The table below shows the commands available to the operator for tasking on infected devices . The attack leveraged malware we called ' BlackLambert ' , which was used to target a high profile organization in Europe . The attackers primarily use malicious .PDF files that exploit vulnerabilities in Adobe Reader , Acrobat , and Flash Player , including the use of two zero-day exploits—one in 2009 and another in 2011 . Our gathered field data shows the following statistics on CSP usage across the Internet ( based on HTTPArchive March 2020 scan ):


If the system is deemed interesting , the next stage malware would be delivered into corresponding directories .


The hook gets windows messages indicating when a network drive has been attached .


One chunk contains the entire malware DLL code ( without PE headers ) . This cyber-espionage group was dubbed ' Rocket Kitten ' , and remains active as of this writing , with reported attacks as recent as October 2015 . The final payload comes in a form of a launcher DLL that contains an encrypted backdoor in its .rdata section and a plain-text configuration in its resources . Astamirov is now facing charges of wire fraud and of intentionally damaging protected computers , plus he 's accused of making ransom demands through deploying ransomware .


This opens the door to , for example , fully controlling the victim ’ s bank account . This campaign used the abovementioned .html file , malicious Excel/Word document VBA macro , the FlawedAmmyy payload , and Amadey . This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets financial organizations .


To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control . OSX Malware Linked to Operation Emmental Hijacks User Network Traffic .


After successful installation , tap Open and enable the device administrator . We believe that the Sea Turtle campaign continues to be highly successful for several reasons . APT37 has also been linked to following campaigns between 2016-2018 : Operation Daybreak , Operation Erebus , Golden Time , Evil New Year , Are you Happy? , FreeMilk , Northern Korean Human Rights , and Evil New Year 2018 .


Once in their possession , the actors use these compromised payment card credentials to generate further card information . APT threat actors , most likely nation state-sponsored , targeted a diplomat in the French Ministry of Foreign Affairs with a seemingly legitimate invitation to a technology conference in Taiwan .


Appendix Samples Some of the latest Cerberus samples found in the wild : App name Package name SHA 256 hash Flash Player com.uxlgtsvfdc.zipvwntdy 728a6ea44aab94a2d0ebbccbf0c1b4a93fbd9efa8813c19a88d368d6a46b4f4f Flash Player com.ognbsfhszj.hqpquokjdp fe28aba6a942b6713d7142117afdf70f5e731c56eff8956ecdb40cdc28c7c329 The SectorJ04 group , which has been utilizing the same pattern of infection and the same malware for more than six months , is believed to be attempting to change its infection methods such as downloading malware directly from malicious documents without using MSI installation files , changing their spam email format and using new types of backdoor . BRONZE BUTLER compromises organizations to conduct cyberespionage , primarily focusing on Japan .


The overarching campaign appears to target both Chinese nationals within different industries and government agencies in Southern Asia . This threat report gives insight into some of the information that Fox-IT has about a threat actor that it follows , called Mofang .


In addition to the following step-by-step process illustrates how Cannon communicates with the actor-controlled C2 email address to obtain a secondary payload .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools . These operations involved highly targeted email lures with repurposed content and attachments that contained an updated version of KeyBoy .


Sensitive bank documents have be found on the servers that were controlling Carbanak . this attack against a Kaspersky Lab user on August 5 , 2014 .


OLDBAIT :


The credentials they use to register their malware infrastructure are easily associated with their public social media accounts on Google® , Facebook® , MySpace® , Instagram® , and various dating and blogging sites . VAMP targeted various types of data from the phones of victims : images , text messages , contacts , and call history , among others .


The use of weaponized legitimate documents is a longstanding operational standard of Patchwork . It is highly likely that the Mofang group is a group that operates out of China and is probably government-affiliated .


Data was always sent to the C & C server via HTTP in the body of a POST request in encrypted form to the relative address /something/index.php . CTU researchers have evidence that the threat group compromised U.S and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations . These new samples targeted Linux- and Unix-based operating systems , vulnerable servers , and internet of things ( IoT ) devices by exploiting known vulnerabilities with available exploits . The customers of these commercial spyware organizations know who their victim(s ) are .


After downloading and unpacking , the main module executes the exploit binary file . The dropped PE file has the distinctive file name 8.t” . Tropic Trooper focuses on targeting government , healthcare , transportation , and high-tech industries and has been active since 2011 .


Claudio Guarnieri , a security researcher who has investigated Hacking Team along with others at the Citizen Lab , was quick to point this out . Nevertheless , resourceful threat actors such as ScarCruft will probably continue to deploy zero-day exploits against their high profile targets .


Microsoft reiterates that the PLATINUM tool does not expose flaws in Intel® Active Management Technology ( AMT ) , but uses the technology within an already compromised network to evade security monitoring tools . Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor.Sogu .


] infogooogel-drive [ . Considering the language being used in the malicious code is Arabic , it seems that the attacker is familiar with Arabic language as well . This saves the intruder from having to manually edit webpages . Adversaries may attempt to hide artifacts associated with their behaviors to evade detection .


This section contains network signatures and host-based rules that can be used to detect malicious activity associated with HIDDEN COBRA actors .


Windows 10 S devices are naturally protected against FinFisher and other threats thanks to the strong code integrity policies that don ’ t allow unknown unsigned binaries to run ( thus stopping FinFisher ’ s PE installer ) or loaded ( blocking FinFisher ’ s DLL persistence ) . menuPass is an ongoing APT campaign with a broad range of targets and will likely continue to target Japan in the future . OceanLotus : 0 config varies content is read from resource P1/1 . In one of our previous blog entries , we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming , pharmaceutical , and telecommunications companies .


These devices were located in the following countries : How we protect you To protect Android devices and users , Google Play provides a complete set of security services that update outside of platform releases . Symantec identified two strains of custom malware used by the Leafminer group : Trojan.Imecab and Backdoor.Sorgu . Given that these attacks were mostly targeted against Asia and the gaming industry , it shouldn’t be surprising they are the work of the group described in Kaspersky ’s “ Winnti – More than just a game ” . Geographically , most victims are located in Europe , specifically Italy .


The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences . In October 2015 , the Callisto Group was observed sending targeted credential phishing emails .


The domain go-microstf.com was originally set up to spoof Google Analytics login page .


After compromising a system , typically by installing Powermud or Powemuddy , Seedworm first runs a tool that steals passwords saved in users ' web browsers and email , demonstrating that access to the victim 's email , social media , and chat accounts is one of their likely goals . Adversary behavioral artifacts further suggest the TEMP.Veles operators are based in Moscow , lending some further support to the scenario that CNIIHM , a Russian research organization in Moscow , has been involved in TEMP.Veles activity .


Credential theft .


The first version of Proyecto RAT” was published at the end of 2010 . We identified an overlap in the domain voguextra.com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post .


In all of these cases , we operate under strict confidentiality rules with our customers and cannot reveal publicly any information about these attacks .


FANCY BEAR adversary used different tradecraft , deploying X-Agent malware with capabilities to do remote command execution , file transmission and keylogging .


These exploits still plague many devices today because security patches that fix them may not be available for some versions of Android , or the patches were never installed by the user . A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . We also observed a pattern that was also using an 8-bit portion of the register . Depending on the campaign , the final payload or the third intermediate stage is appended as an encrypted binary blob to the end of the image .


Talos said the perpetrators of DNSpionage were able to steal email and other login credentials from a number of government and private sector entities in Lebanon and the United Arab Emirates by hijacking the DNS servers for these targets , so that all email and virtual private networking ( VPN ) traffic was redirected to an Internet address controlled by the attackers . CTU researchers have observed the threat actors installing a credential logger and backdoor on Microsoft Exchange servers , which requires a technical grasp of Internet Information Services ( IIS ) .


The stolen data fields are : Mobile - The infected device phone number Machine - The device model ( in our example : Google Pixel 2 ) Sversion - The OS version Bank - Checks if there are any banking-related or cryptocurrency trading apps Provider - The telecommunication provider ( IMSI value in device settings ) npki - Checks if the folder named NPKI ( National Public Key Infrastructure ) might contain authentication certificates related to financial transactions onStartCommand function for stealing device information and additional sensitive data . The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 . Each attack comprises a variety of phases , including reconnaissance , exploitation , command and control , lateral movement , and Exfiltration .


In the past year , FireEye iSIGHT Intelligence has discovered newly developed wiper malware being deployed by TEMP.Reaper , which we detect as RUHAPPY . CraP2P has frequently been used to distribute other malware such as Locky and Dridex , but also supported large scale spam campaigns for dating advertisement and pump-and-dump scams after the demise of Kelihos .


