The document files exploit at least three known vulnerabilities in Microsoft Office , which we discuss in the Infection Techniques section . It came in the form of a " Tran Duy Linh " CVE-2012-0158 exploit kit document MD5 : de8a242af3794a8be921df0cfa51885f61 and was observed on April 10 , 2014 .


During the investigation , Talos was also able to determine that the same infrastructure has been used to deploy similar campaigns using different versions of the malware . Given the level of client network access MSPs have , once APT10 has gained access to a MSP , it is likely to be relatively straightforward to exploit this and move laterally onto the networks of potentially thousands of other victims . OceanLotus : worker.baraeme.com:8531 11b4 . The UK ’s National Cyber Security Centre ( NCSC ) assesses that the Russian Military Intelligence was almost certainly involved in the 13 January defacements of Ukrainian government websites and the deployment of Whispergate destructive malware .


However , Ryuk is only used by GRIM SPIDER and , unlike Hermes , Ryuk has only been used to target enterprise environments . Beginning in 2009 , we've observed this actor conduct more than 40 unique campaigns that we've identified in the malware configurations' campaign codes .


We expect this list to grow given that this actor has changed its infrastructure numerous times in 2017 . In August 2014 , some of our users observed targeted attacks with a variation of CVE-2012-0158 and an unusual set of malware . We have observed 767 separate instances in which APT1 intruders used the publicly available “ HUC Packet Transmit Tool ” or HTRAN on a hop . Greatness incorporates features seen in some of the most advanced PaaS offerings , such as multi - factor authentication ( MFA ) bypass , IP filtering and integration with Telegram bots .


The instances we observed , however , used the DDE exploit to deliver different payloads than what was observed previously .


There have been numerous reports of hTran being used by different Chinese threat actors , including : APT3 , APT27 and DragonOK . We noted in our original blog the large amount of targeting of Iranian citizens in this campaign , we observed almost one-third of all victims to be Iranian .


In this figure we have 11 RuMMS samples , all of which were hosted on the website as shown in the “ y ” axis . This threat group has conducted broad targeting across a variety of industries , including financial , government , energy , chemical , and telecommunications . The second document from the beginning of January is named " fb.docx " and contains usernames and passwords from an alleged " Facebook " leak . This rule was designed to match the decoded URI of any incoming request with the regex , so when the decoded URI matches this regex , the request is dropped .


The following scenario may play out : according to the templates for processing incoming SMSs , Rotexy intercepts a message from the bank that contains the last four digits of the bank card connected to the phone number . We speculate that other attacks delivering Bookworm were also targeting organizations in Thailand based on the contents of the associated decoys documents , as well as several of the dynamic DNS domain names used to host C2 servers that contain the words " Thai " or " Thailand " . Some of the documents exploited CVE-2017-0199 to deliver the payload .


The result is a large online population who have been the subject of numerous cyber-attacks in the past . More details about TajMahal are available to customers of the Kaspersky Intelligence Reporting service (contact intelreports@kaspersky.com) . In March 2014 , the group leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank .


Exodus : New Android Spyware Made in Italy Mar 29 Summary We identified a new Android spyware platform we named Exodus , which is composed of two stages we call Exodus One and Exodus Two . Repeated targeting of Middle Eastern financial , energy and government organizations leads FireEye to assess that those sectors are a primary concern of APT34 . It uses minimal obfuscation applied only on variables and function naming . In terms of the fallout , it ’s tough to overstate the havoc Cl0p was able to wreck thanks to the zero - day .


There are connections between a subset of the group's operational infrastructure and PRC-based Internet service providers .


This trojan 's design and implementation is of an uncommonly high level , making it a dangerous threat . The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations . APT38 's operations began in February 2014 and were likely influenced by financial sanctions enacted in March 2013 that blocked bulk cash transfers and restricted North Korea 's access to international banking systems .


Based on the public blog post – which also indicated that FireEye is responding to an intrusion at a second facility featuring the same or similar observations – this is presumably not for lack of evidence , yet the “ downgrade ” occurs all the same .


The abuse of the WebSocket protocol provides XLoader with a persistent connection between clients and servers where data can be transported any time . To make the fraudulent withdrawals , Lazarus first breaches targeted banks' networks and compromises the switch application servers handling ATM transactions . This may indicate the campaign is still ongoing .


The final step in the trojan 's initialization is the escalation and maintenance of privileges in the device . ITG08 is an organized cybercrime gang that has been active since 2015 , mostly targeting pointof-sale (POS) machines in brick-and-mortar retailers and companies in the hospitality sector in the U.S. and Europe . ScarCruft is a relatively new APT group , victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania .


This brought to us the hypothesis that this might be a version used by the group behind ViceLeaker for internal communication or for other , unclear purposes . We confirmed that this is a DarkHydrus Group's new attack targeting Middle East region . The ScarCruft has shown itself to be a highly-skilled and active group .


ORat is the name assigned by the malware author , as denoted by the program debug database string in the analyzed sample : D:\vswork\Plugin\ORat\build\Release\ORatServer\Loader.pdb .


In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company . The spear phishing emails used in the known attacks by the Callisto Group were so convincing that even skilled and alert users would likely have attempted to open the malicious attachment .


Palo Alto Networks has noted and described the differences of two malware agents developed in parallel , with commonalities in behavior but differing functionalities ; families described as Infy and Infy M. Our primary observation was of the Infy ( non-M ) malware , which primarily functions as a keylogger for the collection of account credentials . As explained later , we believe this campaign is financially-motivated and that it targets accounting departments in Russian businesses .


It uses different topics that include the unique device identifier , which side is sending the message , and whether it is information message or command . From mid-2016 through early 2017 , APT33 compromised a U.S. organization in the aerospace sector and targeted a business conglomerate located in Saudi Arabia with aviation holdings . They most likely used the Qt Creator IDE in a Windows . The email address admin@93[.]gd is linked to IP addresses owned by a certain user with the nickname “ PIG GOD”—another


Reverse shell payload The payload is started by the main module with a specified host and port as a parameter that is hardcoded to ‘ 54.67.109.199 ’ and ‘ 30010 ’ in some versions : Alternatively , they could be hardcoded directly into the payload code : We also observed variants that were equipped with similar reverse shell payloads directly in the main APK /lib/ path . The group was first revealed and named by SkyEye Team in May 2015 . The group has targeted healthcare , defense , aerospace , and government sectors , and has targeted Japanese victims since at least 2014 .


The extracted executable file contains a compiled Autoit script , which can be seen in the RT_RCDATA section of the file .


This could indicate that actor already has plans in expanding the targets to applications from different countries and regions . Most interestingly , Rapid7 observed the use of the Notepad++ updater gup.exe as a legitimate executable to sideload a malicious DLL (libcurl.dll) in order to deploy a variant of the UPPERCUT backdoor also known as ANEL . An overview of the connections among these threats is discussed in below .


The final payload ( dd03c6eb62c9bf9adaf831f1d7adcbab ) is implanted manually as in the WFCWallet case .


I hope that by uncovering this malware at such an early stage , we will be able to prevent a massive and dangerous attack when the attackers are ready to actively use their methods . In the case of Octopus , DustSquad used Delphi as their programming language of choice , which is unusual for such an actor . These operators , like soldiers , may merely be following orders given to them by others . Its code identifies the victim ’s browser and then serves one of two exploits .


We were able to discover this particular version by diving further into connections to analytics-google.org .


The opcode instructions generated by this custom VM are divided into different categories : Logical opcodes , which implement bit-logic operators ( OR , AND , NOT , XOR ) and mathematical operators Conditional branching opcodes , which implement a code branch based on conditions ( equals to JC , JE , JZ , other similar branching opcodes ) Load/Store opcodes , which write to or read from particular addresses of the virtual address space of the process Specialized opcodes for various purposes , Our evidence suggests that malware authors created Emissary as early as 2009 , which suggests that threat actors have relied on this tool as a payload in cyber-espionage attacks for many years . However , there is a downside of using such a technique : once the scheme is uncovered , the attacker loses control and computers can be cleaned through regular updates . What ’s more , two other vulnerabilities in MOVEit were found while new victims were still coming forward .


Next , the loader checks that it ’ s not running in a virtualized environment ( VMWare or Hyper-V ) or under a debugger . Evidence also suggests that APT32 has targeted network security and technology infrastructure corporations with connections to foreign investors . ae1b6f50b166024f960ac792697cd688be9288601f423c15abbc755c66b6daa4 Malware/Backdoor 659 KB ( 674 , 816 bytes ) PE32 executable for MS Windows ( DLL ) ( console ) Intel 80386 32-bit September 2018 . Getting access to the C2 information helped the researchers get a clear view of the attacker 's operations and utilities .


The certificates Blackfly stole were also from South Korean companies , primarily in the video game and software development industry .


The threat actor Rocke was originally revealed by Talos in August of 2018 and many remarkable behaviors were disclosed in their blog post . Wild Neutron hit the spotlight in 2013 , when it successfully infected companies such as Apple , Facebook , Twitter and Microsoft .


