The origins of the Duke toolset names can be traced back to when researchers at Kaspersky Labs coined the term " MiniDuke " to identify the first Duke-related malware they found .


As researchers continued discovering new toolsets that were created and used by the same group that had been operating MiniDuke , and thus the threat actor operating the toolsets started to be commonly referred to as " Dukes " .


Importantly , PinchDuke trojan samples always contain a notable text string , which we believe is used as a campaign identifier by the Dukes group to distinguish between multiple attack campaigns that are run in parallel .


This neatly ties together many of the tools used by the Dukes group , as versions of this one loader have been used to load malware from three different Dukes-related toolsets CosmicDuke , PinchDuke , and MiniDuke – over the course of five years .


As we now know , by February 2013 the Dukes group had been operating MiniDuke and other toolsets for at least 4 and a half years .


Secondly , the value the Dukes intended to gain from these MiniDuke campaigns may have been so great that they deemed it worth the risk of getting noticed .


In the latter case however , the Dukes group appear to have also simultaneously developed an entirely new loader , which we first observed being used in conjunction with CosmicDuke during the spring of 2015 .


The Dukes could have ceased all use of CosmicDuke ( at least until they had developed a new loader ) or retired it entirely , since they still had other toolsets available .


For these CozyDuke campaigns however , the Dukes appear to have employed two particular later-stage toolsets , SeaDuke and HammerDuke .


All of the available evidence however does in our opinion suggest that the group operates on behalf of the Russian Federation .


This assertion of time zone is also supported by timestamps found in many GeminiDuke samples , which similarly suggest the group work in the Moscow Standard Time timezone , as further detailed in the section on the technical analysis of GeminiDuke .


Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years .


APT29 has used The Onion Router and the TOR domain fronting plugin meek to create a hidden , encrypted network tunnel that appeared to connect to Google services over TLS .


Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY .


Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years .


In the investigations Mandiant has conducted , it appeared that APT29 deployed POSHSPY as a secondary backdoor for use if they lost access to their primary backdoors .


POSHSPY is an excellent example of the skill and craftiness of APT29 .


FireEye assesses that APT32 leverages a unique suite of fully-featured malware , in conjunction with commercially-available tools , to conduct targeted operations that are aligned with Vietnamese state interests .


In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 .


From 2016 through 2017 , two subsidiaries of U.S. and Philippine consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations .


From 2016 through 2017 , two consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


In 2015 and 2016 , two Vietnamese media outlets were targeted with malware that FireEye assesses to be unique to APT32 .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam 's manufacturing , consumer products , and hospitality sectors .


APT32 operations are characterized through deployment of signature malware payloads including WINDSHIELD , KOMPROGO , SOUNDBITE , and PHOREAL .


In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines .


APT32 often deploys these backdoors along with the commercially-available Cobalt Strike BEACON backdoor .


APT32 often deploys these backdoors along with the commercially-available Cobalt Strike backdoor .


Based on incident response investigations , product detections , and intelligence observations along with additional publications on the same operators , FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests .


OceanLotus , also known as APT32 , is believed to be a Vietnam-based APT group that has become increasingly sophisticated in its attack tactics , techniques , and procedures ( TTPs ) .


While Volexity does not typically engage in attempting attribution of any threat actor , Volexity does agree with previously reported assessments that OceanLotus is likely operating out of Vietnam .


During that phase , the APT32 operated a fileless PowerShell-based infrastructure , using customized PowerShell payloads taken from known offensive frameworks such as Cobalt Strike , PowerSploit and Nishang .


However , over the past few years , we have been tracking a separate , less widely known suspected Iranian group with potential destructive capabilities , whom we call APT33 .


Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 .


We assess APT33 works at the behest of the Iranian government .


APT33 has targeted organizations – spanning multiple industries – headquartered in the United States , Saudi Arabia and South Korea .


Cybereason also attributes the recently reported Backdoor.Win32.Denis to the OceanLotus Group , which at the time of this report 's writing , had not been officially linked to this threat actor .


APT33 has shown particular interest in organizations in the aviation sector , as well as organizations in the energy sector with ties to petrochemical production .


From mid-2016 through early 2017 , APT33 compromised a U.S. organization in the aerospace sector and targeted a business conglomerate located in Saudi Arabia with aviation holdings .


From mid-2016 through early 2017 , APT33 compromised organizations located in Saudi Arabia and U.S. in the aerospace sector .


During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals .


More recently , in May 2017 , APT33 appeared to target a Saudi organization and a South Korean business conglomerate using a malicious file that attempted to entice victims with job vacancies for a Saudi Arabian petrochemical company .


More recently , in May 2017 , APT33 appeared to target organizations in Saudi and South Korea using a malicious file that attempted to entice victims with job vacancies .


We assess the targeting of multiple companies with aviation-related partnerships to Saudi Arabia indicates that APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia .


APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia .


The generalized targeting of organizations involved in energy and petrochemicals mirrors previously observed targeting by other suspected Iranian threat groups , indicating a common interest in the sectors across Iranian actors .


APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


APT33 registered multiple domains that masquerade as Saudi Arabian aviation companies and Western organizations that together have partnerships to provide training , maintenance and support for Saudi 's military and commercial fleet .


We identified APT33 malware tied to an Iranian persona who may have been employed by the Iranian government to conduct cyber threat activity against its adversaries .


APT33 's targeting of organizations involved in aerospace and energy most closely aligns with nation-state interests , implying that the threat actor is most likely government sponsored .


APT33 leverages popular Iranian hacker tools and DNS servers used by other suspected Iranian threat groups .


This coupled with the timing of operations – which coincides with Iranian working hours – and the use of multiple Iranian hacker tools and name servers bolsters our assessment that APT33 may have operated on behalf of the Iranian government .


The publicly available backdoors and tools utilized by APT33 – including NANOCORE , NETWIRE , and ALFA Shell – are all available on Iranian hacking websites , associated with Iranian hackers , and used by other suspected Iranian threat groups .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


Specifically , the targeting of organizations in the aerospace and energy sectors indicates that the APT33 is likely in search of strategic intelligence capable of benefitting a government or military sponsor .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military aviation capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


We expect APT33 activity will continue to cover a broad scope of targeted entities , and may spread into other regions and sectors as Iranian interests dictate .


The Elfin espionage group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries .


On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " ( referred to as GroupB in this blog post ) to APT33 , operating at the behest of the Iranian government .


The Elfin group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries .


On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " to APT33 , operating at the behest of the Iranian government .


APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea .


In 2017 , APT37 expanded its targeting beyond the Korean peninsula to include Japan , Vietnam and the Middle East , and to a wider range of industry verticals , including chemicals , electronics , manufacturing , aerospace , automotive and healthcare entities .


In 2017 , APT37 targeted a company in Middle East that entered into a joint venture with the North Korean government to provide telecommunications service to the country .


While not conclusive by itself , the use of publicly available Iranian hacking tools and popular Iranian hosting companies may be a result of APT33 's familiarity with them and lends support to the assessment that APT33 may be based in Iran .


North Korean defector and human rights-related targeting provides further evidence that APT37 conducts operations aligned with the interests of North Korea .


In 2017 , APT37 targeted a Middle Eastern company that entered into a joint venture with the North Korean government to provide telecommunications service to the country ( read on for a case study ) .


APT37 targeted a research fellow , advisory member , and journalist associated with different North Korean human rights issues and strategic organizations .


APT37 distributed SLOWDRIFT malware using a lure referencing the Korea Global Forum against academic and strategic institutions located in South Korea .


We believe a organization located in Middle East was targeted by APT37 because it had been involved with a North Korean company and a business deal went bad .


In one instance , APT37 weaponized a video downloader application with KARAE malware that was indiscriminately distributed to South Korean victims through torrent websites .


FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims .


FireEye iSIGHT Intelligence confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims .


In April 2017 , APT37 targeted South Korean military and government organizations with the DOGCALL backdoor and RUHAPPY wiper malware .


It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations .


We assess with high confidence that APT37 acts in support of the North Korean government and is primarily based in North Korea .


