After execution it takes care of restoring the original KernelCallbackTable . We present the connection between Behzad Mesri , an Iranian national recently indicted for his involvement in hacking HBO , and Charming Kitten . The shellcode then proceeds to execute the payload DLL’s entry point . It also reveals direct links to secure[.]66[.]to and zhu[.]vn , both of which also belong to Hack520 and contains his personal blog .


The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell's 1984 , but Weeping Angel , developed by the CIA's Embedded Devices Branch (EDB) , which infests smart TVs , transforming them into covert microphones , is surely its most emblematic realization . Some of the exploit server paths contain modules that appear to have been designed to infect Linux computers , but we have not yet located the Linux backdoor .


Lotus Blossom attempted to exploit CVE-2014-6332 using the POC code available in the wild . As detailed in the previous section , this malware is able to manipulate and exfiltrate emails .


ONIONDUKE : First known activity February 2013 , Most recent known activity Spring 2015 , C&C communication methods HTTP(S) , Twitter ( backup ) , Known toolset components Dropper , Loader , Multiple modular core components , Information stealer , Distributed Denial of Service ( DDoS ) module , Password stealing module , Information gathering module , Social network spamming module .


Analysis of the malicious iOS profile also revealed further connections , as the profile can also be downloaded from a website that FakeSpy deployed early this year . However , three themes in APT28 's targeting clearly reflects areas of specific interest to an Eastern European government , most likely the Russian government . In this case, the content net user is written to . The core module has a lot of functionality that gives the attacker full control of the victim machine .


After an app is installed , the ad service pays the attacker . REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japanese organizations such as government agencies ( including defense ) as well as those in biotechnology , electronics manufacturing , and industrial chemistry . . An additional field of interest in the XPdb was the exec_cdhash , which contains the cdhash , or Code Directory hash , of the executed binaries .


The DeltaCharlie DDoS bot was originally reported by Novetta in their 2016 Operation Blockbuster Malware Report .


Technical Analysis The repackaged applications are embedded with malicious code , which can be found in the com.golf package . Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . We have seen two types of documents sent to victims in these spear phishing campaigns . The attackers may also want to use source code stolen from the game companies so it can be deployed in rogue servers offering pirated versions of the games .


Between October 2015 and May 2016 , CTU researchers analyzed 8,909 Bitly links that targeted 3,907 individual Gmail accounts and corporate and organizational email accounts that use Gmail as a service .


FireEye HX Exploit Guard is a behavior-based solution that is not affected by the tricks used here .


If the attackers are attempting to compromise persons involved in SEC filings due to their information access , they may ultimately be pursuing securities fraud or other investment abuse . The targets were similar to a 2015 TG-4127 campaign — individuals in Russia and the former Soviet states , current and former military and government personnel in the U.S. and Europe , individuals working in the defense and government supply chain , and authors and journalists — but also included email accounts linked to the November 2016 United States presidential election .


In addition to the new AZZY backdoors with side-DLL for C&C , we observed a new set of data-theft modules deployed against victims by the Sofacy group .


If the phone is attached to a bank card , commands are sent from the C & C server with instructions to transfer money from the user ’ s bank account to his/her mobile account . Turla all uses an encrypted container to store the malware 's components and configuration and they also log their actions in a file . Middle Eastern hacking group is using FinFisher malware to conduct international espionage . Looking at the motivations of hackers and cybercriminals is just one possible way to look at how we can dictate our cybersecurity priorities .


Then , the APK is installed as system application and registers listener on USER_PRESENT event . According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . Most targets are from the Middle East : Israel , Egypt , Saudi Arabia , United Arab Emirates and Iraq .


SectorJ04 used the spear phishing email to spread malicious Excel or malicious Word files , and downloaded the MSI files from the attacker’s server when the malicious documents were run . The first time the Lambert family malware was uncovered publicly was in October 2014 , when FireEye posted a blog about a zero day exploit ( CVE-2014-4148 ) used in the wild .


After conveniently granting itself additional privileges and securing its persistence on the device , Cerberus registers the infected device in the botnet and waits for commands from the C2 server while also being ready to perform overlay attacks . They mainly utilize spam email to deliver their backdoor to the infected system that can perform additional commands from the attacker’s server . A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group .


As part of our investigations , we were also able to identify and contact one of the attackers to try and gain insights into the motivations behind these attacks .


The infection begins when a user downloads and installs a Gooligan-infected app on a vulnerable Android device . One group , which we call Cadelle , uses Backdoor.Cadelspy , while the other , which we've named Chafer , uses Backdoor.Remexi and Backdoor.Remexi.B . So the pattern matching function replaces the global variable with 0 . 3AM is socalled because it appends encrypted files with the extension .threeamtime .


In June 2016 , shortly after the DNC ’s announcement , the Guccifer 2.0 persona claimed responsibility for the DNC breach and leaked documents taken from the organization ’s network .


This led us to believe the two groups were connected , at least to begin with , although it appears they parted ways in 2014 , with the original Miniduke group switching to the CosmicDuke implant .


It is now clear that a distinct industry has developed and is becoming more focused on extracting profits , which is clearly evident from the functionality of the malware . We suspect this router was hacked as part of the campaign in order to process the malware 's HTTP requests . We have chosen to keep the name “ Winnti Group ” since it ’s the name first used to identify it , in 2013 , by Kaspersky . As we commonly see in the ransomware space , this threat is delivered through a variety of mechanisms which can include phishing and being dropped as secondary payloads from command and control ( C2 ) frameworks like Cobalt Strike .


The filenames across the two variants bear striking similarities .


Use and configure available firewalls to block attacks .


Exfiltrated contact list data sent to the C2 server . The list also includes several hack tools , such as Mimikatz for credential dumping and several compiled python scripts used to locate and compromise other systems on the local network . As the crisis in Syria escalates , FireEye researchers have discovered a threat group , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe .


Mobile Malware Evolution : 2013 24 FEB 2014 The mobile malware sector is growing rapidly both technologically and structurally . The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool ( RAT ) . The Winnti Group , active since at least 2012 , is responsible for for high-profile supply-chain attacks against the video game and software industries leading to the distribution of trojanized software ( such as CCleaner , ASUS LiveUpdate and multiple video games ) that is then used to compromise more victims . Method , where the code checks one of two values before running encryption logic


As news of the DNC breach spread , APT28 was preparing for another set of operations : countering the condemnation that Russia was facing after doping allegations and a threatened blanket ban of the Russian team from the upcoming Rio Games .


Screenshot capture ( with the GDI API ) ;


The module allows Gooligan to : Steal a user ’ s Google email account and authentication token information Install apps from Google Play and rate them to raise their reputation Install adware to generate revenue Ad servers , which don ’ t know whether an app using its service is malicious or not , send Gooligan the names of the apps to download from Google Play . BlackOasis ' interests span a wide gamut of figures involved in Middle Eastern politics . We need to check if the value comes from the result of x * ( x – 1 ) Tools used by the attackers in this campaign included


This tool also has a heavy reliance on EventHandlers with timers to run its methods in a specific order and potentially increase its evasion capability .


This method is not unique to HammerDuke , as MiniDuke , OnionDuke , and CozyDuke all support similar use of Twitter ( image 9 , page 18 ) to retrieve links to additional payloads or commands . 2015 : CloudDuke .


Given the evidence outlined above , CrowdStrike attributes the PUTTER PANDA group to PLA Unit 61486 within Shanghai , China with high confidence . We didn’t choose to name it after a vegetable; the .NET malware developers named it Topinambour themselves .


The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes . Some of the exploit server paths contain modules that appear to have been designed to infect Linux computers , but we have not yet located the Linux backdoor .


In 2011 , three years after the most recent release of PIVY , attackers used the RAT to compromise security firm RSA and steal data about its SecureID authentication system . Based on the command capabilities of the Taidoor malware , we were able to determine that data theft and data destruction was possible .


This document appeared to be targeting a government organization dealing with foreign affairs in Europe via spear-phishing .


The payload delivered in these November 2017 attacks using DDE enabled documents was SofacyCarberp , which differs from the Zebrocy downloader delivered in the February 2018 attacks . 115fd8c619fa173622c7a1e84efdf6fed08a25d3ca3095404dcbd5ac3deb1f03 was another Zebrocy sample we were able to pivot from by gathering additional samples connecting to its C2 86.106.131.177 .


The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components . This program is designed to capture keystrokes , take screenshots of the user 's desktop and get contents from the clipboard .


