The potential actor and who they target Our current analysis strongly suggests Desert Scorpion is being deployed in targeted attacks against Middle Eastern individuals of interest specifically those in Palestine and has also been highlighted by other researchers . In all of these incidents , the Lazarus utilized similar toolsets , including KillDisk that was executed on compromised machines . Depending on the type of decompression engine used, there is a good probability that only the decoy file may be scrutinized and vetted, and the malicious content unnoticed – just like how some of the most popular archiving tools failed to notice the second ZIP . STRATOFEAR is a modular backdoor that communicates with C2 servers using a protocol specified in its C2 configuration , which is decrypted from a local file .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) .


We found more macOS malware similar to that used in the original Operation AppleJeus case .


From August to October , Guccifer 2.0 posted several additional installments of what appear to be internal DCCC documents on “ his ” WordPress site .


TA505 turned to URLs in early August 2017 to distribute Locky , finally eschewing the document or zipped script attachments that have characterized the majority of their Locky campaigns since February 2016 ; most of these URLs linked to malicious documents and scripts .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58729 [ . In addition to the MitM server IP addresses published in previous reports , Talos identified 16 additional servers leveraged by the actor during the observed attacks . APT28 : SNAKEMACKEREL , Swallowtail , Group 74 , Sednit , Sofacy , Pawn Storm , Fancy Bear , STRONTIUM , Tsar Team , Threat Group-4127 , TG-4127 .


When the document is opened in Word , the instructions are not immediately visible , as Word does not display these fields contents by default .


After releasing Operation AppleJeus , the Lazarus group continued to use a similar modus operandi in order to compromise cryptocurrency businesses .


This suggests that these attacks were part of a planned operation against specific targets in India .


The executable module continues to be part of a framework supporting various internal and external components communicating over internal and external channels , maintaining slightly morphed encryption and functionality per deployment .


Below is the list of all the commands catered by the C & C server . Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor . Sandworm Team has been linked to the Ukrainian energy sector attack in late 2015 .


The app loads a URL pointing to a Bread-controlled server . In June we published on a previously unknown group we named " Bahamut " , a strange campaign of phishing and malware apparently focused on the Middle East and South Asia . Finally , it marks ZxShell main Dll for deletion with the MoveFileEx Windows API . TIEDYE supports the following protocols : tcp , tcp6 , udp , upd6 , http , https , proxy_socks4 , proxy_socks4a , pipe , ssl , ssl3 , and rdp .


] it server1fi.exodus.connexxa [ . TEMP.Veles' lateral movement activities used a publicly-available PowerShell-based tool , WMImplant . The backdoor has rather basic C2 functionality implemented through a predefined set of URLs : Who is the Winnti group ?


In the quadrant , the smaller boxes in blue-gray represent particular apps in the RuMMS family , while the bigger boxes in deep-blue represent C2 servers used by some RuMMS apps . The OilRig group continues to be a persistent adversary group in the Middle East region . The oldest one from November 2019 , named " Urgent.docx " . Mandiant has identified zero - day exploitation of this vulnerability in the wild beginning in late August 2023 as well as n - day exploitation after Citrix ’s publication .


Backdoored Conversations C2 server analysis During the analysis of the Smali injected apps and their C2 server infrastructure we hadn ’ t found any interesting clues , but things changed when we looked at the C2 server of the linked Conversations messenger . Prior to that report , we published detail analysis on malware exploiting CVE-2018-8414 vulnerability (remote code execution in SettingContent-ms) , which is believed a work of DarkHydrus . ScarCruft tools : 02681a7fe708f39beb7b3cf1bd557ee9 Bluetooth info harvester .


It is also possible that ScarCruft deployed another zero day exploit , CVE-2016-0147 , which was patched in April . The group uses website and web-server compromise as a means of attack and leverages an enormous cache of tools in its campaigns , to include exploits that take advantage of known CVE software vulnerabilities .


During this period , TG-4127 created 213 short links targeting 108 email addresses on the hillaryclinton.com domain .


It ’ s possible , as with other Android malware , that some apps may also be available on forums , file-sharing sites or even sent to victims as email attachments , and we were only able to determine the delivery mechanism for a handful of the apps we have been able to find . The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience . More recently , in May 2017 , APT33 appeared to target a Saudi organization and a South Korean business conglomerate using a malicious file that attempted to entice victims with job vacancies for a Saudi Arabian petrochemical company .


It is important to note that the data won ’ t be uploaded to C & C server automatically . This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . PROMETHIUM and NEODYMIUM both used a zero-day exploit that executed code to download a malicious payload .


Based on the evolution of Ginp it is clear that it isn ’ t based on Anubis , but rather reuses some of its code . APT10 also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API . Since the source code is publicly available , Gh0st RAT has been used by multiple actors for years .


The next day , Kaspersky also published their own research on the malware .


Move the value of a register into the VM descriptor 0x20 JNB Jump if not below/Jump if above or equal/Jump if not carry 0x21 JNP Jump if not parity/Jump if parity odd Each virtual instruction is stored in a special data structure that contains all the information needed to be properly read and executed by the VM . While this may be coincidental , the out-of-sequence version 3.0 sample was created ten days after we published the Operation Lotus Blossom paper that exposed the Elise Trojan that is closely related to Emissary . Winnti : 7f73def251fcc34cbd6f5ac61822913479124a2a Wed Nov 14 03:50:18 2018 19317120 44260a1d . Harrison signed his threatening missive with the salutation , “ We are legion , ” suggesting that whatever comeuppance he had in store for Ashley Madison would come from a variety of directions and anonymous hackers .


This should be highly alarming to any government agency or enterprise . A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005 . The ShellMainThreadInt function gets the HeapDestroy Windows API address and replaces the first 3 bytes with the RET 4 opcode . Therefore , there are cases where these vulnerabilities are accessible via the internet .


Recently , the 360 Core Security discovered an APT attack code named as APT-C-26 against cryptocurrency institutions and related individuals . In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 .


Some of the documents exploited CVE-2017-0199 to deliver the payload . In this case , the malware is signed off by a “ developer ” , which may actually be a dummy account or that of a compromised user .


DanderSpritz is the framework for controlling infected machines , different from FuZZbuNch as the latter provides a limited toolkit for the post-exploitation stage with specific functions such as DisableSecurity and EnableSecurity for DarkPulsar . This time the group chose a national data center as its target from an unnamed country in Central Asia in an attempt to gain " access to a wide range of government resources at one fell swoop " .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58717 [ . During a typical incident , the actor would modify the NS records for the targeted organization , pointing users to a malicious DNS server that provided actor-controlled responses to all DNS queries . In 2017 , a phishing campaign was used to target seven law and investment firms .


he PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) . Clever Kitten has moved to leveraging strategic web compromises .


the fake Facebook login page IODBSSUEEZ Send a file containing stolen Facebook credentials to the C & C server FdelSRRT Delete files containing stolen Facebook credentials chkstzeaw Launch Facebook LUNAPXER Launch apps according to the package name sent by the C & C server Gapxplister Get a list of all installed applications DOTRall8xxe Zip all the stolen files and store in the /DCIM/.dat/ directory Acouxacour Get a list of accounts on the victim 's device Fimxmiisx Open the camera A significantly improved variant of the Bemstour exploit tool was rolled out in September 2016 , when it was used in an attack against an educational institution in Hong Kong . This group has not been directly linked to a government source , but the group 's motivations appear to overlap with those of the Chinese government .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . The second method , described in Part D.2 , below , involves the " ShadowPad " malware , which the Barium Defendants have distributed via a third-party software provider 's compromised update .


HenBox Enters the Uyghur App Store In May 2016 , a HenBox app was downloaded from uyghurapps [ . As explained in further detail below , the JS dropper ultimately installs a JS decryptor onto an infected machine that will then finally decrypt and execute the actual KopiLuwak backdoor in memory only . Our analysis has led us to conclude that APT1 is likely government-sponsored and one of the most persistent of China 's cyber threat actors .


The second campaign identifier , from the sample compiled on the 12th , references cihaderi.net , another Turkish website that claims to provide “ news from the jihad world ” and which dedicates a section of its site to Chechnya .


The IIS w3wp.exe process loads the malicious DLL , which CTU researchers have observed in the Program Files\Microsoft\Exchange Server\ClientAccess\Owa\Bin directory .


] com ) used in malicious activity and it is reasonable to assume the remaining three are or were intended to serve the same purpose . APT41 is unique among tracked China-based actors in that it leverages non-public malware typically reserved for espionage campaigns in what appears to be activity for personal gain . Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years .


There are also infrastructure ties between some FakeM variants and older activity using Trojans such as Elirks , Poison Ivy , and BiFrost , which were used in attacks as old as 2009 . Additionally , the targeting of a French diplomat based in Taipei , Taiwan aligns with previous targeting by these actors , as does the separate infrastructure .


