“ We ’ re appreciative of both Check Point ’ s research and their partnership as we ’ ve worked together to understand these issues , ” said Adrian Ludwig , Google ’ s director of Android security . From November 2015 through the end of 2016 , APT38 was involved in at least nine separate compromises against banks . When a binary is loaded into IDA Pro , You 'll uncover why the US has seen a significant uptick in ransomware incidents across the board , especially in sectors like education .


Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload . The actors appear to follow a set playbook , as the observed TTPs are fairly static within each attack in this campaign .


PlugX C2 server : ipsoftwarelabs.com .


CTU researchers have observed the threat group obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both .


This service , along with the API , was fully decommissioned in March 2019 . By pivoting off the registration details and servers data of the two domains we discovered others registered by the threat agent . The backdoor had the following properties : They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration .


Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack . CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 .


The following factors supporting this assessment are further detailed in this post .


Based on this discovery , we began to look for other binaries signed with the South Korean mobile software developer's certificate .


We identified 42 apps on Google Play as belonging to the campaign , which had been running since July 2018 . In a recent campaign , Kaspersky observed ScarCruft using a multi-stage binary to infect several victims and ultimately install a final payload known as ROKRAT – a cloud service-based backdoor . The executable performs the following tasks: If the system is a 64-bit version of Windows , it downloads and executes a specific 64-bit version of the malware thanks to a powershell script .


In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 . The document attached to this e-mail exploits CVE-2012-0158 .


The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format . The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 .


The most significant change in this particular Trojan ’ s history was the encryption of data sent between the device and C & C . Based on BRONZE UNION 's targeting activity , CTU researchers assess it is highly likely that the group focuses on political and defense organization networks . Users can consider adopting security solutions that can defend against malicious bot-related activities such as Outlaw ’s through a cross-generational blend of threat defense techniques . Adversaries may also use CLIs to install and run new software , including malicious tools that may be installed over the course of an operation .


Microsoft is aware of CVE-2015-1701 and is working on a fix .


XENOTIME configured TRISIS based on the specifics and functions of the Triconex system within the industrial control ( ICS ) environment .


FakeSpy uses an anti-debugging technique by creating another child process of itself . During our research into this attack campaign , Unit 42 gathered several tools that the Emissary Panda uploaded to the three webshells at the two government organizations . Some of the malicious documents were test files without the implant .


As we have seen in some previous targeted malware attacks , the attackers in this incident are taking advantage of services like changeip.com to establish free subdomains in their infrastructure . When the adversaries' operations are live , they modify the record again to point the C2 domain to an IP address they can access .


Earlier this month , Securelist 's technology caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . APT40 is described as a moderately sophisticated cyber-espionage group which combines access to significant development resources with the ability to leverage publicly available tools .


This mistake in operational security allowed us to gain visibility into exfiltrated content for a number of devices . Only one client , based in Iran , continued to communicate with the infrastructure . Below is a list of zones registered by APT1 that are newsthemed : As Google Analytics is allowed in the CSP configuration of many major sites , this demo shows how an attacker can bypass this security protection and steal data .


An example SMS message is shown in Figure 1 . Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information . Finally , it will be run using “ post.php ” as argument . But while it was clear earlier on that attackers were actively exploiting CVE-2023 - 34362 , it was only a few days later that it became clear that Cl0p was behind the attacks .


Android remains a prime target for malicious attacks . This is a hacking group with Chinese origins which targets selected organisations related with education , energy and technology . The suspicious sample detected by Augur is actually a new 32-bit ShadowPad launcher . The malware then checks the command execution functionality using a command that vary across the samples .


SeaDuke is made interesting by the fact that it is written in Python and designed to be cross-platform so that it works on both Windows and Linux .


In this scenario , one or more persons – likely including at least one CNIIHM employee , based on the moniker discussed above – would have had to conduct extensive , high-risk malware development and intrusion activity from CNIIHM ’s address space without CNIIHM ’s knowledge and approval over multiple years .


The second method uses intents , broadcasts , and receivers to execute HenBox code . In June 2018 , APT41 sent spear-phishing emails using an invitation lure to join a decentralized gaming platform linked to a cryptocurrency service (Figure 5) that had positioned itself as a medium of exchange for online games and gambling sites . On December 29 , 2016 , the Department of Homeland Security ( DHS ) and Federal Bureau of Investigation ( FBI ) released a Joint Analysis Report confirming FireEye 's long held public assessment that the Russian government sponsors APT28 .


APT28 is using novel techniques involving the EternalBlue exploit and the open source tool Responder to spread laterally through networks and likely target travelers .


