For example , the CIA attack system Fine Dining , provides 24 decoy applications for CIA spies to use .


For example , Comodo was defeated by CIA malware placing itself in the Window's Recycle Bin .


CIA hackers discussed what the NSA's Equation Group hackers did wrong and how the CIA's malware makers could avoid similar exposure .


The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation .


This information is used by the CIA's 'JQJIMPROVISE' software (see below) to configure a set of CIA malware suited to the specific needs of an operation .


Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies .


HIVE is a multi-platform CIA malware suite and its associated control software .


A series of standards lay out CIA malware infestation patterns which are likely to assist forensic crime scene investigators as well as Apple , Microsoft , Google , Samsung , Nokia , Blackberry , Siemens and anti-virus companies attribute and defend against attacks .


In April 2013 , Kaspersky Lab reported that a popular game was altered to include a backdoor in 2011 .


Yet again , new supply-chain attacks recently caught the attention of ESET Researchers .


Given that these attacks were mostly targeted against Asia and the gaming industry , it shouldn’t be surprising they are the work of the group described in Kaspersky’s Winnti – More than just a game” .


The OSB functions as the interface between CIA operational staff and the relevant technical support staff .


A sustained cyberespionage campaign targeting at least three companies in the United States and Europe was uncovered by Recorded Future and Rapid7 between November 2017 and September 2018 .


The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant .


The attackers then enumerated access and conducted privilege escalation on the victim networks , utilizing DLL sideloading techniques documented in a US-CERT alert on APT10 to deliver malware .


On the two other victim networks , the attackers deployed a unique version of the UPPERCUT (ANEL) backdoor , known to have only been used by APT10 .


APT10 actors then compressed proprietary data from Visma using WinRAR (deployed by the attackers) and exfiltrated to a Dropbox account using the cURL for Windows command-line tool .


UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques .


we assess with high confidence that these incidents were conducted by APT10 also known as Stone Panda , menuPass , CVNX in an effort to gain access to networks and steal valuable intellectual property or gain commercial advantage .


On top of the breadth , volume , and targets of attacks that APT10 has conducted since at least 2016 , we now know that these operations are being run by the Chinese intelligence agency , the Ministry of State Security (MSS) .


Utilizing actors working for shell companies such as Huaying Haitai Science and Technology Development Co Ltd , the MSS has conducted an unprecedented campaign , dubbed Operation Cloud Hopper , ” against managed IT service providers (MSPs) designed to steal intellectual property and enable secondary attacks against their clients .


We assess that APT10 likely compromised Visma with the primary goal of enabling secondary intrusions onto their client networks , and not of stealing Visma intellectual property .


In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage .


The backdoor was deployed using the Notepad++ updater and sideloading malicious DLL , as noted in APT10’s targeting of Japanese corporations in July 2018 .


That attack was attributed to perpetrators Kaspersky called the Winnti Group .


APT10 is a threat actor that has been active since at least 2009 .


APT10 has historically targeted healthcare , defense , aerospace , government , heavy industry and mining , and MSPs and IT services , as well as other sectors , for probable intellectual property theft .


We believe APT10 is the most significant Chinese state-sponsored cyber threat to global corporations known to date .


In the blog , Intrusion Truth identified APT10 as having utilized several Tianjin-based companies , including Huaying Haitai Science and Technology Development Co Ltd and Laoying Baichen Instruments Equipment Co Ltd .


Based on the technical data uncovered , and in light of recent disclosures by the U.S. Department of Justice on the ongoing activities of Chinese state-sponsored threat actors .


Our research from 2017 concluded that Guangdong ITSEC (and therefore the MSS) directed the activities of a company named Boyusec , which was identified as a shell company for APT3 .


Access to the networks of these third-party service providers grants the MSS the ability to potentially access the networks of hundreds , if not thousands , of corporations around the world .


The December APT10 indictment noted that the group’s malicious activities breached at least 45 companies and managed service providers in 12 countries , including Brazil , Canada , Finland , France , Germany , India , Japan , Sweden , Switzerland , the United Arab Emirates , the United Kingdom , and the United States .


In all three incidents , APT10 gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials .


In all three incidents , the attackers gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials .


In all three incidents , APT10 actors used previously acquired legitimate credentials , possibly gained via a third-party supply chain compromise in order to gain initial access to the law firm and the apparel company .


In early 2017 , APT10 began conducting attacks against global managed IT service providers (MSPs) that granted them unprecedented access to MSPs and their customers’ networks .


'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS (JukeBox) and Linux (DanceFloor) .


During this operation (dubbed ‘Cloud Hopper” because of the group’s use of popular western cloud-based services) , APT10 utilized both new malware (Quasar RAT , Trochilus , RedLeaves , ChChes as well as some familiar old tools .


Most recently , on December 20 , 2018 , the U.S. Department of Justice charged two hackers associated with the Chinese Ministry of State Security (MSS) with global computer intrusion campaigns targeting intellectual property .


This indictment attributed the intrusions to APT10 , a group that had been conducting the malicious activities for over a decade on behalf of the MSS , China’s civilian human intelligence agency .


The Visma group operates across the entire Nordic region along with Benelux , Central , and Eastern Europe .


Recorded Future has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 .


We were particularly interested in identifying whether any customers of the targeted MSPs were subsequently compromised by APT10 , given their potential access through compromised MSP networks .


Recorded Future’s Insikt Group has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 .


In September 2018 , one of our clients (and a supplier as well) , Visma , reached out to us for assistance in investigating an incident uncovered on their network following a breach notification by Rapid7 .


This was followed by an initial exploitation , network enumeration , and malicious tool deployment on various Visma endpoints within two weeks of initial access .


On August 30 , 2018 , APT10 deployed their first modified version of Trochilus that had its C2 communications encrypted using Salsa20 and RC4 ciphers instead of the more common RC4-encrypted Trochilus variant seen in the wild .


This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 .


The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process .


APT10 also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API .


In order to exfiltrate the compromised data , APT10 employed custom malware that used Dropbox as its C2 .


They also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API .


Our research partner Rapid7 investigated the Dropbox use and found that the attackers had used the same account to store exfiltrated data from a global apparel company .


They also identified broadly similar TTPs being used in the attack against a U.S law firm specializing in intellectual property law .


Rapid7’s investigation revealed the law firm was first targeted in late 2017 , followed by the apparel company a few months later , and finally , the Visma attack in August 2018 .


In one of the attacks , Rapid7 identified the attackers escaping a Citrix application in order to run the payload script on the victim desktop .


Additionally , the same DLL sideloading technique observed in the Visma attack was used , and many of the tools deployed by the APT10 shared naming similarities as well 1.bat , cu.exe , ss.rar , r.exe , pd.exe .


Most interestingly , Rapid7 observed the use of the Notepad++ updater gup.exe as a legitimate executable to sideload a malicious DLL (libcurl.dll) in order to deploy a variant of the UPPERCUT backdoor also known as ANEL .


APT10 used this approach to deploy UPPERCUT when targeting Japanese corporations in July 2018 .


APT10 actors gained initial access to the Visma network around August 17 , 2018 .


While we are confident that APT10 actors gained access to the Visma network in August using stolen employee Citrix remote desktop credentials , it is not clear how or when these credentials were initially compromised .


Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials .


After almost two weeks , on August 30 , 2018 , APT10 attackers used their access to the network to move laterally and made their first deployment of an RC4- and Salsa20-encrypted variant of the Trochilus malware using a previously associated DLL sideloading techniquE .


This means that APT10 actors had two separate access points into the Visma network .


This slight delay may point to the handing over of active exploitation duties to other operator(s) in a multi-team APT10 effort within the Ministry of State Security for the attack .


Other examples of malicious infrastructure registered with internet.bs include domains for APT28’s VPNFilter malware campaign and the registration of the cyber-berkut .


org domain that was affiliated with the pro-Russian and potentially Russian state-linked threat actor CyberBerkut .


KHRAT is a backdoor trojan purported to be used with the China-linked cyberespionage group DragonOK .


In early 2018 , Rapid7 identified that APT10 compromised an apparel company , based upon detections and intelligence gathered from the U.S.-based law firm breach .


The attacker gained access to the victim’s internet-accessible Citrix systems and authenticated to them from networks associated with low-cost VPN providers owned by VPN Consumer Network .


Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe.” The attackers used identical TTPs for executing malware and Mimikatz as observed before , by using DLL sideloading with known good binaries that had DLL search order path issues .


Rapid7 reviewed malware discovered in the victim’s environment and found implants that used Dropbox as the C2 .


The attackers used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script .


APT10 used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script .


For exfiltration of stolen data , APT10 used WinRAR and renamed rar.exe” to r.exe” to create archives , upload them with curl.exe” (renamed to c.exe”) , and again , use the cloud storage provider Dropbox .


Rapid7 discovered that additional data was placed into the Dropbox accounts under control of the attacker during the compromise and was able to attribute data that was placed into it as being owned by Visma .


