At the time of analysis , the subdomains did not host a website; however , based on BITTER APT group’s targeting patterns , it is highly likely that they were created to host faux login phishing pages designed to steal user’s credentials .


The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations .


They seem to have specialized knowledge about military operations , as they are focused on stealing specific files such as those that describe navigation routes .


SectorJ04 used the spear phishing email to spread malicious Excel or malicious Word files , and downloaded the MSI files from the attacker’s server when the malicious documents were run .


Group-IB specialists have established that the aim of the attack was to deliver and launch the second stage of Silence’s Trojan , known as Silence.MainModule .


The hackers will map a company’s network and look for strategically favorable locations for placing their malware .


Typically , APT10 tends to employ a namesquatting scheme in their domains that aims to confuse the observer by posing as a legitimate domain .


If the attack had succeeded , it would have given hackers control over the ATM network , while money mules would have been standing by the ATM machines at pre-set time intervals to cash them out .


Based on the functionality of the various tools uploaded to the webshells , we believe the threat actors breach the SharePoint servers to use as a beachhead , then attempt to move laterally across the network via stolen credentials and exploiting vulnerabilities .


The first of them is the well-known FIN7 , which specializes in attacking various companies to get access to financial data or PoS infrastructure .


Alpha’s early role was fairly simple: engage with individuals , who he chose based on the goods they were selling , and then provide personal shipping addresses back to Omega .


Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials .


In some samples deployed since March 2019 , Turla developers modified their PowerShell scripts in order to bypass the Antimalware Scan Interface (AMSI) .


Distinct changes to Azazel by the Winnti developers include the addition of a function named ‘Decrypt2’ , which is used to decode an embedded configuration similar to the core implant .


Early in Q2 , Kaspersky identified an interesting Lazarus attack targeting a mobile gaming company in South Korea that we believe was aimed at stealing application source code .


During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros .


PittyTiger has also been seen using Heartbleed vulnerability in order to directly get valid credentials .


They have also been seen using Heartbleed vulnerability in order to directly get valid credentials .


Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() .


APT28 is using novel techniques involving the EternalBlue exploit and the open source tool Responder to spread laterally through networks and likely target travelers .


Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data exfiltration and to provide remote access to infected machines .


If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation .


To enable connections to the infected computer using the Remote Desktop Protocol ( RDP ) , Carbanak sets Termservice service execution mode to Auto .


Just a few months later , in February 2015 , we announced the discovery of Carbanak , a cyber-criminal gang that used custom malware and APT techniques to steal millions of dollars while infecting hundreds of financial institutions in at least 30 countries .


Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year .


The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware .


The malware starts communicating with the C&C server by sending basic information about the infected machine .


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests .


After app installation , whenever SWAnalytics senses victims opening up infected applications or rebooting their phones , it silently uploads their entire contacts list to Hangzhou Shun Wang Technologies controlled servers .


This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge .


It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in .


With default settings , SWAnalytics will scan through an Android device’s external storage , looking for directory tencent/MobileQQ/WebViewCheck” .


By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device .


To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control .


Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue .


The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine .


The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems .


The PowerShell version of the Trojan also has the ability to get screenshots .


Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations .


BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e , possibly en masse .


The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience .


China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool .


China Chopper contains a remote shell (Virtual Terminal) function that has a first suggested command of netstat an|find ESTABLISHED .


The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords .


Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory .


The exploit installs Silence’s loader , designed to download backdoors and other malicious programs .


The threat actors behind the Sea Turtle campaign were successful in compromising entities by manipulating and falsifying DNS records at various levels in the domain name space .


Some of the documents exploited CVE-2017-0199 to deliver the payload .


It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries .


This threat group has conducted broad targeting across a variety of industries , including financial , government , energy , chemical , and telecommunications , and has largely focused its operations within the Middle East .


This threat group has conducted broad targeting across a variety of industries , including financial , government , energy , chemical , and telecommunications .


Join us in a live webinar as we discuss this threat group whom we assess to be working on behalf of the Iranian Government , with a mission that would benefit nation-state geopolitical and economic needs .


The group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries .


HELIX KITTEN is likely an Iranian-based adversary group , active since at least late 2015 , targeting organizations in the aerospace , energy , financial , government , hospitality and telecommunications business verticals .


The certificates Blackfly stole were also from South Korean companies , primarily in the video game and software development industry .


Suckfly 's attacks on government organizations that provide information technology services to other government branches is not limited to India .


In this report we continue our research of the actor 's operations with a specific focus on a selection of custom information technology ( IT ) tools and tactics the threat actor leveraged during the early stages of the targeted attack lifecycle .


CTU researchers have evidence that the TG-3390 compromised U.S and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations .


Based on analysis of the group 's SWCs , TG-3390 operations likely affect organizations in other countries and verticals .


TG-3390 operates a broad and long-running campaign of SWCs and has compromised approximately 100 websites as of this publication .


CTU researchers have evidence that the threat group compromised U.S and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations .


In 2016 , the threat actors conducted a strategic web compromise ( SWC ) on the website of an international industry organization that affected aerospace , academic , media , technology , government , and utilities organizations around the world .


In addition , BRONZE UNION activity on multiple U.S.-based defense manufacturer networks included the threat actors seeking information associated with aerospace technologies , combat processes , and naval defense systems .


Leafminer attempts to infiltrate target networks through various means of intrusion : watering hole websites , vulnerability scans of network services on the internet , and brute-force login attempts .


Leafminer also utilized Process Doppelganging , a detection evasion technique first discussed at the Black Hat EU conference last year .


On September 15 and 19 , 2017 , Proofpoint detected and blocked spearphishing emails from this group targeting a US shipbuilding company and a US university research center with military ties .


Between August 2 and 4 , the actor sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors .


Between August 2 and 4 , the Leviathan sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors .


The Leviathan generally emailed Microsoft Excel documents with malicious macros to US universities with military interests , most frequently related to the Navy .


Instead , the Spring Dragon group is known to have employed spearphish exploits , strategic web compromises , and watering holes attack .


On November 10 , 2015 , threat actors sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


On November 10 , 2015 , Lotus Blossom sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


The Magic Hound attacks did not rely on exploit code to compromise targeted systems , instead relying on Excel and Word documents containing malicious macros .


The Magic Hound campaign used Word and Excel documents containing malicious macros as a delivery method , specifically attempting to load MagicHound.Rollover .


APT33 often conducts spear-phishing operations using a built-in phishing module .


In a recent attack , APT33 sent spear-phishing emails to workers in the aviation industry .


These emails included recruitment-themed lures and links to malicious HTML application ( HTA ) files .


APT34 often uses compromised accounts to conduct spear-phishing operations .


APT33 leverages a mix of public and non-public tools and often conducts spear-phishing operations using a built-in phishing module from " ALFA TEaM Shell " , a publicly available web shell .