The Trojan ’ s list of possible commands has remained practically unchanged throughout its life , and will be described below in detail . In one of the samples received for analysis , the US-CERT Code Analysis Team observed botnet controller functionality . We determined that these backdoors were installed on the targets ' machines on September 19 2018 , based mainly on the service creation time of the loader component .


It ’ s worth noting , newer versions of the DroidVPN app are available on Google Play , as well as in some other third-party app stores , which could indicate uyghurapps [ . The Winnti hackers broke into Henkel’s network in 2014 . On November 26 , 2015 , a suspected China-based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


Upon gaining access to the machines connected to corporate and guest Wi-Fi networks , APT28 deployed Responder .


All information about your social networks , Bank accounts , Credit Cards . Silence try to apply new techniques and ways of stealing from various banking systems , including AWS CBR , ATMs , and card processing . AveMaria is a new botnet , whose first version we found in September 2018 , right after the arrests of the FIN7 members . Scripts should be captured from the file system when possible to determine their actions and intent .


Kaspersky Labs , who sometimes refer to CosmicDuke as ‘ Bot Gen Studio ’ , speculated that “ one possibility is that ‘ Bot Gen Studio ’ is a malware platform also available as a so-called ‘ legal spyware ’ tool ” ;


The C2 URL is : hxxp : //64.78.161.133/ * victims ’ s_cell_phone_number * /process.php In addition to this , the malware also reports to another script , “ hxxp : //64.78.161.33/android.php ” . TG-3390 actors have used Java exploits in their SWCs . Although most malware today either seeks monetary gain or conducts espionage for economic advantage , both of these activity groups appear to seek information about specific individuals .


In late 2015 , Symantec identified suspicious activity involving a hacking tool used in a malicious manner against one of our customers .


In both these campaigns the activity group included remote triggers to deactivate exploitation , with an attempt to conceal the vulnerability , and prevent analysis of the attack . This file requires the target to attempt to open the .lnk file , which redirects the user to a Windows Scripting Component ( .wsc ) file , hosted on an adversary-controlled microblogging page .


It is worth noting that during our investigation f-secure uncovered links between infrastructure associated with the Callisto Group and infrastructure used to host online stores selling controlled substances . TA505 is also using FlowerPippi ( Backdoor.Win32.FLOWERPIPPI.A ) , a new backdoor that we found them using in their campaigns against targets in Japan , India , and Argentina . TA505 targeted Middle Eastern countries in a June 11 campaign that delivered more than 90% of the total spam emails to the UAE , Saudi Arabia , and Morroco . It fetches the same FlawedAmmyy downloader .msi file , then downloads the FlawedAmmyy payload . TA505 used Wizard (.wiz) files in this campaign , with FlawedAmmyy RAT as the final payload . On June 14 , we saw TA505’s campaign still targeting UAE with similar tactics and techniques , but this time , some of the spam emails were delivered via the Amadey botnet . It later delivered an information stealer named EmailStealer , ” which stolesimple mail transfer protocol SMTP ) credentials and email addresses in the victim’s machine . On June 18 , the majority of the campaign’s spam emails were sent with the subject , Your RAKBANK Tax Invoice / Tax Credit Note” or Confirmation . This campaign used the abovementioned .HTML file , malicious Excel/Word document VBA macro , the FlawedAmmyy payload , and Amadey . On June 24 , we found another campaign targeting Lebanon with the ServHelper malware . On June 17 , we observed the campaign’s spam emails delivering malware-embedded Excel files directly as an attachment . On June 20 , we spotted the campaign’s spam emails delivering .doc and .xls files . Nonetheless , these spam emails were not delivered to the UAE or Arabic-speaking users , but to banks in Asian countries such as India , Indonesia , and the Philippines . After our analysis , we found that Proofpoint reported this malware as AndroMut as well . In the campaign that targeted Japan , Philippines , and Argentina on June 20 , we found what seems to be a new , undisclosed malware , which we named Gelup . Another new malware we found that TA505 is using in their campaigns last June 20 against targets in Japan , the Philippines , and Argentina is FlowerPippi . The malicious email contains a highly suspicious sample which triggered the ZLAB team to investigate its capabilities and its possible attribution , discovering a potential expansion of the TA505 operation . The attack , as stated by CyberInt , leveraged a command and control server located in Germany related to the TA505 actor: a very active group involved in cyber-criminal operation all around the world , threatening a wide range of high profile companies , active since 2014 . The comparison of the infection chains reveals in both cases TA505 used a couple of SFX stages to deploy the RMS” software: a legitimate remote administration tool produced by the Russian company TektonIT . The TA505 group is one of the most active threat groups operating since 2014 , it has traditionally targeted Banking and Retail industries , as we recently documented during the analysis of the Stealthy email Stealer” part of their arsenal . Also , some code pieces are directly re-used in the analyzed campaigns , such as the i.cmd” and exit.exe” files , and , at the same time , some new components have been introduced , for instance the rtegre.exe” and the veter1605_MAPS_10cr0.exe” file . In 2018 , Kaspersky Labs published a report that analyzed a Turla PowerShell loader that was based on the open-source project Posh-SecMod . Turla is believed to have been operating since at least 2008 , when it successfully breached the US military . This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products . However , it is likely the same scripts are used more globally against many traditional Turla targets in Western Europe and the Middle East . In some samples deployed since March 2019 , Turla developers modified their PowerShell scripts in order to bypass the Antimalware Scan Interface ( AMSI ) .


Malware Capabilities The Cybereason Nocturnus team has been following EventBot since the beginning of March 2020 . For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2 This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP port 443 . The Elise malware used by Lotus Blossom , which was an attack campaign on targets in Southeast Asia .


Specific to this technique , if the C2 server is not available at the time of execution , the malicious code cannot be retrieved , rendering the delivery document largely benign .


However , the following email domains do not use Google mail servers and may have been targeted by other means :


Translate the client response object into the server version of the client response object .


Money then disappears from the victim ’ s account and is cashed in without the owner ’ s knowledge . In the past , we have seen the group using open-source password dumpers such as Mimikatz . It exports the following functions , which are examined in greater detail below : DllMain Install UnInstall ServiceMain ShellMain ShellMainThread zxFunction001 zxFunction002 . An attacker with access to a valid cookie can establish an authenticated session to the NetScaler appliance without knowledge of the username , password , or access to a multi - factor authentication token or device .


Disturbingly , the malware establishes a rootkit on the device , allowing it to download and execute any code a cybercriminal would want to run on a device . PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . We have observed that in cases where APT10 has infiltrated a target via an MSP , it continues to use the MSPs credentials .


A journey to Zebrocy land .


Infection The user receives an SMS with a malicious link pointing to a fake website simulating a popular free ad service . FireEye assesses that APT32 leverages a unique suite of fully-featured malware . The purpose is to be executed only once and steal data on the infected system , here are the main features : Keyloggers , Clipboard stealer , Firefox profiles and cookies stealer , Chrome profiles and cookies stealer , Opera profiles and cookies stealer .


Detecting threat actors in recent German industrial attacks with Windows Defender ATP .


The sub-function to decrypt the content skips the first 4 bytes , suggesting that the first four bytes of the downloaded content is in cleartext ( most likely the “ FWS ” or “ CWS ” header to look legitimate ) .


CloudDuke is a malware toolset known to consist of , at least , a downloader , a loader and two backdoor variants .


While documents designed to exploit the InPage software are rare , they are not new – however in recent weeks Unit42 has observed numerous InPage exploits leveraging similar shellcode , suggesting continued use of the exploit previously discussed by Kaspersky . ALLANITE operations limit themselves to information gathering and have not demonstrated any disruptive or damaging capabilities .


Additionally , CTU researchers have observed evidence of BRONZE PRESIDENT targeting political and law enforcement organizations in countries adjacent to the PRC , including Mongolia and India .


The overlap between the HenBox and 9002 malware families Unit 42 has seen involves three shared C2s between several samples ; the first IP below is used for more than half of the HenBox samples we have seen to date : 47.90.81 [ . APT41 uses multiple methods to perform lateral movement in an environment , including RDP sessions , using stolen credentials , adding accounts to User and Admin groups , and password brute-forcing utilities . Secondly , the value the Dukes intended to gain from these MiniDuke campaigns may have been so great that they deemed it worth the risk of getting noticed .


After getting a command from the C & C , the app is able to download a malicious payload in the form of a .dex file that is being dynamically loaded adding the additional malicious capabilities . While Volexity does not typically engage in attempting attribution of any threat actor , Volexity does agree with previously reported assessments that OceanLotus is likely operating out of Vietnam . GandCrab Variant d6c53d9341dda1252ada3861898840be4d669abae2b983ab9bf5259b84de7525 ce1ee671fe5246a9c40b624ef97e4de1 GandCrab Variant aca0b96126c813b0d29d6fbff9175f8ca62ff2ec6eed83bff76a73ae717cfcb8 07f955796a252771861c8e0db06b1f01 GandCrab Variant 8cd45f8c8f2ed0109db6a64f9945f3dcb8a780f65c76aedded7b8af95e6dc7ec 4fcd0d13ea669a83a749ae5bfb098ca2 GandCrab Variant 933210a9d19b25e0711ae88eece1ba06bb035a01ab2880cc707ff55bdd3b8dd0 8ec87fd3ea777fa8d5160dc957e6683e GandCrab Variant e564e87958b3e76bc9bfeb5bed773b7a17f3a82f84872acdbb609aa43a9cd776 c7d5077960882259b85c01fd41c49ffd . Then it calls with invalid value 69 .


Naming additional payload applications as system updates is a clever technique used by malware authors to trick victims into believing a threat isn ’ t present on their device . As detailed in the previous section , this malware is able to manipulate and exfiltrate emails . Before the service is started ChangeServiceConfig is called to modify the service type to shared and interactive . Open Babel allows users to “ search , convert , analyze , or store data from molecular modeling , chemistry , solid - state materials , biochemistry , or related areas , ” according to its website , and is used in other popular pieces of software in the science field .


As such , this decision does not necessarily refer to a specific institution , but rather a collection of observations and behaviors observed across multiple , similarly-situated victims .


But it would appear that BLU only took action after Kryptowire notified it along with Google , Adups and Amazon . Most recently though , a new campaign , targeting Belarus , Turkey and Ukraine , has emerged that caught the attention of Check Point researchers . The group is responsible for the campaign known as Operation Wilted Tulip .


If users or administrators detect the custom tools indicative of HIDDEN COBRA , these tools should be immediately flagged , reported to the DHS National Cybersecurity Communications and Integration Center ( NCCIC ) or the FBI Cyber Watch ( CyWatch ) , and given highest priority for enhanced mitigation .


Likewise , many of CosmicDuke ’s persistence components use techniques also used by components associated with GeminiDuke and CozyDuke .


Two of the four domains that have been hosted at this IP since 2016 — upfile2box.com and 7aga.net — were registered by a freelance web developer in Gaza , Palestine .


The overlays are activated by the malicious operator using the command changeActivity , as seen on step 5 of the activation cycle . MuddyWater has recently been targeting victims likely from Lebanon and Oman , while leveraging compromised domains , one of which is owned by an Israeli web developer . This particular sample is a loader that loads an encrypted payload for its functionality . The government even offered a reward of up to $ 10 million for information on Cl0p after several federal agencies in the US fell victim to the gang .


Over the last twelve months , Microsoft has delivered nearly 1400 nation-state notifications to those who have been targeted or compromised by STRONTIUM .


Port 6206 : Skype extraction service . We don't know the exact date Suckfly stole the certificates from the South Korean organizations . The contents of the decoy documents seems to include : This was followed by an executable downloader and payload concealed in an image file , likely to make its detection more difficult .


In earlier versions , it operated with shell commands like this : Stealing WhatsApp encryption key with Busybox Social payload Actually , this is not a standalone payload file – in all the observed versions its code was compiled with exploit payload in one file ( ‘ poc_perm ’ , ‘ arrs_put_user ’ , ‘ arrs_put_user.o ’ ) . Attackers were initially discovered while investigating a phishing attack that targeted political figures in the MENA region . Turla is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware .


Learn more about our mobile threat defense capabilities in Microsoft Defender for Endpoint on Android . A trait common to all three malware families we analyzed is that they use the IWebBrowser2 COM interface to perform their CnC communication . so TAU is looking for newer versions ANEL samples . Whoever hacked Ashley Madison had access to all employee emails , but they only released Biderman ’s messages — three years worth .


The threat actor was able to leverage the web shell to run reconnaissance commands , steal credentials , and deploy other tools . BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years .


TG-3390 : 72.11.148.220 .


Spaghetti and junk codes make common analyst tools ineffective In analyzing FinFisher , the first obfuscation problem that requires a solution is the removal of junk instructions and “ spaghetti code ” , which is a technique that aims to confuse disassembly programs . iDefense analysts have identified a campaign likely to be targeting members of— or those with affiliation or interest in—the ASEAN Defence Ministers ' Meeting ( ADMM ) . As far as we can tell , its dropper was downloaded over HTTPS from api.goallbandungtravel.com . The downloader uses managed AES ( Rijndael algorithm ) to decrypt the appended data which is then reflectively loaded as a byte array using the Assembly .


eSurv ’ s public marketing is centered around video surveillance software and image recognition systems , but there are a number of individuals claiming to be mobile security researchers working at the company , including one who has publically made claims to be developing a mobile surveillance agent . Just a few months later , in February 2015 , we announced the discovery of Carbanak , a cyber-criminal gang that used custom malware and APT techniques to steal millions of dollars while infecting hundreds of financial institutions in at least 30 countries . Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload .


This report details our observations of APT28 ’s targeting , and our investigation into a related breach .


We believe the primary purpose of this tactic is an attempt at evading detection in the targeted network .


TrickMo uses accessibility services to identify and control some of these screens and make its own choices before giving the user a chance to react . Similarly , the group takes advantage of freely available consolidations of email credentials , personal information , and other data shared in eCrime forums for fraud purposes . In July 2017 , we observed an attack on a Middle Eastern technology organization that was also targeted by the OilRig campaign in August 2016 .


This campaign primarily affected the government sector in the Middle East , U.S. , and Japan . Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015 .


The actor typically targets Central Asian countries , Russia , Belarus , Mongolia , and others .


In some deployments , we observed Sofacy actively developing and deploying a new package to a much smaller , specific subset of targets within the broader set .


Some of BRONZE PRESIDENT 's malware has persistence capabilities .


XLoader 6.0 also mirrors the way FakeSpy hides its real C & C server . FANCY BEAR ( also known as Sofacy or APT 28 ) is a separate Russian-based threat actor , which has been active since mid 2000s , and has been responsible for targeted intrusion campaigns against the Aerospace , Defense , Energy , Government and Media sectors . This response tells the malware to: Set the file name for the data that will follow to 10140, Set the part number to 0, Parse response data, Set a 1 action for the next . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


Lookout researchers have discovered a new mobile surveillanceware family , FrozenCell . According to Kessem the malware has redirection instructions for 17 banks , and features an additional 230 URLs to assist attackers in targeting community banks and email service providers in Poland . It expects the webpage to contain special HTML tags ; the backdoor will attempt to interpret the data between the tags as commands . Kaspersky said there was another case of end users being infected by the malware , which is known as " Winnti . "


This entry was posted on Mon Dec 04 12:00 EST 2017 and filed under Code , Reverse Engineering , Nick Harbour , and Incident Response . We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded .


The beaconing only starts after the application is installed and removed from the running tasks . DustySky ( called " NeD Worm " by its developer ) is a multi-stage malware in use since May 2015 . Between early December 2018 and the end of January 2019 , Rancor conducted at least two rounds of attacks intending to install Derusbi or KHRat malware S-MALon S-MALvictim systems . Ashley Madison ’s long - suspected army of fake female accounts came to the fore in August 2012 after the former sex worker turned activist and blogger Maggie McNeill published screenshots apparently taken from Ashley Madison ’s internal systems suggesting that a large percentage of the female accounts on the service were computer - operated bots .


This post does n't follow the chronological evolution of Zen , but instead covers relevant samples from least to most complex . Our analysis shows that actors attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . Moreover , the exploit dropped a different malware payload , a backdoor we refer to as ELMER . To increase investigation transparency , we are including a Last Known True , or LKT , value for network indicators .


Once the user attempts to open the document , Microsoft Word immediately attempts to load the remote template containing a malicious macro and payload from the location specified within the settings.xml.rels file of the DOCX document .


] 975685 [ . Russian citizens—journalists , software developers , politicians , researchers at universities , and artists are also targeted by Pawn Storm . Richard_Johnson.doc : 878e4e8677e68aba918d930f2cc67fbe 0a3f915dd071e862046949885043b3ba61100b946cbc0d84ef7c44d77a50f080 . Based on the files ’ thumbnail images – the only content visible in the Windows Explorer window – the PowerPoint files imitate Ukraine ’s Ministry of Defence and Poland ’s Ministry of National Defence .


The current dumpers have some similarities with those previously used by the group .


Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant . Upon opening of the MS Word document , our embedded file exploits CVE-2017-11882 to drop a malicious fake Norton Security Shell Extension module , 'NavShExt.dll' , which is then injected into iexplore.exe to install the backdoor , begin collection , and activate command and control .


All the malicious Dvmap apps had the same functionality . Technical analysis of COVELLITE malware indicates an evolution from known LAZARUS toolkits . Because the personnel in charge of confirming reservations usually need to pull credit card data from OTA websites , it ’s possible to collect card numbers by monitoring the clipboard and the documents sent to the printer . Adversaries may manipulate control systems devices or possibly leverage their own , to communicate with and command physical control processes .


GeminiDuke also occasionally embeds additional executables that attempt to achieve persistence on the victim computer .


BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms .


Sofacy continued to use DealersChoice throughout the fall of 2016 , which we also documented in our December 2016 publication discussing Sofacy ’s larger campaign .


In a press briefing just two weeks ago , Deputy Attorney General Rod Rosenstein announced that the grand jury assembled by Special Counsel Robert Mueller had returned an indictment against 12 officers of Russia 's Main Intelligence Directorate of the Russian General Staff ( better known as Glavnoye razvedyvatel'noye upravleniye , or GRU ) .


Importantly , the backdoor simply will not reveal its malicious nature unless Arabic language keyboard and settings are found on the infected machine .


In addition , Kaspersky analyzed the victims of this campaign and spotted an interesting overlap of this campaign with another APT actor known as DarkHotel . Both in the attacks against ITUC and in other occasions , Operation Kingphish approached selected targets over social media , prominently Facebook , and engaged in chat conversations with them on and off , sometimes over a period of several months . This time the document purported to be about the involvement of the Emir of Qatar in funding ISIS , which was seemingly copied from a website critical of Qatar . While there is a clear underlying Qatar migrant workers theme in Operation Sheep , it is also hypothetically possible that these attacks could have been perpetrated by a malicious actor affiliated to a different government with an interest in damaging the reputation of the State of Qatar . Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year . The SDK , named SWAnalytics is integrated into seemingly innocent Android applications published on major 3rd party Chinese app stores such as Tencent MyApp , Wandoujia , Huawei App Store , and Xiaomi App Store . After app installation , whenever SWAnalytics senses victims opening up infected applications or rebooting their phones , it silently uploads their entire contacts list to Hangzhou Shun Wang Technologies controlled servers . In theory , Shun Wang Technologies could have collected a third of China’s population names and contact numbers if not more . With no clear declaration of usage from Shun Wang , nor proper regulatory supervision , such data could circulate into underground markets for further exploit , ranging from rogue marketing , targeted telephone scams or even friend referral program abuse during November’s Single’s Day and December’s Asian online shopping fest . This paper will cover the discovery of this campaign , dubbed ‘Operation Sheep’ , and an analysis of SWAnalytics . In mid-September , an app named ‘Network Speed Master’ stood out on our radar with its rather unusual behavior patterns . This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge . It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in . With default settings , SWAnalytics will scan through an Android device’s external storage , looking for directory tencent/MobileQQ/WebViewCheck” . From our first malicious sample encounter back in mid-September until now , we have observed 12 infected applications , the majority of which are in the system utility category . By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device . Operation Sheep is the first campaign we have observed in the wild that abuses similar concept since our MitD publication . To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control . Whenever users reboot their device or open up Network Speed Master , SWAnalytics will fetch the latest configuration file from http[:]//mbl[.]shunwang[.]com/cfg/config[.]json” . In order to understand SWAnalytics’ impact , we turned to public download volume data available on Chandashi , one of the app store optimization vendors specialized in Chinese mobile application markets . Data points span from September 2018 to January 2019 where we observed over 17 million downloads in just five months . In China alone , we have seen underground market sheep shavers” ported SMS rogue marketing strategy to spread Alipay Red Packet referral URL links . In Operation Sheep’s case , Shun Wang likely harvests end user contact lists without application developer acknowledgement . According to Cheetah Mobile’s follow-up investigation , fraudulent behaviors came from two 3rd party SDKs Batmobi , Duapps integrated inside Cheetah SDK . It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns . Webinjects targeting Japan , a country we haven’t seen targeted by Panda Banker before . Japan is no stranger to banking malware . Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware . This post was our first analysis of the first Panda Banker campaign that we’ve seen to target financial institutions in Japan . Operation Pawn Storm is an active economic and political cyber-espionage operation that targets a wide range of entities , like the military , governments , defense industries , and the media . we believe the iOS malware gets installed on already compromised systems , and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems . we found two malicious iOS applications in Operation Pawn Storm . One is called XAgent detected as IOS_XAGENT.A and the other one uses the name of a legitimate iOS game , MadCap detected as IOS_ XAGENT.B . The obvious goal of the SEDNIT-related spyware is to steal personal data , record audio , make screenshots , and send them to a remote command-and-control (C&C) server .


This example is from a later version of EventBot , and in other versions the naming convention is very similar , with bot IDs such as word100 , word101 , word102 , and test2005 , test2006 etc . Webinjects targeting Japan , a country we haven’t seen targeted by Panda Banker before . This cyber-espionage group was dubbed ' Rocket Kitten ' , and remains active as of this writing , with reported attacks as recent as October 2015 .


We assess with high confidence that this modified version is operated by the infamous Wolf Research . The attacker is from North Korea . This research paper will delve into another prominent group of attackers referred to as “ IXESHE ” ( pronounced “ i-sushi ” ) , based on one of the more common detection names security companies use for the malware they utilize . Having such a gap with the most commonly used domain allowed with CSP is a major risk indicator of the threats that can come from other domains that are used to serve multiple accounts .


This time resets every time the user performs some activity . During the operations , the group used tools consistent with those leveraged during past intrusions including Powermud , a custom tool used by the Seedworm group , and customized PowerShell , LaZagne , and Crackmapexec scripts . DDKONG Plugin : File Name : H istory.nls . Mandiant identified the historical execution of malicious binaries across multiple systems using cdhash values stored in the XPdb .


Take voice call playback process for example . Additionally the reports on Carbanak show a different picture , where banks targeted outside of Russia , specifically Europe , USA and Japan are mentioned , which does not match our research . However the unflattening of ANEL code had to be performed in the later maturity level since the assignment of block comparison variable heavily depends on opaque predicates . The first script is the RAW data the retrieved from the JS file and the second one is the decoded one .


] com , points to the IP address 54.69.156.31 which serves a self-signed TLS certificate with the certificate common name MyCert and fingerprint 11:41:45:2F : A7:07:23:54 : AE:9A : CE : F4 : FE:56 : AE : AC : B1 : C2:15:9F:6A : FC:1E : CC:7D : F8:61 : E3:25:26:73:6A . The Taidoor attackers have been actively engaging in targeted attacks since at least March 4 , 2009 . Decodes the Base64 payload and writes the file to C:\ProgramData\IntegratedOffice.exe . First , the discovery of new OT malware presents an immediate threat to affected organizations , since these discoveries are rare and because the malware principally takes advantage of insecure by design features of OT environments that are unlikely to be remedied any time soon .


At the time of writing , Locky ransomware remains their malware of choice , even as the group continues to experiment with a variety of additional malware .


In case of failure , it will sleep for three seconds and try again .


In April , 2018 , the 360 Core Security takes the lead in capturing the APT-C-06 group’s new APT attack using 0-day vulnerabilities (CVE-2018-8174) in the wild . In early August , Unit 42 identified two attacks using similar techniques .


Those targeted include Paypal Business , Revolut , Barclays , UniCredit , CapitalOne UK , HSBC UK , Santander UK , TransferWise , Coinbase , paysafecard , and many more . Over the past three years , Filensfer has been deployed against organizations in Luxembourg , Sweden , Italy , the UK , and the U.S . Organizations in the government , energy , and technology sectors have been targeted by Magic Hound , specifically organizations based in or doing business in Saudi Arabia .


However , analysts may not always see the indicators of compromise in the server ’ s response . Given our increased confidence that Bahamut was responsible for targeting of Qatari labor rights advocates and its focus on the foreign policy institutions other Gulf states , Bahamut 's interests are seemingly too expansive to be limited one sponsor or customer . The protection is enabled to all processes except for ones in the following list : Svchost.exe , Lsass.exe , Winlogon.exe , Services.exe , Csrss.exe , ctfmon.exe , Rundll32.exe , mpnotify.exe , update.exe . The first with a valid handle to close the process created .


On the other hand , dynamic analysis tools ( like debuggers or sandbox ) face the anti-debug and anti-analysis tricks hidden in the virtualized code itself that detects sandbox environments and alters the behavior of the malware . All of the Emissary we've collected are written in Traditional Chinese , which is used primarily in Taiwan and Hong Kong . It is impossible to start analyzing every piece of software we run , especially with all the regular updates we are encouraged or required to install . TIEDYE can communicate with a C2 server using a range of supported protocols described as follows .


The attack group has made incremental changes to ZeroT since our last analysis .


The following are the three files:Defender.sct – The malicious JavaScript based scriptlet file . Since Ploutus-D interacts with the Kalignite Platform , only minor modifications to the Ploutus-D code may be required to target different ATM vendors worldwide .


About 57 % of these devices are located in Asia and about 9 % are in Europe . During this heist , APT38 waited for a holiday weekend in the respective countries to increase the likelihood of hiding the transactions from banking authorities . and so forth . Further analysis of COSMICENERGY is available as part of .


The Zebrocy Trojan gathers system specific information that it will send to the C2 server via an HTTP POST request to the above URL .


Figure 4 . Group-IB experts continuously monitor the Silence’ activities . Get system information .


In a recent spear-phishing campaign , the Cobalt Hacking Group used a remote code execution vulnerability in Microsoft Office software to connect to its command and control server via Cobalt Strike . According to the security experts , this collection of malware was discovered after their first initial report was published , meaning that Group 27 ignored the fact they were unmasked and continued to infect their targets regardless , through the same entry point , the Myanmar Union Election Commission ( UEC ) website .


As the same name suggests , the artifact appears in fact to act as a tunnel for the attacker to remotely access the internal network and maintain persistence .


However , no command is received from the C2 until the inactiveTime field ( see beaconing information image above ) has at least the value of 2000000 . Seedworm likely functions as a cyber espionage group to secure actionable intelligence that could benefit their sponsor 's interests . DDKONG Plugin : File Type : PE32 executable ( DLL ) Intel 80386, for MS Windows . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


Additionally Kaspersky identified a new backdoor that we attribute with medium confidence to Turla . The exploit , which takes advantage of CVE-2018-4878 , allows an attacker to execute arbitrary code such as an implant .


Known targets of this group have been involved in the maritime industry , as well as engineering-focused entities , and include research institutes , academic organizations , and private firms in the United States . With GozNym , attackers dupe users by showing them the actual bank 's URL and SSL certificate .


] comaccount-manager [ . Palo Alto Networks has noted and described the differences of two malware agents developed in parallel , with commonalities in behavior but differing functionalities ; families described as Infy and Infy M. Our primary observation was of the Infy ( non-M ) malware , which primarily functions as a keylogger for the collection of account credentials . The first zone we became aware of was “ hugesoft.org ” , which was registered through eNom , Inc. in October 2004 . Monitor newly executed processes that may attempt to hide artifacts associated with their behaviors to evade detection .


Previous reports alleged this surveillanceware tool was deployed using ‘ honey traps ’ where the actor behind it would reach out to targets via fake social media profiles of young women . Our investigation also led to the discovery of dozens of email addresses registered by Turla operators for this campaign and used to receive exfiltrated data from the victims . The first service name that is not installed on the system becomes the ZxShell service name . The MOVEit data breaches had widespread impacts , affecting everything from the Oregon DMV and Louisiana OMV ( Office of Motor Vehicles)—including the leak of nearly 10 million drivers ' licenses — to the University of Rochester and multiple corporations .


By using Google Cloud Messaging botnet owners can operate without a C & C server , thus eliminating the threat of the botnet being detected and blocked by law enforcement authorities . Perhaps the most worrying discovery we made was that Thrip had targeted a satellite communications operator . The log file is encrypted using the same algorithm as the one used to encrypt static strings from the module . Open Babel allows users to “ search , convert , analyze , or store data from molecular modeling , chemistry , solid - state materials , biochemistry , or related areas , ” according to its website , and is used in other popular pieces of software in the science field .


RECEIVE_BOOT_COMPLETED - allow the application to launch itself after system boot . The techniques and modules employed by EvilGnome — that is the use of SFX , persistence with task scheduler and the deployment of information stealing tools—remind us of Gamaredon Group’s Windows tools . Version 2.0 received one update in October 2013 before the malware author released version 3.0 in December 2014 .


This means that the malware can be remotely eliminated by an SMS message . Operation Daybreak appears to have been launched by APT37 to infect high profile targets through spear-phishing e-mails . The threat then executes " svchost.exe " .


There have been several recent examples of companies choosing to release their software directly to consumers , bypassing traditional storefronts . ESET has been tracking a new version of Machete (the group’s Python-based toolset) that was first seen in April 2018 . APT37 , another North Korean state-sponsored group , targeted a Middle Eastern financial company , but there was no evidence of financial fraud .


The web shell parameters in this attack match to the China Chopper parameters , as described in FireEye 's analysis of China Chopper . Our research indicates that it has started targeting Japanese users .


Back then , CosmicDuke still lacked most of the credential-stealing functionality found in later samples .


Disguised Spyware Uploaded on Google Play Store We identified previously unknown spyware apps being successfully uploaded on Google Play Store multiple times over the course of over two years . Based on that research and this observation , we postulate that the OilRig group gathered credentials to a legitimate user 's OWA account and logged into the user 's account to send phishing attacks to other individuals within the same , targeted organization . The screenshots are exfiltrated via the ImgBB website . The messages show that Harrison was hired in March 2010 to help promote Ashley Madison online , but the messages also reveal Harrison was heavily involved in helping to create and cultivate phony female accounts on the service .


Non-governmental political organizations may provide access to desirable national policy information , especially foreign policy , but may not have the same level of protection and security as governmental organizations .


Our analysis shows that actors attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . Their targets are marine companies that operate in and around the South China Sea , an LOC of much Chinese interest .


The threat actors used shortened URLs in spear phishing messages and fake news websites to direct targets to download KASPERAGENT .


However , it ’ s possible the set of commands may change in future versions of the Trojan . The decoy documents dropped suggest that the targets are likely to be politically or militarily motivated , with subjects such as Intelligence reports and political situations being used as lure documents . Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities .


Under these conditions , the app continues executing and the intent of targeting Xiaomi devices and users could be inferred , however poorly written code results in execution in more environments than perhaps intended ; further checks are made to ascertain whether the app is running on an emulator , perhaps to evade researcher analysis environments . In 2015 , APT41 targeted a Japanese media organization with a lure document (Figure 3) titled 中東呼吸器症候 群(MERS)の予防 , ” which translates to Prevention of Middle East Respiratory Syndrome (MERS) . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


PCRat S-VULNAME/Gh0st is a payload that we do not see this group using frequently .


We reverse engineered XLoader and found that it appears to target South Korea-based banks and game development companies . Either way , Sofacy's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion . After the reconstruction of the full infection chain , we noticed strong similarities with a recent spear-phishing attack campaign against an unspecified US retail company .


Anti-emulator code . Interestingly , following some open-source publications about them , the FIN7 operators seems to have developed a homemade builder of malicious Office document using ideas from ThreadKit , which they employed during the summer of 2018 . Using information from the FireEye DTI cloud , FireEye observed that Ke3chang targeted a single firm .


FIN7 is a threat actor group that is financially motivated with targets in the restaurant , services and financial sectors . The malware starts communicating with the C&C server by sending basic information about the infected machine .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Maudi Surveillance Operation which was previously reported in 2013 .


In addition , it monitors to verify if com.android.music.helper package is removed . The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites . By targeting high-tech and manufacturing operations in Japan and Taiwan , DragonOK may be acquiring trade secrets for a competitive economic advantage .


] com hxxp : //www [ . Upon gaining access to the machines connected to corporate and guest Wi-Fi networks , APT28 deployed Responder . Several metadata fields ( specifically title , subject , author , comments , manager , and company ) appear to have been populated with different data sets . The top most targeted organizations included those from technology and social media , NATO , and the transportation sector .


This is a stark contrast with other attacks commonly associated with the Sofacy group where generally no more than a handful of victims are targeted within a single organization in a focus-fire style of attack .


Trend Micro 's Mobile App Reputation Service ( MARS ) covers Android and iOS threats using leading sandbox and machine learning technologies . It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks .


The widespread proliferation and use of the following tools suggest that the group likely has the knowledge and capability to use them as part of its operations :


These more recent developments indicate that XLoader is still evolving . TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology . It is worth noting that the IP response observed to set ping mode was the reverse of the IP used to set text mode (i.e., 199.250.250.99 ) . The new documentary , The Ashley Madison Affair , begins airing today on Hulu in the United States and on Disney+ in the United Kingdom .


TG-3390 : american.blackcmd.com .


Due to TrickMo ’ s persistence implementation mentioned earlier , this lockdown screen persists after a restart and is re-initiated every time the device becomes interactive . The ultimate goal of this threat is to mine Monero cryptocurrency in compromised Linux machines . Russia .


] ponethus [ . he Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information . Aumlib , which for years has been used in targeted attacks , now encodes certain HTTP communications . Compromised websites ( WordPress appears to be the top target ) are injected with a code snippet that replaces the current webpage with the aforementioned fake updates templates .


To get around this , the app then uses its root privilege to inject code into the Setup Wizard , extract the CAPTCHA image , and sends it to a remote server to try to solve the CAPTCHA . First , when a specific recipient was targeted , the mails often purported to be meeting invitations from established business partners . APT17 was embedding the encoded C2 IP address for the BLACKCOFFEE malware in legitimate Microsoft TechNet profiles pages and forum threads , a method some in the information security community call a “ dead drop resolver. ” Encoding the IP address makes it more difficult to identify the true C2 address for network security professionals . We called this new malware ?


The group is known for their advanced attacks that leverage custom-built Windows malware ( Kasperagent , Micropsia ) as well as Android malware ( Vamp , GnatSpy ) .


Customers have to send a set text message from their phone to a specific bank number . Skipper , which has been linked to Turla in the past , was found alongside Gazer in most cases we investigated . Winnti : C&C : b[org_name].dnslookup.services : 443 . Organizations can collect this intelligence , review the threats described , consider if and how the threat is relevant to them , and the necessity of making any potential additional mitigations .


The MQTT connection to broker The MQTT connection to broker The MQTT communication is used primarily to update the device state and get commands from the C & C . APT33 has shown particular interest in organizations in the aviation sector , as well as organizations in the energy sector with ties to petrochemical production . Remexi developers use the C programming language and GCC compiler on Windows in the MinGW . Cisco Duo provides multi - factor authentication for users to ensure only those authorized are accessing your network .


The two weaponized documents we discovered leveraging DDE were of particular interest due to victimology and a change in tactics .


Dump data from the IMO messenger app . The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information . Targeting Palestinians : The campaigns seems to target Palestinian individuals and entities , likely related to the Palestinian government . Harrison signed his threatening missive with the salutation , “ We are legion , ” suggesting that whatever comeuppance he had in store for Ashley Madison would come from a variety of directions and anonymous hackers .


While we don't know the motivations behind the attacks , the targeted commercial organizations , along with the targeted government organizations , may point in this direction .


APT Targets Financial Analysts with CVE-2017-0199 .


As a result , the Trojan delete button in the list of applications becomes inactive , which may cause problems for inexperienced users . the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated . Various network attack tools used to fingerprint and compromise other hosts on the network . The attacker also executed various Cobalt Strike components and tried to escalate privileges on the computer using PsExec .


The Proc1 function within the Module1 does nothing more than build the %APPDATA%\MSDN\~msdn.exe path to the dropped payload and executes it using the built-in Shell function .


] databit [ . The Mofang group has been active in relation to the Kyaukphyu sez . status.acmetoy.com /DD/ myScript.js or status.acmetoy.com /DD/ css.css . On March 2 , 2021 , Microsoft released a blog post that detailed multiple zero - day vulnerabilities used to attack on - premises versions of Microsoft Exchange Server .


HttpBrowser 's executable code may be obfuscated through structured exception handling and return-oriented programming .


Even though this individual ’s email id matched with the Pastebin id where base64 encoded malicious code was found , it is hard to say if this individual was or was not involved in this cyber attack .


PLATINUM does not conduct its espionage activity to engage in direct financial gain , but instead uses stolen information for indirect economic advantages . In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker ; 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks .


These repackaged apps pose as communication , news , lifestyle , book , and reference apps popularly used in the Middle East . ScarCruft 's Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . The first one exploits the INCLUDEPICTURE feature of Microsoft Word to get context information about the victim’s computer , and the availability and version number of Microsoft Word . Kaspersky has more here .


Its major functionality is also implemented through the call of the asynchronous task ( “ org.starsizew.i ” ) , including uploading the incoming SMS messages to the remote C2 server and executing any commands as instructed by the remote attacker . The executable variant of Helminth is installed with a dropper Trojan that we are tracking as the HerHer Trojan . Gamaredon cyberwarfare operations against Ukraine are still active . However , the self - proclaimed hacktivist group Anonymous Sudan appears to have increased KillNet ’s capabilities and the group has become the collective ’s most prolific affiliate in 2023 , conducting a majority of claimed DDoS attacks .


Sofacy Attacks Multiple Government Entities .


Instead , the actual content within the body of the websites was an exact match in each instance .


To protect itself from being removed , Svpeng uses a previously unknown vulnerability in Android . Our analysis indicates this is a sophisticated multi-stage infection ; which begins with Epic Turla . For a complete list of tools please see the MainConnectionIo section . Minidionis – one more APT with a usage of cloud drives • Miniduke is back : Nemesis Gemina and the Botgen Studio More details about CozyDuke are available to customers of Kaspersky Intelligence Reporting .


We speculate that the DLL type payload will be downloaded and call its Print export function for further infection .


Shamoon2 : 2a0df97277ddb361cecf8726df6d78ac .


The source process reads /proc/ [ pid ] /maps to find where libc is located in the target process memory . Like BlackEnergy ( a.k.a Sandworm , Quedagh ) , Potao is an example of targeted espionage ( APT ) malware detected mostly in Ukraine and a number of other CIS countries , including Russia , Georgia and Belarus . The attackers can also extend BLACKCOFFEE ’s functionality through additional commands sent as shellcode . Together with our partner CrySyS Lab , we ’ve discovered two new , previously - unknown infection mechanisms for Miniduke .


The program creates the mutex “ mtx ” and an event named “ WerTyQ34C ” .


We performed this comparison and found 28,881 servers that advertised a vulnerable version of SharePoint .


It looks like its main purpose is to get into the system and execute downloaded files with root rights . Kaspersky Lab products detect the Octopus Trojan as Trojan.Win32.Octopus.gen . The activity we have directly observed likely represents only a small fraction of the cyber espionage that APT1 has conducted . These new infection vectors rely on Java and IE vulnerabilities to infect the victim ’s PC .


The Cybereason Nocturnus team suspects that the malware operators and authors are Chinese speakers . The first of them is the well-known FIN7 , which specializes in attacking various companies to get access to financial data or PoS infrastructure . backdoors that now appear to be part of APT15 's toolset .


In an attempt to hide the contents of the stolen data , the threat actor used winrar to compress and password-protect it . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) .


The PLATINUM group has written a few different versions of keyloggers that perform their functions in different ways , most likely to take advantage of different weaknesses in victims ' computing environments . Upon successful exploitation , the attachment will install the Trojan known as NetTraveler using a DLL side-loading attack technique .


After the next run of the infected application , the “ boot ” module will run the “ patch ” module , which hooks the methods from known ad SDKs to its own implementation . The vast majority of systems communicating with Bookworm C2 servers are within the Bangkok metropolitan area where a majority of the government of Thailand exists . 3 、A password-protected ZIP archive ; They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration .


SIGHT Partners is still collecting information on the mechanics of the power outage and what role the KillDisk malware played in the greater event . The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


Request encoding process The HTTP requests follow the format below , while on the WebSocket only the query data is written . IBM X-Force IRIS has gained insight into ITG08’s intrusion methods , ability to navigate laterally , use of custom and open-source tools , and typical persistence mechanisms . APT38 shares malware code and other development resources with TEMP.Hermit North Korean cyber espionage activity , although we consider APT38 .


Changes in the second stage SPLM backdoor are refined , making the code reliably modular .


] comlila-tournai [ . When activities targeting of civil society subsided , the actors instead appeared to have focused on external targets , such a series of attempts to spearphish the Danish Ministry of Foreign Affairs . Within these zones , we know of thousands of FQDNs that have resolved to hundreds of IP addresses ( which we suspect are hops ) and in some instances to APT1 ’s source IP addresses in Shanghai . Monitor for API calls that may attempt to hide artifacts associated with their behaviors to evade detection .


What is sure is that the gap in the Android banking malware rental business left open after the rental of the Anubis 2 and RedAlert 2 Trojans ended provides a good opportunity for the actors behind Cerberus to grow their business quickly . Machete has Latin American targets and has been developed by a Spanish-speaking group , presumably from a LATAM country . APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry .


The mitigation strategies provided may seem like common sense .


PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 . We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 .


CTU researchers observed the first short links targeting hillaryclinton.com email addresses being created in mid-March 2016 ; the last link was created in mid-May .


The most recent Scarlet Mimic attacks we have identified were conducted in 2015 and suggest the group has a significant interest in both Muslim activists and those interested in critiques of the Russian government and Russian President Vladimir Putin . In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company .


After the profile is installed , the user will then be redirected to another Apple phishing site . On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website . The decoded data shows a command to be executed whoami&ipconfig /all on the victim . SysUpdate is exclusively used by Budworm .


During the course of this investigation , we ensured that all certificates compromised by Suckfly were revoked and the affected companies notified .


The attached document contains a conference agenda that the Sofacy group appears to have copied directly from the website for the “ Underwater Defence & Security 2018 Conference ” here .


For sample “ 538ff577a80748d87b5e738e95c8edd2bd54ea406fe3a75bf452714b17528a87 ” the following is an excerpt from the VBA macro building the PowerShell command .


After this announcement , the Palestinian Authority cut salaries for its employees in Gaza by 30 percent and informed Israel that it would no longer pay for electricity provided to Gaza causing blackouts throughout the area and escalating tensions between the rival groups .


A full list of targeted applications is included in the IOC section at the end of this post . Aside from the four companies which have publicly acknowledged attacks , Symantec has identified five other large technology firms compromised by Butterfly , primarily headquartered in the US . It is possible that the operators of this cluster of activity were influenced by open-source publications and do not have any ties with FIN7 . The new campaign , which we call FakeSG , also relies on hacked WordPress websites to display a custom landing page mimicking the victim 's browser .


Our solution is to :


do.jar ( SHA256 : a711e620246d9954510d3f1c8d5c784bacc78069a5c57b9ec09c3e234bc33a8b ) : The decrypted file that was created by “ start.ogg. ” It sends a request to the server with the device ’ s configuration . PittyTiger could also use CVE-2014-1761 , which is more recent . An additional campaign has also been observed targeting Japanese entities .


A current round of cyber-attacks from Chinese source groups are targeting the maritime sector in an attempt to steal technology . In comparison , XENOTIME was defined based on principles of infrastructure ( compromised third-party infrastructure and various networks associated with several Russian research institutions ) , capabilities ( publicly- and commercially-available tools with varying levels of customization ) and targeting ( an issue not meant for discussion in this blog ) .


READ_EXTERNAL_STORAGE - read from external storage . The installed EXE file is almost exactly the same as the DLL version of Bisonal variant used against the Russian organization . In addition , we observed a TTP shift post publication with regards to their malware delivery ; they started using compromised but legitimate domains to serve their malware .


Every device with Google Play includes Google Play Protect and all apps on Google Play are automatically and periodically scanned by our solutions . The PassCV group continues to be extremely effective in compromising both small and large game companies and surreptitiously using their code-signing certificates to infect an even larger swath of organizations . Many threat groups use lateral movement techniques , but this engagement allowed CTU analysts to not only further validate indicators of lateral movement , but also to look a bit closer at those indicators and expand the cluster of indicators surrounding the use of at.exe for lateral movement within the infrastructure . It uses a vulnerability discovered at the end December 2012 , CVE-2012 - 4792 .


Text message and call logs were transmitted every 72 hours to the Shanghai server , and once a day for other personally identifiable data , the company says . In early 2018 , Rapid7 identified that APT10 compromised an apparel company , based upon detections and intelligence gathered from the U.S.-based law firm breach . Tick was spotted last year , but they are actively and silently attacking various organizations in South Korea and Japan for a number of years .


Other than that , its major functionality is to collect private device information , upload it to a remote C2 server , and handle any commands as requested by the C2 server . In May 2016 , Unit 42 began researching attacks that used spear-phishing emails with attachments , specifically malicious Excel spreadsheets sent to financial organizations within Saudi Arabia . The script will check the presence of the “ IndexOfﬁce.exe ” artifact : if true then it will delete it and it will download a new ﬁle/script from “ http://masseffect.space/<PC_Name>_<Hex_Drive_SN>/post.php ” . To date , the ransomware has only been used in a limited fashion .


Super Mario Run Malware # 2 – DroidJack RAT Gamers love Mario and Pokemon , but so do malware authors . The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors . From April 19-24 , 2017 , a politically-motivated , targeted campaign was carried out against numerous Israeli organizations . The new exploit method bypasses URL rewrite mitigations for the endpoint provided by Microsoft in response to •


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . To enhance the effectiveness of phishing attacks into the organization , Barium will collect additional background informationfrom social media sites .


As a result , due to such an unusual compilation process , there were signs in the dex file that point to dexlib , a library used by the Smali tool to assemble dex files . The installed EXE file is almost exactly the same as the DLL version of Bisonal variant used against the Russian organization . Upon execution , this malware creates 10 random directory paths and uses them for a specially designated purpose .


This loads the SWF file , effectively running the malicious code on the system .


This server runs an instance of ‘ Parse Server ’ ( source on GitHub ) , an open source version of the Parse Backend infrastructure , which is a model for providing web app and mobile app developers with a way to link their applications to backend cloud storage and APIs exposed by back-end applications , while also providing features such as user management , push notifications and more . Utilizing KillDisk in the attack scenario most likely served one of two purposes : the attackers covering their tracks after an espionage operation , or it was used directly for extortion or cyber-sabotage . During this time they were able to steal digital certificates from South Korean companies and launch attacks against Indian and Saudi Arabian government organizations .


Yamato Transport - One of Japan 's largest door-to-door delivery service companies , also in Tokyo . Following the exposure of a wide range of their infrastructure and operations by Symantec earlier this year , we discovered that APT33 , or closely aligned actors , reacted by either parking or reassigning some of their domain infrastructure . of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


DanderSpritz consists entirely of plugins to gather intelligence , use exploits and examine already controlled machines . According to a 49-page report published Thursday , all of the attacks are the work of Chinese government 's intelligence apparatus , which the report 's authors dub the Winnti Umbrella .


This is in stark contrast to some other suspected Russian threat actors ( such as Operation Pawn Storm ) who appear to have increased their targeting of Ukraine following the crisis .


This high level of cyber-espionage activity goes back years .


In our analysis , one activity group stood out : NEODYMIUM . Analysis of the operational times of the group 's activities indicates that it is probably centered around China Standard Time ( UTC +8 ) . A bot identifier is generated from the machine’s MAC address . In an article for DarkReading , Ericka Chickowski highlights 15 key indicators of compromise


With a bit of luck , we managed to find logs in which the evidence showed “ Agent Smith ’ s C & C front end routinely distributes a workload between “ w.h * * * g.com ” and “ tt.a * * * d.net ” . This activity is a longer tail for the actor than a spearphish ; this is likely based on the Clever Kitten background , which may be focused on web development/application testing . Using msiexec.exe , a legitimate system process , can make it harder to trace the source of malicious activity . FireEye currently tracks this activity in three clusters , UNC2639 , UNC2640 , and UNC2643 .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . Contextually relevant emails are sent to specific targets with attached documents that are packed with exploit code and Trojan horse programmes designed to take advantage of vulnerabilities in software installed on the target 's computer .


One curious trait of Bahamut is that it develops fully-functional applications in support of its espionage activities , rather than push nonfunctional fake apps or bundle malware with legitimate software . CTU researchers have evidence that the TG-3390 compromised U.S. and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations .


Interestingly , that location may be either a web address or a Microsoft OneDrive account .


After its foray into overt and disruptive attacks in 2016 , the group has subsequently returned to its roots , mounting intelligence gathering operations against a range of targets .


If , for some reason , SuperService does not switch off the screen when there is an attempt to revoke the device administrator privileges , the Trojan tries to intimidate the user : While running , Rotexy tracks the following : switching on and rebooting of the phone ; termination of its operation – in this case , it relaunches ; sending of an SMS by the app – in this case , the phone is switched to silent mode . Analysts in our DeepSight Managed Adversary and Threat Intelligence ( MATI ) team have found a new backdoor , Backdoor.Powemuddy , new variants of Seedworm 's Powermud backdoor ( aka POWERSTATS ) , a GitHub repository used by the group to store their scripts , as well as several post-compromise tools the group uses to exploit victims once they have established a foothold in their network . The campaign 's use of an SMB worm to distribute WCry contributed to the ransomware 's virulence .


There were several distinct areas where mobile malware underwent advances . LuckyMouse , also known as Iron Tiger , EmissaryPanda , APT 27 and Threat Group-3390 , is the same group of Chinese hackers who was found targeting Asian countries with Bitcoin mining malware early this year . We have contacted the compromised universities and provided the necessary information and assistance to remediate the compromise . Additional attacker backdoors identified on systems with names that masquaraded as legitimate binaries and also produced AOT files upon translation ( e.g. , npx - cli and npx-cli.aot ) .


Nevertheless , on May 12th 2015 ( a few weeks after the attack against Bundestag appears to have started ) the American security firm root9B released a report containing details on malware samples very similar to Artifact #2 .


The hackers will map a company’s network and look for strategically favorable locations for placing their malware . To further exemplify the proficiency of the attackers leveraging the Lamberts toolkit , deployment of Black Lambert included a rather sophisticated TTF zero day exploit , CVE-2014-4148 .


] databit [ . The first attack started in early July with a ShimRatReporter payload . The POST URI is changed to /bbs/ search.asp ( as mentioned , earlier Aumlib variants used a POST URI of /bbs/ info.asp . ) The POST body is now encoded . FireEye currently tracks this activity in three clusters , UNC2639 , UNC2640 , and UNC2643 .


In particular , EventBot can intercept SMS messages and bypass two-factor authentication mechanisms . The operation against the Tibetan Parliamentarians illustrates the continued use of malicious attachments in the form of documents bearing exploits . The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign .


Given that both organizations appear to describe similar ( if not identical ) activity , any reasonable person could ( and should ) ask – why the inconsistency in naming and identification? Aside from the competitive vendor naming landscape ( which I am not a fan of in cases on direct overlap , but which has more to say for itself when different methodologies are employed around similar observations ) , the distinction between FireEye and Dragos ’ approaches with respect to the “ TRITON actor ” comes down to fundamental philosophical differences in methodology .


The new IP addresses are typically on the same subnet as the previous ones .


Destructive malware used by VOODOO BEAR includes a wiper called PassKillDisk . Further tracking of the Lazarus’s activities has enabled Kaspersky researchers to discover a new operation , active since at least November 2018 , which utilizes PowerShell to control Windows systems and Mac OS malware to target Apple customers .


Gooligan-infected apps can also be installed using phishing scams where attackers broadcast links to infected apps to unsuspecting users via SMS or other messaging services . Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea 's Reconnaissance General Bureau ( RGB ) . This results in The email would start a conversation between the attackers and victims sometimes being quite lengthy to establish trust , which would include the attackers encouraging the victim to open a registration link hosted by a real website that had already been compromised by the attackers .


First , they use the built-in toolbox commands to determine what apps are running . Group123 is constantly evolving as the new fileless capability that was added to ROKRAT demonstrates . Another obfuscation , This article is based on research by Marcelo Rivero , Malwarebytes ' ransomware specialist , who monitors information published by ransomware gangs on their Dark Web sites .


TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems . The samples Novetta obtained from the active Axiom infection were compiled in mid- to late 2014 and represent what Novetta is referring to as version 3.0 of the Winnti lineage .


On April 3 , 2016 , we still observed new RuMMS samples emerging in the wild . Data about Wingbird activity indicates that it is typically used to attack individuals and individual computers instead of networks . Hash : e2cb06e0a5c14b4c5f58d0e56a1dc10b6a1007cf56c77ae6cb07946c3dfe82d8 . While COSMICENERGY ’s capabilities are not significantly different from previous OT malware families ’ , its discovery highlights several notable developments in the OT threat landscape .


Over a few days' span , the threat actors install remote access tools on additional systems based upon the results of the network reconnaissance .


The additions include code to decrypt an embedded Flash object and an event handler that calls a newly added function ( “ skinEvent2 ” ) that plays the decrypted object .


This very first step fails in Android 7.0 and higher , even with a root permission . The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People's Republics . This BLACKCOFFEE variant contains one or more URLs that link to the biography sections of attacker-created profiles as well as forum threads that contain comments from those same profiles . This model is flexible and enables the operators to constantly change how their backdoors retrieve further commands or malcode as needed .


] orgmary-crawley [ . We named it RedOctober because we started this investigation in October 2012 , an unusually hot month . Typical use of HTRAN is fairly simple : the attacker must specify the originating IP address ( of his or her workstation in Shanghai ) , and a port on which to accept connections . This makes Greatness particularly well - suited for phishing business users .


App Swap Per Device Avg . One of its file stealers , swissknife2 , abuses a cloud storage service as a repository of exfiltrated files . Many of the URLs listed were in use for an extended period . The file , matches signatures for the tried - and - true China Chopper .


Technical Analysis XLoader first loads the encrypted payload from Assets/db as test.dex to drop the necessary modules then requests for device administrator privileges . At least 4 attack campaigns against Pakistan have been observed by us since 2017 . Then it invokes the renamed executable and runs it passing a series of parameter : “ uninstall.exe x -pQELRatcwbU2EJ5 -y ”


? After the phishing email resulted in a successful infiltration , ITG08 used the More_eggs backdoor to gain a foothold and infect additional devices . We consider APT38 's operations more global and highly specialized for targeting the financial sector .


Lately , Patchwork has been sending multiple RTF files exploiting CVE-2017-8570 . One vulnerability is a Windows zero-day vulnerability ( CVE-2019-0703 ) discovered by Symantec . Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers .


Incident Background Beginning on Oct. 24 at 08:00 UTC , FireEye detected and blocked attempts to infect multiple clients with a drive-by download masquerading as a Flash Update (install_flash_player.exe) that delivered a wormable variant of ransomware . The Middle Eastern hacker group in this case is codenamed " BlackOasis " Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


However , this time , the permission is actually used . security policy in the Eastern Europe and South Caucasus regions . Attached to this email was a malicious Microsoft Word document ( MD5: f6fafb7c30b1114befc93f39d0698560 ) that exploited CVE-2012-0158 . TEMP.Veles has used port - protocol mismatches on ports such as 443 , 4444 , 8531 , and 50501 during C2 .


It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in . This function is similar to the various versions of backdoors ( such as sctrls and sip_telephone ) that we analyzed in our previous blog post and whitepaper .


An investigation of Chrysaor Malware on Android 03 April 2017 Google is constantly working to improve our systems that protect users from Potentially Harmful Applications ( PHAs ) . During our investigation , there was a breakthrough discovery that helped connect Leafminer to a number of attacks observed on systems in the Middle East and identify the toolkit used in the group 's efforts of intrusion , lateral movement , and exfiltration . APT33 : 192.119.15.35 [REDACTED].ddns.net . As such , we ’ve seen a growing number of reports of victims who are targeted with commercial spyware .


However , the group ’s activities since the beginning of 2017 have again become more covert and appear to be mainly motivated by intelligence gathering .


TrickMo is no different ; the goal is to complete the operation while raising minimal suspicion . Since they were first identified in January 2-16 , this adversary has consistently targeted large organizations for high ransom demands . Strider has been active since at least October 2011 .


Targets of the campaign received Microsoft Word documents via email that claimed to contain instructions for logging into webmail or information regarding a state law proposal .


In 2015 and 2016 , Dridex was one of the most prolific eCrime banking trojans on the market and , since 2014 , those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits . According to 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor .


Accessibility features are typically used to help users with disabilities by giving the device the ability to write into input fields , auto-generate permissions , perform gestures for the user , etc . Today , this malware is still actively being used against the Philippines . M-Trends 2018 can arm security teams with the knowledge they need to defend against today 's most often used cyber attacks , as well as lesser seen and emerging threats .


On the 14th of November , F-Secure published a blog post naming the malware OnionDuke and associating it with MiniDuke and CosmicDuke , the other Duke toolsets known at the time .


Information about the C&C infrastructure identified in our analysis of Suckfly activity can be seen in Table 1 .


Finally , the malware spawns a thread that has the goal to load , remap , and relocate the stage 5 malware . Mandiant has previously observed targeted attackers stealing email , but few threat actors have been as successful at this as APT35 . While this loader differs somewhat in general implementation , the payload extraction routine seems to be the same as in the previous variant . In this incident , the attacker leveraged an EOL version of the MicroSCADA supervisory control system .


Analysis of a threat group's targeting , origin , and competencies can determine which organizations could be at risk .


Subsequently , two additional articles ( here and here ) were released by Objective-See which provide an analysis of some validated WINDSHIFT samples targeting OSX systems . APT28 is using novel techniques involving the EternalBlue exploits and the open source tool Responder to spread laterally through networks and likely target travelers .


FAKE REVIEWS When early versions of apps are first published , many five star reviews appear with comments like : “ So .. good .. ” “ very beautiful ” Later , 1 star reviews from real users start appearing with comments like : “ Deception ” “ The app is not honest … ” SUMMARY Sheer volume appears to be the preferred approach for Bread developers . Researchers from various security organizations have used a variety of names to assign responsibility for the hacks , including LEAD , BARIUM , Wicked Panda , GREF , PassCV , Axiom , and Winnti . In versions 3.1 – 3.21, the configuration info is xor encoded with 0x85 . Most fraudsters create one - time email addresses or use stolen email addresses , both of which are easy to create or obtain .


In 2014 , our colleagues at Crowdstrike wrote an expos about a long-standing Chinese APT threat group they self-named Putter Panda , which Mandiant / FireEye refers to as APT2 . China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool .


Unlike newer samples , this one created a unique file sloo.exe .


Unlike other rooting malware , this Trojan not only installs its modules into the system , it also injects malicious code into the system runtime libraries . In addition to the legitimate AmmyAdmin tool , the hackers used Visconti Backdoor developed based on legitimate RMS ( remote manipulator system ) software . The macro code inside the remote OLE document contains PowerShell commands that download and execute the final payload . ( Forbes , Gizmodo ) • Vulnerability Roundup : Memory corruption vulnerability in Microsoft Edge ; MilesightVPN and router could be taken over • Malicious Microsoft Drivers Could Number in the Thousands : Cisco Talos • New Threat Actor Launches Cyber - attacks on Ukraine and Poland •


The first webview overlay is created on step 6 of the activation cycle . We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro ) , an Iran-nexus actor that has been active since at least May 2017 . The newer sample appears to be a re-write for optimization purposes with the underlying behavior remaining the same , reverse shell . First , the endpoint , used for informing clients about services offered by the remote Microsoft Exchange server , is accessed using an authenticated request to the frontend .


The collection of basic device information . The generalized targeting of organizations involved in energy and petrochemicals mirrors previously observed targeting by other suspected Iranian threat groups , indicating a common interest in the sectors across Iranian actors . The newest module’s compilation timestamp is March 2018 . Budworm aka LuckyMouse , Emissary Panda , APT27 deployed a previously unseen variant of its SysUpdate backdoor SysUpdate DLL inicore_v2.3.30.dll .


The ultimate objective of targeted attacks is to acquire sensitive data . XENOTIME operates globally , impacting regions far outside of the Middle East , their initial target .


Copy the content from the server object into the new client object ( will not work if client implementation is different ) .


In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage . This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files .


Screenshots from this developer ’ s YouTube video shows history of checking Ashas adware on Google Play ESET telemetry Figure 15 . The regsvr32.exe executable can be used to download a Windows Script Component file (SCT file) by passing the URL of the SCT file as an argument . The exploit , which takes advantage of CVE-2018-4878 , allows an attacker to execute arbitrary code such as an implant .


The Root of All ( Android ) Evil So how does TrickMo get around these security features ? HawkEye is a versatile Trojan used by diverse actors for multiple purposes . In July 2017 , we observed the OilRig group using a tool they developed called ISMAgent in a new set of targeted attacks .