Once on the Visma network , APT10 attackers used the Microsoft BITSAdmin CLI tool to copy malicious tools from a suspected attacker-controlled C2 hosted on 173.254.236[.]158 to the \ProgramData\temp\ directory on the infected host .


Rapid7 then provided a breach notification to Visma to alert them to this compromise in September 2018 .


We believe APT10 is the most significant known Chinese state-sponsored cyber threat to global corporations .


APT10's unprecedented campaign against MSPs , alleged to have included some of the largest MSPs in the world , in order to conduct secondary attacks against their clients , grants the Chinese state the ability to potentially access the networks of hundreds (if not thousands) of corporations around the world .


This campaign brings to light further evidence supporting the assertions made by the Five Eyes nations , led by the U.S Department of Justice indictment against APT10 actors outlining the unprecedented scale of economic cyberespionage being conducted by the Chinese Ministry of State Security .


This report , alongside the plethora of other reporting on APT10 operations , acutely highlights the vulnerability of organizational supply chains .


We believe the groups moved to use CVE-2018-0798 instead of the other Microsoft Equation Editor Remote Code Execution (RCE) vulnerabilities because the former is more reliable as it works on all known versions of Equation Editor .


The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 .


After further analysis , it was discovered that the RTF files were exploiting the CVE-2018-0798 vulnerability in Microsoft’s Equation Editor (EQNEDT32) .


Anomali Researchers were able to identify multiple samples of malicious RTF documents ITW using the same exploit for CVE-2018-0798 .


The earliest use of the exploit ITW we were able to identify and confirm is a sample (e228045ef57fb8cc1226b62ada7eee9b) dating back to October 2018 (VirusTotal submission of 2018-10-29) with the RTF creation time 2018-10-23 .


CVE-2018-0798 is an RCE vulnerability , a stack buffer overflow that can be exploited by a threat actor to perform stack corruption .


As observed previously with CVE-2017-11882 and CVE-2018-0802 , the weaponizer was used exclusively by Chinese cyber espionage actors for approximately one year December 2017 through December 2018 , after which cybercrime actors began to incorporate it in their malicious activity .


Upon decrypting and executing , it drops two additional files wsc_proxy.exe” (legitimate Avast executable) and a malicious DLL wsc.dll” in the %TEMP% folder .


However , Beginning on 25 June 2019 , we started observing multiple commodity campaigns Mostly dropping AsyncRAT using the updated RTF weaponizer with the same exploit (CVE-2018-0798) .


Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer .


These findings also suggest that the threat groups have robust exploit developing capabilities because CVE-2018-0798 is not widely reported on and it is typically not incorporated into publicly available weaponizers .


In addition , a current ANY.RUN playback of our observed Elise infection is also available .


Upon opening of the MS Word document , our embedded file exploits CVE-2017-11882 to drop a malicious fake Norton Security Shell Extension module , 'NavShExt.dll' , which is then injected into iexplore.exe to install the backdoor , begin collection , and activate command and control .


Moving through the infection process , NetWitness Endpoint detects the initial exploit CVE-2017-1182 in action as the Microsoft Equation Editor , 'EQNEDT32.exe' , scores high for potentially malicious activity .


Most recently though , a new campaign , targeting Belarus , Turkey and Ukraine , has emerged that caught the attention of Check Point researchers .


The well-crafted and socially engineered malicious documents then become the ﬁrst stage of a long and mainly ﬁleless infection chain that eventually delivers POWERSTATS , a signature PowerShell backdoor of this threat group .


This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more .


If the macros in SPK KANUN DEĞİŞİKLİĞİ GİB GÖRÜŞÜ.doc” are enabled , an embedded payload is decoded and saved in the %APPDATA% directory with the name CiscoAny.exe” .


INF ﬁles have been used in the past by MuddyWater , although they were launched using Advpack.dll and not IEAdvpack.dll .


In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document .


Although it has focused most of its efforts on the Middle East region , the political afﬁliations , motives and purposes behind MuddyWater’s attacks are not very well- deﬁned , thus earning it its name .


In the past , countries such as Saudi Arabia , the UAE and Turkey have been a MuddyWater's main target , but the campaigns have also reached a much wider audience , making their way to victims in countries such as Belarus and Ukraine .


MuddyWater target groups across Middle East and Central Asia , primarily using spear phishing emails with malicious attachments .


Most recently MuddyWater were connected to a campaign in March that targeted organizations in Turkey , Pakistan , and Tajikistan .


The group has been quite visible since the initial 2017 Malwarebytes report on their elaborate espionage attack against the Saudi Arabian government .


Our analysis revealed that they drop a new backdoor , which is written in PowerShell as MuddyWater’s known POWERSTATS backdoor .


We assume that RunPow stands for run PowerShell , ” and triggers the PowerShell code embedded inside the .dll file .


This backdoor has some features similar to a previously discovered version of the Muddywater backdoor .


Based on our analysis , we can confirm that MuddyWater target Turkish government organizations related to the finance and energy sectors .


This is yet another similarity with previous MuddyWater campaigns , which were known to have targeted multiple Turkish government entities .


The main delivery method of this type of backdoor is spear phishing emails or spam that uses social engineering to manipulate targets into enabling malicious documents .


Trend Micro™ Deep Discovery™ provides detection , in-depth analysis , and proactive response to today’s stealthy malware , and targeted attacks in real time .


MuddyWater first surfaced in 2017 .


First stage infections and graphical decoys have been described by multiple sources , including in our previous research MuddyWater expands operations .


MuddyWater compiles various offensive Python scripts .


This includes Python scripts .


Usually , the Stageless Meterpreter has the Ext_server_stdapi.x64.dll” , Ext_server_extapi.x64.dll” , and Ext_server_espia.x64.dll” extensions .


The January 2017 report followed up on other private reports published on the group’s BeEF-related activity in 2015 and 2016 .


Previous analysis of the NewsBeef APT indicates that the group focuses on Saudi Arabian (SA) and Western targets , and lacks advanced offensive technology development capabilities .


However , in the summer of 2016 , NewsBeef deployed a new toolset that includes macro-enabled Office documents , PowerSploit , and the Pupy backdoor .


The most recent NewsBeef campaign uses this toolset in conjunction with spearphishing emails , links sent over social media/standalone private messaging applications , and watering hole attacks that leverage compromised high-profile websites some belonging to the SA government .


The NewsBeef actor deployed a new toolset in a campaign that focused primarily on Saudi Arabian targets .


NewsBeef continues to deploy malicious macro-enabled Office documents , poisoned legitimate Flash and Chrome installers , PowerSploit , and Pupy tools .


The NewsBeef campaign is divided into two main attack vectors , spearphishing and strategic web compromise watering hole attacks .


On December 25 , 2016 , the NewsBeef APT stood up a server to host a new set of Microsoft Office documents (maintaining malicious macros and PowerShell scripts) to support its spear-phishing operations .


These compromised servers include Saudi Arabian government servers and other high-value organizational identities relevant to NewsBeef's targets .


However , Kaspersky Security Network (KSN) records also contain links that victims clicked from the Outlook web client outlook.live.com” as well as attachments arriving through the Outlook desktop application .


Interestingly , NewsBeef set up its server using the hosting provider Choopa , LLC , US” , the same hosting provider that the group used in attacks over the summer of 2016 .


NTG’s IT focus and client list likely aided NewsBeef’s delivery of malicious PowerShell-enabled Office documents and poisoned installers .


In other schemes , NewsBeef sent macro-enabled Office attachments from spoofed law firm identities or other relevant service providers to targets in SA .


The law firm in this scheme is based in the United Kingdom and is the sole location for targets outside of SA for this campaign .


Starting in October 2016 , NewsBeef compromised a set of legitimate servers (shown below) , and injected JavaScript to redirect visitors to http://analytics-google.org:69/Check.aspx .


For example , on a Saudi government website , the NewsBeef APT delivered packed JavaScript into the bottom of a referenced script that is included in every page served from the site the packed and unpacked JavaScript is shown below .


The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” .


A high volume of redirections from the compromised site continues into mid-January 2017 .


However , as this recent campaign indicates , the NewsBeef APT appears to have shifted its intrusion toolset away from BeEF and towards macro-enabled malicious Office documents , PowerSploit , and Pupy .


Despite this shift in toolset , the group still relies on old infrastructure as evidenced by their reuse of servers hosted by the service providers Choopa and Atlantic.net .


Its attack activities can be traced back to April 2012 .


The OceanLotus reflects a very strong confrontational ability and willing to attack by keep evolving their techniques .


These APT attacks and adopting confrontation measures will exist for a long time .


OceanLotus’ targets are global .


OceanLotus have been actively using since at least early 2018 .


OceanLotus malware family samples used no earlier than 2017 .


We identified two methods to deliver the KerrDown downloader to targets .


The link to the final payload of KerrDown was still active during the time of analysis and hence we were able to download a copy which turned out to be a variant of Cobalt Strike Beacon .