31a8633c2cd67ae965524d0b2192e9f14d04d016 FinFisher exposed : A researcher ’ s tale of defeating traps , tricks , and complex virtual machines March 1 , 2018 Office 365 Advanced Threat Protection ( Office 365 ATP ) blocked many notable zero-day exploits in 2017 . The actor 's targeting is consistent with Chinese state interests and there are multiple technical artifacts indicating the actor is based in China . At the time of writing , none of the domains resolve and the C&C servers are not responding . Instead , it appeared that corresponding requests were made directly through the Outlook Web Application ( OWA ) endpoint , indicating a previously undisclosed exploit method for Exchange .


Transparent Tribe has been active for several years and conducting suspected intelligence collection operations against South Asian political and military targets . The Word document usually exploits CVE-2012-0158 .


“ Cyber Conflict ” Decoy Document Used In Real Cyber Conflict .


This new mobile ransomware variant is an important discovery because the malware exhibits behaviors that have not been seen before and could open doors for other malware to follow . Over the years , the Ke3chang attackers have used three types of malware that we call : " BS2005 " , " BMW " , and " MyWeb " . This implementation will deobfuscate approximately 89% of encountered functions . The next is to call with expecting it to return 0 as it is likely to have an environment variable name like that .


It repeatedly attempts to iterate through directories and to collect files with the following extensions : doc , docx , ppt , pptx , pps , ppsx , xls , xlsx , and pdf . We believe the 2013 , 2015 , and 2016 KeyBoy samples provide evidence of a development effort focused on changing components that would be used by researchers to develop detection signatures .


Shellcode simply uses dlopen to open a .so file within the target process and then dlsym to find a symbol in that file and run it . In the previous pages we have presented our findings based on ESET detection telemetry and our analysis of Win32/Potao and Win32/FakeTC samples . APT17 : 130.184.156.62 . Its code identifies the victim ’s browser and then serves one of two exploits .


Upon receiving the command GUIFXB , the spyware launches a fake Facebook login page . Development of Bemstour has continued into 2019 . Their main targets reside in Russia , Ukraine , Belarus , Azerbaijan , Poland and Kazakhstan .


While the behavior of the attackers differs slightly in each compromise , generally once the attackers have identified the desired intellectual property , they copy the content to archives on internal systems they use as internal staging servers .


After the executable is executed , it downloads Pony and Vawtrak malware variants to steal data . From February to September 2016 , WhiteBear activity was narrowly focused on embassies and consular operations around the world .


Instead of being written in Assembly or C , it was written in C++ , which provides added layers of abstraction for the developer ’s perusal , at the cost of added complexity .


PLATINUM has been targeting its victims since at least as early as 2009 , and may have been active for several years prior . MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs .


EventBot Updated library naming convention EventBot New library naming convention . The well-crafted and socially engineered malicious documents then become the ﬁrst stage of a long and mainly ﬁleless infection chain that eventually delivers POWERSTATS , a signature PowerShell backdoor of this threat group . In early 2017 , Mandiant responded to an incident involving APT35 targeting an energy company .


As mentioned above , EventBot Version 0.0.0.1 sends a JSON object containing the Android package names of all the apps installed on the victim ’ s device alongside additional metadata , including the bot version , botnetID , and the reason this package is sent . The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process . The OilRig group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries .


Even if the noisy initial CozyDuke campaign is noticed by the victim organization , or by someone else who then makes it publicly known , defenders will begin by first looking for indicators of compromise ( IOCs ) related to the CozyDuke toolset .


This helps protect sensitive information and critical services , and limits damage from network perimeter breaches .


During a high profile incident we investigated , our products successfully detected and blocked a “ standard ” Sofacy “ AZZY ” sample that was used to target a range of defense contractors .


In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves . Recently , Falcon Intelligence observed new activity from MUSTANG PANDA , using a unique infection chain to target likely Mongolia-based victims .


In particular , avoid side-loading apps from third-party app stores and avoid the temptation to play games that are not yet available on Android . The corporation conrms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions.” Henkel claims that a very small portion” of its worldwide IT systems had been aected — the systems in Germany . The group , which we have given the name Gallmaker , has been operating since at least December 2017 , with its most recent activity observed in June 2018 .


Attackers are making growing use of utilities like Winexe and PSExec to perform lateral movement across compromised networks .


RAR SFX directives are used to display the decoy while the malicious payload is executed .


During a typical incident , the actor would modify the NS records for the targeted organization , pointing users to a malicious DNS server that provided actor-controlled responses to all DNS queries . The tools found in this campaign , such as the HyperBro Trojan , are regularly used by a variety of Chinese-speaking actors .


If the data received from the C2 server starts with the same string , then the remainder of the payload is decompressed using ORat 's "deflate" algorithm and called as a function .


As originally detailed in Kaspersky ’s whitepaper , the MiniDuke campaigns from February 2013 employed spear-phishing emails with malicious PDF file attachments .


id= $ NUM ” . The registrant information for kernel.ws also provided a geolocation of Tehran , IR and the email provider for the address used in checkgoogle.org was the same used for mydomain1607.com , chmail.ir . Gamaredon : c1524a4573bc6acbe59e559c2596975c657ae6bbc0b64f943fffca663b98a95f . But what happens when an unidentified virus infects a victims computer Antivirus programs can only protect against threats they already know .


Patchwork has also recently employed Android malware in its attacks , with its use of a customized version of AndroRAT . For example , one zero-day vulnerability exploit ( CVE-2015-2545 ) used by PLATINUM was addressed immediately in September 2015 .