The compilation times of APT37 malware is consistent with a developer operating in the North Korea time zone ( UTC +8:30 ) and follows what is believed to be a typical North Korean workday .


The majority of APT37 activity continues to target South Korea , North Korean defectors , and organizations and individuals involved in Korean Peninsula reunification efforts .


Similarly , APT37 targeting of a company located in Middle East in 2017 is also consistent with North Korean objectives given the entity 's extensive relationships inside North Korea .


Similarly , APT37 targeting of a Middle Eastern company in 2017 is also consistent with North Korean objectives given the entity 's extensive relationships inside North Korea .


In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company .


Though they have primarily tapped other tracked suspected North Korean teams to carry out the most aggressive actions , APT37 is an additional tool available to the regime , perhaps even desirable for its relative obscurity .


ScarCruft is a relatively new APT group , victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania .


Certain details , such as using the same infrastructure and targeting , make us believe that Operation Daybreak is being done by the ScarCruft APT group .


Prior to the discovery of Operation Daybreak , we observed the ScarCruft APT launching a series of attacks in Operation Erebus .


Operation Daybreak appears to have been launched by unknown attackers to infect high profile targets through spear-phishing e-mails .


Operation Daybreak appears to have been launched by APT37 to infect high profile targets through spear-phishing e-mails .


On occasion the APT37 directly included the ROKRAT payload in the malicious document and during other campaigns the attackers leveraged multi-stage infection processes .


In the early part of 2017 , Group123 started the " Evil New Year " campaign .


In November 2017 , Talos observed the latest Group123 campaign of the year , which included a new version of ROKRAT being used in the latest wave of attacks .


Group123 is constantly evolving as the new fileless capability that was added to ROKRAT demonstrates .


In this campaign , the Group123 used a classical HWP document in order to download and execute a previously unknown malware : NavRAT .


However , we asses with medium confidence that NavRAT is linked to Group123 .


APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world 's largest cyber heists .


APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world .


APT38 is believed to operate more similarly to an espionage operation , carefully conducting reconnaissance within compromised financial institutions and balancing financially motivated objectives with learning about internal systems .


The group has compromised more than 16 organizations in at least 13 different countries , sometimes simultaneously , since at least 2014 .


APT38 shares malware code and other development resources with TEMP.Hermit North Korean cyber espionage activity , although we consider APT38 .


We consider APT38 's operations more global and highly specialized for targeting the financial sector .


APT38 is a financially motivated group linked to North Korean cyber espionage operators , renown for attempting to steal hundreds of millions of dollars from financial institutions and their brazen use of destructive malware .


Because APT38 is backed by ( and acts on behalf of ) the North Korean regime , we opted to categorize the group as an " APT " instead of a " FIN " .


Over time these malware similarities diverged , as did targeting , intended outcomes , and TTPs , almost certainly indicating that TEMP.Hermit activity is made up of multiple operational groups primarily linked together with shared malware development resources and North Korean state sponsorship .


Based on observed activity , we judge that APT38 's primary mission is targeting financial institutions and manipulating inter-bank financial systems to raise large sums of money for the North Korean regime .


Since 2015 , APT38 has attempted to steal hundreds of millions of dollars from financial institutions .


APT38 has pursued their main objective of targeting banks and financial entities since at least 2014 .


We surmise that the targeting of banks , media , and government agencies is conducted in support of APT38 's primary mission .


The APT38 targeted news outlets known for their business and financial sector reporting , probably in support of efforts to identify and compromise additional financial institutions .


APT38 also targeted financial transaction exchange companies likely because of their proximity to banks .


Given the lapse in time between the spear-phishing and the heist activity in the above example , we suggest two separate but related groups under the North Korean regime were responsible for carrying out missions ; one associated with reconnaissance ( TEMP.Hermit or a related group ) and another for the heists ( APT38 ) .


APT38 , in particular , is strongly distinguishable because of its specific focus on financial institutions and operations that attempt to use SWIFT fraud to steal millions of dollars at a time .


We can confirm that the APT38 operator activity is linked to the North Korean regime , but maintains a set of common characteristics , including motivation , malware , targeting , and TTPs that set it apart from other statesponsored operations .


As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions to raise money for the North Korean regime .


As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions and financial systems to raise money for the North Korean regime .


Although the APT38 's primary targets appear to be Financial Exchange banks and other financial organizations , they have also Financial Exchange targeted countries ' media organizations with a focus on the financial sector .


Since at least the beginning of 2014 , APT38 operations have focused almost exclusively on developing and conducting financially motivated campaigns targeting international entities , whereas TEMP.Hermit is generally linked to operations focused on South Korea and the United States .


TEMP.Hermit is generally linked to operations focused on South Korea and the United States .


While North Korean cyber operations against specific countries may have been driven by diplomatic factors and perceived insults against Pyongyang , the application of increasingly restrictive and numerous financial sanctions against North Korea probably contributed to the formation of APT38 .


APT38 's operations began in February 2014 and were likely influenced by financial sanctions enacted in March 2013 that blocked bulk cash transfers and restricted North Korea 's access to international banking systems .


APT37 ( Reaper ) , another North Korean state-sponsored group , targeted a Middle Eastern financial company , but there was no evidence of financial fraud .


APT37 , another North Korean state-sponsored group , targeted a Middle Eastern financial company , but there was no evidence of financial fraud .


Early APT38 operations suggest that the group began targeting financial institutions with an intent to manipulate financial transaction systems at least as early as February 2014 , although we did not observe fraudulent transactions until 2015 .


We do not have evidence that the earliest targeted financial institutions were victimized by fraudulent transactions before APT38 left the compromised environments , possibly indicating that APT38 was conducting reconnaissance-only activity at that time .


In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank .


From November 2015 through the end of 2016 , APT38 was involved in at least nine separate compromises against banks .


Per the complaint , the email account watsonhenny@gmail.com was used to send LinkedIn invitations to employees of a bank later targeted by APT38 .


Further , the recent DOJ complaint provides insight into initial compromise techniques conducted by North Korean operators against APT38 targets , which may have been leveraged as part of the initial compromise into the targeted organizations .


This is corroborated by our identification of TEMP.Hermit 's use of MACKTRUCK at a bank , preceding the APT38 operation targeting the bank 's SWIFT systems in late 2015 .


APT38 relies on DYEPACK , a SWIFT transaction-hijacking framework , to initiate transactions , steal money , and hide any evidence of the fraudulent transactions from the victimized bank .


The APT38 uses DYEPACK to manipulate the SWIFT transaction records and hide evidence of the malicious transactions , so bank personnel are none the wiser when they review recent transactions .


During this heist , APT38 waited for a holiday weekend in the respective countries to increase the likelihood of hiding the transactions from banking authorities .


During one reported incident , APT38 caused an outage in the bank 's essential services .


We attribute APT38 to North Korean state-sponsored operators based on a combination of technical indicators linking the activity to Pyongyang and details released by DOJ implicating North Korean national Park Jin Hyok in a criminal conspiracy .


As detailed in the DOJ complaint , a sample of WHITEOUT malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank .


APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition .


Malware overlaps between APT38 and TEMP.Hermit highlight the shared development resources accessible by multiple operational groups linked to North Korean state-sponsored activity .


APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry .


This is evidence of shared motivation and intent to target the SWIFT system by the North Korean operators performing the reconnaissance and APT38 which later targeted that organization .


Although APT38 is distinct from other TEMP.Hermit activity , both groups operate consistently within the interests of the North Korean state .


Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea .


As detailed in the DOJ complaint , a sample of WHITEOUT ( aka Contopee ) malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank .


Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea 's Reconnaissance General Bureau ( RGB ) .


APT38 .


APT38 's targeting of financial institutions is most likely an effort by the North Korean government to supplement their heavily-sanctioned economy .


We have moderate confidence APT39 operations are conducted in support of Iranian national interests based on regional targeting patterns focused in the Middle East .


APT39 's focus on the widespread theft of personal information sets it apart from other Iranian groups FireEye tracks , which have been linked to influence operations , disruptive attacks , and other threats .


APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns .


Other groups attributed to Iranian attackers , such as Rocket Kitten , have targeted Iranian individuals in the past , including anonymous proxy users , researchers , journalists , and dissidents .


Remexi is a basic back door Trojan that allows Cadelle to open a remote shell on the computer and execute commands .


Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands .


One group , which we call Cadelle , uses Backdoor.Cadelspy , while the other , which we've named Chafer , uses Backdoor.Remexi and Backdoor.Remexi.B .


APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol ( RDP ) , Secure Shell ( SSH ) , PsExec , RemCom , and xCmdSvc .


The APT39 were using an improved version of Remexi in what the victimology suggests might be a domestic cyber-espionage operation .


A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group .


A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group .


The Middle Eastern hacker group in this case is codenamed " BlackOasis " .


Kaspersky found the BlackOasis group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


BlackOasis ' interests span a wide gamut of figures involved in Middle Eastern politics .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japanese organizations such as government agencies ( including defense ) as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets .


In fact , REDBALDKNIGHT has been zeroing in on Japanese organizations as early as 2008 — at least based on the file properties of the decoy documents they've been sending to their targets .


Secureworks® incident responders and Counter Threat Unit™ ( CTU ) researchers investigated activities associated with the BRONZE BUTLER ( also known as Tick ) threat group , which likely originates in the People .


Targeting data supports the belief that APT39 's key mission is to track or monitor targets of interest , collect personal information , including travel itineraries , and gather customer data from telecommunications firms .


BRONZE BUTLER has used a broad range of publicly available ( Mimikatz and gsecdump ) and proprietary ( Daserf and Datper ) tools .


BRONZE BUTLER are also fluent in Japanese , crafting phishing emails in native Japanese and operating successfully within a Japanese-language environment .


BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


BRONZE BUTLER uses credential theft tools such as Mimikatz and WCE to steal authentication information from the memory of compromised hosts .


While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


Several xxmm samples analyzed by CTU researchers incorporate Mimikatz , allowing BRONZE BUTLER to issue Mimikatz commands directly from xxmm .


BRONZE BUTLER compromises organizations to conduct cyberespionage , primarily focusing on Japan .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when the group compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data exfiltration and to provide remote access to infected machines .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when BRONZE BUTLER compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


In some cases , the attackers used the Society for Worldwide Interbank Financial Telecommunication ( SWIFT ) network to transfer money to their accounts .


Carbanak is a backdoor used by the attackers to compromise the victim .


If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation .


To enable connections to the infected computer using the Remote Desktop Protocol ( RDP ) , Carbanak sets Termservice service execution mode to Auto .


Carbanak is also aware of the IFOBS banking application and can , on command , substitute the details of payment documents in the IFOBS system .


Sensitive bank documents have be found on the servers that were controlling Carbanak .


Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa .


FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015 .


As with previous campaigns , and as highlighted in our annual M-Trends 2017 report , FIN7 is calling stores at targeted organizations to ensure they received the email and attempting to walk them through the infection process .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers .


While FIN7 has embedded VBE as OLE objects for over a year , they continue to update their script launching mechanisms .


This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies .


Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


The group has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space .


Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems .


The first successful bank robbery was committed by this group in January 2013 .


To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer .


We have no evidence of compromises against banks in Western Europe or United States , but it should be noted that the attackers methods could be utilized against banks outside of Russia as well .


Additionally the reports on Carbanak show a different picture , where banks targeted outside of Russia , specifically Europe , USA and Japan are mentioned , which does not match our research .


Without any insight into the evidence Kaspersky has obtained , we can only repeat our view that Anunak has targeted only banks in Russia and we have no concrete reports of compromised banks outside of Russia directly related to this criminal group .


Charming Kitten is an Iranian cyberespionage group operating since approximately 2014 .


These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider .


The Charming Kitten' focus appears to be individuals of interest to Iran in the fields of academic research .


Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as OilRig and CopyKittens .


Flying Kitten ( which is another name given by the security industry to Charming Kitten ) was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of the IRI ( Islamic Republic of Iran ) government and foreign espionage targets .


Flying Kitten was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of government and foreign espionage targets .


At certain times , Mesri has been a member of an Iran-based hacking group called the Turk Black Hat security team " .


During intense intelligence gathering over the last 24 months , we observed the technical capabilities of the Operation Cleaver team rapidly evolve faster than any previously observed Iranian effort .


TinyZBot is a bot written in C# and developed by the Cleaver team .


Some of the teams publicly known today include Iranian Cyber Army , Ashiyane , Islamic Cyber Resistance Group , Izz ad-Din al-Qassam Cyber Fighters , Parastoo , Shabgard , Iran Black Hats and many others 9 .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team .


The Cobalt group 's traditional " stomping grounds " are the Eastern Europe , Central Asia , and Southeast Asia .


Against targets in the CIS countries , the Cobalt also used their own infrastructure , which included rented dedicated servers .


In several cases , the Cobalt compromised company infrastructure and employee accounts in order to send phishing messages to partner companies in North and South America , Europe , CIS countries , and Central and Southeast Asia .


To ensure remote access to the workstation of an employee at a target organization , the Cobalt group ( as in previous years ) uses Beacon , a Trojan available as part of commercial penetration testing software .


Artifacts indicated the involvement of the Cobalt that , according to Positive Technologies information , from August to October had performed similar successful attacks in Eastern Europe , and it 's likely that this group may will soon become active in the West .


In a recent spear-phishing campaign , the Cobalt Hacking Group used a remote code execution vulnerability in Microsoft Office software to connect to its command and control server via Cobalt Strike .


The basic principles of targeted attacks on financial institutions have not changed since 2013 when the Anunak , Corkow , Buhtrap , and Lurk groups began conducting the first attacks on Russian banks .


In a recent spear-phishing campaign , the Cobalt Group used a known CVE to connect to its C&C server via Cobalt Strike , but ended up revealing all targets .


This isn't the first time we've seen Cobalt makes this error—back in March , an attack focussing on 1,880 targets across financial institutions in Kazakhstan had the same flaw .


The Carbanak attacks targeting over a 100 financial institutions worldwide .


The leader of the crime gang behind the Carbanak and Cobalt malware attacks targeting over a 100 financial institutions worldwide has been arrested in Alicante , Spain , after a complex investigation conducted by the Spanish National Police .


Since 2013 , the Cobalt have attempted to attack banks and financial institutions using pieces of malware they designed .


Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt .


The organised crime group started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world .


One of the Cobalt Group 's latest campaigns , an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor , was investigated and presented by the Talos research team .


The Cobalt started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world .


The Cobalt group misused Cobalt Strike , for instance , to perpetrate ATM cyber heists and target financial institutions across Europe , and interestingly , Russia .


The hacking group misused Cobalt Strike , for instance , to perpetrate ATM cyber heists and target financial institutions across Europe , and interestingly , Russia .


If successful , Cobalt goes on to attack financial institutions outside the country .


The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled .


As part of our monitoring of Iranian threat agents activities , we have detected that since October 2016 and until the end of January 2017 , the Jerusalem Post , as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens .


CopyKittens use several self-developed malware and hacking tools that have not been publicly reported to date , and are analyzed in this report : TDTESS backdoor ; Vminst , a lateral movement tool ; NetSrv , a Cobalt Strike loader ; and ZPP , a files compression console program .


CopyKittens often uses the trial version of Cobalt Strike , a publicly available commercial software for " Adversary Simulations and Red Team Operations " .


Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent .


The group , which we have given the name Gallmaker , has been operating since at least December 2017 , with its most recent activity observed in June 2018 .


Rather , the Gallmaker 's attack activity we observed is carried out exclusively using LotL tactics and publicly available hack tools .


Gallmaker used lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange ( DDE ) protocol in order to gain access to victim machines .


Should a user enable this content , the attackers are then able to use the DDE protocol to remotely execute commands in memory on the victim 's system .


Back in 2013 , CopyKittens used several Facebook profiles to spread links to a website impersonating Haaretz news , an Israeli newspaper .