After publishing our initial series of blogposts back in 2016 , Kaspersky has continued to track the ScarCruft threat actor . These include CVE-2010-3962 as part of an attack campaign in 2010 and CVE-2014-1776 in 2014 . Beginning in August 2016 , a group calling itself the Shadow Brokers began releasing tools it claimed to have originated from the Equation Group . Over the coming months , it progressively released more tools , until April 2017 , when it released a final , large cache of tools , including the DoublePulsar backdoor , the FuzzBunch framework , and the EternalBlue , EternalSynergy , and EternalRomance exploit tools . However , Buckeye had already been using some of these leaked tools at least a year beforehand . The earliest known use of Equation Group tools by Buckeye is March 31 , 2016 , during an attack on a target in Hong Kong . Beginning in March 2016 , Buckeye began using a variant of DoublePulsar (Backdoor.Doublepulsar) , a backdoor that was subsequently released by the Shadow Brokers in 2017 . However , while activity involving known Buckeye tools ceased in mid-2017 , the Bemstour exploit tool and the DoublePulsar variant used by Buckeye continued to be used until at least September 2018 in conjunction with different malware . During this attack , the Bemstour exploit tool was delivered to victims via known Buckeye malware (Backdoor.Pirpi) . One hour later , Bemstour was used against an educational institution in Belgium . Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor . DoublePulsar is then used to inject a secondary payload , which runs in memory only . A significantly improved variant of the Bemstour exploit tool was rolled out in September 2016 , when it was used in an attack against an educational institution in Hong Kong . When used against 32-bit targets , Bemstour still delivered the same DoublePulsar backdoor . Bemstour was used again in June 2017 in an attack against an organization in Luxembourg . Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam . Development of Bemstour has continued into 2019 . Unlike earlier attacks when Bemstour was delivered using Buckeye's Pirpi backdoor , in this attack Bemstour was delivered to the victim by a different backdoor Trojan (Backdoor.Filensfer) . The most recent sample of Bemstour seen by Symantec appears to have been compiled on March 23 , 2019 , eleven days after the zero-day vulnerability was patched by Microsoft . Filensfer is a family of malware that has been used in targeted attacks since at least 2013 . The zero-day vulnerability found and reported by Symantec (CVE-2019-0703) occurs due to the ACT the Windows SMB Server handles certain requests . While Symantec has never observed the use of Filensfer alongside any known Buckeye tools , information shared privately by another vendor included evidence of Filensfer being used in conjunction with known Buckeye malware (Backdoor.Pirpi) . CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 . Buckeye's exploit tool , EternalRomance , as well as EternalSynergy , can exploit the CVE-2017-0143 message type confusion vulnerability to perform memory corruption on unpatched victim computers . In the case of the Buckeye exploit tool , the attackers exploited their own zero-day vulnerability (CVE-2019-0703) . It is noteworthy that the attackers never used the FuzzBunch framework in its attacks . FuzzBunch is a framework designed to manage DoublePulsar and other Equation Group tools and was leaked by the Shadow Brokers in 2017 . There are multiple possibilities as to how Buckeye obtained Equation Group tools before the Shadow Brokers leak . However , aside from the continued use of the tools , Symantec has found no other evidence suggesting Buckeye has retooled . this RTF exploits again the CVE-2017-1882 on eqnedt32.exe . And the dropper execute the iassvcs.exe to make a side loading and make the persistence . This IP is very interesting because it connects with tele.zyns.com and old infrastructures used by chinese APT or DDOS Chinese team against the ancient soviet republics . Over the past three years , Filensfer has been deployed against organizations in Luxembourg , Sweden , Italy , the UK , and the U.S . All zero-day exploits known , or suspected , to have been used by this group are for vulnerabilities in Internet Explorer and Flash . According to reports , the Philippines is the most exposed country in ASEAN to the cyberattacks known as advanced persistent threats , or APTs . Our analysis of this malware shows that it belongs to Hussarini , also known as Sarhust , a backdoor family that has been used actively in APT attacks targeting countries in the ASEAN region since 2014 . OutExtra.exe is a signed legitimate application from Microsoft named finder.exe . In addition to file-based protection , customers of the DeepSight Intelligence Managed Adversary and Threat Intelligence (MATI) service have received reports on Buckeye , which detail methods of detecting and thwarting activities of this group . However , in this attack , this file is used to load the Hussarini backdoor via DLL hijacking . Today , this malware is still actively being used against the Philippines . Hussarini was first mentioned in APT campaigns targeting the Philippines and Thailand in 2014 . Further analysis showed that the Iron cybercrime group used two main functions from HackingTeam's source in both IronStealer and Iron ransomware . Xagent” is the original filename Xagent.exe whereas seems to be the version of the worm . Xagent – A variant of JbossMiner Mining Worm” – a worm written in Python and compiled using PyInstaller for both Windows and Linux platforms . Its activities were traced back to 2010 in FireEye's 2013 report on operation Ke3chang – a cyberespionage campaign directed at diplomatic organizations in Europe . We have been tracking the malicious activities related to this threat actor and discovered a previously undocumented malware family with strong links to the Ke3chang group – a backdoor we named Okrum . Furthermore , from 2015 to 2019 , we detected new versions of known malware families attributed to the Ke3chang group – BS2005 backdoors from operation Ke3chang and the RoyalDNS malware , reported by NCC Group in 2018 . Ke3chang behind the attacks seemed to have a particular interest in Slovakia , where a big portion of the discovered malware samples was detected; Croatia , the Czech Republic and other countries were also affected . Our technical analysis of the malware used in these attacks showed close ties to BS2005 backdoors from operation Ke3chang , and to a related TidePool malware family discovered by Palo Alto Networks in 2016 that targeted Indian embassies across the globe . The story continued in late 2016 , when we discovered a new , previously unknown backdoor that we named Okrum . The malicious actors behind the Okrum malware were focused on the same targets in Slovakia that were previously targeted by Ketrican 2015 backdoors . We started connecting the dots when we discovered that the Okrum backdoor was used to drop a Ketrican backdoor , freshly compiled in 2017 . In 2017 , the same entities that were affected by the Okrum malware and by the 2015 Ketrican backdoors again became targets of the malicious actors . This time , the attackers used new versions of the RoyalDNS malware and a Ketrican 2017 backdoor . According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 . In addition to file-based protection , customers of the DeepSight has received reports on Buckeye , which detail methods of detecting and thwarting activities of this group . In 2018 , we discovered a new version of the Ketrican backdoor that featured some code improvements . According to our telemetry , Okrum was used to target diplomatic missions in Slovakia , Belgium , Chile , Guatemala , and Brazil , with the attackers showing a particular interest in Slovakia . Indeed , we have detected various external tools being abused by Okrum , such as a keylogger , tools for dumping passwords , or enumerating network sessions . The detection evasion techniques we observed in the Okrum malware include embedding the malicious payload within a legitimate PNG image , employing several anti-emulation and anti-sandbox tricks , as well as making frequent changes in implementation . The unnamed company makes products used in the military and aerospace industries , and the hackers could have been after commercial secrets or more traditional espionage , according to ClearSky , the cybersecurity firm that exposed the operation . North Korean dictator Kim Jong Un has set ambitious economic goals , and some cybersecurity analysts have predicted he will unleash the Pyongyang-affiliated hackers to meet those deadlines by targeting multinational companies’ trade secrets . According to ClearSky , the suspected Lazarus operatives looked to leverage a vulnerability in outdated WinRAR file-archiving software that hackers have been exploiting since it was disclosed last month . This new Lotus Blossom campaign delivers a malicious RTF document posing as an ASEAN Defence Minister's Meeting (ADMM) directory (decoy) that also carries an executable (payload) embedded as an OLE object , the Elise backdoor . Just months after the APT32 watering hole activity against ASEAN-related websites was observed in Fall 2017 , this new activity clearly indicates the association (ASEAN) clearly remains a priority collection target in the region . Researchers implicated Lazarus Group because of digital clues including a malicious implant known as Rising Sun that has been attributed to the group . The attackers originally embedded an implant into the malicious document as a hypertext application (HTA) file , and then quickly moved to hide it in an image on a remote server and used obfuscated Visual Basic macros to launch the decoder script . Lazarus used the open-source tool Invoke-PSImage , released December 20 , to embed the PowerShell script into the image file . Once the script runs , it passes the decoded script from the image file to the Windows command line in a variable $x , which uses cmd.exe to execute the obfuscated script and run it via PowerShell . The Department of Homeland Security (DHS) issued an alert about this activity on Jan. 24 2019 , warning that an attacker could redirect user traffic and obtain valid encryption certificates for an organization's domain names . In the Sea Turtle campaign , Talos was able to identify two distinct groups of victims . The first group , we identify as primary victims , includes national security organizations , ministries of foreign affairs , and prominent energy organizations . The threat actors behind the Sea Turtle campaign show clear signs of being highly capable and brazen in their endeavors . In most cases , threat actors typically stop or slow down their activities once their campaigns are publicly revealed . The threat actors behind the Sea Turtle campaign were successful in compromising entities by manipulating and falsifying DNS records at various levels in the domain name space . If an attacker was able to compromise an organization's network administrator credentials , the attacker would be able to change that particular organization's DNS records at will . If the attackers were able to obtain one of these EPP keys , they would be able to modify any DNS records that were managed by that particular registrar . Captured legitimate user credentials when users interacted with these actor - controlled servers . The diagram below illustrates how we believe the actors behind the Sea Turtle campaign used DNS hijacking to achieve their end goals . As of early 2019 , the only evidence of the spear-phishing threat vector came from a compromised organization's public disclosure . On January 4 , Packet Clearing House , which is not an Internet exchange point but rather is an NGO which provides support to Internet exchange points and the core of the domain name system , provided confirmation of this aspect of the actors’ tactics when it publicly revealed its internal DNS had been briefly hijacked as a consequence of the compromise at its domain registrar . During a typical incident , the actor would modify the NS records for the targeted organization , pointing users to a malicious DNS server that provided actor-controlled responses to all DNS queries . The next step for the actor was to build MitM servers that impersonated legitimate services to capture user credentials . In addition to the MitM server IP addresses published in previous reports , Talos identified 16 additional servers leveraged by the actor during the observed attacks . The attackers would then use the certificate on actor-controlled servers to perform additional MitM operations to harvest additional credentials . In some cases , the victims were redirected to these actor-controlled servers displaying the stolen certificate . One notable aspect of the campaign was the actors' ability to impersonate VPN applications , such as Cisco Adaptive Security Appliance (ASA) products , to perform MitM attacks . At this time , we do not believe that the attackers found a new ASA exploit . Rather , they likely abused the trust relationship associated with the ASA's SSL certificate to harvest VPN credentials to gain remote access to the victim's network . As an example , DNS records indicate that a targeted domain resolved to an actor-controlled MitM server . In another case , the attackers were able to compromise NetNod , a non-profit , independent internet infrastructure organization based in Sweden . Using this access , the threat actors were able to manipulate the DNS records for sa1[.]dnsnode[.]net . This redirection allowed the attackers to harvest credentials of administrators who manage domains with the TLD of Saudi Arabia (.sa) . In one of the more recent campaigns on March 27 , 2019 , the threat actors targeted the Sweden-based consulting firm Cafax . We assess with high confidence that Sea Turtle was targeted in an attempt to re-establish access to the NetNod network , which was previously compromised by this threat actor . Obtaining access to this ccTLD registrars would have allowed attackers to hijack any domain that used those ccTLDs . These actors perform DNS hijacking through the use of actor-controlled name servers . Sea Turtle have been more aggressive in their pursuit targeting DNS registries and a number of registrars , including those that manage ccTLDs . These actors use Let's Encrypts , Comodo , Sectigo , and self-signed certificates in their MitM servers to gain the initial round of credentials . These actors have been more aggressive in their pursuit targeting DNS registries and a number of registrars , including those that manage ccTLDs . Once they have access to the network , they steal the organization's legitimate SSL certificate and use it on actor-controlled servers . we believe that the Sea Turtle campaign continues to be highly successful for several reasons . Had more ccTLDs implemented security features such as registrar locks , attackers would be unable to redirect the targeted domains . The attackers stole organizations' SSL certificates associated with security appliances such as ASA to obtain VPN credentials , allowing the actors to gain access to the targeted network . The threat actors were able to maintain long term persistent access to many of these networks by utilizing compromised credentials . Cisco Talos will continue to monitor Sea Turtle and work with our partners to understand the threat as it continues to evolve to ensure that our customers remain protected and the public is informed . If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file . Create a link file in the startup folder for AutoHotkeyU32.exe , allowing the attack to persist even after a system restart . More importantly , one of these files also enables the download of TeamViewer , a remote access tool that gives threat actors remote control over the system . Such attacks highlight the need for caution before downloading files from unknown sources and enabling macro for files from unknown sources . The agency's hacking division freed it from having to disclose its often controversial operations to the NSA (its primary bureaucratic rival) in order to draw on the NSA's hacking capacities . By the end of 2016 , the CIA's hacking division , which formally falls under the agency's Center for Cyber Intelligence (CCI) , had over 5000 registered users and had produced more than a thousand hacking systems , trojans , viruses , and other weaponized malware . Such is the scale of the CIA's undertaking that by 2016 , its hackers had utilized more code than that used to run Facebook . Wikileaks has carefully reviewed the Year Zero disclosure and published substantive CIA documentation while avoiding the distribution of 'armed' cyberweapons until a consensus emerges on the technical and political nature of the CIA's program and how such 'weapons' should analyzed , disarmed and published . These redactions include ten of thousands of CIA targets and attack machines throughout Latin America , Europe and the United States . The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell's 1984 , but Weeping Angel , developed by the CIA's Embedded Devices Branch (EDB) , which infests smart TVs , transforming them into covert microphones , is surely its most emblematic realization . After infestation , Weeping Angel places the target TV in a 'Fake-Off' mode , so that the owner falsely believes the TV is off when it is on . As of October 2014 the CIA was also looking at infecting the vehicle control systems used by modern cars and trucks . The CIA's Mobile Devices Branch (MDB) developed numerous attacks to remotely hack and control popular smart phones . Despite iPhone's minority share (14.5%) of the global smart phone market in 2016 , a specialized unit in the CIA's Mobile Development Branch produces malware to infest , control and exfiltrate data from iPhones and other Apple products running iOS , such as iPads . The attack against Samsung smart TVs was developed in cooperation with the United Kingdom's MI5/BTSS . CIA's arsenal includes numerous local and remote zero days developed by CIA or obtained from GCHQ , NSA , FBI or purchased from cyber arms contractors such as Baitshop . These techniques permit the CIA to bypass the encryption of WhatsApp , Signal , Telegram , Wiebo , Confide and Cloackman by hacking the smart phones that they run on and collecting audio and message traffic before encryption is applied . The CIA also runs a very substantial effort to infect and control Microsoft Windows users with its malware . CIA's malware includes multiple local and remote weaponized zero days , air gap jumping viruses such as Hammer Drill which infects software distributed on CD/DVDs , infectors for removable media such as USBs , systems to hide data in images or in covert disk LOCs Brutal Kangaroo and to keep its malware infestations going . Many of these infection efforts are pulled together by the CIA's Automated Implant Branch (AIB) , which has developed several attack systems for automated infestation and control of CIA malware , such as Assassin and Medusa . The CIA has developed automated multi-platform malware attack and control systems covering Windows , Mac OS X , Solaris , Linux and more , such as EDB's HIVE and the related Cutthroat and Swindle tools , which are described in the examples section below . By hiding these security flaws from manufacturers like Apple and Google the CIA ensures that it can hack everyone &mdsh; at the expense of leaving everyone hackable . Once in Frankfurt CIA hackers can travel without further border checks to the 25 European countries that are part of the Shengen open border LOC — including France , Italy and Switzerland . A number of the CIA's electronic attack methods are designed for physical proximity . The attacker is provided with a USB containing malware developed for the CIA for this purpose , which is inserted into the targeted computer . The attacker then infects and exfiltrates data to removable media . As an example , specific CIA malware revealed in Year Zero is able to penetrate , infest and control both the Android phone and iPhone software that runs or has run presidential Twitter accounts . For example , the CIA attack system Fine Dining , provides 24 decoy applications for CIA spies to use . For example , Comodo was defeated by CIA malware placing itself in the Window's Recycle Bin . CIA hackers discussed what the NSA's Equation Group hackers did wrong and how the CIA's malware makers could avoid similar exposure . The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation . This information is used by the CIA's 'JQJIMPROVISE' software (see below) to configure a set of CIA malware suited to the specific needs of an operation . Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies . HIVE is a multi-platform CIA malware suite and its associated control software . A series of standards lay out CIA malware infestation patterns which are likely to assist forensic crime scene investigators as well as Apple , Microsoft , Google , Samsung , Nokia , Blackberry , Siemens and anti-virus companies attribute and defend against attacks . In April 2013 , Kaspersky Lab reported that a popular game was altered to include a backdoor in 2011 . Yet again , new supply-chain attacks recently caught the attention of ESET Researchers . Given that these attacks were mostly targeted against Asia and the gaming industry , it shouldn’t be surprising they are the work of the group described in Kaspersky’s Winnti – More than just a game” . The OSB functions as the interface between CIA operational staff and the relevant technical support staff . A sustained cyberespionage campaign targeting at least three companies in the United States and Europe was uncovered by Recorded Future and Rapid7 between November 2017 and September 2018 . The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant . The attackers then enumerated access and conducted privilege escalation on the victim networks , utilizing DLL sideloading techniques documented in a US-CERT alert on APT10 to deliver malware . On the two other victim networks , the attackers deployed a unique version of the UPPERCUT (ANEL) backdoor , known to have only been used by APT10 . APT10 actors then compressed proprietary data from Visma using WinRAR (deployed by the attackers) and exfiltrated to a Dropbox account using the cURL for Windows command-line tool . UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques . we assess with high confidence that these incidents were conducted by APT10 also known as Stone Panda , menuPass , CVNX in an effort to gain access to networks and steal valuable intellectual property or gain commercial advantage . On top of the breadth , volume , and targets of attacks that APT10 has conducted since at least 2016 , we now know that these operations are being run by the Chinese intelligence agency , the Ministry of State Security (MSS) . Utilizing actors working for shell companies such as Huaying Haitai Science and Technology Development Co Ltd , the MSS has conducted an unprecedented campaign , dubbed Operation Cloud Hopper , ” against managed IT service providers (MSPs) designed to steal intellectual property and enable secondary attacks against their clients . We assess that APT10 likely compromised Visma with the primary goal of enabling secondary intrusions onto their client networks , and not of stealing Visma intellectual property . In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage . The backdoor was deployed using the Notepad++ updater and sideloading malicious DLL , as noted in APT10’s targeting of Japanese corporations in July 2018 . That attack was attributed to perpetrators Kaspersky called the Winnti Group . APT10 is a threat actor that has been active since at least 2009 . APT10 has historically targeted healthcare , defense , aerospace , government , heavy industry and mining , and MSPs and IT services , as well as other sectors , for probable intellectual property theft . We believe APT10 is the most significant Chinese state-sponsored cyber threat to global corporations known to date . In the blog , Intrusion Truth identified APT10 as having utilized several Tianjin-based companies , including Huaying Haitai Science and Technology Development Co. Ltd. and Laoying Baichen Instruments Equipment Co. Ltd . Based on the technical data uncovered , and in light of recent disclosures by the U.S. Department of Justice on the ongoing activities of Chinese state-sponsored threat actors . Our research from 2017 concluded that Guangdong ITSEC (and therefore the MSS) directed the activities of a company named Boyusec , which was identified as a shell company for APT3 . Access to the networks of these third-party service providers grants the MSS the ability to potentially access the networks of hundreds , if not thousands , of corporations around the world . The December APT10 indictment noted that the group’s malicious activities breached at least 45 companies and managed service providers in 12 countries , including Brazil , Canada , Finland , France , Germany , India , Japan , Sweden , Switzerland , the United Arab Emirates , the United Kingdom , and the United States . In all three incidents , APT10 gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials . In all three incidents , the attackers gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials . In all three incidents , APT10 actors used previously acquired legitimate credentials , possibly gained via a third-party supply chain compromise in order to gain initial access to the law firm and the apparel company . In early 2017 , APT10 began conducting attacks against global managed IT service providers (MSPs) that granted them unprecedented access to MSPs and their customers’ networks . 'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/Exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS ( JukeBox ) and Linux ( DanceFloor ) . . During this operation (dubbed ‘Cloud Hopper” because of the group’s use of popular western cloud-based services) , APT10 utilized both new malware (Quasar RAT , Trochilus , RedLeaves , ChChes as well as some familiar old tools . Most recently , on December 20 , 2018 , the U.S. Department of Justice charged two hackers associated with the Chinese Ministry of State Security (MSS) with global computer intrusion campaigns targeting intellectual property . This indictment attributed the intrusions to APT10 , a group that had been conducting the malicious activities for over a decade on behalf of the MSS , China’s civilian human intelligence agency . The Visma group operates across the entire Nordic region along with Benelux , Central , and Eastern Europe . Recorded Future has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 . We were particularly interested in identifying whether any customers of the targeted MSPs were subsequently compromised by APT10 , given their potential access through compromised MSP networks . Recorded Future’s Insikt Group has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 . In September 2018 , one of our clients (and a supplier as well) , Visma , reached out to us for assistance in investigating an incident uncovered on their network following a breach notification by Rapid7 . This was followed by an initial exploitation , network enumeration , and malicious tool deployment on various Visma endpoints within two weeks of initial access . On August 30 , 2018 , APT10 deployed their first modified version of Trochilus that had its C2 communications encrypted using Salsa20 and RC4 ciphers instead of the more common RC4-encrypted Trochilus variant seen in the wild . This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 . The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process . APT10 also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API . In order to exfiltrate the compromised data , APT10 employed custom malware that used Dropbox as its C2 . They also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API . Our research partner Rapid7 investigated the Dropbox use and found that the attackers had used the same account to store exfiltrated data from a global apparel company . They also identified broadly similar TTPs being used in the attack against a U.S. law firm specializing in intellectual property law . Rapid7’s investigation revealed the law firm was first targeted in late 2017 , followed by the apparel company a few months later , and finally , the Visma attack in August 2018 . In one of the attacks , Rapid7 identified the attackers escaping a Citrix application in order to run the payload script on the victim desktop . Additionally , the same DLL sideloading technique observed in the Visma attack was used , and many of the tools deployed by the APT10 shared naming similarities as well 1.bat , cu.exe , ss.rar , r.exe , pd.exe . Most interestingly , Rapid7 observed the use of the Notepad++ updater gup.exe as a legitimate executable to sideload a malicious DLL (libcurl.dll) in order to deploy a variant of the UPPERCUT backdoor also known as ANEL . APT10 used this approach to deploy UPPERCUT when targeting Japanese corporations in July 2018 . APT10 actors gained initial access to the Visma network around August 17 , 2018 . While we are confident that APT10 actors gained access to the Visma network in August using stolen employee Citrix remote desktop credentials , it is not clear how or when these credentials were initially compromised . Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials . After almost two weeks , on August 30 , 2018 , APT10 attackers used their access to the network to move laterally and made their first deployment of an RC4- and Salsa20-encrypted variant of the Trochilus malware using a previously associated DLL sideloading techniquE . This means that APT10 actors had two separate access points into the Visma network . This slight delay may point to the handing over of active exploitation duties to other operator(s) in a multi-team APT10 effort within the Ministry of State Security for the attack . Other examples of malicious infrastructure registered with internet.bs include domains for APT28’s VPNFilter malware campaign and the registration of the cyber-berkut . org domain that was affiliated with the pro-Russian and potentially Russian state-linked threat actor CyberBerkut . KHRAT is a backdoor trojan purported to be used with the China-linked cyberespionage group DragonOK . In early 2018 , Rapid7 identified that APT10 compromised an apparel company , based upon detections and intelligence gathered from the U.S.-based law firm breach . The attacker gained access to the victim’s internet-accessible Citrix systems and authenticated to them from networks associated with low-cost VPN providers owned by VPN Consumer Network . Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe.” The attackers used identical TTPs for executing malware and Mimikatz as observed before , by using DLL sideloading with known good binaries that had DLL search order path issues . Rapid7 reviewed malware discovered in the victim’s environment and found implants that used Dropbox as the C2 . The attackers used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script . APT10 used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script . For Exfiltration of stolen data , APT10 used WinRAR and renamed rar.exe” to r.exe” to create archives , upload them with curl.exe” (renamed to c.exe”) , and again , use the cloud storage provider Dropbox . Rapid7 discovered that additional data was placed into the Dropbox accounts under control of the attacker during the compromise and was able to attribute data that was placed into it as being owned by Visma . Once on the Visma network , APT10 attackers used the Microsoft BITSAdmin CLI tool to copy malicious tools from a suspected attacker-controlled C2 hosted on 173.254.236[.]158 to the \ProgramData\temp\ directory on the infected host . Rapid7 then provided a breach notification to Visma to alert them to this compromise in September 2018 . We believe APT10 is the most significant known Chinese state-sponsored cyber threat to global corporations . APT10's unprecedented campaign against MSPs , alleged to have included some of the largest MSPs in the world , in order to conduct secondary attacks against their clients , grants the Chinese state the ability to potentially access the networks of hundreds (if not thousands) of corporations around the world . This campaign brings to light further evidence supporting the assertions made by the Five Eyes nations , led by the U.S. Department of Justice indictment against APT10 actors outlining the unprecedented scale of economic cyberespionage being conducted by the Chinese Ministry of State Security . This report , alongside the plethora of other reporting on APT10 operations , acutely highlights the vulnerability of organizational supply chains .