Secureworks Counter Threat Unit ( CTU ) researchers have observed BRONZE PRESIDENT activity since mid-2018 but identified artifacts suggesting that the threat actors may have been conducting network intrusions as far back as 2014 .


The original app looks innocent , with most of its code aimed at implementing the real features that the app claims to provide . Based on incident response investigations , product detections , and intelligence observations along with additional publications on the same operators , FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests . Word Dropper Variant cc5a14ff026ee593d7d25f213715b73833e6b9cf71091317121a009d5ad7fc36 7ce3d9fc86396fac9865607594395e94 Word Dropper Variant 28a8d6b8a0cdcb25d098e403cc8b6dcb855cb591f0b54c2e3363b5c580d92b28 74c7aed44680100e984251ce2cdbdbc6 Word Dropper Variant facbc2cb089668197ca3968a3433b6f4826430c13f7d1c75b44667307c67dfe3 10f308d78adda567d4589803ce18cc9b Word Dropper Variant e714a5147335245c386b105bb7494a8b190b6a737ba28f029561efe48105cd11 f279d0f04874327b85221697d99de321 Word Dropper Variant 56c46ef3d5bd544fa35f6e336d3be93cf36e72d0273fa1dbc915979f2d883e9d bc1b322e7efc19417ab0d0524ccb9ff2 . Mandiant has observed overlap amongst multiple North Korean groups that fall under the RGB .


Yet our statistics says that about 60 % of Android users are still sitting with Android 4.4.2 and below . The zero-day vulnerability found and reported by Symantec (CVE-2019-0703) occurs due to the way the Windows SMB Server handles certain requests . The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 .


C&C : The command and control channel that serves to relay commands between the installed malware and attackers .


In some samples , starting from January 2016 , an algorithm has been implemented for unpacking the encrypted executable DEX file from the assets folder . Some of the documents exploited CVE-2017-0199 to deliver the payload . Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs .


Once BARIUM has established rapport , they spear-phish the victim using a variety of unsophisticated malware installation vectors , including malicious shortcut ( .lnk ) files with hidden payloads , compiled HTML help ( .chm ) files , or Microsoft Office documents containing macros or exploits .


The Lookout Threat Intelligence team identified that this same Facebook profile has also posted Google Drive links to Android malware belonging to the FrozenCell family attributed to APT-C-27 . This recent attack against an online casino in Central America suggests that hacking tools from the Lazarus toolset are recompiled with every attack ( we didn't see these exact samples anywhere else ) . In this case, the Trustwave Secure email Gateway flagged the message as suspicious and it did not get . Based on our research , we discovered an unknown threat actor using MortalKombat ransomware since December 2022 to target individuals and smaller companies .


The second function is http : //s.psserviceonline [ . BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded .


These accounts are created by abusing accessibility services . By analyzing the attack infrastructure , Group-IB identified that MoneyTaker group continuously exfiltrates internal banking documentation to learn about bank operations in preparation for future attacks . Foreword ” . In March 2021 , in a separate environment , we observed a threat actor utilize one or more vulnerabilities to place at least one web shell on the vulnerable Exchange Server .


Get installed applications GET_CONTACTS Get contacts SEND_BULK_SMS Send SMS to multiple numbers UPDATE_APK Not implemented INJECT_PACKAGE Add new overlay target CALL_FORWARD Enable/disable call forwarding START_PERMISSIONS Starts request for additional permissions ( Accessibility privileges , battery optimizations bypass , dynamic permissions ) Features The most recent version of Ginp has the same capabilities as most other Android banking Trojans , such as the use of overlay attacks , SMS control and contact In all three incidents , APT10 gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials . Symantec reported that Tick exploited additional Adobe Flash and Microsoft Office vulnerabilities .


Once installed on a device FrozenCell is capable of : Recording calls Retrieving generic phone metadata ( e.g. , cell location , mobile country code , mobile network code ) Geolocating a device Extracting SMS messages Retrieving a victim 's accounts Exfiltrating images Downloading and installing additional applications Searching for and exfiltrating pdf , doc , docx , ppt , pptx , xls , and xlsx file types Retrieving contacts The graph below represents a split of the types of data The fact that the cybercriminals behind GozNym have already adapted the Trojan for three different languages and in countries which have different banking systems is unique , according to Kessem . APT1 . Threat actors have been using this business model for a decade - plus , originally known as commodity malware .


Busybox payload Busybox is public software that provides several Linux tools in a single ELF file . The attackers have targeted a large number of organizations globally since early 2017 . Heightened activity was seen in mid-2015 .


However , in addition to the traditional functionality , there were also backdoor capabilities such as upload , download , delete files , camera takeover and record surrounding audio . A previous campaign of this APT group was uncovered by Talos in June 2017 , and since then very little of this operation was seen in the wild . When uploading stolen data to a cloud service , it uses predefined directory path such as /english , /video or /scriptout .


CN Tel . However , to increase success rates APT20 can use zero-day exploits , so even a properly patched system would be compromised . Victims of BlackOasis have been observed in the following countries : Russia , Iraq , Afghanistan , Nigeria , Libya , Jordan , Tunisia , Saudi Arabia , Iran , Netherlands , Bahrain , United Kingdom and Angola .


Comparison of code of Asset file before and after decryption Figure 11 . APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets . The image file has been correctly identified by SEG as a PNG when its file extension is .jpg denoting a JPEG formatted . None on the CrowdStrike Falcon ® console and of the market - leading CrowdStrike Falcon ® platform in action .


Once they have access to the network , they steal the organization's legitimate SSL certificate and use it on actor-controlled servers . We suspect this router was hacked as part of the campaign in order to process the malware 's HTTP requests .


Possible impacts include : temporary or permanent loss of sensitive or proprietary information , disruption to regular operations , financial losses incurred to restore systems and files , and potential harm to an organization 's reputation .


We confirmed that the tool did not expose vulnerabilities in the management technology itself , but rather misused AMT SOL within target networks that have already been compromised to keep communication stealthy and evade security applications . From late April to early May , the attackers focused on human rights related NGOs .


Conclusion Smishing ( SMS phishing ) offers a unique vector to infect mobile users . Based on previously observed tactics , it is highly likely the OilRig group leveraged credential harvesting and compromised accounts to use the government agency as a launching platform for their true attacks . The decoded base64 data is an AutoIT binary . Instead , it appeared that corresponding requests were made directly through the Outlook Web Application ( OWA ) endpoint , indicating a previously undisclosed exploit method for Exchange .


TA459 is well-known for targeting organizations in Russia and neighboring countries .


The spear-phishing emails used by the Dukes may contain either specially-crafted malicious attachments or links to URLs hosting the malware .


The app then clicks the appropriate buttons , scrollbars , and other UI elements to go through account sign-up without user intervention . At this point , the current attack campaign against the chemical industry began . FireEye Threat Intelligence assesses that APT17 , a China based threat group , was behind the attempt . The track controlling commands issued may have also resulted in tram collisions , a further risk to those on board and nearby the areas of impact .


BRONZE PRESIDENT has deployed a variety of remote access tools .


If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs . Just like last time , Buhtrap is spreading through exploits embedded in news outlets .


It then sends the aggregated log back to the C2 server .


EVENTBOT VERSION 0.3.0.1 Additional Assets Based on Country / Region EventBot-23aEventBot Spanish and Italian Images in Spanish and Italian added in version 0.3.0.1 . We assume that RunPow stands for run PowerShell , ” and triggers the PowerShell code embedded inside the .dll file . Once connected to the VPN , APT35 focused on stealing domain credentials from a Microsoft Active Directory Domain Controller to allow them to authenticate to the single-factor VPN and Office 365 instance .


There are a ton of functions that are clearly decoding information from arrays after which it executes an already decoded PowerShell command .


The latest version is analyzed here ; we weren ’ t able to determine if the earlier versions were also malicious . During this attack , we found that the SLUB malware used two Slack teams sales-yww9809” and marketing-pwx7789 . The first class , colloquially known as " wipers " , are a class of malware has the primary intent of destroying data on a victim 's machine .


] 31 162.243.172 [ . In the 2018 public posting announcing TEMP.Veles , FireEye researchers noted that the institute in question at least supported TEMP.Veles activity in deploying TRITON . In our analysis , we reviewed the TTPs and the decoy content , and pointed out the similarities between previous attacks that have been attributed to MoleRATs , an Arabic-speaking , politically motivated group that has operated The email address admin@93[.]gd is linked to IP addresses owned by a certain user with the nickname “ PIG GOD”—another


However , we did find a single shared IP address demonstrably connecting the Downeks downloader and Quasar C2 infrastructure .


Kaspersky products detect the above-described threat with the verdict Trojan-Banker.AndroidOS.Riltok . Trend Micro has previously reported the use of this malware in targeted attacks by the BlackTech group , primarily focused on cyber-espionage in Asia . An interesting element is that the malware looks for filenames created with the previous version of KONNI .


It has similar functionality to the ‘ AndroidMDMSupport ’ command from the current versions – stealing data belonging to other installed applications . Operation Parliament appears to be another symptom of escalating tensions in the Middle East region . Winnti Group is a threat group with Chinese origins that has been active since at least 2010 .