Gallmaker 's activity appears to be highly targeted , with its victims all related to government , military , or defense sectors .


Gallmaker 's targets are embassies of an Eastern European country .


There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors .


The group has carried out attacks most months since December 2017 .


Its activity subsequently increased in the second quarter of 2018 , with a particular spike in April 2018 .


The fact that Gallmaker appears to rely exclusively on LotL tactics and publicly available hack tools makes its activities extremely hard to detect .


The Gamaredon Group primarily makes use of compromised domains , dynamic DNS providers , Russian and Ukrainian country code top-level domains ( ccTLDs ) , and Russian hosting providers to distribute their custom-built malware .


Gallmaker may well have continued to avoid detection were it not for Symantec 's technology .


In this instance , Symantec identified the specific PowerShell commands used by Gallmaker as being suspicious , leading to the discovery of this new campaign .


Without Symantec 's advanced AI-based capabilities , Gallmaker 's activities may well have remained undetected .


Previously , LookingGlass reported on a campaign they named " Operation Armageddon " , targeting individuals involved in the Ukrainian military and national security establishment .


The earliest discovered sample ( based on compile times and sandbox submission times ) distributed by this threat group resembles the descriptions of Gamaredon provided by Symantec and Trend Micro .


The scripts would also use wget to send POST requests to command and control ( C2 ) servers that would contain information about the compromised system .


These VNC exectuables would either be included in the SFX file or downloaded by the batch script .


The batch script would then attempt to have the VNC program connect to a command and control ( C2 ) server to enable the server to control the compromised system .


While the most recent samples observed still use batch scripts and SFX files , the Gamaredon Group has moved away from applications like wget , Remote Manipulator Tool , VNC and ChkFlsh.exe .


The threat group using these implants has been active since at least 2014 and has been seen targeting individuals likely involved in the Ukrainian government .


Some of the samples share delivery mechanisms and infrastructure with samples which are detected by a few antivirus vendors as Gamaredon .


Periodically , researchers at Palo Alto Networks hunt through WildFire execution reports , using AutoFocus , to identify untagged samples ' artifacts in the hopes of identifying previously undiscovered malware families , behaviors , and campaigns .


Just a few months later , in February 2015 , we announced the discovery of Carbanak , a cyber-criminal gang that used custom malware and APT techniques to steal millions of dollars while infecting hundreds of financial institutions in at least 30 countries .


Today at the Security Analyst Summit ( SAS 2016 ) , Kaspersky Lab is announcing the discovery of two new gangs engaged in APT-style bank robberies – Metel and GCMAN – and the reemergence of the Carbanak group with new targets in its sights .


In 2015 , Kaspersky Lab researchers conducted Incident Response for 29 organizations located in Russia and infected by these three groups .


Kaspersky Lab is releasing crucial Indicators of Compromise ( IOCs ) and other data to help organizations search for traces of these attack groups in their corporate networks .


In all , Kaspersky Lab discovered Metel in more than 30 financial institutions .


It is highly likely that this threat is far more widespread and we urge financial institutions around the world to scan their networks for signs of the Metel malware .


A second group , which we call GCMAN because the malware is based on code compiled on the GCC compiler , emerged recently using similar techniques to the Metel Group to infect banking institutions and attempt to transfer money to e-currency services .


Our investigations revealed that the attackers drove around several cities in Russia , stealing money from ATMs belonging to different banks .


Once inside the network , the GCMAN group uses legitimate and penetration testing tools such as Putty , VNC , and Meterpreter for lateral movement .


Our investigation revealed an attack where the GCMAN group then planted a cron script into bank 's server , sending financial transactions at the rate of $200 per minute .


The GCMAN group used an MS SQL injection in commercial software running on one of bank 's public web services , and about a year and a half later , they came back to cash out .


During that time they poked 70 internal hosts , compromised 56 accounts , making their way from 139 attack sources ( TOR and compromised home routers ) .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers .


Kaspersky Lab 's research team responded to three financial institutions in Russia that were infected with the GCMAN malware .


In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company .


Recently Subaat drew our attention due to renewed targeted attack activity .


Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec , in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking , which we are calling Gorgon Group .


Starting in February 2018 , Palo Alto Networks identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


Starting in February 2018 , Palo Alto Networks Unit 42 identified a


of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


The GCMAN group has moved beyond banks and is now targeting the budgeting and accounting departments in any organization of interest to them , using the same APT-style tools and techniques .


Starting in February 2018 , Unit 42 identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


APT38 's increasingly aggressive targeting against banks .


Gorgon Group used common URL shortening services to download payloads .


APT38 has paralleled North Korea 's worsening financial condition .


On much of the C2 infrastructure we identified several crimeware family samples .


While investigating the domains and infrastructure used by the phishing components of Gorgon Group , Unit 42 researchers witnessed several common operational security flaws with Gorgon Group 's actors throughout their many campaigns .


360 and Tuisec already identified some Gorgon Group members .


RATs such as NjRat and infostealers like Lokibot were leveraging the same C2 infrastructure as that of the targeted attacks .


it 's not known if the attackers physically reside in Pakistan .


Gorgon used numerous decoy documents and phishing emails , both styles of attacks lacked overall sophistication .


While it 's not known if the attackers physically reside in Pakistan , all members of Gorgon Group purport to be in Pakistan based on their online personas .


Starting in mid-February , Unit 42 researchers have been tracking an active campaign sharing a significant portion of infrastructure leveraged by Gorgon Group for criminal and targeted attacks .


Unit 42 researchers have been tracking Gorgon Group for criminal and targeted attacks .


As part of the investigation , Unit 42 researchers were able to identify an interesting characteristic about how the Gorgon Group crew uses shared infrastructure between cybercrime and targeted attacks .


The crew combines both regular crime and targeted attack objectives using the same domain infrastructure over time , rarely changing their TTPs .


One interesting note about the criminal activity of Gorgon Group is their usage of Bitly .


Between April 1 , 2018 and May 30 , 2018 , we observed the domain stevemike-fireforce.info used in a Gorgon Group cybercrime campaign involving more than 2,300 emails and 19 documents in the initial attack .


Similar to that of their targeted attacks , Gorgon Group leveraged Bitly for distribution and shortening of C2 domains .


Beginning in early March 2018 , Unit 42 started observing targeted attacks against Russian , Spanish and United States government agencies operating in Pakistan .


Leveraging click counts for the campaign for Bitly , we were able to see Gorgon Group 's activity volume increase throughout April .


As we continued to investigate , it became apparent that Gorgon Group had been consistently targeting worldwide governmental organizations operating within Pakistan .


Starting in mid-February .


Additionally , during that time , members of Gorgon Group were also performing criminal operations against targets across the globe , often using shared infrastructure with their targeted attack operations .


Unit 42 researchers have been tracking an active campaign .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


Beginning in early March 2018 , Unit 42 started observing Gorgon group attacks against Russian , Spanish and United States government agencies operating in Pakistan .


Like all of Gorgon Group 's members , Fudpage 's online profile , infrastructure utilization and standardization , connects them back to Gorgon Group .


Ultimately , this lead us to the conclusion that several of Gorgon Group 's members have a nexus in Pakistan .


Gorgon Group isn't the first actor group we've witnessed dabble in both nation state level and criminal attacks .


Overall , in spite of the lack of sophistication in Gorgon Group 's activity , they were still relatively successful ; once again proving that simple attacks on individuals without proper protections , work .


On January 15 , Advanced Threat Research discovered an operation using a new variant of the SYSCON backdoor .


The Korean-language Word document manual.doc appeared in Vietnam on January 17 , with the original author name of Honeybee .


While Gorgon Group has been making minor changes in their methodologies , they are still actively involved in both targeted and criminal attacks .


This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON , which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics .


This key was also used in the Honeybee campaign and appears to have been used since August 2017 .


Several additional documents surfaced between January 17 and February 3 .


All contain the same Visual Basic macro code and author name as Honeybee .


Some of the malicious documents were test files without the implant .