Perhaps the Dukes group thought that by faking a timestamp from before the earliest one cited in the whitepaper , they might be able to confuse researchers .


All nine certificates were used maliciously in 2015 .


Beginning in May 2017 , FireEye observed a number of Ukrainian websites compromised with BACKSWING v1 , and in June 2017 , began to see content returned from BACKSWING receivers . ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints .


FireEye Labs recently detected a limited APT campaign exploiting zero-day vulnerabilities in Adobe Flash and a brand-new one in Microsoft Windows .


MD5s : c4c4077e9449147d754afd972e247efc Document.apk 0b8806b38b52bebfe39ff585639e2ea2 WUC ’ s Conference.apk Triada : organized crime on Android Triada is a modular mobile Trojan that actively uses root privileges to substitute system files and uses several clever methods to become almost invisible March 3 , 2016 You know how armies typically move : first come the scouts to make sure everything is ok. Then the heavy troops The first time the Lambert family malware was uncovered publicly was in October 2014 , when FireEye posted a blog about a zero day exploit ( CVE-2014-4148 ) used in the wild . The actor then made subtle modifications to the file and uploaded the newly created file to the same popular antivirus testing website in order to determine how to evade detection .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 . We started connecting the dots when we discovered that the Okrum backdoor was used to drop a Ketrican backdoor , freshly compiled in 2017 .


Small Trojans like Leech , Ztorg and Gopro now download one of the most advanced mobile Trojans our malware analysts have ever encountered — we call it Triada . The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Artifacts identified within the malware samples related to these attacks also suggest the targeting of the defense industry in Saudi Arabia , which appears to be related to an earlier wave of attacks carried out in the fall of 2015 .


A recent whois of “ goldncup.com ” . Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam 's manufacturing , consumer products , and hospitality sectors . The graph highlights the at least 3 different variants of Ursnif that were being hosted on the bevendbrec.com site . The fact the attackers were attempting to connect in realtime with victims over phones and video conferences for conversations rather than just engaging over email is also unusual , suggesting confidence in the attackers skills in English and in impersonation although it is not clear if any conversations ended up taking place .


The “ VPN Filter ” malware has also been attributed to STRONTIUM by the FBI .


The Dukes primarily target Western governments and related organizations , such as government ministries and agencies , political think tanks , and governmental subcontractors .


Given that this is an active threat , we ’ ve been working behind-the-scenes with our customers to ensure both personal and enterprise customers are protected from this threat and only decided to come forward with this information after the research team at Kaspersky released a report earlier today . WhiteBear is a parallel project or second stage of the Skipper Turla cluster of activity documented in another private intelligence report " Skipper Turla – the White Atlas framework " from mid-2016 . Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes . The videos were quickly passed around offices while users ’ systems were silently infected in the background , and many of the APT ’s components were signed with phony Intel and AMD digital certificates .


While we believe CosmicDuke to be an entirely custom- written toolset with no direct sharing of code with other Duke toolsets , the high-level ways in which many of its features have been implemented appear to be shared with other members of the Duke arsenal .


Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before . Hackers used the remote access to detect servers of their interest in the internal network .


The commands received via GCM can not be blocked immediately on an infected device . Armed with this information about the malware and living off the land tactics being used by this group of attackers whom we named Thrip , we broadened our search to see if we could find similar patterns that indicated Thrip had been targeting other organizations . As with previous ShadowPad variants , the Config module ( 102 ) contains an encrypted string pool that can be accessed from any other module . If an adversary can send an unauthorized command message to a control system , then it can instruct the control systems device to perform an action outside the normal bounds of the device 's actions .


220.158.216.127 to gather additional Zebrocy samples as well as a weaponized document .


Delivery Hashes :


Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 . Designated as Threat Group 3390 and nicknamed " Emissary Panda " by researchers , the hacking group has compromised victims' networks largely through " watering hole " attacks launched from over 100 compromised legitimate websites , sites picked because they were known to be frequented by those targeted in the attack .


The use of the CARBANAK malware in FIN7 operations also provides limited evidence that these campaigns are linked to previously observed CARBANAK operations leading to fraudulent banking transactions , ATM compromise , and other monetization schemes . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks . In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task .


During one intrusion , the threat actors extensively used this tool to execute WMI commands on remote hosts in the environment .


