To perform some of its activities , the malware does not need high privileges inside the device , as we will explain ahead . PwC UK and BAE Systems , working closely with industry and government , have uncovered a new , unparallelled campaign which we refer to as Operation Cloud Hopper . We have contacted ASUS and informed them about the attack on Jan 31 , 2019 , supporting their investigation with IOCs and descriptions of the malware . • None consisting of CVE-2022 - 41080 and CVE-2022 - 41082 to achieve remote code execution ( RCE ) through Outlook Web Access ( OWA ) .


PsExec is a Microsoft Sysinternals tool for executing processes on other systems and is one of the most frequently seen legitimate pieces of software used by attackers attempting to live off the land . If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros .


Copy the contents from the client response object into the translated server object .


The titles and contents of these files suggest that the actor targeted individuals affiliated with these government agencies and the Fatah political party . Icefog , also known as the " Dagger Panda " by Crowdstrike 's naming convention , infected targets mainly in South Korea and Japan . For example , we observed an APT attacker pasting the string “ czo1NA== ” into an HTML page . When an attacker pays for an as - a - service malware , they often get an individual login with dedicated customer support , much like any user would with a legitimate piece of software .


Some of the targeted apps were : Whatsapp YouTube Video Downloader Google Update Instagram Hack Wifi AirDroid WifiHacker Facebook Photoshop SkyTV Hotstar Trump Dash PokemonGo With many more to come . Group-IB specialists determined that the email addresses of IT bank employees were among the recipients of these emails . If successful , Cobalt goes on to attack financial institutions outside the country .


Kegotip is an infostealer ( credentials and email addresses ) used to facilitate other crimeware activities .


During investigation of the Command & Control server ( with IP 176.31.112.10 hardcoded in Artifact #2 ) , we managed to identify some operational mistakes made by the attackers , allowing us to connect the incident with attacks previously associated with the Sofacy Group .


Android ’ s accessibility services were originally developed by Google for the benefit of users with disabilities . The threat actors , observed by FireEye Labs , use a variety of different methods to either compromise or acquire already compromised payment card credentials , including sharing or purchasing dumps online , hacking vulnerable merchant websites and compromising payment card processing devices . On August 23 , 2017 , we observed OilRig targeting an organization within the United Arab Emirates government .


This newly observed activity uses a series of redirections and fileless , malicious implementations of legitimate tools to gain access to the targeted systems . In 2015 , the SecureWorks® Counter Threat Unit™ ( CTU ) research team documented the BRONZE UNION threat group ( formerly labeled TG-3390 ) , which CTU™ analysis suggests is based in the People's Republic of China ( PRC ) .


They target groups across Middle East and Central Asia , primarily using spear phishing emails with malicious attachments .


The record contains a personal email address : WHOIS records of C2 server exposing the attacker ’ s email address We were aware of the possibility that the attackers might be using a compromised email account , so we dug deeper to find more information related to this email address . From at least February 2019 to present , the actors in the LUCKY ELEPHANT campaign copied webpages to mimic South Asian government websites as well as Microsoft Outlook 365 login pages and hosted them on their own doppelganger domains , presumably to trick victims into providing login credentials . GreezaBackdoor of DarkHotel : 5e0e11bca0e94914e565c1dcc1ee6860 .


Network activity BrainTest communicates with five servers : APK files provider ( http : //psserviceonline [ . A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . Following the trail of existing public reporting , the tie to FIN7 is essentially made based on a download observed from a MuddyWater C2 , of a non-public tool " DNSMessenger " .


Methods and techniques 2013 not only saw a radical increase in output from mobile virus writers but also saw them actively applying methods and technologies that allowed cybercriminals to use their malware more effectively . The campaign is believed to be active covertly since fall 2017 . These protests gathered hundreds of thousands of people in the streets with large support from students of Hong Kong universities , leading to multiple university campus occupations by the protesters . PIEHOP utilizes LIGHTWORK to execute the IEC-104 commands " ON ” or " OFF " on the remote system and immediately deletes the executable after issuing the commands .


Hamas , who has historically maintained control over the strip , elected Yahya al-Sinwar – a hardliner from its military wing – as its leader in February .


Eastern countries . This week we will discuss another Chinese nexus adversary we call Samurai Panda . The second file follows a decodable binary format . As previously recommended , updating Windows , Java and Adobe Reader to the latest versions should provide a basic level of defense against the known Miniduke attacks .


The client was likely built using the Quasar server client builder .


This was also reinforced by their naming conventions , wherein different versions are simply named after the code iterations , following a specific format regardless of the actual function of the code .


Additionally , some copies of Exodus One use the following XOR key : Rino Gattuso is a famous retired Italian footballer , originally from Calabria . TA459 is well-known for targeting organizations in Russia and neighboring countries . Downloads a Base64 encoded payload from the following URL : Apropos of my retrospective report , Bullock found that a great many messages in Biderman ’s inbox were belligerent and anti - Semitic screeds from a former Ashley Madison employee named William Brewster Harrison .


As we know from our investigation , traces of the first development activities were found at the end of 2016 , but the main distribution campaign began in 2018 ( end of 2017 ) . With the experience gained from the APT attack that began in March 2017 , it seems this campaign has evolved into an attack with new capabilities , and an even more specific target , over a year later . This malware uses Windows Bluetooth APIs to find information on connected Bluetooth devices and saves the following information .


] com and ora.studiolegalebasili [ . China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool . Poison Ivy is a remote access tool that is freely available for download from its official web site at www.poisonivy-rat.com .


In April , at the time of writing this post , we recorded 413 RuMMS infections . The samples of ThreeDollars we collected in these attacks are structurally very similar to the first sample we analyzed in October 2017 , down to the lure image used to trick the recipient into clicking the " Enable Content " button to execute the malicious macro . The base64 data and image are separated by the " **** " string . School budgets are tight and institutions are understandably keen to direct their budgets at things that directly benefit pupils .


For now , we observe only one payload version for following the ARM CPUs : arm64-v8a , armeabi , armeabi-v7a . The link to the final payload of KerrDown was still active during the time of analysis and hence we were able to download a copy which turned out to be a variant of Cobalt Strike Beacon . Magic Hound : Rocket Kitten , Operation Saffron Rose , Ajax Security Team , Operation Woolen-Goldfish , Newscaster , Cobalt Gypsy , APT35 .


Using XREFs during static analysis is a common technique to quickly find where functions of interest are called . However , it is still widely used , notably in Russia .


Researchers from Bitdefender also released an analysis of one of the samples in a blogpost . Throughout 2017 and 2018 , Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground . One of the most notable functions of the initial dropper is to bypass Windows UAC ( User Account Control ) in order to execute the next payload with higher privileges . Stolen credentials can be resold to other threat actors tied to ransomware gangs .


The malware was distributed from infected devices via SMS in the form “ % USERNAME % , I ’ ll buy under a secure transaction . The DeepSight Managed Adversary and Threat Intelligence (MATI) team co-authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug (aka Turla) cyber espionage group , and methods of detecting and thwarting activities of this adversary . The malware has evolved over time .


We chose the name “ HenBox ” based on metadata found in most of the malicious apps such as package names and signer detail . This technique was also observed against a government organizations in the Middle East and North African region . The group targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


These tools include:AIRBREAK: a JavaScript-based backdoor also reported as Orz that retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services.BADFLICK: a backdoor that is capable of modifying the file system , generating a reverse shell , and modifying its command and control (C2) configuration . RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism .


) to C & C ( calllog.php ) Whenever the user snaps a picture , either with the front or rear camera , it gets sent to the C & C ( uppc.php , fi npic.php orreqpic.php ) Can send GPS coordinates to C & C ( gps3.php ) The C & C server to which the application seems to be sending collected data appears to be operational , as of this writing , and running since May 2018 . Silence started by targeting organizations in Russia , gradually shifting their focus to former Soviet countries , and then the world . While FIN7 has embedded VBE as OLE objects for over a year , they continue to update their script launching mechanisms .


While the malware is capable of facilitating various cyber-criminal goals , our team confirmed it ’ s currently installing additional apps on infected devices . According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . This section details changes made to APT10 tools , techniques and procedures ( TTPs ) post-2014 , following its shift from Poison Ivy to PlugX .


Accordingly , the server side certificates appear to be generated locally on VPS hosts that exclusively are paid for at providers with bitcoin merchant processing .


The HenBox app downloaded in May 2016 was masquerading as the DroidVPN app . The role of the .NET module is to deliver the known KopiLuwak JavaScript Trojan . Given the mission , resourcing , and location of PLA Unit 61398 , we conclude that PLA Unit 61398 is APT1 .


The C & C role for Rotexy can be filled not only by a web server but also by any device that can send SMSs . In a separate incident , CTU researchers identified a file named s.txt , which is consistent with the output of the Netview host-enumeration tool . Symantec identified two strains of custom malware used by the Leafminer group : Trojan.Imecab and Backdoor.Sorgu .


Some of the documents exploited CVE-2017-0199 to deliver the payload . All of these early WhiteBear targets were related to embassies and diplomatic/foreign affair organizations .