Upon conclusion of our investigation , we shared this information with the manufacturers of the specific devices involved and they have used this event to explore new protections in their products .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . Xagent” is the original filename Xagent.exe whereas seems to be the version of the worm .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . While we were unable to recover the initial vulnerability used , it is possibly the same CVE-2014-0515 Adobe Flash exploit first reported by Cisco TRAC in late July .


The attachment in these emails is a weaponized Microsoft Office document containing a malicious macro that – when enabled – leads to the download of Hancitor . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including embassies .


While recent Zebrocy versioning was 7.1 , some of the related Zebrocy modules that drop file-stealing MSIL modules we call Covfacy were v7.0 .


Triada : organized crime on Android 2 . CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 . In this latest campaign , APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER .


] 144 [ . APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea . In the case of old Windows versions like XP , main module events.exe runs an edited XPTask.vbs Microsoft sample script to create a weekly scheduled task for . The duration of manipulation may be temporary or longer sustained , depending on operator detection .


Exfiltrate Chrome browser history ( limited to a given date ) 7 reqsmscal.php Exfiltrate memory card file structure 8 reqsmscal.php Record surrounding sound for 80 seconds 1 reqcalllog.php Exfiltrate all call logs 2 reqcalllog.php Exfiltrate all SMS messages 3 reqcalllog.php Upload specified file from the device to the C2 4 reqcalllog.php Download file from specified URL and save on device 5 reqcalllog.php Delete specified file 6,7,8 reqcalllog.php Commands not yet In this sample , however , the module names were changed from actors and characters’ names to car models , namely BMW_x1” , BMW_x2” and up to BMW_x8” . This malware is responsible for stealing Bluetooth device information .


In October 2017 , AhnLab published a report called " Operation Bitter Biscuit " , an attack campaign against South Korea , Japan , India and Russia using Bisonal and its successors , Bioazih and Dexbia . Additionally the reports on Carbanak show a different picture , where banks targeted outside of Russia , specifically Europe , USA and Japan are mentioned , which does not match our research .


At this time , we do not believe that the attackers found a new ASA exploit . However , in the same week of September a series of spearphishing attempts once again targeted a set of otherwise unrelated individuals , employing the same tactics as before .


To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East .


The simpler one will connect to a hardcoded C&C server over HTTP or HTTPS to download commands to execute .


We identified infrastructure overlaps and string references to previous Wolf Research work . According to the German press , the intruders used the Winnti family of malware as their main implant , giving them persistent access to the conglomerate 's network as early as February 2016 . In addition , the IXESHE attackers conducted two specific attacks that leveraged zero-day exploits—one in 2009 and another in 2011 . In addition to the complexity of managing CSP rules , this vulnerability shows how widely used services such as Google Analytics can be subverted to bypass this protection .


Use of the virtual machine brings many technical benefits to the operators , chief among them allowing the malware to install apps without requiring users to approve a list of elevated permissions . DDoS malware floods a target 's network-connected service with an excessive number of request at once in order to overload the capacity of the server . The malware also features a destructive component , which can wipe the master boot record of an infected computer . Beyond Ukraine , the group continues to sustain espionage operations that are global in scope and illustrative of the Russian military 's far - reaching ambitions and interests in other regions .


After investigation , QiAnXin suspect this attack is carried out by Molerats . It contains a Word document in plaintext ( written to Bienvenue_a_Sahaja_Yoga_Toulouse.doc ) , along with an executable ( Update.exe ) and DLL ( McUpdate.dll ) .


PinchDuke will also search for files that have been created within a predefined timeframe and whose file extension is present in a predefined list .


The researchers wrote : While profit is powerful motivation for any attacker , Yingmob ’ s apparent self-sufficiency and organizational structure make it well-positioned to expand into new business ventures , including productizing the access to the 85 million Android devices it controls . FBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation . APT33 : 64.251.19.214 mynetwork.ddns.net . Another example would be that of a person selling illicit products on the dark web .


When done , the bot is functional and ready to receive commands and perform overlay attacks . In the blog , Intrusion Truth identified APT10 as having utilized several Tianjin-based companies , including Huaying Haitai Science and Technology Development Co Ltd and Laoying Baichen Instruments Equipment Co Ltd . These domains were registered through the privacy protection services in 2008 and 2011 .


Evolution of Rotexy 2014–2015 Since the malicious program was detected in 2014 , its main functions and propagation method have not changed : Rotexy spreads via links sent in phishing SMSs that prompt the user to install an app . This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON , which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics . Since they first emerged back in 2007 with a series of cyberespionage attacks against the South Korean government , these threat actors have successfully managed to pull off some of the most notable and devastating targeted attacks—such as the widely-reported 2014 Sony hack and the 2016 attack on a Bangladeshi bank—in recent history .


CTU researchers identified a variety of post-compromise tools stored under %AppData% ( e.g. , \AppData\Roaming\Temp ) on several compromised systems .


This instruction is especially important for malware that tries to avoid user interaction by running in the background as a service . The actors frequently use the stolen data to create cloned physical cards , which they use to attempt to withdraw funds from ATMs . Clearly , OilRig incorporates a testing component within their development process , as we have previously observed OilRig performing testing activities on their delivery documents and their TwoFace webshells .


We will continue to monitor this ransomware family to ensure customers are protected and to share our findings and insights to the community for broad protection against these evolving mobile threats . Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . considering multiple control flow dispatchers and various jump cases for control flow flattening . The leaked tooling included a Python script , , that when executed led CrowdStrike researchers to replicate the logs generated in recent Play ransomware attacks .


To illustrate the level of threat the DEFENSOR ID app posed , we performed three tests . This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products . HIDDEN COBRA actors install the FALLCHILL malware to establish persistence .


At runtime , the packer decompresses the resource and uses Reflection to load the assembly , find its Entry point , and Invoke it .


With the Kelihos spam botnet no longer in operation and Levashov behind bars , multiple criminal operators turned to different spam botnets to distribute their crimeware . While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


Depending on placement , a web shell can provide continued access to victims ' environments , re-infect victim systems , and facilitate lateral movement . A Trojan sending a build identifier to its C2 server is quite common , as it notifies the threat actors of the specific version of the Trojan in which they are interacting .