According to Kaspersky Lab’s report , NetTraveler has been active since as early as 2004; however , the highest volume of activity occurred from 2010 – 2013 . APT41 has also deployed rootkits and Master Boot Record (MBR) bootkits on a limited basis to hide their malware and maintain persistence on select victim systems . The limited use of these tools by APT41 suggests the group reserves more advanced TTPs and malware only for high-value targets . Like other Chinese espionage operators , APT41 appears to have moved toward strategic intelligence collection and establishing access and aACT from direct intellectual property theft since 2015 . This shift , however , has not affected the group's consistent interest in targeting the video game industry for financially motivated reasons . BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e. , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e. , possibly en masse . With the contents of the emails , included links and decoy PDFs all involving taxes , the attackers are apparently targeting the financial departments of organizations in the Balkans region . Some parts of the campaign were briefly described by a Serbian security provider in 2016 and the Croatian CERT in 2017 . The campaign has been active at least from January 2016 to the time of writing the most recent detections in our telemetry are from July 2019 . Our findings show that the mentioned attacks have been orchestrated and we consider them a single long-term campaign that spans Croatia , Serbia , Montenegro , and Bosnia and Herzegovina . We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 . Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina . According to our telemetry , the campaign spreading these tools has been live since 2016 , with the most recent detections as late as in July 2019 . In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e. , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 . Via the BalkanDoor backdoor , the attacker sends a backdoor command to unlock the screen… and using BalkanRAT , they can do whatever they want on the computer . The BalkanDoor backdoor does not implement any Exfiltration channel . APT41 leveraged ADORE.XSEC , a Linux backdoor launched by the Adore-NG rootkit , throughout an organization's Linux environment . The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience . The main part of the BalkanRAT malware is a copy of the Remote Utilities software for remote access . Interestingly , some of the APT41's POISONPLUG malware samples leverage the Steam Community website associated with Valve , a video game developer and publisher . The campaign targeting accountants in the Balkans shows some similarities with a campaign aimed at Ukrainian notaries reported in 2016 . Based on the Let’s Encrypt certificate issuance date , we believe this campaign to be active from May 2019 . One of the domains uncovered during the investigation was identified by the Chinese security vendor CERT 360 as being part of the BITTER APT campaign in May 2019 . Further analysis of the BITTER APT’s infrastructure uncovered a broader phishing campaign targeting other government sites and state-owned enterprises in China . Further investigation revealed approximately 40 additional sites , all of which appear to be targeting the government of China and other organisations in China . We expect to see BITTER APT continuing to target the government of China by employing spoofed login pages designed to steal user credentials and obtain access to privileged account information . This domain and IP address has been previously associated with the BITTER APT and targeting government agencies in China with phishing attacks , based on reporting from 360-CERT . At the time of analysis , the subdomains did not host a website; however , based on BITTER APT group’s targeting patterns , it is highly likely that they were created to host faux login phishing pages designed to steal user’s credentials . BITTER APT campaigns are primarily targeting China , Pakistan and Saudi Arabia historically . As part of its ongoing research initiatives , the Anomali Threat Research Team has discovered a new phishing attack leveraging spoof sites that seem to be designed to steal email credentials from the target victims within the government of the People’s Republic of China . 360 Threat Intelligence Center has reported on related indicators being attributed to BITTER APT a South Asian country suspected Indian APT in open source reporting . China Chopper is a tool that has been used by some state-sponsored actors such as Leviathan and Threat Group-3390 , but during our investigation we've seen actors with varying skill levels . China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool . Cisco Talos discovered significant China Chopper activity over a two-year period beginning in June 2017 , which shows that even nine years after its creation , attackers are using China Chopper without significant modifications . Here , we investigate a campaign targeting an Asian government organization . We observed another campaign targeting an organisation located in Lebanon . China Chopper contains a remote shell ( Virtual Terminal ) function that has a first suggested command of netstat an|find ESTABLISHED . They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword.exe . The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords . The actor attempts to exploit CVE-2018–8440 — an elevation of privilege vulnerability in Windows when it improperly handles calls to Advanced Local Procedure Call — to elevate the privileges using a modified proof-of-concept exploit . The attacker obtains the required privileges and launches a few other tools to modify the access control lists (ACLs) of all websites running on the affected server . The Windows branch of the Cloud Atlas intrusion set still uses spear-phishing emails to target high profile victims . From the beginning of 2019 until July , we have been able to identify different spear-phishing campaigns related to this threat actor mostly focused on Russia , Central Asia and regions of Ukraine with ongoing military conflicts . We described one of the techniques used by Cloud Atlas in 2017 and our colleagues at Palo Alto Networks also wrote about it in November 2018 . The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server . Previously , Cloud Atlas dropped its validator” implant named PowerShower” directly , after exploiting the Microsoft Equation vulnerability CVE-2017-11882 mixed with CVE-2018-0802 . This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage . Cloud Atlas remains very prolific in Eastern Europe and Central Asia . During its recent campaigns , Cloud Atlas used a new polymorphic” infection chain relying no more on PowerShower directly after infection , but executing a polymorphic HTA hosted on a remote server , which is used to drop three different files on the local system . The Gamaredon Group has been actively launching spear-phishing attacks against Ukrainian government and military departments from the mid-2013s . In addition , the anonymous cybersecurity experts referenced in the article connected the malicious Gamaredon Group actors with Russian state-sponsored hackers . In one article published in the Kharkiv Observer – an independent Ukranian online publication – an unnamed source stated that even the Ukrainian Presidential Administration has been attacked by malware developed by the Gamaredon Group . Gamaredon Group primarily target Ukrainian organizations and resources using spear-phishing attacks , and they use military or similar documents as bait . Once they have found a victim , they then deploy remote manipulation system binaries (RMS) via self-extracting archives and batch command files . The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . During a recent incident response investigation , our team identified new attacks by the financially motivated attack group ITG08 , also known as FIN6 . More recently , ITG08 has been observed targeting e-commerce environments by injecting malicious code into online checkout pages of compromised websites — a technique known as online skimming — thereby stealing payment card data transmitted to the vendor by unsuspecting customers . This tool , a TTP observed in ITG08 attacks since 2018 , is sold on the dark web by an underground malware-as-a-service (MaaS) provider . ITG08 is an organized cybercrime gang that has been active since 2015 , mostly targeting pointof-sale (POS) machines in brick-and-mortar retailers and companies in the hospitality sector in the U.S. and Europe . Past campaigns by ITG08 using the More_eggs backdoor were last reported in February 2019 . Attackers use it to create , expand and cement their foothold in compromised environments . Lastly , ITG08 used Comodo code-signing certificates several times during the course of the campaign . Let’s take a closer look at ITG08’s TTPs that are relevant to the campaign we investigated , starting with its spear phishing and intrusion tactics and covering information on its use of the More_eggs backdoor . Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe . X-Force IRIS determined that the More_eggs backdoor later downloaded additional files , including a signed binary shellcode loader and a signed Dynamic Link Library ( DLL ) , as described below , to create a reverse shell and connect to a remote host . Once the ITG08 established a foothold on the network , they employed WMI and PowerShell techniques to perform network reconnaissance and move laterally within the environment . The attackers used this technique to remotely install a Metasploit reverse TCP stager on select systems , subsequently spawning a Meterpreter session and Mimikatz . In addition to the More_eggs malware , ITG08 leveraged in-memory attacks by injecting malicious code , in this case Mimikatz , into legitimate system processes . A recently rising attack tool in ITG08 campaigns has been the More_eggs JScript backdoor . Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . After a successful phishing attack in which users have opened emails and browsed to malicious links , ITG08 attackers install the More_eggs JScript backdoor on user devices alongside several other malware components . Beyond using More_eggs as a backdoor , ITG08 in this campaign also used offensive security tools and PowerShell scripts to carry out the different stages of the attack . After injecting Meterpreter into memory , the attacker had complete control of the infected device . IBM X-Force IRIS has gained insight into ITG08’s intrusion methods , ability to navigate laterally , use of custom and open-source tools , and typical persistence mechanisms . After the phishing email resulted in a successful infiltration , ITG08 used the More_eggs backdoor to gain a foothold and infect additional devices . In addition , configuring PowerShell script logging and identifying any obfuscation will assist in mitigating ITG08’s use of PowerShell to conduct malicious activity . The LYCEUM threat group targets organizations in sectors of strategic national importance , including oil and gas and possibly telecommunications . CTU research indicates that LYCEUM may have been active as early as April 2018 . In May 2019 , the threat group launched a campaign against oil and gas organizations in the Middle East . This campaign followed a sharp uptick in development and testing of their toolkit against a public multivendor malware scanning service in February 2019 . Stylistically , the observed tradecraft resembles activity from groups such as COBALT GYPSY (which is related to OilRig , Crambus , and APT34 and COBALT TRINITY also known as Elfin and APT33 . When CTU researchers first published information about LYCEUM to Secureworks Threat Intelligence clients , no public documentation on the group existed . Using compromised accounts , LYCEUM send spearphishing emails with malicious Excel attachments to deliver the DanBot malware , which subsequently deploys post-intrusion tools . The developer consistently used Accept-Enconding” (note the extra ‘n’) in all DanBot samples analyzed by CTU researchers . Get-LAPSP.ps1 is a PowerShell script that gathers account information from Active Directory via LDAP . LYCEUM deployed this tool via DanBot shortly after gaining initial access to a compromised environment . LYCEUM delivers weaponized maldocs via spearphishing from the compromised accounts to the targeted executives , human resources (HR) staff , and IT personnel . This focus on training aligns with LYCEUM’s targeting of executives , HR staff , and IT personnel . Despite the initial perception that the maldoc sample was intended for ICS or OT staff , LYCEUM has not demonstrated an interest in those environments . However , CTU researchers cannot dismiss the possibility that the LYCEUM could seek access to OT environments after establishing robust access to the IT environment . LYCEUM is an emerging threat to energy organizations in the Middle East , but organizations should not assume that future targeting will be limited to this sector . Aside from deploying novel malware , LYCEUM’s activity demonstrates capabilities CTU researchers have observed from other threat groups and reinforces the value of a few key controls . Password spraying , DNS tunneling , social engineering , and abuse of security testing frameworks are common tactics , particularly from threat groups operating in the Middle East . The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations . Machete is still very active at the time of this publication , regularly introducing changes to its malware , infrastructure and spearphishing campaigns . ESET has been tracking a new version of Machete (the group’s Python-based toolset) that was first seen in April 2018 . This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted with the Machete malware . Their long run of attacks , focused on Latin American countries , has allowed them to collect intelligence and refine their tactics over the years . Machete is interested in files that describe navigation routes and positioning using military grids . The Machete group sends very specific emails directly to its victims , and these change from target to target . The Machete group is very active and has introduced several changes to its malware since a new version was released in April 2018 . Previous versions were described by Kaspersky in 2014 and Cylance in 2017 . Since August 2018 , the Machete components have been delivered with an extra layer of obfuscation . The GoogleUpdate.exe component is responsible for communicating with the remote C&C server . ESET has been tracking this threat for months and has observed several changes , sometimes within weeks . This ACT , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries . The presence of code to exfiltrate data to removable drives when there is physical access to a compromised computer may indicate that Machete operators could have a presence in one of the targeted countries , although we cannot be certain . This group is very active and continues to develop new features for its malware , and implement infrastructure changes in 2019 . Machete's long run of attacks , focused in Latin American countries , has allowed them to collect intelligence and refine their tactics over the years . ESET researchers have detected an ongoing , highly targeted campaign , with a majority of the targets being military organizations . The group behind Machete uses effective spearphishing techniques . First described by Kaspersky in 2014 [1] and later , by Cylance in 2017 [2] , Machete is a piece of malware found to be targeting high profile individuals and organizations in Latin American countries . In 2018 Machete reappeared with new code and new features . As of June 2019 , ESET has seen over 50 victims being actively spied upon by Machete , with more than half of them being computers belonging to the Venezuelan military forces . Machete has Latin American targets and has been developed by a Spanish-speaking group , presumably from a LATAM country . Machete was active and constantly working on very effective spearphishing campaigns . In some cases , Machete trick new victims by sending real documents that had been stolen on the very same day . Machete relies on spearphishing to compromise its targets . They seem to have specialized knowledge about military operations , as they are focused on stealing specific files such as those that describe navigation routes . Attackers take advantage of that , along with their knowledge of military jargon and etiquette , to craft very convincing phishing emails . Operators behind Machete apparently already have information about individuals or organizations of interest to them in Latin America , how to reach them , and how best to trick them into getting compromised . Since the end of March up until the end of May 2019 , ESET observed that there were more than 50 victimized computers actively communicating with the C&C server . This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted by Machete . Machete is malware that has been developed and is actively maintained by a Spanish-speaking group . Since it was active in 2012 , it has been carrying out attacks against sensitive targets in China and is one of the most active APT attack organizations targeting mainland China in recent years . By introducing small changes to their code and infrastructure , the group has bypassed several security products . OceanLotus will release malicious sub-packages in the background , receive the remote control command , steal the privacy information of users such as SMS messages , contacts , call records , geographic locations , and browser records . They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . It can be seen that after the code leakage , the CEO of the HackingTeam organization said that the leaked code is only a small part is based on the facts , which also reflects that the network arms merchants have lowered the threshold of APT attacks to a certain extent , making more uncertainties of cyber attacks . This report includes details related to the major hacking targets of the SectorJ04 group in 2019 , how those targets were hacked , characteristics of their hacking activities this year and recent cases of the SectorJ04 group’s hacking . In 2019 , the SectorJ04 group expanded its hacking activities to cover various industrial sectors located across Southeast Asia and East Asia , and is changing the pattern of their attacks from targeted attacks to searching for random victims . The SectorJ04 group has maintained the scope of its existing hacking activities while expanding its hacking activities to companies in various industrial sectors located in East Asia and Southeast Asia . There was a significant increase in SectorJ04's hacking activities in 2019 , especially those targeting South Korea . They mainly utilize spam email to deliver their backdoor to the infected system that can perform additional commands from the attacker’s server . We saw SectorJ04 group activity in Germany , Indonesia , the United States , Taiwan , India . The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system . The SectorJ04 group’s preexisting targets were financial institutions located in countries such as North America and Europe , or general companies such as retail and manufacturing , but they recently expanded their LOCs of activity to include the medical , pharmaceutical , media , energy and manufacturing industries . The SectorJ04 group mainly used their own backdoor , ServHelper and FlawedAmmy RAT , for hacking .