While investigating KerrDown we found multiple RAR files containing a variant of the malware .


Therefore , it is clear that the OceanLotus group works during weekdays and takes a break during the weekends .


The group was first revealed and named by SkyEye Team in May 2015 .


OceanLotus's targets include China's maritime institutions , maritime construction , scientific research institutes and shipping enterprises .


RedDrip Team (formerly SkyEye Team) has been to OceanLotus to keep track of high strength , groupactivity , found it in the near future to Indochinese Peninsula countries since 2019 On April 1 , 2019 , RedDrip discovered a Vietnamese file name Hop dong sungroup.rar in the process of daily monitoring the attack activities of the OceanLotus .


COCCOC is a Vietnam was founded in 2013 .


In fact , according to reports of various security vendors , OceanLotus also attacked several countries , including Cambodia , Thailand , Laos , even some victims in Vietnam , like opinion leaders , media , real estate companies , foreign enterprises and banks .


Unlike the 2016 variants of Ratsnif that stored all packets to a PCAP file .


these threat actors targeted a number of government agencies Threat actors targeted a number of government agencies in East Asia .


Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT .


Maudi Surveillance Operation which was previously reported in 2013 .


specifically CVE-2018-0798 , before downloading subsequent payloads .


The dropped PE file has the distinctive file name 8.t” .


The last process is utilized as part of the loading process for Cotx RAT and involves the legitimate Symantec binary noted above .


These conflicts have even resulted in Haftar leading an attack on the capital city in April .


The attackers have targeted a large number of organizations globally since early 2017 .


Attackers were initially discovered while investigating a phishing attack that targeted political figures in the MENA region .


Group's targets include high-profile entities such as parliaments , senates , top state offices and officials , political science scholars , military and intelligence agencies , ministries , media outlets , research centers , election commissions , Olympic organizations , large trading companies , and other unknown entities .


Cisco Talos recently published a blogpost describing targeted attacks in the Middle East region which we believe may be connected .


Operation Parliament appears to be another symptom of escalating tensions in the Middle East region .


The attackers have taken great care to stay under the radar , imitating another attack group in the region .


With deception and false flags increasingly being employed by threat actors , attribution is a hard and complicated task that requires solid evidence , especially in complex regions such as the Middle East .


The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware .


The malware starts communicating with the C&C server by sending basic information about the infected machine .


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests .


What lied beneath this facade was a well-engineered campaign of phishing attacks designed to steal credentials and spy on the activity of dozens of journalists , human rights defenders , trade unions and labour rights activists , many of whom are seemingly involved in the issue of migrants’ rights in Qatar and Nepal .


We refer to this campaign and the associated actor as Operation Kingphish Malik” , in one of its written forms in Arabic , translates to King” .


It is worth noting that in December 2016 , Amnesty International published an investigation into another social engineering campaign perpetrated by a seemingly fake human rights organization known as Voiceless Victims , which targeted international human rights and labour rights organizations campaigning on migrant workers’ rights in Qatar .


It appears that the attackers may have impersonated the identity of a real young woman and stole her pictures to construct the fake profile , along with a professional biography also stolen from yet another person .


In the course of this email correspondence , the attacker — Safeena” — then sent what appeared to be invitations to access several documents on Google Drive .


The attackers were meticulous in making their phishing page as credible as possible .


Among the targets of this campaign is the International Trade Union Confederation (ITUC) .


Both in the attacks against ITUC and in other occasions , Operation Kingphish approached selected targets over social media , prominently Facebook , and engaged in chat conversations with them on and off , sometimes over a period of several months .


This time the document purported to be about the involvement of the Emir of Qatar in funding ISIS , which was seemingly copied from a website critical of Qatar .


While there is a clear underlying Qatar migrant workers theme in Operation Sheep , it is also hypothetically possible that these attacks could have been perpetrated by a malicious actor affiliated to a different government with an interest in damaging the reputation of the State of Qatar .


Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year .


The SDK , named SWAnalytics is integrated into seemingly innocent Android applications published on major 3rd party Chinese app stores such as Tencent MyApp , Wandoujia , Huawei App Store , and Xiaomi App Store .


After app installation , whenever SWAnalytics senses victims opening up infected applications or rebooting their phones , it silently uploads their entire contacts list to Hangzhou Shun Wang Technologies controlled servers .


In theory , Shun Wang Technologies could have collected a third of China’s population names and contact numbers if not more .


With no clear declaration of usage from Shun Wang , nor proper regulatory supervision , such data could circulate into underground markets for further exploit , ranging from rogue marketing , targeted telephone scams or even friend referral program abuse during November’s Single’s Day and December’s Asian online shopping fest .


This paper will cover the discovery of this campaign , dubbed ‘Operation Sheep’ , and an analysis of SWAnalytics .


In mid-September , an app named ‘Network Speed Master’ stood out on our radar with its rather unusual behavior patterns .


This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge .


It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in .


With default settings , SWAnalytics will scan through an Android device’s external storage , looking for directory tencent/MobileQQ/WebViewCheck” .


From our first malicious sample encounter back in mid-September until now , we have observed 12 infected applications , the majority of which are in the system utility category .


By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device .


Operation Sheep is the first campaign we have observed in the wild that abuses similar concept since our MitD publication .


To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control .


Whenever users reboot their device or open up Network Speed Master , SWAnalytics will fetch the latest configuration file from http[:]//mbl[.]shunwang[.]com/cfg/config[.]json” .


In order to understand SWAnalytics’ impact , we turned to public download volume data available on Chandashi , one of the app store optimization vendors specialized in Chinese mobile application markets .


Data points span from September 2018 to January 2019 where we observed over 17 million downloads in just five months .


In China alone , we have seen underground market sheep shavers” ported SMS rogue marketing strategy to spread Alipay Red Packet referral URL links .


In Operation Sheep’s case , Shun Wang likely harvests end user contact lists without application developer acknowledgement .


According to Cheetah Mobile’s follow-up investigation , fraudulent behaviors came from two 3rd party SDKs Batmobi , Duapps integrated inside Cheetah SDK .


It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns .


Webinjects targeting Japan , a country we haven’t seen targeted by Panda Banker before .


Japan is no stranger to banking malware .


Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware .


This post was our first analysis of the first Panda Banker campaign that we’ve seen to target financial institutions in Japan .


Operation Pawn Storm is an active economic and political cyber-espionage operation that targets a wide range of entities , like the military , governments , defense industries , and the media .


We believe the iOS malware gets installed on already compromised systems , and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems .


We found two malicious iOS applications in Operation Pawn Storm .


One is called XAgent detected as IOS_XAGENT.A and the other one uses the name of a legitimate iOS game , MadCap detected as IOS_ XAGENT.B .


The obvious goal of the SEDNIT-related spyware is to steal personal data , record audio , make screenshots , and send them to a remote command-and-control (C&C) server .


Madcap” is similar to the XAgent malware , but the former is focused on recording audio .


To learn more about this campaign , you may refer to our report , Operation Pawn Storm Using Decoys to Evade Detection .


Additionally , we discovered a new DNS hijacking technique that we assess with moderate confidence is connected to the actors behind Sea Turtle .


Talos now has moderate confidence that the threat actors behind Sea Turtle have been using another DNS hijacking technique .


This technique was also observed against a government organizations in the Middle East and North African region .


Cisco telemetry confirmed that the actors behind Sea Turtle maintained access to the ICS-Forth network from an operational command and control (C2) node .


Our telemetry indicates that the actors maintained access in the ICS-Forth network through at least April 24 , five days after the statement was publicly released .


This full-blown spying framework consists of two packages named ‘Tokyo’ and ‘Yokohama’ .


Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue .


The first confirmed date when TajMahal samples were seen on a victim’s machine is August 2014 .


More details about TajMahal are available to customers of the Kaspersky Intelligence Reporting service (contact intelreports@kaspersky.com) .


The dropper first appeared in mid-July , suggesting that this APT activity is potentially ongoing , with Turla actively targeting G20 participants and/or those with interest in the G20 , including member nations , journalists , and policymakers .


Turla is a well-documented , long operating APT group that is widely believed to be a Russian state-sponsored organization .


Turla is perhaps most notoriously suspected as responsible for the breach of the United States Central Command in 2008 .


More recently Turla was accused of breaching RUAG , a Swiss technology company , in a public report published by GovCERT.ch .


The delivery of KopiLuwak in this instance is currently unknown as the MSIL dropper has only been observed by Proofpoint researchers on a public malware repository .


Assuming this variant of KopiLuwak has been observed in the wild , there are a number of ways it may have been delivered including some of Turla’s previous attack methods such as spear phishing or via a watering hole .


This could include diplomats , experts in the areas of interest related to the Digital Economy Task Force , or possibly even journalists .


Turla's goal could include diplomats , experts in the areas of interest related to the Digital Economy Task Force , or possibly even journalists .