Kaspersky Lab’s experts calculated the amount of stolen data stored on NetTraveler’s C&C servers to be more than 22 gigabytes . Backdoors are installed in infected systems and SectorJ04 also distributed email stealers , botnet malware and ransomware through those backdoors . Backdoor installed in the infected system distributed additional botnet malware , ransomware and email stealers . SectorJ04 was recently confirmed to use additional backdoor called AdroMut and FlowerPippi , which is used to install other backdoor such as FlawedAmmy RAT on behalf of the MSI file , or to collect system information and send it to the attacker’s server . Although the SectorJ04 group mainly targeted countries located in Europe or North America , it has recently expanded its field of activities to countries located in Southeast Asia and East Asia . The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format . A new type of backdoor called AdroMut and a new malware called FlowerPippi was also found coming from SectorJ04 . But after 2019 SectorJ04 has changed its hacking strategy to attack using spam email . The hacking activities of SectorJ04 group , which targeted South Korea in the first half of 2019 , have been continuously discovered . Prior to 2019 , the SectorJ04 group conducted large-scale hacking activities for financial gain using exploit kits on websites to install ransomware , such as Locky and GlobeImporter , along with its banking Trojan , on its victims computers . In June 2019 , continuous SectorJ04's activities targeting South Korea were found again and spam emails were written with various contents , including transaction statements , receipts and remittance cards . The SectorJ04 group has carried out large-scale hacking activities targeting South Korea , while also expanding the field of attacks to Southeast Asian countries such as Taiwan and the Philippines . In June , SectorJ04 group conducted hacking using spam emails written in various languages , including English , Arabic , Korean and Italian , and the emails were written with various contents , including remittance card , invoice and tax invoice . Spam emails and attachments written in Chinese were found in May , and the SectorJ04 group at that time targeted industrial sectors such as electronics and telecommunications , international schools and manufacturing . In addition to their preexist backdoor , ServHelper and FlawedAmmy , they have also been confirmed to use the backdoor called AdroMut and FlowerPippi . AdroMut downloads the malware ServHelper and FlawedAmmy RAT used by the SectorJ04 group from the attacker server and simultaneously performs the functions of a backdoor . The SectorJ04 group , which has been utilizing the same pattern of infection and the same malware for more than six months , is believed to be attempting to change its infection methods such as downloading malware directly from malicious documents without using MSI installation files , changing their spam email format and using new types of backdoor . Until 2019 , SectorJ04 group had carried out massive website-based hacking activities that mainly utilize ransomware and banking trojans for financial profit , and has also been carrying out information gathering activities to secure attack resources such as email accounts and system login information from users since 2019 . The SectorJ04 group has shown a pattern of hacking activities that have changed from targeted attacks to a large-scale distribution of spam . This allows them to expand their range of targets of hacking activities for financial profit , and in this regard , SectorJ04 group has been found to have hacked into a company’s internal network by using a spear phishing email targeting executives and employees of certain South Korean companies around February 2019 . SectorJ04 group carried out intensive hacking on various industrial sectors , including South Korea’s media , manufacturing and universities , around February and March 2019 . SectorJ04 used the spear phishing email to spread malicious Excel or malicious Word files , and downloaded the MSI files from the attacker’s server when the malicious documents were run . SectorJ04 group conducted hacking activities targeting financial institutions located in India and Hong Kong around April 2019 . SectorJ04 group carried out hacking activities targeting financial institutions located in Italy and other countries around May 2019 . In late July , SectorJ04 group used FlawedAmmy RAT to carry out hacking attacks on companies and universities in sectors such as education , job openings , real estate and semiconductors in South Korea . In early August , the SectorJ04 group carried out extensive hacking activities targeting the users around the world , including South Korea , India , Britain , the United States , Germany , Canada , Argentina , Bangladesh and Hong Kong . Spam emails targeting email accounts used in the integrated mail service of public officials were also found in the hacking activity . They are one of the most active cyber crime groups in 2019 , and they often modify and tweak their hacking methods and perform periodic hacking activities . Now , Silence is one of the most active threat actors targeting the financial sector . Since we released our original report , Silence: Moving into the darkside , the confirmed damage from Silence's operations has increased fivefold compared to the figures in Group-IB's initial report . Silence started by targeting organizations in Russia , gradually shifting their focus to former Soviet countries , and then the world . Silence also started using Ivoke , a fileless loader , and EDA agent , both written in PowerShell . Silence 2.0: Going Global is an extension of our original report: Silence: Moving into the Darkside which remains the most significant contribution to the research on the group and is the first such report to reveal Silence’s activity . Since the report’s release in September 2018 , Group-IB’s Threat Intelligence team has detected 16 campaigns targeting banks launched by Silence . Like the majority of APT groups , Silence uses phishing as their infection vector . In the last successful attack described in Silence: Moving into the darkside , dated April 2018 , the hackers siphoned off about $150 , 000 through ATMs in a single night . Prior to April 2018 , as described in Group-IB’s Silence: Moving into the darkside report , Silence’s target interests were primarily limited to former Soviet and Eastern European countries including Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan . In 2018 , Silence conducted test campaigns to update their database of current targets and expand their attack geography . The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users . Silence has conducted at least three campaigns using recon emails , followed by malicious mail sent to an updated recipient list . Group-IB has also detected recon emails sent out to New Zealand . Since our last public report , Silence has sent out more than 170 , 000 recon emails to banks in Russia , the former Soviet Union , Asia and Europe . In November 2018 , Silence tried their hand at targeting the Asian market for the first time in their history . In total , Silence sent out about 80 , 000 emails , with more than half of them targeting Taiwan , Malaysia , and South Korea . Prior to April 2018 , as described in Group-IB’s Silence: Moving into the darkside report , Silence’s target interests were primarily limited to former Soviet and Eastern European countries including Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan . From 16 October 2018 to 1 January 2019 , Silence sent out about 84 , 000 emails in Russia alone to update their address database . As part of their phishing campaigns , silence still uses Microsoft Office documents with macros or exploits , CHM files , and .lNK shortcuts as malicious attachments .


And later 2016 , their focus turned towards the Olympics ’ and the World Anti-Doping Agency ( WADA ) and Court of Arbitration for Sports ( CAS ) , when individuals and servers in these organizations were phished and compromised .


This command is used to connect the victim to a Wi-Fi network controlled by the cybercriminals to perform traffic sniffing and man-in-the-middle ( MitM ) attacks . Starting in October 2016 , NewsBeef compromised a set of legitimate servers (shown below) , and injected JavaScript to redirect visitors to http://analytics-google.org:69/Check.aspx . APT39 is Oan Iranian cyber espionage group that has been active since at least 2014 .


Figure 6 – Ransomware component Anubis has been known to utilize Twitter or Telegram to retrieve the C2 address and this sample is no exception ( Figure 7 ) . During the 2013 attacks , the Wild Neutron actor successfully compromised and leveraged the website www.iphonedevsdk.com , which is an iPhone developers forum . ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula . FakeSG has different browser templates depending on which browser the victim is running .


Cyber analysts are encouraged to review the information provided in this alert to detect signs of malicious network activity .


It uses the base Dalvik User-Agent string for the device it ’ s running on . We surmise that the targeting of banks , media , and government agencies is conducted in support of APT38 's primary mission . TAU investigated the ANEL obfuscation algorithms then modified the HexRaysDeob code to defeat the obfuscations . Further analyses of these similarities are available via Mandiant Advantage .


Memory collection and analysis can be an extremely valuable component of an incident response plan and in this case proved crucial in identifying TG-1314 's actions on objective .


If the file exists it then moves it to “ __tmpdt.tmp ” in the same directory and continues the installation .


Figure 6 . The Magic Hound attacks did not rely on exploit code to compromise targeted systems , instead relying on Excel and Word documents containing malicious macros . Second stage samples ( Win64/Winnti.BN ) A clever example was ‘ Office Monkeys LOL Video.zip ’ .


DeltaCharlie is a DDoS tool capable of launching Domain Name System ( DNS ) attacks , Network Time Protocol ( NTP ) attacks , and Carrier Grade NAT ( CGN ) attacks .


There have also been cases of users in Ukraine , Germany , Turkey and several other countries being affected . At first glance CONFUCIUS_B looks very similar to CONFUCIUS_A , and they are also packaged in plain SFX binary files . FireEye is highlighting a Cyber Espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40 .


The DllMain function is identical and starts the main thread ; the “ Applicate ” function is identical to the one in the newer library .


The report documented an advanced threat group they attributed to China .


It had again cloned a different legitimate Japanese website to host its malicious app , similar to what FakeSpy had also done before . APT19 seemed to be going after defense sector firms , Chinese dissident groups and political , financial , pharmaceutical and energy sectors that could benefit the Chinese economy . This query uses a receive structure similar to an M action; it is worth noting all of the receiver operation queries made in ping mode use the [System.Net.Dns]::GetHostAddresses . We assess " pack\scil\s1.txt " is likely a file containing SCIL commands the attackers executed in MicroSCADA .


All the detections of this backdoored app were geolocated in Iran . In July 2018 , Palo Alto disclosed DarkHydrus Group which showed its special interest to governments in Middle East . It has a keen interest in North Korean affairs , attacking those in the business sector who may have any connection to North Korea , as well as diplomatic agencies around the globe .


The second script calls VirtualAlloc to create a buffer , uses memset to load Metasploit-related shellcode into that buffer and executes it through CreateThread .


Once installed , it displayed the icon found in the actual Netflix app on Google Play . Group-IB has also detected recon emails sent out to New Zealand . Without any insight into the evidence Kaspersky has obtained , we can only repeat our view that Anunak has targeted only banks in Russia and we have no concrete reports of compromised banks outside of Russia directly related to this criminal group .


Currently , the Twitoor trojan has been downloading several versions of mobile banking malware . When it comes to engaging targets , Scattered Canary frequently maximized efficiencies through the use of scripts , or as some members of the group call them , formats.” These formats are templated text documents that can contain several layers of phishing messages to send to potential victims . We believe that Lazarus will remain one of the biggest threats to the banking sector , finance , and trading companies , as well as casinos for the next few years .


This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more . In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document .


Using intelligence from our in-depth investigation , Windows Defender ATP can raise alerts for malicious behavior employed by FinFisher ( such as memory injection in persistence ) in different stages of the attack kill chain . Spring Dragon 's infiltration techniques there were not simply spearphish . After all , it is embedded inside a legitimate executable that still needs to run . In late 2021 and 2022 , Cuba ransomware delivered an increasing number of highprofile attacks .


How does Gooligan work ? Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands . and has only read accesses . The goal of studying IoAs is to understand the intent of a malicious user accessing the information and network resources of the organization , even when a malicious payload is not yet delivered , and all computing interactions can be considered as legitimate and authorized .


] it server3fi.exodus.connexxa [ . Dragos' data indicates XENOTIME remains active . URL : http://nicoledotson.icu/debby/weatherford/Zavantazhyty . Sandworm ’s substation attack reveals notable insights into Russia ’s continued investment in OT - oriented offensive cyber capabilities and overall approach to attacking OT systems .


Additionally , this incident exposes the global nature of cyber threats and the value of worldwide perspective – a cyber espionage incident targeting Russians can provide an opportunity to learn about and interdict crime against English speakers elsewhere . PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


HD_Audio.exe : 0c4aa50c95c990d5c5c55345626155b87625986881a2c066ce032af6871c426a connects to manual.newphoneapp.com .


It adds the file extension .AnubisCrypt to each encrypted file and sends it to the C2 . Wild Neutron 's attacks in 2015 uses a stolen code signing certificate belonging to Taiwanese electronics maker Acer and an unknown Flash Player exploit . After publishing our initial series of blogposts back in 2016 , we have continued to track the ScarCruft threat actor . RussianPanda ( @AnFam17 ) named the URL shortcut campaign RogueRaticate .


