According to our telemetry , that was the year the distribution campaign was at its most active . This backdoor has some features similar to a previously discovered version of the Muddywater backdoor . Cobalt Group : Cobalt Gang , Cobalt Spider .


The activities continue : the most recently observed domain was registered on October 31 , 2017 . Based on our analysis , we can confirm that MuddyWater target Turkish government organizations related to the finance and energy sectors . Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions .


Based on our KSN statistics , there are several infected individuals , exclusively in Italy . This is yet another similarity with previous MuddyWater campaigns , which were known to have targeted multiple Turkish government entities . The group has conducted intrusions to steal money via targeting ATM systems , card processing , payment systems and SWIFT systems .


Moreover , as we dived deeper into the investigation , we discovered several spyware tools for Windows that form an implant for exfiltrating sensitive data on a targeted machine . The main delivery method of this type of backdoor is spear phishing emails or spam that uses social engineering to manipulate targets into enabling malicious documents . Cobalt Group has mainly targeted banks in Eastern Europe , Central Asia , and Southeast Asia .


The version we found was built at the beginning of 2017 , and at the moment we are not sure whether this implant has been used in the wild . Trend Micro™ Deep Discovery™ provides detection , in-depth analysis , and proactive response to today’s stealthy malware , and targeted attacks in real time . One of the alleged leaders was arrested in Spain in early 2018 , but the group still appears to be active .


We named the malware Skygofree , because we found the word in one of the domains * . MuddyWater first surfaced in 2017 . The group has been known to target organizations in order to use their access to then compromise additional victims .


Malware Features Android According to the observed samples and their signatures , early versions of this Android malware were developed by the end of 2014 and the campaign has remained active ever since . First stage infections and graphical decoys have been described by multiple sources , including in our previous research MuddyWater expands operations . Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak .


The code and functionality have changed numerous times ; from simple unobfuscated malware at the beginning to sophisticated multi-stage spyware that gives attackers full remote control of the infected device . MuddyWater compiles various offensive Python scripts . Taidoor is a threat group that has operated since at least 2009 and has primarily targeted the Taiwanese government .


We have examined all the detected versions , including the latest one that is signed by a certificate valid from September 14 , 2017 . This includes Python scripts . TEMP.Veles ： XENOTIME .


The implant provides the ability to grab a lot of exfiltrated data , like call records , text messages , geolocation , surrounding audio , calendar events , and other memory information stored on the device . Usually , the Stageless Meterpreter has the Ext_server_stdapi.x64.dll” , Ext_server_extapi.x64.dll” , and Ext_server_espia.x64.dll” extensions . TEMP.Veles is a Russia based threat group that has targeted critical infrastructure .


After manual launch , it shows a fake welcome notification to the user : Dear Customer , we ’ re updating your configuration and it will be ready as soon as possible . The January 2017 report followed up on other private reports published on the group’s BeEF-related activity in 2015 and 2016 . The group has been observed utilizing TRITON , a malware framework designed to manipulate industrial safety systems .


At the same time , it hides an icon and starts background services to hide further actions from the user . Previous analysis of the NewsBeef APT indicates that the group focuses on Saudi Arabian (SA) and Western targets , and lacks advanced offensive technology development capabilities . The White Company is a likely state-sponsored threat actor with advanced capabilities .


Service Name Purpose AndroidAlarmManager Uploading last recorded .amr audio AndroidSystemService Audio recording AndroidSystemQueues Location tracking with movement detection ClearSystems GSM tracking ( CID , LAC , PSC ) ClipService Clipboard stealing AndroidFileManager Uploading all exfiltrated data AndroidPush XMPP С & C protocol ( url.plus:5223 ) RegistrationService Registration on C & C via HTTP ( url.plus/app/pro/ ) Interestingly , a self-protection feature was implemented in almost every service However , in the summer of 2016 , NewsBeef deployed a new toolset that includes macro-enabled Office documents , PowerSploit , and the Pupy backdoor . From 2017 through 2018 , the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan .


. The most recent NewsBeef campaign uses this toolset in conjunction with spearphishing emails , links sent over social media/standalone private messaging applications , and watering hole attacks that leverage compromised high-profile websites some belonging to the SA government . Molerats : Operation Molerats , Gaza Cybergang .


Since in Android 8.0 ( SDK API 26 ) the system is able to kill idle services , this code raises a fake update notification to prevent it : Cybercriminals have the ability to control the implant via HTTP , XMPP , binary SMS and FirebaseCloudMessaging ( or GoogleCloudMessaging in older versions ) protocols . The NewsBeef actor deployed a new toolset in a campaign that focused primarily on Saudi Arabian targets . Molerats is a politically-motivated threat group that has been operating since 2012 .


Such a diversity of protocols gives the attackers more flexible control . NewsBeef continues to deploy malicious macro-enabled Office documents , poisoned legitimate Flash and Chrome installers , PowerSploit , and Pupy tools . The group 's victims have primarily been in the Middle East , Europe , and the United States .


In the latest implant versions there are 48 different commands . The NewsBeef campaign is divided into two main attack vectors , spearphishing and strategic web compromise watering hole attacks . MuddyWater : Seedworm , TEMP.Zagros .


You can find a full list with short descriptions in the Appendix . On December 25 , 2016 , the NewsBeef APT stood up a server to host a new set of Microsoft Office documents (maintaining malicious macros and PowerShell scripts) to support its spear-phishing operations . MuddyWater is an Iranian threat group that has primarily targeted Middle Eastern nations , and has also targeted European and North American nations .