If the argument -SSL is given through command-line to the artifact , these beacons will be encapsulated in an SSL connection and a proper TLS handshake will be initiated with the C&C .


These PDFs would attempt to silently infect the recipient with MiniDuke , while distracting them by displaying a decoy document .


CTU researchers assess with high confidence that threat groups like TG-1314 will continue to live off of the land to avoid detection and conduct their operations .


The actor attempts to exploit CVE-2018–8440 — an elevation of privilege vulnerability in Windows when it improperly handles calls to Advanced Local Procedure Call — to elevate the privileges using a modified proof-of-concept exploit . The China-backed Barium APT is suspected to be at the helm of the project .


Eventually , the screen PIN preferences will be saved to an additional XML file in the shared preferences folder . The dropped PE file has the distinctive file name 8.t” . Between December 28 , 2016 and January 1 , 2017 , CTU researchers observed a phishing campaign targeting Middle Eastern organizations .


Our investigation of APT28 ’s compromise of WADA ’s network , and our observations of the surrounding events reveal how Russia sought to counteract a damaging narrative and delegitimize the institutions leveling criticism .


This subset of SPLM / CHOPSTICK activity leads into several small surprises that take us into 2018 , to be discussed in further detail at SAS 2018 .


They are believed to have successfully attacked the Ministries of Internal and Foreign Affairs of several ex-Soviet countries , as well as Eastern European governments and military institutions , and NATO and the White House .


Skype ; 3rd party stores only Most of these apps are well established and available on Google Play , however , com.skype.rover appears to be available only on third-party app stores . In these instances , APT41 leveraged TeamViewer to transfer malware into the compromised environment , although we do not have direct evidence of APT41 compromising TeamViewer . As researchers continued discovering new toolsets that were created and used by the same group that had been operating MiniDuke , and thus the threat actor operating the toolsets started to be commonly referred to as " Dukes " .


During our analysis , the C2 server provided a secondary payload that functionally appeared similar to the initial Zebrocy sample .


Chinese language traces in the code : During the investigation , the Cybereason Nocturnus team discovered code artifacts that may indicate Chinese threat actors . FIN7 thus continue to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework . Coincidentally , following the recent hack of a US Navy contractor and theft of highly sensitive data on submarine warfare , we have found evidence of very recent activity by a group referred to as APT15 , known for committing cyber espionage which is believed to be affiliated with the Chinese government .


If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs . UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques .


Port 6208 : IMO extraction service . Symantec detects this threat as Backdoor.Nidiran . Meetings minutes of different Palestinian organizations . Request a demo meeting with us or reach out to us at salesthreatconnect.com to see how we can help automate phishing analysis and response for your organization .


Poseidon has maintained a consistently evolving toolkit since the mid-2000s . The attackers try to lure targets through spear phishing emails that include compressed executables .


Taking this information from directory listings , like the one shown above , allowed for the decryption of all content . Infy engaged in malware spearphishing against the same targets as Flying Kitten from the outset of its campaign ; Operation Cleaver has registered several resources related to development agencies that have been the subject of intrusion attempts by others since February 2014 . advanbusiness.com businessconsults.net businessformars.com companyinfosite.com conferencesinfo.com copporationnews.com . Unfortunately , the CSP policy ca n’t discriminate based on the Tag ID .


Locky distribution ceased in June and July but returned in August with volumes rivaling the peaks of 2016 .


We decided to call the operation “ ViceLeaker ” , because of strings and variables in its code . Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body . For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2 This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP port 443 . The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload . Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected .


All the domains in both batches were initially registered with the same alias : “ John Kasai of Klagenfurt , Austria ” .


User clicks link to attacker controlled website .


A BREXIT-themed lure document that delivers ZEKAPAB malware .


Based on our findings Linux.GreedyAntd 's operations closely resemble previous cryptojacking campaigns deployed by Pacha Group in the past . While the Sima moniker could similarly originate from software labels , it is a common female Persian name and a Persian-language Word for " visage " or " appearance " . Given its use in more advanced social engineering campaigns against women 's rights activists , the label seem particularly apt .


Our analysis shows that the threat actor behind the FakeSpy malware is a Chinese-speaking group , commonly referred to as " Roaming Mantis '' , a group that is known to have launched similar campaigns in the past . The samples we analyzed originated from the Philippines . These VNC exectuables would either be included in the SFX file or downloaded by the batch script .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server .


This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge . The exploit installs Silence’s loader , designed to download backdoors and other malicious programs .


including the functionality to steal passwords , take screenshots , log keystrokes , and steal files .


initall .


HummingWhale has also been observed hiding the original malicious app once it 's installed and trying to improve its Google Play reputation by automatically generating posts disguised as positive user comments and ratings . This reverse engineering report looks at the RATs and staging malware found within the Lazarus Group 's collection . DarkComet ( Backdoor.Breut ) : Another commodity RAT used to open a backdoor on an infected computer and steal information . Lastly , the command supplies a file named “ s1.txt ” in the " pack\scil\ " folder of the attacker 's ISO .


While they still use RAR SFX format for the initial payloads , ZeroT now uses a the legitimate McAfee utility ( SHA256 3124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe ) named mcut.exe instead of the Norman Safeground AS for sideloading as they have in the past .


This application is freely available from poisonivy-rat.com .


GolfSpy encrypts all the stolen data using a simple XOR operation with a pre-configured key before sending it to the C & C server using the HTTP POST method . We believe they may have some links to North Korea , which may explain why ScarCruft decided to closely monitor them . The third module allows the operators to take a screenshot of the remote system . Instead , they can make money by marketing their services to other bad actors for a fee .


In their latest leak , they have released the UNITEDRAKE NSA exploit , which is a remote access and control tool that can remotely target Windows-based systems to capture desired information and transfer it to a server . Dokument 09.06.2017.docx .


The entered data is forwarded to the cybercriminals . FireEye’s visibility into the operations of APT28 – a group we believe the Russian government sponsors – has given us insight into some of the government’s targets , as well as its objectives and the activities designed to further them . In the sample only the English version can be displayed to the user (that is hardcoded in the sample) .


Some apps have started with clean versions , in an attempt to grow user bases and build the developer accounts ’ reputations . Both Win32/Barlaiy & Win32/PlugX.L are remote access " trojans " , which allow Barium to gather a victim 's information , control a victim 's device , install additional malware , and exfiltrate information fi-om a victim 's device . The buttons are all in Chinese , with the help of Google Translate and keen detective skills ( read : button clicking ) , we ’ve deciphered the functionality . These group policies contained instructions to copy a file from a server to the local hard drive and to schedule a task to run the copied file at a particular time .


The Sofacy threat group continues to use their DealersChoice framework to exploit Flash vulnerabilities in their attack campaigns .


This page mimics a legitimate bank form and blocks the device screen until the user enters all the information . While not detected at the time , Microsoft 's antivirus and security products now detect this Barium malicious file and flag the file as " Win32/ShadowPad.A " . While the group has not yet demonstrated an ICS capability , RASPITE 's recent targeting focus and methodology are clear indicators of necessary activity for initial intrusion operations into an IT network to prepare the ACT for later potential ICS events .


Our research on the RTM malware shows that the Russian banking system is still a target of choice for criminals . Back in February 2016 , Indian army officials issued a warning against the usage of three apps , WeChat , SmeshApp , and Line , fearing that these apps collected too much information if installed on smartphones used by Indian army personnel .


In addition to “ Free VPN Master Android , ” we ’ ve observed Red Alert 2.0 Trojans in the wild disguising themselves using names like : Flash Player or Update Flash Player Android Update or Android Antivirus Chrome Update or Google Update Update Google Market WhatsApp Viber OneCoin Wallet Pornhub Tactic FlashLight or PROFlashLight Finanzonline The vast majority of in-the-wild Red Alert 2.0 samples falsely present themselves as Adobe Flash player for Android , a utility that Adobe stopped supporting years ago . The compilation times of APT37 malware is consistent with a developer operating in the North Korea time zone ( UTC +8:30 ) and follows what is believed to be a typical North Korean workday . The BITS mechanism has existed since Windows XP up to the current Windows 10 versions and was developed to create download/upload jobs, mostly to update the OS . They will usually have found your email address via a data breach of a third party .


Despite the group's proficiency , there are still many opportunities to detect and disrupt its operation by studying its modus operandi .


In the actual targeted attack detected by the Hungarian National Security Agency , TeamSpy used components of the TeamViewer tool combined with other malware modules . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload .


The Lazarus Group was first identified in Novetta’s report Operation Blockbuster in February 2016 . The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer .


Unfortunately , there is a specific feature of Android vulnerabilities that means it is only possible to get rid of them by receiving an update from the device manufacturers . A variety of malware , including the PlugX tool , was shared with other known Chinese threat groups . It then creates a service named clr_optimization_v4.0.30229_32 , which is responsible for executing CLR.exe . The sample of LIGHTWORK we obtained includes eight hardcoded IEC-104 information object addresses ( IOA ) , which typically correlate with input or output data elements on a device and may correspond to power line switches or circuit breakers in an RTU or relay configuration .


This is a first for an APT group , and shows Sednit has access to very sophisticated tools to conduct its espionage operations .


This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans . The developers of Bookworm use these modules in a rather unique ACT , as the other embedded DLLs provide API functions for Leader to carry out its tasks .


They have at some point used just about every cloaking and obfuscation technique under the sun in an attempt to go undetected . ALLANITE operations continue and intelligence indicates activity since at least May 2017 . A host firewall Several issues in Foxit PDF reader could lead to arbitrary code execution Foxit PDF Reader is one of the most popular PDF readers on the market , offering many similar features to Adobe Acrobat .


Cannon moves the downloaded file to the specified path .


The payload turned out to be an open source penetration test toolkit called Koadic .


] net , is now a legitimate version of the DroidVPN app , and looks as shown in Figure 1 below . RocketMan!” (probably a reference to Donald Trump’s nickname for Kim Jong Un) and MiamiBeach” serve as the first beacon messages from the victim to the control server . APT1 is a China-based cyber-espionage group , active since mid-2006 .


Coverage Additional ways our customers can detect and block this threat are listed below . The Machete group sends very specific emails directly to its victims , and these change from target to target . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank .


2015 , APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


Tools such as PlugX have historically been leveraged by threat groups operating in the PRC .


This particular HenBox variant , as listed in Table 3 above , harvests data from two popular messaging and social media apps : Voxer Walkie Talkie Messenger ( com.rebelvox.voxer ) and Tencent ’ s WeChat ( com.tencent.mm ) . APT41 has used several malware families that have also been used by other Chinese espionage operators , including variants of HIGHNOON , HOMEUNIX , PHOTO , SOGU , and ZXSHELL , among others . Of note , we also discovered the Sofacy group using a very similar delivery document to deliver a new Trojan called Cannon .


Thanks to a relative lack of security controls applied to mobile devices , these devices have become very attractive targets for a broad range of malicious actors . According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 . Lazarus Group is a threat group that has been attributed to the North Korean government .


Two years back , in the month of March we reported , NQ Mobile Security Research Center uncovered the world 's first Android bootkit malware called 'DKFBootKit ' , that replaces certain boot processes and can begin running even before the system is completely booted up . The computers of diplomats , military attachés , private assistants , secretaries to Prime Ministers , journalists and others are under the concealed control of unknown assailant (s ) . While APT1 intruders occasionally use publicly available backdoors such as Poison Ivy and Gh0st RAT , the vast majority of the time they use what appear to be their own custom backdoors . Researchers have uncovered an ongoing cyberespionage campaign targeting more than 30 online video game companies over the past four years .


This file is decrypted and injected into an instance of InstallUtiil.exe , and functions as a Tor anonymizer . PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched .


In this report , we'll review how NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . The group has also targeted businesses operating in the South China Sea , which is a strategically important region and the focus of disputes between China and other states .


Industrial safety systems are highly redundant and separate controls which override and manage industrial processes if they approach unsafe conditions such as over-pressurization , overspeed , or over-heating .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . The latest version of Madi also has the ability to monitor the Russian social network Vkontakte ( VK ) along with the Jabber messaging platform to look for users who visit websites that contain words like " USA " , " Skype " , and " gov " .


Keeping in mind the sensitivity of passwords , GoCrack includes an entitlement-based system that prevents users from accessing task data unless they are the original creator or they grant additional users to the task . Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


If you haven't heard about it for some reason , I would recommend to read this detailed report by Group-IB , as this APT attacks not only Russian banks , but also banks in more than 25 countries . In early May 2016 , both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe .


Figure 5 . ScarCruft also attacked a diplomatic agency in Hong Kong , and another diplomatic agency in North Korea . To do that , it also drops a PowerShell script on the workstation to execute . • Bad actors who want to get into the cyber attack business need little to no technical skills to get started .


The InterceptCall receiver is triggered whenever there is an incoming or outgoing call . How Buckeye obtained Equation Group tools at least a year prior to the Shadow Brokers leak remains unknown . Carbanak is a threat group that mainly targets banks .


They should also take the following steps to harden both web applications and the servers hosting them to reduce the risk of network intrusion via this vector .


Distribution via alternative app stores . LuckyMouse has been spotted using a widely used Microsoft Office vulnerability ( CVE-2017-11882 ) . The launcher is a 32-bit DLL named hpqhvsei.dll , which is the name of a legitimate DLL loaded by hpqhvind.exe . In one of our previous blog entries , we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming , pharmaceutical , and telecommunications companies .


Two of these campaigns were detailed in separate blog posts by the Polish security company Prevenity , who said that both campaigns targeted Polish entities with spear- phishing emails containing malicious attachments with relevant Polish language names .


It is however still only an iteration on earlier versions of the MiniDuke loader .


The user visits the URL to complete the payment and enters their phone number . The group has also targeted businesses operating in the South China Sea , which is a strategically important region and the focus of disputes between China and other states . Ps Process service Unix command implementation . What ’s more , two other vulnerabilities in MOVEit were found while new victims were still coming forward .


During our investigation into the activity , FireEye identified a direct overlap between BADRABBIT redirect sites and sites hosting a profiler we’ve been tracking as BACKSWING . The Magic Hound campaign was also discovered using a custom dropper tool , which we have named MagicHound.DropIt .


The one non-random string difference was the path to the “ .txt ” and “ .exe ” files within the command “ certutil -decode ” , as the Sofacy document used “ C:\Programdata\ ” for the path whereas the Luckystrike document used the path stored in the Application.UserLibraryPath environment variable .


During the May 2014 Ukrainian presidential election , purported pro-Russian hacktivists CyberBerkut conducted a series of malicious activities against the CEC including a system compromise , data destruction , a data leak , a distributed denial-of-service ( DDoS ) attack , and an attempted defacement of the CEC website with fake election results .


The ‘ onload2 ’ function decrypts the response received from the HTTP request issued in ‘ onload1 ’ function .


The class “ org.starsizew.Tb ” also has a self-monitoring mechanism to restart itself when its own onDestroy API is triggered . Artifacts identified within the malware samples related to these attacks also suggest the targeting of the defense industry in Saudi Arabia , which appears to be related to an earlier wave of attacks carried out in the fall of 2015 . Finally , the malware will write the “ IndexOfﬁce.txt ” ﬁle in the “ %APPDATA%\Microsoft\Ofﬁce\ ” path . In early 2020 , new versions of Foudre a malware associated with the APT Advanced Persistent Threat Infy discussed in detail below emerged with new and improved elements from previous versions .


The macro ran a PowerShell command that attempted to download additional PowerShell loader scripts for PupyRAT , a research and penetration-testing tool that has been used in attacks . The pie chart in Figure 8 shows that the vast majority ( 73% ) of the hosts are geographically located in Thailand , which matches the known targeting of this threat group .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy .


The key for the RC4 encryption in this sample is the hardcoded string “ h0le ” .


Quasar contains the NetSerializer library that handles serialization of high level IPacket objects that the client and server use to communicate .


Palo Alto Networks Traps Advanced Endpoint Protection recently prevented recent attacks that we believe are part of a campaign linked to DustySky .


The malicious executables all called out to the same URLs on windowsnewupdates.com .


Figure 13 : Popup asking for a credit card number The application also supports stealing credit card verification information ( Figures 14 and 15 ) . By hiding these security flaws from manufacturers like Apple and Google the CIA ensures that it can hack everyone &mdsh; at the expense of leaving everyone hackable . The intrusion into healthcare company Anthem has been attributed to Deep Panda .


As Riltok shows , cybercriminals can apply the same methods of infection to victims in different countries with more or less the same success . Kaspersky found an active campaign by a Chinese APT group we call SixLittleMonkeys that uses a new version of the Microcin Trojan and a RAT that we call HawkEye as a last stager . Indeed , the malware author moved this part of the code from the core of the malware to a library .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id87721 [ . The attackers would then use the certificate on actor-controlled servers to perform additional MitM operations to harvest additional credentials . APT28 is a threat group that has been attributed to Russia's Main Intelligence Directorate of the Russian General Staff by a July 2018 U.S. Department of Justice indictment .


IBM analysts recently unveiled a first look at how threat actors may have placed Shamoon2 malware on systems in Saudi Arabia .


Once the user double-clicks on the executable file , the dropper drops a Word document in %AppData% and displays the following decoy document to the victim , while the dropper runs in the background and installs the backdoor . %appdata%\info.docx :


Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace .


While unlikely , it is worth considering that the same C&C server might have been the subject of 3rd-party attacks due to this vulnerability .


Malicious activity is trigged only on user interaction , attackers normally use this technique to bypass sandbox/automated analysis .


This particular application is signed with a fake certificate : Owner : CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Issuer CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Serial : 1c9157d7 Validity : 11/02/2017 00:16:46 03/20/2045 00:16:46 MD5 Hash : A8:55:46:32:15 If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file . As of June 2015 , the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong .


In the beginning of July 2015 , the Dukes embarked on yet another large-scale phishing campaign .


On many occasions , both the dropper and the payload will contain a range of techniques to ensure the sample is not being analyzed on a virtual machine , using a debugger , or located within a sandbox .


There are the following relevant detection paths ( the last one is an alternative Telegram client – “ Telegram X “ ) : Name Detection path Sex Game For Adults 18.apk /storage/emulated/0/WhatsApp/Media/WhatsApp Documents/ 4_6032967490689041387.apk /storage/emulated/0/Telegram/Telegram Documents/ Psiphon-v91.apk /storage/emulated/0/Android/data/org.thunderdog.challegram/files/documents/ Backdoored Open Source During the course For simplicity , Kaspersky is calling them the BlackEnergy APT group . We believe they may have some links to North Korea , which may explain why ScarCruft decided to closely monitor them .


BRONZE PRESIDENT uses custom batch scripts to collect either specific file types ( including files with .pptx , .xlsx , .pdf extensions ) or all files within a specific location .


Analysis of those files uncovered two more imphashes , 0B4E44256788783634A2B1DADF4F9784 and E44F0BD2ADFB9CBCABCAD314D27ACCFC , for a total of 20 malicious files .


CTU researchers discovered the threat actors searching for " [company] login , " which directed them to the landing page for remote access .


What this means for you All Lookout customers are protected from this threat . The Axiom group has been presented as an advanced Chinese threat actor carrying out cyber-espionage attacks against a whole range of different industries . The ZxShell mutex is created named @_ZXSHELL_@ . The file c018c54eff8fd0b9be50b5d419d80f21 ( r3_iec104_control.py ) imports the " iec104_mssql_lib " module , which is contained within the extracted contents as adfa40d44a58e1bc909abca444f7f616 ( iec104_mssql_lib.pyc ): 2b86adb6afdfa9216ef8ec2ff4fd2558 ( iec104_mssql_lib.py ) implements PIEHOP ’s primary capabilities and contains many developer - supplied comments for the included code .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools . It is therefore possible that the large percentage of high value targets identified in our analysis of the GhostNet are coincidental , spread by contact between individuals who previously communicated through e-mail .


DROPSHOT is a notable piece of malware used to deliver variants of the TURNEDUP backdoor . The campaign code " 20150920 " is associated with this decoy , which is a week prior to media articles announcing that the Crown Price of Thailand Maha Vajiralongkorn will lead the Bike for Dad 2015 event .


Each organization typically only saw a handful of employees at the receiving end of these emails .


Interestingly , there appear to be two parallel efforts within the campaign , with each effort using a completely different toolset for the attacks .


This mimics the wallet updater connected to the C2 addresses : wfcwallet.com ( resolved ip : 108.174.195.134 ) , www.chainfun365.com ( resolved ip : 23.254.217.53 ) .


After analyzing the traffic associated with these short links , we determined that each one was associated with a referral path from mail.mosa.pna.ps . With Javafog , we are turning yet another page in the Icefog story by discovering another generation of backdoors used by the attackers . When APT1 attackers are not using WEBC2 , they require a “ command and control ” ( C2 ) user interface so they can issue commands to the backdoor . Cisco Talos researchers recently discovered Greatness , one of the most advanced phishing - as - a - service tools ever seen in the wild .


] info OpSec fails and use of cryptography While looking at this infrastructure , we identified that one of these domains has directory indexing enabled . On May 2 , 2016 , Palo Alto published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available . However , they also include names referencing English-speaking countries , such as “ aunewsonline.com ” ( Australia ) , “ canadatvsite.com ” ( Canada ) , and “ todayusa.org ” ( U.S . ) . Our demonstration shows how using the Google Analytics API , a web skimmer can send data to be collected in his own account instance .


] net , negg2.ddns [ . We found two malicious iOS applications in Operation Pawn Storm . The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


To protect against code injections and other attacks , system operators should routinely evaluate known and published vulnerabilities , periodically perform software updates and technology refreshes , and audit external-facing systems for known web application vulnerabilities .


While FireEye has not directly observed BACKSWING delivering BADRABBIT , BACKSWING was observed on multiple websites that were seen referring FireEye customers to 1dnscontrol.com , which hosted the BADRABBIT dropper . Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14 , 2017 , FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


The beginning of 2011 however saw a significant break from that routine , when a large grouping of domain names was registered by the Dukes in two batches ; the first batch was registered on the 29th of January and the second on the 13th of February .


It then resets cron and removes possible cache files from other programs , starts scripts and binaries a , init0 , and start , and sets the persistence by modifying the crontab .


Some emulators build their phone number out of the default number created in the emulator software and the port number : 5554. getMachine function using anti-emulator technique . AveMaria is a new botnet , whose first version we found in September 2018 , right after the arrests of the FIN7 members . ministries of foreign affairs in Europe have been targeted and compromised by a threat actor we call Ke3chang .


As rooting exploits on Android become less prevalent and lucrative , PHA authors adapt their abuse or monetization strategy to focus on tactics like click fraud . In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy . Unlike the Nov. 26 campaign , these attacks targeted Taiwanese governmental and media and entertainment organizations . The contents of the Exchange Web Server ( also found within the folder ) • At least 14 days of Exchange Control Panel ( ECP ) logs , located in We have found significant hunting and analysis value in these log folders , especially for suspicious CMD parameters in the ECP Server logs .


Originally intended to target the Russian audience , the banker was later adapted , with minimal modifications , for the European “ market. ” The bulk of its victims ( more than 90 % ) reside in Russia , with France in second place ( 4 % ) . It also reconfigures the Microsoft Sysinternals registry to prevent pop-ups when running the PsExec tool . Talos has named this malware KONNI .


At the time of writing this article , no other significant changes in Asacub ’ s network behavior had been observed : The origin of Asacub It is fairly safe to say that the Asacub family evolved from Trojan-SMS.AndroidOS.Smaps . The threat actors have used the Baidu search engine , which is only available in Chinese , to conduct reconnaissance activities . From the sample we analyzed , attacks started from one virtual private server ( VPS ) that searches for a vulnerable machine to compromise ( previous techniques used malicious URLs or infecting legitimate websites for bot propagation ) . We also want to specifically thank Google ’s Threat Analysis Group ( TAG ) , Mandiant ’s DPRK Fusion Cell , and our government partners for their continued collaboration and support .


Malware code showing definition of populateConfigMap Figure 14 . ther names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon . The other archiving tools were able to extract one file from the ZIP attachment – either order.jpg or SHIPPING_MX00034900_PL_INV_pdf.exe . CADDYWIPER was then executed as a scheduled task at a predetermined time .


The document loads malicious content from http://109.248.148.42/office/thememl/2012/main/attachedTemplate.dotm via the settings.xml.rels component that is embedded within the DOCX document .


If brother.apk application is removed , mcpef.apk reinstalls brother.apk from assets . It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks . Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document .


The ability to carry out these types of intelligence-gathering activities on phones represents a huge score for the operator . Based on the patterns of subdomain registration over time in DNS , TRAC believes this is an example where the attackers registered their own second-level domain . The pause and retooling by APT12 was covered in the Mandiant 2014 M-Trends report . As a result , we decided to call this variant FakeSG .


Figure 7 – C2 As seen in Figure 8 , this version of Anubis is built to run on several iterations of the Android operating system , dating back to version 4.0.3 , which was released in 2012 . Wild Neutron 's attack took advantage of a Java zero-day exploit and used hacked forums as watering holes . We recently discovered some interesting telemetry on this actor , and decided to dig deeper into ScarCruft ’s recent activity . The themed " updates " look very professional and are more up to date than its SocGholish counterpart .


1849a50a6ac9b3eec51492745eeb14765fe2e78488d476b0336d8e41c2c581d4 d328fca14c4340fcd4a15e47562a436085e6b1bb5376b5ebd83d3e7218db64e7 59b9809dba857c5969f23f460a2bf0a337a71622a79671066675ec0acf89c810 120474682ea439eb0b28274c495d9610a73d892a4b8feeff268c670570db97e2 For the sake of this analysis we'll take the Vietnamese backdoor as an example ; the one found in the Indian attack operates in the exact same way . The attackers behind the breach of the New York Times ’ computer network late last year appear to be mounting fresh assaults that leverage new and improved versions of malware . RussianPanda ( @AnFam17 ) named the URL shortcut campaign RogueRaticate .


Additionally , one of the two government organizations had the highest infection rate of the Indian targets .


In our February report , we discovered the Sofacy group using Microsoft Office documents with malicious macros to deliver the SofacyCarberp payload to multiple government entities .


For threat hunting , iDefense recommends searching for the following :


In addition , Antiy Lab revealed the APT organization Green Spot on September 19 , 2018 . Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download .


In addition to the traffic originating from Chengdu , we identified a selection of hacktools and malware signed using nine stolen certificates .


It abuses accessibility services . In this blog we provide insight into the tactics , techniques and procedures (TTPs) of a Brazilian cyber crime group that specializes in payment card fraud operations . In August 2017 , we found this threat group has developed yet another Trojan that they call ' Agent Injector ' with the specific purpose of installing the ISMAgent backdoor .


Execute a command through exploits for CVE-2018-0802 . Their operations against gaming and technology organizations are believed to be economically motivated in nature .


In this scenario , the domain cdnverify.net was registered on January 30 , 2018 and just two days later , an attack was launched using this domain as a C2 .


As mentioned by Kaspersky , even though the exploits used for these MiniDuke campaigns were near-identical to those described by FireEye , there were nevertheless small differences .


This threat group attacked defense contractors and aerospace companies . China Chopper contains a remote shell ( Virtual Terminal ) function that has a first suggested command of netstat an|find ESTABLISHED .


Thanks to this tool reuse , we found the threat group uploading a credential dumping tool called Dumpert that we had not seen used in prior incidents involving the exploitation of CVE-2019-0604 .


The Word document usually exploits CVE-2012-0158 . The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April .


According to the document.xml file , the DealersChoice loader SWF exists after the “ covert-shores-small.png ” image file within the delivery document .


RECEIVE_SMS - Allows the application to receive SMS messages . Of note , FireEye discovered two additional new malware families hosted at this domain , VALUEVAULT and LONGWATCH . While it 's not known if the attackers physically reside in Pakistan , all members of Gorgon Group purport to be in Pakistan based on their online personas .


The first part is the target directory , the second is a regular expression used to match specific files , while the last part is an ID . But before the ScarCruft infection , however , another APT group also targeted this victim with the host being infected with GreezeBackdoor on March 26 , 2018 . The last retrieved module is a persistence module . Lesser - known threat actors want to piggyback off having a big name associated with them , like DarkSide , to intimidate their actors or lend more credence to the effectiveness of their threats .


] com hxxp : //mailsa-wqe [ . Since releasing our 2014 report , we continue to assess that APT28 is sponsored by the Russian Government . Using TXT resource records enabled the actors to provide tasking in fewer transactions due to the amount of data that can be transmitted in a TXT . Another new actor we discovered , seemingly of Vietnamese origin , uses a Yashma ransomware variant to target victims in Bulgaria , China , Vietnam and other countries .


TEMP.Veles ’ lateral movement activities used a publicly-available PowerShell based tool , WMImplant .


Once again this downloader is as straightforward as the Zebrocy gang ’s other downloaders .


Users looking forward to using the TikTok app amidst the ban might look for alternative methods to download the app . Xagent is the original filename Xagent.exe whereas seems to be the version of the worm . The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes , normally using Syrian and Iranian themes .


The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 . Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 ( Microsoft Office Equation Editor , widely used by Chinese-speaking actors since December 2017 ) , we can′t prove they were related to this particular attack .


One of its file stealers , swissknife2 , abuses a cloud storage service as a repository of exfiltrated files . At that time it was the name of a cybercriminal group that was stealing money from Russian financial establishments — to the tune of at least $150,000 per hit .


As mentioned in our previous blog on Bookworm , the Trojan sends a static date string to the C2 server that we referred to as a campaign code . It is thus interesting to see Buhtrap add strategic web compromises to their arsenal .


The stages of the FinFisher multi-layered protection mechanisms Stage 0 : Dropper with custom virtual machine The main dropper implements the VM dispatcher loop and can use 32 different opcodes handlers . The Elise malware used by Lotus Blossom , which was an attack campaign on targets in Southeast Asia . Let’s start with who is not targeted . Because the cdhash is computed based on executable code in the application , Mandiant was able to identify additional malware in the environment despite the files being deleted by the threat actor and the samples having different file hashes .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . No zero-day vulnerabilities were used to breach targeted networks , instead " TG-3390 relied on old vulnerabilities such as CVE-2011-3544 " — a near-year-old Java security hole — " and CVE-2010-0738 to compromise their targets " , Dell SecureWorks' researchers reported .


Equipped reverse shell payload with specific string After an in-depth look , we found that some versions of the reverse shell payload code share similarities with PRISM – a stealth reverse shell backdoor that is available on Github . OceanLotus's targets include China's maritime institutions , maritime construction , scientific research institutes and shipping enterprises . In 2016 and 2017 , the group targeted managed IT service providers , manufacturing and mining companies , and a university .


This threat actor is remarkable for two reasons : Its access to sophisticated zero-day exploits for Microsoft and Adobe software Its use of an advanced piece of government-grade surveillance spyware FinFisher , also known as FinSpy and detected by Microsoft security products as Wingbird FinFisher is such a complex piece of malware that , like other researchers , we had to devise special methods to crack it . APT40 relies heavily on web shells for an initial foothold into an organization . The backdoor reports information about the machine such as the user name , computer name , Windows version and system language to the C&C server and awaits commands . • Cisco Talos has discovered a threat actor conducting several campaigns against government entities , military organizations and civilian users in Ukraine and Poland .


The Web page shown here on the left is hosted on a domain that seems apt : free-vpn [ . FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . In that case, it takes a . The United States is joining with allies and partners to condemn Russia ’s destructive cyber activities against Ukraine .


In the case of 32-bit systems , the malware may attempt a known UAC bypass by launching printui.exe system process and using token manipulation with NtFilterToken as described in this blog post . CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash . The way the payload is invoked ( by overwriting the return address on the stack , as opposed to a direct call ) . The Talos Threat Spotlight posts and Quarterly Trends reports provide details of threats and the techniques used by threat actors .


The majority of infected machines are located in the US , Bangladesh and the UK ;


First , it modifies the Zygote process . This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams . It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . There has also been at least one victim targeted by a spear-phishing attack .


125: UK , US , and Canada 220: UK and Australia 223: Germany 7200: UK 7500: Australia .


This domain is similar to the one the malware author used for his adware C & C communication , minigameshouse [ . RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism . SHA256 : dd730cc8fcbb979eb366915397b8535ce3b6cfdb01be2235797d9783661fc84d .


Gaza Cybergang Group 3 in Operation Parliament : In this instance , the malware also used people ’s names for C2 communication to send and receive commands from the server .


The adversaries then issue HTTP GET requests , sometimes with the User-Agent MINIXL , to exfiltrate the archive parts from the victim's network .


Further analysis of the malware identified what looks like a custom back door .


Each of these behaviors is under the control of the remote C2 server . The discovery by Kaspersky marks at least the fifth zero-day exploit used by BlackOasis and exposed by security researchers since June 2015 . From this URL it tries to download another stage then storing it into “ C:\Users\admin\AppData\Roaming\ ” path with random name . NjRAT is an open - source remote access trojan ( RAT ) whose source code is freely available and is used by commodity actors and APTs , making the process of attribution more difficult .


UAC When running under a limited UAC account , the installer extracts d3d9.dll and creates a persistence key under HKCU\Software\Microsoft\Windows\Run . The attacker used a spear-phishing email containing a link to a fake resume hosted on a legitimate website that had been compromised . The library code performs numerous checks for the CPU features , and based on the outcome , it will choose a processor-specific implementation of the cryptographic function . The file c018c54eff8fd0b9be50b5d419d80f21 ( r3_iec104_control.py ) imports the " iec104_mssql_lib " module , which is contained within the extracted contents as adfa40d44a58e1bc909abca444f7f616 ( iec104_mssql_lib.pyc ): 2b86adb6afdfa9216ef8ec2ff4fd2558 ( iec104_mssql_lib.py ) implements PIEHOP ’s primary capabilities and contains many developer - supplied comments for the included code .


It is worth noting that shortly before the attack , security vendors reported the use of 0-day exploits in Flash Player and Microsoft Windows by the same threat actor .


The existence of the Equation Group was first posited in Feb. 2015 by researchers at Russian security firm Kaspersky Lab , which described it as one of the most sophisticated cyber attack teams in the world . They tried new techniques to steal from banking systems , including AWS CBR ( the Russian Central Bank 's Automated Workstation Client ) , ATMs , and card processing .


% 20Configuratore % 20v5_4_2.apk http : //vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/ 2015-01-14 http : //windupdate.serveftp.com/wind/LTE/WIND % 20Configuratore % 20v5_4_2.apk http : //windupdate.serveftp.com/wind/LTE/ 2015-03-31 http : //119.network/lte/Internet-TIM-4G-LTE.apk http : //119.network/lte/download.html In China alone , we have seen underground market sheep shavers” ported SMS rogue marketing strategy to spread Alipay Red Packet referral URL links . APT12 : IXESHE , DynCalc , Numbered Panda , DNSCALC .


If the user wants to check which app is responsible for the ad being displayed , by hitting the “ Recent apps ” button , another trick is used : the app displays a Facebook or Google icon , as seen in Figure 6 . The malware may inject itself into browser processes and explorer.exe . We don't know if the document is a legitimate compromised document or a fake that the attacker has created in an effort to be credible .


By : Trend Micro April 20 , 2018 We have been detecting a new wave of network attacks since early March , which , for now , are targeting Japan , Korea , China , Taiwan , and Hong Kong . One of the IP addresses , 128.127.105.13 , was previously used by the DoNot Team (aka APT-C-35) , a suspected Indian APT group . Paying more attention during the code analysis , we discovered that it is full of junk instructions used to declare and initialize variables never used .


Nbtscan — This publicly available command-line tool scans systems for NetBIOS name information ( see Figure 2 ) .


Spaghetti code makes the program flow hard to read by adding continuous code jumps , hence the name . iDefense analysts have identified a campaign likely to be targeting members of or those with affiliation or interest in the ASEAN Defence Minister 's Meeting ( ADMM ) . We have seen it installed as a Windows service and as a DLL in C:\Windows\System32 using the following file names : The threat actor was consistently observed removing prior payloads from disk ; however , the FSEvents artifacts were able to provide great insight into files that previously existed on disk .


One certificate was generated locally on what appeared to be a HP-UX box , and another was generated on 8569985.securefastserver.com with an email address root@8569985.securefastserver.com , as seen here for their nethostnet.com domain .


Artifacts During the research , we found plenty of traces of the developers and those doing the maintaining . Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware . The admin@338 has targeted international media organizations in the past .


All MiniDuke components , from the loader and downloader to the backdoor , had been slightly updated and modified during the downtime .


' to disguise the Base64 . After injecting Meterpreter into memory , the attacker had complete control of the infected device . The group has compromised more than 16 organizations in at least 13 different countries , sometimes simultaneously , since at least 2014 .


Separate administrators into privilege tiers with limited access to other tiers .


DHS and FBI assess that HIDDEN COBRA actors will continue to use cyber operations to advance their government 's military and strategic objectives .


Alternatively , it is also possible that APT41 injected malicious code into the package prior to compilation , circumventing the need to steal the code-signing certificate and compile it on their own . The first time the Lambert family malware was uncovered publicly was in October 2014 , when FireEye posted a blog about a zero day exploit ( CVE-2014-4148 ) used in the wild .


In particular , we noted that the Sofacy group deployed a webpage on each of the domains .


This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April . Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam .


] com Unit 42 published a blog in July 2016 about 9002 malware being delivered using a combination of shortened links and a file hosted on Google Drive . In another instance , APT41 targeted a hotel’s reservation systems ahead of Chinese officials staying there , suggesting the group was tasked to reconnoiter the facility for security reasons . In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 .


Port 6209 : Telegram extraction service . Specifically , Suckfly used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows . News about Hamas and the Palestinian National Authority . The contents found in secure[.]66[.]to often lead to zhu[.]vn , which is Hack520 ’s domain for hosting his own private blog .


This can be packaged and " sold '' in many different ways to customers . As we have seen in some previous targeted malware attacks , the attackers in this incident are taking advantage of services like changeip.com to establish free subdomains in their infrastructure . These development efforts may have resulted in the emergence of the WATERSPOUT backdoor . The tactics , techniques and procedures ( TTPs ) are very similar to those of SocGholish and it would be easy to think the two are related .


The use of a white font coloring to hide contents within a weaponized document is a technique we had previously reported being used by the Sofacy group in a malicious macro attack .


The xxxx.exe file copies happiness.txt to C:\PROGRAM FILES\common files\ODBC\ODUBC.DLL and to C:\WINDOWS\system32\jql.sys .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . Our analysis of this malware shows that it belongs to Hussarini , also known as Sarhust , a backdoor family that has been used actively in APT attacks targeting countries in the ASEAN region since 2014 .


Some malicious files associated with these samples were titled the following : Council_of_ministres_decision Minutes of the Geneva Meeting on Troops Summary of today 's meetings.doc.exe The most important points of meeting the memory of the late President Abu Omar may Allah have mercy on him - Paper No . In 2013 , a public report reveals a group of actors conducted targeted attacks leverage a malware dubbed ICEFOG against mainly government organizations and defense industry of South Korea and Japan . That string is the base64 encoded version of “ s : 54 ” , meaning “ sleep for 54 minutes ” ( or hours , depending on the particular backdoor ) . As Nick Biasini explained in a past episode of Talos Takes , name recognition also plays a major part in the rising popularity of this business model .


At that time , Rockloader was the initial payload downloaded by malicious attached JavaScript files .


The Flash object embedded within this delivery document is a variant of an exploit tool that we call DealersChoice .


Running the script removes the remaining files and scripts from previous attacks , keeping a low profile to evade detection .


Based on samples of Duke malware from 2012 , the Dukes do appear to have continued actively using and developing all of their tools .


Additionally , the improvements we made to our protections have been enabled for all users of our security services . RASPITE targeting includes entities in the US , Middle East , Europe , and East Asia . Right after the PE entry point , the standard call to the C Runtime initialization ( __scrt_common_main_seh ) is hooked to launch the malicious payload before everything else . More information Over the course of three and a half years , OilRig has used various backdoors , starting with DanBot , as well as using the Shark backdoor in April 2021 before transitioning to the Milan backdoor and the new backdoor Marlin in August 2021 .


The spear phishing emails had Myanmar political-themed lures and , if the 9002 C2 server responded , the Trojan sent system specific information along with the string “ jackhex ” . These supply chain compromise tactics have also been characteristic of APT41’s best known and most recent espionage campaigns . From 2016 through 2017 , two subsidiaries of U.S. and Philippine consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations .


According to the hacking collective , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks . Examples of notable Potao dissemination techniques , some of which were previously unseen , or at least relatively uncommon , include the use of highly-targeted spear-phishing SMS messages to drive potential victims to malware download sites and USB worm functionality that tricked the user into ' willingly ' executing the Trojan .


In their latest leak , they have released the UNITEDRAKE NSA exploit , which is a remote access and control tool that can remotely target Windows-based systems to capture desired information and transfer it to a server . Blackgear has been targeting various industries since its emergence a decade ago .


The targets of these campaigns , according to Kaspersky , were located variously in Belgium , Hungary , Luxembourg and Spain .


It steals money from the victim ’ s bank account . Southeastern Europe as well as countries in the former Soviet Union Republichas recently been the main target . Winnti : hpqhvsei.dll . Simultaneously , a threat researcher outside of CrowdStrike discovered an attacker ’s tooling via an open repository , downloaded all of the tools , and made them available through a MegaUpload link in a Twitter post.2


The database contained the last activity performed on around 60 compromised devices . The TA505 group is one of the most active threat groups operating since 2014 , it has traditionally targeted Banking and Retail industries , as we recently documented during the analysis of the Stealthy Email Stealer” part of their arsenal . According to trusted third-party reporting , HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace , telecommunications , and finance industries .


One ELF library , libloc4d.so , handles amongst other things the loading of the app-decoded ELF library file “ sux ” , as well as handling connectivity to the C2 . In May 2016 , APT41 deployed a POISONPLUG sample at a U.S.-based game development studio . The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 .


Some of these same tools , identified by hash , were evaluated in a malware testing environment by a single user .


This payload is also used by the earlier versions of the implant . Cisco Talos recently published a blogpost describing targeted attacks in the Middle East region which we believe may be connected . Winnti Group : Blackfly .


The user may not notice the Flash object on the page , as Word displays it as a tiny black box in the document , as seen in Figure 1 .


BrainTest uses four privilege escalation exploits to gain root access on a device and to install a persistent malware as a system application . PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 . The tactical malware , historically EvilGrab , and now ChChes ( and likely also RedLeaves ) , is designed to be lightweight and disposable , often being delivered through spear phishing .


Because the real nature of apps containing adware is usually hidden to the user , these apps and their developers should be considered untrustworthy . There was code to download a decoy document from the Internet and open it in a second winword.exe process using the Start-Process cmdlet . Bankshot was first reported by the Department of Homeland Security on December 13 , 2017 , and has only recently resurfaced in newly compiled variants .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) .


] today www [ . Given the wide usage of STAR in LATAM , financial institutions in LATAM could have particular exposure to a potential interest from the MoneyTaker group . This sample ( aa873ed803ca800ce92a39d9a683c644 ) exhibited network traffic that does not match the earlier pattern and therefore may evade existing network traffic signatures designed to detect Ixeshe related infections . The web shell , named help.aspx ( MD5 : 4b3039cf227c611c45d2242d1228a121 ) , contained code to identify the presence of ( 1 ) FireEye xAgent , ( 2 ) CarbonBlack , or ( 3 ) CrowdStrike Falcon endpoint products and write the output of discovery .


It should be noted that CosmicDuke does not interoperate with the second , embedded malware in any way other than by writing the malware to disk and executing it .


C2 and Targeted Banks As described earlier , the C2 domain is kept in the app ’ s resources . We consider APT38 's operations more global and highly specialized for targeting the financial sector . For example , The code hunted for several security products to evade – including Kaspersky .


DualToy is still active and we have detected over 8,000 unique samples belonging to this Trojan family to date . Indeed , we have detected various external tools being abused by Okrum , such as a keylogger , tools for dumping passwords , or enumerating network sessions . North Korean group definitions are known to have significant overlap , and the name Lazarus Group is known to encompass a broad range of activity .


The WICKED PANDA adversary makes use of a number of open-source and custom tools to infect and move laterally in victim networks . The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


CTU researchers and Secureworks incident responders have observed BRONZE PRESIDENT using the following tools , along with several custom batch scripts for locating and archiving specific file types :


The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information . Buhtrap has been active since 2014 , however their first attacks against financial institutions were only detected in August 2015 .


In April 2015 , we uncovered the malicious efforts of APT30 , a suspected China-based threat group that has exploited the networks of governments and organizations across the region , targeting highly sensitive political , economic and military information . In addition to spreading malware via spear fishing email with Office attachment containing either vulnerability or malicious macro , this group is particularly good at leveraging malicious Android APKs in the target attacks .


Proofpoint researchers track a wide range of threat actors involved in both financially motivated cybercrime and state-sponsored actions .


Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue . Threat actors like Confucius and Patchwork are known for their large arsenal of tools and ever-evolving techniques that can render traditional security solutions — which are often not designed to handle the persistent and sophisticated threats detailed in this blog — ineffective .


If the package name of the foreground app is included in the target list , an overlay is shown . Recorded Future has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 . According to the debug path in the body , the author of the tool called it “ NamelessHdoor , ” and its internal version is identified as “ V1.5. ”


looks like it was created for manual operator control . Since at least 2013 , HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government , financial , automotive , and media industries . APT33 : 95.211.191.117 update-sec.com . We have observed some lower degrees of confidence overlaps in post - exploitation stages among these UNC groups , like using the same recon commands and utilities available on Windows .


Downeks can be instructed by the C2 to perform a few other commands :


Once the keyword is present , the SDK will switch from innocent ads server to malicious payload delivery ones . The sctrls backdoor we came across is delivered via RTF files exploiting CVE-2015-1641 . The goal of the campaign is to capture credit card data from guests and travelers stored in hotel systems , as well as credit card data received from popular online travel agencies ( OTAs ) such as Booking.com . The final payloads include the AgentTesla remote access trojan ( RAT ) , Cobalt Strike beacons and njRAT .


] top/7 * * * * * 3 ” ( Fr . APT33 is the only group that Kaspersky has observed use the DROPSHOT dropper . The developer used the Microsoft Winsocks API to handle the network connection .


Figure 7 . For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer . Once decoded , decrypted , and executed , an obfuscated loader will load one of the APT32 backdoors . They also added a new user for persistence and used the Wput tool to exfiltrate the victims files to their own FTP server .


That is why Microsoft has been working to extend its industry-leading endpoint protection capabilities beyond Windows . Starting in mid-February , Unit 42 researchers have been tracking an active campaign sharing a significant portion of infrastructure leveraged by Gorgon Group for criminal and targeted attacks . The modified code will consider this . Kaspersky ’s Global Research and Analysis Team ( GReAT ) has observed signs of its attacks in several countries including Germany , South Korea and Uzbekistan , as well as the US .


'' Strazzere 's experience in trying to contact both vendors last year is typical of the frustrations frequently faced by security researchers . After further analysis , it was discovered that the RTF files were exploiting the CVE-2018-0798 vulnerability in Microsoft’s Equation Editor (EQNEDT32) . Custom Gh0st : 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 .


Several Mandiant investigations revealed that , after gaining access , APT32 regularly cleared select event log entries and heavily obfuscated their PowerShell-based tools and shellcode loaders with Daniel Bohannon’s Invoke-Obfuscation framework . Based on analysis of the data and malware samples we have collected , Unit 42 believes the attacks described herein are the work of a group or set of cooperating groups who have a single mission , collecting information on minority groups who reside in and around northwestern China .


One theory is that the botnets were a criminal side business for the Dukes group .


The researchers say the malware uses the unusually tight control it gains over infected devices to create windfall profits and steadily increase its numbers . The cybercriminal group Lazarus has a history of attacking financial organizations in Asia and Latin America . APT33 : 8.26.21.117 srvhost.servehttp.com . " Indicators of attack IoAs refer to the series of behaviors that a cybercriminal exhibits prior to executing a cyberattack .


PUTTER PANDA is likely to continue to aggressively target Western entities that hold valuable information or intellectual property relevant to these interests . Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina .


This entry was posted on Fri Mar 16 00:00 EDT 2018 and filed under Targeted Attacks , FireEye , and China . From our trend analysis seen in Figure 3 , Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August .


For example , Trojan.Shunnael ( aka X-Tunnel ) , malware used to maintain access to infected networks using an encrypted tunnel , underwent a rewrite to .NET .


This ' connection bouncer ' tool lets the threat actor redirect ports and connections between different networks and obfuscate C2 server traffic . The computers of diplomats , military attachés , private assistants , secretaries to Prime Ministers , journalists and others are under the concealed control of unknown assailant (s ) .


The group has performed these activities at multiple locations across Brazil , possibly using multiple mules . Turla is a notorious group that has been targeting government officials .


The malicious application is on the left-hand side . We expect to see BITTER APT continuing to target the government of China by employing spoofed login pages designed to steal user credentials and obtain access to privileged account information . APT33 's targeting of organizations involved in aerospace and energy most closely aligns with nation-state interests , implying that the threat actor is most likely government sponsored .


Finished ! Had more ccTLDs implemented security features such as registrar locks , attackers would be unable to redirect the targeted domains . APT38 APT38 is a financially-motivated threat group that is backed by the North Korean regime .


The group used malware with keylogging capabilities to monitor the computer of an executive who manages the company 's relationships with other telecommunications companies . Analysis of TG-3390 's operations , targeting , and tools led CTU researchers to assess with moderate confidence the group is located in the People's Republic of China .


MD5 b84b66bcdecd4b4529014619ed649d76 SHA1 fef1725ad72e4ef0432f8cb0cb73bf7ead339a7c Algorithm sha1 With RSA Encryption .


It will use either a standard web request or it will write data into a web socket if the first method fails . A recently rising attack tool in ITG08 campaigns has been the More_eggs JScript backdoor . However , we asses with medium confidence that NavRAT is linked to Group123 .


The dates were all fairly recent , having been received in the past few days since the beginning of August .


All 3 samples were compiled with the same timestamp .


Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address . From February to September 2016 , WhiteBear activity was narrowly focused on embassies and consular operations around the world .


A Russian security firm 'Doctor Web ' identified the first mass distributed Android bootkit malware called 'Android.Oldboot ' , a piece of malware that 's designed to re-infect devices after reboot , even if you delete all working components of it . Some time ago , a Kaspersky Lab customer in Latin America contacted us to say he had visited China and suspected his machine was infected with an unknown , undetected malware . We believe that APT1 is able to wage such a long-running and extensive cyber espionage campaign in large part because it receives direct government support . The exploits are located in separate web pages .


Once the backdoor sends basic information about its newly compromised system , the operators take control of the backdoor and start to send commands right away .


Patterning such as reuse of WHOIS artifacts , IP reuse , or even domain name themes are common and regularly used to group attacks to specific campaigns .


It prompts the user to download a file that supposedly contains the full article .


Corrupted archive privapp.txt Looks like a list of system applications ( including spyware components ) from the infected device run-as.x run-as.y Run-as tool ELF file SuperSU config fragment for implant components and the busybox tool supersu.cfg : This config allows the implant to use all root features silently . DHS and FBI are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity . APT33 : 8.26.21.120 mynetwork.ddns.net . The ThreatConnect Platform centralizes threat intelligence , automates key activities and enables information sharing across the internal security organization and with external partners .


While we became initially curious because the hacktool was signed , we became more suspicious when we realized a mobile software developer had signed it , since this is not the type of software typically associated with a mobile application .


Quasar mutex name : VMFvdCsC7RFqerZinfV0sxJFo .


Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download . this RTF exploits again the CVE-2017-1882 on eqnedt32.exe .


C2 server : app.progsupdate.com , which resolved to 185.141.25.68 ) , over port 4664 .


We recently observed a resurgence of the same phishing campaign when our systems detected roughly 90 phony Apple-like domains that were registered from July 2016 to September 2016 . The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan .


The Spark backdoor allows the attackers to :


This exploit delivers a malware variant that shares characteristics with the APT28 backdoors CHOPSTICK and CORESHELL malware families , both described in our APT28 whitepaper .


Using our Farsight DNSDB integration , we identified other domains currently and previously hosted on the same IP .


In doing so , users can become victims to malicious apps portraying themselves as the original app . Although both examples of the different delivery methods described above show an exclusive targeting of Russian speakers , the recurring financial and political themes that they use highlight the attacker's interest in the financial world once more . When executed , it will register symbols for multiple commonly used functions , including : open() , rmdir() , and unlink() , and modify their returns to hide the malware ’s operations .


Below is a table with the compile date and some PDB strings found within a few of the binaries .


For example , Svpeng uses a previously unknown vulnerability to protect itself from being removed manually or by the antivirus program . The group used a number of tools common to other Chinese hacking groups , but they had a few unique tools of their own with interfaces developed for Standard ( Simplified ) Chinese . The decrypted payload is the usual shellcode responsible for ShadowPad initialization ( obfuscated using fake conditional jumps to hinder disassembly ) . The threat of Iranian cyber operations continues to rise as challenges in relation to the renewal of the 2015 Iranian Nuclear Deal persist and regional tensions , specifically between Israel and Iran , escalate .


They took advantage of the Syrian military conflict for thematic content and file naming “ Trump ’s_Attack_on_Syria_English.docx ” .


However , Poseidon 's practice of being a ' custom-tailored malware implants boutique ' kept security researchers from connecting different campaigns under the umbrella of a single threat actor . These attacks are primarily targeting private industry in search of key intellectual property for competitive advantage , military institutions , and governmental organizations often in search of documents related to current political events and human rights organizations .


The Stage-1 downloader will download and execute a new downloader , written in C++ , not so different from other Zebrocy downloaders .


Group-IB specialists detected various sites used by criminals to spread the Trojan : mail tracking websites , news portals , electronic books , computer graphics resources , music portals , etc . In addition to using SWCs to target specific types of organizations , TG-3390 uses spearphishing emails to target specific victims .


This apparent disregard for publicity suggests , in our opinion , that the benefactors of the Dukes is so powerful and so tightly connected to the group that the Dukes are able to operate with no apparent fear of repercussions on getting caught .


In June 2017 , QiAnXin discovered new malware used by Molerats . We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages .


In this situation , Word will present the same lure document to the victim as seen in Figure 2 , but without the ability to enable macros via an Enable Content button .


July 28 A recent campaign compromised Taiwan and Hong Kong sites to deliver Flash exploits related to Hacking Team . Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent . In this case , FULLHOUSE.DOORED is a backdoor written in C / C++ that communicates using HTTP .


] somtum [ . Trend Micro specifically noted that the 2013 versions of KeyBoy used the same algorithm for encoding their configuration files as was observed in the Operation Tropic Trooper malware . The previous versions of Aumlib had not changed since at least May 2011, and Ixeshe had not evolved since at least December 2011 . Malwarebytes customers are protected as we detect the infrastructure and final payload used in these attacks .


UNIQUE FEATURES BY VERSION EventBot Version 0.0.0.1 RC4 and Base64 Packet Encryption EventBot RC4 and Base64 data decryption from the C2 RC4 and Base64 data decryption from the C2 . This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 . These emails included recruitment-themed lures and links to malicious HTML Application files .


The attachments exploited CVE-2017-8759 which was discovered and documented only five days prior to the campaign . Continued WhiteBear activity later shifted to include defense-related organizations into June 2017 .


Infection VectorWe have observed this recent wave of Zyklon malware being delivered primarily through spam emails . More recently , in May 2017 , APT33 appeared to target organizations in Saudi and South Korea using a malicious file that attempted to entice victims with job vacancies .


Shamoon2 : 104.218.120.128 .


This family showcases the amount of resources that malware authors now have to expend . Our research indicates that it has started targeting Japanese users . Then there is the dll install name , the domain , and the port . Talos discovered multiple vulnerabilities in Foxit PDF Reader that could allow an adversary to execute , arbitrary code on the targeted machine .


Attackers exploiting the vulnerability can corrupt memory and gain remote code execution .


With the help of the open-source Android Dynamic Binary Instrumentation Toolkit and root privilege , it is possible to intercept any function execution . These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider . . A Cl0p representative confirmed that they had been testing the vulnerability since July 2021 and that they had decided to deploy it over the Memorial Day weekend .


The code makes use of the Windows Crypto API for 3DES and the decryption key is stored as a standard Windows PUBLICKEYSTRUC structure .


While we know that TEMP.Veles deployed the TRITON attack framework , we do not have specific evidence to prove that CNIIHM did ( or did not ) develop the tool .


Per the domain ’s WHOIS record , an anonymized registrant registered com-ho.me in October 2016 and used it to serve malicious documents with similar macro activation features .


WannaCry leverages an exploit , codenamed " EternalBlue " , that was released by the Shadow Brokers on April 14 , 2017 . The Turla espionage group has been targeting various institutions for many years .


The Conflict between Hamas and Fatah : The historical rivalry between the Hamas and Fatah has resulted in many open battles between the two entities .


this RTF exploits again the CVE-2017_1882 on eqnedt32.exe . TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems .


The threat actors appear to have leveraged publicly available exploit code that can be found on Github at the URL : https://github.com/rxwx/CVE-2017-8570 . For example , we have observed frequent reuse of older ( patched ) exploits in malware operations against the Tibetan community .


T1444 Masquerade as Legitimate Application Impersonates legitimate GAS Tecnologia application . Symantec believes that the variant of Mimikatz used in this attack is unique to Waterbug . The McAfee Advanced Threat Research team discovered a previously unknown data-gathering implant that surfaced in mid-February 2018 .


When the adversaries' operations are live , they modify the record again to point the C2 domain to an IP address they can access .


This engineer ’ s name is also associated with a company called eSurv S.R.L . Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent . The threat group in this recently observed campaign a TEMP.Zagros a weaponized their malware using the following techniques .


System applications with root , by contrast , have super-user permissions that allow them to break out of such sandboxes . CTU researchers also identified components in the custom C2 protocol being used which they have seen utilized by Nickel Academy ( Lazarus ) previously . APT33 : 89.34.237.118 mywinnetwork.ddns.net . Among the IP addresses owned by Hack520 is a whole/22 IP Range which we dubbed as the “ PIG RANGE ” .


It was primarily notable for its high-volume campaigns and its association with TA505 , given the actor ’s propensity for massive campaigns and ability to dominate the email landscape .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 . If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros .


This newest entry seems to indicate that these changes won ’ t be stopping soon . Georgian military security issues , particularly with regard to U.S. cooperation and NATO , provide a strong incentive for Russian state-sponsored threat actors to steal information that sheds light on these topics . After writing the data received from the controller, a function is called to process the received . The UK , on the other hand , emerged as the second - largest ransomware target , enduring close to 200 ransomware attacks .


PLATINUM often spear phishes its targets at their non-official or private email accounts , to use as a stepping stone into the intended organization 's network . one organization is located in the US .


These changes include : Removing the SYSTEM_ALERT_WINDOW error and alert window types , and introducing a few other types as replacement Elevating the permission status of SYSTEM_ALERT_WINDOW to special permission by putting it into the “ above dangerous ” category , which means that users have to go through many screens to approve apps that ask for permission , instead of just one click Introducing an overlay kill switch on Android 8.0 and later that users can activate anytime to deactivate a system alert window To adapt , Android malware evolved to misusing The Korean-language Word document manual.doc appeared in Vietnam on January 17 , with the original author name of Honeybee . , The focus should be on isolating the affected devices andor networks to prevent further spread and minimize the impact .