” extensions .


we identified two methods to deliver the KerrDown downloader to targets .


we believe the iOS malware gets installed on already compromised systems , and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems .


These campaign-related VPSs are located in South Africa . The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems .


The PowerShell version of the Trojan also has the ability to get screenshots .


China Chopper contains a remote shell ( Virtual Terminal ) function that has a first suggested command of netstat an|find ESTABLISHED .


Our investigation showed that these attacks were targeted , and that the threat actor sought to steal communications data of specific individuals in various countries .


CapabilitiesFormBook is a data stealer , but not a full-fledged banker .


On November 10 , 2015 , threat actors sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


LEAD and Barium are not known for large-scale spear-phishing , so it is unlikely that SOC personnel would have to deal with multiple machines having been compromised by these groups at the same time .


This could include diplomats , experts in the LOCs of interest related to the Digital Economy Task Force , or possibly even journalists .


It is possible that CVE-2017-8759 was being used by additional actors .


The malware leverages an exploit , codenamed EternalBlue , that was released by the Shadow Brokers on April 14 , 2017 .


Some hackers even went onto use the Cisco exploits in the wild .


The Word document usually exploits CVE-2012-0158 .


The group has demonstrated access to zero-day vulnerabilities CVE-2018-0802 , and the ability to incorporate them into operations .


APT28 is using novel techniques involving the EternalBlue exploits and the open source tool Responder to spread laterally through networks and likely target travelers .


Documents with the flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


The EternalBlue exploits from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 .


Some of the documents exploited CVE-2017-0199 to deliver the payload .


The documents that exploit CVE-2017-11882 download another payload — an HTML Application ( HTA ) file toting a malicious Visual Basic ( VBS ) script — from the server , which is executed accordingly by the command-line tool mshta.exe .


Earlier this month , Securelist 's technology caught another zero-day exploits deployed in targeted attacks .


Earlier this month , we caught another zero-day Adobe Flash Player exploits deployed in targeted attacks .


Another set of attacks called Operation Erebus leverages another flash exploit , CVE-2016-4117 , and relies on watering hole attacks as a means of propagation .


One vulnerability is a Windows zero-day vulnerability ( CVE-2019-0703 ) discovered by Symantec . Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers .


The second Windows vulnerability ( CVE-2017-0143 ) was patched in March 2017 after it was discovered to have been used by two exploit tools—EternalRomance and EternalSynergy—that were also released as part of the Shadow Brokers leak .


The zero-day vulnerability found and reported by Symantec CVE-2019-0703 occurs due to the ACT the Windows SMB Server handles certain requests .


this RTF exploits again the CVE-2017-1882 on eqnedt32.exe .


OSX Malware Linked to Operation Emmental Hijacks User Network Traffic .


The OSX_DOK malware ( Detected by Trend Micro as OSX_DOK.C ) showcases sophisticated features such as certificate abuse and security software evasion that affects machines using Apple ’s OS X operating system .


This malware , which specifically targets Swiss banking users , uses a phishing campaign to drop its payload , which eventually results in the hijacking of a user ’s network traffic using a Man-in-the-Middle ( MitM ) attack .


OSX_DOK.C seems to be another version of WERDLOD ( Detected by Trend Micro as TROJ_WERDLOD Family ) , which is a malware that was used during the Operation Emmental campaigns—an interesting development that we will tackle further in this blog post .


OSX_DOK.C first arrives via a phishing email that contains certain files labeled as either .zip or .docx files .


The sample we analyzed was a purported message from a police inspector in Zurich allegedly claiming to unsuccessfully contact the recipient .


The email also comes with two files attached claiming to contain questions for the user : one is a .zip file , which is a fake OS X app , while the other is a .docx file used to target Windows operating systems using WERDLOD .


Both of these samples work as Banking Trojans and provide similar functionalities .


Some examples of the files used in the email attachment include the following :


Zahlungsinformationen 01.06.2017.zip .


Zahlungsinformationen digitec.zip .


Dokument 09.06.2017.zip .


Dokument 09.06.2017.docx .


06.2017.docx .


Once the docx file included in the phishing email is clicked , a warning window will pop up .


After this , the App Store on the system will be removed , followed by a full screen fake OS X update screen .


It will ask for a password to run command as root .


The malware will begin to download other utilities .


It relies on Homebrew , an open source software package manager to install Golang and Tor .


The malware will then install fake certificates in the system to perform a MitM attack without notifying the user .


The structure of the fake App Store matches the application bundle structure and provides both English and German interfaces .


The archive in Mac OS X looks like this :


Mac OS X will run the application if it passes certificates .


In this case , the malware is signed off by a “ developer ” , which may actually be a dummy account or that of a compromised user .


In addition , the time stamp on the CA is new , which might mean that it was obtained specifically for this attack .


The fake certificate imitates the COMODO root certificate .


