While the motivation for each APT32 private sector compromise varied – and in some cases was unknown – the unauthorized access could serve as a platform for law enforcement , intellectual property theft , or anticorruption measures that could ultimately erode the competitive advantage of targeted organizations . Working backwards from each Internet address , I was able to see that in the last few months of 2018 the hackers behind DNSpionage succeeded in compromising key components of DNS infrastructure for more than 50 Middle Eastern companies and government agencies , including targets in Albania , Cyprus , Egypt , Iraq , Jordan , Kuwait , Lebanon , Libya , Saudi Arabia and the United Arab Emirates .


It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks . The Sogu gang use a custom developed threat – Backdoor.Sogu , whereas the group described in this document use an off the shelf threat – Poison Ivy .


CTU researchers observed the threat actors collecting Cisco VPN profiles to use when accessing the victim's network via VPN .


They also state that the code is written from scratch and is not using parts of other existing banking Trojans unlike many other Trojans that are either based completely on the source of another Trojan ( such as the leaked Anubis source code that is now being resold ) or at least borrow parts of other Trojans . The group behind Machete uses effective spearphishing techniques . APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition .


Currently Running Applications Banking Trojans that rely on the overlay mechanism to steal information need to know what application is in the foreground . Certain details , such as using the same infrastructure and targeting , make us believe that Operation Daybreak is being done by the ScarCruft APT group . Interestingly, the FBI website for wanted cybercriminals includes two Iranians called Mohammad Reza, although this could be a common name or even a false . Among the IP addresses owned by Hack520 is a whole/22 IP Range which we dubbed as the “ PIG RANGE ” .


For example , the password of the WiFi network used by the phone was stored in the folder /storage/emulated/0/.lost+found/0BBDA068-9D27-4B55-B226-299FCF2B4242/ using the following file name format DD_MM_2019_HH_mm_ss_XXXXXXXXXXXXX.txt.crypt ( the datetime followed by the IMEI ) . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions . Federation of Independent Palestinian Communities and Organizations and Events in the Diaspora . This is clear and shocking evidence of a deliberate and malicious attack by Russia against Ukraine which had significant consequences on ordinary people and businesses in Ukraine and across Europe .


The malware was able to perform overlay attacks and become the default SMS app through the abuse of the Accessibility Service . A sustained cyberespionage campaign targeting at least three companies in the United States and Europe was uncovered by Recorded Future and Rapid7 between November 2017 and September 2018 . It has targeted countries including Israel , Saudi Arabia , Turkey , the U.S. , Jordan , and Germany .


10/03/2020 At the end of February the actors behind Ginp added screen capture capabilities to their Trojan . During this operation (dubbed ‘Cloud Hopper” because of the group’s use of popular western cloud-based services) , APT10 utilized both new malware (Quasar RAT , Trochilus , RedLeaves , ChChes as well as some familiar old tools . The threat often uses compromised web servers in Japan and the Republic of Korea .


We do not know whether the files are legitimate Palestinian Authority documents , but they are designed to look official .


At that time it was the name of a cybercriminal group that was stealing money from Russian financial establishments — to the tune of at least $150,000 per hit . TG-3390 uses the PlugX remote access tool .


Talos found 189 logos from banks to cryptocurrency exchanges inside the archive , all of which could be targeted . The group has focused mainly on governmental targets in Iraq and Saudi Arabia , according to past telemetry . Derusbi : File Name : 32.dll . We have observed TANKTRAP being used with other disruptive tools including NEARMISS , SDELETE , PARTYTICKET , and CADDYWIPER .


REQUEST_IGNORE_BATTERY_OPTIMIZATIONS - Whitelists the application to allow it to ignore battery optimizations . Bitdefender’s forensics and investigation team was contacted to look into a security incident that started in May 2018 with an email received by two of the bank’s employees . Starting in mid-February .


This group has no known associations to other activity groups .


While one of these modules gathers system information and another attempts to steal the victim ’s usernames and passwords , as one would expect from a malware used for a targeted attack , the other two known OnionDuke modules are quite the opposite ; one is designed for use in DoS S-TOOL attacks and the other for posting predetermined messages to the Russian VKontakte social media site .


These samples were located by pivoting on document attributes .


This document reports that Ismail Hanieyh , the political leader of Hamas , had notified the Egyptian government that he will remain abroad after his visit to Tehran to take part in Soleimani ’s funeral , which sparked tension with the Egyptian authorities .


The discovery of this new PLATINUM technique and the development of detection capabilities highlight the work the Windows Defender ATP team does to provide customers greater visibility into suspicious activities transpiring on their networks . This particular threat was also used by hackers to compromise a Korean social network site to steal records of 35 million users .


The discovery by Kaspersky marks at least the fifth zero-day exploit used by BlackOasis and exposed by security researchers since June 2015 . Also , by creating this type of API access , Turla could use one accessible server as a single point to dump data to and exfiltrate data from .


WAKE_LOCK - Allows the application to use PowerManager WakeLocks to keep the processor from sleeping or the screen from dimming . A Carbanak trademark in cyberattacks remains the use of Cobalt Strike – a powerful pentesting tool designed for exploiting and executing malicious code , simulating post-exploitation actions of advanced threat actors – which allows them to infiltrate the organization , move laterally , exfiltrate data , and deploy anti-forensic and evasion tools . Leveraging click counts for the campaign for Bitly , we were able to see Gorgon Group 's activity volume increase throughout April .


Malware code showing handover from initial module to main payload Figure 13 . APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more . We used different archiving tools such as PowerArchiver 2019 , WinZip , WinRar , 7Zip , and unzIP S-TOOL that is built into the Windows OS in attempting to extract the content of the attachment SHIPPING_MX00034900_PL_INV_pdf.zip . While this shift likely reflects the increased tempo of wartime cyber operations , it also reveals the GRU ’s priority objectives in OT attacks .


The actor sends an email to trala.cosh2@post.cz with the unique system identifier as a subject with a secondary email account and credentials in ASCII hexadecimal format within the message body .


Comparing it to OSX_DOK.C , we can see that it uses the same script format .


Xenotime .


This simulation shows that FakeSpy behaves differently on a physical device versus an emulator . Given FIN7’s previous use of false security companies , we decided to look deeper into this one . During our period of visibility into the BS2005 " moviestar " campaign against various ministries of foreign affairs in Europe , FireEye discovered that the Ke3chang had initially tested the malware in virtual machines , prior to compromising actual targets .


Note that inside this single response , there is one “ install_true ” command , one “ sms_grab ” command and four “ sms_send ” commands . In July 2017 , we observed APT34 targeting a Middle East organization using a PowerShell-based backdoor that we call POWRUNER and a downloader with domain generation algorithm functionality that we call BONDUPDATER , based on strings within the malware . Everything starts with a malicious document using a well-known vulnerability to download a malicious document hosted on the internet . It is possible that the malware was used to support exercises such as the ones hosted by Rostelecom - Solar in 2021 in collaboration with the Russian Ministry of Energy or in 2022 for the ( SPIEF ) .


Each of the phishing sites contained links to a distribution manifest , which contained metadata such as the application name , version , icon , and a URL for the IPA file . Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign .


TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution . Attackers have been known to distribute malicious files masquerading as the legitimate iviewers.dll file and then use DLL load hijacking to execute the malicious code and infect the computer .


While admittedly the version numbers provided by SharePoint within HTTP responses do not always provide the precise SharePoint version number , we decided to use it to check if it was less than the version numbers of the patched SharePoint versions from the Microsoft advisory .


The website uses a different fixed twitter account ( https : //twitter.com/fdgoer343 ) . APT17 was embedding the encoded CnC IP address for the BLACKCOFFEE malware in legitimate Microsoft TechNet profiles pages and forum threads , a method some in the information security community call a " dead drop resolver " . The controller issued the command to write the base64-decoded and modified data to the file name set earlier in the exchange . Talos eventually uncovered additional campaigns , including the two previously mentioned by Ukraine ’s Computer Emergency Response Team ( CERT - UA ) and FortiGuard Labs researchers .


After some major upgrade , by mid-June , the “ Agent Smith ” campaign reached its peak . In order to increase the likelihood of their malware successfully communicating home , cyber espionage threat actors are increasingly abusing legitimate web services , in lieu of DNS lookups to retrieve a command and control address . With these capabilities , Microsoft Defender ATP provides comprehensive protection against Dexphot and the countless other complex and evolving threats that we face every day . To increase investigation transparency , we are including a Last Known True , or LKT , value for network indicators .


The group has demonstrated access to zero-day vulnerabilities (CVE-2018-0802) , and the ability to incorporate them into operations . which has been active since at least 2011 .


Some of the observed GeminiDuke samples that used timestamps as mutex names were compiled while MSK still respected DST and for these samples , the timestamps perfectly align with MSK as it was defined at the time .