This time I'm going to focus on malicious CHM files used by Silence APT . It was during operator X 's network monitoring that the attackers placed Naikon proxies within the countries ' borders , to cloak and support real-time outbound connections and data Exfiltration from high-profile victim organizations .


If an unsuspecting user grants these permissions ( see Figure 4 ) , the trojan can read any text displayed in any app the user may launch – and send it to the attackers . On June 14 , we saw TA505’s campaign still targeting UAE with similar tactics and techniques , but this time , some of the spam emails were delivered via the Amadey botnet . The Lazarus Group employs a variety of RATs and staging malware to conduct cyber operations , many of which contain significant code overlap that points to at least a shared development environment .


In a three-month period from August to October 2018 , it launched over 70,000 attacks against users located primarily in Russia . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia . Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library ( .dll )


As seen in previous Downeks versions , it uses masquerades with icons , filenames and metadata imitating popular legitimate applications such as VMware workstation and CCleaner , or common file formats such as DOC and PDF .


PLATINUM has used several zero-day exploits against their victims . Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit.MSWord.CVE-2010-333 , Exploit.Win32.CVE-2012-0158 .


This is also the first version where the package name changes into something that a less aware user may be tricked by , com.android.playup . Their primary interest appears to be gathering intelligence . FireEye dubbed this new malware family HIGHTIDE . RTM used Port 44443 for its VNC module .


The PowerShell script will look at the architecture of the system to check which malicious DLL files should be downloaded . This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


Android shell A new package was added that allows the execution of commands in the Android shell . The malicious attachments purported to be invitations or drafts of the agenda for the conference . Jason_invitation.doc : 00a95fb30be2d6271c491545f6c6a707 , CVE-2012-0158 . Monitor network data flows for unexpected patterns and metadata that may be indicative of a mismatch between protocol and utilized port .


) “ % USERNAME % , je vous ai envoyé un prepaiement m-leboncoin [ . Kaspersky reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 . The malware includes 2 domains: phpschboy.prohosts.org , jams481.site.bz .


Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download . It's coincident that both 'darkhydrus' APT group name and ‘Williams’ user name in PDB path found in this Twitter user .


With the account credentials , the attackers were able to access the victim 's account and navigate the internal corporate network as though they were the employee .


We were able to determine this because the attackers ’ hacktools are command line driven and can provide insight into when the operators are behind keyboards actively working .


To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys . We believe that Bookworm samples use the static date string as campaign codes , which we used to determine the approximate date of each attack that we did not have detailed targeting information .


This makes Dvmap the first Android malware that injects malicious code into the system libraries in runtime , and it has been downloaded from the Google Play Store more than 50,000 times . After the infection stage , criminals move laterally with the help of legitimate and pentesting tools , stealing passwords from their initial victims ( entry point ) to gain access to the computers within the organization that have access to money transactions . Recently we noticed that these modules had been merged into a single backdoor module able to collect data from clipboard and capture screenshots . Shortly thereafter , ESET ® researchers analyzed a sophisticated new malware , which is the main suspect in this case .


The Lazarus group is currently one of the most active and prolific APT actors .


Despite its known weaknesses , the RC4 algorithm is regularly used by malware authors . While discussions of threats in this region often focus on " North America " generally or just the United States , nearly 100 campaigns during this period were either specifically targeted at Canadian organizations or were customized for Canadian audiences .


smishing ) . The targeting of mainly Saudi Arabian organizations across a wide variety of industries aligns with historical targeting patterns for the group , which appear undeterred following previous exposés of their activity . Kaspersky Lab is releasing crucial Indicators of Compromise ( IOCs ) and other data to help organizations search for traces of these attack groups in their corporate networks .


The next stage in device infection could be the use of exploit kits and malvertising , which would be quite effective due the many Android vulnerabilities and consumers with unpatched devices . Attackers are targeting Windows platform and aiming at government institutions as well as big companies in Colombia . Group 72 ’s involvement in Operation SMN is another example of what sort of damage that can be done if organizations are not diligent in their efforts to secure their networks . As an example , we took the twitter login page , which implemented the following CSP rule ( which contains ): The following short JS code inserted into the site will send the credentials to google - analytics console controlled by us : The UA-#######- # parameter is the tag ID owner that Google Analytics uses to connect the data to a specific account .


The result of this entire command saves a variant of the Awen asp.net webshell ( T1100 ) to the SharePoint server to further interact with the compromise server .


via Authorized App Store Impersonates security app on Google Play . Curiously though , Waterbug also compromised other computers on the victim’s network using its own infrastructure . The Lazarus used a similar infrastructure to earlier threats , including the Destover backdoor variant known as Escad .


Perkele intercepts mTANs ( confirmation codes for banking operations ) sent by the bank via text message . Our January 2018 white paper was the first public analysis of a Turla campaign called Mosquito . MD5 : e3878d541d17b156b7ca447eeb49d96a . Minidionis – one more APT with a usage of cloud drives • Miniduke is back : Nemesis Gemina and the Botgen Studio More details about CozyDuke are available to customers of Kaspersky Intelligence Reporting .


As mentioned above , banking Trojans are perhaps the most complex of all mobile threats , and Svpeng is one of the most striking examples . Further analysis uncovered a handful of ties indicating the actors may also be using the PCShare malware family , which has not been previously tied to the group . The campaign identifiers found in the samples we ’ve analyzed match the subdomain part of the C&C server , showing that these samples were really targeted against these universities . SocialPolitical Hacktivism primarily intrinsic Social or Ideological issues create a motivation for some to attack organizations to make a statement .


] it Firenze server1gioiat.exodus.connexxa [ . On multiple dates in 2017 , TEMP.Veles struggled to execute this utility on multiple victim systems , potentially due to AV detection . 1 . A typical log entry showing access to the PowerShell backend is detailed in the Remote PowerShell HTTP logs , located in , such as in the example below : CrowdStrike incident responders discovered Remote PowerShell logs similar to log entries for ProxyNotShell exploitation to gain initial access , suggesting the attacker leveraged Remote PowerShell .


To infect individuals with access to the data the actors desire , Scarlet Mimic deploys both spear-phishing and watering hole ( strategic web compromise ) attacks . APT37 targeted a research fellow , advisory member , and journalist associated with different North Korean human rights issues and strategic organizations .


Our analysis indicates that this trojan is in its testing stage but given its potential , every mobile user should be aware of GPlayed . BITTER APT campaigns are primarily targeting China , Pakistan and Saudi Arabia historically . The publicly available backdoors and tools utilized by APT33 – including NANOCORE , NETWIRE , and ALFA Shell – are all available on Iranian hacking websites , associated with Iranian hackers , and used by other suspected Iranian threat groups .


The attack consisted of Microsoft Word delivery documents that contained Adobe Flash objects capable of loading additional malicious Flash objects embedded in the file or directly provided by a command and control server .


From a process and file perspective , Hermes and Ryuk target files in a similar fashion . ScarCruft 's Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell . Turla is a notorious group that has been targeting governments .


The activities of some non-governmental organizations ( NGOs ) challenge governments on politically sensitive issues such as social , humanitarian , and environmental policies .


This service hides the app from plain sight and loads another ELF library to gather environmental information about the device , such as running processes and apps , and details about device hardware , primarily through parsing system logs and querying running processes . In July 2017 , APT41 injected malicious code into a software update package maintained by Netsarang and signed it with a legitimate Netsarang certificate in an operation referred to as ShadowPad by Kaspersky . FireEye has moderate confidence that a campaign targeting the hospitality sector is attributed to Russian actor APT28 .


Over time , this campaign will also infect the same device , repeatedly , with the latest malicious patches . n summary , Cold River is a sophisticated threat actor making malicious use of DNS tunneling for command and control activities , compelling lure documents , and previously unknown implants . The threat authors have one more evasion technique for these scheduled tasks : some Dexphot variants copy msiexec.exe to an arbitrary location and give it a random name , such as %AppData%\<random>.exe . As our experience with and knowledge of this threat actor grows , we will update this post or release new technical details as appropriate .


In 2016 we saw fully functional , very large SPLM / X-Agent modules supporting OS X .


Quasar is a publicly-available commodity RAT , an evolution of his earlier xRAT , by German developer “ MaxXor ” .


Umbrella , our secure internet gateway ( SIG ) , blocks users from connecting to malicious domains , IPs , and URLs , whether users are on or off the corporate network . This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries . The APT38 uses DYEPACK to manipulate the SWIFT transaction records and hide evidence of the malicious transactions , so bank personnel are none the wiser when they review recent transactions .


A PDB path contained in a tested file contained a string that appears to be a unique handle or user name .


This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics . 'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/Exfiltration tools supporting all major operating systems like Windows ( Bartender ) , MacOS ( JukeBox ) and Linux ( DanceFloor ) .


We have examined all the detected versions , including the latest one that is signed by a certificate valid from September 14 , 2017 . This includes Python scripts . TEMP.Veles ： XENOTIME .


Gallmaker used lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange ( DDE ) protocol in order to gain access to victim machines . Trochilus RAT activity was discovered during both months of October and November 2015 .


Some tools used by this actor — specifically BlackEnergy and GCat — have been adapted from commodity malware . Users who failed to patch their systems may find themselves mining cryptocurrency for threat actors .