They quickly move away from their initial access vector to hide their entry point and then target Exchange servers as a new access vector .


This version includes 185 different applications , including official applications of worldwide banks . CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 . The Magic Hound campaign was also discovered using a custom dropper tool , which we have named MagicHound.DropIt .


Additionally , open sources have reported for several years that in Russia and China , high-profile hotel guests may expect their hotel rooms to be accessed and their laptops and other electronic devices accessed .


Across two campaigns of several million messages each , the actor used both macro laden Microsoft Word documents and zipped VBScript attachments to install the Trojan on potential victim PCs .


PackageInstaller shows the app ’ s permission access and asks for the user 's approval , which then installs the application . This CPE was created to ensure our customers are updated with new discoveries , activity and detection efforts related to this campaign , along with other recent activity from Iranian-nexus threat actors to include APT33 , which is mentioned in this updated FireEye blog post . 360 and Tuisec already identified some Gorgon Group members .


After reversing these opcodes , we were able to update our interpreter script to support both 32-bit and 64-bit virtual machines used by FinFisher . These emails included recruitment-themed lures and links to malicious HTML application ( HTA ) files . The size of the payload is encoded within the first four pixels of the image . TLDR OilRig is leveraging a new backdoor dubbed Marlin as part of a longrunning espionage campaign that started in April 2018 .


We also found the init0 script running ; the script cleans out all miners regardless of its origin .


Check Point Research reported these dangerous apps to Google upon discovery . Russian-speaking hackers are believed to be responsible for these attacks and used the Corkow Trojan . We named the first group RevengeHotels , and the second ProCC . Chinese state - sponsored actors reportedly accessed email accounts belonging to several U.S.-based organizations and federal government agencies , including the State Department .


This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose . some indications of loosely linked activity dating back to at least 2013 .


Another trick in “ Agent Smith ’ s arsenal is to change the settings of the update timeout , making the original application wait endlessly for the update check . We revealed a Chinese-based adversary we crypt as Anchor Panda , a group with very specific tactics , techniques , and procedures ( TTPs ) and a keen interest in maritime operations and naval and aerospace technology . The now-malicious processes are released from suspension and run . We will continue to monitor these campaigns and in particular SocGholish to see if the web delivery landscape changes .


Inside the SDK The malware resides within the ‘ RXDrioder ’ Software Development Kit ( SDK ) , which is provided by ‘ addroider [ . During this heist , APT38 waited for a holiday weekend in the respective countries to increase the likelihood of hiding the transactions from banking authorities . Suckfly 's attacks on government organizations that provide information technology services to other government branches is not limited to India .


Filename : ntslwin.exe MD5 : f4cab3a393462a57639faa978a75d10a .


The WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware . Silence also used Russian-language web hosting services .


However , although the “ Concipit1248 ” app requested permissions to open the device camera and read photos , the code only can upload a self-contained PNG file to a remote sever . Our investigation revealed an attack where the GCMAN group then planted a cron script into bank 's server , sending financial transactions at the rate of $200 per minute . in addition to normal operations mentioned in the original cases . It is attributed to Iranian statesponsored APT Charming Kitten , whose other recent attacks include targeting world leaders attending the Munich Security Conference and the T20 Summit in Saudi Arabia in an effort to steal their email credentials , targeting Israeli scholars and U.S. government employees in another credentialstealing effort last July , and also attacking the reelection effort of former President Donald Trump .


But Android.Oldboot malware is a bit more dangerous because even if you remove all working components of it from your android successfully , the component imei_chk will persist in a protected boot memory area and hence will reinstall itself on next boot and continuously infect the Smartphone . The C&C server ( 82.137.255.56 ) used by the above backdoors was used by APT-C-27 ( Goldmouse ) many times since 2017 . We will describe APT1 ’s backdoors in two categories : “ Beachhead Backdoors ” and “ Standard Backdoors. ” The companies infected by the malware primarily market so - called massively multiplayer online role - playing games .


Conclusions This Trojan was distributed through the Google Play Store and uses a number of very dangerous techniques , including patching system libraries . We also started monitoring the malware and , using Kaspersky Attribution Engine based on similarity algorithms , discovered that Octopus is related to DustSquad , something we reported in April 2018 . From our observations , it is one of the most prolific cyber espionage groups in terms of the sheer quantity of information stolen . The attackers left a small clue in the code , in the form of the number 666 ( 0x29A hex ) before one of the decryption subroutines : • By analysing the logs from the command servers , we have observed 59 unique victims in 23 countries : For the detailed analysis and information on how to protect against the attack , please read :


They appear to have been active since 2006 .


Symantec has also been able to connect earlier attack campaigns with Sowbug , demonstrating that it has been active since at least early-2015 and may have been operating even earlier . LEAD and Barium are not known for large-scale spear-phishing , so it is unlikely that SOC personnel would have to deal with multiple machines having been compromised by these groups at the same time .


Early in Q2 , Kaspersky identified an interesting Lazarus attack targeting a mobile gaming company in South Korea that we believe was aimed at stealing application source code . " Machete " is a targeted attack campaign with Spanish speaking roots .


Defense against FinFisher Exposing as much of FinFisher ’ s riddles as possible during this painstaking analysis has allowed us to ensure our customers are protected against this advanced piece of malware . menuPass also heavily favors spear phishing , and so takes steps to socially engineer their spear phishes for maximum appearance of legitimacy . OceanLotus : {9E3BD021-B5AD-49DEAE93-F178329EE0FE} C&C URLs varies content is read from resource P1/2 . Part of this can be explained by the fact that 8BASE disproportionately attacked Brazil with 11 attacks last month , while PLAY focused on Switzerland ( 5 ) .


APT28 used this technique to steal usernames and hashed passwords that allowed escalation of privileges in the victim network .


] today somtum [ . This threat report gives insight into some of the information that Fox-IT has about a threat actor that it follows , called Mofang . The following sections detail the changes to Backdoor.APT.Aumlib and Backdoor.APT.Ixeshe . Furthermore , the process that created the web shell was UMWorkerProcess.exe , the process responsible for Exchange Server ’s Unified Messaging Service .


While FireEye has not directly observed BACKSWING delivering BADRABBIT , BACKSWING was observed on multiple websites that were seen referring FireEye customers to 1dnscontrol.com , which hosted the BADRABBIT dropper . This blog post analyzes several recent Molerats attacks that deployed PIVY against targets in the Middle East and in the U.S. We also examine additional PIVY attacks that leverage Arabic-language content related to the ongoing crisis in Egypt and the wider Middle East to lure targets into opening malicious files .


The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . When G-Data published on Turla/Uroburos back in February , several questions remained unanswered .


Use caution and exercise due diligence when faced with a shortened link , especially in unsolicited email messages .


] today svcws [ . This sample was also found to be deployed using the CVE-2012-0158 vulnerability . We cannot say for sure whether the attackers were responding to the scrutiny they received in the wake of the episode . Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected .


Within six hours of entering the environment , the threat actors compromised multiple systems and stole credentials for the entire domain . However , full details on XENOTIME and other group tools , techniques , procedures , and infrastructure is available to network defenders via Dragos WorldView .


The client deserializes the packet into IPacket GetSystemInfo .


Some common techniques include : basic XOR encryption , nested XOR and custom key-derivation methods . APT5 has targeted or breached organizations across multiple industries , but its focus appears to be on telecommunications and technology companies , especially information about satellite communications . RunAs Create new process as another User or Process context . In a modern ransomware attack the target is an entire organisation , not just one or two computers .


Technical Analysis Permissions Marcher ’ s APK size is fairly small ( only 683KB for sample eb8f02fc30ec49e4af1560e54b53d1a7 ) , much smaller than most legitimate apps and other popular mobile malware samples . The first sample being captured was in April 2018 and since that we observed a lot more related ones . ZxShell is a sophisticated tool employed by Group 72 that contains all kinds of functionality . In our Google Analytics platform , we will see the data as : In our demo the DP will result in page view of Which will be decoded from base64 as : The source of the problem is that the CSP rule system is n’t granular enough .


EventBot Sending the pin code back to the C2 Sending the pin code back to the C2 . While investigating KerrDown we found multiple RAR files containing a variant of the malware . The connections associated with these profiles indicate the threat actor began using the persona to target organizations in April 2016 .


Turla and APT28 are Russian cyber espionage groups that have used these zero-days against European diplomatic and military entities . Mark Zuckerberg , Jack Dorsey , Sundar Pichai , and Daniel Ek — the CEOs of Facebook , Twitter , Google and Spotify , respectively — have also fallen victim to the hackers , dispelling the notion that a career in software and technology exempts one from being compromised .


The organization was closed after the CSIS presentation . This article is an attempt to share this experience with other experts , particularly the IT security specialists in companies and financial institutions that increasingly find themselves the targets of cyber-attacks . The emails normally come from compromised personal accounts or are entirely spoofed . This shorcut uses the WebDav HTTP protocol extension to retrieve the file launcher-upd.hta from a remote server : This heavily obfuscated script is responsible for the execution of PowerShell that downloads the final malware payload ( NetSupport RAT ) .


For example , the summer 2015 attack that used the unusual ' resume ' would not have been successful on Windows 10 as-is because of the presence of the Supervisor Mode Execution Prevention ( SMEP ) mitigation , even without the latest security updates installed . As this post and previous cited research show , APT groups such as Nitro will continue to evolve their techniques within the kill chain to avoid detection .


[ Note : The analysis of the functionality below describes a single app , but applies to all apps of the Android/AdDisplay.Ashas family . Kaspersky wrote about LuckyMouse targeting national data centers in June . The handling of instructions has improved too .


The loader used by the sample purported to have been compiled on the 25th of March 2010 .


To their credit , both Google and Amazon appear to have put pressure on device manufacturers to fix their devices when flaws are found , Strazzere says . As observed previously with CVE-2017-11882 and CVE-2018-0802 , the weaponizer was used exclusively by Chinese cyber espionage actors for approximately one year December 2017 through December 2018 , after which cybercrime actors began to incorporate it in their malicious activity . C2 : krjregh.sacreeflame.com .


HummingBad sends notifications to Umeng , a tracking and analytics service attackers use to manage their campaign . The backdoors Lazarus are deploying are difficult to detect and a significant threat to the privacy and security of enterprises , allowing attackers to steal information , delete files , install malware , and more . APT33 : 64.251.19.217 [REDACTED].servehttp.com . Cuba ransomware was first observed in 2019 .


The report also includes a mention of the same IP address used as Command & Control server in the attack against Bundestag ( 176.31.112.10 ) .


The 2016 presidential election has the world ’s attention , and leaders of other states are anxiously watching and planning for possible outcomes .


We named this campaign “ Bouncing Golf ” based on the malware ’ s code in the package named “ golf. ” June 18 , 2019 We uncovered a cyberespionage campaign targeting Middle Eastern countries . Samurai Panda is interesting in that their target selection tends to focus on Asia Pacific victims in Japan , the Republic of Korea , and other democratic Asian victims . The operating system also creates a registry key within the software registry hive that is specifically associated with the creation of the scheduled task on the destination host : Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\At1 . Researchers have uncovered an ongoing cyberespionage campaign targeting more than 30 online video game companies over the past four years .


Extremely high-volume campaigns distributing Locky exclusively in July 2016 , consistently delivering tens of millions of messages .


The attacker can choose the data types to collect , which are written in a certain format . ScarCruft uses a multi-stage binary infection scheme . The malware is designed for receiving modules to be executed in-memory and sending the results to C2s . Recently , this model for threat actors has come to be known as the “ as - a - service " model , borrowing the term from the growing trend in the tech industry .


In most cases they would be crafted to appear as applications distributed by unspecified mobile operators in Italy . Initial inspection of this attack suggested this was again the OilRig campaign using their existing toolset , but further examination revealed not only new variants of the delivery document we named Clayslide , but also a different payload embedded inside it . Feature-wise , the RAT has three commands : UNC2529 displayed indications of target research based on their selection of sender email addresses and subject lines which were tailored to their intended victims .


While WERDLOD kills processes for Internet Explorer , Firefox , and Chrome , OSX_DOK.C does the same on Safari , Firefox , and Chrome .


Between May 2017 and December 2018 , a multi-purpose command tool that has been used by Whitefly was also used in attacks against defense , telecoms , and energy targets in Southeast Asia and Russia . Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework .


It was executed via rundll32 commands such as : rundll32.exe “ C:\Windows\twain_64.dll ” .


Pivoting from the Mozilla v5.1 user agent revealed over forty additional Zebrocy samples , with several again targeting the same Central Asian nation .


The initial dropper , upon execution , extracts an embedded Downeks instance :


The attack involving this updated variant of DealersChoice was targeting a European government organization .


A Humanitarian Bulletin published by the United Nations ’ Office for the Coordination of Humanitarian Affairs indicates in March 2017 ( just before the first malware samples associated with this campaign were identified in early April ) Hamas created “ a parallel institution to run local ministries in Gaza , ”


The Nitro Attacks .


Metel is a banking Trojan ( also known as Corkow ) discovered in 2011 when it was used to attack users of online banking services . After gaining access to a target network in one intrusion analyzed by CTU researchers , TG-3390 actors identified and exfiltrated data for specific projects run by the target organization , indicating that they successfully obtained the information they sought .


FortiGuard Labs has been monitoring a Linux coin mining campaign from " Rocke " – a malware threat group specializing in cryptomining . Wild Neutron 's targeting of major IT companies , spyware developers ( FlexiSPY ) , jihadist forums ( the " Ansar Al-Mujahideen English Forum " ) and Bitcoin companies indicate a flexible yet unusual mindset and interests .


The CVE-2012-0773 was originally discovered by VUPEN and has an interesting story . In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group .


Both OnionDuke and MiniDuke also use date-based algorithms to generate Twitter account names and then searched for any tweets from those accounts that linked to image files .


We named this campaign “ Bouncing Golf ” based on the malware ’ s code in the package named “ golf. ” The malware involved , which Trend Micro detects as AndroidOS_GolfSpy.HRX , is notable for its wide range of cyberespionage capabilities . Next , in an effort to demonstrate it wasn't relegated to China , CrowdStrike exposed Clever Kitten , an actor we track out of Iran who leverages some very distinct TTPs when viewed next to a more visible adversary . The Task Scheduler service names the tasks , so subsequent tasks are named At2 , At3 , and so on . The companies infected by the malware primarily market so - called massively multiplayer online role - playing games .


Suckfly delivered Nidiran through a strategic web compromise .


DLL hijacking techniques have been seen in the past with the APT15 group . One is called XAgent detected as IOS_XAGENT.A and the other one uses the name of a legitimate iOS game , MadCap detected as IOS_ XAGENT.B .


The malware starts communicating with the C&C server by sending basic information about the infected machine . The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content .


For instance , its JHUHUGIT implant was delivered through a Flash zero-day and used a Windows EoP exploit to break out of the sandbox .


C2 interface


The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . The Intercept reported that there exists a 2011 presentation by Canada 's Communication Security Establishment ( CSE ) outlining the errors made by the Turla operators during their operations even though the tools they use are quite advanced .


These domains have been registered by the attackers since 2015 . We assume that RunPow stands for run PowerShell , ” and triggers the PowerShell code embedded inside the .dll file . Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 ( TG-2889 ) .


EventBot Randomized package name Randomized package name instead of com.example.eventbot . The SDK , named SWAnalytics is integrated into seemingly innocent Android applications published on major 3rd party Chinese app stores such as Tencent MyApp , Wandoujia , Huawei App Store , and Xiaomi App Store . The group has repeatedly used social media , particularly LinkedIn , to identify and interact with employees at targeted organizations , and then used weaponized Excel documents to deliver RATs such as PupyRAT .


The placement of the decoy functionality is likely designed to confuse the malware researchers . We expect the damage caused by these groups to intensify and the attacks to extend into other regions that are also linked to the complicated Palestinian situation . The initial request , referred to as the helo/hello request in the Nmap script , is comprised of four DWORDs .


With Cybereason Mobile , our customers can protect against modern threats across traditional and mobile endpoints , all within a single console . The Word document usually exploits CVE-2012-0158 . This , in turn , would provide access to a larger amount of intellectual property and sensitive data .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs .


We do not know whether the Dukes compiled the components themselves or whether someone else compiled the components before handing them to the group .


The Windows version of UnionCryptoTrader updater ( 629b9de3e4b84b4a0aa605a3e9471b31 ) has similar functionality to the macOS version .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . According to our statistics , as of the beginning of 2015 this botnet encompassed over 250 000 infected devices worldwide including infecting more than 100 financial institutions with 80% of them from the top 20 list .


Figure 1 . ScarCruft is a relatively new APT group ; victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania . The spear phishing campaigns were remarkably sophisticated from a social engineering perspective . Digital certificates stolen in some of the heists have been used to sign malware that targeted Tibetan and Uyghur activists .


Whitefly compromises its victims using custom malware alongside open-source hacking tools and living off the land tactics , such as malicious PowerShell scripts . To deliver the malware to the victim machines , the Rocke group exploits vulnerabilities in Apache Struts 2 , Oracle WebLogic , and Adobe ColdFusion .


It checks whether it is being run in an emulator before it starts its malicious activity . The intelligence we have collected shows that Silence is part of a more extensive operation , still focused on financial institutions operating mainly on Russian territory . At the end of 2018 , while searching for new FIN7 campaigns via telemetry , we discovered a set of activity that we temporarily called “ CopyPaste ” from a previously unknown APT . As an example , we took the twitter login page , which implemented the following CSP rule ( which contains ): The following short JS code inserted into the site will send the credentials to google - analytics console controlled by us : The UA-#######- # parameter is the tag ID owner that Google Analytics uses to connect the data to a specific account .


RCSession C2 server : toshibadrive.com .


Internal name : snd.dll File format : PE32 DLL MD5: 8c4d896957c36ec4abeb07b2802268b9 Linker version : 11.0 , Microsoft Visual Studio Linker timestamp : 2015.07.24 12:07:27 ( GMT ) Exported functions :


All that is needed is to get the original size of the DEX file and read everything that comes after this offset . The CVE-2012-0773 was originally discovered by VUPEN and has an interesting story . Detecting malicious code hidden using this method is not trivial , so process hollowing has become a prevalent technique used by malware today . Following a successful infection , callbacks are made to the RAT 's command and control server at 94.158.247[.]27 .


With mobile devices increasingly used in the corporate environment , thanks to the popularity of BYOD policies , this malware has the potential to cause serious harm , mostly to consumers , and businesses that allow the installation of unsigned applications . In another case , Sima mirrored an announcement made about the broadcast of a television program on Iranian-American cultural affairs in order to impersonate the individual and engage in spearphishing within hours of the legitimate message . However , recent data seems to indicate that the attacks have continued without significant drawbacks . The problem is that CSP does n't support query strings ( See Spec ):


In 2016 , an attack campaign by this group was recorded in early May that made use of an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player , which at the time was both unknown and unpatched . The malicious loader will use dynamic-link library ( DLL ) hijacking — injecting malicious code into a process of a file/application — on sidebar.exe and launch dllhost.exe ( a normal file ) .


Because a user interacting with an ad often leads to a higher chance of the user purchasing something , ad networks often " pay per click '' to developers who host their ads . WildFire correctly classifies NetTraveler as malicious . This tactic is not without precedent ; in 2013 , the New York Times revealed it had been the target of China based actors shortly after it reported on the alleged mass accumulation of wealth by then-Prime Minister Wen Jiabao and his family . Several Democratic lawmakers released a report last week that accused TaxAct , H&R Block and TaxSlayer of embedding Meta and Google ’s tracking pixels on their sites , potentially violating U.S. law and sharing taxpayers ’ information with those companies .


1 Fadi Alsalamin scandal with an Israeli officer - exclusive - watched before the deletion - Fadi Elsalameen The details of the assassination of President Arafat_06-12-2016_docx Quds.rar Many of these executables are associated with various short links created using Bit.ly , a URL shortening service . Similar to our approach with Symantec 's report on Hidden Lynx , we used Recorded Future to organize the technical details about the DeputyDog attacks to reveal technical information described in the open source reporting across multiple campaigns . In lieu of manually editing an HTML file on a hop point , we have also observed APT1 intruders uploading new ( already-edited ) HTML files . Lesser - known threat actors want to piggyback off having a big name associated with them , like DarkSide , to intimidate their actors or lend more credence to the effectiveness of their threats .


Most of these commands are related to gathering information from the infected machine ( number of CPU cores , users , scheduled tasks , running processes , OS installed , and CPU and memory information ) via the dota3 payload , as well as changing the password to a random string also stored in /tmp/up.txt .


After building an initial rapport with targets , the actors behind these social media accounts would instruct victims to install an additional app for easier communication . It mainly targets Microsoft Outlook , a widely used mail client , but also targets The Bat! , a mail client very popular in Eastern Europe . A new service is then created using the service parser function ProcessScCommand . None Read about adversaries tracked by CrowdStrike in 2021 in the and in the • None Learn more about how can help your organization prepare to defend against sophisticated threats , respond and recover from incidents with speed and precision , and fortify your cybersecurity practices .


] com/gate_cb8a5aea1ab302f0_c online 185.158.248 [ . The Trojan is quite similar to the .NET RocketMan Trojan and can handle the same commands; additionally , it includes the #screen” command to take a screenshot . A paper from FireEye in 2013 on several campaigns using PIVY included menuPass as one of them .


FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform . In 2015 , the Metel gang began to target banks and financial institutions directly .


Command & Control Communication The C2 communication of Zyklon is proxied through the Tor network . For example , DeltaAlfa specifies a DDoS bot family identified as Alfa .