Harvested credentials provided by an embedded Mimikatz executable facilitate the infection of other systems on the network . which they launched targeted attacks against Russian banks , businesses and media companies .


This led us to additional infrastructure for Zebrocy at 185.25.51.198 and 185.25.50.93 .


It also harvests call details and SMS logs as shown below . The admin@338 linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong . In other recent attacks ( January 2017 ) , the group used a fake Juniper Networks VPN portal and fake University of Oxford websites to deliver malware as described by ClearSky . UNC2452 is a sophisticated group that has targeted government and private sector entities worldwide .


Like many espionage campaigns , much of APT40 's activity begins by attempting to trick targets with phishing emails , before deploying malware such as the Gh0st RAT trojan to maintain persistence on a compromised network . CTU researchers assess with high confidence that threat groups like Threat Group-1314 will continue to live off of the land to avoid detection and conduct their operations .


The primary goal of these attacks was likely to find code-signing certificates for signing future malware . Aside from the competitive vendor naming landscape ( which I am not a fan of in cases on direct overlap , but which has more to say for itself when different methodologies are employed around similar observations ) , the distinction between FireEye and Dragos' approaches with respect to the " TRITON actor " comes down to fundamental philosophical differences in methodology .


Devices running Android 4.4 and higher are protected by Verified Boot . Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit.MSWord.CVE-2010-333 , Exploit.Win32.CVE-2012-0158 . APT16 actors were likely also responsible for the June 2015 activity . Uncovering weaknesses in Apple macOS and VMWare vCenter : 12 vulnerabilities in RPC implementation •


After the checks , the malware becomes active , but first , it goes through seven steps , each one calling a different command : uploadPhoneNumbers : Exfiltrates all phone numbers that are in the contact list . The Seedworm group controls its Powermud backdoor from behind a proxy network to hide the ultimate command-and-control ( C&C ) location . The DllInstall export function is responsible for the core behavior of the malware , as just loading it does nothing . For this reason , the particular actions intended by the actor are unclear without further knowledge about the targeted assets .


This check serves two purposes :


This variant of SofacyCarberp was configured to use the following domain as its C2 server : cdnverify.net .


One of its most notable routines is capturing voice calls in real time by hooking into the “ mediaserver ” system service . To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer . referred in his blog ) None Use of open source libraries for protocol implementation : The availability of open source projects that implement OT protocols can lower the barrier of entry for actors attempting to interact with OT devices .


In that case , you first need to send the text “ 393838 ” in an SMS to the infected device and then repeat all the actions described above ; that text message will change the C & C address to “ : // ” , so the phone will no longer receive commands from the real C & C . We initially became aware of Careto when we observed attempts to exploit a vulnerability in our products to make the malware " invisible " in the system . Since early 2018 , FireEye ( including our FireEye as a Service ( FaaS ) , Mandiant Consulting , and iSIGHT Intelligence teams ) has been tracking an ongoing wave of intrusions targeting engineering and maritime entities , especially those connected to South China Sea issues .


If you ’ ve downloaded one of the apps listed in Appendix A , below , you might be infected . We attribute APT38 to North Korean state-sponsored operators based on a combination of technical indicators linking the activity to Pyongyang and details released by DOJ implicating North Korean national Park Jin Hyok in a criminal conspiracy . to MMAT_GLBOPT2 ( most global optimizations completed ) However , twice this year , in March and June , LockBit 's considerable rate of attacks was vastly exceeded by CL0P , which was otherwise dormant .


The HawkEye malware is primarily used for credential theft and is often combined with additional tools to extract passwords from email and web browser applications . APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


In 2011-2012 , the group used a relatively tiny implant ( known as “ Sofacy ” or SOURFACE ) as their first stage malware , which at the time had similarities with the old Miniduke implants .


The identified email owners held a wide range of responsibilities within the Hillary for America campaign , extending from senior figures to junior employees and the group mailboxes for various regional offices .


1664cb343ee830fa94725fed143b119f7e2351307ed0ce04724b23469b9002f2 Loaded DEX SHA2 : afaf446a337bf93301b1d72855ccdd76112595f6e4369d977bea6f9721edf37e Domain/IP : goldncup [ . Specifically , the targeting of organizations in the aerospace and energy sectors indicates that the APT33 is likely in search of strategic intelligence capable of benefitting a government or military sponsor . Remexi boasts features that allow it to gather keystrokes, take screenshots of Windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote . Since 2021 , there have been multiple leaks of ransomware source code and builders components that are essential to creating and modifying ransomware .


We have discovered apps using AES , Blowfish , and DES as well as combinations of these to encrypt their strings . More than half of the organizations we have observed being targeted or breached by APT5 operate in these sectors . SC Service control command , implemented as the Windows one . Our initial investigation on the domains registered by Hack520 revealed that similar domains ( listed below ) were registered by another profile .


By comparing the sizes of the encrypted asset file tong.luo vs the decrypted JAR file mycode.jar , it is interesting to note that it is the same file ( almost the same size ) . The timeline shows three main clusters of activity across the three webshells , with activity occurring on two separate webshells (green and orange) within a very small window of time on April 2 , 2019 and the activity involving the third webshell two weeks later on April 16 , 2019 . While Gorgon Group has been making minor changes in their methodologies , they are still actively involved in both targeted and criminal attacks .


Due to this obfuscation , a part of the previously mentioned cfg class is now mapped to c/b/a/a/a or c/a/a/a/a . By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device . The persistent use of social media to identify and manipulate victims indicates that COBALT GYPSY successfully achieves its objectives using this tactic .


Third-party app stores are ubiquitous in China for a number of reasons including : evermore powerful Chinese Original Equipment Manufacturers ( OEM ) , a lack of an official Chinese Google Play app store , and a growing smartphone market . We didn’t choose to name it after a vegetable; the .NET malware developers named it Topinambour themselves . While APT1 intruders occasionally use publicly available backdoors such as Poison Ivy and Gh0st RAT .


After initialization , the artifact will attempt to establish a connection by creating a socket .


In red , we see those values being passed into the suspicious Java method through the registered interface . Our primary contribution in this update is to implicate Bahamut in what are likely counterterrorism-motivated surveillance operations , and to further affirm our belief that the group is a hacker-for-hire operation . ZxFunction002 This will either bind the calling process to a port or has the calling process connect to a remote host . Therefore , there are cases where these vulnerabilities are accessible via the internet .


Where possible , minimize server fingerprinting by configuring web servers to avoid responding with banners identifying the server software and version number .


Both the loader and dropped class are obfuscated using ProGuard , which obfuscates names using alphabet letters . This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge . These characteristics suggest that COBALT GYPSY executed the January and February phishing campaigns and that it created the Mia Ash persona .


The purely nominal control over the applications uploaded to these stores means attackers can conceal Trojans in apps made to look like innocent games or utilities . The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center . In this case the legitimate hpqhvind.exe was dropped by the attackers , along with their malicious hpqhvsei.dll , in C:\Windows\Temp . KillNet has remained relatively consistent in its targeting of Ukraine ’s supporters and prioritization of DDoS attacks since Russia invaded in February 2022 , and despite new capabilities , the collective has hardly altered its targeting patterns .


This local port is used by Exodus Two to execute various commands on the Android device , such as enabling or disabling certain services , or parsing app databases . Suckfly conducted a multistage attack against an e-commerce organization . Corrupted file f6876fd68fdb9c964a573ad04e4e0d3cfd328304659156efc9866844a28c7427 . imgonline-com-ua-dexifEEdWuIbNSv7G.jpg : The FBI released an advisory warning users about NFT phishing scams where developers are often approached via social media and tricked into visiting a malicious link .


While the attackers used different pretexts when sending these malicious emails , two methodologies stood out .


If that doesn ’ t work , they try to use queryUsageStats : When the malware invokes queryUsageStats , it asks for the list of applications that ran in the last 1 million milliseconds ( 16 minutes and 40 seconds ) . In this campaign , the Group123 used a classical HWP document in order to download and execute a previously unknown malware : NavRAT . control flow flattening , COSMICENERGY lacks discovery capabilities , which implies that to successfully execute an attack the malware operator would need to perform some internal reconnaissance to obtain environment information , such as MSSQL server IP addresses , MSSQL credentials , and target IEC-104 device IP addresses .


Suckfly : Revealing the secret life of your code signing certificates .


They exist in two types : the credentials stealers ( first 2 screenshots ) and the credit card grabbers ( last screenshot ) . But after 2019 SectorJ04 has changed its hacking strategy to attack using spam email . BRONZE BUTLER are also fluent in Japanese , crafting phishing emails in native Japanese and operating successfully within a Japanese-language environment .