The earliest step in any possible attack(s) involving this variant of KopiLuwak of which Proofpoint researchers are currently aware begin with the MSIL dropper .


The basic chain of events upon execution of the MSIL dropper include dropping and executing both a PDF decoy and a Javascript (JS) dropper .


As explained in further detail below , the JS dropper ultimately installs a JS decryptor onto an infected machine that will then finally decrypt and execute the actual KopiLuwak backdoor in memory only .


As Proofpoint has not yet observed this attack in the wild it is likely that there is an additional component that leads to the execution of the MSIL payload .


The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine .


Despite the added capabilities , we still agree with Kaspersky that this backdoor is likely used as an initial reconnaissance tool and would probably be used as a staging point to deploy one of Turla’s more fully featured implants .


Turla is a complex cyberattack platform focused predominantly on diplomatic and government-related targets , particularly in the Middle East , Central and Far East Asia , Europe , North and South America and former Soviet bloc nations .


We didn’t choose to name it after a vegetable; the .NET malware developers named it Topinambour themselves .


The role of the .NET module is to deliver the known KopiLuwak JavaScript Trojan .


Moreover , Turla now also has a heavily obfuscated PowerShell Trojan that is similar to KopiLuwak .


RocketMan!” (probably a reference to Donald Trump’s nickname for Kim Jong Un) and MiamiBeach” serve as the first beacon messages from the victim to the control server .


These could be tools to circumvent internet censorship , such as Softether VPN 4.12” and psiphon3” , or Microsoft Office activators” .


These campaign-related VPSs are located in South Africa .


The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems .


The PowerShell version of the Trojan also has the ability to get screenshots .


The Trojan is quite similar to the .NET RocketMan Trojan and can handle the same commands; additionally , it includes the #screen” command to take a screenshot .


The usage of KopiLuwak , a well-known and exclusive artefact previously used by the Turla group , makes us attribute this campaign to this actor with high confidence .


Winnti's mode of operation: to collect information on the organizational charts of companies , on cooperating departments , on the IT systems of individual business units , and on trade secrets , obviously .


Hackers usually take precautions , which experts refer to as Opsec .


The Winnti group’s Opsec was dismal to say the least .


This mode of operation is typical of many hacker groups—and especially of Winnti .


They are a very , very persistent group , ” says Costin Raiu , who has been watching Winnti since 2011 .


Raiu and his team have followed the digital tracks left behind by some of the Winnti hackers .


One government official puts it very matter-of-factly: Winnti is very specific to Germany .


By 2014 , the Winnti malware code was no longer limited to game manufacturers .


Winnti is targeting high-tech companies as well as chemical and pharmaceutical companies .


Winnti is attacking companies in Japan , France , the U.S. and Germany .


The Winnti hackers broke into Henkel’s network in 2014 .


Henkel confirms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions .


Far from attacking Henkel and the other companies arbitrarily , Winnti takes a highly strategic approach .


The hackers behind Winnti have also set their sights on Japan’s biggest chemical company , Shin-Etsu Chemical .


In the case of another Japanese company , Sumitomo Electric , Winnti apparently penetrated their networks during the summer of 2016 .


Winnti hackers also penetrated the BASF and Siemens networks .


Thanks to this tool , we found out back in March 2019 that the Bayer pharmaceutical group had been hacked by Winnti .


At Gameforge , the Winnti hackers had already been removed from the networks when a staff member noticed a Windows start screen with Chinese characters .


To witnesses , the spy appears to be running a program showing videos (e.g VLC) , presenting slides (Prezi) , playing a computer game (Breakout2 , 2048) or even running a fake virus scanner .


From the time of file creation , the attacker started working at least as early as July 2018 .


The link to feeds.rapidfeeds.com left in its XML configuration file was also mentioned by Kaspersky’s report in the reference section , which confirms that the APT-C-09 group keeps updating its C2 configuration channel and the recent one reserves some past features .


For example , Donot and Bitter disguised as Kashmiri Voice to attack Pakistan , Transparent Tribe attacked India with decoy document regarding terrorist attacks in Kashmir .


Considering APT-C-09 , Bitter and Donot have carried out targeted attacks against China , we must take actions in advance and keep a close eye on their recent activities .


APT41 espionage operations against the healthcare , high-tech , and telecommunications sectors include establishing and maintaining strategic access , and through mid-2015 , the theft of intellectual property .


FireEye Threat Intelligence assesses with high confidence that APT41 carries out an array of financially motivated intrusions , particularly against the video game industry , including stealing source code and digital certificates , virtual currency manipulation , and attempting to deploy ransomware .


APT41 has executed multiple software supply chain compromises , gaining access to software companies to inject malicious code into legitimate files before distributing updates .


APT41 is unique among tracked China-based actors in that it leverages non-public malware typically reserved for espionage operations in what appears to be activity that falls outside the scope of state-sponsored missions .


Based on early observed activity , consistent behavior , and APT41's unusual focus on the video game industry , we believe the group's cyber crime activities are most likely motivated by personal financial gain or hobbyist interests .


APT41 campaigns include most of the incidents previously attributed in FireEye Threat Intelligence reporting to GREF Team and a number of additional clusters that were previously unnamed .


Activity traces back to 2012 when individual members of APT41 conducted primarily financially motivated operations focused on the video game industry before expanding into likely statesponsored activity .


Learning to access video game production environments enabled APT41 to develop the tactics , techniques , and procedures (TTPs) that were later leveraged against software companies to inject malicious code into software updates .


APT41 has targeted organizations in 14 countries (and Hong Kong) over seven years , including: France , India , Italy , Japan , Myanmar , the Netherlands , Singapore , South Korea , South Africa , Switzerland , Thailand , Turkey , the United Kingdom , and the United States (Figure 1) .


APT41 espionage operations against entities in these countries follow targeting of verticals consistent with Chinese national policy priorities .


We believe that like other Chinese espionage operators , APT41 has moved toward strategic intelligence collection and establishing access , but away from direct intellectual property theft .


In 2014 , APT41 was observed carrying out espionage campaigns concurrently with financially motivated intrusions , demonstrating that they could balance different objectives simultaneously .


Since 2017 , APT41's activities have included a series of supply chain compromises .


The group also targeted companies involved in producing motherboards , processors , and server solutions for enterprises .


Since 2013 , APT41 has targeted organizations involved in the research , development , and sale of computer components used for machine-learning , autonomous vehicles , medical imaging , and the consumer market .


In a 2014 compromise , APT41 targeted a European conglomerate and specifically focused on systems physically located in China .


In spring 2015 , APT41 targeted information related to two entities undergoing a merger announced the previous year .


Since 2017 , APT41 has consistently targeted telecommunications companies , possibly a crucial first step to establish a foothold in targeting a particular region .


Targeted telecom companies spanned several countries , and recently identified intrusions were concentrated in countries where we had not identified any prior APT41 activity .


In July and August 2016 , APT41 sent spear-phishing emails to Hong Kong media organizations known for pro-democracy editorial content .


This was the first instance we have observed of APT41 targeting pro-democracy groups in Hong Kong .


APT41 frequently leverages timely news stories as the lure content in their spear-phishing emails , although social engineering content does not always correlate with targeted users or organizations .


In 2015 , APT41 targeted a Japanese media organization with a lure document (Figure 3) titled 中東呼吸器症候 群(MERS)の予防 , ” which translates to Prevention of Middle East Respiratory Syndrome (MERS) .


APT41 activity aimed at medical device companies and pharmaceuticals is demonstrative of the group's capacity to collect sensitive and highly valuable intellectual property (IP) , although we have not observed evidence of IP theft since late 2015 .


Unlike other observed Chinese espionage operators , APT41 conducts explicit financially motivated activity , which has included the use of tools that are otherwise exclusively used in campaigns supporting state interests .


Although APT41 initially targeted the parent company , 30 percent of the victimized hosts were related to a subsidiary specialized in manufacturing medical devices .


In 2018 , we observed APT41 target a third healthcare company , although their goals during this compromise were unclear .


In June 2018 , APT41 sent spear-phishing emails using an invitation lure to join a decentralized gaming platform linked to a cryptocurrency service (Figure 5) that had positioned itself as a medium of exchange for online games and gambling sites .


This provides another connection between the targeting of the cryptocurrency organizations and video game targeting .


In October 2018 , the group compiled an instance of XMRig , a Monero cryptocurrency mining tool , demonstrating a continued interest in cryptocurrency .


APT41 campaigns focused on the video game sector have largely affected studios and distributors in East and Southeast Asia , although global companies based in the United States have also been targeted .


APT41 continuously returns to targeting the video game sector and seems to have matured its campaigns through lessons learned in operations against the industry .


We believe these operations include broadly malicious activity that can enable further operations , such as targeting game source code and compromising digital certificates , while other activities are explicitly financially motivated , such as abusing in-game currency mechanics .


In October 2012 , APT41 used captured credentials to compromise a jump server and access a production environment where they deployed a Linux version of PHOTO .