To obtain logins and passwords they applied keyloggers built into Corkow , as well as a commonly used feature of Mimikatz , dumping clear text Windows credentials from LSA . Estimating the damages is challenging , but as we learned , the criminals are siphoning off assets in transactions that do not exceed $15,000 each .


FireEye recently published a blog covering the tactics , techniques , and procedures ( TTPs ) for the “ TRITON actor ” when preparing to deploy the TRITON / TRISIS malware framework in 2017 .


CLOAKING Client-side Carrier Checks In our basic command & control example above , we didn ’ t address the ( incorrectly labeled ) “ imei ” field . Trojanized versions of the utility were then signed with legitimate certificates and were hosted on and distributed from official ASUS update servers – which made them mostly invisible to the vast majority of protection solutions , according to Kaspersky Lab . Next , the ZxShell Load-Image Notify function prevents the AV processes from restarting . The gang attacked 10 victims last month , the majority of them being from the Information and Communications Technology ( ICT ) sectors .


] 30 . APT41 leverages an arsenal of over 46 different malware families and tools to accomplish their missions , including publicly available utilities , malware shared with other Chinese espionage operations , and tools unique to the group . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


This document discusses a recent targeted attack campaign directed primarily at private companies involved in the research , development , and manufacture of chemicals and advanced materials .


] 23 222.139.212 [ . To maintain presence , APT41 relies on backdoors , a Sticky Keys vulnerability , scheduled tasks , bootkits , rootkits , registry modifications , and creating or modifying startup files . This is in stark contrast to some other suspected Russian threat actors ( such as Operation Pawn Storm ) who appear to have increased their targeting of Ukraine following the crisis .


The file system commands underling handlers and IPacket were modified to support more features , so these commands don’t work out of the box and required manual implementation from us .


However , the actual text would often only display a basic welcome message . To enhance the effectiveness of phishing attacks into the organization , Barium will collect additional background informationfrom social media sites . The symbol “ g_bCreateListenSck ” is set to 1 . Of the two file types , the PowerPoint files are more unusual in that they would not show any actual slides when opened , but would still execute the malicious VBA code , a finding consistent with CERT - UA ’s analysis .


Within weeks of eviction , the threat actors attempt to access their ChinaChopper web shells from previously used IP addresses .


Check if chat apps are running In the above example , the malware is searching for Line , Facebook Messenger and WhatsApp activities . We are confident the Callisto Group used this type of access to a target 's email account for the purposes of sending spear phishing to other targets . The RIPTIDE exploit document drops its executable file into the C:\Documents and Settings\{user}\Application Data\Location folder while the HIGHTIDE exploit document drops its executable file into the C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\ folder . Device Registration APT29 has enrolled a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account .


If not , the response is scrubbed of the strings used to complete the billing fraud . Althoughthe BariumDefendants have relied on differentand distinct infrastructures in an effortto evade detection , Bariumused the same e-mail address (hostay88@gmail.com ) to register malicious domains used in connection with at least two toolsets that Barium has employed to compromise victim computers . In this manner , ZxShell is able to completely hide itself , intercepting the following Kernel API calls : ZwAllocateVirtualMemory , ZwOpenEvent , ZwQueryDirectoryFile , ZwWriteFile , ZwEnumerateKey , and ZwDeviceIoControlFile . CADDYWIPER is a disruptive wiper written in C that is focused on making data irrecoverable and causing maximum damage within an environment .


Once the cookie data is decoded , Suckfly has the network name , hostname , IP address , and the victim 's operating system information .


] ru/4 * * * * * 7 ” , containing a link to download the Trojan . Following these reports , Chronicle researchers doubled down on efforts to try to unravel the various campaigns where Winnti was leveraged . Moreover the new version searches for files generated by previous versions .


The cybercriminals behind it kept the same masking and distribution methods , using names and icons imitating those of popular free ad services . We will see more from Zebrocy into 2019 on government and military related organizations . Both documents contained email addresses , phone numbers and contacts of members of official organizations such as United Nations , UNICEF , and Embassies linked to North Korea .


The group uses a mix of tools and malware , some developed by the group and others that are more generic tools .


Here , external APT28 reports on 2017 Darkhotel-style activity in Europe and Dealer ’s Choice spearphishing are of interest .


It is therefore important to note that , contrary to what might be assumed , we have actually observed a drop instead of an increase in Ukraine related campaigns from the Dukes following the country ’s political crisis .


It allocates and fills four chunks of memory inside the service process . Since early 2014 , an attacker group of Iranian origin has been actively targeting persons of interest by means of malware infection , supported by persistent spear phishing campaigns . In this instance , the shellcode is configured to load an encoded backdoor from within the payload . OT asset owners leveraging IEC-104 compliant devices should take action to preempt potential in the wild deployment of COSMICENERGY .


In fact , as a sign of their arsenal ’s breadth , they had already decided to retire one of these malware toolsets as obsolete after developing a replacement for it , seemingly from scratch .


This exploit file made use of the same shellcode that we have observed Transparent Tribe use across a number of spear phishing incidents . PittyTiger could also use CVE-2014-1761 , which is more recent .


The C & C server then responds with a configuration file , containing the personal identification number for the device and some settings — the time interval between contacting the server , the list of modules to be installed and so on . Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . The Helminth executable variant is very similar in functionality to its script-based counterpart , as it also communicates with its C2 server using both HTTP and DNS queries .


These early campaigns were distributed via the Lerspeng downloader while later campaigns occasionally used Pony or Andromeda as intermediate loaders to distribute various instances of Dridex .


This can result in brand degradation , loss of individual reputation , or loss of consumer trust . The group uses legitimate administration tools to fly under the radar in their post-exploitation phase , which makes detection of malicious activity , as well as attribution more complicated . Since late 2016 , PwC UK and BAE Systems have been assisting victims of a new cyber espionage campaign conducted by APT10 .


INDRIK SPIDER consists of experienced malware developers and operators who have likely been part of the group since the early days of Dridex operations , beginning in June 2014 . Thursday 's Flash Player update patched 36 vulnerabilities in total including the zero day CVE-2016-4171 .