One such immediately apparent connection was the similar deployment technique used by both XLoader 6.0 and FakeSpy . These URIs result in the download of an installer , which creates a PE of the malware typically known as HTTPBrowser , but called Token Control by the Wekby group themselves ( based upon the PDB strings found within many of the samples ) . If performing receive operations in ping mode, Glimpse makes a query with the 0 action to contact the controller for . Adversaries may utilize command - line interfaces ( CLIs ) to interact with systems and execute commands .


The sample we analyzed changed that behavior and hard-coded DWORD for each object type .


When a user enters an Internet banking site on a computer infected by banking malware ( ZeuS , Citadel ) , a request about the smartphone number and type of operating system is injected into the code of the authentication page . Kaspersky Lab documented this behavior in 2014 . Since ZxShell has been around since at least 2004 , numerous people have purchased or obtained the tools necessary to set up ZxShell command and control servers ( C&C ) and generate the malware that is placed on the victim ’s network . The RAT was likely not detected before as it has the ability to remove itself from the victim machine in time for the deployment of malware .


The root stash directory location may be read from the configuration file or set to the default location which is “ %MYPICTURES% ” .


Downeks .NET internal name is “ SharpDownloader ” , “ Sharp ” may be a reference to the language it was written in – C# .


The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method . The Plead malware is a backdoor which , according to Trend Micro , is used by the BlackTech group in targeted attacks .


The code itself is not modified by this type of obfuscation though , making the analysis easier . It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in . CTU researchers have observed multiple COBALT GYPSY campaigns since 2015 and consider it highly likely that the group is associated with Iranian government-directed cyber operations .


CTU researchers have evidence that the threat group compromised U.S. and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . In addition , the time stamp on the CA is new , which might mean that it was obtained specifically for this attack .


We now track this activity set as TEMP.Veles .


As more variants of Mirai emerged , so did the list IoT devices it was targeting .


Various recruitment posts on Chinese job sites and Chinese National Enterprise Credit Information Public System ( NECIPS ) data led us one step further , linking the actor to its legal entity name . As of the Group-IB investigation of this malware program in March 2015 , Corkow v.7.118.1.1 had not been detected by a single antivirus program . They also sell credentials from the affected systems , allowing other cybercriminals to have remote access to hotel front desks infected by the campaign . While CISA or Microsoft have yet to disclose any specific vulnerabilities the actors exploited , the CISA report does say that the APT used a Microsoft account consumer key to forge tokens and impersonate targeted users .


When a Germany-based industrial conglomerate disclosed in December 2016 that it was breached early that year , the breach was revealed to be a professionally run industrial espionage attack .


The overall infection procedure was very similar to the WFCWallet case , but with an added injection procedure , and they only used the final backdoor payload instead of using a tunneling tool .


Our decompilation of the serialization library was not complete enough to allow simple recompilation .


Broadcast Receiver Figure 4 : MyReceiver broadcast receiver . It was reported by Symantec to Microsoft in September 2018 and was patched on March 12 , 2019 . Carbanak : Anunak , Carbon Spider .


Operation AppleJeus Sequel , Lazarus continues to attack the cryptocurrency business with enhanced capabilities .


In the image below , we see the malware function that detects such dialogs when they are presented to the user , asking them to tap an option based on predefined choices . These actors scan websites for vulnerabilities to exploit to illicitly access databases . This technique was observed in previous Clayslide documents to access the script variant of the Helminth Trojan in earlier OilRig attacks .


This IP is located in Los Angeles , U.S.A. , at a hosting company named “ Emagine Concept Inc ” . The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . PROMETHIUM uses a unique set of tools and methods to perform actions like lateral movement and data Exfiltration .


The group was first publicly disclosed by FireEye in this report . The document exploited CVE-2012-0158 and will decode and write an executable to disk upon infection .


They ’re a critical component of many dangerous industrial environments such as electric power generation and oil and gas processing .


Dragos has reported that XENOTIME , the APT group behind the TRISIS (aka TRITON and HatMan) attack on a Saudi Arabian petro-chemical facility in 2017 , has expanded its focus beyond the oil and gas industries . To install and register the malicious shim database on a system , FIN7 used a custom Base64 encoded PowerShell script , which ran the sdbinst.exe” utility to register a custom shim database file containing a patch onto a system .


Within the unit , two divisions were involved in the breaches : one specializing in operations and the second in development and maintenance of hacking tools and infrastructure .


We discovered the activity originated from three separate IP addresses , all located in Chengdu , China .


The package certificate is issued under the package name , which also resembles the name of the main DLL name . They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword.exe . APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea .


This same keyword was also found in the njRAT c2 communication used in this attack .


The BRONZE PRESIDENT cyberespionage group targets NGOs , as well as political and law enforcement organizations in countries in South and East Asia .


Understanding the “ how ” and “ why ” behind different entity classifications of similar ( or even the same ) activity allows us to move beyond the dismissive approach of “ everyone has their names for marketing purposes ” to a more productive mindset that grasps the fundamental methodologies that ( should ) drive these decisions .


The sample analyzed was targeted at Russian-speaking users , as most of the user interaction pages are written in Russian . This focus on training aligns with LYCEUM’s targeting of executives , HR staff , and IT personnel . As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions to raise money for the North Korean regime .


, included the kasper PDB string reported by Unit 42 , and used similar POST and GET requests .


In their current campaign , APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros . This could include diplomats , experts in the LOCs of interest related to the Digital Economy Task Force , or possibly even journalists .


Based on Suckfly scanning for common ports , it ’s clear that the group was looking to expand its foothold on the e-commerce company 's internal network .


Project Spy ’ s earlier versions Searching for the domain in our sample database , we found that the coronavirus update app appears to be the latest version of another sample that we detected in May 2019 . Periodically , researchers at Palo Alto Networks hunt through WildFire execution reports , using AutoFocus , to identify untagged samples ' artifacts in the hopes of identifying previously undiscovered malware families , behaviors , and campaigns . The code tracks the block comparison variable in each predecessor and more ( if any conditional blocks before the predecessor ) When the marital infidelity website AshleyMadison.com learned in July 2015 that hackers were threatening to publish data stolen from 37 million users , the company ’s then - CEO Noel Biderman was quick to point the finger at an unnamed former contractor .


The loader ’ s anti-debugger code is based on the following three methods : The first call aims to destroy the debugger connection : NOTE : This call completely stops the execution of WinDbg and other debuggers The second call tries to detect the presence of a debugger : The final call tries to destroy the possibility of adding software breakpoint : Finally , if the loader is happy with all the checks done so far , based on the victim operating system ( 32 or 64-bit ) it proceeds to decrypt a set of fake bitmap resources ( stage 2 We believe recent activity targeting private interests in Vietnam suggests that APT32 poses a threat to companies doing business or preparing to invest in the country . The payload is encoded inside this image with the use of a technique called steganography , which utilizes the least significant bits of each pixel’s color code to store hidden information , without making overtly visible changes to the picture itself . The actor hunts for confidential information stored in the networks of governmental organizations , political groups and think tanks , as well as various individuals involved in defense and geopolitical related research .


The fake applications are built using WebView , a popular extension of Android ’ s View class that lets the developer show a webpage . The zip contained a sample of the Poison Ivy malware which is also known to be used by APT10 . APT38 's increasingly aggressive targeting against banks .


Unlike CosmicDuke and PinchDuke , GeminiDuke primarily collects information on the victim computer ’s configuration .


The actors likely log into sahro.bella7@post.cz and process the system information and screenshot sent by the Trojan to determine if the compromised host is of interest .


'' There are 27 response codes that the C2 can use to make requests to the trojan , which pretty much match what 's listed in the capabilities section . CTU research indicates that LYCEUM may have been active as early as April 2018 . Over time these malware similarities diverged , as did targeting , intended outcomes , and TTPs , almost certainly indicating that TEMP.Hermit activity is made up of multiple operational groups primarily linked together with shared malware development resources and North Korean state sponsorship .


They did this at least 5 times between 18 April and 15 May . LAZARUS GROUP is responsible for attacks ranging from the 2014 attack on Sony Pictures to a number of Bitcoin heists in 2017 . The backdoor installed in the machine is more customized than that used by RevengeHotels : it ’s developed from scratch and is able to collect data from the clipboard and printer spooler , and capture screenshots . Methods of manipulating control can include changes to set point values , tags , or other parameters .


If the account exists , HammerDuke will then search for tweets from that account with links to image files that contain embedded commands for the toolset to execute .


start rundll32.exe “ C:\Users\user\AppData\Local\cdnver.dll ” .


On Windows 10 , similar code integrity policies can be configured using Windows Defender Application Control . ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints . OceanLotus : {B578B063-93FB-4A5F-82B4-4E6C5EBD393B} ? 4 0 ( config+0x486 ) . The second path ( /Library / Fonts / ArialUnicode.ttf.md5.1 ) may be used to store logging information related to monitor activity that is described as follows .