The OnionDuke toolset includes at least a dropper , a loader , an information stealer Trojan and multiple modular variants with associated modules .


As we explained in our most recent blogpost about Zebrocy , the configuration of the backdoor is stored in in the resource section and is split into four different hex-encoded , encrypted blobs .


What makes Ginp stand out is that it was built from scratch being expanded through regular updates , the last of which including code copied from the infamous Anubis banking Trojan , indicating that its author is cherry-picking the most relevant functionality for its malware . This information is used by the CIA's 'JQJIMPROVISE' software (see below) to configure a set of CIA malware suited to the specific needs of an operation . Dragonfly 2.0 : Berserk Bear .


However , some of the recently identified files display “ extended-capability ”


44f6d1caa257799e57f0ecaf4e2e216178f4cb3d com.binary.sms.receiver 9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae 7771af1ad3a3d9c0b4d9b55260bb47c2692722cf com.android.copy e384694d3d17cd88ec3a66c740c6398e07b8ee401320ca61e26bdf96c20485b4 APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia . Winnti : dump.gxxservice.com 142.93.204.230 DigitalOcean . An attacker may have more than a single motivation to target a particular organization .


During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros . This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 . According to our telemetry , Okrum was used to target diplomatic missions in Slovakia , Belgium , Chile , Guatemala , and Brazil , with the attackers showing a particular interest in Slovakia .


Unit 42 tracks roughly 300 SilverTerrier actors who have registered a combined 11,600 domains over the past five years . From February to September 2016 , WhiteBear activity was narrowly focused on embassies and consular operations around the world .


The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . PsExec is a Microsoft Sysinternals tool for executing processes on other systems and is one of the most frequently seen legitimate pieces of software used by attackers attempting to live off the land .


ScarCruft 's Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . APT5 has been active since at least 2007 .


Threat actors can use the services' detailed statistics about which links were clicked when , and from what location , to track the success of a spearphishing campaign .


Pivoting off the five highlighted IP ’s above with a shared infrastructure , I pulled the reverse DNS to see what other sites may be present .


To attack macOS users , the Lazarus group has developed homemade macOS malware , and added an authentication mechanism to deliver the next stage payload very carefully , as well as loading the next-stage payload without touching the disk .


Allows applications to access information about networks . As of October 2014 the CIA was also looking at infecting the vehicle control systems used by modern cars and trucks . They often use point-of-sale malware .


Pitty Tiger , like other APT attackers , often use anti-virus " familiar names " when registering domains or creating subdomains . In 2017 , the number of MoneyTaker 's attacks has remained the same with 8 US banks , 1 law firm and 1 bank in Russia being targeted .


Technical details Here is the meta information for the observed samples , certificates and hardcoded version stamps : Certificate MD5 Module Version Serial Number : 0x76607c02 Issuer : CN=Ron Validity : from = Tue Aug 30 13:01:30 MSK 2016 to = Sat Aug 24 13:01:30 MSK 2041 Subject : CN=Ron 9e005144ea1a583531f86663a5f14607 1 – 18abe28730c53de6d9e4786c7765c3d8 2 2.0 From March 18 to 26 we observed the malware operating in multiple areas of the world . FastUploader is a custom FTP tool designed to exfiltrate data at a faster rate than traditional FTP clients . When CrowdStrike researchers later reproduced the attack , events were present in CozyDuke - also known as CozyBear , CozyCar and Office Monkeys ( among others ) , and whose activity appears to align with advanced persistent threat APT29 - is a threat actor which came to prominence in 2014 when it is believed to have staged a series of precise attacks on high profile targets including the US White House , Department of State and the Democratic National Committee .


] 230 [ . In addition to the notably overt and large-scale campaigns with CozyDuke and CloudDuke , the Dukes also continued to engage in more covert , surgical campaigns using CosmicDuke . The majority if the modifications are of removing comments and renaming variables . In fact , we saw instances of compromised stores having both skimmers loaded , which means double trouble for victims as their credit card information is stolen not just once but twice .


The Infection Chain Once the user downloads and installs one of the infected applications , ‘ SimBad ’ registers itself to the ‘ BOOT_COMPLETE ’ and ‘ USER_PRESENT ’ intents , which lets ‘ SimBad ’ to perform actions after the device has finished booting and while the user is using his device respectively . BRONZE BUTLER uses credential theft tools such as Mimikatz and WCE to steal authentication information from the memory of compromised hosts . Suckfly conducted a multistage attack between April 22 and May 4 .


Credential phishing and an Android banking Trojan combine in Austrian mobile attacks NOVEMBER 03 , 2017 Overview Credential phishing , banking Trojans , and credit card phishing schemes are common threats that we regularly observe both at scale and in more targeted attacks . The unnamed company makes products used in the military and aerospace industries , and the hackers could have been after commercial secrets or more traditional espionage , according to ClearSky , the cybersecurity firm that exposed the operation . Some organizations track North Korean clusters or groups such as Bluenoroff , APT37 , and APT38 separately , while other organizations may track some activity associated with those group names by the name Lazarus Group .


Within some of the first of those commands , the bot typically receives a list of banks it will target . Though they have primarily tapped other tracked suspected North Korean teams to carry out the most aggressive actions , APT37 is an additional tool available to the regime , perhaps even desirable for its relative obscurity . This is probably the Latin spelling for the word “health” in Farsi . Forbes Technology Council is an invitationonly community for worldclass CIOs , CTOs and technology executives .


Over the past year , we've seen the group extensively targeting a wide gamut of entities in various sectors , including Governments , Academy , Crypto-Currency , Telecommunications and the Oil sectors . The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests .


The MUTEX name is different too : FG00nxojVs4gLBnwKc7HhmdK0h .


In this case , we ’re seeing a definite problem with the overly-conservative naming approach used as it engenders confusion in a significant subset of the intended audience .


When a suitable .exe file candidate is found , it is copied into the malware installation folder ( for example , C : \ProgramData ) . Between December 28 , 2016 and January 1 , 2017 , CTU researchers observed a phishing campaign targeting Middle Eastern organizations . wsc_proxy.exe plugins-setup.exe SoftManager.exe GetEFA.exe . Rhysida appears to have first popped up back in May , with several high - profile compromises posted on their leak site .


After rendering the ad on the screen , the app tries to identify the part of the advertisement website to click . Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique . The message subject read “ DPP ’s Contact Information Update ” , apparently targeting those interested in contact information for DPP members or politicians . ( CISA , CNN )


While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec , we have seen infections in multiple countries due to the nature of the victims operating large international corporations . As we have seen in some previous targeted malware attacks , the attackers in this incident are taking advantage of services like .


This group has been operating in the Middle East since 2012 .


The ZIP archives have names relevant to the targets and contain both legitimate files and malware .


Based on our technical analysis of the known PinchDuke samples from 2008 however , we believe PinchDuke to have been under development by the summer of 2008 .


Aside from the natural value of phone numbers associated with the names of their owners . After compromising a system , typically by installing Powermud or Powemuddy , Seedworm first runs a tool that steals passwords saved in users ' web browsers and email , demonstrating that access to the victim 's email , social media , and chat accounts is one of their likely goals . Once this export is called , it checks for a hidden window with a caption of Hello Google ! Based upon analysis and gathered data , we have determined that the operation is conducted by a Vietnamese threat actor .


CVE-2015-8651 : Adobe Flash Player 18.0.0.324 and 19.x Vulnerability .


However , the keylogger needs to be specifically enabled by a command sent from the C2 server . The company specializes in finance and natural resources specific to that region . FIN7 S-APT/Cobalt phishing documents may seem basic , but when combined with their extensive social engineering and focused targeting , they are quite successful . The tactics , techniques and procedures ( TTPs ) are very similar to those of SocGholish and it would be easy to think the two are related .


Figure 5 – Keylogger component Figure 6 shows one of the most noteworthy functions of Anubis : its ransomware module . Based on the profile of the victims and the type of information targeted by the attackers , Symantec believes that Butterfly is financially motivated , stealing information it can potentially profit from . FIN7 S-APT/GRIFFON : hpservice-cdn.com realtek-cdn.com logitech-cdn.com pci-cdn.com appleservice-cdn.com servicebing-cdn.com . On June 22 , @AnFam17 spotted the same fake browser update leveraging URL shortcuts .


Between May 2017 and December 2018 , a multi-purpose command tool that has been used by Whitefly was also used in attacks against defense , telecoms , and energy targets in Southeast Asia and Russia . We've found that this group has continued to operate successfully , predominantly in Latin America , since 2014 .


That this group is mostly targeting businesses is apparent from the processes they are looking for on a compromised system . The most recent Scarlet Mimic attacks we have identified were conducted in 2015 and suggest the group has a significant interest in both Muslim activists and those interested in critiques of the Russian government and Russian President Vladimir Putin .


CTU researchers believe legitimate websites are used to host tools because web proxies categorize the sites as benign .


INTERNET - Allows the application to open network sockets . FireEye detects this activity across our platforms , including named detection for TONEDEAF , VALUEVAULT , and LONGWATCH . As part of the investigation , Unit 42 researchers were able to identify an interesting characteristic about how the Gorgon Group crew uses shared infrastructure between cybercrime and targeted attacks .