Kaspersky witnessed the ScarCruft threat actor extensively testing a known public exploit during its preparation for the next campaign . CVE-2018-0798 is an RCE vulnerability , a stack buffer overflow that can be exploited by a threat actor to perform stack corruption . As observed previously with CVE-2017-11882 and CVE-2018-0802 , the weaponizer was used exclusively by Chinese Cyber Espionage actors for approximately one year December 2017 through December 2018 , after which cybercrime actors began to incorporate it in their malicious activity . Upon decrypting and executing , it drops two additional files wsc_proxy.exe” (legitimate Avast executable) and a malicious DLL wsc.dll” in the %TEMP% folder . However , Beginning on 25 June 2019 , we started observing multiple commodity campaigns Mostly dropping AsyncRAT using the updated RTF weaponizer with the same exploit ( CVE-2018-0798 ) . Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer . These findings also suggest that the threat groups have robust exploit developing capabilities because CVE-2018-0798 is not widely reported on and it is typically not incorporated into publicly available weaponizers . In addition , a current ANY.RUN playback of our observed Elise infection is also available . Upon opening of the MS Word document , our embedded file exploits CVE-2017-11882 to drop a malicious fake Norton Security Shell Extension module , 'NavShExt.dll' , which is then injected into iexplore.exe to install the backdoor , begin collection , and activate command and control . Moving through the infection process , NetWitness Endpoint detects the initial exploit CVE-2017-1182 in action as the Microsoft Equation Editor , 'EQNEDT32.exe' , scores high for potentially malicious activity . Most recently though , a new campaign , targeting Belarus , Turkey and Ukraine , has emerged that caught the attention of Check Point researchers . The well-crafted and socially engineered malicious documents then become the ﬁrst stage of a long and mainly ﬁleless infection chain that eventually delivers POWERSTATS , a signature PowerShell backdoor of this threat group . This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more . If the macros in SPK KANUN DEĞİŞİKLİĞİ GİB GÖRÜŞÜ.doc” are enabled , an embedded payload is decoded and saved in the %APPDATA% directory with the name CiscoAny.exe” . INF ﬁles have been used in the past by MuddyWater , although they were launched using Advpack.dll and not IEAdvpack.dll . In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document . Although it has focused most of its efforts on the Middle East region , the political afﬁliations , motives and purposes behind MuddyWater’s attacks are not very well- deﬁned , thus earning it its name . In the past , countries such as Saudi Arabia , the UAE and Turkey have been a MuddyWater's main target , but the campaigns have also reached a much wider audience , making their ACT to victims in countries such as Belarus and Ukraine . MuddyWater target groups across Middle East and Central Asia , primarily using spear phishing emails with malicious attachments . Most recently MuddyWater were connected to a campaign in March that targeted organizations in Turkey , Pakistan , and Tajikistan . The group has been quite visible since the initial 2017 Malwarebytes report on their elaborate espionage attack against the Saudi Arabian government . Our analysis revealed that they drop a new backdoor , which is written in PowerShell as MuddyWater’s known POWERSTATS backdoor . We assume that RunPow stands for run PowerShell , ” and triggers the PowerShell code embedded inside the .dll file . This backdoor has some features similar to a previously discovered version of the Muddywater backdoor . Based on our analysis , we can confirm that MuddyWater target Turkish government organizations related to the finance and energy sectors . This is yet another similarity with previous MuddyWater campaigns , which were known to have targeted multiple Turkish government entities . The main delivery method of this type of backdoor is spear phishing emails or spam that uses social engineering to manipulate targets into enabling malicious documents . Trend Micro™ Deep Discovery™ provides detection , in-depth analysis , and proactive response to today’s stealthy malware , and targeted attacks in real time . MuddyWater first surfaced in 2017 . First stage infections and graphical decoys have been described by multiple sources , including in our previous research MuddyWater expands operations . MuddyWater compiles various offensive Python scripts . This includes Python scripts . Usually , the Stageless Meterpreter has the Ext_server_stdapi.x64.dll” , Ext_server_extapi.x64.dll” , and Ext_server_espia.x64.dll” extensions . The January 2017 report followed up on other private reports published on the group’s BeEF-related activity in 2015 and 2016 . Previous analysis of the NewsBeef APT indicates that the group focuses on Saudi Arabian and Western targets , and lacks advanced offensive technology development capabilities . However , in the summer of 2016 , NewsBeef deployed a new toolset that includes macro-enabled Office documents , PowerSploit , and the Pupy backdoor . The most recent NewsBeef campaign uses this toolset in conjunction with spearphishing emails , links sent over social media/standalone private messaging applications , and watering hole attacks that leverage compromised high-profile websites some belonging to the SA government . The NewsBeef actor deployed a new toolset in a campaign that focused primarily on Saudi Arabian targets . NewsBeef continues to deploy malicious macro-enabled Office documents , poisoned legitimate Flash and Chrome installers , PowerSploit , and Pupy tools . The NewsBeef campaign is divided into two main attack vectors , spearphishing and strategic web compromise watering hole attacks . On December 25 , 2016 , the NewsBeef APT stood up a server to host a new set of Microsoft Office documents (maintaining malicious macros and PowerShell scripts) to support its spear-phishing operations . These compromised servers include Saudi Arabian government servers and other high-value organizational identities relevant to NewsBeef's targets . However , Kaspersky Security Network records also contain links that victims clicked from the Outlook web client outlook.live.com” as well as attachments arriving through the Outlook desktop application . Interestingly , NewsBeef set up its server using the hosting provider Choopa , LLC , US” , the same hosting provider that the group used in attacks over the summer of 2016 . NTG’s IT focus and client list likely aided NewsBeef’s delivery of malicious PowerShell-enabled Office documents and poisoned installers . In other schemes , NewsBeef sent macro-enabled Office attachments from spoofed law firm identities or other relevant service providers to targets in SA . The law firm in this scheme is based in the United Kingdom and is the sole location for targets outside of SA for this campaign . Starting in October 2016 , NewsBeef compromised a set of legitimate servers (shown below) , and injected JavaScript to redirect visitors to http://analytics-google.org:69/Check.aspx . For example , on a Saudi government website , the NewsBeef APT delivered packed JavaScript into the bottom of a referenced script that is included in every page served from the site the packed and unpacked JavaScript is shown below . The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” . A high volume of redirections from the compromised site continues into mid-January 2017 . However , as this recent campaign indicates , the NewsBeef APT appears to have shifted its intrusion toolset aACT from BeEF and towards macro-enabled malicious Office documents , PowerSploit , and Pupy . Despite this shift in toolset , the group still relies on old infrastructure as evidenced by their reuse of servers hosted by the service providers Choopa and Atlantic.net . Its attack activities can be traced back to April 2012 . The OceanLotus reflects a very strong confrontational ability and willing to attack by keep evolving their techniques . These APT attacks and adopting confrontation measures will exist for a long time . OceanLotus’ targets are global . OceanLotus have been actively using since at least early 2018 . OceanLotus malware family samples used no earlier than 2017 . we identified two methods to deliver the KerrDown downloader to targets . The link to the final payload of KerrDown was still active during the time of analysis and hence we were able to download a copy which turned out to be a variant of Cobalt Strike Beacon . While investigating KerrDown we found multiple RAR files containing a variant of the malware . Therefore , it is clear that the OceanLotus group works during weekdays and takes a break during the weekends . The group was first revealed and named by SkyEye Team in May 2015 . OceanLotus's targets include China's maritime institutions , maritime construction , scientific research institutes and shipping enterprises .


The G DATA SecurityLabs are convinced that the number of similarities identified between EvilBunny and Babar show that both malware families originate from the same developers . The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities .


Once a user downloads a malicious app , it silently registers receivers which establish a connection with the C & C server . The primary goal of these attacks was likely to find code-signing certificates for signing future malware . with the goal of retrieving a new updated list . Danbot , Shark , and Milan use both DNS and HTTPS for C2 communications , while Marlin uses the OneDrive API for C2 communications .


Command to change the beaconing changeArchive : The final command of the activation cycle is the download of an archive . When successfully executed , the malicious documents install a backdoor we track as POWERSTATS . When the DLL is initially loaded , it dynamically resolves and imports additional modules ( DLLs ’ ) needed . The most significant similarities we identified are with INDUSTROYER and INDUSTROYER.V2 , which were both malware variants deployed in the past to impact electricity transmission and distribution .


Loading the decrypted .dex file into memory and triggering the main payload Main payload When the main payload is loaded into memory , the initial detonator hands over the control to the main payload by invoking the method XoqF ( which we renamed to triggerInfection during analysis ) from the gvmthHtyN class ( renamed to PayloadEntry ) . Coincidentally , following the recent hack of a US Navy contractor and theft of highly sensitive data on submarine warfare , we have found evidence of very recent activity by a group referred to as APT15 , known for committing cyber espionage which is believed to be affiliated with the Chinese government . This NanoCore RAT is version 1.2.2.0 which has been found to be offered for free on the Dark Web just a few months . The threat actor targets individuals and employees that may have access to a Facebook Business account with an information - stealer malware .


When reviewing the decrypted packet , it ’ s clear it has the same content as previous versions . INF ﬁles have been used in the past by MuddyWater , although they were launched using Advpack.dll and not IEAdvpack.dll . They then proceeded to log directly into the VPN using the credentials of the compromised user .


MINIDUKE : First known activity Loader July 2010 , Backdoor May 2011 Most recent known activity Loader : Spring 2015 , Backdoor : Summer 2014 C&C communication methods HTTP(S) , Twitter , Known toolset components Downloader , Backdoor , Loader .


Microsoft patched this vulnerability in September 2012 , suggesting that this watering hole attack used an older vulnerability , which aligns with the threat groups continued use of older vulnerabilities in their spear-phishing efforts . The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan .


Static analysis of the code reveals that the malware downloads the overlay template to use against any of the bank ( s ) it is targeting . Since 2015 , APT38 has attempted to steal hundreds of millions of dollars from financial institutions . The obfuscations looked similar to the ones explained in Hex-Rays blog , These disruptive cyber operations began in January 2022 , prior to Russia ’s illegal further invasion of Ukraine and have continued throughout the war .


This analysis dissects FakeSpy ’ s Chunghwa Post app version , which emerged in April 2020 . On June 19 , 2019 , FireEye’s Managed Defense Security Operations Center received an exploit detection alert on one of our FireEye Endpoint Security appliances . RATs such as NjRat and infostealers like Lokibot were leveraging the same C2 infrastructure as that of the targeted attacks .


TG-3390 actors have used Java exploits in their SWCs . Based on multiple active compromises by the Axiom threat group , Novetta was able to capture and analyze new Winnti malware samples .


Additionally new endpoint was added that seems related to downloading a module for the malware , probably with new features or configuration . APT10 is a threat actor that has been active since at least 2009 . Logs keystrokes and mouse movement Captures screenshots Opens cmd.exe shell Enumerates processes Executes programs Removes itself Enumerates all opening TCP and UDP ports .


For this task , I used PassiveTotal ’s Passive DNS and AutoFocus Maltego transforms .


We named the malware Skygofree , because we found the word in one of the domains * . MuddyWater first surfaced in 2017 . The group has been known to target organizations in order to use their access to then compromise additional victims .


The block is decrypted using a customized algorithm that uses a key derived from the original malware dropper ’ s TimeDateStamp field multiplied by 5 . APT33 often conducts spear-phishing operations using a built-in phishing module . Side-loaded DLL Loads next-stage payload using custom .png steganography Uses AES128 implementation from Crypto++ library for payload decryption Known to load Denes backdoor , might possibly be used also with other payloads . Threat actors regularly adapt and make use of red team tools - such as commercial and publicly available exploitation frameworks - to facilitate real world attacks , like TEMP.Veles ’ use of METERPRETER during .


All of the files that are being uploaded or downloaded are zip files encrypted by AES with ECB mode . During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals . XOR and RC4 encryption is used with quite long unique keys for different . By creating awareness and using the right solutions , both individuals and organizations can take the steps needed to defend against the malicious tactics used by threat actors like the Winnti group .