We assess with high confidence that this activity is carried out on behalf of the North Korean government given malware development artifacts and targeting that aligns with North Korean state interests . We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations .


Original code of the APK on the left , versus injected APK on the right The analysis of the APK was rather interesting , because some of the actions were very common spyware features , such as the exfiltration of SMS messages , call logs and other data . The targets are military or defense industry in particular countries , it used DDNS for C2 servers , and tracked connections from their victims by using target or campaign codes , as well as disguising the malware as document file , and using a dropper to install the malware and decoy file . The malware creates 11 threads simultaneously : six threads are responsible for stealing information from the infected host , and five threads are for forwarding collected data to four cloud services ( Box , Dropbox , Pcloud and Yandex ) .


UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques . The use of InPage as an attack vector is not commonly seen , with the only previously noted attacks being documented by Kaspersky in late 2016 .


The change in the way the malware works today may be to help finance the campaign through fraudulent ad activity . APT39 's focus on the widespread theft of personal information sets it apart from other Iranian groups FireEye tracks , which have been linked to influence operations , disruptive attacks , and other threats . In this case , If this is the primary reason why someone might be after your companys data , simple preventative measures could be used to deter these attacks from happening .


This variant of HenBox also used the common green Android figure as the app logo and was named 设置 ( “ Backup ” in English ) . Considering APT-C-09 , Bitter and Donot have carried out targeted attacks against China , we must take actions in advance and keep a close eye on their recent activities . The APT18 then installed the hcdLoader RAT , which installs as a Windows service and provides command line access to the compromised system .


The Lookout Threat Intelligence team is increasingly seeing the same tradecraft , tactics , and procedures that APT-C-23 favors being used by other actors . Lazarus regrouped and rushed into new countries , selecting mostly poorer and less developed locations , hitting smaller banks because they are , apparently , easy prey . In one instance , a large U.S. company was attacked in the same month a Middle Eastern company it co-owns was also compromised . The techniques leveraged during the incident suggest a growing maturity of Russia ’s offensive OT arsenal , including an ability to recognize novel OT threat vectors , develop new capabilities , and leverage different types of OT infrastructure to execute attacks .


The most likely conclusion that can be drawn here is that an analyst or researcher obtained this file , modified it to see the content ( misspelling the variable name along the way ) post-decoding , and uploaded it to see what it did in a sandbox .


This version adds one significant class — it requests DEVICE_ADMIN privileges . Named Trochilus , this new RAT was part of Group 27 's malware portfolio that included six other malware strains , all served together or in different combinations , based on the data that needed to be stolen from each victim . WATERSPOUT : APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted .


The impacted versions of the UPX library are 3.94 , 3.93 , and 3.92 .


EVENTBOT INFRASTRUCTURE By mapping the C2 servers , a clear , repeated pattern emerges based on the specific URL gate_cb8a5aea1ab302f0_c . The basic chain of events upon execution of the MSIL dropper include dropping and executing both a PDF decoy and a Javascript (JS) dropper . Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as Oilrig1 and CopyKittens2 .


At the time of writing this research , four versions of the EventBot malware were observed : Version 0.0.0.1 , 0.0.0.2 , and 0.3.0.1 and 0.4.0.1 . This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others . In December 2015 , Unit 42 published a blog about a cyber espionage attack using the Emissary Trojan as a payload .


We assess that APT10 likely compromised Visma with the primary goal of enabling secondary intrusions onto their client networks , and not of stealing Visma intellectual property . The exploit document carrying this alternate KeyBoy configuration also used a decoy document which was displayed to the user after the exploit launched .


In some versions , the server would only return valid responses several days after the apps were submitted . In the next incident , also in 2017 , software updates for the legitimate computer cleanup tool CCleaner was found to have been compromised by hackers to taint them with the same ShadowPad backdoor . The hook installed by ZxShell implements one of its filtering routine . A full report describing the timeline of DUCKTAIL ’s activities , a detailed analysis of its malware component , and appendices containing indicators of compromise , Yara detection rules , metadata , and MITRE ATT&CK techniques can be downloaded from a link on this page .


specifically CVE-2018-0798 , before downloading subsequent payloads . Thus far , Bahamut 's campaigns have appeared to be primarily espionage or information operations – not destructive attacks or fraud .


spear phishing : 69.87.223.26 .


For the hardware virtualization check , the loader obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list . Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations foreign governments . This particular OceanLotus malware loader attempts to imitate McAfee ’s McVsoCfg DLL and expects to be side-loaded by the legitimate " On Demand Scanner " executable . Seven of the vulnerabilities included in today ’s Vulnerability Roundup have a CVSS severity score of 9.8 out of a possible 10 .


In actual fact , the Trojan does not block anything and the phone can be used without any problems . The primary backdoor used in the Epic attacks is also known as " WorldCupSec " , " TadjMakhal " , " Wipbot " or " Tavdig " . Here is a short list of the types of tools included with ZxShell : A rough translation of this message is as follows : Hack520 seems to be very interested in hosting services and his profile fits that of a system administrator profile with some programming and hacking skills .


In the past , we ’ve seen groups such as Equation and Flame use malware to steal data from air-gapped networks .


The “ Init ” export establishes connection to port 80 of a C2 server using Wininet API .


C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Blaster.lnk :


Bahamut was shown to be resourceful , not only maintaining their own Android malware but running propaganda sites , although the quality of these activities varied noticeably . In comparison to other threat groups , TG-3390 is notable for its tendency to compromise Microsoft Exchange servers using a custom backdoor and credential logger .


Lurk uses a form of steganography : that's where one file is hidden away inside another file of a completely different sort , such as an image , audio , or video file . In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task .


RuMMS Samples , C2 , Hosting Sites , Infections and Timeline In total we captured 297 RuMMS samples , all of which attempt to contact an initial C2 server that we extracted from the app package . The use of script-based backdoors is a common technique used by the OilRig group as we have previously documented . We already published a couple of articles about ROKRAT ( here , here , here and here ) where another unrelated actor , Group123 , made the same choice but with different providers . Other interesting anomalies in June include 47 attacks on the Manufacturing industry ( which usually averages around 20 attacks a month ) and notable increases in attacks on Switzerland ( 14 ) and Brazil ( 13 ) , both of which are normally attacked only two or three times a month .


Application Recording — Stealing OTPs and TANs The feature that makes TrickMo different from standard SMS stealers is its unique ability to record the screen when targeted apps are running . The tool then starts a new web browser instance on the attacker’s system and submits credentials on the real VPN portal . the group 's targets include an organization in Sweden .


In 2016 , the Mirai botnet was discovered by the malware research group MalwareMustDie .


It helps the attacker find out which banks the owner of the smartphone calls – the Trojan receives a list of bank phone numbers from its C & C server . The witnessed techniques , tactics and procedures ( TTPs ) are in-line with what we usuallysee in Turla 's operation : a first stage backdoor , such as Skipper , likely delivered through spearphishing followed by the appearance on the compromised system of a second stage backdoor , Gazerin this case . Winnti : hpqhvind.exe . The configuration contains two C2 servers that are prefixed with a protocol identifier .


In addition to the notably overt and large-scale campaigns with CozyDuke and CloudDuke , the Dukes also continued to engage in more covert , surgical campaigns using CosmicDuke .


Suckfly made its malware difficult to analyze to prevent their operations from being detected .


We also registered one episode of mobile malware spreading via a third-party botnet . The main command and control ( C&C ) server used in this attack is hosted on an IP address which belongs to a Ukrainian ISP , specifically to a MikroTik router running a firmware version released in March 2016 . In the case where the parent process is hpqhvind.exe , this sequence of bytes is present at this exact location and the malicious DLL will proceed to patch the parent process in memory . Sometimes this was a high profile , legitimate site such as ‘ diplomacy.pl ’ hosting a ZIP archive .


Neptun is installed on Microsoft Exchange servers and is designed to passively listen for commands from the attackers . Group-IB specialists detected various sites used by criminals to spread the Trojan : mail tracking websites , news portals , electronic books , computer graphics resources , music portals , etc .


These attacks deliver the Spark and Pierogi backdoors for politically-driven cyber espionage operations .


To lure the victims to download the malware , threat actors use SMS phishing – sending a short SMS message containing a malicious URL to the potential victims . Although most malware today either seeks monetary gain or conducts espionage for economic advantage , both of these activity groups appear to seek information about specific individuals . Thanks to this exploit ( Remote Code Execution exploit ) the user interaction is not required , in fact the “ enable macro ” button is not shown . Criminals are also using malvertising via search engines to lure potential victims in .