This technique enables the malware to efficiently run while evading unpacking techniques from the AntiVirus-integrated UPX library .


Our first observation of an attempted attack related to this campaign dates back to November 2015 , although Symantec telemetry data indicates that the campaign may have already existed in early 2015 or perhaps even earlier . Subdomains at phmail.us have been linked to malicious activity dating back as far as December 2011 .


In our analysis , we distinguish between two separate campaigns happening simultaneously .


Gorgon used numerous decoy documents and phishing emails , both styles of attacks lacked overall sophistication . It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns .


Shamoon2 : 5e5ea1a67c2538dbc01df28e4ea87472 .


Once executed , Vcrodat loads an encrypted payload on to the victim 's computer . Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() .


The threat actor Rocke was first reported by Cisco Talos in late July 2018 . During the 2013 attacks , the Wild Neutron actor successfully compromised and leveraged the website www.iphonedevsdk.com , which is an iPhone developers forum .


However , we have not seen Bart since , suggesting that this was either an experiment or that the ransomware did not function as expected for TA505 .


TA505 introduced Jaff ransomware in May 2017 .


Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor.Sogu .


While accessing the domain from a browser you get a login page very similar to other malware panels . The backdoors Lazarus are deploying are difficult to detect and a significant threat to the privacy and security of enterprises , allowing attackers to steal information , delete files , install malware , and more . Proofpoint is tracking this attacker , believed to operate out of China , as TA459 .


We can compare it to the sample e338d49c270baf64363879e5eecb8fa6bdde8ad9 used in May 2017 by Group 74 .


NEWMSG – write an SMS to the device memory containing the text and sender number sent from C & C . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions . The EternalBlue exploits from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 .


c0cfd462ab21f6798e962515ac0c15a92036edd3e2e63639263bf2fd2a10c184 d791e0ce494104e2ae0092bb4adc398ce740fef28fa2280840ae7f61d4734514 38dcec47e2f4471b032a8872ca695044ddf0c61b9e8d37274147158f689d65b9 27cea60e23b0f62b4b131da29fdda916bc4539c34bb142fb6d3f8bb82380fe4c this SWC was used to specifically target Turkish goverment . XGen security also powers Trend Micro ’s suite of security solutions : Hybrid Cloud Security and User Protection . We initially tracked this activity as UNC3810 before merging the cluster with Sandworm .


The investigation uncovered that an actor had used these devices to gain initial access to corporate networks .


September 08 , 2020 TikTok Spyware A detailed analysis of spyware masquerading as TikTok A recent threat to ban TikTok in the United States has taken the internet by storm and received mixed reactions from social media and internet users . As with the 2016 series of virtual bank heists , including the Bangladesh Bank heist , FASTCash illustrates that Lazarus possesses an in-depth knowledge of banking systems and transaction processing protocols and has the expertise to leverage that knowledge in order to steal large sums from vulnerable banks . Analysisof these larger convoluted clusters is ongoing .


Interestingly , the two communication apps described above as being targeted by the HenBox variant listed in Table 3 do not appear in this updated list . APT41 regularly leverages code-signing certificates to sign malware when targeting both gaming and nongaming organizations . The Dukes are known to employ a vast arsenal of malware toolsets , which we identify as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , CloudDuke , SeaDuke , HammerDuke , PinchDuke , and GeminiDuke .


In this section we describe in more detail the commands performed manually by the operators through their Delphi backdoor .


Gold Lowell responded by modifying a registry entry to disable the endpoint tool 's scanning functionality . The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems .


The attackers ’ final step was to exfiltrate data off the victim ’s network and onto Suckfly ’s infrastructure .


APT28 is using novel techniques involving the EternalBlue exploit and the open source tool Responder to spread laterally through networks and likely target travelers . Finally , there are many similarities between Gazer and other second stage backdoors used by the Turla group such as Carbon and Kazuar .


These attacks against Albanian government institutions by the Sofacy Group were documented and reported by consultancy corporate PwC in December 2014 .


About a decade ago , attackers wielding banking Trojans could simply use stolen credentials to access a victim ’ s online banking account and perform money transfers . PUTTER PANDA is likely to continue to aggressively target Western entities that hold valuable information or intellectual property relevant to these interests . We also identified another sample of ThreeDollars , created on January 15 , 2017 with the file name strategy preparation.dot .


The third type of information will be sent when RuMMS intercepts any SMS messages , including the balance inquiry results when it contacts the SMS code of a particular financial service . Additionally , the scope of organizations targeted by this group has expanded to not only include organizations within Saudi Arabia , but also a company in Qatar and government organizations in Turkey , Israel and the United States . JhoneRAT : Cloud based python RAT targeting Middle Eastern countries . The Twitter handle used by Hack520 indicates also an “ est ” portion .


Despite broad scrutiny and reports on MuddyWater attacks , the activity continues with only incremental changes to the tools and techniques .


In addition to the Mimikatz tool , the actor uploaded other tools to the webshell hosted at this second organization . es.exe : Mimikatz with custom loader , da53dcaeede03413ba02802c4be10883c4c28d3d28dee11734f048b90eb3d304 .


Since last week , iSIGHT Partners has worked to provide details on the power outage in Ukraine to our global customers . According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability .


In the 2016 Internet Crime Report published by the FBI , BEC was specifically highlighted as a " Hot Topic " , having been attributed to more than US$360 million in losses and gaining status as its own category of attack . The SWC of a Uyghur cultural website suggests intent to target the Uyghur ethnic group , a Muslim minority group primarily found in the Xinjiang region of China .


My initial thought was the worst-case scenario – they ’ve been compromised and are distributing malware ! I immediately downloaded the file from the website , but everything looked normal .


Working with U.S. Government partners , DHS and FBI identified Internet Protocol ( IP ) addresses associated with a malware variant , known as DeltaCharlie , used to manage North Korea 's distributed denial-of-service ( DDoS ) botnet infrastructure .


Following is the HTTP response from the C2 server , containing the encrypted configuration : EventBot Encrypted HTTP response returned from the C2 Encrypted HTTP response returned from the C2 . Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam . The MPK bot is not publicly available and had previously been attributed to an adversary group called " Rocket Kitten " which has often been thought to be a state sponsored adversary operating in the Middle East region .


Investigators indicated that the actors may have gained access to DCCC systems as early as March .


The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information . The threat is likely targeting employees of various Palestinian government agencies , security services , Palestinian students , and those affiliated with the Fatah political party .


Although BokBot has aided the distribution of TrickBot since 2017 , the development of custom TrickBot modules for the specific campaign has not been observed before . BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China .


Multiple China-based cyber threat groups have targeted international media organizations in the past .


The admin@338 has targeted international media organizations in the past .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations .


The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


Once the LOWBALL malware calls back to the Dropbox account , the admin@338 will create a file called upload.bat which contains commands to be executed on the compromised computer .


We observed the admin@338 upload a second stage malware , known as BUBBLEWRAP ( also known as Backdoor.APT.FakeWinHTTPHelper ) to their Dropbox account along with the following command .


We have previously observed the admin@338 group use BUBBLEWRAP .


The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets .


The admin@338 linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


The group targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


The agroup targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


The admin@338 , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


In August 2013 , FireEye reported that admin@338 had been using the Poison Ivy RAT in its operations .


In March 2014 , the admin@338 leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank .


In March 2014 , the group leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank .


According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


The admin@338 's Dropbox accounts have also been found to contain a different backdoor dubbed BUBBLEWRAP .


Researchers have pointed out that it is not uncommon for China-based threat groups to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement .


Researchers have pointed out that it is not uncommon for admin@338 to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement .


This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose .


The attackers used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


The admin@338 used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


FireEye analysts documented the admin@338 group 's activities in a previous paper titled Poison Ivy : Assessing Damage and Extracting Intelligence paper .


The spear-phishing campaign against Asian entities isn't isolated , the admin@338 also started another attack against the US-based think tank on 14th March .


Our analysis has led us to conclude that APT1 is likely government-sponsored and one of the most persistent of China 's cyber threat actors .


FireEye said it has tracked admin@338 's activity since 2013 and the group has largely targeted organizations involved in financial , economic , and trade policy .


The simplest conclusion based on these facts is that APT1 is operating in China , and most likely in Shanghai .


These data sets show that APT1 is either operating in China during normal Chinese business hours or that APT1 is intentionally going to painstaking lengths to look like they are .