Since at least 2012 , APT41 has repeatedly gained access to game development environments within affected companies , including online multiplayer networks , as well as targeting of production database administrators .


APT41 has been observed inserting malicious code into legitimate video game files to distribute malware .


In 2018 , the group inserted CRACKSHOT malware into game files that were signed with legitimate codesigning certificates , most likely indicating access to the production environment , which facilitated a supply chain compromise .


We have also observed APT41 limitedly deploy rootkits on Linux systems and Master Boot Record (MBR) bootkits , such as ROCKBOOT , on Windows systems to hide their malware and maintain persistence on victim systems .


Selective deployment of ROCKBOOT suggests that APT41 reserves more advanced TTPs and malware only for high-value targets .


APT41 has blatantly engaged in financially motivated activity targeting the video game industry , including manipulating virtual currencies .


In a highly unusual case , APT41 attempted to extort a game company by deploying the Encryptor RaaS ransomware .


APT41 is well-known for leveraging compromised digital certificates from video game studios to sign malware .


We suggest that APT41 sought to target in-game currency but found they could not monetize the specific targeted game , so the group resorted to ransomware to attempt to salvage their efforts and profit from the compromise .


APT41 has also used credentials compromised in previous operations .


In 2014 , APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service .


Although we do not have first-hand evidence of APT41's compromise of TeamViewer , we have observed APT41 use compromised TeamViewer credentials as an entry point at multiple organizations .


Public reports of supply chain compromises linked to APT41 date back to at least 2014 , and technical evidence associated with these incidents was used to determine a relationship , if any , with APT41 .


As demonstrated in operations targeting the video game industry , APT41 leverages a variety of TTPs to access production environments where they can inject malicious code into legitimate files .


In March 2017 , suspected Chinese espionage operators targeted CCleaner , a utility that assists in the removal of unwanted files from a computer .


In July 2017 , APT41 injected malicious code into a software update package maintained by Netsarang and signed it with a legitimate Netsarang certificate in an operation referred to as ShadowPad by Kaspersky .


Both APT41 and the actors in the CCleaner incident used TeamViewer during initial compromise .


Supply chain compromises are most likely an extension of APT41's tactics used in gaining access to gaming development environments and to other gaming organizations via third-party service providers .


Beginning in July 2018 , APT41 appeared to have directly targeted several East and Southeast Asia-based video game developers and distributors to inject legitimate executables with the CRACKSHOT backdoor .


The lure used to target the cryptocurrency exchange (displayed in Figure 5 and translated in Figure 6) referenced an online gaming platform , tying the cryptocurrency targeting to APT41's focus on video game-related targeting .


FireEye malware analysis identified source code overlaps between malware used by APT41 in May 2016 targeting of a U.S.-based game development studio and the malware observed in supply chain compromises in 2017 and 2018 .


In May 2016 , APT41 deployed a POISONPLUG sample at a U.S.-based game development studio .


Alternatively , it is also possible that APT41 injected malicious code into the package prior to compilation , circumventing the need to steal the code-signing certificate and compile it on their own .


Either APT41 is operating outside of state control but still working with other Chinese APT malware actors , tools , and infrastructure on a parttime or contractual basis , or APT41 is a full-time .


APT41 uses many of the same tools and compromised digital certificates that have been leveraged by other Chinese espionage operators .


Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations .


APT41 has used several malware families that have also been used by other Chinese espionage operators , including variants of HIGHNOON , HOMEUNIX , PHOTO , SOGU , and ZXSHELL , among others .


HIGHNOON , one of the main code families observed being used by APT41 , was also used by APT17 in 2015 to target semiconductor and chemical manufacturers .


HOMEUNIX , another popular backdoor used by APT41 , has been used by at least 14 separate Chinese espionage groups , including APT1 , APT10 , APT17 , APT18 , and APT20 .


APT41 has used CROSSWALK.BIN , a kernel driver , to circumvent firewalls and covertly send data .


Another Chinese espionage group used a similar tool , CLASSFON , to covertly proxy network communications in 2011 .


At least two of these malware families , HIGHNOON.CLI and GEARSHIFT , have been used by APT17 and another suspected Chinese espionage group .


APT41 regularly leverages code-signing certificates to sign malware when targeting both gaming and nongaming organizations .


In July 2017 , APT41 initiated a TeamViewer session and transferred files that were later deleted .


In these instances , APT41 leveraged TeamViewer to transfer malware into the compromised environment , although we do not have direct evidence of APT41 compromising TeamViewer .


In May 2018 , APT41 used TeamViewer for initial entry in the compromise of a healthcare company .


Notably , APT41 was observed using proof-of-concept exploit code for CVE-2019-3396 within 23 days after the Confluence .


APT41 has targeted payment services specializing in handling in-game transactions and real money transfer (RMT) purchases .


We observed APT41 using a compromised account to create a scheduled task on a system , write a binary component of HIGHNOON containing the payload and C&C information to disk , and then modify the legitimate Windows WMI Performance Adaptor (wmiApSrv) to execute the HIGHNOON payload .


The group will also use a compromised account to create scheduled tasks on systems or modify legitimate Windows services to install the HIGHNOON and SOGU backdoors .


APT41 uses multiple methods to perform lateral movement in an environment , including RDP sessions , using stolen credentials , adding accounts to User and Admin groups , and password brute-forcing utilities .


To maintain presence , APT41 relies on backdoors , a Sticky Keys vulnerability , scheduled tasks , bootkits , rootkits , registry modifications , and creating or modifying startup files .


APT41 leveraged ROCKBOOT as a persistence mechanism for PHOTO and TERA backdoors .


APT41 has also been observed modifying firewall rules to enable file and printer sharing to allow for inbound Server Message Block (SMB) traffic .


In some instances , APT41 leveraged POISONPLUG as a first-stage backdoor to deploy the HIGHNOON backdoor in the targeted environment .


The group also deploys the SOGU and CROSSWALK malware families as means to maintain presence .


APT41 sent spear-phishing emails to multiple HR employees three days after the compromise had been remediated and systems were brought back online .


APT41 also deploys the SOGU and CROSSWALK malware families as means to maintain presence .


Within hours of a user opening the malicious attachment dropping a HOMEUNIX backdoor , APT41 regained a foothold within the environment by installing PHOTO on the organization's servers across multiple geographic regions .


Before attempting to deploy the publicly available Ransomware-as-a-Service (RaaS) Encryptor RaaS through group policy , APT41 blocked victim systems from retrieving anti-virus updates by accessing the DNS management console and implementing a forward lookup on the domain used for anti-virus updates to the park IP address 1.1.1.1 .


APT41 has been observed creating a RAR archive of targeted files for exfiltration .


APT41 is unique among tracked China-based actors in that it leverages non-public malware typically reserved for espionage campaigns in what appears to be activity for personal gain .


During multiple engagements , APT41 attempted to remove evidence of some of its activity by deleting Bash histories , clearing Windows security and system events , and modifying DNS management to avoid anti-virus detections .


Explicit financially-motivated targeting is unusual among Chinese statesponsored threat groups , and evidence suggests APT41 has conducted simultaneous cyber crime and cyber espionage operations from 2014 onward .


APT41 operations against higher education , travel services , and news/media firms provide some indication that the group also tracks individuals and conducts surveillance .


For example , the group has repeatedly targeted call record information at telecom companies .


APT41 has established and maintained strategic access to organizations in the healthcare , high-tech , and telecommunications sectors .


The group’s financially motivated activity has primarily focused on the video game industry , where APT41 has manipulated virtual currencies and even attempted to deploy ransomware .


In another instance , APT41 targeted a hotel’s reservation systems ahead of Chinese officials staying there , suggesting the group was tasked to reconnoiter the facility for security reasons .


These supply chain compromise tactics have also been characteristic of APT41’s best known and most recent espionage campaigns .


Interestingly , despite the significant effort required to execute supply chain compromises and the large number of affected organizations , APT41 limits the deployment of follow-on malware to specific victim systems by matching against individual system identifiers .


Mapping the group’s activities since 2012 (Figure 2) also provides some indication that APT41 primarily conducts financially motivated operations outside of their normal day jobs .


The latter is especially notable because APT41 has repeatedly returned to targeting the video game industry and we believe these activities were formative in the group’s later espionage operations .


APT41 leverages an arsenal of over 46 different malware families and tools to accomplish their missions , including publicly available utilities , malware shared with other Chinese espionage operations , and tools unique to the group .


Once in a victim organization , APT41 can leverage more sophisticated TTPs and deploy additional malware .


APT41 often relies on spear-phishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims .


APT41 has also deployed rootkits and Master Boot Record (MBR) bootkits on a limited basis to hide their malware and maintain persistence on select victim systems .


The limited use of these tools by APT41 suggests the group reserves more advanced TTPs and malware only for high-value targets .