There is some infrastructure overlap in the C2 servers used by almost all of the FakeM variants , as well other Trojans such as MobileOrder , Psylo , and CallMe . Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents .


We determined that this chunk of data contains an array of opcode instructions ready to be interpreted by a custom virtual machine program ( from this point on referenced generically as “ VM ” ) implemented by FinFisher authors . APT threat actors , most likely nation state-sponsored , targeted a diplomat in the French Ministry of Foreign Affairs with a seemingly legitimate invitation to a technology conference in Taiwan . That C&C server served the latest version of the MUI files encrypted with a static RC5 key . A recent report from the United Kingdom ’s National CyberSecurity Center ( NCSC ) highlights how the accessibility of these tools “ lowers the barrier to entry to state and non - state actors in obtaining capability and intelligence . ”


Why would OurMine want to target WikiLeaks . Silence 's successful attacks currently have been limited to the CIS and Eastern European countries .


Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release . Next , in an effort to demonstrate it wasn't relegated to China , CrowdStrike exposed Clever Kitten , an actor we track out of Iran who leverages some very distinct TTPs when viewed next to a more visible adversary .


Enforce secure network authentication , where possible .


( Please note this is a different app and not the same as the one being spread by hxxp : //tiny [ . Gamaredon Group primarily makes use of Russian hosting providers in order to distribute its malware . The following is an example Python function to decode these strings . libxselinux.old : 7f4764c6e6dabd262341fd23a9b105a3 dc96d0f02151e702ef764bbc234d1e73d2811416 ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23 .


The members of the group use a variety of tools , including CCleaner , on a daily basis to effectively remove any evidence of their operations . Additionally , the targeting of a French diplomat based in Taipei , Taiwan aligns with previous targeting by these actors , as does the separate infrastructure .


It indicates perhaps an interesting trend which is exploiting the trust relationships between the two communities . Compared to Patchwork , whose Trojanized documents exploit at least five security flaws , Confucius' backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 . Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information .


The malware continues by creating a service named mssecsvc2.0 with a binary path pointing to the running module with the arguments -m security . Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers .


C:\Users\[user name]\Downloads\Telegram Desktop\UnionCryptoTraderSetup.exe .


CTU researchers have observed TG-3390 actors using tools that are favored by multiple threat groups :


Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . The decoy documents used by the InPage exploits suggest that the targets are likely to be politically or militarily motivated .


FANCY BEAR ( also known as Sofacy or APT 28 ) is a separate Russian-based threat actor , which has been active since mid 2000s , and has been responsible for targeted intrusion campaigns against the Aerospace , Defense , Energy , Government and Media sectors .


Timebombs , Dynamic Code Loading and Reflection If Google Bouncer was not detected , the application starts a time bomb which initiates the malicious flow only after 20 seconds and will run every 2 hours . Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() . But the group has also used Poison Ivy ( PIVY ) , a RAT more commonly associated with threat actors in China — so much so that PIVY has , inaccurately , become synonymous with all APT attacks linked to China .


German Bundestag & Political Parties :


With the ability to hide its icon from the launcher and hijack popular existing apps on a device , there are endless possibilities to harm a user ’ s digital even physical security . Group-IB Bot-trek TDS sensors are in place at a number of financial institutions and , unfortunately , we register that currently Corkow malware is present on 80% of protected corporate systems . They explain why the company has chosen to book that particular hotel . ( Vox , USA Today )


BLOCKER_BANKING_START – display phishing HTML page for entry of bank card details . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address .


Additionally , there is evidence to suggest APT33 targeted Saudi Arabian and Western organizations that provide training , maintenance and support for Saudi Arabia 's military and commercial fleets . A researcher has attributed a recently publicized attack on Citrix' internal network to the Iranian-linked group known as IRIDIUM – and said that the data heist involved 6 terabytes of sensitive data .


This data shows a distinct concentration of infected devices beaconing from Gaza , Palestine . By the end of April , GozNym had redirection instructions for 17 Polish banks in its repertoire , along with an extra 230 URLs designed to assist attackers in targeting community banks and email service providers in the Eastern European country . The domain names and IP addresses together comprise APT1 ’s command and control framework which they manage in concert to camouflage their true origin from their English speaking targets . There are a few reasons why attackers may opt to pay for an as - a - service malware tool for their chosen campaign : • As - a - service saves attackers time .


Much like the observers watching the shadows of objects cast upon the wall of the cave , these two definitions ( XENOTIME and TEMP.Veles , both presumably referring to “ the TRITON actor ” ) describe the same phenomena , yet at the same time appear different .


Communication with C & C Although Asacub ’ s capabilities gradually evolved , its network behavior and method of communication with the command-and-control ( C & C ) server changed little . Based on analysis of the group 's SWCs , TG-3390 operations likely affect organizations in other countries and verticals . We will continue to observe the group ’s activities as they target industries from the United States and Europe . The purpose of these socially engineered lures is to convince the targeted users to enable macros , thereby allowing the execution chain to commence .


Installation process with administrative privilege This installation method is more interesting because it reveals how the malware tries to achieve stealthier persistence on the machine . Further analysis revealed a well-established collection of fake social media profiles that appear intended to build trust and rapport with potential victims . Implementation of an additional anti-analysis check that compares the name of the parent process to a string stored in an encrypted resource . The opportunities for governments and law enforcement to use spyware as part of legal investigations led to the development of commercial spyware .


Cannon gathers system information and saves it to a file named ini .


In April Novetta released its excellent report on the Winnti malware spotted in the operations of Axiom group . Silence attacked financial organisations in the UK . Silence conducted the first stage of their Asian campaign , organising a massive phishing attack aimed at receiving an up-to-date list of current recipients in different countries for further targeted attacks delivering their malicious software . The attackers used the server deployed on 6 June 2019 to control compromised workstations in these banks . On 24 March 2019 , Silence.ProxyBot MD5 2fe01a04d6beef14555b2cf9a717615c ) was uploaded to VirusTotal from an IP address in Sri Lanka . On October 18th , 2018 , the group sent out emails to British financial companies as part of their preparatory campaign . Group-IB experts established that the server 185.20.187.89 started functioning no later than 28 January 2019 . According to local media reports , in 2019 Silence successfully withdrew money from the Bangladeshi bank twice within 2 months . To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank . As we described in Silence: Moving into the darkside report , Silence has experience with theft using compromised card processing systems . In February 2019 , Russian media7 reported a Silence attack on IT Bank in the city of Omsk . On 16 January 2019 , Silence sent out phishing emails with malicious attachments disguised as invitations to the International Financial Forum iFin-2019 .


] com hxxp : //nttdocomo-qaq [ . We have reasons to believe that the operators of the APT28 network are either Russian citizens or citizens of a neighboring country that speak Russian . ThreatSight worked with the Threat Analysis Unit ( TAU ) to research the campaign . Beyond basic cybersecurity hygiene , including auditing current IT environments for vulnerabilities , implementing needed patches and regularly employing backups , its imperative to have multifactor authentication as a minimum on any externalfacing RDP , whilst preferably removing externalfacing RDP altogether .


In the past , Sednit used a similar technique for credential phishing .


The VBA drops and executes a new variant of Seduploader .


The first set of commands gathers information about the victim ’s computer and environment :


] comgooogel [ . The Cloud Atlas implants utilize a rather unusual C&C mechanism . The HTRAN utility is merely a middle-man , facilitating connections between the victim and the attacker who is using the hop point . It contains features such as having the victim ’s email address pre - filled and displaying their appropriate company logo and background image , extracted from the target organization ’s real Microsoft 365 login page .


Nmap — BRONZE PRESIDENT used this freely available network scanning tool from the C:\PerfLogs\ folder .


This background image likely contains a fake “ software update ” screen . Alternatively , OurMine might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address . The group has maintained a low profile until now and its targets have been mainly organizations and individuals that would be of interest to a nation state 's intelligence services .


Segment networks and segregate them into security zones .


“ These communication channels are hard to discover and even harder to block entirely . In July 2018 , following a trend we have observed across the entire BEC threat landscape , Scattered Canary changed their preferred cash out mechanism from wire transfers to gift cards . Lazarus attacks are not a local problem and clearly the group 's operations span across the whole world .


'' This security hole is currently present in every operating system image for A83T , H3 or H8 devices that rely on kernel 3.4 , he added . In March 2018 we detected an ongoing campaign . Winnti Group targeting universities in Hong Kong . Once a system was exploited a unique downloader was dropped onto the victim ’s disk , containing a customized micro backdoor written in Assembler .


Each of these layers seems to be different to some extent in the various samples we found .


Should a device become infected , this backdoor can not be removed without root privilege . The basic principles of targeted attacks on financial institutions have not changed since 2013 when the Anunak , Corkow , Buhtrap , and Lurk groups began conducting the first attacks on Russian banks . So the next block of the first one in the level can not be determined . Information about executed programs that violate one or more of these rules is recorded in the XProtect Database ( XPdb ) , which is stored in SQLite 3 format and located at /var / protected / xprotect / XPdb .