APT1 has used and steadily modified BISCUIT since as early as 2007 and continues to use it presently .


While APT1 intruders occasionally use publicly available backdoors such as Poison Ivy and Gh0st RAT .


Given the mission , resourcing , and location of PLA Unit 61398 , we conclude that PLA Unit 61398 is APT1 .


APT1 were a highly prolific cyber-attack group operating out of China .


APT1 is a China-based cyber-espionage group , active since mid-2006 .


APT12 's targets are consistent with larger People 's Republic of China ( PRC ) goals .


Since the release of the Arbor blog post , FireEye has observed APT12 use a modified backdoor that we call HIGHTIDE .


However , the malware shared several traits with the RIPTIDE and HIGHTIDE backdoor that we have attributed to APT12 .


From October 2012 to May 2014 , FireEye observed APT12 utilizing RIPTIDE , that communicates via HTTP to a hard-coded command and control ( C2 ) server .


Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 .


FireEye believes the change from RIPTIDE to HIGHTIDE represents a temporary tool shift to decrease malware detection while APT12 developed a completely new malware toolset .


They have largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


A China-based cyber threat group , which FireEye tracks as an uncategorized advanced persistent threat ( APT ) group and other researchers refer to as admin@338 , may have conducted the activity .


The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


About four months after The New York Times publicized an attack on its network , the APT12 behind the intrusion deployed updated versions of their Backdoor.APT.Aumlib and Backdoor.APT.Ixeshe malware families .


With this in mind , this week we are providing some indicators for a China based adversary who we crypt as " NUMBERED PANDA " Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc .


Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc .


The new campaigns mark the first significant stirrings from the APT12 since it went silent in January in the wake of a detailed expose of the group and its exploits — and a retooling of what security researchers believe is a massive spying operation based in China .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries .


On November 26 , 2015 , a suspected China-based APT16 sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


On November 26 , 2015 , a suspected China-based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


While attribution of the first two spear phishing attacks is still uncertain , we attribute the second December phishing campaign to the China-based APT group that we refer to as APT16 .


APT16 actors sent spear phishing emails to two Taiwanese media organizations .


On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website .


It is possible , although not confirmed , that APT16 was also responsible for targeting this government agency , given both the timeframe and the use of the same n-day to eventually deploy the ELMER backdoor .


Despite the differing sponsorship , penetration of Hong Kong and Taiwan-based media organizations continues to be a priority for China-based APT16 .


The suspected APT16 targeting of the Taiwanese government agency – in addition to the Taiwanese media organizations – further supports this possibility .


APT17 was embedding the encoded CnC IP address for the BLACKCOFFEE malware in legitimate Microsoft TechNet profiles pages and forum threads , a method some in the information security community call a " dead drop resolver " .


APT17 , also known as DeputyDog , is a China-based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


FireEye has monitored APT17 's use of BLACKCOFFEE variants since 2013 to masquerade malicious communication as normal web traffic by disguising the CnC communication as queries to web search engines .


The use of BLACKCOFFEE demonstrates APT17 's evolving use of public websites to hide in plain sight .


TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology .


The APT18 then installed the hcdLoader RAT , which installs as a Windows service and provides command line access to the compromised system .


The malware used by the Wekby group has ties to the HTTPBrowser malware family , and uses DNS requests as a command and control mechanism .


These URIs result in the download of an installer , which creates a PE of the malware typically known as HTTPBrowser , but called Token Control by the Wekby group themselves ( based upon the PDB strings found within many of the samples ) .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and political , financial , pharmaceutical and energy sectors that could benefit the Chinese economy .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy .


APT28 malware , in particular the family of modular backdoors that we call CHOPSTICK , indicates a formal code development environment .


However , three themes in APT28 's targeting clearly reflects areas of specific interest to an Eastern European government , most likely the Russian government .


We identified three themes in APT28 's lures and registered domains , which together are particularly relevant to the Russian government .


Georgian military security issues , particularly with regard to U.S. cooperation and NATO , provide a strong incentive for Russian state-sponsored threat actors to steal information that sheds light on these topics .


APT28 's malware settings suggest that the developers have done the majority of their work in a Russian language build environment during Russian business hours , which suggests that the Russian government is APT28 's sponsor .


We believe that APT28 's targeting of the MOD aligns with Russian threat perceptions .


We assess that APT28 is most likely sponsored by the Russian government .


Given the available data , we assess that APT28 's work is sponsored by the Russian government .


The targets of TG-4127 include military , government and defense sectors .


Some of APT28 's more commonly used tools are the SOURFACE downloader , its second stage backdoor EVILTOSS , and a modular family of implants that we call CHOPSTICK .


Our visibility into the operations of APT28 - a group we believe the Russian Government sponsors - has given us insight into some of the government 's targets , as well as its objectives and the activities designed to further them .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government .


After compromising a political organization , APT28 will steal internal data .


On December 29 , 2016 , the Department of Homeland Security ( DHS ) and Federal Bureau of Investigation ( FBI ) released a Joint Analysis Report confirming FireEye 's long held public assessment that the Russian Government sponsors APT28 .


In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations , and characterized APT28 's activity as aligning with the Russian Government 's strategic intelligence requirements .


In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations' , and characterized APT28 's activity as aligning with the Russian Government 's strategic intelligence requirements .


APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


Our investigation of APT28 's compromise of WADA 's network , and our observations of the surrounding events reveal how Russia sought to counteract a damaging narrative and delegitimize the institutions leveling criticism .


For full details , please reference our 2014 report , APT28 : A Window into Russia 's Cyber Espionage Operations .


The APT28 , which is linked to the Russian government , returned to low-key intelligence-gathering operations during 2017 and into 2018 , targeting a range of military and government targets in Europe and South America .


Another attack group , Earworm ( aka Zebrocy ) , has been active since at least May 2016 and is involved in what appears to be intelligence gathering operations against military targets in Europe , Central Asia , and Eastern Asia .


Several sources consider APT28 a group of CyberMercs based in Russia .


The primary targets of APT28 are potential victims in several countries such as Ukraine , Spain , Russia , Romania , the United States and Canada .


We have reasons to believe that the operators of the APT28 network are either Russian citizens or citizens of a neighboring country that speak Russian .


Finally , the use of recent domestic events and a prominent US military exercise focused on deterring Russian aggression highlight APT28 's ability and interest in exploiting geopolitical events for their operations .


In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM , JHUHUGIT , AZZY and a few others .


In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM ( aka Xagent , aka CHOPSTICK ) , JHUHUGIT ( which is built with code from the Carberp sources ) , AZZY ( aka ADVSTORESHELL , NETUI , EVILTOSS , and spans across 4-5 generations ) and a few others .


The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


Their evolving and modified SPLM , CHOPSTICK , XAgent code is a long-standing part of Sofacy activity , however much of it is changing .


Compared to other backdoor tools associated with the Sofacy group , the use of Zebrocy in attack campaigns is far more widespread .


As alluded to in our previous blog regarding the Cannon tool , the Sofacy group ( AKA Fancy Bear , APT28 , STRONTIUM , Pawn Storm , Sednit ) has persistently attacked various government and private organizations around the world from mid-October 2018 through mid-November 2018 .


Russian citizens—journalists , software developers , politicians , researchers at universities , and artists are also targeted by Pawn Storm .


While the JHUHUGIT ( and more recently , " JKEYSKW " ) implant used in most of the Sofacy attacks , high profile victims are being targeted with another first level implant , representing the latest evolution of their AZZY Trojan .


Once a foothold is established , Sofacy trys to upload more backdoors , USB stealers as well as other hacking tools such as " Mimikatz " for lateral movement .


Once a foothold is established , they try to upload more backdoors , USB stealers as well as other hacking tools such as " Mimikatz " for lateral movement .


The Sofacy threat group continues to target government organizations in the EU , US , and former Soviet states to deliver the Zebrocy tool as a payload .


Komplex shares a significant amount of functionality and traits with another tool used by Sofacy – the Carberp variant that Sofacy had used in previous attack campaigns on systems running Windows .


The Sofacy group created the Komplex Trojan to use in attack campaigns targeting the OS X operating system – a move that showcases their continued evolution toward multi-platform attacks .


The Komplex Trojan revealed a design similar to Sofacy 's Carberp variant Trojan , which we believe may have been done in order to handle compromised Windows and OS X systems using the same C2 server application with relative ease .


This whitepaper explores the tools - such as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , etc- of the Dukes , a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making .