From our analysis , Honeybee submitted most of these documents from South Korea , indicating that some of the targeting was in South Korea .


Honeybee attacked beyond the borders of South Korea to target Vietnam , Singapore , Argentina , Japan , Indonesia , and Canada .


Honeybee appears to target humanitarian aid and inter-Korean affairs .


McAfee Advanced Threat Research team 's analysis , we find multiple components from this operation are unique from a code perspective , even though the code is loosely based on previous versions of the SYSCON backdoor .


Large-scale cyber espionage campaigns such as " GhostNet " .


As the crisis in Syria escalates , FireEye researchers have discovered a cyber espionage campaign , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe .


As the crisis in Syria escalates , FireEye researchers have discovered a threat group , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe .


We believe that the Ke3chang attackers are operating out of China and have been active since at least 2010 .


FireEye gained visibility into one of 23 known command-and-control ( CnC ) servers operated by the Ke3chang actor for about one week .


Each attack comprises a variety of phases , including reconnaissance , exploitation , command and control , lateral movement , and exfiltration .


The Ke3chang attackers have been active since at least 2010 .


traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


The Ke3chang have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , chemicals , manufacturing , mining sectors .


August 2013 , FireEye gained visibility on one of 22 CnC servers used at that time by the Ke3chang attackers .


In this report , we present the historical intelligence we have gathered on the Ke3chang campaign , as well as an in-depth assessment of the ongoing Syrian-themed attacks against these MFAs .


Ke3chang attackers have used spear-phishing emails .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


Traditionally , the Ke3chang attackers have used spear-phishing emails with either a malware attachment or a link to a malicious download .


Over the years , the Ke3chang attackers have used three types of malware that we call : " BS2005 " , " BMW " , and " MyWeb " .


it is a typical first stage backdoor commonly found in APT attacks .


The attackers have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


All of the CnC communications are performed over the HTTP protocol .


The current Ke3chang campaign leverages the BS2005 malware , while older activity from 2010 - 2011 leveraged BMW , followed by the MyWeb malware sporadically used in between .


A trait common to all three malware families we analyzed is that they use the IWebBrowser2 COM interface to perform their CnC communication .


Three months after the Olympics-themed attacks , FireEye observed a new BS2005 campaign labeled " newtiger " , which is possibly a reference to an older 2010 campaign labeled " tiger " .


Using information from the FireEye DTI cloud , FireEye observed that Ke3chang targeted a single firm .


The Ke3chang attackers used the older " MyWeb " malware family from 2010 to 2011 .


The Ke3chang attackers used the older MyWeb malware family from 2010 to 2011 .


During our period of visibility into the BS2005 " moviestar " campaign against various ministries of foreign affairs in Europe , FireEye discovered that the Ke3chang had initially tested the malware in virtual machines , prior to compromising actual targets .


The MyWeb sample that FireEye analyzed has a compile date of 1/20/2011 .


At least one of the attacks in this campaign leveraged a European security and defense-themed lure , which aligns with the targeting preferences for this group .


MyWeb is the second-generation malware used by Ke3chang .


ministries of foreign affairs in Europe have been targeted and compromised by a threat actor we call Ke3chang .


This attack used the crisis in Syria as a lure to deliver malware to its targets .


Tracking the malicious activities of the elusive Ke3chang APT group , ESET researchers have discovered new versions of malware families linked to the group , and a previously unreported backdoor .


Furthermore , FireEye has presented evidence indicating that the Ke3chang attackers have been active since at least 2010 and have attacked targets related to G20 meetings in the past .


During our brief window of visibility into one of the known 22 CnC nodes , FireEye observed the Ke3chang conducting reconnaissance and moving laterally throughout the compromised networks .


Ke3chang attackers are operating within China .


In May 2017 , NCC Group 's Incident Response team reacted to an ongoing incident .


which provides a range of services to UK Government .


APT15 was targeting information related to UK government departments and military technology .


backdoors that now appear to be part of APT15 's toolset .


This report demonstrates that Ke3chang is able to successfully penetrate government targets using exploits for vulnerabilities that have already been patched and despite the fact that these ministries have defenses in place .


RoyalDNS - required APT15 .


The Ke3chang group also used keyloggers and their own .NET tool to enumerate folders and dump data from Microsoft Exchange mailboxes .


APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets .


This time , APT15 opted for a DNS based backdoor : RoyalDNS .


APT15 then used a tool known as RemoteExec .


APT15 then used a tool known as RemoteExec ( similar to Microsoft .


Coincidentally , following the recent hack of a US Navy contractor and theft of highly sensitive data on submarine warfare , we have found evidence of very recent activity by a group referred to as APT15 , known for committing cyber espionage which is believed to be affiliated with the Chinese government .


APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more .


Other names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon .


ther names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon .


There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group .


There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group ; although posted in March 2018 , it refers to a campaign in 2017 .


both attributed to Chinese government affiliated groups .


DLL hijacking techniques have been seen in the past with the APT15 group .


cyber actors of the North Korean to target the media , aerospace , financial , and critical infrastructure sectors in the United States and globally .


Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets , keyloggers , remote access tools ( RATs ) , and wiper malware .


Variants of malware and tools used by HIDDEN COBRA actors include Destover and Hangman .


DHS has previously released Alert TA14-353A .


Our analysis shows that the cybercriminals behind the attack against an online casino in Central America , and several other targets in late-2017 , were most likely the infamous Lazarus hacking group .


The Lazarus Group was first identified in Novetta 's report Operation Blockbuster in February 2016 .


cyberattacks against high-value targets in Ukraine in December 2015 and December 2016 .


In all of these incidents , the Lazarus utilized similar toolsets , including KillDisk that was executed on compromised machines .


We are confident this KillDisk malware was deployed by Lazarus , rather than by another , unrelated attacker .


This recent attack against an online casino in Central America suggests that hacking tools from the Lazarus toolset are recompiled with every attack ( we didn't see these exact samples anywhere else ) .


Utilizing KillDisk in the attack scenario most likely served one of two purposes : the attackers covering their tracks after an espionage operation , or it was used directly for extortion or cyber-sabotage .


Today we'd like to share some of our findings , and add something new to what 's currently common knowledge about Lazarus Group activities , and their connection to the much talked about February 2016 incident , when an unknown attacker attempted to steal up to $851M USD from Bangladesh Central Bank .


Since the Bangladesh incident there have been just a few articles explaining the connection between Lazarus Group and the Bangladesh bank heist .


However , from this it 's only clear that Lazarus might have attacked Polish banks .


Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers .


Considering that the afterhack publications by the media mentioned that the investigation stumbled upon three different attackers , it was not obvious whether Lazarus was the one responsible for the fraudulent SWIFT transactions , or if Lazarus had in fact developed its own malware to attack banks ' systems .


We would like to add some strong facts that link some attacks on banks to Lazarus , and share some of our own findings as well as shed some light on the recent TTPs used by the attacker , including some yet unpublished details from the attack in Europe in 2017 .


Lazarus attacks are not a local problem and clearly the group 's operations span across the whole world .


Lazarus was previously known to conduct cyberespionage and cybersabotage activities , such as attacks on Sony Pictures Entertainment with volumes of internal data leaked , and many system harddrives in the company wiped .


We believe that Lazarus Group is very large and works mainly on infiltration and espionage operations , while a substantially smaller units within the group , which we have dubbed Bluenoroff , is responsible for financial profit .


Lazarus regrouped and rushed into new countries , selecting mostly poorer and less developed locations , hitting smaller banks because they are , apparently , easy prey .


To date , the Lazarus group has been one of the most successful in launching large scale operations against the financial industry .


We believe that Lazarus will remain one of the biggest threats to the banking sector , finance , and trading companies , as well as casinos for the next few years .


We believe Lazarus started this watering hole attack at the end of 2016 after their other operation was interrupted in South East Asia .


We believe they started this watering hole campaign at the end of 2016 after their other operation was interrupted in South East Asia .


A rudimentary but somewhat clever design , KiloAlfa provides keylogging capability for the Lazarus Group 's collection of malicious tools .