The second type of apps reveals an evolution in the author 's tactics . This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files . The ELMER variant 6c33223db475f072119fe51a2437a542 beaconed to the C2 IP address 121.127.249.74 over port 443 . The final payloads include the AgentTesla remote access trojan ( RAT ) , Cobalt Strike beacons and njRAT .


Infrastructure :


While it ’ s not the first of its kind , this Android malware app is more sophisticated than similar apps and possesses interesting features that enable its operators to steal transaction authorization codes from victims who download the app . Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer . The use of script-based backdoors is a common technique used by the OilRig group as we have previously documented .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


Unit 42 followed network traces and pivoted on the information left behind by this actor , such as open directories , document metadata , and binary peculiarities , which enabled us to find a custom-made piece of malware , that we named " CapturaTela " . One of Silence 's first targets was a Russian bank , when they tried to attack AWS CBR .


It then uses the AlarmManager to set a pending intent that will run its own service after a predefined interval . The individuals using Hancitor malware also known by the name Chanitor are no exception and have taken three approaches to deliver the malware in order to ultimately steal data from their victims . The tester created the final test file less than 8 hours before the creation time of a delivery document , which was then delivered via a spear-phishing email 20 minutes later .


] it ( " attiva '' is the Italian for " activate '' ) . The ultimate objective of targeted attacks is to acquire sensitive data . Takes screenshots from the infected machine . RDP is designed to allow legitimate users to remotely connect to and control a system , such as when IT support needs to remotely control an employees computer to troubleshoot an issue or conduct regular maintenance .


Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . But two tools used were unique to the group : ASPXTool , an Internet Information Services ( IIS ) specific " Web shell " used to gain access to servers inside a target 's network ; and the OwaAuth credential stealing tool and Web shell , used to attack Microsoft Exchange servers running the Web Outlook interface .


These attacks are still largely perpetrated via spear phishing campaigns , whether via simple executable attachments in hopes that a victim will launch the file to using a previously observed DDE exploitation technique .


This visual context enables SOC personnel to investigate alerts with all related artifacts , understand the scope of the breach , and prepare a comprehensive action plan .


It is important to give certificates the protection they need so they can't be used maliciously .


For example : Conclusions The Skygofree Android implant is one of the most powerful spyware tools that we have ever seen for this platform . Madcap” is similar to the XAgent malware , but the former is focused on recording audio . We have previously observed the admin@338 group use BUBBLEWRAP .


If the system has been previously infected with a cryptominer , it also attempts to kill the running miner and all its related activities .


] 122:28844 61 [ . Secondly , the value the Dukes intended to gain from these MiniDuke campaigns may have been so great that they deemed it worth the risk of getting noticed . This additional payload is then executed in memory . Cisco Secure Malware Analytics ( Threat Grid ) identifies malicious binaries and builds protection into all Cisco Secure products .


If mcpef.apk is removed , brother.apk reinstalls it from a META-INF/brother file boy , post.sh : The shell scripts u sed for application persistency . In April , 2018 , the 360 Core Security takes the lead in capturing the APT-C-06 group’s new APT attack using 0-day vulnerabilities (CVE-2018-8174) in the wild . Security researchers subsequently linked these attacks to a broader , yearlong campaign that targeted not just Israelis but Palestinians as well .


We observed several samples of Zebrocy using this user agent targeting the foreign affairs ministry of a large Central Asian nation .


The now infamous Dridex banking Trojan can trace much of its DNA to Cridex and Bugat .


This suggests that the Sofacy group is confident that the targeted individuals would be interested enough in the content to peruse through it .


As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware . Back in February 2016 , Indian army officials issued a warning against the usage of three apps , WeChat , SmeshApp , and Line , fearing that these apps collected too much information if installed on smartphones used by Indian army personnel .


How does Chrysaor work ? On September 15 and 19 , 2017 , Proofpoint detected and blocked spearphishing emails from this group targeting a US shipbuilding company and a US university research center with military ties . The configuration consists of four fields : This incident and last year ’s INDUSTROYER.V2 incident both show efforts to streamline OT attack capabilities through simplified deployment features .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 . The above network shows relationships between three tools used by Hidden Lynx during its VOHO campaign : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit .


These improvements render FakeSpy one of the most powerful information stealers on the market . This investigation by the Agari Cyber Intelligence Division into the cybercriminal group we’ve named Scattered Canary offers unprecedented visibility into eleven years of fraud and criminal activities , and the growth of a 419 startup into a fully operational BEC business . DHS has previously released Alert TA14-353A .


In April , security researchers in the Microsoft Threat Intelligence Center discovered infrastructure of a known adversary communicating to several external devices .


Finally , the app can remove itself through three ways : Via a command from the server Autoremove if the device has not been able to check in to the server after 60 days Via an antidote file . TEMP.Periscope overlaps in targeting , as well as tactics , techniques , and procedures ( TTPs ) , with TEMP.Jumper , a group that also overlaps significantly with public reporting on NanHaiShu . Domain names were carefully chosen to look like they are related to the game or application publisher . When the malware is executed , it attempts to run the following commands , most of which attempt to stop various security and backup related software


Symantec worked with the certificate owner to confirm that the hacktool was not associated with them .


The ransom demand for 0.2 Bitcoins ( roughly $ 180 ) is a much higher ransom demand than has been seen in mobile ransomware so far . He is responsible for developing tools for conducting attacks and is also able to modify complex exploits and third party software . In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software : browsers , email clients , messengers , etc. , and can act as a keylogger . Monitor for newly constructed user accounts that may attempt to hide artifacts associated with their behaviors to evade detection .


Such devices still must be identifiable , maintained , and monitored by security teams , especially in large complex enterprises .


The webshell named bitreeview.aspx was saved to a folder within the SharePoint server ’s install path .


The campaign ’s lure content revolves around recent geopolitical events , espeically the Israeli-Palestinian conflict , the assassination of Qasem Soleimani , and the ongoing conflict between Hamas and Fatah Palestinian movements .


Another set of attacks called Operation Erebus leverages another Flash exploit , CVE-2016-4117 , and relies on watering hole attacks as a means of propagation . Government officials said they knew the initial attack occurred in 2011 , but are unaware of who specifically is behind the attacks .


'' in a variety of ways , such as static analysis , dynamic analysis , and machine learning . The first attack in the US that Group-IB attributes to MoneyTaker was conducted in the spring of 2016 : money was stolen from the bank by gaining access to First Data 's " STAR " network operator portal . Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability , and the local Windows privilege escalation vulnerability CVE-2015-1701 . Approximately twenty days later , the attacker placed another web shell on a separate Microsoft Exchange Server .


After launching , it hides its presence on the system and checks the defined Twitter account at regular intervals for commands . The first type of attack Scattered Canary pivoted to was credential phishing . Utilizing KillDisk in the attack scenario most likely served one of two purposes : the attackers covering their tracks after an espionage operation , or it was used directly for extortion or cyber-sabotage .


Before connecting with the socket , it creates a malware environment in ‘ APPDATA/myupd ’ and creates a sqlite3 database there – ‘ myupd_tmp\\mng.db ’ : CREATE TABLE MANAGE ( ID INT PRIMARY KEY NOT NULL , Send INT NOT NULL , Keylogg INT NOT NULL , Screenshot INT NOT NULL , Audio INT NOT NULL ) ; INSERT INTO MANAGE ( ID , Send , Keylogg , Screenshot , Audio This time the document purported to be about the involvement of the Emir of Qatar in funding ISIS , which was seemingly copied from a website critical of Qatar . FIN4 is a financially motivated threat group that has targeted confidential information related to the public financial market , particularly regarding healthcare and pharmaceutical companies , since at least 2013 .


Earlier this year , Cybereason identified an advanced , persistent attack targeting telecommunications providers that has been underway for years , soon after deploying into the environment . Deepen told Threatpost the group has been operating since at least since 2008 and has targeted China and US relations experts , Defense Department entities , and geospatial groups within the federal government .


COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites . This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample .


Google officials removed the malicious apps from the Play market after receiving a private report of their existence . While some members within the Romeo and Sierra groups may not implement sound authentication strategies , shift their design focus in abrupt and unusual manners , and fail to understand the pitfalls of distributed command networks , on the whole the families within the Lazarus Group 's collection of RATs and staging malware perform their tasks with surprising effectiveness . Elfin also makes frequent use of a number of publicly available hacking tools , including : Will Harrison was terminated as an Ashley Madison employee in November 2011 , and by early 2012 he ’d turned his considerable harassment skills squarely against the company .


MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “ POWERSTATS ” .