Then , it uses the accessibility service for its malicious operations , some of which include : Preventing the user from uninstalling the app Becoming the default SMS app by changing device settings Monitoring the currently running application ( s ) Scraping on-screen text Android operating systems include many dialog screens that require the denial , or approval , of app permissions and actions that have to receive input from the user by tapping a button on the screen . Based on our observations , this group uses a variety of different methods to either compromise or acquire already compromised payment card credentials . Initial inspection of this attack suggested this was again the OilRig campaign using their existing toolset , but further examination revealed not only new variants of the delivery document we named Clayslide , but also a different payload embedded inside it .


The parameters “ wth ” and “ qlt ” specify “ width ” and “ quality ” .


A malware sample using two separate unique user agent strings is uncommon .


We have seen two types of apps that use this custom-made SDK . Only one incident involving a Russian bank was promptly identified and prevented that is known to Group-IB . ELMER is a non-persistent proxy-aware HTTP backdoor written in Delphi , and is capable of performing file uploads and downloads , file execution , and process and directory listings . Say these arguments extend through the 2024 election — what happens if control of the White House or Congress switches between parties ?


Cannon has not been previously observed in use by the Sofacy group and contains a novel email-based C2 communication channel .


It has been shortened for brevity . According to Kaspersky Lab 's report , this threat actor has been active since as early as 2004 ; however , the highest volume of activity occurred from 2010 – 2013 . The webmail addresses , while unknown , were possibly the personal-use addresses of the individuals whose corporate domain emails were targeted . Apple had to roll back and then re - release a security update that addressed an actively exploited vulnerability in WebKit .


executes netwf.dll netwf.dll :


] com hxxp : //sagawa-reg [ . In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM ( aka Xagent , aka CHOPSTICK ) , JHUHUGIT ( which is built with code from the Carberp sources ) , AZZY ( aka ADVSTORESHELL , NETUI , EVILTOSS , and spans across 4-5 generations ) and a few others . This campaign originally came in via phishing emails that contained an attached Word document with embedded macros , Carbon Black located roughly 180 variants in the wild . Problems also arise when organizations turn a blind eye to the usage of commercial spyware .


There is no doubt that BitPaymer ransomware operations are proving successful for this criminal group , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan . The common use of the Enfal Trojan suggests that Shadow Network may be exchanging tools and techniques .


The Trojan also registered in Google Cloud Messaging ( GCM ) , meaning it could then receive commands via that service . This malware report contains analysis of one 32-bit Windows executable file , identified as a Remote Access Trojan ( RAT ) . We also recently discovered that Lazarus successfully planted their backdoor ( detected by Trend Micro as BKDR_BINLODR.ZNFJ-A ) into several machines of financial institutions across Latin America .


Given this requirement , SilverTerrier actors often rely on Dynamic DNS and virtual private servers to provide a layer of obfuscation to protect their identities . Turla is a notorious group that has been targeting diplomats .


In addition to using several publicly known injection methods to perform this task , it also takes advantage of an obscure operating system feature known as hot patching . Today Kaspersky Lab 's team of experts published a new research report about NetTraveler , which is a family of malicious programs used by APT actors to successfully compromise more than 350 high-profile victims in 40 countries .


Suckfly 's attacks on government organizations that provide information technology services to other government branches is not limited to India . The malware will install two proxies running on local host port 5555 and 5588 .


Upgrade PowerShell to new versions with enhanced logging features and monitor the logs to detect usage of PowerShell commands , which are often malware-related .


Written in pure C language , Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions , and carries out integrity control of various system components to avoid debugging and security detection . Metel is a banking Trojan ( also known as Corkow ) discovered in 2011 when it was used to attack users of online banking services .


) , and less screen real estate for victims to identify potential indicators of a threat . The Lazarus Group was first identified in Novetta 's report Operation Blockbuster in February 2016 . Among the archiving tools we tried, WinRar 3.30 behaved differently and . It has two components Loader and core module .


The threat actors saved both the SYSTEM file ( system.hive ) and NTDS.dit in the compromised host's c:\windows\temp directory .


How do you know if your Google account is breached ? APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition . opaque predicates pattern matching functions are called . Mandiant first observed the self - proclaimed hacktivist group calling itself " Anonymous Sudan " in January 2023 and the group soon after declared allegiance to KillNet .


The below code snippet is currently isolated and dormant . In August 2015 a new incident related to the Corkow ( Metel ) Trojan was detected . Some of them exploit CVE-2017-0199 , loading it using VBS and PowerShell scripts and then installing customized versions of RevengeRAT , NjRAT , NanoCoreRAT , 888 RAT and other custom malware such as ProCC in the victim ’s machine . For those who fall outside of that demographic , it ’s interesting that this group is still relying on the user enabling macros in Office , since Microsoft disabled those by default earlier this year .


The attack wave started in late July 2011 and continued into midSeptember 2011 .


The HTA ’s VBScript changes the window size and location and then uses PowerShell to download yet another script : power.ps1 .


The adware functionality is the same in all the apps we analyzed . Kaspersky also observed some activity from Gaza Team and MuddyWater . Here is the complete list of files internally used by the RAT: error.tmp (the log file of the keylogger) tedsul.ocx helpsol.ocx trepsl.ocx psltred.ocx solhelp.ocx sulted.ocx .


Generally , after an application gets banned from an official app store , such as Google Play , users try to find alternative ways to download the app . The recent wave of FASTCash attacks demonstrates that financially motivated attacks are not simply a passing interest for the Lazarus group and can now be considered one of its core activities . The library used to hide Winnti ’s system activity is a copy of the open-source userland rootkit Azazel , with minor changes .


The DLL side-loaded stage 4 malware mimicking a real export table to avoid detection Stage 4 : The memory loader – Fun injection with GDI function hijacking Depending on how stage 4 was launched , two different things may happen : In the low-integrity case ( under UAC ) the installer simply injects the stage 5 malware into the bogus explorer.exe process started earlier and terminates In the high-integrity case ( with administrative privileges or after UAC bypass ) , the code searches for the process hosting the Plug and Play service ( usually svchost.exe SecureWorks® Counter Threat Unit™ ( CTU ) researchers analyzed a phishing campaign that targeted a Middle Eastern organization in early January 2017 . Finally , the loader will decrypt the payload to a memory buffer and overwrite the previously found return address with the pointer to that buffer , ensuring that the malicious shellcode will be executed when the DLL attempts to return to the caller . Examples of indicators of attack , and why they matter


By targeting high-tech and manufacturing operations in Japan and Taiwan , DragonOK may be acquiring trade secrets for a competitive economic advantage . Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates .


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . XBOW 's capabilities are derived from BIFROSE and KIVARS ; Shrouded Crossbow gets its name from its unique mutex format .


BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including research and pharmaceutical companies .


With their gaps in visibility , these organizations can have a very difficult time distinguishing adversary activity from that of legitimate users , pushing detection times out to weeks , months , or even years .


FURTHER READING New type of auto-rooting Android adware is nearly impossible to remove Researchers from security firm Check Point Software said the malware installs more than 50,000 fraudulent apps each day , displays 20 million malicious advertisements , and generates more than $ 300,000 per month in revenue . Since they first emerged back in 2007 with a series of cyberespionage attacks against the South Korean government , these threat actors have successfully managed to pull off some of the most notable and devastating targeted attacks—such as the widely-reported 2014 Sony hack and the 2016 attack on a Bangladeshi bank—in recent history . APT33 : 95.211.191.117 update-sec.com . None DGA Formula The algorithm for generating domains has been updated and includes the TLDs toplevel domains of .space , .net , .dynu.net , and .top to evade detection of security vendors using the previously published DGA domain generation algorithm


Both apps shared the same C & C server , but we couldn ’ t investigate the latter as it had already been removed from the Google Play store . One of the most interesting things to occur during one of Waterbug’s recent campaigns was that during an attack against one target in the Middle East , Waterbug appeared to hijack infrastructure from the Crambus espionage group and used it to deliver malware on to the victim’s network . Based on our analysis of public and private information from submissions , along with product telemetry , it appears Proxysvc was used alongside the 2017 Destover variant and has operated undetected since mid-2017 .


First , they use COM object hijacking to make the malware persistent on the system even though the custom backdoor is installed only for a few hours .


Malware authors in the past have often coded a “ safety net ” into their malware to prevent them from accidentally infecting their own computers and devices . The Gamaredon Group primarily makes use of compromised domains , dynamic DNS providers , Russian and Ukrainian country code top-level domains ( ccTLDs ) , and Russian hosting providers to distribute their custom-built malware . and so on ) This type of vulnerability is known as a server - side request forgery ( SSRF ) .


As mentioned in our previous blogs on DealersChoice , the payload of choice for previous variants was SofacyCarberp ( Seduploader ) , but we have no evidence to suggest this tool was used in this attack .


By accessing and stealing this data , Eventbot has the potential to access key business data , including financial data . In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy . On November 10 , 2015 , threat actors sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


Successfully evicting TG-3390 from an environment requires a coordinated plan to remove all access points , including remote access tools and web shells .