The design of KiloAlfa is broken down into two basic components : the persistence functionality and the keylogging functionality .


The persistence functionality of KiloAlfa allows the malware to self-install on a victim 's machine when activated ( described below ) .


Evidence suggest that the Lazarus Group uses compromised infrastructure as the public-facing touchpoint for the majority of their malware samples .


PapaAlfa is believed to be one of the proxy malware components that the Lazarus Group uses to hide the true command and control server ( s ) for operations .


Rather , PapaAlfa could be considered a smart proxy due in part to the fact that the Lazarus can easily switch the backend destination address and port without having to reestablish control over the infected machine hosting the PapaAlfa malware .


In terms of form factor , PapaAlfa comes in two flavors : service DLL and standalone executable .


The IndiaBravo-PapaAlfa installer is responsible for installing the service DLL variant .


While the tools profiled in this report are not inherently malicious , their capabilities are nonetheless integral to the Lazarus Group 's cyber operations , both espionage and destructive in nature , making them inherently dangerous to potential victims .


These tools often lay the groundwork for further malicious activity , such as the targeting of antivirus capabilities and the disabling of firewalls , both of which are very fundamental defensive measures .


Furthermore , like many other identified Lazarus Group families , these tools showcase the group 's creative solutions , such as the PapaAlfa , which makes it difficult to immediately identify potentially malicious activity on a compromised network .


The first class , colloquially known as " wipers " , are a class of malware has the primary intent of destroying data on a victim 's machine .


DDoS malware floods a target 's network-connected service with an excessive number of request at once in order to overload the capacity of the server .


For example , DeltaAlfa specifies a DDoS bot family identified as Alfa .


The naming scheme used by Novetta for the malware identified during Operation Blockbuster consists of at least two identifiers which each identifier coming from the International Civil Aviation Organization ( ICAO ) 's phonetic alphabet ,2 commonly referred to as the NATO phonetic alphabet .


Loaders are typically responsible for loading a DLL component into memory given that a DLL cannot operate in a standalone mode such as an executable .


This report will explore the various installers , uninstallers and loaders Novetta has observed the Lazarus Group using .


This reverse engineering report looks at the RATs and staging malware found within the Lazarus Group 's collection .


Regardless of their sophistication or refinement , the malware families within the Lazarus Group 's India and Lima classes perform at a reasonable level for their designed purpose : the introduction and persistence of malware from the Lazarus Group on a victim 's infrastructure .


While the capabilities for the installers , loaders , and uninstallers in this report are relatively straight forward and single-focused , analysis of these malware families provide further insight into the capabilities of the Lazarus Group .


The Lazarus Group employs a variety of RATs that operate in both client mode and server mode .


The most common communication mode for a RAT is to act as a client to a remote server .


The Lazarus Group employs a variety of RATs and staging malware to conduct cyber operations , many of which contain significant code overlap that points to at least a shared development environment .


While some members within the Romeo and Sierra groups may not implement sound authentication strategies , shift their design focus in abrupt and unusual manners , and fail to understand the pitfalls of distributed command networks , on the whole the families within the Lazarus Group 's collection of RATs and staging malware perform their tasks with surprising effectiveness .


This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets Bitcoin users and global financial organizations .


This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets financial organizations .


McAfee Advanced Threat Research analysts have discovered an aggressive Bitcoin-stealing phishing campaign by the international cybercrime group Lazarus that uses sophisticated malware with long-term impact .


McAfee Advanced Threat Research ( ATR ) analysts have discovered an aggressive Bitcoin-stealing phishing campaign by the international cybercrime group Lazarus that uses sophisticated malware with long-term impact .


Beginning in 2017 , the Lazarus group heavily targeted individuals with spear phishing emails impersonating job recruiters which contained malicious documents .


The use of decoy documents also reveals some of the potential targets of the Lazarus group 's malicious activity , specifically the use spear phishing attacks observed targeting South Korean government and aerospace organizations .


The campaign lasted from April to October and used job descriptions relevant to target organizations , in both English and Korean language .


The Lazarus Group 's objective was to gain access to the target 's environment and obtain key military program insight or steal money .


In this latest discovery by McAfee , despite a short pause in similar operations , the Lazarus group targets financial organizations .


This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans .


This Malware Analysis Report ( MAR ) is the result of analytic efforts between the Department of Homeland Security ( DHS ) and the Federal Bureau of Investigation ( FBI ) .


When victims open malicious documents attached to the emails , the malware scans for Bitcoin activity and then establishes an implant for long-term data-gathering .


According to trusted third-party reporting , HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace , telecommunications , and finance industries .


The malware is a fully functional RAT with multiple commands that the actors can issue from a command and control ( C2 ) server to a victim 's system via dual proxies .


FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware or as a file downloaded unknowingly by users when visiting sites compromised by HIDDEN COBRA actors .


HIDDEN COBRA actors use an external tool or dropper to install the FALLCHILL malware to establish persistence .


HIDDEN COBRA actors install the FALLCHILL malware to establish persistence .


Working with U.S. government partners , DHS and FBI identified Internet Protocol ( IP ) addresses and other indicators of compromise ( IOCs ) associated with a remote administration tool ( RAT ) used by the North Korean government—commonly known as FALLCHILL .


This alert 's IOC files provide HIDDEN COBRA indicators related to FALLCHILL .


McAfee Advanced Threat Research analysts have uncovered a global data reconnaissance campaign assaulting a wide number of industries including critical infrastructure , entertainment , finance , health care , and telecommunications .


Because of this , additional HIDDEN COBRA malware may be present on systems compromised with FALLCHILL .


This campaign , dubbed Operation GhostSecret , leverages multiple implants , tools , and malware variants associated with the state-sponsored cyber group HIDDEN COBRA .


From March 18 to 26 we observed the malware operating in multiple areas of the world .


Furthermore , the Advanced Threat Research team has discovered Proxysvc , which appears to be an undocumented implant .


Our investigation into this campaign reveals that the actor used multiple malware implants , including an unknown implant with capabilities similar to Bankshot .


The attackers behind Operation GhostSecret used a similar infrastructure to earlier threats , including SSL certificates used by FakeTLS in implants found in the Destover backdoor variant known as Escad , which was used in the Sony Pictures attack .


Based on our analysis of public and private information from submissions , along with product telemetry , it appears Proxysvc was used alongside the 2017 Destover variant and has operated undetected since mid-2017 .


This new variant resembles parts of the Destover malware , which was used in the 2014 Sony Pictures attack .


The Lazarus used a similar infrastructure to earlier threats , including the Destover backdoor variant known as Escad .


The McAfee Advanced Threat Research team discovered a previously unknown data-gathering implant that surfaced in mid-February 2018 .


The Advanced Threat Research team uncovered activity related to this campaign in March 2018 , when the actors targeted Turkish banks .


Lazarus used watering hole attacks to compromise legitimate and trusted websites frequently visited by their targets .


Malefactors used watering hole attacks to compromise legitimate and trusted websites frequently visited by their targets .


Feedback from our Smart Protection Network revealed that apart from attacks in North America ( mainly the U.S. ) , Europe , and South America , the campaign also noticeably affected enterprises in Taiwan , Hong Kong , China , and Bahrain .


On February 28 , the McAfee discovered that the cybercrime group HIDDEN COBRA continues to target cryptocurrency and financial organizations .


On February 28 , the McAfee Advanced Threat Research team discovered that the cybercrime group HIDDEN COBRA continues to target cryptocurrency and financial organizations .


While the URL acts similarly to how eye-watch.in : 443 delivers payloads , we also saw the URL leveraging and exploiting security flaws in Flash : CVE-2015-8651 , CVE-2016-1019 , and CVE-2016-4117 .


In this analysis , we observed the return of HIDDEN COBRA 's Bankshot malware implant surfacing in the Turkish financial system .


In this new , aggressive campaign we see a return of the Bankshot implant , which last appeared in 2017 .


This attack resembles previous attacks by HIDDEN COBRA conducted against the SWIFT .


The exploit , which takes advantage of CVE-2018-4878 , allows an attacker to execute arbitrary code such as an implant .