Also , we found the IP address 185.25.50.93 hosting C2 services for a Delphi backdoor that ESET ’s report states is the final stage payload for these attacks .


The first attack vector is to compromise the out of band authentication for online banks that rely on SMS using SMS forwarding . XBOW 's capabilities are derived from BIFROSE and KIVARS ; Shrouded Crossbow gets its name from its unique mutex format . txt . These restrictions are specified by a list of allowed URIs .


Files of the FLV file format contain a sequence of Tag structures .


Both WERDLOD and OSX_DOK.C targeted financial institutions , with a particular focus on banks in Switzerland .


Callisto Group appears to be intelligence gathering related to European foreign and security policy . In particular , TG-3390 has exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code .


In earlier versions , the something part of the relative path was a partially intelligible , yet random mix of words and short combinations of letters and numbers separated by an underscore , for example , “ bee_bomb ” or “ my_te2_mms ” . Like many threat groups , TG-3390 conducts strategic web compromises ( SWCs ) , also known as watering hole attacks , on websites associated with the target organization 's vertical or demographic to increase the likelihood of finding victims with relevant information . This time , the group explored unpatched systems vulnerable to CVE-2016-8655 and Dirty COW exploit ( CVE-2016-5195 ) as attack vectors . According to the Education Data Initiative , " Public education spending in the United States falls short of global benchmarks and lags behind economic growth . "


Specifically , Lookout determined these were trojanized versions of the apps SR Chat and YeeCall Pro . First , Turla steals emails by forwarding all outgoing emails to the attackers . ZxShell implemented its own version of the Windows B-TOOL S-OS SC command . The second step is simply the same exploit used in the second step of ProxyNotShell , allowing code execution through PowerShell remoting .


However , around a month ago , Rocke started targeting systems that run Jenkins by attempting to exploit CVE-2018-1000861 and CVE-2019-1003000 . A ransomware variant dubbed PyLocky was observed in September 2018 being distributed by a phishing campaign using an invoicing theme .


The updated DealersChoice documents used a similar process to obtain a malicious Flash object from a C2 server , but the inner mechanics of the Flash object contained significant differences in comparison to the original samples we analyzed .


MITRE TAGS Action Tag ID App auto-start at device boot T1402 Input prompt T1411 Capture SMS messages T1412 Application discovery T1418 Capture audio T1429 Location tracking T1430 Access contact list T1432 Access call log T1433 Commonly used port T1436 Standard application layer protocol T1437 Masquerage as legitimate application T1444 Suppress application icon T1508 Capture camera T1512 Screen capture T1513 Foreground persistence T1541 DualToy : New Windows Trojan Sideloads Risky Apps to Android and iOS Devices We started connecting the dots when we discovered that the Okrum backdoor was used to drop a Ketrican backdoor , freshly compiled in 2017 . The group focuses on targeting Korean think tank as well as DPRK/nuclear-related targets .


Svpeng is only currently attacking clients of Russian banks . Turla is a notorious group that has been targeting diplomats . Winnti : hpqhvsei.dll . The messages show that Harrison was hired in March 2010 to help promote Ashley Madison online , but the messages also reveal Harrison was heavily involved in helping to create and cultivate phony female accounts on the service .


Although there are obvious differences between the legitimate file and the malicious one , filtering out the malicious file would involve going through a data set with noise from millions of possible file names , software publishers , and certificates .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel® Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication . The attack wave started in late July 2011 and continued into midSeptember 2011 .


] cc/3 * * * * * 1 ” . The FBI issued a rare bulletin admitting that a group named APT6 hacked into US government computer systems as far back as 2011 and for years stole sensitive data . Once executed , two files were dropped on the targeted system : a decoy document (a picture) and a fake svchost.exe binary .


The email was made to look like as if an investigation report related to Uri terror attack was shared by the MHA official .


In the actual targeted attack detected by the Hungarian National Security Agency , they used components of the TeamViewer tool combined with other malware modules . According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability .


FireEye Labs detects this phishing attack and customers will be protected against the usage of these sites in possible future campaigns . The following examples were developed using a Winnti installer that was used in attacks in December 2016 .


The service continues by loading an ELF , created by Baidu , which is capable of tracking the device location before setting up a monitor to harvest phone numbers associated with outgoing calls for those numbers with a country code “ +86 ” prefix , which relates to the People ’ s Republic of China . Both APT41 and the actors in the CCleaner incident used TeamViewer during initial compromise . APT28 is using novel techniques involving the EternalBlue exploits and the open source tool Responder to spread laterally through networks and likely target travelers .


There is no doubt that BitPaymer ransomware operations are proving successful for Indrik Spider , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan . We assess with high confidence that these operations are distinctly different and independent from the operations performed by DNSpionage , which we reported on in November 2018 .


Most of the strings inside the module are encrypted with a homebrew XOR-based algorithm .


Some IoT devices may even communicate basic telemetry back to the device manufacturer or have means to receive software updates .


MUMMY SPIDER is a criminal entity linked to the core development of the malware most commonly known as Emotet or Geodo . Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


Fake SMS message luring users to enter a fake website , which contains the malicious APK ( JPCERT report ) . Other commodity RAT malware families , such as AdwindRAT and RevengeRAT , were also linked to suspected APT33 domain activity . A second group , which we call GCMAN because the malware is based on code compiled on the GCC compiler , emerged recently using similar techniques to the Metel Group to infect banking institutions and attempt to transfer money to e-currency services .


Also , the software vulnerabilities pointed out in the FOTA software by Strazzere in 2015 could have been taken advantage of by cybercriminals looking to steal bank account details or execute other frauds . INF ﬁles have been used in the past by MuddyWater , although they were launched using Advpack.dll and not IEAdvpack.dll . The actors have also conducted spearphishing .


Two suspicious artifacts have been retrieved from two separate servers within the Die Linke infrastructure .


Zen does n't even check for the root privilege : it just assumes it has it . The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage . Based on our visibility and available data , we only attribute one campaign to the Chinese APT group APT16 . The duration of manipulation may be temporary or longer sustained , depending on operator detection .


Following the trail further , we traced malicious traffic back to where it originated from and looked for additional evidence to indicate that the attacker persistently used the same infrastructure .


This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 .


All of the 4 previously mentioned toolsets were written in a minimalistic style commonly seen with malware ; MiniDuke even goes as far as having many components written in Assembly language .


A complete list of sample hashes is available here . Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server . As part of our monitoring of Iranian threat agents activities , we have detected that since October 2016 and until the end of January 2017 , the Jerusalem Post , as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens .


Modifications :


Interestingly , the command and control server includes a publicly accessible interface to work with the victims : Some of the commands with rough translations : The command-and-control server is running Windows Server 2003 and has been configured for Chinese language : This , together with the logs , is a strong indicator that the attackers are Chinese-speaking . Moreover , they used the same exploit kit Niteris as that in the Corkow case . The Operation Aurora , named by McAfee and announced in January 2010 , and the WikiLeaks document disclosures of 2010 have highlighted the fact that external and internal threats are nearly impossible to prevent .


] comrose-sturat [ . Just like with RedOctober , the top target of Cloud Atlas is Russia , followed closely by Kazakhstan , according to data from the Kaspersky Security Network ( KSN ) . Occasionally , APT1 attackers have installed C2 server components on systems in their hop infrastructure rather than forwarding connections back to C2 servers in Shanghai . All they need to do is deploy and configure the provided phishing kit with an API key .


The GoogleUpdate.exe component is responsible for communicating with the remote C&C server . The oldest sample we've seen up to now is from November 2013 .


Figure 6 . Based on our research , SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans . McAfee Advanced Threat Research analysts have uncovered a global data reconnaissance campaign assaulting a wide number of industries including critical infrastructure , entertainment , finance , health care , and telecommunications .


But I never received such files from their command and control server . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) . Though our visibility of APT1 ’s activities is incomplete , we have analyzed the group ’s intrusions against nearly 150 victims over seven years . While inspecting one of the C&C servers of Miniduke , we have found files that were not related to the C&C code , but seemed to be prepared for infecting visitors using web - based vulnerabilities .


ISMDoor is able to exfiltrate data , take screenshots , and execute arbitrary commands on the victim 's machine . The vast majority of systems communicating with Bookworm C2 servers are within the Bangkok metropolitan LOC where a majority of the government of Thailand exists .


Gaza Cybergang Group 1 , also dubbed MoleRATs : MoleRATs has been active since at least 2012 .


TG-3390 : backup.darkhero.org .


In 2015 and 2016 , GOLD LOWELL frequently exploited JBoss enterprise applications using several versions of this open-source JBoss exploitation tool . Since the last report , PassCV has significantly expanded its targets to include victims in the United States , Taiwan , China and Russia .