Like other Chinese espionage operators , APT41 appears to have moved toward strategic intelligence collection and establishing access and away from direct intellectual property theft since 2015 .


This shift , however , has not affected the group's consistent interest in targeting the video game industry for financially motivated reasons .


BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e , possibly en masse .


With the contents of the emails , included links and decoy PDFs all involving taxes , the attackers are apparently targeting the financial departments of organizations in the Balkans region .


Some parts of the campaign were briefly described by a Serbian security provider in 2016 and the Croatian CERT in 2017 .


The campaign has been active at least from January 2016 to the time of writing the most recent detections in our telemetry are from July 2019 .


Our findings show that the mentioned attacks have been orchestrated and we consider them a single long-term campaign that spans Croatia , Serbia , Montenegro , and Bosnia and Herzegovina .


We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 .


Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina .


According to our telemetry , the campaign spreading these tools has been live since 2016 , with the most recent detections as late as in July 2019 .


In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 .


Via the BalkanDoor backdoor , the attacker sends a backdoor command to unlock the screen… and using BalkanRAT , they can do whatever they want on the computer .


The BalkanDoor backdoor does not implement any exfiltration channel .


APT41 leveraged ADORE.XSEC , a Linux backdoor launched by the Adore-NG rootkit , throughout an organization's Linux environment .


The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience .


The main part of the BalkanRAT malware is a copy of the Remote Utilities software for remote access .


Interestingly , some of the APT41's POISONPLUG malware samples leverage the Steam Community website associated with Valve , a video game developer and publisher .


The campaign targeting accountants in the Balkans shows some similarities with a campaign aimed at Ukrainian notaries reported in 2016 .


Based on the Let’s Encrypt certificate issuance date , we believe this campaign to be active from May 2019 .


One of the domains uncovered during the investigation was identified by the Chinese security vendor CERT 360 as being part of the BITTER APT campaign in May 2019 .


Further analysis of the BITTER APT’s infrastructure uncovered a broader phishing campaign targeting other government sites and state-owned enterprises in China .


Further investigation revealed approximately 40 additional sites , all of which appear to be targeting the government of China and other organisations in China .


We expect to see BITTER APT continuing to target the government of China by employing spoofed login pages designed to steal user credentials and obtain access to privileged account information .


This domain and IP address has been previously associated with the BITTER APT and targeting government agencies in China with phishing attacks , based on reporting from 360-CERT .


At the time of analysis , the subdomains did not host a website; however , based on BITTER APT group’s targeting patterns , it is highly likely that they were created to host faux login phishing pages designed to steal user’s credentials .


BITTER APT campaigns are primarily targeting China , Pakistan and Saudi Arabia historically .


As part of its ongoing research initiatives , the Anomali Threat Research Team has discovered a new phishing attack leveraging spoof sites that seem to be designed to steal email credentials from the target victims within the government of the People’s Republic of China .


360 Threat Intelligence Center has reported on related indicators being attributed to BITTER APT a South Asian country suspected Indian APT in open source reporting .


China Chopper is a tool that has been used by some state-sponsored actors such as Leviathan and Threat Group-3390 , but during our investigation we've seen actors with varying skill levels .


China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool .


Cisco Talos discovered significant China Chopper activity over a two-year period beginning in June 2017 , which shows that even nine years after its creation , attackers are using China Chopper without significant modifications .


Here , we investigate a campaign targeting an Asian government organization .


We observed another campaign targeting an organisation located in Lebanon .


China Chopper contains a remote shell (Virtual Terminal) function that has a first suggested command of netstat an|find ESTABLISHED .


They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword.exe .


The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords .


The actor attempts to exploit CVE-2018–8440 — an elevation of privilege vulnerability in Windows when it improperly handles calls to Advanced Local Procedure Call — to elevate the privileges using a modified proof-of-concept exploit .


The attacker obtains the required privileges and launches a few other tools to modify the access control lists (ACLs) of all websites running on the affected server .


The Windows branch of the Cloud Atlas intrusion set still uses spear-phishing emails to target high profile victims .


From the beginning of 2019 until July , we have been able to identify different spear-phishing campaigns related to this threat actor mostly focused on Russia , Central Asia and regions of Ukraine with ongoing military conflicts .


We described one of the techniques used by Cloud Atlas in 2017 and our colleagues at Palo Alto Networks also wrote about it in November 2018 .


The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server .


Previously , Cloud Atlas dropped its validator” implant named PowerShower” directly , after exploiting the Microsoft Equation vulnerability CVE-2017-11882 mixed with CVE-2018-0802 .


This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage .


Cloud Atlas remains very prolific in Eastern Europe and Central Asia .


During its recent campaigns , Cloud Atlas used a new polymorphic” infection chain relying no more on PowerShower directly after infection , but executing a polymorphic HTA hosted on a remote server , which is used to drop three different files on the local system .


The Gamaredon Group has been actively launching spear-phishing attacks against Ukrainian government and military departments from the mid-2013s .


In addition , the anonymous cybersecurity experts referenced in the article connected the malicious Gamaredon Group actors with Russian state-sponsored hackers .


In one article published in the Kharkiv Observer – an independent Ukranian online publication – an unnamed source stated that even the Ukrainian Presidential Administration has been attacked by malware developed by the Gamaredon Group .


Gamaredon Group primarily target Ukrainian organizations and resources using spear-phishing attacks , and they use military or similar documents as bait .


Once they have found a victim , they then deploy remote manipulation system binaries (RMS) via self-extracting archives and batch command files .


The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content .


During a recent incident response investigation , our team identified new attacks by the financially motivated attack group ITG08 , also known as FIN6 .


More recently , ITG08 has been observed targeting e-commerce environments by injecting malicious code into online checkout pages of compromised websites — a technique known as online skimming — thereby stealing payment card data transmitted to the vendor by unsuspecting customers .


This tool , a TTP observed in ITG08 attacks since 2018 , is sold on the dark web by an underground malware-as-a-service (MaaS) provider .


ITG08 is an organized cybercrime gang that has been active since 2015 , mostly targeting pointof-sale (POS) machines in brick-and-mortar retailers and companies in the hospitality sector in the U.S. and Europe .


Past campaigns by ITG08 using the More_eggs backdoor were last reported in February 2019 .


Attackers use it to create , expand and cement their foothold in compromised environments .


Lastly , ITG08 used Comodo code-signing certificates several times during the course of the campaign .


Let’s take a closer look at ITG08’s TTPs that are relevant to the campaign we investigated , starting with its spear phishing and intrusion tactics and covering information on its use of the More_eggs backdoor .


Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe .


X-Force IRIS determined that the More_eggs backdoor later downloaded additional files , including a signed binary shellcode loader and a signed Dynamic Link Library (DLL) , as described below , to create a reverse shell and connect to a remote host .


Once the ITG08 established a foothold on the network , they employed WMI and PowerShell techniques to perform network reconnaissance and move laterally within the environment .


The attackers used this technique to remotely install a Metasploit reverse TCP stager on select systems , subsequently spawning a Meterpreter session and Mimikatz .


In addition to the More_eggs malware , ITG08 leveraged in-memory attacks by injecting malicious code , in this case Mimikatz , into legitimate system processes .


A recently rising attack tool in ITG08 campaigns has been the More_eggs JScript backdoor .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory .


After a successful phishing attack in which users have opened emails and browsed to malicious links , ITG08 attackers install the More_eggs JScript backdoor on user devices alongside several other malware components .


Beyond using More_eggs as a backdoor , ITG08 in this campaign also used offensive security tools and PowerShell scripts to carry out the different stages of the attack .


After injecting Meterpreter into memory , the attacker had complete control of the infected device .


IBM X-Force IRIS has gained insight into ITG08’s intrusion methods , ability to navigate laterally , use of custom and open-source tools , and typical persistence mechanisms .


After the phishing email resulted in a successful infiltration , ITG08 used the More_eggs backdoor to gain a foothold and infect additional devices .


In addition , configuring PowerShell script logging and identifying any obfuscation will assist in mitigating ITG08’s use of PowerShell to conduct malicious activity .


The LYCEUM threat group targets organizations in sectors of strategic national importance , including oil and gas and possibly telecommunications .


CTU research indicates that LYCEUM may have been active as early as April 2018 .


In May 2019 , the threat group launched a campaign against oil and gas organizations in the Middle East .


This campaign followed a sharp uptick in development and testing of their toolkit against a public multivendor malware scanning service in February 2019 .


Stylistically , the observed tradecraft resembles activity from groups such as COBALT GYPSY (which is related to OilRig , Crambus , and APT34 and COBALT TRINITY also known as Elfin and APT33 .


When CTU researchers first published information about LYCEUM to Secureworks Threat Intelligence clients , no public documentation on the group existed .


Using compromised accounts , LYCEUM send spearphishing emails with malicious Excel attachments to deliver the DanBot malware , which subsequently deploys post-intrusion tools .


The developer consistently used Accept-Enconding” (note the extra ‘n’) in all DanBot samples analyzed by CTU researchers .


Get-LAPSP.ps1 is a PowerShell script that gathers account information from Active Directory via LDAP .


LYCEUM deployed this tool via DanBot shortly after gaining initial access to a compromised environment .


LYCEUM delivers weaponized maldocs via spearphishing from the compromised accounts to the targeted executives , human resources (HR) staff , and IT personnel .


This focus on training aligns with LYCEUM’s targeting of executives , HR staff , and IT personnel .


Despite the initial perception that the maldoc sample was intended for ICS or OT staff , LYCEUM has not demonstrated an interest in those environments .


However , CTU researchers cannot dismiss the possibility that the LYCEUM could seek access to OT environments after establishing robust access to the IT environment .


LYCEUM is an emerging threat to energy organizations in the Middle East , but organizations should not assume that future targeting will be limited to this sector .


Aside from deploying novel malware , LYCEUM’s activity demonstrates capabilities CTU researchers have observed from other threat groups and reinforces the value of a few key controls .


Password spraying , DNS tunneling , social engineering , and abuse of security testing frameworks are common tactics , particularly from threat groups operating in the Middle East .


The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations .


Machete is still very active at the time of this publication , regularly introducing changes to its malware , infrastructure and spearphishing campaigns .


ESET has been tracking a new version of Machete (the group’s Python-based toolset) that was first seen in April 2018 .


This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted with the Machete malware .


Their long run of attacks , focused on Latin American countries , has allowed them to collect intelligence and refine their tactics over the years .


Machete is interested in files that describe navigation routes and positioning using military grids .


The Machete group sends very specific emails directly to its victims , and these change from target to target .


The Machete group is very active and has introduced several changes to its malware since a new version was released in April 2018 .


Previous versions were described by Kaspersky in 2014 and Cylance in 2017 .


Since August 2018 , the Machete components have been delivered with an extra layer of obfuscation .


The GoogleUpdate.exe component is responsible for communicating with the remote C&C server .


ESET has been tracking this threat for months and has observed several changes , sometimes within weeks .


This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries .


The presence of code to exfiltrate data to removable drives when there is physical access to a compromised computer may indicate that Machete operators could have a presence in one of the targeted countries , although we cannot be certain .


This group is very active and continues to develop new features for its malware , and implement infrastructure changes in 2019 .


Machete's long run of attacks , focused in Latin American countries , has allowed them to collect intelligence and refine their tactics over the years .


ESET researchers have detected an ongoing , highly targeted campaign , with a majority of the targets being military organizations .


The group behind Machete uses effective spearphishing techniques .


First described by Kaspersky in 2014 [1] and later , by Cylance in 2017 [2] , Machete is a piece of malware found to be targeting high profile individuals and organizations in Latin American countries .


In 2018 Machete reappeared with new code and new features .


As of June 2019 , ESET has seen over 50 victims being actively spied upon by Machete , with more than half of them being computers belonging to the Venezuelan military forces .


Machete has Latin American targets and has been developed by a Spanish-speaking group , presumably from a LATAM country .


Machete was active and constantly working on very effective spearphishing campaigns .


In some cases , Machete trick new victims by sending real documents that had been stolen on the very same day .


Machete relies on spearphishing to compromise its targets .


They seem to have specialized knowledge about military operations , as they are focused on stealing specific files such as those that describe navigation routes .


Attackers take advantage of that , along with their knowledge of military jargon and etiquette , to craft very convincing phishing emails .


Operators behind Machete apparently already have information about individuals or organizations of interest to them in Latin America , how to reach them , and how best to trick them into getting compromised .


Since the end of March up until the end of May 2019 , ESET observed that there were more than 50 victimized computers actively communicating with the C&C server .


This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted by Machete .


Machete is malware that has been developed and is actively maintained by a Spanish-speaking group .


Since it was active in 2012 , it has been carrying out attacks against sensitive targets in China and is one of the most active APT attack organizations targeting mainland China in recent years .


By introducing small changes to their code and infrastructure , the group has bypassed several security products .


OceanLotus will release malicious sub-packages in the background , receive the remote control command , steal the privacy information of users such as SMS messages , contacts , call records , geographic locations , and browser records .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage .


It can be seen that after the code leakage , the CEO of the HackingTeam organization said that the leaked code is only a small part is based on the facts , which also reflects that the network arms merchants have lowered the threshold of APT attacks to a certain extent , making more uncertainties of cyber attacks .


This report includes details related to the major hacking targets of the SectorJ04 group in 2019 , how those targets were hacked , characteristics of their hacking activities this year and recent cases of the SectorJ04 group’s hacking .


In 2019 , the SectorJ04 group expanded its hacking activities to cover various industrial sectors located across Southeast Asia and East Asia , and is changing the pattern of their attacks from targeted attacks to searching for random victims .


The SectorJ04 group has maintained the scope of its existing hacking activities while expanding its hacking activities to companies in various industrial sectors located in East Asia and Southeast Asia .


There was a significant increase in SectorJ04's hacking activities in 2019 , especially those targeting South Korea .


They mainly utilize spam email to deliver their backdoor to the infected system that can perform additional commands from the attacker’s server .


We saw SectorJ04 group activity in Germany , Indonesia , the United States , Taiwan , India .


The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system .


The SectorJ04 group’s preexisting targets were financial institutions located in countries such as North America and Europe , or general companies such as retail and manufacturing , but they recently expanded their areas of activity to include the medical , pharmaceutical , media , energy and manufacturing industries .


The SectorJ04 group mainly used their own backdoor , ServHelper and FlawedAmmy RAT , for hacking .


SectorJ04 also used the Remote Manipulator System (RMS) RAT , a legitimate remote management software created in Russia .


Backdoors are installed in infected systems and SectorJ04 also distributed email stealers , botnet malware and ransomware through those backdoors .


Backdoor installed in the infected system distributed additional botnet malware , ransomware and email stealers .


SectorJ04 was recently confirmed to use additional backdoor called AdroMut and FlowerPippi , which is used to install other backdoor such as FlawedAmmy RAT on behalf of the MSI file , or to collect system information and send it to the attacker’s server .


Although the SectorJ04 group mainly targeted countries located in Europe or North America , it has recently expanded its field of activities to countries located in Southeast Asia and East Asia .


The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format .


A new type of backdoor called AdroMut and a new malware called FlowerPippi was also found coming from SectorJ04 .


But after 2019 SectorJ04 has changed its hacking strategy to attack using spam email .


The hacking activities of SectorJ04 group , which targeted South Korea in the first half of 2019 , have been continuously discovered .


Prior to 2019 , the SectorJ04 group conducted large-scale hacking activities for financial gain using exploit kits on websites to install ransomware , such as Locky and GlobeImporter , along with its banking Trojan , on its victims computers .


In June 2019 , continuous SectorJ04's activities targeting South Korea were found again and spam emails were written with various contents , including transaction statements , receipts and remittance cards .


The SectorJ04 group has carried out large-scale hacking activities targeting South Korea , while also expanding the field of attacks to Southeast Asian countries such as Taiwan and the Philippines .


In June , SectorJ04 group conducted hacking using spam emails written in various languages , including English , Arabic , Korean and Italian , and the emails were written with various contents , including remittance card , invoice and tax invoice .


Spam emails and attachments written in Chinese were found in May , and the SectorJ04 group at that time targeted industrial sectors such as electronics and telecommunications , international schools and manufacturing .


In addition to their preexist backdoor , ServHelper and FlawedAmmy , they have also been confirmed to use the backdoor called AdroMut and FlowerPippi .


AdroMut downloads the malware ServHelper and FlawedAmmy RAT used by the SectorJ04 group from the attacker server and simultaneously performs the functions of a backdoor .


The SectorJ04 group , which has been utilizing the same pattern of infection and the same malware for more than six months , is believed to be attempting to change its infection methods such as downloading malware directly from malicious documents without using MSI installation files , changing their spam email format and using new types of backdoor .


Until 2019 , SectorJ04 group had carried out massive website-based hacking activities that mainly utilize ransomware and banking trojans for financial profit , and has also been carrying out information gathering activities to secure attack resources such as email accounts and system login information from users since 2019 .


The SectorJ04 group has shown a pattern of hacking activities that have changed from targeted attacks to a large-scale distribution of spam .


This allows them to expand their range of targets of hacking activities for financial profit , and in this regard , SectorJ04 group has been found to have hacked into a company’s internal network by using a spear phishing email targeting executives and employees of certain South Korean companies around February 2019 .


SectorJ04 group carried out intensive hacking on various industrial sectors , including South Korea’s media , manufacturing and universities , around February and March 2019 .


SectorJ04 used the spear phishing email to spread malicious Excel or malicious Word files , and downloaded the MSI files from the attacker’s server when the malicious documents were run .


SectorJ04 group conducted hacking activities targeting financial institutions located in India and Hong Kong around April 2019 .