These implants are variations of earlier forms of Bankshot , a remote access tool that gives an attacker full capability on a victim 's system .


Bankshot was first reported by the Department of Homeland Security on December 13 , 2017 , and has only recently resurfaced in newly compiled variants .


We have found what may be an early data-gathering stage for future possible heists from financial organizations in Turkey ( and possibly other countries ) .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


This malware report contains analysis of one 32-bit Windows executable file , identified as a Remote Access Trojan ( RAT ) .


This malware is capable of accessing device configuration data , downloading additional files , executing commands , modifying the registry , capturing screen shots , and exfiltrating data .


Volgmer is a backdoor Trojan designed to provide covert access to a compromised system .


It is suspected that spear phishing is the primary delivery mechanism for Volgmer infections ; however , HIDDEN COBRA actors use a suite of custom tools , some of which could also be used to initially compromise a system .


Since at least 2013 , HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government , financial , automotive , and media industries .


Therefore , it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer .


As a backdoor Trojan , Volgmer has several capabilities including : gathering system information , updating service registry keys , downloading and uploading files , executing commands , terminating processes , and listing directories .


In one of the samples received for analysis , the US-CERT Code Analysis Team observed botnet controller functionality .


Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library ( .dll )


Lazarus actors commonly maintain persistence on a victim 's system by installing the malware-as-a-service .


Working with U.S. Government partners , DHS and FBI identified Trojan malware variants used by the North Korean government - referred to by the U.S. Government as BADCALL .


The malware uses a custom binary protocol to beacon back to the command and control ( C2 ) server , often via TCP port 8080 or 8088 , with some payloads implementing Secure Socket Layer ( SSL ) encryption to obfuscate communications .


DHS and FBI are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity .


The malware known as RATANKBA is just one of the weapons in Lazarus ' arsenal .


We analyzed a new RATANKBA variant ( BKDR_RATANKBA.ZAEL–A ) , discovered in June 2017 , that uses a PowerShell script instead of its more traditional PE executable form—a version that other researchers also recently identified .


Around 55% of the victims of Lazarus were located in India and neighboring countries .


Lazarus group could have been active since late 2016 , was used in a recent campaign targeting financial institutions using watering hole attacks .


Since they first emerged back in 2007 with a series of cyberespionage attacks against the South Korean government , these threat actors have successfully managed to pull off some of the most notable and devastating targeted attacks—such as the widely-reported 2014 Sony hack and the 2016 attack on a Bangladeshi bank—in recent history .


It 's possible that Lazarus is using RATANKBA to target larger organizations .


RATANKBA is delivered to its victims using a variety of lure documents , including Microsoft Office documents , malicious CHM files , and different script downloaders .


Overall , an organization will need multilayered security strategies , as Lazarus and other similar groups are experienced cybercriminals who employ different strategies to get past organizational defenses .


simultaneous use of the detected Win32/KillDisk.NBO variants .


Working with U.S. Government partners , DHS and FBI identified Trojan malware variants used by the North Korean government – commonly known as HARDRAIN .


These files have the capability to download and install malware , install proxy and Remote Access Trojans ( RATs ) , connect to command and control ( C2 ) servers to receive additional instructions , and modify the victim 's firewall to allow incoming connections .


The cybercriminal group Lazarus has a history of attacking financial organizations in Asia and Latin America .


We also recently discovered that Lazarus successfully planted their backdoor ( detected by Trend Micro as BKDR_BINLODR.ZNFJ-A ) into several machines of financial institutions across Latin America .


We determined that these backdoors were installed on the targets ' machines on September 19 2018 , based mainly on the service creation time of the loader component .


Just last week Lazarus were found stealing millions from ATMs across Asia and Africa .


These and other tools used by the Lazarus group can be mitigated by routinely scanning the network for any malicious activity to help prevent the malware from entering and spreading through an organization .


The backdoors Lazarus are deploying are difficult to detect and a significant threat to the privacy and security of enterprises , allowing attackers to steal information , delete files , install malware , and more .


Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs .


FBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation .


Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others .


We also saw that the attack technique bears some resemblance to a previous 2017 Lazarus attack , analyzed by BAE Systems , against targets in Asia .


WannaCry utilizes EternalBlue by crafting a custom SMB session request with hard-coded values based on the target system .


Notably , after the first SMB packet sent to the victim 's IP address , WannaCry sends two additional packets to the victim containing the hard-coded IP addresses 192.168.56.20 and 172.16.99.5 .


WannaCry ( also known as WCry or WanaCryptor ) malware is a self-propagating ( worm-like ) ransomware that spreads through internal networks and over the public internet by exploiting a vulnerability in Microsoft 's Server Message Block ( SMB ) protocol , MS17-010 .


The WannaCry malware consists of two distinct components , one that provides ransomware functionality and a component used for propagation , which contains functionality to enable SMB exploitation capabilities .


WannaCry leverages an exploit , codenamed " EternalBlue " , that was released by the Shadow Brokers on April 14 , 2017 .


WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data .


In May 2017 , SecureWorks® Counter Threat Unit® ( CTU ) researchers investigated a widespread and opportunistic WCry ( also known as WanaCry , WanaCrypt , and Wana Decrypt0r ) ransomware campaign that impacted many systems around the world .


In November 2017 , SecureWorks Counter Threat Unit ( CTU ) researchers investigated a widespread and opportunistic WCry ransomware campaign that impacted many systems around the world .


Microsoft addressed the SMBv1 vulnerabilities in March 2017 with Security Bulletin MS17-010 .


The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April .


If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit .


WCry uses a combination of the RSA and AES algorithms to encrypt files .


The campaign 's use of an SMB worm to distribute WCry contributed to the ransomware 's virulence .


Last week Microsoft , working together with Facebook and others in the security community , took strong steps to protect our customers and the internet from ongoing attacks by an advanced persistent threat actor known to us as ZINC , also known as the Lazarus Group .


Last week Microsoft , working together with Facebook , took strong steps to protect our customers and the internet from ongoing attacks by the Lazarus Group .


We concluded that Lazarus Group was responsible for WannaCry , a destructive malware .


We concluded that Lazarus Group was responsible for WannaCry , a destructive attack in May that targeted Microsoft customers .


Today , the governments of the United States , United Kingdom , Australia , Canada , New Zealand and Japan have all announced that the government of North Korea is responsible for the activities of ZINC/Lazarus .


In November 2017 , Secureworks Counter Threat Unit™ ( CTU ) researchers discovered the North Korean cyber threat group , known as Lazarus Group and internally tracked as NICKEL ACADEMY by Secureworks , had launched a malicious spearphishing campaign using the lure of a job opening for the CFO role at a European-based cryptocurrency company .


In November 2017 , CTU researchers discovered the North Korean cyber threat group , known as Lazarus Group , had launched a malicious spearphishing campaign using the lure of a job opening for the CFO role at a European-based cryptocurrency company .


Bankshot is designed to persist on a victim 's network for further exploitation ; thus the Advanced Threat Research team believes this operation is intended to gain access to specific financial organizations .


CTU researchers assess this as the continuation of activity first observed in 2016 , and it is likely that the campaign is ongoing .


CTU researchers have observed NICKEL ACADEMY ( Lazarus ) copying and pasting job descriptions from online recruitment sites in previous campaigns .


There are several indicators , which have led CTU researchers to believe with high confidence that NICKEL ACADEMY is behind the current spearphishing campaign .


CTU researchers also identified components in the custom C2 protocol being used which they have seen utilized by Nickel Academy ( Lazarus ) previously .


CTU researchers also identified components in the custom C2 protocol being used ( the way in which the malware talks to the Command and Control Servers ) which they have seen utilized by Nickel Academy ( Lazarus ) previously .


Leafminer attempts to infiltrate target networks through various means of intrusion : watering hole websites , vulnerability scans of network services on the internet , and brute-force login attempts .


The researchers found that there are common elements in the macro and in the first- stage RAT used in this campaign , with former campaigns of the NICKEL ACADEMY ( Lazarus ) threat group .