As soon as the victim tries to log in , it stores the victim 's credentials in /storage/0/DCIM/.fdat Facebook Login Figure 7 : Fake Facebook login The second command is IODBSSUEEZ , which further sends stolen credentials to the C & C server , as seen in Figure 8 . Unlike earlier attacks when Bemstour was delivered using Buckeye's Pirpi backdoor , in this attack Bemstour was delivered to the victim by a different backdoor Trojan (Backdoor.Filensfer) . They compromised various banking systems , including the Russian Central Bank 's Automated Workstation Client , ATMs , and card processing .


These will be executed in a WebView object created by the trojan . This campaign followed a sharp uptick in development and testing of their toolkit against a public multivendor malware scanning service in February 2019 . Since 2015 , APT38 has attempted to steal hundreds of millions of dollars from financial institutions .


Additionally , rootdaemon attempts to remove its own power usage statistics from Huawei phones ' SystemManager : Similarly , the malicious application probably attempts to minimize traces on Samsung phones by adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/apm_sp_status_of_apps.xml the following lines : And adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/com.samsung.android.securitylogagent_preferences.xml For example , in September 2016 , Sowbug infiltrated an organization in Asia , deploying the Felismus backdoor on one of its computers , Computer A , using the file name adobecms.exe in CSIDL_WINDOWS\debug . JhoneRAT : https://drive.google.com/uc?export=download&id=1OlQssMvjb7gI175qDx8SqTgRJIEp5Ypd . Money


Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures .


The final part of the VBA script changes the properties of these two files , setting their attributes to Hidden .


For persistence , the loader will write the path to this batch file to the following registry key .


Intrigued , we continued our search and found more interesting clues that could reveal some detailed information about the owners of the infected devices . FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware or as a file downloaded unknowingly by users when visiting sites compromised by HIDDEN COBRA actors . This tool was downloaded several times between 23:29 on February 12 and 07:47 on February 13 . In October 2019 , ESET published “ Operation Ghost ” detailing a set of new trojans used by the Dukes , including PolyglotDuke , RegDuke and FatDuke .


Most of the additional samples were the Delphi and AutoIT variants as reported by ESET .


] com http : //www.adsuperiorstore [ . Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data exfiltration and to provide remote access to infected machines . The group , which we call Seedworm ( aka MuddyWater ) , has been operating since at least 2017 , with its most recent activity observed in December 2018 .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team . Iranian Threat Agent Greenbug has been registering domains similar to those of Israeli High-Tech and Cyber Security Companies .


The embedded app appears to be a media player . APT41 has targeted organizations in 14 countries (and Hong Kong) over seven years , including: France , India , Italy , Japan , Myanmar , the Netherlands , Singapore , South Korea , South Africa , Switzerland , Thailand , Turkey , the United Kingdom , and the United States (Figure 1) . Georgian military security issues , particularly with regard to U.S. cooperation and NATO , provide a strong incentive for Russian state-sponsored threat actors to steal information that sheds light on these topics .


Some of the CozyDuke spear-phishing emails from early July posed as e-fax arrival notifications , a popular theme for spam emails , and used the same “ US letter fax test page ” decoy document that was used a year later by CloudDuke .


Drive-by downloads and multiple rooting exploits The malware uses a variety of methods to infect devices . We also saw that the attack technique bears some resemblance to a previous 2017 Lazarus attack , analyzed by BAE Systems , against targets in Asia . APT33 : 64.251.19.216 srvhost.servehttp.com . The next step is to collect some information about the victim system to send them to the C2 server .


The threat actors have used discrete infrastructure clusters that share matching hosting and registration characteristics .


You can find a full list with short descriptions in the Appendix . On December 25 , 2016 , the NewsBeef APT stood up a server to host a new set of Microsoft Office documents (maintaining malicious macros and PowerShell scripts) to support its spear-phishing operations . MuddyWater is an Iranian threat group that has primarily targeted Middle Eastern nations , and has also targeted European and North American nations .


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . Moreover , the number of Corkow incidents detected in Q1 2015 in the United States exceeds the number of those in the CIS countries .


Our research team was able to identify several instances of this activity by cross-referencing data from breached devices with Google Play app reviews . In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets . the variable v2 in pseudocode is a register operand ( ecx ) WarDefense extrinsic In the 21st century it would be irresponsible to ignore the fact that nation states and even patriot hackers play in either initiating or defending against adversaries .


Microsoft Defender for Endpoint on Android further enriches organizations ’ visibility into malicious activity , empowering them to comprehensively prevent , detect , and respond to against attack sprawl and cross-domain incidents . The Ke3chang attackers used the older " MyWeb " malware family from 2010 to 2011 . Occasionally, we encounter some clever and creative ways these malicious archives are . CADDYWIPER will attempt to wipe all files before proceeding to wipe any mapped drives .


If rooting is successful , the attacker has full control of the device and can execute privileged commands remotely . The Middle Eastern hacker group in this case is codenamed " BlackOasis " . In the following example , US by the numbers


Admin panel The administration panel shows the application configuration , which matches the commands from the C2 . We have also observed APT10 use DLL search order hijacking and sideloading , to execute some modified versions of open-source tools . To achieve this , the attackers had hardcoded a list of MAC addresses in the trojanized samples and this list was used to identify the actual intended targets of this massive operation . For the latest protection updates , please visit the Symantec Protection Bulletin .


If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file . n summary , Cold River is a sophisticated threat actor making malicious use of DNS tunneling for command and control activities , compelling lure documents , and previously unknown implants .


These results indicated that the threat actors leveraged the Altiris management platform installed at the client site , along with compromised domain credentials associated with the Altiris system , to move laterally within the compromised environment .


For the victims deemed interesting enough , the Dukes would then deploy a different toolset .


] com hxxp : //www [ . As alluded to in our previous blog regarding the Cannon tool , the Sofacy group ( AKA Fancy Bear , APT28 , STRONTIUM , Pawn Storm , Sednit ) has persistently attacked various government and private organizations around the world from mid-October 2018 through mid-November 2018 . For this post the following sample was analyzed . LockBit reportedly squeezed about $ 91 million out of US organizations with around 1,700 attacks since 2020 , according to a June report by CISA .


We do not have any strong ties to connect the current attacks exploiting this vulnerability in SharePoint with the Emissary Panda attacks carried out in April .


If the threat reappears on the device after the first installation , it means that the malware managed to install the persistency module in the System directory . Carbanak is also aware of the IFOBS banking application and can , on command , substitute the details of payment documents in the IFOBS system . MuddyWater is an Iranian high-profile threat actor that 's been seen active since 2017 .


Much like the MiniDuke expose in February 2013 , the Dukes again appeared to prioritize continuing operations over staying hidden .


Figure 5 . Instead , sensitive KHNP documents were leaked by the actors as part of an effort to exaggerate the access they had and embarrass the South Korean Government , a technique we assess North Korea would turn to again in order to instill fear and/or meet domestic propaganda aims . The campaign of April 2017 used pertinent documents containing potentially sensitive data .


These steps were taken over a 13-day period , but only on specific days .


Their publicly advertised products include CCTV management systems , surveillance drones , face and license plate recognition systems . The attackers actively sent out malicious documents and maintained several IP addresses for command and control . The backdoor has the following capabilities : Organizations can have hundreds , thousands or more of unremediated vulnerabilities that could open the door for an attacker .


The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 . Due to these changes without a new date string , we believe the date codes are used for campaign tracking rather than a Bookworm build identifier .


icons Figure 11 : Icons used to pose as famous apps . In addition to file-based protection , customers of the DeepSight Intelligence Managed Adversary and Threat Intelligence (MATI) service have received reports on Buckeye , which detail methods of detecting and thwarting activities of this group . APT17 : Deputy Dog .


In at least one case however , the email instead contained a link to a zip archive file named “ Office Monkeys LOL Video.zip ” , which was hosted on the DropBox cloud storage service .


Sofacy , one of the most active APT we monitor , continues to spearphish their way into targets , reportedly widely phishes for credentials , and infrequently participates in server side activity ( including host compromise with BeEF deployment , for example ) .


FormBook is a browser form stealer/keylogger that is under active development . Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) .


To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT . Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor .


Android users warned of malware attack spreading via SMS FEB 16 , 2016 Security researchers are warning owners of Android smartphones about a new malware attack , spreading via SMS text messages . The group , which we have given the name Gallmaker , has been operating since at least December 2017 , with its most recent activity observed in June 2018 . the callback is executed just once in the implementation . The campaign was carried out in late 2020 , but it was detected , analyzed , and published in late March 2021 .


FakeSpy Masquerades as Postal Service Apps Around the World July 1 , 2020 KEY FINDINGS The Cybereason Nocturnus team is investigating a new campaign involving FakeSpy , an Android mobile malware that emerged around October 2017 . Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX . Gallmaker 's activity appears to be highly targeted , with its victims all related to government , military , or defense sectors .


NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird . The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People 's Republics .


The threat actors demonstrated the ability to adapt when reentering a network after an eviction , overcoming technical barriers constructed by network defenders .


Sofacy APT hits high profile targets with updated toolset .


We recently observed Hancitor attacks against some of our FireEye Exploit Guard customers . In all cases , based on the nature of the computers infected by Thrip , it appeared that the telecoms companies themselves and not their customers were the targets of these attacks .