The commands are self-explanatory and show the features included in the malware . Interestingly , while most Blue Lambert variants have version numbers in the range of 2.x , Green Lambert is mostly in 3.x versions . We found more than 40 of these campaign tags . Though Google meant to have this parameter be used to mention the page the user visited , we used it to exfiltrate the user name and password data encoded in base64 .


The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems . OSX_DOK.C seems to be another version of WERDLOD ( Detected by Trend Micro as TROJ_WERDLOD Family ) , which is a malware that was used during the Operation Emmental campaigns—an interesting development that we will tackle further in this blog post .


Receiver was involved in receiving commands from the Server and the main functionality of Sender was to send all the data collected to the C & C over Wi-Fi . To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank . One of the Cobalt Group 's latest campaigns , an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor , was investigated and presented by the Talos research team .


On September 10 , 2019 , we observed an HTTP POST request to the following URL that we believe was the exploitation of CVE-2019-0604 in a publicly facing SharePoint server ( T1190 ) : /_layouts/15/picker.aspx .


After the modules are installed they are deployed to the short term memory and deleted from the device storage , which makes the Trojan a lot harder to catch . ScarCruft 's Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . Helminth executable samples send artifacts within network beacons to its C2 server that the Trojan refers to as a ' Group ' and ' Name ' .


In this case , Group 74 did not use an exploit or any 0-day but simply used scripting language embedded within the Microsoft Office document .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , government , and media for espionage and destructive purposes , since at least 2011 . The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


Retrieve media exchanged through WhatsApp . Forensic analysis indicates that the APT has been operational since at least June 2011 and was still active in 2016 . In one instance , it lures victims to open an email attachment . Rhysida , a new ransomware gang claiming to be a " cybersecurity team , " has been in operation since May 17 , 2023 , making headlines for their high - profile attack against the Chilean Army .


This is done by reading the /proc/ [ pid ] /cmdline file . Operation Ghoul is one of the many attacks in the wild targeting industrial , manufacturing and engineering organizations , Kaspersky Lab recommends users to be extra cautious while checking and opening emails and attachments . This additional obfuscation puts yet another layer between APT17 and the security professionals attempting to chase them down . • Based on the analysis , it appears that the MiniDuke - s creators provide a dynamic backup system that also can fly under the radar – if Twitter isn - t working or the accounts are down , the malware can use Google Search to find the encrypted strings to the next C2 .


Another evasive mechanism used by the backdoor is how it checks whether an Arabic keyboard and Arabic language settings are used on the infected machine .


In two of the cases , the passwords for the devices were deployed without changing the default manufacturer ’s passwords and in the third instance the latest security update had not been applied to the device .


As can be seen , the possibilities offered by the bot are pretty common . The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system . Kaspersky found the BlackOasis group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


Due to artefacts left in the loader during compilation time however , we know that it used a specific version of the Boost library , 1.54.0 , that was only published on the 1st of July 2013 .


The application downloads the file and dynamically loads it using dalvik.system.DexClassLoader and invokes class and method specified in json . The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components . The threat actor 's known working hours align to Chinese Standard TIME ( CST ) and its targeting corresponds to that of other known China-based threat actors , which supports our assessment that these campaigns are conducted by APT10 .


The second stealing function is the onStartCommand , which steals infected device data and additional information . Unfortunately , we do not have access to the PYTHON33.hlp or CreateTsMediaAdm.hlp files , so we do not know the final payload loaded by either of these DLLs . We believe that the Ke3chang attackers are operating out of China and have been active since at least 2010 .


What is less common is that the name used for the mutex is often a timestamp .


SELECTED SAMPLES Package Name SHA-256 Digest com.rabbit.artcamera 18c277c7953983f45f2fe6ab4c7d872b2794c256604e43500045cb2b2084103f org.horoscope.astrology.predict 6f1a1dbeb5b28c80ddc51b77a83c7a27b045309c4f1bff48aaff7d79dfd4eb26 com.theforest.rotatemarswallpaper 4e78a26832a0d471922eb61231bc498463337fed8874db5f70b17dd06dcb9f09 Binders are delivered by attack vectors ( such as phishing and watering hole attacks ) onto a machine . The most common ports used are , 80, 1985, 1986, and 443 . 1985 is the default port for the malware , 1986 is the lazy variation of that port . For this year 's State of Malware report we asked : What do resource constrained organizations need to know in 2023 ?


Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download . Usually , the delivered payload is either the well-known ' PlugX ' or ' HTTPBrowser ' RAT , a tool which is believed to have Chinese origins and to be used only by certain Chinese hacking groups .


Additionally , should the command-and-control ( C & C ) servers get seized by the authorities , it would ultimately lead to disclosing information about the entire botnet . In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks . Considering that the afterhack publications by the media mentioned that the investigation stumbled upon three different attackers , it was not obvious whether Lazarus was the one responsible for the fraudulent SWIFT transactions , or if Lazarus had in fact developed its own malware to attack banks ' systems .


All included decoy document written in Arabic ( all related to Middle Eastern politics ) or Hebrew .


During this period of transition , CosmicDuke would often embed PinchDuke so that , upon execution , CosmicDuke would write to disk and execute PinchDuke .


It also starts an Android service named MainService . Gaza Cybergang Group3 (highest sophistication) whose activities previously went by the name Operation Parliament . Use of these protocols is thoroughly documented in the Novetta and Kaspersky reports .


Typically , their primary goal is to obtain domain administrator credentials and/or gain access to a system storing intellectual property .


" This malware employs several tactics to keep its activity hidden , meaning users might be unaware of its existence on their device . While the tools profiled in this report are not inherently malicious , their capabilities are nonetheless integral to the Lazarus Group 's cyber operations , both espionage and destructive in nature , making them inherently dangerous to potential victims . Elfin has deployed a wide range of tools in its attacks including custom malware , commodity malware , and open-source hacking tools . A careful analysis of the domain registrations from this threat actor between 2014 and 2015 allowed us to identify one profile used to register several domains that were used as C&C servers for a particular malware family employed by the Winnti group .


The target 's job function , corporate email address , information on work related projects , and publicly accessible personal blog could all be freely found online .


RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism . We suspect the Kazuar tool may be linked to the Turla threat actor group ( also known as Uroburos and Snake ) , who have been reported to have compromised embassies , defense contractors , educational institutions , and research organizations across the globe .


The new SOL protocol within the PLATINUM file-transfer tool makes use of the AMT Technology SDK 's Redirection Library API ( imrsdk.dll ) . To mitigate the threat of the described campaign , security teams can consider blocking access to the C2 server 103.236.150.14 and , where applicable , ensure that the Microsoft Security Update KB2553204 is installed in order to patch the CVE-2017-11882 vulnerability .


Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit.MSWord.CVE-2010-333 , Exploit.Win32.CVE-2012-0158 . TG-3390 actors have used Java exploits in their SWCs .


this instance ) from the launcher view on their device , as shown in Figure 3 below . Targeted telecom companies spanned several countries , and recently identified intrusions were concentrated in countries where we had not identified any prior APT41 activity . CTU researchers assess with moderate confidence that the group is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government .


However , the security of these stores and the apps they sell aren ’ t always verified . As detailed in the DOJ complaint , a sample of WHITEOUT ( aka Contopee ) malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank . is always even . The executable within this not only played a very funny video , but dropped and ran another CozyDuke executable .


Figure 4 . In addition , Emissary appears to against Taiwan or Hong Kong , all of the decoys are written in Traditional Chinese , and they use themes related to the government or military . ESET telemetry shows victims are mostly located in Asia , with Thailand having the largest part of the pie . Depending on the platform and on how the code is compiled , these vulnerabilities could lead to arbitrary code execution : Talos is disclosing these vulnerabilities despite no official fix from Open Babel .


] net The overlaps between the Henbox , PlugX , Zupdax , and Poison Ivy malware families involves a web of shared C2s and IP resolutions centered around the below : 59.188.196 [ . APT41 has also been observed modifying firewall rules to enable file and printer sharing to allow for inbound Server Message Block (SMB) traffic . In the latter case however , the Dukes group appear to have also simultaneously developed an entirely new loader , which we first observed being used in conjunction with CosmicDuke during the spring of 2015 .


In addition , Dell analysts have assessed with high-confidence these activities are attributable to Iranian state-sponsored activities .


The stealer searches for files 60mb and less with these extensions : .doc , .docx , .xls , .xlsx , .ppt , .pptx , .exe , .zip , .rar .


We needed to do this to understand the techniques FinFisher uses to compromise and persist on a machine , and to validate the effectiveness of Office 365 ATP detonation sandbox , Windows Defender Advanced Threat Protection ( Windows Defender ATP ) generic detections , and other Microsoft security solutions . APT40 has been observed leveraging a variety of techniques for initial compromise , including web server exploitation , phishing campaigns delivering publicly available and custom backdoors , and strategic web compromises . The data is XOR encrypted with the key “ *&b0i0rong2Y7un1 ” and base64-encoded . In each case , CrowdStrike reviewed the relevant logs and determined there was no evidence of exploitation of CVE-2022 - 41040 for initial access .


But some clues , such as the existence of a hidden menu for operator control , point to a manual installation method – the attackers used physical access to a victim ’ s device to install the malware . According to trusted third-party reporting , HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace , telecommunications , and finance industries . Later at 20:57 , the attackers became active on the compromised machine and proceeded to download the archiving tool WinRAR . 89.34.237.118 808 http://89.34.237.118:808/Rar32.exe . Based on the use of domain names they registered , the group started out in the business of fake / rogue anti - virus products in 2007 .


Infecting legal web resources help spread mobile malware via popular websites . For example , at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network . Furthermore , the encrypted payload is neither embedded in the overlay nor located in a COM1:NULL.dat alternate data stream . If implemented correctly , PIEHOP can connect to a user supplied remote MSSQL server for uploading LIGHTWORK and issuing remote commands specifically targeting RTU , and then delete itself .


Ultimately , the epistemic foundation of the behavior-based naming approach makes this irrelevant for tracking ( and labeling for convenience sake ) observations .


OCTOBER 2014 THROUGH SEPTEMBER 2015 , FireEye iSight Intelligence identified changes made to domain name server ( DNS ) records that suggest that APT28 intercepted email traffic from the Kyrgyzstan Ministry of Foreign Affairs after maliciously modifying DNS records of the ministry ’s authoritative DNS servers .


PVE Find AD User — This command-line tool identifies login locations of Active Directory ( AD ) users .


All of these methods attempt to space out the introduction of possible signals in various stages , testing for gaps in the publication process . Once the Barium Defendants have access to a victim computer through the malware described above , they monitor the victim 's activity and ultimately search for and steal sensitive documents ( for example , exfiltration of intellectual property regarding technology has been seen ) , and personal information fi"om the victim 's network . Sending the help command for each , you can see the extra features added between version 3.1 and 3.2 . The “ ExecStart ” value specifies the path of the program to be run , which in this case was GOGETTER .


If the malware determines that is not running on an emulator , it then performs additional checks to ensure that it wo n't be detected . We observed Moafee running HTRAN proxies on their multiple Command and Control ( C2 ) servers – all operated on CHINANET , and hosted in Guangdong Province . ShadowHammer : HEUR : Trojan.Win32.ShadowHammer.gen . The first step is the previously unknown OWA exploit technique .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . specifically CVE-2018-0798 , before downloading subsequent payloads .


This recurring , blindingly-fast Sofacy attack attracted our attention as neither sample was delivered through a zero-day vulnerability — instead , they appeared to be downloaded and installed by another malware .


On installation , the app requests the user to provide SMS storage access and high Android privileges such as Device Admin . Shrouded Crossbow targeted privatized agencies and government contractors as well as enterprises in the consumer electronics , computer , healthcare , and financial industries . So much so that Microsoft did a takedown in 2012 . It is therefore recommended to set the code only as a response for or methods and to use instead , as the method change is explicitly prohibited in that case .


After installation , the malware connects to the designated Command and Control ( C & C ) server , and receives a command to perform . Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data exfiltration and to provide remote access to infected machines . On April 22 , 2015 , Suckfly exploited a vulnerability on the targeted employee 's operating system ( Windows ) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack .


Potentially malicious iOS connection Using the codes and “ Concipit1248 ” to check for more versions , we found two other apps in the App Store . It is highly likely that this threat is far more widespread and we urge financial institutions around the world to scan their networks for signs of the Metel malware . the following microcode graph shows edi is assigned to esi ( the block comparison variable in this case ) Rhysida appears to have first popped up back in May , with several high - profile compromises posted on their leak site .


The packet is serialized into a stream of bytes .


When analyzing the Ginp ’ s recent samples , ThreatFabric analysts found some similarities with the famous Android banking Trojan . The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process . It turned out that the DLL files we found are a custom variant of Gh0st RAT , and the EXE files download the RAT .


The certificates are only as secure as the safeguards that organizations put around them .


Once installed , the application requests permissions so that it may control SMS messages and steal sensitive data on the device , as well as proliferate to other devices in the target device ’ s contact list . These RAT families are discussed in Novetta’s other report on the Lazarus Group’s RAT and Staging capabilities . The fact that Gallmaker appears to rely exclusively on LotL tactics and publicly available hack tools makes its activities extremely hard to detect .


( It is specified in the interception template whether a reply must be sent , and which text should be sent to which address . The vulnerability exists in the old Equation Editor ( EQNEDT32.EXE ) , a component of Microsoft Office that is used to insert and evaluate mathematical formulas . In November 2017 , CTU researchers discovered the North Korean cyber threat group , known as Lazarus Group , had launched a malicious spearphishing campaign using the lure of a job opening for the CFO role at a European-based cryptocurrency company .


Four files tested in 2014 are based on the open-source project , cryptcat .


Release_Time : 2015-05-28


Apps that have this permission can draw a window that belongs to the system group and can ’ t be dismissed . Beginning in early March 2018 , Unit 42 started observing Gorgon group attacks against Russian , Spanish and United States government agencies operating in Pakistan . Additionally there is a known issue with the result ( e.g , the remaining loop or paradoxical decompiled code ) With regards to these similarities , we highlight the following trends which could manifest in future OT malware : •


We have also found a Russian-language error message in many PinchDuke samples which translates as , “ There is an error in the module ’s name ! The length of the data section name must be 4 bytes! ” Additionally , Kaspersky noted that based on the compilation timestamps , the authors of the Duke malware appear to primarily work from Monday to Friday between the times of 6am and 4pm UTC+0 .


Beginning within the data field , all contents of the FLV stream become 0xEE .


To deliver the malware to the victim machines , the Rocke group exploits vulnerabilities in Apache Struts 2 , Oracle WebLogic , and Adobe ColdFusion . While the group used watering hole attacks in 2013 , it's still unclear how victims get redirected to the exploitation kits in the new 2014-2015 attacks .


At this stage , half the job is done for the malware . McAfee Advanced Threat Research team 's analysis , we find multiple components from this operation are unique from a code perspective , even though the code is loosely based on previous versions of the SYSCON backdoor . , It allows security researchers to analyze the source code and understand the attacker ’s tactics , techniques and procedures ( TTPs ) , which helps security professionals develop effective detection rules and enhance security products ' capabilities in combating ransomware threats .


This organization was formerly known as the East Turkestan Islamic Party and is purported to be an Islamic extremist separatist organization founded by Uyghur jihadists . Learning to access video game production environments enabled APT41 to develop the tactics , techniques , and procedures (TTPs) that were later leveraged against software companies to inject malicious code into software updates . We identified three themes in APT28 's lures and registered domains , which together are particularly relevant to the Russian government .


The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . The Leafminer operators use EternalBlue to attempt lateral movement within target networks from compromised staging servers .


OurMine is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that . The infection vector is a spear-phishing email with a malicious attachment .


Based on observations associated with the malicious document , we observed subsequent shell sessions probably associated with Metasploit B-MAL S-TOOL ’s Meterpreter that enabled deployment of additional tools and malware preceding deployment of three Shamoon-related files : ntertmgr32.exe , ntertmgr64.exe and vdsk911.sys .


Even now , this is still not enough . After the source codes of their tools became public in 2016 , the name Buhtrap was used for the financial Trojan . The unzIP . Both of these campaigns use a similar structure with compromised WordPress sites hosting the lure shortcuts and a WebDav server that loads NetSupport RAT .


We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit .


Malware data leak When we analyzed the sample , we realized that the malware operators left the remote database with some of the victims ’ data freely accessible , without any authentication . The comparison of the infection chains reveals in both cases TA505 used a couple of SFX stages to deploy the RMS” software: a legitimate remote administration tool produced by the Russian company TektonIT . When victims open malicious documents attached to the emails , the malware scans for Bitcoin activity and then establishes an implant for long-term data-gathering .


Once the HenBox app is installed and launched , it launches an install process for the embedded app as a decoy to other malicious behaviors occurring in the background , and to satisfy the victim with the app they were requesting , assuming they requested to download a particular app , such as DroidVPN . By 2014 , the Winnti malware code was no longer limited to game manufacturers . Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries .


After that , it carries out the malware operator ’s commands in order to install the next stage permanent payload .


Some of the documents exploited CVE-2017-0199 to deliver the payload . Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier .


The Magic Hound attacks did not rely on exploit code to compromise targeted systems , instead relying on Excel and Word documents containing malicious macros . We successfully unpacked the initial sample we found dropped by the UPX unpacker .