SectorJ04 group carried out hacking activities targeting financial institutions located in Italy and other countries around May 2019 .


In late July , SectorJ04 group used FlawedAmmy RAT to carry out hacking attacks on companies and universities in sectors such as education , job openings , real estate and semiconductors in South Korea .


In early August , the SectorJ04 group carried out extensive hacking activities targeting the users around the world , including South Korea , India , Britain , the United States , Germany , Canada , Argentina , Bangladesh and Hong Kong .


Spam emails targeting email accounts used in the integrated mail service of public officials were also found in the hacking activity .


They are one of the most active cyber crime groups in 2019 , and they often modify and tweak their hacking methods and perform periodic hacking activities .


Now , Silence is one of the most active threat actors targeting the financial sector .


Since we released our original report , Silence: Moving into the darkside , the confirmed damage from Silence's operations has increased fivefold compared to the figures in Group-IB's initial report .


Silence started by targeting organizations in Russia , gradually shifting their focus to former Soviet countries , and then the world .


Silence also started using Ivoke , a fileless loader , and EDA agent , both written in PowerShell .


Silence 2.0: Going Global is an extension of our original report: Silence: Moving into the Darkside which remains the most significant contribution to the research on the group and is the first such report to reveal Silence’s activity .


Since the report’s release in September 2018 , Group-IB’s Threat Intelligence team has detected 16 campaigns targeting banks launched by Silence .


Like the majority of APT groups , Silence uses phishing as their infection vector .


In the last successful attack described in Silence: Moving into the darkside , dated April 2018 , the hackers siphoned off about $150 , 000 through ATMs in a single night .


Prior to April 2018 , as described in Group-IB’s Silence: Moving into the darkside report , Silence’s target interests were primarily limited to former Soviet and Eastern European countries including Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan .


In 2018 , Silence conducted test campaigns to update their database of current targets and expand their attack geography .


The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


Silence has conducted at least three campaigns using recon emails , followed by malicious mail sent to an updated recipient list .


Group-IB has also detected recon emails sent out to New Zealand .


Since our last public report , Silence has sent out more than 170 , 000 recon emails to banks in Russia , the former Soviet Union , Asia and Europe .


In November 2018 , Silence tried their hand at targeting the Asian market for the first time in their history .


In total , Silence sent out about 80 , 000 emails , with more than half of them targeting Taiwan , Malaysia , and South Korea .


From 16 October 2018 to 1 January 2019 , Silence sent out about 84 , 000 emails in Russia alone to update their address database .


As part of their phishing campaigns , silence still uses Microsoft Office documents with macros or exploits , CHM files , and .LNK shortcuts as malicious attachments .


In the former Soviet Union , Silence targeted banks in Kyrgyzstan , Kazakhstan , and Ukraine .


In 2019 , Group-IB also observed the use of a new fileless PowerShell loader called Ivoke .


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer .


As the CnC server , Silence use CnC-3 server running Windows , from which they send commands to download additional modules .


To control ATMs , the group uses the Atmosphere Trojan , which is unique to Silence , or a program called xfs-disp.exe .


In addition , Silence downloads the reverse proxy programs Silence.ProxyBot and Silence. ProxyBot.NET , which are described in detail in the report Silence: moving into the darkside .


Analysis of the emails has shown that the attachment contains an exploit for the CVE-2017-11882 vulnerability .


Group-IB specialists tracked a massive mailout of emails containing a malicious Microsoft Word attachment titled Договор.doc” [Contract.doc] .


Silence sent out emails to Russian banks .


The exploit installs Silence’s loader , designed to download backdoors and other malicious programs .


Silence conducted a massive phishing campaign posing as the Central Bank of the Russian Federation .


Group-IB specialists have established that the aim of the attack was to deliver and launch the second stage of Silence’s Trojan , known as Silence.MainModule .


Silence attacked financial organisations in the UK .


Silence conducted the first stage of their Asian campaign , organising a massive phishing attack aimed at receiving an up-to-date list of current recipients in different countries for further targeted attacks delivering their malicious software .


The attackers used the server deployed on 6 June 2019 to control compromised workstations in these banks .


On 24 March 2019 , Silence.ProxyBot (MD5 2fe01a04d6beef14555b2cf9a717615c) was uploaded to VirusTotal from an IP address in Sri Lanka .


On October 18th , 2018 , the group sent out emails to British financial companies as part of their preparatory campaign .


Group-IB experts established that the server 185.20.187.89 started functioning no later than 28 January 2019 .


According to local media reports , in 2019 Silence successfully withdrew money from the Bangladeshi bank twice within 2 months .


To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank .


As we described in Silence: Moving into the darkside report , Silence has experience with theft using compromised card processing systems .


In February 2019 , Russian media7 reported a Silence attack on IT Bank in the city of Omsk .


On 16 January 2019 , Silence sent out phishing emails with malicious attachments disguised as invitations to the International Financial Forum iFin-2019 (see section ‘Attack timeline’) .


Group-IB specialists determined that the email addresses of IT bank employees were among the recipients of these emails .


The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine .


Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server .


Since at least 2011 , these hackers have been using malware to spy on corporate networks .


Hackers are targeting high-tech companies as well as chemical and pharmaceutical companies .


The hackers will map a company’s network and look for strategically favorable locations for placing their malware .


The corporation conrms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions.” Henkel claims that a very small portion” of its worldwide IT systems had been aected — the systems in Germany .


A BASF spokeswoman tells us in an email that in July 2015 , hackers had successfully overcome the rst levels” of defense .


The tool was written by sta of Thyssenkrupp , because the industrial giant—company number eleven—had been spied on by Winnti .


Hackers are charged with spying on a manufacturer of gas turbines .


The Hong Kong government was spied on by the Winnti hackers .


Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX .


While OceanLotus’ targets are global , their operations are mostly active within the APAC region which encompasses targeting private sectors across multiple industries , foreign governments , activists , and dissidents connected to Vietnam .


NewsBeef attacks against Saudi Arabian organizations and individuals (as well as targets in the European Union) are likely to continue .


Rapid7 discovered that additional data was placed into the Dropbox accounts under control of the APT10 during the compromise and was able to attribute data that was placed into it as being owned by Visma .


Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe .


These RAT families are discussed in Novetta’s other report on the Lazarus Group’s RAT and Staging capabilities .


Magic Hound has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia .


Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations .


CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash .


CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering .


Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East (including targets inside Iran itself) , as well as across Europe and in the United States .


These malware families have a rich history of being used in many targeted attacks against government and private organizations .


The activity surfaced in Southeast Asia , a region where APT10 frequently operates .


The samples we analyzed originated from the Philippines .


APT10 frequently targets the Southeast Asia region .


Both of the loader’s variants and their various payloads that enSilo analyzed share similar Tactics , Techniques , and Procedures (TTPs) and code associated with APT10 .


Typically , APT10 tends to employ a namesquatting scheme in their domains that aims to confuse the observer by posing as a legitimate domain .


Also , the certificate embedded in the Quasar sample was issued at 22.12.2018 , which correlates with the file’s compilation date .


Over the past three months , Recorded Future’s Insikt Group has observed an increase in APT33’s also known as Elfin infrastructure building and targeting activity , and on June 21 , 2019 , Yahoo .


News reported that the U.S. Cyber Command launched cyberattacks on an Iranian spy group .


Iranian state-sponsored threat actor APT33 has been conducting cyberespionage activity since at least 2013 , predominantly targeting nations in the Middle East , but also notably targeting U.S. , South Korean , and European commercial entities across a wide variety of sectors .


Our research found that APT33 , or a closely aligned threat actor , continues to conduct and prepare for widespread cyberespionage activity , with over 1 , 200 domains used since March 28 , 2019 and with a strong emphasis on using commodity malware .


The targeting of mainly Saudi Arabian organizations across a wide variety of industries aligns with historical targeting patterns for the group , which appear undeterred following previous exposés of their activity .


Towards the end of April 2019 , we tracked down what we believe to be new activity by APT10 , a Chinese cyber espionage group .


Almost 60% of the suspected APT33 domains that were classified to malware families related to njRAT infections , a RAT not previously associated with APT33 activity .


Other commodity RAT malware families , such as AdwindRAT and RevengeRAT , were also linked to suspected APT33 domain activity .


APT33 is an Iranian state-sponsored threat actor that has engaged in cyberespionage activities since at least 2013 .


Western and Saudi organizations in industries that have been historically targeted by APT33 should be monitoring geopolitical developments and increasing the scrutiny of operational security controls focusing on detection and remediation of initial unauthorized access , specifically from phishing campaigns , webshells .


Symantec’s Elfin report denoted additional targeting of the engineering , chemical , research , finance , IT , and healthcare sectors .


We assess that the recent reporting on links between the Nasr Institute and Kavosh Security Group , as well as technical and persona analysis , overlaps among APT33 , APT35 , and MUDDYWATER , and is probably a result of the tiered structure that Iran utilizes to manage cyber operations .