During our investigation , there was a breakthrough discovery that helped connect Leafminer to a number of attacks observed on systems in the Middle East and identify the toolkit used in the group 's efforts of intrusion , lateral movement , and exfiltration .


As of early June 2018 , the server hosted 112 files in a subdirectory that could be accessed through a public web shell planted by the Leafminer .


As of early June 2018 , the server hosted 112 files in a subdirectory that could be accessed through a public web shell planted by the attackers .


The Leafminer 's post-compromise toolkit suggests that Leafminer is looking for email data , files , and database servers on compromised target systems .


Researching the hacker handle MagicCoder results in references to the Iranian hacking forum Ashiyane as well as defacements by the Iranian hacker group Sun Army .


Targeted regions included in the list of Leafminer are Saudi Arabia , United Arab Emirates , Qatar , Kuwait , Bahrain , Egypt , Israel , and Afghanistan .


Our investigation of Leafminer started with the discovery of JavaScript code on several compromised websites in the Middle East .


This included the Fuzzbunch framework that was part of an infamous leak of exploits and tools by the Shadow Brokers in April 2017 .


Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft .


The EternalBlue exploit from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 .


The Leafminer operators use EternalBlue to attempt lateral movement within target networks from compromised staging servers .


Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address .


Furthermore , the Leafminer arsenal server hosted a Python script to scan for this vulnerability .


Another intrusion approach used by Leafminer seems a lot less sophisticated than the previously described methods but can be just as effective : using specific hacktools to guess the login passwords for services exposed by a targeted system .


Commands found in a readme text that was stored in a ZIP archive together with the hacktool THC Hydra in Leafminer 's tool arsenal represent online dictionary attacks on Microsoft Exchange and Remote Desktop Protocol services of regional government servers in Saudi Arabia .


Symantec identified two strains of custom malware used by the Leafminer group : Trojan.Imecab and Backdoor.Sorgu .


Leafminer is a highly active group , responsible for targeting a range of organizations across the Middle East .


Leafminer appears to be based in Iran and seems to be eager to learn from and capitalize on tools and techniques used by more advanced threat actors .


Leafminer also utilized Process Doppelganging , a detection evasion technique first discussed at the Black Hat EU conference last year .


Dragos has identified Leafminer group targeting access operations in the electric utility sector .


Analysis of RASPITE tactics , techniques , and procedures ( TTPs ) indicate the group has been active in some form since early - to mid-2017 .


RASPITE targeting includes entities in the US , Middle East , Europe , and East Asia .


RASPITE overlaps significantly with Symantec 's Leafminer , which recently released a report on the group 's activity in the Middle East .


RASPITE 's activity to date currently focuses on initial access operations within the electric utility sector .


This means that the Leafminer group is targeting electric utilities .


While the group has not yet demonstrated an ICS capability , RASPITE 's recent targeting focus and methodology are clear indicators of necessary activity for initial intrusion operations into an IT network to prepare the way for later potential ICS events .


Active since at least 2014 , this actor has long-standing interest in maritime industries , naval defense contractors , and associated research institutions in the United States and Western Europe .


Active since at least 2014 , the Leviathan has long-standing interest in maritime industries , naval defense contractors , and associated research institutions in the United States and Western Europe .


On September 15 and 19 , 2017 , Proofpoint detected and blocked spearphishing emails from this group targeting a US shipbuilding company and a US university research center with military ties .


The attachments exploited CVE-2017-8759 which was discovered and documented only five days prior to the campaign .


Some of the documents exploited CVE-2017-0199 to deliver the payload .


Between August 2 and 4 , the actor sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors .


Between August 2 and 4 , the Leviathan sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors .


The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period .


The period between November 2014 and January 2015 marked one of the earlier instances in which Proofpoint observed persistent exploitation attempts by this actor .


The Leviathan , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 .


This actor , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 .


The campaign is linked to a group of suspected Chinese cyber espionage actors we have tracked since 2013 , dubbed TEMP.Periscope .


The Leviathan generally emailed Microsoft Excel documents with malicious macros to US universities with military interests , most frequently related to the Navy .


The current campaign is a sharp escalation of detected activity since summer 2017 .


Since early 2018 , FireEye ( including our FireEye as a Service ( FaaS ) , Mandiant Consulting , and iSIGHT Intelligence teams ) has been tracking an ongoing wave of intrusions targeting engineering and maritime entities , especially those connected to South China Sea issues .


Known targets of the Leviathan have been involved in the maritime industry , and research institutes , academic organizations , and private firms in the United States .


Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities .


TEMP.Periscope overlaps in targeting , as well as tactics , techniques , and procedures ( TTPs ) , with TEMP.Jumper , a group that also overlaps significantly with public reporting on NanHaiShu .


The actor has conducted operations since at least 2013 in support of China 's naval modernization effort .


FireEye is highlighting a cyber espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40 .


The Leviathan group has specifically targeted engineering , transportation , and the defense industry , especially where these sectors overlap with maritime technologies .


We believe APT40 's emphasis on maritime issues and naval technology ultimately support China 's ambition to establish a blue-water navy .


Within a year APT40 was observed masquerading as a UUV manufacturer , and targeting universities engaged in naval research .


APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia .


We assess with moderate confidence that APT40 is a state-sponsored Chinese cyber espionage operation .


The actor 's targeting is consistent with Chinese state interests and there are multiple technical artifacts indicating the actor is based in China .


Analysis of the operational times of the group 's activities indicates that it is probably centered around China Standard Time ( UTC +8 ) .


APT40 relies heavily on web shells for an initial foothold into an organization .


APT40 has been observed leveraging a variety of techniques for initial compromise , including web server exploitation , phishing campaigns delivering publicly available and custom backdoors , and strategic web compromises .


Depending on placement , a web shell can provide continued access to victims ' environments , re-infect victim systems , and facilitate lateral movement .


The group 's capabilities are more than the much discussed CVE-2012-0158 exploits over the past few years .


A paper released today by our colleagues at Palo Alto Networks presented a portion of data on this crew under the label " the Lotus Blossom Operation " , likely named for the debug string present in much of the " Elise " codebase since at least 2012 : " d:\lstudio\projects\lotus\… " .


Instead , the Spring Dragon group is known to have employed spearphish exploits , strategic web compromises , and watering holes attack .


The group 's spearphish toolset includes PDF exploits , Adobe Flash Player exploits , and the common CVE-2012-0158 Word exploits including those generated from the infamous " Tran Duy Linh " kit .


The Spring Dragon appears to have rolled out a steady mix of exploits against government-related organizations in VN , TW , PH , and other locations over the past few years .


Organizations located in Myanmar and targeted by Spring Dragon have gone unmentioned .


Spring Dragon 's infiltration techniques there were not simply spearphish .


The download name was " Zawgyi_Keyboard_L.zip " , and it dropped a " setup.exe " that contained several backdoor components , including an Elise " wincex.dll " ( a42c966e26f3577534d03248551232f3 , detected as Backdoor.Win32.Agent.delp ) .


While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past , Spring Dragon employs more involved and creative intrusive activity as well .


The well-known threat group called DRAGONFISH or Lotus Blossom are distributing a new form of Elise malware targeting organizations for espionage purposes .


The threat actors associated with DRAGONFISH have previously focused their campaigns on targets in Southeast Asia , specifically those located in countries near the South China Sea .


iDefense analysts have identified a campaign likely to be targeting members of— or those with affiliation or interest in—the ASEAN Defence Ministers ' Meeting ( ADMM ) .


iDefense analysts have identified a campaign likely to be targeting members of or those with affiliation or interest in the ASEAN Defence Minister 's Meeting ( ADMM ) .


iDefense assesses with high confidence that this campaign is associated with the threat group DRAGONFISH ( also known as Lotus Blossom and Spring Dragon ) .


To mitigate the threat of the described campaign , security teams can consider blocking access to the C2 server 103.236.150.14 and , where applicable , ensure that the Microsoft Security Update KB2553204 is installed in order to patch the CVE-2017-11882 vulnerability .


The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign .


The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan .