this SWC was used to specifically target Turkish goverment .


Since that analysis , CTU researchers have observed multiple BRONZE UNION threat campaigns that illustrate the evolution of the group 's methods and espionage objectives .


this SWC was used to specifically target Turkish banking .


this SWC was used to specifically target Turkish academic networks .


BRONZE UNION has consistently demonstrated the capability to conduct successful large-scale intrusions against high-profile networks and systems .


The threat actors appear to be able to create and leverage multiple SWCs in parallel .


In a separate incident , CTU researchers identified a file named s.txt , which is consistent with the output of the Netview host-enumeration tool .


BRONZE UNION actors leveraged initial web shell access on Internet-facing systems to conduct internal reconnaissance .


BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control ( C2 ) and operational infrastructure .


This script relays commands and output between the controller and the system .


The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server ( systsm.webServer/httplogging ) and then delete existing logs from the system ( see Figure 4 ) .


In 2016 , CTU researchers observed the group using native system .


In March 2018 we detected an ongoing campaign .


TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems .


As of this publication , BRONZE UNION remains a formidable threat group that targets intellectual property and executes its operations at a swift pace .


we detected an ongoing campaign targeting a national data center .


The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool ( RAT ) .


we detected an ongoing campaign targeting a national data center in the Centeral Asia .


The tools found in this campaign , such as the HyperBro Trojan , are regularly used by a variety of Chinese-speaking actors .


Due to tools and tactics in use we attribute the campaign to LuckyMouse Chinese-speaking actor ( also known as EmissaryPanda and APT27 ) .


It's possible TG-3390 used a waterhole to infect data center employees .


Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 ( Microsoft Office Equation Editor , widely used by Chinese-speaking actors since December 2017 ) , we can′t prove they were related to this particular attack .


We suspect this router was hacked as part of the campaign in order to process the malware 's HTTP requests .


In March 2017 , Wikileaks published details about an exploit affecting Mikrotik called ChimayRed .


There were traces of HyperBro in the infected data center from mid-November 2017 .


This is a hacking group with Chinese origins which targets selected organisations related with education , energy and technology .


Usually , the delivered payload is either the well-known ' PlugX ' or ' HTTPBrowser ' RAT , a tool which is believed to have Chinese origins and to be used only by certain Chinese hacking groups .


Emissary Panda has used many ways with the most notable being the exploits from the Hacking Team leak .


Emissary Panda is still active and continues to target selected organisations .


Cybersecurity researchers have uncovered an espionage campaign that has targeted a national data center of an unnamed central Asian country in order to conduct watering hole attacks .


The campaign is believed to be active covertly since fall 2017 .


LuckyMouse , also known as Iron Tiger , EmissaryPanda , APT 27 and Threat Group-3390 , is the same group of Chinese hackers who was found targeting Asian countries with Bitcoin mining malware early this year .


March by security researchers from Kaspersky Labs .


For example , at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network .


The group has been active since at least 2010 and was behind many previous attack campaigns resulting in the theft of massive amounts of data from the directors and managers of US-based defense contractors .


attacks to a Chinese-speaking threat actor group called LuckyMouse .


LuckyMouse has been spotted using a widely used Microsoft Office vulnerability ( CVE-2017-11882 ) .


This time the group chose a national data center as its target from an unnamed country in Central Asia in an attempt to gain " access to a wide range of government resources at one fell swoop " .


The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center .


According to the researchers , the group injected malicious JavaScript code into the official government websites associated with the data center in order to conduct watering hole attacks .


the targeted system with a piece of malware called HyperBro , a Remote Access Trojan ( RAT ) .


The main command and control ( C&C ) server used in this attack is hosted on an IP address which belongs to a Ukrainian ISP , specifically to a MikroTik router running a firmware version released in March 2016 .


the targets of the hacking group were in the automotive .


Dell SecureWorks researchers unveiled a report on Threat Group-3390 that has targeted companies around the world while stealing massive amounts of industrial data .


The group , believed to be based in China , has also targeted defense contractors , colleges and universities , law firms , and political organizations — including organizations related to Chinese minority ethnic groups .


LAS VEGAS—Today at the Black Hat information security conference , Dell SecureWorks researchers unveiled a report on a newly detected hacking group that has targeted companies around the world while stealing massive amounts of industrial data .


Designated as Threat Group 3390 and nicknamed " Emissary Panda " by researchers , the hacking group has compromised victims' networks largely through " watering hole " attacks launched from over 100 compromised legitimate websites , sites picked because they were known to be frequented by those targeted in the attack .


the United Kingdom had data stolen by members of Emissary Panda .


the US had data stolen by members of Emissary Panda .


No zero-day vulnerabilities were used to breach targeted networks , instead " TG-3390 relied on old vulnerabilities such as CVE-2011-3544 " — a near-year-old Java security hole — " and CVE-2010-0738 to compromise their targets " , Dell SecureWorks' researchers reported .


The group used a number of tools common to other Chinese hacking groups , but they had a few unique tools of their own with interfaces developed for Standard ( Simplified ) Chinese .


If the address falls within ranges that the attackers are interested in , the malicious site waits for their next page view to drop an exploit on the desirable target 's PC .


Visitors to sites exploited by Emissary Panda are directed by code embedded in the sites to a malicious webpage , which screens their IP address .


There has also been at least one victim targeted by a spear-phishing attack .


A variety of malware , including the PlugX tool , was shared with other known Chinese threat groups .


Once inside networks , the group generally targeted Windows network domain controllers and Exchange e-mail servers , targeting user credentials to allow them to move to other systems throughout the targeted network .


They used an exploit of Internet Information Server to inject keylogger and backdoor malware onto the Exchange server .


But two tools used were unique to the group : ASPXTool , an Internet Information Services ( IIS ) specific " Web shell " used to gain access to servers inside a target 's network ; and the OwaAuth credential stealing tool and Web shell , used to attack Microsoft Exchange servers running the Web Outlook interface .


By using such features and tools , attackers are hoping to blend in on the victim 's network and hide their activity in a sea of legitimate processes .


TAA leverages advanced artificial intelligence and machine learning that combs through Symantec 's data lake of telemetry in order to spot patterns associated with targeted attacks .


January 2018 , TAA triggered an alert at a large telecoms operator in Southeast Asia .


Thrip was using PsExec to move laterally between computers on the company 's network .


TAA triggered an alert at a large telecoms operator in Southeast Asia .


AA triggered an alert at a large telecoms operator in Southeast Asia .


PsExec is a Microsoft Sysinternals tool for executing processes on other systems and is one of the most frequently seen legitimate pieces of software used by attackers attempting to live off the land .


TAA not only flagged this malicious use of PsExec , it also told us what the attackers were using it for .


Thrip was attempting to remotely install a previously unknown piece of malware ( Infostealer.Catchamas ) on computers within the victim 's network .


three computers in China being used to launch the Thrip attacks .


Perhaps the most worrying discovery we made was that Thrip had targeted a satellite communications operator .


Thrip seemed to be mainly interested in the operational side of the company .


This suggests to us that Thrip 's motives go beyond spying and may also include disruption .


Armed with this information about the malware and living off the land tactics being used by this group of attackers whom we named Thrip , we broadened our search to see if we could find similar patterns that indicated Thrip had been targeting other organizations .


The group had also targeted three different telecoms operators , all based in Southeast Asia .


In all cases , based on the nature of the computers infected by Thrip , it appeared that the telecoms companies themselves and not their customers were the targets of these attacks .


Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection .


Many of the tools they use now feature new behaviors , including a change in the way they maintain a foothold in the targeted network .


Execute a command through exploits for CVE-2017-11882 .


Execute a command through exploits for CVE-2018-0802 .


The backdoor will load the encrypted configuration file and decrypt it , then use Secure Sockets Layer ( SSL ) protocol to connect to command-and-control ( C&C ) servers .


TClient is actually one of Tropic Trooper 's other backdoors .


The malicious loader will use dynamic-link library ( DLL ) hijacking — injecting malicious code into a process of a file/application — on sidebar.exe and launch dllhost.exe ( a normal file ) .


TClient , for instance , uses DLL hijacking and injection that may not be as noticeable to others .


The backdoor noted by other security researchers was encoded with different algorithms and configured with different parameter names in 2016 , for instance .


Taiwan has been a regular target of cyber espionage threat actors for a number of years .


In early August , Unit 42 identified two attacks using similar techniques .


which has been active since at least 2011 .


One of the attacks used Tropic Trooper 's known Yahoyah malware , but the other attack deployed the widely available Poison Ivy RAT .


This confirms the actors are using Poison Ivy as part of their toolkit , something speculated in the original Trend Micro report but not confirmed by them .


The document attached to this e-mail exploits CVE-2012-0158 .


As we have noted in many earlier reports , attackers commonly use decoy files to trick victims into thinking a malicious document is actually legitimate .


Further analysis uncovered a handful of ties indicating the actors may also be using the PCShare malware family , which has not been previously tied to the group .


This matches with known Tactics , Techniques , and Procedures ( TTPs ) for Tropic Trooper , targeting both government institutions and also the energy industry in Taiwan .


Tropic Trooper is also still exploiting CVE-2012-0158 , as are many threat actors .


The Tropic Trooper threat actor group has been known to target governments and organizations in the Asia Pacific region for at least six years .


Turla is a notorious group that has been targeting governments .


Turla is known to run watering hole and spearphishing campaigns to better pinpoint their targets .


Turla is a notorious group that has been targeting government officials .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors .


Turla is a notorious group that has been targeting diplomats .


The codename for Turla APT group in this presentation is MAKERSMARK .


The Intercept reported that there exists a 2011 presentation by Canada 's Communication Security Establishment ( CSE ) outlining the errors made by the Turla operators during their operations even though the tools they use are quite advanced .


The witnessed techniques , tactics and procedures ( TTPs ) are in-line with what we usuallysee in Turla 's operation : a first stage backdoor , such as Skipper , likely delivered through spearphishing followed by the appearance on the compromised system of a second stage backdoor , Gazerin this case .


Southeastern Europe as well as countries in the former Soviet Union Republichas recently been the main target .


Finally , there are many similarities between Gazer and other second stage backdoors used by the Turla group such as Carbon and Kazuar .


Skipper , which has been linked to Turla in the past , was found alongside Gazer in most cases we investigated .


Turla APT group makes an extra effort to avoid detection by wiping files securely , changing the strings and randomizing what could be simple markers through the different backdoor versions .


The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including government institutions .


Turla all uses an encrypted container to store the malware 's components and configuration and they also log their actions in a file .


Over the last 10 months , Kaspersky Lab researchers have analyzed a massive cyber-espionage operation which we call " Epic Turla " .


We also observed exploits against older ( patched ) vulnerabilities , social engineering techniques and watering hole strategies in these attacks .


The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including embassies .


The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including military .


The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including education .


When G-Data published on Turla/Uroburos back in February , several questions remained unanswered .


The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including research and pharmaceutical companies .


The primary backdoor used in the Epic attacks is also known as " WorldCupSec " , " TadjMakhal " , " Wipbot " or " Tavdig " .


Thrip 's motive is likely espionage and its targets include those in the communications , geospatial imaging , and defense sectors , both in the United States and Southeast Asia .


One big unknown was the infection vector for Turla ( aka Snake or Uroburos ) .


The mothership server is generally a VPS , which runs the Control panel software used to interact with the victims .


the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated .


Once a victim is confirmed as " interesting " , the attackers upload another Epic backdoor which has a unique ID used to control this specific victim .


Our analysis indicates this is a sophisticated multi-stage infection ; which begins with Epic Turla .


this attack against a Kaspersky Lab user on August 5 , 2014 .


VENOMOUS BEAR is an advanced , Russia-based adversary that's been active since at least 2004 .


Venomous Bear has deployed malware to targets using several novel methods .


For years , Turla has relied , among other impersonations , on fake Flash installers to compromise victims .


Turla merely uses the Adobe brand to trick users into downloading the malware .


By looking at our telemetry , we found evidence that Turla installers were exfiltrating information to get.adobe.com URLs since at least July 2016 .


Thus , it is clear they are trying to be as stealthy as possible by hiding in the network traffic of the targeted organizations .


Finally , some of the victims are also infected with other Turla-related malware such as ComRAT or Gazer .


Kaspersky Lab documented this behavior in 2014 .


It is not a new tactic for Turla to rely on fake Flash installers to try to trick the user to install one of their backdoors .


Turla operators could use an already-compromised machine in the network of the victim 's organization to perform a local MitM attack .


Our January 2018 white paper was the first public analysis of a Turla campaign called Mosquito .


It is not the first time Turla has used generic tools .


In the past , we have seen the group using open-source password dumpers such as Mimikatz .


Starting in March 2018 , we observed a significant change in the campaign : it now leverages the open source exploitation framework Metasploit before dropping the custom Mosquito backdoor .


Even an experienced user can be fooled by downloading a malicious file that is apparently from adobe.com , since the URL and the IP address correspond to Adobe 's legitimate infrastructure .


However , to our knowledge , this is the first time Turla has used Metasploit as a first stage backdoor , instead of relying on one of its own tools such as Skipper .


Traffic was intercepted on a node between the end machine and the Adobe servers , allowing Turla 's operators to replace the legitimate Flash executable with a trojanized version .


At the beginning of March 2018 , as part of our regular tracking of Turla 's activities , we observed some changes in the Mosquito campaign .


In this post , we have presented the evolutions of the Turla Mosquito campaign over the last few months .


Primary targets for this adversary are in the government , aerospace , NGO , defense , cryptology and education sectors .


Turla 's campaign still relies on a fake Flash installer but , instead of directly dropping the two malicious DLLs , it executes a Metasploit shellcode and drops , or downloads from Google Drive , a legitimate Flash installer .


The Turla espionage group has been targeting various institutions for many years .


Recently , we found several new versions of Carbon , a second stage backdoor in the Turla group arsenal .


The Turla group is known to be painstaking and work in stages , first doing reconnaissance on their victims' systems before deploying their most sophisticated tools such as Carbon .


Kaspersky APT Intelligence Reporting subscription , customers received an update in mid-February 2017 .


Like previous Turla activity , WhiteBear leverages compromised websites and hijacked satellite connections for command and control ( C2 ) infrastructure .


WhiteBear is a parallel project or second stage of the Skipper Turla cluster of activity documented in another private intelligence report " Skipper Turla – the White Atlas framework " from mid-2016 .


However , despite the similarities to previous Turla campaigns , we believe that WhiteBear is a distinct project with a separate focus .


From February to September 2016 , WhiteBear activity was narrowly focused on embassies and consular operations around the world .


Continued WhiteBear activity later shifted to include defense-related organizations into June 2017 .


All of these early WhiteBear targets were related to embassies and diplomatic/foreign affair organizations .


Thus , Turla operators had access to some highly sensitive information ( such as emails sent by the German Foreign Office staff ) for almost a year .


Our investigation also led to the discovery of dozens of email addresses registered by Turla operators for this campaign and used to receive exfiltrated data from the victims .


It mainly targets Microsoft Outlook , a widely used mail client , but also targets The Bat! , a mail client very popular in Eastern Europe .


First , Turla steals emails by forwarding all outgoing emails to the attackers .


We identified several European governments and defense companies compromised with this group .


What actually happens is that the malware is able to decode data from the PDF documents and interpret it as commands for the backdoor .


In early 2018 , multiple media claimed that Turla operators used mail attachments to control infected machines .


As detailed in the previous section , this malware is able to manipulate and exfiltrate emails .


To our knowledge , Turla is the only espionage group that currently uses a backdoor entirely controlled by emails , and more specifically via PDF attachments .


The attackers first infected in March 2017 .


Our research shows that compromised organizations are at risk of not only being spied on by the Turla group who planted the backdoor , but also by other attackers .


The developers refer to this tool by the name Kazuar , which is a Trojan written using the Microsoft.NET Framework that offers actors complete access to compromised systems targeted by its operator .


We suspect the Kazuar tool may be linked to the Turla threat actor group ( also known as Uroburos and Snake ) , who have been reported to have compromised embassies , defense contractors , educational institutions , and research organizations across the globe .


This is also a full-featured backdoor controlled by email , and which can work independently of any other Turla component .


A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005 .


If the hypothesis is correct and the Turla threat group is using Kazuar , we believe they may be using it as a replacement for Carbon and its derivatives .


We used a combination of tools such as NoFuserEx , ConfuserEx Fixer , ConfuserEx Switch Killer , and de4d0t in order to deobfuscate the code for in depth analysis .


Kazuar generates its mutex by using a process that begins with obtaining the MD5 hash of a string " [username]=>singleton-instance-mutex " .


The subject is a series of targeted attacks against private companies .


e uncovered the activity of a hacking group which has Chinese origins .


Also , by creating this type of API access , Turla could use one accessible server as a single point to dump data to and exfiltrate data from .


According to our estimations , this group has been active for several years and specializes in cyberattacks against the online video game industry .


Based on our analysis , we believe that threat actors may compile Windows and Unix based payloads using the same code to deploy Kazuar against both platforms .


The group 's main objective is to steal source codes .


In 2010 HBGary investigated an information security incident related to the Winnti group at one of HBGary 's customers – an American video game company .


In 2010 US-based HBGary investigated an information security incident related to the Winnti group at one of HBGary 's customers – an American video game company .


For a long time the Winnti group had been considered as a Chinese threat actor targeting gaming companies specifically .


In April Novetta released its excellent report on the Winnti malware spotted in the operations of Axiom group .


The Axiom group has been presented as an advanced Chinese threat actor carrying out cyber-espionage attacks against a whole range of different industries .


this library includes two drivers compiled on August 22 and September 4 , 2014 .


Also our visibility as a vendor does not cover every company in the world ( at least so far ; ) ) and the Kaspersky Security Network ( KSN ) did not reveal other attacks except those against gaming companies .


Conversely , LokiBot and Agent Tesla are new malware tools .


Based on multiple active compromises by the Axiom threat group , Novetta was able to capture and analyze new Winnti malware samples .


Initial attack targets are commonly software and gaming organizations in United States , Japan , South Korea , and China .


The samples Novetta obtained from the active Axiom infection were compiled in mid- to late 2014 and represent what Novetta is referring to as version 3.0 of the Winnti lineage .


We assess with high confidence that the Winnti umbrella is associated with the Chinese state intelligence apparatus , with at least some elements located in the Xicheng District of Beijing .


The Winnti umbrella continues to operate highly successfully in 2018 .


The Winnti umbrella and closely associated entities has been active since at least 2009 .


The Winnti and Axiom group names were created by Kaspersky Lab and Symantec , respectively , for their 2013/2014 reports on the original group .


Their operations against gaming and technology organizations are believed to be economically motivated in nature .


However , based on the findings shared in this report we assess with high confidence that the actor 's primary long-term mission is politically focused .


The Winnti umbrella and linked groups' initial targets are gaming studios and high tech businesses .


During the same time period , we also observed the actor using the Browser Exploitation Framework ( BeEF ) to compromise victim hosts and download Cobalt Strike .


In this campaign , the attackers experimented with publicly available tooling for attack operations .


The primary goal of these attacks was likely to find code-signing certificates for signing future malware .


The Chinese intelligence apparatus has been reported on under many names , including Winnti , PassCV , APT17 , Axiom , LEAD , BARIUM , Wicked Panda , and GREF .


The attackers behind observed activity in 2018 operate from the Xicheng District of Beijing via the net block 221.216.0.0/13 .


ALLANITE activity closely resembles Palmetto Fusion described by the US Department of Homeland Security ( DHS ) .


ALLANITE activity closely resembles Palmetto Fusion described by the US Department of Homeland Security .


ALLANITE uses email phishing campaigns and compromised websites called watering holes to steal credentials and gain access to target networks , including collecting and distributing screenshots of industrial control systems .


In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group Symantec calls Dragonfly ( which Dragos associates with DYMALLOY ) .


In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group .


We assess with high confidence that the attackers discussed here are associated with the Chinese state intelligence apparatus .


ALLANITE operations limit themselves to information gathering and have not demonstrated any disruptive or damaging capabilities .


In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group Symantec calls Dragonfly .


Public disclosure by third-parties , including the DHS , associate ALLANITE operations with Russian strategic interests .


ALLANITE conducts malware-less operations primarily leveraging legitimate and available tools in the Windows operating system .


However , full details on ALLANITE and other group tools , techniques , procedures , and infrastructure is available to network defenders via Dragos WorldView .


In addition to maritime operations in this region , Anchor Panda also heavily targeted western companies in the US , Germany , Sweden , the UK , and Australia , and other countries involved in maritime satellite systems , aerospace companies , and defense contractors .


A current round of cyber-attacks from Chinese source groups are targeting the maritime sector in an attempt to steal technology .


PLA Navy Anchor Panda is an adversary that CrowdStrike has tracked extensively over the last year targeting both civilian and military maritime operations in the green/brown water regions primarily in the area of operations of the South Sea Fleet of the PLA Navy .


ALLANITE operations continue and intelligence indicates activity since at least May 2017 .


APT Anchor Panda is a Chinese threat actor group who target maritime operations .


According to cyber security researchers , Anchor Panda , who work directly for the Chinese PLA Navy , likely remains active .


In the past they used Adobe Gh0st , Poison Ivy and Torn RAT malware as their primary attack vector is sphere phishing .


Their targets are marine companies that operate in and around the South China Sea , an area of much Chinese interest .


As recently as this past week , researchers observed Chinese hackers escalating cyber-attack efforts to steal military research secrets from US universities .


The cyber-espionage campaign has labelled the group Advanced Persistent Threat ( APT ) 40 or , titled , Periscope .


The group has been active since at least January 2013 .


The group has also targeted businesses operating in the South China Sea , which is a strategically important region and the focus of disputes between China and other states .


The main targets seem to be US companies in engineering , transport and defense , although it has targeted other organizations around the world .


The times of day the group is active also suggests that it is based near Beijing and the group has reportedly used malware that has been observed in other Chinese operations , indicating some level of collaboration .


Periscope 's activity has previously been suspected of being linked to China , but now researchers believe their evidence links the operation to the Chinese state .


APT40 is described as a moderately sophisticated cyber-espionage group which combines access to significant development resources with the ability to leverage publicly available tools .


Anchor Panda uses website and web-server compromise as a means of attack and leverages an enormous cache of tools in its campaigns , to include exploits that take advantage of known CVE software vulnerabilities .


Like many espionage campaigns , much of APT40 's activity begins by attempting to trick targets with phishing emails , before deploying malware such as the Gh0st RAT trojan to maintain persistence on a compromised network .


The group uses website and web-server compromise as a means of attack and leverages an enormous cache of tools in its campaigns , to include exploits that take advantage of known CVE software vulnerabilities .


More than half of the organizations we have observed being targeted or breached by APT5 operate in these sectors .


APT5 has been active since at least 2007 .


APT5 has targeted or breached organizations across multiple industries , but its focus appears to be on telecommunications and technology companies , especially information about satellite communications .


APT5 targeted the network of an electronics firm that sells products for both industrial and military applications .


The group subsequently stole communications related to the firm 's business relationship with a national military , including inventories and memoranda about specific products they provided .


In one case in late 2014 , APT5 breached the network of an international telecommunications company .


The group used malware with keylogging capabilities to monitor the computer of an executive who manages the company 's relationships with other telecommunications companies .


APT5 also targeted the networks of some of Southeast Asia 's major telecommunications providers with Leouncia malware .


We suspect that the group sought access to these networks to obtain information that would enable it to monitor communications passing through the providers' systems .


The FBI said the " group of malicious cyber actors " ( known as APT6 or 1.php ) used dedicated top-level domains in conjunction with the command and control servers to deliver " customized malicious software " to government computer systems .


Deepen told Threatpost the group has been operating since at least since 2008 and has targeted China and US relations experts , Defense Department entities , and geospatial groups within the federal government .


Government officials said they knew the initial attack occurred in 2011 , but are unaware of who specifically is behind the attacks .


According to Deepen , APT6 has been using spear phishing in tandem with malicious PDF and ZIP attachments or links to malware infected websites that contains a malicious SCR file .


Nearly a month later , security experts are now shining a bright light on the alert and the mysterious group behind the attack .


The attacks discussed in this blog are related to an APT campaign commonly referred to as " th3bug " , named for the password the actors often use with their Poison Ivy malware .


Over the summer they compromised several sites , including a well-known Uyghur website written in that native language .


In contrast to many other APT campaigns , which tend to rely heavily on spear phishing to gain victims , " th3bug " is known for compromising legitimate websites their intended visitors are likely to frequent .


While we were unable to recover the initial vulnerability used , it is possibly the same CVE-2014-0515 Adobe Flash exploit first reported by Cisco TRAC in late July .


However , to increase success rates APT20 can use zero-day exploits , so even a properly patched system would be compromised .


Our direct observation of in-the-wild spearphishing attacks staged by the Bahamut group have been solely attempts to deceive targets into providing account passwords through impersonation of notices from platform providers .


Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 .


Later that month , the same tactics and patterns were seen in attempts against an Iranian women 's activist – an individual commonly targeted by Iranian actors , such as Charming Kitten and the Sima campaign documented in our 2016 Black Hat talk .


In June we published on a previously unknown group we named " Bahamut " , a strange campaign of phishing and malware apparently focused on the Middle East and South Asia .


Once inside a network , APT40 uses credential-harvesting tools to gain usernames and passwords , allowing it to expand its reach across the network and move laterally through an environment as it moves to towards the ultimate goal of stealing data .


Bahamut was shown to be resourceful , not only maintaining their own Android malware but running propaganda sites , although the quality of these activities varied noticeably .


Several times , APT5 has targeted organizations and personnel based in Southeast Asia .


However , in the same week of September a series of spearphishing attempts once again targeted a set of otherwise unrelated individuals , employing the same tactics as before .


Our primary contribution in this update is to implicate Bahamut in what are likely counterterrorism-motivated surveillance operations , and to further affirm our belief that the group is a hacker-for-hire operation .


As we wrote then , compared to Kingphish , Bahamut operates as though it were a generation ahead in terms of professionalism and ambition .


In the Bahamut report , we discussed two domains found within our search that were linked with a custom Android malware agent .


After the publication of the original report , these sites were taken offline despite the fact that one agent was even updated a six days prior to our post ( the " Khuai " application ) .


FIF is notable for its links to the Lashkar-e-Taiba ( LeT ) terrorist organization , which has committed mass-casualty attacks in India in support of establishing Pakistani control over the disputed Jammu and Kashmir border region .


As a result , it is already flagged as Bahamut by antivirus engines .


Our initial observation of the Bahamut group originated from in-the-wild attempts to deceive targets into providing account passwords through impersonation of platform providers .


One curious trait of Bahamut is that it develops fully-functional applications in support of its espionage activities , rather than push nonfunctional fake apps or bundle malware with legitimate software .


Curiously , Bahamut appears to track password attempts in response to failed phishing attempts or to provoke the target to provide more passwords .


Bahamut spearphishing attempts have also been accompanied with SMS messages purporting to be from Google about security issues on their account , including a class 0 message or " flash text " .


These text messages did not include links but are intended to build credibility around the fake service notifications later sent to the target 's email address .


We have not found evidence of Bahamut engaging in crime or operating outside its limited geographic domains , although this narrow perspective could be accounted for by its compartmentalization of operations .


Thus far , Bahamut 's campaigns have appeared to be primarily espionage or information operations – not destructive attacks or fraud .


The targets and themes of Bahamut 's campaigns have consistently fallen within two regions – South Asia ( primarily Pakistan , specifically Kashmir ) and the Middle East ( from Morocco to Iran ) .


Our prior publication also failed to acknowledge immensely valuable input from a number of colleagues , including Nadim Kobeissi 's feedback on how the API endpoints on the Android malware were encrypted .


Bahamut targeted similar Qatar-based individuals during their campaign .


Bellingcat also reported the domain had been used previously to host potential decoy documents as detailed in VirusTotal here using hxxp://voguextra.com/decoy.doc .


The China-backed BARIUM APT is suspected to be at the helm of the project .


Trojanized versions of the utility were then signed with legitimate certificates and were hosted on and distributed from official ASUS update servers – which made them mostly invisible to the vast majority of protection solutions , according to Kaspersky Lab .


Kaspersky Lab To compromise the utility , Kaspersky Lab determined that the cyberattackers used stolen digital certificates used by ASUS to sign legitimate binaries , and altered older versions of ASUS software to inject their own malicious code .


To compromise the utility , Kaspersky Lab determined that Barium used stolen digital certificates used by ASUS to sign legitimate binaries , and altered older versions of ASUS software to inject their own malicious code .


BARIUM , a Chinese state player that also goes by APT17 , Axiom and Deputy Dog , was previously linked to the ShadowPad and CCleaner incidents , which were also supply-chain attacks that used software updates to sneak onto machines .


That said , the " fingerprints " left on the samples by the attackers – including techniques used to achieve unauthorized code execution – suggest that the BARIUM APT is behind the effort , according to the researchers .


In the 2017 ShadowPad attack , the update mechanism for Korean server management software provider NetSarang was compromised to serve up an eponymous backdoor .


In the next incident , also in 2017 , software updates for the legitimate computer cleanup tool CCleaner was found to have been compromised by hackers to taint them with the same ShadowPad backdoor .


NetSarang , which has headquarters in South Korea and the United States , removed the backdoored update , but not before it was activated on at least one victim 's machine in Hong Kong .


Given our increased confidence that Bahamut was responsible for targeting of Qatari labor rights advocates and its focus on the foreign policy institutions other Gulf states , Bahamut 's interests are seemingly too expansive to be limited one sponsor or customer .


Barium specializes in targeting high value organizations holding sensitive data , by gathering extensive information about their employees through publicly available information and social media , using that information to fashion phishing attacks intended to trickthose employees into compromising their computers and networks .


We identified an overlap in the domain voguextra.com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post .


Althoughthe BariumDefendants have relied on differentand distinct infrastructures in an effortto evade detection , Bariumused the same e-mail address (hostay88@gmail.com ) to register malicious domains used in connection with at least two toolsets that Barium has employed to compromise victim computers .


The second method , described in Part D.2 , below , involves the " ShadowPad " malware , which the Barium Defendants have distributed via a third-party software provider 's compromised update .


To enhance the effectiveness of phishing attacks into the organization , Barium will collect additional background informationfrom social media sites .


Employing a technique known as " spear phishing " , Barium has heavily targeted individuals within HumanResources or Business Developmentdepartments ofthe targeted organizations in order to compromise the computers ofsuch individuals .


The first method , described in Part D.l , below , involves the " Barlaiy " and " PlugXL " malware , which the Barium Defendants propagate using phishing techniques .


Using the information gathered from its reconnaissance on social media sites , Barium packages the phishing e-mail in a way that gives the e-mail credibility to the target user , often by making the e-mail appear as ifit were sent from an organization known to and trusted by the victim or concerning a topic of interest to the victim .


Barium Defendants install the malicious " Win32/Barlaiy " malware and the malicious " Win32/PlugX.L " malware on victim computers using the means described above .


Both Win32/Barlaiy & Win32/PlugX.L are remote access " trojans " , which allow Barium to gather a victim 's information , control a victim 's device , install additional malware , and exfiltrate information fi-om a victim 's device .


Barium Defendants install the malicious credential stealing and injection tool known as " Win32/RibDoor.A!dha " .


While not detected at the time , Microsoft 's antivirus and security products now detect this Barium malicious file and flag the file as " Win32/ShadowPad.A " .


MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com.mxi.videoplay ) .


Figure 9a , below , shows detections of encounters with the Barium actors and their infrastructure , including infected computers located in Virginia , and Figure 9b , below , shows detections of encounters throughout the United States .


Barium has targeted Microsoft customers both in Virginia , the United States , and around the world .


Once the Barium Defendants have access to a victim computer through the malware described above , they monitor the victim 's activity and ultimately search for and steal sensitive documents ( for example , exfiltration of intellectual property regarding technology has been seen ) , and personal information fi"om the victim 's network .


According to a 49-page report published Thursday , all of the attacks are the work of Chinese government 's intelligence apparatus , which the report 's authors dub the Winnti Umbrella .


Researchers from various security organizations have used a variety of names to assign responsibility for the hacks , including LEAD , BARIUM , Wicked Panda , GREF , PassCV , Axiom , and Winnti .


It targets organizations in Japan , South Korea , and Taiwan , leveling its attacks on public sector agencies and telecommunications and other high-technology industries .


In 2016 , for instance , we found their campaigns attacking Japanese organizations with various malware tools , notably the Elirks backdoor .


Blackgear has been targeting various industries since its emergence a decade ago .


Blackgear 's campaigns also use email as an entry point , which is why it's important to secure the email gateway .


BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years .


Our research indicates that it has started targeting Japanese users .


The malware tools used by BLACKGEAR can be categorized into three categories : binders , downloaders and backdoors .


Binders are delivered by attack vectors ( such as phishing and watering hole attacks ) onto a machine .


Based on the mutexes and domain names of some of their C&C servers , BlackTech 's campaigns are likely designed to steal their target 's technology .


Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns : PLEAD , Shrouded Crossbow , and of late , Waterbear .


Active since 2012 , it has so far targeted Taiwanese government agencies and private organizations .


PLEAD uses spear-phishing emails to deliver and install their backdoor , either as an attachment or through links to cloud storage services .


PLEAD also dabbled with a short-lived , fileless version of their malware when it obtained an exploit for a Flash vulnerability ( CVE-2015-5119 ) that was leaked during the Hacking Team breach .


PLEAD also uses CVE-2017-7269 , a buffer overflow vulnerability Microsoft Internet Information Services ( IIS ) 6.0 to compromise the victim 's server .


This campaign , first observed in 2010 , is believed to be operated by a well-funded group given how it appeared to have purchased the source code of the BIFROST backdoor , which the operators enhanced and created other tools from .


Shrouded Crossbow targeted privatized agencies and government contractors as well as enterprises in the consumer electronics , computer , healthcare , and financial industries .


Shrouded Crossbow employs three BIFROST-derived backdoors : BIFROSE , KIVARS , and XBOW .


Like PLEAD , Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents .


XBOW 's capabilities are derived from BIFROSE and KIVARS ; Shrouded Crossbow gets its name from its unique mutex format .


While PLEAD and KIVARS are most likely to be used in first phase attacks , Waterbear can be seen as a secondary backdoor installed after attackers have gained a certain level of privilege .


Recently , the JPCERT published a thorough analysis of the Plead backdoor , which , according to Trend Micro , is used by the cyberespionage group BlackTech .


Despite the fact that the Changing Information Technology Inc. certificate was revoked on July 4 , 2017 , the BlackTech group is still using it to sign their malicious tools .


The BlackTech group is primarily focused on cyberespionage in Asia .


The new activity described in this blogpost was detected by ESET in Taiwan , where the Plead malware has always been most actively deployed .


Attackers are targeting Windows platform and aiming at government institutions as well as big companies in Colombia .


Attackers like to use spear-fishing email with password protected RAR attachment to avoid being detected by the email gateway .


The first sample being captured was in April 2018 and since that we observed a lot more related ones .


After performing investigations on the classified victims , we find the attacker targets big companies and government agencies in Colombia .


After monitoring and correlating the APT attack , 360 Threat Intelligence Center discovered multiple related emails to attack Colombian government agencies , financial institutions and large enterprises .


The oldest sample we've seen up to now is from November 2013 .


One of the top targets is the Japan Pension Service , but the list of targeted industries includes government and government agencies , local governments , public interest groups , universities , banks , financial services , energy and so on .


However , the attack is different in two respects : unlike other APTs , the main focus of Blue Termite is to attack Japanese organizations ; and most of their C2s are located in Japan .


Originally , the main infection vector of Blue Termite was spear-phishing emails .


Kaspersky Lab has detected a new method of first infection that uses a drive-by-download with a flash exploit ( CVE-2015-5119 , the one leaked from The Hacking Team incident ) .


Kaspersky Lab also found some watering hole attacks , including one on a website belonging to a prominent member of the Japanese government .


In early July 2015 , however , Kaspersky Lab found a sample that creates a decryption key with Salt1 , Salt2 , and Salt3 .


From early June , when the cyber-attack on the Japan Pension Service started to be reported widely , various Japanese organizations would have started to deploy protection measures .


It employs AES in addition to SID tricks , making it difficult to decrypt sensitive data .


In order to fight back against this cyber-espionage , Kaspersky Lab will continue its research .


Bookworm 's functional code is radically different from PlugX and has a rather unique modular architecture that warranted additional analysis by Unit 42 .


Bookworm has little malicious functionality built-in , with its only core ability involving stealing keystrokes and clipboard contents .


The Plead malware is a backdoor which , according to Trend Micro , is used by the BlackTech group in targeted attacks .


So far , it appears threat actors have deployed the Bookworm Trojan primarily in attacks on targets in Thailand .


The threat actors use a commercial installation tool called Smart Installer Maker to encapsulate and execute a self-extracting RAR archive and in some cases a decoy slideshow or Flash installation application .


The self-extracting RAR writes a legitimate executable , an actor-created DLL called Loader.dll and a file named readme.txt to the filesystem and then executes the legitimate executable .


targeted attacks .


Using XREFs during static analysis is a common technique to quickly find where functions of interest are called .


The developers designed Bookworm to be a modular Trojan not limited to just the initial architecture of the Trojan , as Bookworm can also load additional modules provided by the C2 server .


Although the developers of Bookworm have included only keylogging functionality in Bookworm as a core ability , as suggested in Table 1 , several of the embedded DLLs provide Leader with cryptographic and hashing functions , while others support Leader 's ability to communicate with its C2 server .


While we did not discuss the surrounding attacks using Bookworm in detail , we have observed threat actors deploying Bookworm primarily in attacks on targets in Thailand .


Also , Bookworm uses a combination of encryption and compression algorithms to obfuscate the traffic between the system and C2 server .


The developers of Bookworm have gone to great lengths to create a modular framework that is very flexible through its ability to run additional modules directly from its C2 server .


Unit 42 recently published a blog on a newly identified Trojan called Bookworm , which discussed the architecture and capabilities of the malware and alluded to Thailand being the focus of the threat actors' campaigns .


Leader is Bookworm 's main module and controls all of the activities of the Trojan , but relies on the additional DLLs to provide specific functionality .


The developers of Bookworm use these modules in a rather unique way , as the other embedded DLLs provide API functions for Leader to carry out its tasks .


Unit 42 does not have detailed targeting information for all known Bookworm samples , but we are aware of attempted attacks on at least two branches of government in Thailand .


We speculate that other attacks delivering Bookworm were also targeting organizations in Thailand based on the contents of the associated decoys documents , as well as several of the dynamic DNS domain names used to host C2 servers that contain the words " Thai " or " Thailand " .


We believe that it is likely threat actors will continue development Bookworm , and will continue to use it for the foreseeable future .


Threat actors have delivered Bookworm as a payload in attacks on targets in Thailand .


Analysis of compromised systems seen communicating with Bookworm C2 servers also confirms our speculation on targeting with a majority of systems existing within Thailand .


As mentioned in our previous blog on Bookworm , the Trojan sends a static date string to the C2 server that we referred to as a campaign code .


We believed that the actors would use this date code to track their attack campaigns ; however , after continued analysis of the malware , we think these static dates could also be a build identifier for the Trojan .


Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier .


A Trojan sending a build identifier to its C2 server is quite common , as it notifies the threat actors of the specific version of the Trojan in which they are interacting .


Due to these changes without a new date string , we believe the date codes are used for campaign tracking rather than a Bookworm build identifier .


We believe that Bookworm samples use the static date string as campaign codes , which we used to determine the approximate date of each attack that we did not have detailed targeting information .


Another decoy slideshow associated with the Bookworm attack campaign contains photos of an event called Bike for Dad 2015 .


The campaign code " 20150920 " is associated with this decoy , which is a week prior to media articles announcing that the Crown Price of Thailand Maha Vajiralongkorn will lead the Bike for Dad 2015 event .


Chitpas is heavily involved with Thailand politics and was a core leader of the People's Committee for Absolute Democracy ( PCAD ) , which is an organization that staged anti-government campaigns in 2013 and 2014 .


The final remaining known decoy includes photos of Chitpas Tant Kridakon ( Figure 7 ) , who is known as heiress to the largest brewery in Thailand .


These images were associated with the Bookworm campaign code " 20150905 " .


Unit 42 analyzed the systems communicating with the Bookworm C2 domains and found that a majority of the IP addresses existed within autonomous systems ( ASN ) located in Thailand .


The pie chart in Figure 8 shows that the vast majority ( 73% ) of the hosts are geographically located in Thailand , which matches the known targeting of this threat group .


We believe that the IP addresses from Canada , Russia and Norway are analysis systems of antivirus companies or security researchers .


Overall , the Bookworm infrastructure overlaps with the infrastructure hosting C2 servers used by various attack tools , including FFRAT , Poison Ivy , PlugX , and others .


Unit 42 enumerated the threat infrastructure related to Bookworm and created a chart to visualize connected entities to its current attack campaign .


Threat actors have targeted the government of Thailand and delivered the newly discovered Bookworm Trojan since July 2015 .


The actors appear to follow a set playbook , as the observed TTPs are fairly static within each attack in this campaign .


So far , Unit 42 has seen infrastructure overlaps with servers hosting C2 servers for samples of the FFRAT , PlugX , Poison Ivy and Scieron Trojans , suggesting that the threat actors use these tools as the payload in their attacks .


The threat actors have continually used Flash Player installers and Flash slideshows for decoys .


The vast majority of systems communicating with Bookworm C2 servers are within the Bangkok metropolitan area where a majority of the government of Thailand exists .


Buhtrap has been active since 2014 , however their first attacks against financial institutions were only detected in August 2015 .


At the moment , the group is known to target Russian and Ukrainian banks .


Buhtrap is the first hacker group using a network worm to infect the overall bank infrastructure that significantly increases the difficulty of removing all malicious functions from the network .


Malicious programs intentionally scan for machines with an automated Bank-Customer system of the Central bank of Russia ( further referred to as BCS CBR ) .


If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros .


We noticed that criminals were spreading Buhtrap using this method from May 2015 to August 2015 .


It is worth noting that attackers used the same compromised websites to spread Buhtrap as those that had been used for the Corkow Trojan .


Moreover , they used the same exploit kit Niteris as that in the Corkow case .


Purportedly during one of the first attacks hackers intercepted the mailing list of the Anti-drop " club and created a specific phishing email for its members .


However , it is still widely used , notably in Russia .


As noted in our previous blog on Buhtrap , this gang has been actively targeting Russian businesses , mostly through spear-phishing .


It is thus interesting to see Buhtrap add strategic web compromises to their arsenal .


The first malware we saw was the lurk downloader , which was distributed on October 26th .


The executable would install the real Ammyy product , but would also launch a file called either AmmyyService.exe or AmmyySvc.exe which contained the malicious payload .


Buhtrap is getting better at disguising the code they inject into compromised websites .


With the recent arrests of actors using the Lurk banking trojan , Buhtrap appears to be a likely alternative for actors wishing to target Russian banks and software .


They have different functions and ways of spreading , but the same purpose — to steal money from the accounts of businesses .


Our experts have found that cybercriminals are actively focusing on SMBs , and giving particular attention to accountants .


The first encounter with Buhtrap was registered back in 2014 .


For now , we can call RTM one of the most active financial Trojans .


At that time it was the name of a cybercriminal group that was stealing money from Russian financial establishments — to the tune of at least $150,000 per hit .


Buhtrap resurfaced in the beginning of 2017 in the TwoBee campaign , where it served primarily as means of malware delivery .


After the source codes of their tools became public in 2016 , the name Buhtrap was used for the financial Trojan .


Just like last time , Buhtrap is spreading through exploits embedded in news outlets .


Estimating the damages is challenging , but as we learned , the criminals are siphoning off assets in transactions that do not exceed $15,000 each .


As explained later , we believe this campaign is financially-motivated and that it targets accounting departments in Russian businesses .


" Buhgalter " means " accountant " in Russian .


Seeing a campaign like this , inevitably the Anunak/Carbanak documented by Fox-IT and Kaspersky comes to mind .


The infection vector is similar , it uses a similar modified mimikatz application , and it uses a third-party remote access tool , changes system settings to allow concurrent RDP sessions , and so on .


The second , aptly titled " kontrakt87.doc " , copies a generic telecommunications service contract from MegaFon , a large Russian mobile phone operator .


In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task .


Careto 's Mask campaign we discovered relies on spear-phishing e-mails with links to a malicious website .


Sometimes , the attackers use sub-domains on the exploit websites , to make them seem more legitimate .


These sub-domains simulate sub-sections of the main newspapers in Spain plus some international ones like the Guardian and the Washington Post .


The CVE-2012-0773 was originally discovered by VUPEN and has an interesting story .


In other words , the attackers attracted our attention by attempting to exploit Kaspersky Lab products .


We initially became aware of Careto when we observed attempts to exploit a vulnerability in our products to make the malware " invisible " in the system .


Most modules were created in 2012 .


The attackers began taking them offline in January 2014 .


Last week we discussed Numbered Panda , a group that is also based out of China and is fairly well known to the security community , though by many names .


We revealed a Chinese-based adversary we crypt as Anchor Panda , a group with very specific tactics , techniques , and procedures ( TTPs ) and a keen interest in maritime operations and naval and aerospace technology .


The campaign was active until January 2014 , but during our investigations the C&C servers were shut down .


This week we are going to discuss Clever Kitten , whom , by virtue of several indicators , we have affiliated with the Islamic Republic of Iran .


Clever Kitten has moved to leveraging strategic web compromises .


Clever Kitten actors have a strong affinity for PHP server-side attacks to make access ; this is relatively unique amongst targeted attackers who often favor targeting a specific individual at a specific organization using social engineering .


Clever Kitten primarily targets global companies with strategic importance to countries that are contrary to Iranian interests .


A Clever Kitten attack starts with the use of a web vulnerability scanner to conduct reconnaissance .


The scanner was identified as the Acunetix Web Vulnerability Scanner which is a commercial penetration testing tool that is readily available as a 14-day trial .


Once an exploitable page is identified , Clever Kitten will attempt to upload a PHP backdoor to gain remote access to the system .


The reason for this is likely the availability of exploits against web browsers , which for a variety of reasons allows an attacker to bypass security features such as Data Execution Prevention ( DEP ) or Address Space Layout Randomization ( ASLR ) .


Once an exploitable page is identified , the actor will attempt to upload a PHP backdoor to gain remote access to the system .


In Clever Kitten 's attacks , the goal is lateral movement ; this is an attempt to move further into the target environment in order to begin intelligence collection .


This activity is a longer tail for the actor than a spearphish ; this is likely based on the Clever Kitten background , which may be focused on web development/application testing .


Without going too deep into the rabbit hole , there are several indicators pointing to an Iranian nexus , including language artifacts in the tool-marks used by the attacker , as well as network activity tying this actor to a very specific location that we have high confidence in not being spoofed .


Clever Kitten 's goal is to eventually be able to masquerade as a legitimate user by compromising credentials either through a pass-the-hash attack , or by dumping password hashes from a compromised host .


The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates , though , Indian and Canadian companies with interests in those Middle Eastern countries are also targeted .


There are new TTPs used in this attack – for example Agent_Drable is leveraging the Django python framework for command and control infrastructure , the technical details of which are outlined later in the blog .


n summary , Cold River is a sophisticated threat actor making malicious use of DNS tunneling for command and control activities , compelling lure documents , and previously unknown implants .


Some of the exploit server paths contain modules that appear to have been designed to infect Linux computers , but we have not yet located the Linux backdoor .


The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates , though , Indian and Canadian companies with interests in those Middle Eastern countries may have also been targeted .


The decoy documents used by the InPage exploits suggest that the targets are likely to be politically or militarily motivated .


The use of InPage as an attack vector is not commonly seen , with the only previously noted attacks being documented by Kaspersky in late 2016 .


The decoy documents dropped suggest that the targets are likely to be politically or militarily motivated , with subjects such as Intelligence reports and political situations being used as lure documents .


While documents designed to exploit the InPage software are rare , they are not new – however in recent weeks Unit42 has observed numerous InPage exploits leveraging similar shellcode , suggesting continued use of the exploit previously discussed by Kaspersky .


Confucius targeted a particular set of individuals in South Asian countries , such as military personnel and businessmen , among others .


Tweety Chat 's Android version can record audio , too .


Confucius' operations include deploying bespoke backdoors and stealing files from their victim 's systems with tailored file stealers , some of which bore resemblances to Patchwork 's .


Compared to Patchwork , whose Trojanized documents exploit at least five security flaws , Confucius' backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .


Back in February , we noted the similarities between the Patchwork and Confucius groups and found that , in addition to the similarities in their malware code , both groups primarily went after targets in South Asia .


Back in February , Trend Micro noted the similarities between the Patchwork and Confucius groups and found that , in addition to the similarities in their malware code , both groups primarily went after targets in South Asia .


One of its file stealers , swissknife2 , abuses a cloud storage service as a repository of exfiltrated files .


During the months that followed in which we tracked Confucius' activities , we found that they were still aiming for Pakistani targets .


During their previous campaign , we found Confucius using fake romance websites to entice victims into installing malicious Android applications .


Periodically , the malware tries to contact the Command-and-Control ( C&C ) server with the username encoded into parameters .


This function is similar to the various versions of backdoors ( such as sctrls and sip_telephone ) that we analyzed in our previous blog post and whitepaper .


This algorithm was previously discussed by security researchers in a Confucius-related blog post .


Lately , Patchwork has been sending multiple RTF files exploiting CVE-2017-8570 .


The group still uses the Badnews malware , a backdoor with information-stealing and file-executing capabilities , albeit updated with a slight modification in the encryption routine at the end of 2017 , when they added Blowfish encryption on top of their custom encryption described in our former Patchwork blogpost .


Threat actors like Confucius and Patchwork are known for their large arsenal of tools and ever-evolving techniques that can render traditional security solutions — which are often not designed to handle the persistent and sophisticated threats detailed in this blog — ineffective .


The reality is that IT departments of small to large-sized organizations are not equipped to handle the more advanced threats that groups like Confucius use in their attacks .


Patchwork uses email as an entry point , which is why securing the email gateway is important .


This blog post examines two similar malware families that utilize the aforementioned technique to abuse legitimate websites , their connections to each other , and their connections to known espionage campaigns .


In order to increase the likelihood of their malware successfully communicating home , cyber espionage threat actors are increasingly abusing legitimate web services , in lieu of DNS lookups to retrieve a command and control address .


In 2013 , Rapid7 reported on a series of relatively amateur attacks against Pakistani targets .


The first of which we call ' CONFUCIUS_A ' , a malware family that has links to a series of attacks associated with a backdoor attack method commonly known as SNEEPY ( aka ByeByeShell ) first reported by Rapid7 in 2013 .


At first glance CONFUCIUS_B looks very similar to CONFUCIUS_A , and they are also packaged in plain SFX binary files .


The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon .


We also believe that both clusters of activity have links to attacks with likely Indian origins , the CONFUCIUS_A attacks are linked to the use of SNEEPY/BYEBYESHELL and the CONFUCIUS_B have a loose link to Hangover .


The two malware families themselves are also very similar , and therefore we think that the shared technique is an indication of a single developer , or development company , behind both CONFUCIUS_A and CONFUCIUS_B .


In this blog post , we discussed two separate malware variations that behave in very similar ways and use similar techniques to acquire a C2 address , with both using Yahoo Answers and Quora to evade traditional mechanisms for blocking command and control domains .


The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio .


Confucius' backdoors are delivered through Office documents exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .


We dove deeper into Confucius' operations—namely , the malware-ridden documents , backdoors , and file stealers they use in their campaigns .


The sctrls backdoor we came across is delivered via RTF files exploiting CVE-2015-1641 .


The documents that exploit CVE2017-11882 download another payload — an HTML Application ( HTA ) file toting a malicious Visual Basic ( VBS ) script — from the server , which is executed accordingly by the command-line tool mshta.exe .


In August 2015 a new incident related to the Corkow ( Metel ) Trojan was detected .


Corkow provided remote access to the ITS-Broker system terminal by 《 Platforma soft 》 Ltd , which enabled the fraud to be committed .


According to our statistics , as of the beginning of 2015 this botnet encompassed over 250 000 infected devices worldwide including infecting more than 100 financial institutions with 80% of them from the top 20 list .


The interest among hackers in targeting trading systems is expected to grow .


Russian-speaking hackers are believed to be responsible for these attacks and used the Corkow Trojan .


Hackers target primarily companies in Russia and CIS countries , though it is noticed that the amount of attacks targeting the USA has increased 5 times since 2011 .


One of the first botnets specializing in targeting the trading software called Quik was " Ranbyus " , created in 2012 .


As of the Group-IB investigation of this malware program in March 2015 , Corkow v.7.118.1.1 had not been detected by a single antivirus program .


Hackers gained access to a computer in the trading system in September 2014 .


Starting in December 2014 , the criminal group began running keyloggers in the infected system .


To spread the Corkow malware criminals use a drive-by downloads method , when victims are infected while visiting compromised legitimate websites .


Group-IB specialists detected various sites used by criminals to spread the Trojan : mail tracking websites , news portals , electronic books , computer graphics resources , music portals , etc .


Hackers use the exploits " Nitris Exploit Kit " ( earlier known as CottonCastle ) , which is not available in open sources and sold only to trusted users .


Group-IB Bot-trek TDS sensors are in place at a number of financial institutions and , unfortunately , we register that currently Corkow malware is present on 80% of protected corporate systems .


Considering the Trojan delivery method and through our analysis of infections on banks' networks , we can confirm that all infections were conducted on a random basis .


According to statistics , Corkow primarily targets users in Russia and the CIS , but it is worth noting that in 2014 the amount of attacks targeting the USA increased by 5 times , in comparison with 2011 .


Moreover , the number of Corkow incidents detected in Q1 2015 in the United States exceeds the number of those in the CIS countries .


Hackers first actively spread bots using the Niteris exploit , and then search for infected devices at banks amongst their bots by analyzing IP addresses , cracked passwords and results of the modules performance .


In addition to the legitimate AmmyAdmin tool , the hackers used Visconti Backdoor developed based on legitimate RMS ( remote manipulator system ) software .


If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs .


To obtain logins and passwords they applied keyloggers built into Corkow , as well as a commonly used feature of Mimikatz , dumping clear text Windows credentials from LSA .


Hackers used the remote access to detect servers of their interest in the internal network .


In 2015 , the Metel gang began to target banks and financial institutions directly .


Metel is a banking Trojan ( also known as Corkow ) discovered in 2011 when it was used to attack users of online banking services .


After the infection stage , criminals move laterally with the help of legitimate and pentesting tools , stealing passwords from their initial victims ( entry point ) to gain access to the computers within the organization that have access to money transactions .


With this level of access , the gang has been able to pull off a clever trick by automating the rollback of ATM transactions .


COVELLITE operates globally with targets primarily in Europe , East Asia , and North America .


US targets emerged in September 2017 with a small , targeted phishing campaign directed at select U.S. electric companies .


LAZARUS GROUP is responsible for attacks ranging from the 2014 attack on Sony Pictures to a number of Bitcoin heists in 2017 .


Technical analysis of COVELLITE malware indicates an evolution from known LAZARUS toolkits .


COVELLITE remains active but appears to have abandoned North American targets , with indications of activity in Europe and East Asia .


Given the group 's specific interest in infrastructure operations , rapidly improving capabilities , and history of aggressive targeting , Dragos considers this group a primary threat to the ICS industry .


Delivering a backdoor and spyware , this campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video .


Delivering a backdoor and spyware , Desert Falcons 's campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video .


FrozenCell is the mobile component of a multi-platform attack we've seen a threat actor known as " Two-tailed Scorpion/APT-C-23 " , use to spy on victims through compromised mobile devices and desktops .


Desert Falcons is keenly aware of the information they can derive from these devices and are using multi-stage ( phishing + an executable ) , multi-platform ( Android + desktop ) attacks to accomplish their spying .


FrozenCell masquerades as fake updates to chat applications like Facebook , WhatsApp , Messenger , LINE , and LoveChat .


It appears the Desert Falcons sent malicious executables though phishing campaigns impersonating individuals associated with the Palestinian Security Services , the General Directorate of Civil Defence - Ministry of the Interior , and the 7th Fateh Conference of the Palestinian National Liberation Front ( held in late 2016 ) .


We believe that this is a new variant of VAMP , indicating that the threat actors behind APT-C-23 are still active and continuously improving their product .


VAMP targeted various types of data from the phones of victims : images , text messages , contacts , and call history , among others .


Recently , Trend Micro researchers came across a new mobile malware family which we have called GnatSpy .


On Nov. 27 , 2018 , Cisco 's Talos research division published a write-up outlining the contours of a sophisticated cyber espionage campaign it dubbed DNSpionage .


Talos said the perpetrators of DNSpionage were able to steal email and other login credentials from a number of government and private sector entities in Lebanon and the United Arab Emirates by hijacking the DNS servers for these targets , so that all email and virtual private networking ( VPN ) traffic was redirected to an Internet address controlled by the attackers .


Talos reported that these DNS hijacks also paved the way for the attackers to obtain SSL encryption certificates for the targeted domains ( e.g.webmail.finance.gov.lb ) , which allowed them to decrypt the intercepted email and VPN credentials and view them in plain text .


That changed on Jan. 25 , 2019 , when security firm CrowdStrike published a blog post listing virtually every Internet address known to be ( ab )used by the espionage campaign to date .


Working backwards from each Internet address , I was able to see that in the last few months of 2018 the hackers behind DNSpionage succeeded in compromising key components of DNS infrastructure for more than 50 Middle Eastern companies and government agencies , including targets in Albania , Cyprus , Egypt , Iraq , Jordan , Kuwait , Lebanon , Libya , Saudi Arabia and the United Arab Emirates .


PCH is a nonprofit entity based in northern California that also manages significant amounts of the world 's DNS infrastructure , particularly the DNS for more than 500 top-level domains and a number of the Middle East top-level domains targeted by DNSpionage .


This APT group usually carries out target attacks against government agencies to steal sensitive information .


In addition to spreading malware via spear fishing email with Office attachment containing either vulnerability or malicious macro , this group is particularly good at leveraging malicious Android APKs in the target attacks .


We named the actor DustSquad and have provided private intelligence reports to our customers on four of their campaigns involving custom Android and Windows malware .


In this blogpost we cover a malicious program for Windows called Octopus that mostly targets diplomatic entities .


We also started monitoring the malware and , using Kaspersky Attribution Engine based on similarity algorithms , discovered that Octopus is related to DustSquad , something we reported in April 2018 .


From early 2014 until December 2018 , ns0.idm.net.lb pointed to 194.126.10.18 , which appropriately enough is an Internet address based in Lebanon .


Kaspersky Lab products detect the Octopus Trojan as Trojan.Win32.Octopus.gen .


Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) .


El Machete is one of these threats that was first publicly disclosed and named by Kaspersky here .


We've found that this group has continued to operate successfully , predominantly in Latin America , since 2014 .


All attackers simply moved to new C2 infrastructure , based largely around dynamic DNS domains , in addition to making minimal changes to the malware in order to evade signature-based detection .


In the case of Octopus , DustSquad used Delphi as their programming language of choice , which is unusual for such an actor .


Targets included a wide array of high-profile entities , including intelligence services , military , utility providers ( telecommunications and power ) , embassies , and government institutions .


Some time ago , a Kaspersky Lab customer in Latin America contacted us to say he had visited China and suspected his machine was infected with an unknown , undetected malware .


It was a targeted attack we are calling " Machete " .


At first look , it pretends to be a Java related application but after a quick analysis , it was obvious this was something more than just a simple Java file .


" Machete " is a targeted attack campaign with Spanish speaking roots .


The decoy slideshows all contain photos from very meaningful events to individuals in Thailand , suggesting that the actors continually look for impactful events to use to disguise their attacks .


In some cases , such as Russia , the target appears to be an embassy from one of the countries of this list .


Both attackers and victims speak Spanish natively , as we see it consistently in the source code of the client side and in the Python code .


We are also grateful to the Private Office of his Holiness the Dalai Lama , the Tibetan Government-in-Exile , the missions of Tibet in London , Brussels , and New York , and Drewla ( a Tibetan NGO ) .


Between June 2008 and March 2009 the Information Warfare Monitor conducted an extensive and exhaustive two-phase investigation focused on allegations of Chinese cyber espionage against the Tibetan community .


These instances of Gh0st RAT are consistently controlled from commercial Internet access accounts located on the island of Hainan , People's Republic of China .


The fieldwork generated extensive data that allowed us to examine Tibetan information security practices , as well as capture real-time evidence of malware that had penetrated Tibetan computer systems .


It is therefore possible that the large percentage of high value targets identified in our analysis of the GhostNet are coincidental , spread by contact between individuals who previously communicated through e-mail .


Where they exist , they often use grey market or pirated software .


Contextually relevant emails are sent to specific targets with attached documents that are packed with exploit code and Trojan horse programmes designed to take advantage of vulnerabilities in software installed on the target 's computer .


GhostNet represents a network of compromised computers resident in high-value political , economic , and media locations spread across numerous countries worldwide .


After that , the attacker is capable to control the compromised device .


The computers of diplomats , military attachés , private assistants , secretaries to Prime Ministers , journalists and others are under the concealed control of unknown assailant (s ) .


The C&C server ( 82.137.255.56 ) used by the above backdoors was used by APT-C-27 ( Goldmouse ) many times since 2017 .


According to 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor .


The banking malware GozNym has legs ; only a few weeks after the hybrid Trojan was discovered , it has reportedly spread into Europe and begun plaguing banking customers in Poland with redirection attacks .


The APT group is reportedly targeting the Middle East region .


The malware has started targeting corporate , SMB , investment banking and consumer accounts at banks , including some in Portugal and the U.S. , in addition to Poland , according to researchers at IBM 's X-Force team .


According to Kessem the malware has redirection instructions for 17 banks , and features an additional 230 URLs to assist attackers in targeting community banks and email service providers in Poland .


With GozNym , attackers dupe users by showing them the actual bank 's URL and SSL certificate .


Fresh from targeting banks in Poland , the banking Trojan GozNym has begun taking aim at banks in Germany .


Attackers went on to use the Trojan to steal $4 million from 24 banks , including 22 in the United States and two in Canada , in just two weeks .


Recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the GozNym group appears up to the task .


The malware is distributed primarily through laced spam emails that lure recipients into opening attachments .


Kessem .


Fresh from targeting banks in Poland , the banking Trojan has reportedly begun taking aim at banks in Germany .


Now GozNym is now targeting 13 banks and subsidiaries in Germany , Limor Kessem , Executive Security Advisor at IBM , said Tuesday .


he Trojan , a hybrid of Nymaim and Gozi malware , initially formed in April and thrives on carrying out redirection attacks via DNS poisoning .


In April , shortly after the Trojan 's discovery , researchers observed a massive GozNym campaign targeting 24 North American banks .


The method , which technically redirects users through local DNS poisoning , requires a fair bit of work ; recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the group behind GozNym – Nymaim – appear up to the task .


Attackers behind Dyre have used similar tactics in the past but have only deployed their attacks in English speaking countries and Spain .


When we last heard from the Trojan , its operators were seen launching redirection attacks on four large , U.S. banks in June .


The fact that the cybercriminals behind GozNym have already adapted the Trojan for three different languages and in countries which have different banking systems is unique , according to Kessem .


By the end of April , GozNym had redirection instructions for 17 Polish banks in its repertoire , along with an extra 230 URLs designed to assist attackers in targeting community banks and email service providers in the Eastern European country .


Seeking to tease out any possible links between Operation Aurora , VOHO , Operation DeputyDog , and Ephemeral Hydra , we began with Symantec 's Hidden Lynx report as our foundation .


The authors of that report identify three primary tools used in the campaigns attributed to Hidden Lynx : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit .


We will detail how the C&C infrastructure and tools used by hacker group Hidden Lynx during its VOHO campaign ( 2012 ) , excellently documented by Symantec researchers last September , overlap with tools used in other high profile operations during the past few years .


When the New York Times and Mandiant last year unmasked a large scale Chinese hacking operation , pinpointing its location down to the building , the report drew mainstream attention to what security professionals already well knew : sophisticated threat actors carry out persistent cyber operations over months and years .


Using Recorded Future , we quickly built a timeline of the reported use of those tools in major security incidents , finding many events prior to the early 2013 exposé on Hidden Lynx .


In particular , FireEye during the fall of 2013 called out infrastructure overlap between Ephemeral Hydra and DeputyDog .


The above network shows relationships between three tools used by Hidden Lynx during its VOHO campaign : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit .


Symantec during 2012 linked the Elderwood Project to Operation Aurora ; Trojan.Naid and Backdoor.Moudoor were also used in Aurora , by the Elderwood Gang , and by Hidden Lynx .


In addition to these , we also identified " Macfog " , a native Mac OS X implementation of Icefog that infected several hundred victims worldwide .


Icefog , also known as the " Dagger Panda " by Crowdstrike 's naming convention , infected targets mainly in South Korea and Japan .


In 2013 , a public report reveals a group of actors conducted targeted attacks leverage a malware dubbed ICEFOG against mainly government organizations and defense industry of South Korea and Japan .


Similar to our approach with Symantec 's report on Hidden Lynx , we used Recorded Future to organize the technical details about the DeputyDog attacks to reveal technical information described in the open source reporting across multiple campaigns .


With Javafog , we are turning yet another page in the Icefog story by discovering another generation of backdoors used by the attackers .


Since January 2013 , we've been on the lookout for a possible RedOctober comeback .


One possible hit was triggered when we observed Mevade , an unusual piece of malware that appeared late in 2013 .


In August 2014 , some of our users observed targeted attacks with a variation of CVE-2012-0158 and an unusual set of malware .


It wasn't until August 2014 that we observed something which made us wonder if RedOctober is back for good .


The Cloud Atlas implants utilize a rather unusual C&C mechanism .


We named it RedOctober because we started this investigation in October 2012 , an unusually hot month .


The attackers upload data to the account , which is downloaded by the implant , decrypted and interpreted .


Just like with RedOctober , the top target of Cloud Atlas is Russia , followed closely by Kazakhstan , according to data from the Kaspersky Security Network ( KSN ) .


In May 2015 , Palo Alto Networks WildFire detected two e-mails carrying malicious documents from a genuine and compromised Israeli Gmail account , sent to an Israeli industrial organization .


One e-mail carried a Microsoft PowerPoint file named " thanks.pps " ( VirusTotal ) , the other a Microsoft Word document named " request.docx " .


Around the same time , WildFire also captured an e-mail containing a Word document ( " hello.docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient .


Attacks using this tool were still active as of April 2016 .


Considering the language being used in the malicious code is Arabic , it seems that the attacker is familiar with Arabic language as well .


The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll .


In this case , the file used the software name " Cyberlink " , and a description of " CLMediaLibrary Dynamic Link Library " and listing version 4.19.9.98 .


Unit 42 published a blog at the beginning of May titled " Prince of Persia " , in which we described the discovery of a decade-long campaign using a formerly unknown malware family , Infy , that targeted government and industry interests worldwide .


We noted in our original blog the large amount of targeting of Iranian citizens in this campaign , we observed almost one-third of all victims to be Iranian .


In addition to the original " Infy " variant , we also see the newer , more sophisticated , interactive , and fuller-featured " Infy M " variant deployed against apparently-higher-value targets .


This documentation provides new insight into intrusion efforts conducted by at least four discrete Iranian threat actors , Rocket Kitten , Infy , Sima , and Operation Cleaver , including groups and tools that have not been previously disclosed .


Since early 2013 , we have observed activity from a unique threat actor group , which we began to investigate based on increased activities against human right activists in the beginning of 2015 .


Over the course of three years of observation of campaigns targeting civil society and human rights organizations , from records of well over two hundred spearphishing and other intrusion attempts against individuals inside of Iran and in the diaspora , a narrative of persistent intrusion efforts emerges .


Thanks to information we have been able to collect during the course of our research , such as characteristics of the group 's malware and development cycle , our research strongly supports the claim that the Infy group is of Iranian origin and potentially connected to the Iranian state .


Amongst a backdrop of other incidents , Infy became one of the most frequently observed agents for attempted malware attacks against Iranian civil society beginning in late 2014 , growing in use up to the February 2016 parliamentary election in Iran .


Until the publication of the Palo Alto report , the developers of the Infy appeared to be actively updating and maintaining the codebase , and new releases were distributed to existing , as well as new , targets quite regularly .


Other samples were found bearing a compilation time as early as June 2012 and version 00002 .


Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware .


When activities targeting of civil society subsided , the actors instead appeared to have focused on external targets , such a series of attempts to spearphish the Danish Ministry of Foreign Affairs .


Palo Alto Networks has noted and described the differences of two malware agents developed in parallel , with commonalities in behavior but differing functionalities ; families described as Infy and Infy M. Our primary observation was of the Infy ( non-M ) malware , which primarily functions as a keylogger for the collection of account credentials .


Our observation of Infy 's campaigns , primarily through the lens of spearphishing attacks against Iranian civil society and media organizations , indicates a wandering focus on particular demographics on a strategic basis over time .


The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) .


Based on information collected in the course of this research , the targets and victims of Infy 's campaigns have continued to be strongly aligned with Iran 's " soft war " agenda , internal security policies , and regional adversaries of the hardline establishment of the Islamic Republic of Iran .


Until late December 2015 , in nearly every Infy message documented since our tracking began in May 2013 , no attempt included strong tailoring of the approach , often not even including an email body , instead relying on cryptic filenames and email subjects to attract interest .


One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges .


As in the past , these messages have been sent accounts believed to be fake and accounts compromised by Infy , including Kurdish activists that had previously been compromised by the Flying Kitten actor group .


The actors successfully compromised a host of an Saudi government institutions on January 17 , 2016 , and maintained access for at least two weeks .


The Infy group also appears to engage in espionage activities against foreign governments and businesses .


In order to initially compromise the designated targets , Infy typically distributed specifically-crafted malicious documents containing Infy through spearphishing attacks .


In order to initially compromise the designated targets , the attackers typically distributed specifically-crafted malicious documents containing Infy through spearphishing attacks .


On May 2 , 2016 , Palo Alto Networks published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available .


Prior to the distribution of new versions of the agent , the Infy developers appear to consistently conduct tests from local hosts , which indicates that the control and maintenance of the software occurs in the Khorasan Razavi province of Iran , potentially in the city of Mashhad .


On May 2 , 2016 , Palo Alto published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available .


Only one client , based in Iran , continued to communicate with the infrastructure .


A researcher has attributed a recently publicized attack on Citrix' internal network to the Iranian-linked group known as IRIDIUM – and said that the data heist involved 6 terabytes of sensitive data .


" IRIDIUM has hit more than 200 government agencies , oil and gas companies and technology companies , including Citrix Systems Inc " , they said .


Citrix told Threatpost that this is indeed the same password-spraying attack it announced itself last week – but it wouldn't confirm the other details in Resecurity 's post , including the attribution .


In wake of these events , a security firm Resecurity reached out to NBC news and claimed that they had reasons to believe that the attacks were carried out by Iranian-linked group known as IRIDIUM .


Resecurity says that IRIDIUM " has hit more than 200 government agencies , oil and gas companies , and technology companies including Citrix .


Resecurity claims that IRIDIUM breached Citrix 's network during December 2018 .


Infy engaged in malware spearphishing against the same targets as Flying Kitten from the outset of its campaign ; Operation Cleaver has registered several resources related to development agencies that have been the subject of intrusion attempts by others since February 2014 .


The malicious samples we found are the early stage malware most often delivered by spear-phishing e-mails .


This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample .


At this stage , the malware gathers information about the infected computer .


Hancom Office is widely used in South Korea .


Perhaps it also points to the suspected North Korean origin of attack .


The attacker is from North Korea .


All of them lie in ranges of the Jilin Province Network and Liaoning Province Network , in China .