After that , the Trojan will replace the original /system/bin/ip with a malicious one from the archive ( Game324.res or Game644.res ) . VAMP targeted various types of data from the phones of victims : images , text messages , contacts , and call history , among others . RevengeHotels : e675bdf6557350a02f15c14f386fcc47 . These malicious PDF files were rigged with exploits attacking Adobe Reader versions 9 , 10 and 11 , bypassing its sandbox .


The malware uses smishing , or SMS phishing , to infiltrate target devices , which is a technique that relies on social engineering . Both of the loader’s variants and their various payloads that enSilo analyzed share similar Tactics , Techniques , and Procedures (TTPs) and code associated with APT10 . While the most recent samples observed still use batch scripts and SFX files , the Gamaredon Group has moved aACT from applications like wget , Remote Manipulator MAL , VNC and ChkFlsh.exe .


End users and enterprises can also benefit from multilayered mobile security solutions such as Trend Micro™ Mobile Security™ . The threat actor used an exploit from the arsenal of the state-sponsored hacker group APT28 . In his history , FIN7 has overlapped several times with Cobalt S-MAL/EmpireMonkey in terms of TTPs . This type of attack technique can not be easily mitigated with preventive controls since it is based on the abuse of system features .


Interestingly however , another apparent evasion trick was also attempted - forging of the loaders ’ compilation timestamps .


There is a function called " performGlobalAction '' with the description below . But the group has also used Poison Ivy ( PIVY ) , a RAT more commonly associated with threat actors in China — so much so that PIVY has , inaccurately , become synonymous with all APT attacks linked to China . ShadowHammer : aa15eb28292321b586c27d8401703494 . In a recent survey , respondents indicated that 57 of all observed vulnerabilities are more than two years old , with as many as 17 being more than five years old .


MOSA is the Palestinian Directorate of Social Development whose mandate is to achieve comprehensive development , social security , and economic growth for Palestinian families , according to publicly available information on this ministry . Since January 2013 , we've been on the lookout for a possible RedOctober comeback . This interface sometimes runs on their personal attack system , which is typically in Shanghai . Our analysis indicates that attackers may have been using attackers since mid-2022 .


CONNECTION TO CHINA Chinese server infrastructure : FakeSpy applications send stolen information to C2 domains with .club TLDs and URLs ending with /servlet/ [ C2 Command ] ( mentioned above in the “ Stealing Sensitive Information ” section ) . MuddyWater is widely regarded as a long-lived APT group in the Middle East . APT15 then used a tool known as RemoteExec .


This new XLoader variant poses as a security app for Android devices , and uses a malicious iOS profile to affect iPhone and iPad devices . The admin@338 's Dropbox accounts have also been found to contain a different backdoor dubbed BUBBLEWRAP . test1.hta reserved . By selecting these links , you will be leaving NIST webspace .


MainActivity registers BootComplete with a boot event , so that whenever the device is booted , BootComplete gets triggered . As the CnC server , Silence use CnC-3 server running Windows , from which they send commands to download additional modules . Some of the teams publicly known today include Iranian Cyber Army , Ashiyane , Islamic Cyber Resistance Group , Izz ad-Din al-Qassam Cyber Fighters , Parastoo , Shabgard , Iran Black Hats and many others 9 .


In the latter case however , the group appear to have also simultaneously developed an entirely new loader , which we first observed being used in conjunction with CosmicDuke during the spring of 2015 .


At the end of August 2018 , the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components .


Falcon Intelligence has medium-high confidence that the GRIM SPIDER threat actors are operating out of Russia . Adobe Flash Player exploit .


] com . The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords . APT40 was previously reported as TEMP.Periscope and TEMP.Jumper .


Considering the other malicious behaviors of XLoader , this added operation could be very dangerous as threat actors can use it to perform targeted attacks . With this in mind , this week we are providing some indicators for a China based adversary who we crypt as " NUMBERED PANDA " Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc . Any other IP address will set the receive mode to ping, although the server-side software suggests 199.250.250.99 will be . RDP and phishing are two of the most popular initial ransomware attack vectors , and cybercriminals approach in leveraging these techniques has not changed much over the years .


All the IP addresses belong to the same company Hetzner , an IP-hosting firm in Germany . We recently noticed the group behind MuddyWater that appear to be targeting government bodies , military entities , telcos and educational institutions in Jordan , Turkey , Azerbaijan and Pakistan , in addition to the continuous targeting of Iraq and Saudi Arabia , other victims were also detected in Mali , Austria , Russia , Iran and Bahrain. . This particular VBScript payload beacons to domain bafunpda.xyz , which is also used by the KHRAT S-MAL Trojan E-MAL listed above in Table 2 . COSMICENERGY Possibly Associated With Russian Government - Funded Power Disruption and Emergency Response Exercises During our analysis of COSMICENERGY , we identified a comment in the code that indicated the sample uses a module associated with a project named “ Solar Polygon ” ( Figure 2 ) .


First , we launched a banking app and entered the credentials there . However , it is likely the same scripts are used more globally against many traditional Turla targets in Western Europe and the Middle East . Working with U.S. government partners , DHS and FBI identified Internet Protocol ( IP ) addresses and other indicators of compromise ( IOCs ) associated with a remote administration tool ( RAT ) used by the North Korean government—commonly known as FALLCHILL .


By monitoring the package installation broadcast event , XLoader can start their packages . The actors behind this campaign we call LUCKY ELEPHANT use doppelganger webpages to mimic legitimate entities such as foreign governments , telecommunications , and military . At the next startup , the software will directly load the configuration from the just created key .


The next stage payload ( e1953fa319cc11c2f003ad0542bca822 ) , downloaded from this loader , is similar to the .NET downloader in the WFCWallet case .


First Twitter‑controlled Android botnet discovered Detected by ESET as Android/Twitoor , this malware is unique because of its resilience mechanism . On November 29 , 2018 , Scattered Canary sent an attack email to Agari CFO Raymond Lim , enquiring as to his availability to send out a domestic wire transfer . Our analysis shows that the cybercriminals behind the attack against an online casino in Central America , and several other targets in late-2017 , were most likely the infamous Lazarus hacking group .


For more information on the overall capabilities of the malware , please review IBM 's ongoing research .


Within six hours of entering the environment , the threat actors compromised multiple systems and stole credentials for the entire domain .


Further tracking of the Lazarus’s activities has enabled Kaspersky researchers to discover a new operation , active since at least November 2018 , which utilizes PowerShell to control Windows systems and Mac OS malware to target Apple customers . The malware then builds two DLLs in memory – they are 32 and 64-bit DLLs that have identical functionality .


The injected code copies xxxx.exe to %System%\winsys.exe and connects to the Command and Control ( C&C ) server on TCP port 80 .


Our visibility into APT28 ’s operations , which date to at least 2007 , has allowed us to understand the group ’s malware , operational changes , and motivations .


Release_Time : 2019-12-04


The ‘ onload1 ’ function parses the response data from the request to the C2 URL using regular expressions .


Retrieve Keylogger logs .


User must open the Microsoft Word email attachment ;


Port 6207 : Viber extraction service . stolen certificates being used maliciously occurred in early 2014 . Potentially fake documents that appear to be issued by the Palestinian government . The alert described emails that delivered an Evernotethemed lure to entice targeted recipients into downloading a trojan .


Only later is the malicious code introduced , through an update . Barium Defendants install the malicious credential stealing and injection tool known as " Win32/RibDoor.A!dha " . Once an infected machine connects , you see its information displayed in a selection box at the top . An attacker could exploit these issues by tricking a user into opening a specially crafted PDF document or , if the user has the browser extension enabled , by visiting a malicious web page :


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 . And the dropper execute the iassvcs.exe to make a side loading and make the persistence .


Figure 4 details how many times each stolen certificate was used in a given month .


One archive sample analyzed by CTU researchers contained a legitimate PDF file , a benign image of interest to targets , and an HttpBrowser installer disguised as an image file .


Malware installation , persistence , and activation .


The document exploited CVE-2012-0158 and will decode and write an executable to disk upon infection . In March 2017 , Wikileaks published details about an exploit affecting Mikrotik called ChimayRed .


Lollipop has 7 percent , Ice Cream Sandwich has 2 percent , and Marshmallow has 1 percent . WCry uses a combination of the RSA and AES algorithms to encrypt files . APT33 : 64.251.19.232 [REDACTED].ddns.net . In essence , this provides the threat actor unrestricted access to the account .


Researchers showcased a potential malware lifecycle which started with spear phishing and eventually led to the deployment of the disk-wiping malware known as Shamoon .


] top/ These permutations of TLDs and canonical domains incorporating the legitimate domain expected by the targeted banking customers exemplifies recent trends in social engineering by threat actors . One notable aspect of the campaign was the actors' ability to impersonate VPN applications , such as Cisco Adaptive Security Appliance (ASA) products , to perform MitM attacks . APT28 has been active since at least 2004 .


As we described in Silence: Moving into the darkside report , Silence has experience with theft using compromised card processing systems . According to our statistics , as of the beginning of 2015 this botnet encompassed over 250 000 infected devices worldwide including infecting more than 100 financial institutions with 80% of them from the top 20 list .


The first observed samples of the MiniDuke backdoor component are from May 2011 .


What do I need to do ? Leafminer also utilized Process Doppelganging , a detection evasion technique first discussed at the Black Hat EU conference last year . We have tried informing them several times , through various channels , since early February , but without apparent success . If network logs were analyzed individually across that journey , it is likely that all requests were either in compliance with the policies embedded into the firewalls at every node , or some unpatched vulnerability prevented a control action against unauthorized data transfers .


In order to achieve this adaptability , the operator has the capability to remotely load plugins , inject scripts and even compile new .NET code that can be executed . At the time of analysis , the subdomains did not host a website; however , based on BITTER APT group’s targeting patterns , it is highly likely that they were created to host faux login phishing pages designed to steal user’s credentials . This coupled with the timing of operations – which coincides with Iranian working hours – and the use of multiple Iranian hacker tools and name servers bolsters our assessment that APT33 may have operated on behalf of the Iranian government .


] com/api/s2s/tracks/ and is used for activation . Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . In September 2018 , we found evidence of Seedworm and the espionage group APT28 ( aka Swallowtail , Fancy Bear ) , on a computer within the Brazil-based embassy of an oil-producing nation .


In the beginning , this threat group mainly targeted Asian countries . The last piece is the newly discovered CopyPaste group , who targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center . The Ke3chang group also used keyloggers and their own .NET tool to enumerate folders and dump data from Microsoft Exchange mailboxes .


Correspondence of other individuals targeted in the same phishing campaign , including former Secretary of State Colin Powell and Clinton campaign staffer William Rinehart , were published on the “ DC Leaks ” website .


After scanning the QR code and installing a component downloaded from the link , the user infects his smartphone with the Trojan program that boasts functionality that is of great interest to the attackers . Turla operators could use an already-compromised machine in the network of the victim 's organization to perform a local MitM attack . To illustrate the functionality of main ZxShell module , Let ’s take a look at the following sample : “ So good luck , I ’m sure we ’ll talk again soon , but for now , I ve got better things in the oven , ” Harrison wrote to Biderman after his employment contract with Ashley Madison was terminated .


The attacks use multiple exploits in an attempt to gain root access on a device . Notably , after the first SMB packet sent to the victim 's IP address , WannaCry sends two additional packets to the victim containing the hard-coded IP addresses 192.168.56.20 and 172.16.99.5 . APT33 : 64.251.19.217 [REDACTED].myftp.org . Additionally we observed the DPRK threat actor log directly into a Pyongyang IP , from one of their jump boxes .


Since Ryuk 's appearance in August , the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD . These codes are often leveraged in the malware used by coordinated targeted attackers to differentiate victims that were successfully compromised from different target sets .


This malware family is known as " PittyTiger " by the anti-virus community . Operation Ghoul is one of the many attacks in the wild targeting industrial , manufacturing and engineering organizations , Kaspersky Lab recommends users to be extra cautious while checking and opening emails and attachments .


University faculty specializing in aeronautical engineering and research .


As of this publication , CTU researchers have not discovered how TG-3390 keeps track of the details associated with its compromised assets and credentials .


The first variant involves social engineering the target into downloading a trojanized app . Thus , Turla operators had access to some highly sensitive information ( such as emails sent by the German Foreign Office staff ) for almost a year . The service ’s existence is verified with the ServiceExists function , which attempts to open the relative registry sub-key in HKLM\SYSTEM\CurrentControlSet\Services . CrowdStrike incident responders found that renamed Plink and AnyDesk executable creation timestamps on affected backend Exchange servers were closely correlated with PowerShell execution events in the Remote PowerShell logs , indicating the threat actor leveraged the newly discovered exploit chain to drop other tooling for persistent access to the affected Exchange servers .


The main purpose of this module is providing reverse shell features on the device by connecting with the C & C server ’ s socket . Therefore , it is clear that the OceanLotus group works during weekdays and takes a break during the weekends . The group behind the campaign has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia . menuPass : Stone Panda , APT10 , Red Apollo , CVNX , HOGFISH . menuPass is a threat group that appears to originate from China and has been active since approximately 2009 .


The team has encountered different versions of the malware over time as it has rapidly evolved . Previous reports have discussed Bisonal malware used in attacks against Japan , South Korea and Russia . Based on the targeting and lures , Unit 42 assesses that the Lotus Blossom actors ' collection requirements include militaries and government agencies in Southeast Asia .


We have observed Delphi , AutoIt , and C++ variants of Zebrocy , all of which are related not only in their functionality , but also at times by chaining the variants together in a single attack .


According to our estimates , about 60 % of mobile malware are elements of both large and small mobile botnets . three computers in China being used to launch the Thrip attacks . By default , every keystroke is recorded using the Keylogger module ( 306, previously documented by Avast ) and saved to disk in the file %APPDATA%\PAGM\OEY\XWWEYG\WAOUE . Mandiant Threat Intelligence assesses that UNC2452 activity aligns with nation - state priorities broadly and that the group ’s targeting patterns are consistent with Russian strategic interests .


Modified DLL file ( goopdate.dll ) used by BRONZE PRESIDENT to install RCSession : 0617cad9e5d559356c43d4037c86227f , f14eaf5d648aebb2ed7b00b2cf4349263b30fb1c , 2ea9ccf653f63bcc3549a313ec9d0bada341556cc32dd2ca4b73e0c034492740 .


The purpose of this module is to extract and execute a malicious payload – the “ patch ” module . Sometimes , the attackers use sub-domains on the exploit websites , to make them seem more legitimate . Process hollowing is a technique that can hide malware within a legitimate system process . Malwarebytes 's EDR shows the full attack chain ( please click to enlarge ): The NetSupport RAT files are hosted on the same compromised WordPress site used earlier to download the Internet shortcut .


APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more . Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware .


As the code snippet shows , the malware creates a notification builder and then does the following : setCategory ( “ call ” ) – This means that the notification is built as a very important notification that needs special privilege . Honeybee attacked beyond the borders of South Korea to target Vietnam , Singapore , Argentina , Japan , Indonesia , and Canada . ( On hosts of interest , Agrius deploys its own custom malware a .NET backdoor called IPsec Helper , which registers itself as a service to establish persistence .


The Flash zero-day exploit ( CVE-2015-5119 ) was added into the Angler Exploit Kit and Nuclear Exploit Pack . The Cobalt started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world . some functions in the ANEL sample have multiple control dispatchers . None Use of Python for malware development and/or packaging : We expect to continue to observe attackers compiling or packaging their OT malware via methods such as PyInstaller ( IRONGATE ) or Py2Exe ( TRITON ) given the proliferation of OT malware developed or packaged using Python in recent years .


Payload deployment Once the static block execution is complete , the Android Lifecycle callback transfers the control to the OnCreate method of the main class . APT15 was targeting information related to UK government departments and military technology . After the first EOCD comes some extra data – another ZIP file . Initially engaged in espionage activity , Agrius deployed a set of destructive wiper attacks against Israeli targets , masquerading the activity as ransomware attacks .


But according to Gnosticplayers , his foray into a public marketplace like Dream has two goals --besides the first and obvious one being money . SPEAR identified recent PassCV samples which implemented another commercial off-the-shelf ( COTS ) RAT called Netwire .


Both groups can set permissions on specific files to Everyone , and work in tandem with the PLATINUM backdoors . Recently , the JPCERT published a thorough analysis of the Plead backdoor , which , according to Trend Micro , is used by the cyberespionage group BlackTech .


Metasploit is an open source framework popular as a tool for developing and executing exploit code against a remote target machine .


Another common step taken by threat actors is changing their system's MAC Address to avoid being uniquely identified . Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents .


It is very easy to trick victims to fall for such attacks . Further analysis showed that the Iron cybercrime group used two main functions from HackingTeam's source in both IronStealer and Iron ransomware . Group5 is a threat group with a suspected Iranian nexus , though this attribution is not definite .


Most attackers target vulnerable applications and operating systems .


The Arabic-language text and English translation of the document are available in ThreatConnect here .


And our researchers estimate that in every 10 Android users 1 was attacked by either one or several of those Trojans during the second half of 2015 , so there are millions of devices with a huge possibility of being infected with Triada . WannaCry incorporated the leaked EternalBlue exploit that used two known vulnerabilities in Windows CVE-2017-0144 and CVE-2017-0145 to turn the ransomware into a worm , capable of spreading itself to any unpatched computers on the victim's network and also to other vulnerable computers connected to the internet . We assess that APT34 works on behalf of the Iranian government based on infrastructure details that contain references to Iran , use of Iranian infrastructure , and targeting that aligns with nation-state interests .


Timeline of posts related to the Hacking Team DATE UPDATE July 5 The Italian company Hacking Team was hacked , with more than 400GB of confidential company data made available to the public . Since 2013 , the Cobalt have attempted to attack banks and financial institutions using pieces of malware they designed . it attempts to guess the next block number based on the address , This actor uses these vulnerabilities to deploy webshells including CHINACHOP .


Leveraging this intelligence allowed us to begin predicting potential C2 domains that would eventually be used by the Sofacy group .


Our Investigation into both clusters further showed that they were both involved in attacks targeting organizations in South East Asia . Based on this , we believe the Rancor attackers were targeting political entities .


Second , the app can set a custom delay between displaying ads . Analysis of the payload allowed us to confidently link this attack to an actor Kaspersky track as BlackOasis . This file drops exactly the same files than the previous campaign but the decoy document is different .


Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability . TAA not only flagged this malicious use of PsExec , it also told us what the attackers were using it for .


The exploitation of this vulnerability is not unique to Emissary Panda , as multiple threat groups are using this vulnerability to exploit SharePoint servers to gain initial access to targeted networks .


The ScarCruft APT gang has made use of a Flash zero day patched Thursday by Adobe to attack more than two dozen high-profile targets in Russia and Asia primarily . APT5 also targeted the networks of some of Southeast Asia 's major telecommunications providers with Leouncia malware .


] com hxxp : //mailsa-wqo [ . In our 2014 report , we identified APT28 as a suspected Russian government-sponsored espionage actor . To support this capability, the adversaries chose to manually craft the DNS queries and communicate directly with the controller as opposed to using existing .NET DNS . Whoever hacked Ashley Madison had access to all employee emails , but they only released Biderman ’s messages — three years worth .


The only difference introduced is that an event named “ WerTyQ34C ” can be signalled by the function “ NvStop ” to terminate the message loop and stop processing .


The a binary is a script wrapper to start run , a Perl-obfuscated script for installation of a Shellbot to gain control of the infected system .


These threats are capable of opening a back door and stealing information from victims' computers . TG-3390 actors have used Java exploits in their SWCs .


It is unclear how long the malicious code existed inside the apps , hence the actual spread of the malware remains unknown . The Winnti umbrella continues to operate highly successfully in 2018 . We will take a look at the keylogger later on . Enable robust application logging for MicroSCADA and aggregate logs to a central location .


HummingWhale , by contrast , managed to sneak its way into about 20 Google Play apps that were downloaded from 2 million to 12 million times , according to researchers from Check Point , the security company that has been closely following the malware family for almost a year . Rather , PapaAlfa could be considered a smart proxy due in part to the fact that the Lazarus can easily switch the backend destination address and port without having to reestablish control over the infected machine hosting the PapaAlfa malware . Because the Elfin and the Shamoon attacks against this organization occurred so close together , there has been speculation that the two groups may be linked . If you can not apply the KB5019758 patch immediately , you should disable OWA until the patch can be applied .


We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages . Hancom Office is widely used in South Korea .


While one variant will use a preconfigured C&C server over HTTP or HTTPS , the other variant will use a Microsoft OneDrive account to exchange commands and stolen data with its operators .


We however feel it is unlikely that the CosmicDuke operators targeting drug dealers and those targeting governments could be two entirely independent entities .


Before sending any data to the C2 using the trojan attempts to disguise its data , the data is serialized using JSON , which is then encoded in Base64 . After a successful phishing attack in which users have opened emails and browsed to malicious links , ITG08 attackers install the More_eggs JScript backdoor on user devices alongside several other malware components . APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world .


This task proved to be nontrivial . Depending on placement , a web shell can provide continued access to victims ' environments , re-infect victim systems , and facilitate lateral movement . The data received from the C&C server is encrypted using the same key . As outlined in recent research detailing the GRU 's disruptive playbook , we have observed Sandworm adopting LotL tactics across its wider operations to similarly increase the speed and scale at which it can operate while minimizing the odds of detection .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government . In addition to these , we also identified " Macfog " , a native Mac OS X implementation of Icefog that infected several hundred victims worldwide .


Deserialize the decrypted response into another client response object .


Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer . Our initial observation of the Bahamut group originated from in-the-wild attempts to deceive targets into providing account passwords through impersonation of platform providers .


" WzI3MDg5LDI4NjE4LDk4MzMsNDE3MCwyNTcyMiwxOTk3NywyMzY5LDIxNDI2LDM0MzUsNzQ0MiwzMDE0NiwyMTcxOSwxNjE0MCwxNjI4MCwxNjY4OCwyMjU1MCwxOTg2NywxOTQsMzI5OF0= " .


as the user agent , while more recent samples use “ OPAERA ”


We believe this backdoor is relatively new and seems to have appeared starting in the beginning of 2019 .


ACCESS_NETWORK_STATE - Allows the application to access information about networks . However , this action doesn’t appear to have made a dent in the cybercriminal organization , as subsequent spear-phishing campaigns seem to have been reported from March until May 2018 . As we continued to investigate , it became apparent that Gorgon Group had been consistently targeting worldwide governmental organizations operating within Pakistan .


In most cases , LEAD ’s attacks do not feature any advanced exploit techniques .


In addition , the malware can log in to the attacker ’ s email inbox , parse emails in a special folder for commands and save any payloads to a device from email attachments . This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans . A second JavaScript command was also executed , which created a scheduled task to execute chfeeds.vbe multiple times a day . Mandiant has previously identified the domain wasxxv[.]site being used by North Korean threat actors .


Several analysis reports were published on this malware in 2014 and , finally , the source code was leaked in 2015 . Since at least 2008 , The Lamberts have used multiple sophisticated attack tools against high-profile victims . Some of the campaign codes we have seen include : CRML_0505 , CRML_MIL , Firebox4 , JUST_0525 , ML0628 , MW0629 , OM222 . Our demonstration shows how using the Google Analytics API , a web skimmer can send data to be collected in his own account instance .


Adobe on Thursday patched a zero-day vulnerability in Flash Player that has been used in targeted attacks carried out by a new APT group operating primarily against high-profile victims in Russia and Asia . We suspect that the group sought access to these networks to obtain information that would enable it to monitor communications passing through the providers' systems .


So far , this software ( along with the Android version ) has been made available through phishing sites that imitated Italian and Turkmenistani mobile carriers . WannaCry utilizes EternalBlue by crafting a custom SMB session request with hard-coded values based on the target system . The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros .


For the .NET version , the following registry key and value are used for persistence :


We have directly observed multiple copies of Exodus with more than 50 installs and we can estimate the total number of infections to amount in the several hundreds , if not a thousand or more . While continuing research on the August 2018 attacks on a Middle eastern government that delivered BONDUPDATER , Unit 42 researchers observed OilRig 's testing activities and with high confidence links this testing to the creation of the weaponized delivery document used in this attack . The actor used the same technique in the macro and in the JhoneRAT . A main goal of this attack was to obtain access to email accounts .


Signing malware with code-signing certificates is becoming more common , as seen in this investigation and the other attacks we have discussed .


Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier . This threat is another proof point that attackers are clearly incorporating the mobile device into their surveillance campaigns as a primary attack vector .


While there have been several Suckfly campaigns that infected organizations with the group ’s custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions .


2016 We do not know exactly how many people have been infected with RuMMS malware ; however , our data suggests that there are at least 2,729 infections with RuMMS samples from January 2016 to early April 2016 . In the January 16 , 2018 attack , we observed OilRig attacking an organization it previously targeted in January 2017 . The purpose is to download an image from a new Google Drive link . These types of threat actors will be attempting to cause the most embarrassment andor pain to prove the company can not function without them .


Shamoon2 : 69.87.223.26:8080/eiloShaegae1 .


At the time of analysis , the subdomains did not host a website; however , based on BITTER APT group’s targeting patterns , it is highly likely that they were created to host faux login phishing pages designed to steal user’s credentials . Hackers first actively spread bots using the Niteris exploit , and then search for infected devices at banks amongst their bots by analyzing IP addresses , cracked passwords and results of the modules performance .


Extract call logs , contacts and messages from the Skype app . the group 's targets include an organization in Sweden . Using Geopolitically-charged Lure Content : The attackers use specially crafted lure content to trick their targets into opening malicious files that infect the victim ’s machine with the Pierogi backdoor . The name “ Anonymous Sudan ” is likely an attempted appropriation of the brand of the well - known hacktivist collective “ Anonymous , ” similar to another KillNet affiliate , “ Anonymous Russia . ”


W:\Visual Studio 2017\Spark4.2\Release\Spark4.2.pdb .


“ Agent Smith ” itself , though , seems to target mainly India users . Overall , the Bookworm infrastructure overlaps with the infrastructure hosting C2 servers used by various attack tools , including FFRAT , Poison Ivy , PlugX , and others . Over time , Dexphot-related malicious behavior reports dropped to a low hum , as the threat lost steam . Encrypted Channel APT29 has used multiple layers of encryption within malware to protect C2 communication .


We believe this spyware platform is developed by an Italian company called eSurv , which primarily operates in the business of video surveillance . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . This RAT uses three different cloud services to perform all its command and control ( C2 ) activities . The attackers only managed to deploy it to three machines on the organizations network and it was blocked on two of those three computers .


In 2013 , many of the decoy documents employed by the Dukes in their campaigns were related to Ukraine ; examples include a letter undersigned by the First Deputy Minister for Foreign Affairs of Ukraine , a letter from the embassy of the Netherlands in Ukraine to the Ukrainian Ministry of Foreign affairs and a document titled “ Ukraine ’s Search for a Regional Foreign Policy ” .


How to unblock the phone Now for some good news : Rotexy doesn ’ t have a very well-designed module for processing commands that arrive in SMSs . If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros . The period between November 2014 and January 2015 marked one of the earlier instances in which Proofpoint observed persistent exploitation attempts by this actor .


The Sednit group – also known as APT28 , Fancy Bear , Sofacy or STRONTIUM – has been operating since at least 2004 and has made headlines frequently in past years .


The ScarCruft group keeps expanding its exfiltration targets to steal further information from infected hosts and continues to create tools for additional data exfiltration . this SWC was used to specifically target Turkish banking .


While no phishing- or social engineering-initiated routines were observed in this campaign , we found multiple attacks over the network that are considered “ loud. ” These involved large-scale scanning operations of IP ranges intentionally launched from the command and control ( C&C ) server .


The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage .


If that part is found , the app loads Javascript snippets from the JSON parameters to click a button or other HTML element , simulating a real user click . NetTraveler has been used to target diplomats , embassies and government institutions for over a decade , and remains the tool of choice by the adversaries behind these cyber espionage campaigns . The Chinese government would benefit from improved insight into local media coverage of Taiwanese politics , both to better anticipate the election outcome and to gather additional intelligence on politicians , activists , and others who interact with journalists . Popular tax preparation software companies are under fire from lawmakers for allegedly sharing personal information with social media sites , including Google and Meta .


The official “ Golden Cup ” Facebook page . FireEye assesses that APT32 leverages a unique suite of fully-featured malware , in conjunction with commercially-available tools , to conduct targeted operations that are aligned with Vietnamese state interests . The information for this specific sample is listed below . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


As part of their activities , they are known for hijacking DNS settings on Japanese routers that redirect users to malicious IP addresses , creating disguised malicious Android apps that appear as popular apps , stealing Apple ID credentials by creating Apple phishing pages , as well as performing web crypto mining on browsers . FIN7 thus continues to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework . This time , APT15 opted for a DNS based backdoor : RoyalDNS .


The malware opens the URLs using the user agent that imitates a PC browser in a hidden webpage and receives a redirection to another website . The attackers behind observed activity in 2018 operate from the Xicheng District of Beijing via the net block 221.216.0.0/13 . If ZxShell successfully connects to the remote host , the function DoHandshake is called . As 2021 ends , one critical theme remains constant within the world of enterprise security ransomware attacks are continuing to rise , yearoveryear , across private and public entities .


the back of a surge in Trojan activity , we decided to carry out an in-depth analysis and track the evolution of some other popular malware families besides Asacub . CraP2P has frequently been used to distribute other malware such as Locky and Dridex , but also supported large scale spam campaigns for dating advertisement and pump-and-dump scams after the demise of Kelihos . As a backdoor Trojan , Volgmer has several capabilities including : gathering system information , updating service registry keys , downloading and uploading files , executing commands , terminating processes , and listing directories .


Others like transferbot , promptupdate and promptuninstall are meant to help the operator manage the malware . Versions of this particular orchestrator were found on other victims , together with White Lambert samples , indicating a close relationship between the White and Pink Lambert malware families . This helped disguise their activities . Recognizing and stopping the above malicious JavaScript request requires advanced visibility solutions that can detect the access and exfiltration of sensitive user data ( in this case the user ’s email address and password ) .


The malware contains a list of 209 packages hardcoded in its source code . Additionally , the group compromised organizations in Europe and North America that have ties to the Middle East . This could be an attempt to evade sandbox analysis as mouse and keyboard movement is typically not performed . However , given the lack of conclusive evidence , we consider it also possible that a different actor - either with or without permission - reused code associated with the cyber range to develop this malware .


In addition , it collects identifiers and some data from the device . OceanLotus , also known as APT32 , is believed to be a Vietnam-based APT group that has become increasingly sophisticated in its attack tactics , techniques , and procedures ( TTPs ) . Ursnif Variant 446ffd272c79554a19b5f4299327fb74b8ff457681d10571caa6eea51ec406b0 ea7e1650031c92b7377788f05926034e Ursnif Variant 42636f3185c9e398958aad272d983c8b8b1409df4ce93f1f8f608e190290f56d 377cd85d8d68fc58976a123aa151c5e0 Ursnif Variant 24b2141c1134ef14f33a38c58342b6573940c5460d03a2945fafac36e32e6889 b73cbffea8094cfa18b067d9568c53e7 Ursnif Variant e53b0a60c238c45019089bdf7f16d5f47b7ba15ca2c918e385c41f0c2076eb52 24fe5a6196e32749cd030ab51824cabe Ursnif Variant 4c8de1713f830819e8354b653fd19a5cafd0bc8fa3145eedf555f24261c874de 589734cb60aa515599c687539c520049 . Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader , one of the most popular PDF reader alternatives to Adobe Acrobat .


House Speaker Nancy Pelosi later confirmed that the DCCC had suffered a network compromise .


CVE-2015-6585 : Hangul Word Processor Vulnerability .


Figure 14 : disabling infected apps auto-update Figure 15 : changing the settings of the update timeout The Ad Displaying Payload Following all of the above , now is the time to take a look into the actual payload that displays ads to the victim . The campaign was active until January 2014 , but during our investigations the C&C servers were shut down . Next , the loader DLL E-TOOL targets the setup.exe file in SysWoW64 . Malwarebytes customers are protected as we detect the infrastructure and final payload used in these attacks .


As Talos observed at the beginning of 2017 , Group 123 started a campaign corresponding with the new year in 2018 . The Trojan is quite similar to the .NET RocketMan Trojan Obviously and can handle the same commands; additionally , it includes the #screen” command to take a screenshot .


Unfortunately , at the time of collection , the C2 domain had been sinkholed by a third party .


In our research , we focus on the most recent sample , an application dubbed as " Golden Cup '' , launched just before the start of World Cup 2018 . Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years . In this instance it is saved to the C:\ProgramData directory with a pseudo random name . While one of his signatures uses his own blog domain , there is also a second signature which uses 93[.]gd , a domain that was found to have been actively selling VPS services in the past .


AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products . ESET has been tracking this threat for months and has observed several changes , sometimes within weeks . APT38 relies on DYEPACK , a SWIFT transaction-hijacking framework , to initiate transactions , steal money , and hide any evidence of the fraudulent transactions from the victimized bank .


Some versions of the Skygofree feature the self-protection ability exclusively for Huawei devices . The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” . APT41 is a group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity .


Once connected to the pipe , a user or a program can easily provide information required to execute command ( just as they would normally through a command-line ) .


WhatsApp message capture The service com.serenegiant.service.ScreenRecorderService , is invoked by the ScreenRecorderActivity . Callisto Group via credential phishingThese spear phishing emails were crafted to appear highly convincing , including being sent from legitimate email accounts suspected to have been previously compromised by the Callisto Group via credential phishing . It is worth noting that this email appeared to have been sent from another Taiwanese Government employee , implying that the email was sent from a valid but compromised account . Some TrickBot samples have used HTTP over ports 447 and 8082 for C2 .


A " Tracking tool '' or an " Admin tool '' are often cited for these kinds of tools for " commercial '' or " enterprise '' usage . Blending in with legitimate traffic is a common tactic used by attackers to help fly under the radar . Though public disclosures resulted in APT12 adaptations , FireEye observed only a brief pause in APT12 activity before the threat actors returned to normal activity levels . In fact , this chain also leads to NetSupport RAT .


PlugX — A remote access tool notable for communications that may contain HTTP headers starting with " X- " ( e.g. , " X-Session : 0 " ) .


Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) . January 2018 , TAA triggered an alert at a large telecoms operator in Southeast Asia .


Doing so executes code checking if the device is manufactured by Xiaomi , or if Xiaomi ’ s fork of Android is running on the device . APT41 frequently leverages timely news stories as the lure content in their spear-phishing emails , although social engineering content does not always correlate with targeted users or organizations . Since at least 2007 , APT28 has engaged in extensive operations in support of Russian strategic interests .


Other cyberespionage groups , including Black Vine and Hidden Lynx , have also used stolen certificates in their campaigns .


Unfortunately , we were unable to get any C2 S-TOOL servers to issue download commands to any samples that we tested in our lab .


The traffic transits in clear and is therefore potentially exposed to man-in-the-middle attacks : At the same time , null will also bind a local shell on 0.0.0.0:6842 . On April 22 , 2015 , Suckfly exploited a vulnerability on the targeted employee 's operating system ( Windows ) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack . Meeting Agenda.pdf : That 's because a new ransomware called BlackSuit had appeared which shared 98 percent of its code with the infamous Royal ransomware .


2015-02-04 2015-07-20 http : //119.network/lte/Configuratore_TIM.apk 2015-07-08 Many of these domains are outdated , but almost all ( except one – appPro_AC.apk ) samples located on the 217.194.13.133 server are still accessible . In Operation Sheep’s case , Shun Wang likely harvests end user contact lists without application developer acknowledgement . APT12 is a threat group that has been attributed to China .


From the outside , they are indistinguishable from the legitimate applications . Traffic was intercepted on a node between the end machine and the Adobe servers , allowing Turla 's operators to replace the legitimate Flash executable with a trojanized version . It is not directly used from msvcrt.dll but is instead copied to another memory chunk before being called . They claim to have compromised the company and are willing to help resolve the issue .