Take note that the fake certificate does not contain a COMODO Certificate Authority seal that certifies its validity , as seen in the comparison below :


We noticed that this malware will not work for Mozilla Firefox or Google Chrome since these two browsers have their own root certificates .


Of all the major browsers , only Safari uses the system ’s certificates .


We observed the attacker targeting both Windows and Mac OS X in the same spam mail on June 9 , 2017 .


There is a file shortcut embedded in the malicious .docx file—one that will download an executable file from Dropbox that executes once clicked by the user .


The functionalities are similar to the malicious app provided , which includes installing tor and proxy .


We have already notified Dropbox about the use of its service for this malware .


Dropbox has already taken down the links .


The malware will install two proxies running on local host port 5555 and 5588 .


All of the traffic will be hijacked into the first proxy ( port 5555 ) with the victim ’s external IP address as parameter .


The first ( port 5555 ) proxy first finds the IP parameter .


If it is not in Switzerland , the traffic will proceed as normal .


If it detects an IP located in Switzerland , the malware will run an obfuscated JavaScript code and find its visiting domain .


If the domain is in the target , the malware will perform a MitM attack and redirect the traffic to the second proxy ( port 5588 ) , which routes the traffic to the Tor network .


The purpose of these steps is to target users in Switzerland and hijack their traffic After deobfuscating the malware , we found the target domains :


The target domain ’s visitors will be redirected into an e-banking login page that looks and acts normally , but is located on dark web sites .


However , once the victim enters an account and password .


A window will pop out .


The pop-out window is just smoke and mirrors , where nothing actually happens once the countdown timer reaches zero .


We analyzed the webpage and found attackers injecting a script into the webpage .


Once the user enters an account and password , it will initiate POST using AJAX .


The POST message is sent to the same site as the fake login page—which an attacker can control inside the Tor network .


We decoded the data section and found not only the account and password , but that it also fingerprinted the user ’s browser and system information .


While Operation Emmental was able to bypass two-way authentication by tricking its victims into installing a fake app , we have not observed OSX_DOK.C doing this .


However , since they can inject code into the webpage , it means they have the ability to do this as well .


We performed static analysis on the sample and found it packed by Ultimate Packer for Executables ( UPX ) , an open source executable packer that can often be abused by malware .


We successfully unpacked the initial sample we found dropped by the UPX unpacker .


The malware is not obfuscated so we easily found interesting strings here .


We can see that the malware relies on bash shell for most of its setup .


We were not able to unpack the sample discovered after June 9 , 2017 .


The UPX gave a warning message about memory buffer overflow .


The malware author seemingly made unpacking the malware more difficult to slow down or even evade the antivirus engine ’s scanning process .


The packer is the same but the malware tries to exploit the undiscovered bug in the UPX library that causes unpack failure .


We have reported the issues to the UPX team , and they have already fixed it .


While OSX_DOK.C is designed for MAC OS X , which is a Unix-like system , WERDLOD is designed for Windows .


Both malware share the same proxy settings and script :


In particular , WERDLOD uses scripts running on http://127.0.0.1:5555/#{random_string}.js?ip=#{my_ip} as proxy :


Both malware have similar targets .


Detecting threat actors in recent German industrial attacks with Windows Defender ATP .


We then discuss how centralized response options , provided as enhancements to Windows Defender ATP with the Windows 10 Creators Update , can be used to quickly stop threats , including stopping command and control ( C&C ) communication and preventing existing implants from installing additional components or from moving laterally to other computers on the network .


Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles , collaborative document editing sites , and blogs for C&C .


The majority of victims recorded to date have been in electronic gaming , multimedia , and Internet content industries , although occasional intrusions against technology companies have occurred .


In contrast , LEAD has established a far greater reputation for industrial espionage .


Backdoor command and control .


Credential theft .


Winnti is no exception , and so , during Winnti ’s installation process , Windows Defender ATP is able to raise behavioral alerts .


Meanwhile , connectivity to the Windows Defender ATP service is maintained .


The initial infection vector in this attack is not clear , but it results in installing the “ Downeks ” downloader , which in turn infects the victim computer with the “ Quasar ” RAT .


We observed these Quasar samples :


f-secure.exe : 99a7cb43fb2898810956b6137d803c8f97651e23f9f13e91887f188749bd5e8f connects to hnoor.newphoneapp.com .


HD_Audio.exe : 86bd78b4c8c94c046d927fb29ae0b944bf2a8513a378b51b3977b77e59a52806 crashes upon execution . sim.exe 723108103ccb4c166ad9cdff350de6a898489f1dac7eeab23c52cd48b9256a42 connects to hnoor.newphoneapp.com .


We analyzed a Quasar sample we found that was communicating with an active C2 server at the time of analysis :


We discovered that the sample was obfuscated using .NET reactor .


The configuration of Quasar is stored in the Settings object , which is encrypted with a password which is itself stored unencrypted .


Modifications :


Uses SHA256 instead of MD5 to create the key .