Password generation for compressed files takes place client-side with each device using a unique key in most scenarios . Citrix told Threatpost that this is indeed the same password-spraying attack it announced itself last week – but it wouldn't confirm the other details in Resecurity 's post , including the attribution . APT1 also used more generic names referencing topics like software : Most do n’t even do much besides Since the most common allowed domain is google-analytics.com ( 17 K websites )


HenBox masquerades as apps such as VPN and Android system apps and often installs legitimate versions of these apps along with HenBox to trick users into thinking they downloaded the legitimate app . Cisco telemetry confirmed that the actors behind Sea Turtle maintained access to the ICS-Forth network from an operational command and control (C2) node . The agroup targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


Through research , 360 Helios Team has found that , since 2007 , the Poison Ivy Group has carried out 11 years of cyber espionage campaigns against Chinese key units and departments , such as national defense , government , science and technology , education and maritime agencies . The vulnerability is bypassing most mitigations; however , as noted above , FireEye email and network products detect the malicious documents .


So if you have Android 4.4.4 or some more recent version of this OS on your device , your chances of getting infected with Triada are significantly lower . Beginning in August 2016 , a group calling itself the Shadow Brokers began releasing tools it claimed to have originated from the Equation Group . APT34 loosely aligns with public reporting related to the group " OilRig " .


The file is named netwf.dat .


LEAD also steals code-signing certificates to sign its malware in subsequent attacks .


TYPE_VIEW_FOCUSED Represents the event of setting input focus of a View . In many attacks , the group has succeeded in compromising Microsoft Exchange or Lotus Domino email servers in order to intercept company emails and possibly use them to send counterfeit emails . AveMaria : 185.61.138.249 tain.warzonedns.com noreply377.ddns.net 185.162.131.97 91.192.100.62 server.mtcc.me doddyfire.dyndns.org 212.8.240.116 168.167.45.162 toekie.ddns.net warmaha.warzonedns.com . As a result , we decided to call this variant FakeSG .


They should still be on the lookout for these kinds of trojans , as the attackers could target corporate accounts that contain large amounts of money . Since late 2016 , PwC UK and BAE Systems have been assisting victims of a new cyber espionage campaign conducted by APT10 . OceanLotus : a2719f203c3e8dcdcc714dd3c1b60a4cbb5f7d7296dbb88b2a756d85bf0e9c1e Loader #1 . KillNet Appears to Increase Capabilities


Technical Analysis The malware consists of 2 applications : The Dropper : Brain Test ( Unpacked – com.mile.brain , Packed – com.zmhitlte.brain ) This is installed from Google Play and downloads an exploit pack from the server to obtain root access on a device . The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . We observed the deployment and testing of multiple versions of Quasar malware , and the introduction of the bespoke malware families ChChes and RedLeaves .


More likely , this is a case of common attack tools being re-used between different threat actor groups . Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations . The Sofacy threat group continues to target government organizations in the EU , US , and former Soviet states to deliver the Zebrocy tool as a payload .


During this stage of the activation cycle , the malware increases the beaconing time to avoid detection . This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia . Rmcmd : In April , Talos discovered a new ransomware actor , RA Group , conducting double extortion attacks using their ransomware variant based on leaked Babuk source code .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry . Around the same time , WildFire also captured an e-mail containing a Word document ( " hello.docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient .


In 2011 MSK stopped following Daylight Saving Time ( DST ) and was set to UTC+4 year-round , then reset to UTC +3 yearround in 2014 .


In mid-August , the OilRig threat group sent what appeared to be a highly targeted phishing email to a high-ranking office in a Middle Eastern nation . The attacks in that case took place in late September to early October 2016 and the attackers stored the MoonWind samples as RAR files , while in the November attacks the RATs were stored as executables .


The Federal Service for Technical and Export Control ( FTEC ) which is responsible for export control , intellectual property , and protecting confidential information .


Suite 3000 was repeatedly found in each instance .


The regsvr32.exe executable can be used to download a Windows Script Component file (SCT file) by passing the URL of the SCT file as an argument . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) .


Analysis of the additional spyware modules is future work . In addition to using PlugX and Poison Ivy ( PIVY ) , both known to be used by the group , they also used a new Trojan called " ChChes " by the Japan Computer Emergency Response Team Coordination Center ( JPCERT ) . The routine that reads configuration from resources and decompresses the C2 communication library is then called by temporarily replacing the pointer to CComCriticalSection function with the pointer to that routine . Another detection opportunity identified by Mandiant was source IP addresses that access multiple user accounts in a short period of time recorded in the ns.log files or forwarded logs via syslog .


As we saw in both 2016 and 2017 , disruptions to Necurs went hand-in-hand with quiet periods from TA505 .


Code structure Obviously , this code is not obfuscated when compared with the previous version it becomes clear that this is the same code base . Chafer , uses Backdoor.Remexi . These documents were also emailed to organizations in Japan and Taiwan . During C0018 , the threat actors opened a variety of ports , including ports 28035 , 32467 , 41578 , and 46892 , to establish RDP connections.[9 ]


The figure below shows a fragment of encrypted JAR stored in .rodata section of a shared object shipped with the APK as well as the XOR key used for decryption . As a result , it is already flagged as Bahamut by antivirus engines . The architecture of this dropper is different from the others : it starts extracting the main driver from itself . A new report from the Malwarebytes Threat Intelligence team shows 1,900 total ransomware attacks within just four countries — the US , Germany , France , and the UK — in one year .


Recommendations Popular mobile platforms like Android are common targets for organized or commercialized monitoring operations . During intense intelligence gathering over the last 24 months , we observed the technical capabilities of the Operation Cleaver team rapidly evolve faster than any previously observed Iranian effort . The unflattening algorithm requires mapping information between block comparison variable and the actual block number ( mblock_t : :s erial ) In 2009 , the Winnti group shifted to targeting gaming companies in South Korea using a self - named data- and file - stealing malware .


Some of these might have been used on old campaigns or were already prepared for new campaigns . We have observed that in cases where APT10 has infiltrated a target via an MSP , it continues to use the MSPs credentials . The attack took place between June and November 2018 and according to our telemetry , it affected a large number of users . – Consistent with KillNet activity in 2022 , the majority of claimed attacks in 2023 targeted entities in the U.S. and Europe .


This is custom malware , which despite large file size ( 1,1 MB ) , provides limited functionality .


The majority of the overall samples came from the following four sites :


These targets have included organizations such as ministries of foreign affairs , embassies , senates , parliaments , ministries of defense , defense contractors , and think tanks .


They also changed the final Windows payload significantly from the well-known Fallchill malware used in the previous attack .


] com ’ was registered via GoDaddy , and uses privacy protection service . Just last week Lazarus were found stealing millions from ATMs across Asia and Africa . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) .


Table 2 below lists some of these apps with their respective metadata . To witnesses , the spy appears to be running a program showing videos (e.g VLC) , presenting slides (Prezi) , playing a computer game (Breakout2 , 2048) or even running a fake virus scanner . APT17 , also known as DeputyDog , is a China-based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


Report_URL : https://blog-assets.f-secure.com/wp-content/uploads/2020/03/18122307/F-Secure_Dukes_Whitepaper.pdf


Furthermore , we found that in just the first two weeks of 2017 , there have been more than 120 such spyware variants already built using the same SpyNote Trojan builder as SpyNote RAT and roaming in the wild . The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine . The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled .


Moreover , they used the same exploit kit Niteris as that in the Corkow case . In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group Symantec calls Dragonfly ( which Dragos associates with DYMALLOY ) .


The strings inside the binary are encrypted using 3DES and XOR and reversed .


When users try to close the ads , the new functionality causes already downloaded apps to run in a virtual machine . Furthermore , like many other identified Lazarus Group families , these tools showcase the group 's creative solutions , such as the PapaAlfa , which makes it difficult to immediately identify potentially malicious activity on a compromised network . Notestuk ( Backdoor.Notestuk ) ( aka TURNEDUP ) : Malware that can be used to open a backdoor and gather information from a compromised computer . Healthcare has seen increasing email attacks from threat actors for a number of reasons .


The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes . Barium specializes in targeting high value organizations holding sensitive data , by gathering extensive information about their employees through publicly available information and social media , using that information to fashion phishing attacks intended to trickthose employees into compromising their computers and networks .


Most of the network traffic we ’ ve observed is HTTP . Because APT38 is backed by ( and acts on behalf of ) the North Korean regime , we opted to categorize the group as an " APT " instead of a " FIN " . Control flow flattening is an obfuscation method where programs do not cleanly flow from beginning to end . None LIGHTWORK is a disruption tool written in C++ that implements the IEC-104 protocol to modify the state of RTUs over TCP .


] 87:28833 61 [ . The Sofacy group created the Komplex Trojan to use in attack campaigns targeting the OS X operating system – a move that showcases their continued evolution toward multi-platform attacks . The PowerShell script will first create an instance of the .Net Webclient class and then enumerate the available methods using the GetMethods() call ( highlighted in the image in red ) . Considering that both Royal and BlackSuit were active last month , however , a rebrand probably is n’t happening any time soon .


The group had obtained the certificates through pre-attack operations before commencing targeted attacks against a number of government and commercial organizations spread across multiple continents over a two-year period .


Shamoon2 : analytics-google.org : 69/checkFile.aspx .


Other samples were also noticed , posing as a client of a ticket-finding service or as an app store for Android . Distinct changes to Azazel by the Winnti developers include the addition of a function named ‘Decrypt2’ , which is used to decode an embedded configuration similar to the core implant . This evolution is illustrated across 4 campaigns : one in 2014 , one in 2016 and finally two in 2017 .


It appears that they introduced Shifu after high-profile law enforcement actions impacted Dridex distribution .


These additional samples behaved similarly to the initial files ;


Next , the dropper checks its own parent process for indications that it is running in a sandbox setup . We have also seen Magic Hound using DropIt as a binder , specifically dropping a legitimate decoy executable along with the malicious executable onto the target host . Winnti : T1032 Standard Cryptographic Protocol ( RC4 , RC5 ) . title : MicroSCADA SCILC Command Execution description : Identification of Events or Host Commands that are related to the MicroSCADA SCILC programming language and specifically command execution author : Mandiant date : 2023/02/27 logsource : product : windows service : security detection : selection : NewProcessName|endswith : - \scilc.exe CommandLine|contains : -


When specific versions are discovered that may cause issues for the RAT , it promptly exits .


The loader Trojan uses this batch file to run the embedded DLL payload .


Currently , this only affects Russian banks , but the technology behind Svpeng could easily be used to target other banking applications . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including embassies . The primary attack vectors are watering-hole , spear phishing , and other web-based attacks . KillMilk continues to be a central coordinator for the KillNet Collective , despite claims of leaving the group in mid-2022 .


After reestablishing access , the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used .


PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts . The NetTraveler trojan has been known to be used in targeted cyber espionage attacks for more than a decade by nation state threat actors and continues to be used to target its victims and exfiltrate data .


This intelligence has been critical to protecting and informing our clients , exposing this threat , and strengthening our confidence in attributing APT28 to the Russian Government .


The ActionScript will read each byte of the C2 response and get the hexadecimal value .


We found no similarities to commercial spyware products or to other known spyware variants , which suggests BusyGasper is self-developed and used by a single threat actor . Because of this , additional HIDDEN COBRA malware may be present on systems compromised with FALLCHILL . Activity ceased until the attackers returned on March 5 and were observed using Quasar RAT to download a second custom AutoIt FTP Exfiltration tool known as FastUploader from http://192.119.15.36:880/ftp.exe . Techniques include reading SAM and LSA secrets from registries , dumping NTLM hashes , plaintext credentials , and Kerberos keys , as well as dumping the NTDS.dit Active Directory database .


This code modification marks an unusual departure from the typical AZZY backdoors , with its C&C communication functions moved to an external DLL file .


A TrickMo version from January 2020 contained code that checks if the app is running on a rooted device or an emulator to prevent analysis . According to Wikipedia , the CSS was formed in 1972 to integrate the NSA and the Service Cryptologic Elements ( SCE ) of the U.S armed forces . In addition to Helminth , the ISMDoor implant is likely used by the Iran-based adversary to attack targets particularly those in the Middle East region .


This investigation shows multiple similarities to previous attacks attributed to a group called MoleRATs ( aka The Gaza Cybergang ) , an Arabic-speaking , politically motivated group that has operated in the Middle East since 2012 .


The malware then builds two DLLs in memory – they are 32 and 64-bit DLLs that have identical functionality . 360 and Tuisec already identified some Gorgon Group members .


The “ idXXXXX.top ” pattern immediately stands out and may suggest a pattern in the static configuration for the initial domains used by the DGA for Nymaim since the previous two started with “ ejX.com .


cfd77ddc5c1ebb8498c899a68ea75d2616c1c92a0e618113d7c9e5fcc650094b Flash Player com.gzhlubw.pmevdiexmn 3f2ed928789c200e21fd0c2095619a346f75d84f76f1e54a8b3153385850ea63 Target list The actual observed list of mobile apps targeted by Cerberus contains a total of 30 unique applications . The SectorJ04 group has shown a pattern of hacking activities that have changed from targeted attacks to a large-scale distribution of spam . Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data Exfiltration and to provide remote access to infected machines .


Kaspersky Internet Security for Android detects all three of Triada ’ s modules , so it can save your money from cybercriminals that are behind Triada . We believe the groups moved to use CVE-2018-0798 instead of the other Microsoft Equation Editor Remote Code Execution (RCE) vulnerabilities because the former is more reliable as it works on all known versions of Equation Editor . During the past few months , APT34 has been able to quickly incorporate exploits for at least two publicly vulnerabilities ( CVE-2017-0199 and CVE-2017-11882 ) to target organizations in the Middle East .


FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware or as a file downloaded unknowingly by users when visiting sites compromised by HIDDEN COBRA actors . Unit 42 does not have detailed targeting information for all known Bookworm samples , but we are aware of attempted attacks on at least two branches of government in Thailand .


The red fields are used as the shortcode and keyword for SMS billing . Curiously , Bahamut appears to track password attempts in response to failed phishing attempts or to provoke the target to provide more passwords . In our analysed sample the “ Loveusd.sys ” driver is installed with the name “ USBHPMS ” . In some cases , the threat actors may have been using compromised organizations to gain access to other victims in supplychaintype attacks .


CTU researchers have not observed TG-4127 use this technique ( using Bitly short links ) to target the U.S. Republican party or the other U.S. presidential candidates whose campaigns were active between mid-March and mid-May : Donald Trump , Bernie Sanders , Ted Cruz , Marco Rubio , and John Kasich .


The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer .


It was executed from the Telegram messenger download folder :


By adding the previously calculated offset , it can get the address of the mmap function in the target process memory . The main reason for the increase in Potao detections in 2014 and 2015 were infections through USB drives . APT17 : de56eb5046e518e266e67585afa34612 . These new infection vectors rely on Java and IE vulnerabilities to infect the victim ’s PC .


In this blog , we ’ ll detail the innovative ways in which this ransomware surfaces its ransom note using Android features we haven ’ t seen leveraged by malware before , as well as incorporating an open-source machine learning module designed for context-aware cropping of its ransom note . Unit 42 researchers have been tracking an active campaign . . The IP range for “ PIG GOD ” is 43[.]255[.]188.0/22 , which appears to be hosted in Hong Kong as seen in the information we found : The domain 66[.]to leads to another website that shows Hack520 ’s pet pig .


This shows how the attackers use this backdoor in a surgical way to exclusively attack specific targets .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address .


Both of these infection vectors are highly indiscriminate and untargeted when compared to spearphishing , the usual infection vector of choice for the Dukes .


VERSIONING Bread has also leveraged an abuse tactic unique to app stores : versioning . Barium Defendants install the malicious " Win32/Barlaiy " malware and the malicious " Win32/PlugX.L " malware on victim computers using the means described above . We used the ZxShell package for version 3.10 ( SHA256 : 1622460afbc8a255141256cb77af61c670ec21291df8fe0989c37852b59422b4 ).The convenient thing about this is that the CNC panel worked with any version , 3.10 and above . Lowcode automation of processes can make the required actions fast , reliable , and repeatable .


Using this artifact , we were able to pivot and discover another attack campaign using the DealersChoice exploit kit with similar victimology to what we saw in February .


It considers the age of the file , its global prevalence , and the presence and validity of a digital signature along with the method of service creation .


It was late 2018 when Riltok climbed onto the international stage . Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits . The decoy document of the 2 last campaigns suggests that the targets are public organisations .


This file requires the target to attempt to open the .lnk file , which redirects the user to a Windows Scripting Component ( .wsc ) file , hosted on an adversary-controlled microblogging page . Last week we discussed Numbered Panda , a group that is also based out of China and is fairly well known to the security community , though by many names .


Never click on unknown links received through ads , SMS messages , emails , or the like . Furthermore , from 2015 to 2019 , we detected new versions of known malware families attributed to the Ke3chang group – BS2005 backdoors from operation Ke3chang and the RoyalDNS malware , reported by NCC Group in 2018 . Group7 : APT15 , Mirage , Vixen Panda , GREF , Playful Dragon , RoyalAPT .


The new one with the title " Coralco Archimedes , '' and an older version with the title " Wolf Intelligence : '' New panel Old panel The new panel name contains " Coralco '' in its name . In February 2015 , Kaspersky Lab 's Global Research and Analysis Team ( GReAT ) released its research into the Carbanak campaign targeting financial institutions . Some samples alternatively use an FGKD.jsp or an FPK.jsp file . Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected .


The threat actors are adept at identifying key data stores and selectively exfiltrating all of the high-value information associated with their goal .


The Spark backdoor communicates with the C2 servers over the HTTP protocol .


Discovery T1418 Application Discovery Sends list of installed apps on device . Aside from the attack involving Crambus infrastructure , this sample of Mimikatz has only been seen used in one other attack , against an education target in the UK in 2017 . The Advanced Threat Research team uncovered activity related to this campaign in March 2018 , when the actors targeted Turkish banks .


Screenshots : captures an image of the current screen via the raw frame buffer . The current campaign is a sharp escalation of detected activity since summer 2017 . Winnti : 44260a1d 2018-08-15 10:59:09 https://dump.gxxservice.com/common/up/up_base.php . The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier .


A full description of this zero-day attack can be found in this blog post by Kaspersky Lab 's Vyacheslav Zakorzhevsky . This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies .


But the categories targeted by this group seem to be broadening with the inclusion of VPN software . In one instance , APT37 weaponized a video downloader application with KARAE malware that was indiscriminately distributed to South Korean victims through torrent websites . After that, it checks if the iterator divided by (captureScreenTimeOut/captureActiveWindowTimeOut) has a remainder of . We propose to reach an agreement and conclude a deal .


Users are cautioned to research and check reviews before they download apps . Starting in February 2018 , Unit 42 identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States . The following changes are minor compared with above referenced ones . For connections that occur internally within an enclave ( such as those between a proxy or pivot node and other nodes ) , commonly used protocols are SMB , SSH , or RDP .


Initiating the MQTT client . Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 . This malware has previously been associated with an APT actor that Symantec calls Chafer . In todays world of evolving malware , there are likely a lot of threats antivirus does nt know about .


Seemingly random activity patterns in infrastructure deployment and usage , along with the ability to use a wide variety of geographically diverse infrastructure , help the threat actors avoid detection .


These particular detections are interesting because they indicate an attempted selective 2nd stage deployment of a backdoor maintaining filestealer , keylogger , and remoteshell functionality to a system of interest .


By doing so , attackers can easily set up the Trojan to communicate back to them without any need for high-end servers . And the dropper execute the iassvcs.exe to make a side loading and make the persistence . OilRig : IRN2 , HELIX KITTEN , APT34 .


They continue to be persistent in their attack campaigns and continue to use similar tooling as in the past .


C2 servers are shared by multiple samples . The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 . The macro contains a virtual machine detection technique based on the serial number of the disks available in the victim environment . This is consistent with the group ’s prior activity scanning and exploiting internet facing servers for initial access .


One of the tools seen above that caught our interest was the Dumpert tool , which is freely available on Outflanknl ’s GitHub repository .


EventBot is under active development and is evolving rapidly ; new versions are released every few days with improvements and new capabilities . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups . iDefense assesses with high confidence that this campaign is associated with the threat group DRAGONFISH ( also known as Lotus Blossom and Spring Dragon ) .


Communication with the C & C In order to communicate with its C & C , the app uses the MQTT ( Message Queuing Telemetry Transport ) protocol , which is transported over TCP port 1883 . However , over the past few years , we have been tracking a separate , less widely known suspected Iranian group with potential destructive capabilities , whom we call APT33 . The attackers were using an improved version of Remexi in what the victimology suggests might be a domestic cyber-espionage . Once the malware is dropped and executed through the lure documents , the Foudre backdoor connects to the HTTP commandandcontrol C2 server and downloads a selfextracting archive with fullfeatured Tonnerre malware .


To spread through the hospitality company ’s network , APT28 used a version of the EternalBlue SMB exploit .


AutoFocus customers can track these samples with the Zebrocy and Cannon WildFire detects the delivery documents , Zebrocy and Cannon payloads discussed in this blog with malicious verdicts .


Scarlet Mimic has carried out attacks using both spear-phishing and watering holes since at least 2009 with increasingly advanced malware , and has deployed malware to attack multiple operating systems and platforms . In the case of this malware , the activity groups strongly associated with Winnti are BARIUM and LEAD .


Some of the icons used can be seen below . According to reports , the Philippines is the most exposed country in ASEAN to the cyberattacks known as advanced persistent threats , or APTs . FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran , use of Iranian infrastructure , and targeting that aligns with nation-state interests .


Most recently these included PDF attachments with embedded Microsoft Word documents bearing malicious macros that call PowerShell commands that install Dridex .


Strings ( c2 domains and functionality , error messages , etc ) are custom encrypted per deployment .


The first anti-sandbox technique is the loader checking the code segment . To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys . Winnti : T1022 Data Encrypted . Another finding in the activity of ' Sharpshooter ' were a set of unobfuscated connections from IP addresses in Windhoek , a city in Namibia , Africa .


But devices sold outside of Amazon " might not have ever seen fixes , '' he says . However , Beginning on 25 June 2019 , we started observing multiple commodity campaigns Mostly dropping AsyncRAT using the updated RTF weaponizer with the same exploit (CVE-2018-0798) . C2 : lywja.healthsvsolu.com .


It is not common to use this program to distribute malware , although there have been past cases where malware authors have done so . If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign .


Alternatively , OurMine might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address . However , some phishing emails were sent to bank employees in more than 25 countries of Central and Western Europe , Africa and Asia including : Kyrgyzstan , Armenia , Georgia , Serbia , Germany , Latvia , Czech Republic , Romania , Kenya , Israel , Cyprus , Greece , Turkey , Taiwan , Malaysia , Switzerland , Vietnam , Austria , Uzbekistan , Great Britain , Hong Kong , and others .


Pivoting off of this artifact provided us additional Zebrocy samples .


As MainService is the main controller , the developer has taken the appropriate actions to keep it functional and running at all times . Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability . An expansion into Linux tooling indicates iteration outside of their traditional comfort zone .


APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . The witnessed techniques , tactics and procedures ( TTPs ) are in-line with what we usuallysee in Turla 's operation : a first stage backdoor , such as Skipper , likely delivered through spearphishing followed by the appearance on the compromised system of a second stage backdoor , Gazerin this case .


] com webmail [ . For example , we have observed frequent reuse of older ( patched ) exploits in malware operations against the Tibetan community . But , larger , more successful threat actors tend to evolve at a slower rate . This shorcut uses the WebDav HTTP protocol extension to retrieve the file launcher-upd.hta from a remote server : This heavily obfuscated script is responsible for the execution of PowerShell that downloads the final malware payload ( NetSupport RAT ) .


Below are descriptions of some of the most interesting . AA triggered an alert at a large telecoms operator in Southeast Asia . As usual , all the module timestamps are spread over a short time range , which could suggest the use of a build framework to compile these modules . Currently , Mandiant has observed the deployment of Atera , AnyDesk , and SplashTop to establish and maintain a foothold following exploitation of CVE-2023 - 4966 .


In its analysis , CSIS notes that MazarBOT was reported by Recorded Future last November as being actively sold in Russian underground forums and intriguingly , the malware will not activate on Android devices configured with Russian language settings . Its activity subsequently increased in the second quarter of 2018 , with a particular spike in April 2018 . Other additional modifications were made to the code ( e.g , writing a new algorithm for finding control flow dispatcher and first block , In the past , we have seen such occurrences with Magecart threat actors for example in the breach of the Umbro website .


CrowdStrike® Falcon® Intelligence™ also observed a strong correlation between Dridex infections and BitPaymer ransomware . Afterwards , the installer malware creates a downloader and a configuration file from its resource and executes it .


The reasons for this are unknown , but , we could suggest that they did not want to utilize any exploits to ensure they remained viable for any other operations .


Depending on the settings read from the configuration file , the scope may be narrowed to files with particular extensions and/or files created after a specified date .


To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer . Finally , some of the victims are also infected with other Turla-related malware such as ComRAT or Gazer .


Symantec monitors for this type of activity to help prevent organizations from being tied to malicious actions undertaken with their stolen certificates .


The compilation timestamp therefore had to have been faked .


Falcon Intelligence has had unique insight into the email dialogue between a victim and an INDRIK SPIDER operator . The other one , " Operation Erebus " employs an older exploit , for CVE-2016-4117 and leverages watering holes .


The second file , happiness.txt , contains custom code in binary format that is encrypted and used by xxxx.exe .