Similar to its other attacks , Suckfly used the Nidiran back door along with a number of hacktools to infect the victim 's internal hosts .


A coordinated Shamoon outbreak begins and computer hard drives across the organization are permanently wiped .


Here is a command and control protocol fragment : Commands from C2 server parsing In total , the malicious APK handles 16 different commands : Command Endpoint Description 1 reqsmscal.php Send specified SMS message 2 reqsmscal.php Call specified number 3 reqsmscal.php Exfiltrate device info , such as phone model and OS version 4 reqsmscal.php Exfiltrate a list of all installed applications 5 reqsmscal.php Exfiltrate default browser history ( limited to a given date ) 6 reqsmscal.php After reviewing all the malware functionalities , we are confident in saying that the attackers look for victims who answer well-defined characteristics and believe that further stages of the attack are delivered only to those who fit the specific victim profile . We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester .


How it Works In order to get into the Google Play Store , the malware uses a phased approach which is quite a common practice for malware authors these days . APT32 often deploys these backdoors along with the commercially-available Cobalt Strike backdoor . The samples had minor changes , and were presumably changed by the attackers to avoid detection by hash . Threat actors like the Winnti group rarely ever stay static in terms of both tools and tactics .


As observed previously with CVE-2017-11882 and CVE-2018-0802 , the weaponizer was used exclusively by Chinese cyber espionage actors for approximately one year December 2017 through December 2018 , after which cybercrime actors began to incorporate it in their malicious activity . As a result , it is already flagged as Bahamut by antivirus engines .


Bread has used a few tricks to keep strings in plaintext while preventing basic string matching . In one case in late 2014 , APT5 breached the network of an international telecommunications company . Shutdown Logout , shutdown or restart the target system . Check the flag T as indicator if single stepping .


In addition future Trojans could leverage root exploits to make them almost impossible to remove and give malicious actors the ability to hook generic low level API ’ s that are used by all ( banking ) applications , just like the attack vector as has been used on the desktop platform for years . Attackers like to use spear-fishing email with password protected RAR attachment to avoid being detected by the email gateway . ZxShell is one sample amongst several tools that Group 72 used within their campaign . Though Google meant to have this parameter be used to mention the page the user visited , we used it to exfiltrate the user name and password data encoded in base64 .


Phone number for administration changeServer : At this point , the malware changes the C2 to a new host , even though the API and communication protocol continues to be the same . Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn't possible for us to verify this link . The malware supports the following capabilities : Terminate specific process、Enumerate processes、Upload file、Download file、Delete file、List folder contents、Enumerate storage volumes、Execute a command、Reverse shell、Take a screenshot . Conducted for commercial or financial purposes , corporate espionage involves


The code above changes the font color to black within the specified cell range and presents the content to the user .


Firewalls provide security to make your network less susceptible to attack .


The pushTAN method has a clear advantage : It improves security by mitigating the risk of SIM swapping attacks and SMS stealers . Since May 2017 , Mandiant experts observed North Korean actors target at least three South Korean cryptocurrency exchanges with the suspected intent of stealing funds . Unit 42 's ongoing research into the OilRig campaign shows that the threat actors involved in the original attack campaign continue to add new Trojans to their toolset and continue their persistent attacks in the Middle East .


The macro obtains the document saved to the system from within the document stored as UserForm1.Label1.Caption and will write it to : %TEMP%\~temp.docm .


However , a white font color is applied to the text to make it appear that the victim must enable macros to access the content .


Our intelligence shows “ Agent Smith ” droppers proliferate through third-party app store “ 9Apps ” , a UC team backed store , targeted mostly at Indian ( Hindi ) , Arabic , and Indonesian users . We believe that the IP addresses from Canada , Russia and Norway are analysis systems of antivirus companies or security researchers . Microsoft Defender ATP data shows the effectiveness of behavioral blocking and containment capabilities in stopping the Dexphot campaign . Dynamic Resolution During the SolarWinds Compromise , APT29 used dynamic DNS resolution to construct and resolve to randomly - generated subdomains for C2.[12 ]


If /sdcard/MemosForNotes was present on the device , the Chrysaor app removes itself from the device . The actor has conducted operations since at least 2013 in support of China 's naval modernization effort . The apex domain was set to redirect to a relevant legitimate site using the Namecheap redirection service , while the subdomain points to the malicious C&C server . None The motives have not yet been definitively determined , but are guessed to be the result of a oneoff attempt to gather intelligence that potentially can be used in further phishing campaigns .


If the lateral movement with credentials fails , then the malware uses PingCastle MS17-010 scanner (PingCastle is a French Active Directory security tool) to scan that particular host to determine if its vulnerable to EternalBlue , and uses it to spread to that host . There was code to download a decoy document from the Internet and open it in a second winword.exe process using the Start-Process cmdlet .


Symantec has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks . It is highly likely MoonWind is yet another new tool being used by the group or groups responsible for that activity , indicating they are not only still active but continuing to evolve their playbook .


When the victim opens the attached word document it prompts the user to enable macro content and both the documents ( Uri Terror Report.doc and mha-report.doc ) displayed the same content and contained a Show Document button .


The ActionScript relies on event listeners to call specific functions when the event “ Event.COMPLETE ” is triggered after successful HTTP requests are issued to the C2 server .


CrowdStrike® Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams . For the sake of narrative we are going to focus exclusively to those samples we identified being used in attacks against Iranian civil society and diaspora .


Although at first glance this appears somewhat complex , it is in fact a rather simple , repeated keyboard sequence .


The information collected by the malware and the control over the victim 's mobile device allows their operators to perform more complex social engineering attacks . The campaign , which we refer to as Operation Cloud Hopper , has targeted managed IT service providers ( MSPs ) , allowing APT10 unprecedented potential access to the intellectual property and sensitive data of those MSPs and their clients globally . OceanLotus : 4c02b13441264bf18cc63603b767c3d804a545a60c66ca60512ee59abba28d4d Loader #2 . It is possible that the malware was used to support exercises such as the ones hosted by Rostelecom - Solar in 2021 in collaboration with the Russian Ministry of Energy or in 2022 for the ( SPIEF ) .


At runtime , the apps can check which carrier the device is connected to and fetch a configuration object from the command and control server . These text messages did not include links but are intended to build credibility around the fake service notifications later sent to the target 's email address . The ZxShell driver starts by acquiring some kernel information and then hooking “ ObReferenceObjectByHandle ” API . UNC4899 's targeting is selective , and they have been observed gaining access to victim networks through JumpCloud .


A few days later they can cancel the trial and do not need to pay a penny . In addition to making changes to the Excel worksheets that contain the decoy content , the actor also made changes to the worksheet that is initially displayed to the user . So , static analysis on the “ 6323 ” ﬁle shown as its nature : it is written using Microsoft Visual Studio .NET , therefore easily to reverse . These observations leave open the possibility that COSMICENERGY was developed with malicious intent , and at a minimum that it can be used to support targeted threat activity in the wild .


Ongoing activity While monitoring this particular threat , we found another XLoader variant posing as a pornography app aimed at South Korean users . Despite the differing sponsorship , penetration of Hong Kong and Taiwan-based media organizations continues to be a priority for China-based APT16 . Note the request number parameter is now 0001: 39e965e000caD60001679C79T.sample-domain.evil . The ransomware is a 64bit executable written in Rust and it recognises the following commandline parameters


The details of this attribution is explained in a dedicated section below .


WebView JavaScript Interface Continuing on the theme of cross-language bridges , Bread has also tried out some obfuscation methods utilizing JavaScript in WebViews . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 . This set of functionality allows the operator complete control of a system . Astamirov is now facing charges of wire fraud and of intentionally damaging protected computers , plus he 's accused of making ransom demands through deploying ransomware .


To trick the targeted individual into enabling macros , the attackers deliberately used jumbled-up text as content .


and was identified within an archive file ( 4FE7561F63A71CA73C26CB95B28EAEE8 ) with the name “ التفاصيل الكاملة لأغتيال فقهاء.r24 ” .


The incident represented a shift in the capabilities and consequences of ICS malware .


Next it writes a hardcoded binary from its body to “ msdeltemp.dll ” into the target directory .


The second Windows vulnerability (CVE-2017-0143) was patched in March 2017 after it was discovered to have been used by two exploit tools—EternalRomance and EternalSynergy—that were also released as part of the Shadow Brokers leak . Later that month , the same tactics and patterns were seen in attempts against an Iranian women 's activist – an individual commonly targeted by Iranian actors , such as Charming Kitten and the Sima campaign documented in our 2016 Black Hat talk .


Ukrainian officials revealed that the investigation into the compromise of the CEC ’s internal network identified malware traced to APT28 .


nis : The su application used to execute shell commands with root privileges . PLATINUM has used several zero-day exploits against their victims . Moafee and DragonOK both use a well-known proxy tool – HUC Packet Transmit MAL ( HTRAN ) – to disguise their geographical locations .


This research identified several bouts of offensive activity that occurred in the past few months , which revealed similar operational methods in which the attackers served malicious documents and other malware executables from web servers to their targets to establish an initial foothold in the network .