Here are some of the most notable : ‘ geofence ’ – this command adds a specified location to the implant ’ s internal database and when it matches a device ’ s current location the malware triggers and begins to record surrounding audio . These compromised servers include Saudi Arabian government servers and other high-value organizational identities relevant to NewsBeef's targets . The group 's victims are mainly in the telecommunications , government ( IT services ) , and oil sectors .


” social ” – this command that starts the ‘ AndroidMDMSupport ’ service – this allows the files of any other installed application to be grabbed . However , Kaspersky Security Network (KSN) records also contain links that victims clicked from the Outlook web client outlook.live.com” as well as attachments arriving through the Outlook desktop application . Activity from this group was previously linked to FIN7 , but the group is believed to be a distinct group possibly motivated by espionage .


The service name makes it clear that by applications the attackers mean MDM solutions that are business-specific tools . Interestingly , NewsBeef set up its server using the hosting provider Choopa , LLC , US” , the same hosting provider that the group used in attacks over the summer of 2016 . Naikon is a threat group that has focused on targets around the South China Sea .


The operator can specify a path with the database of any targeted application and server-side PHP script name for uploading . NTG’s IT focus and client list likely aided NewsBeef’s delivery of malicious PowerShell-enabled Office documents and poisoned installers . The group has been attributed to the Chinese People ’s Liberation Army ’s ( PLA ) Chengdu Military Region Second Technical Reconnaissance Bureau ( Military Unit Cover Designator 78020 ) .


Several hardcoded applications targeted by the MDM-grabbing command ‘ wifi ’ – this command creates a new Wi-Fi connection with specified configurations from the command and enable Wi-Fi if it is disabled . In other schemes , NewsBeef sent macro-enabled Office attachments from spoofed law firm identities or other relevant service providers to targets in SA . While Naikon shares some characteristics with APT30 , the two groups do not appear to be exact matches .


So , when a device connects to the established network , this process will be in silent and automatic mode . The law firm in this scheme is based in the United Kingdom and is the sole location for targets outside of SA for this campaign . APT39 : Chafer .


This command is used to connect the victim to a Wi-Fi network controlled by the cybercriminals to perform traffic sniffing and man-in-the-middle ( MitM ) attacks . Starting in October 2016 , NewsBeef compromised a set of legitimate servers (shown below) , and injected JavaScript to redirect visitors to http://analytics-google.org:69/Check.aspx . APT39 is Oan Iranian cyber espionage group that has been active since at least 2014 .


addWifiConfig method code fragments ‘ camera ’ – this command records a video/capture a photo using the front-facing camera when someone next unlocks the device . For example , on a Saudi government website , the NewsBeef APT delivered packed JavaScript into the bottom of a referenced script that is included in every page served from the site the packed and unpacked JavaScript is shown below . They have targeted the telecommunication and travel industries to collect personal information that aligns with Iran 's national priorities .


Some versions of the Skygofree feature the self-protection ability exclusively for Huawei devices . The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” . APT41 is a group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity .


There is a ‘ protected apps ’ list in this brand ’ s smartphones , related to a battery-saving concept . A high volume of redirections from the compromised site continues into mid-January 2017 . APT41 has been active since as early as 2012 .


Apps not selected as protected apps stop working once the screen is off and await re-activation , so the implant is able to determine that it is running on a Huawei device and add itself to this list . However , as this recent campaign indicates , the NewsBeef APT appears to have shifted its intrusion toolset away from BeEF and towards macro-enabled malicious Office documents , PowerSploit , and Pupy . The group has been observed targeting healthcare , telecom , technology , and video game industries in 14 countries .


Due to this feature , it is clear that the developers paid special attention to the work of the implant on Huawei devices . Despite this shift in toolset , the group still relies on old infrastructure as evidenced by their reuse of servers hosted by the service providers Choopa and Atlantic.net . Axiom : Group72 .


Also , we found a debug version of the implant ( 70a937b2504b3ad6c623581424c7e53d ) that contains interesting constants , including the version of the spyware . Its attack activities can be traced back to April 2012 . Axiom is a cyber espionage group suspected to be associated with the Chinese government .


Debug BuildConfig with the version After a deep analysis of all discovered versions of Skygofree , we made an approximate timeline of the implant ’ s evolution . The OceanLotus reflects a very strong confrontational ability and willing to attack by keep evolving their techniques . It is responsible for the Operation SMN campaign .


Mobile implant evolution timeline However , some facts indicate that the APK samples from stage two can also be used separately as the first step of the infection . These APT attacks and adopting confrontation measures will exist for a long time . Though both this group and Winnti Group use the malware Winnti , the two groups appear to be distinct based on differences in reporting on the groups' TTPs and targeting .


Below is a list of the payloads used by the Skygofree implant in the second and third stages . OceanLotus’ targets are global . Suckfly is a China based threat group that has been active since at least 2014 .


Reverse shell payload The reverse shell module is an external ELF file compiled by the attackers to run on Android . OceanLotus have been actively using since at least early 2018 . TA459 is a threat group believed to operate out of China that has targeted countries including Russia , Belarus , Mongolia , and others .


The choice of a particular payload is determined by the implant ’ s version , and it can be downloaded from the command and control ( C & C ) server soon after the implant starts , or after a specific command . OceanLotus malware family samples used no earlier than 2017 . TA505 is a financially motivated threat group that has been active since at least 2014 .


In the most recent case , the choice of the payload zip file depends on the device process architecture . We identified two methods to deliver the KerrDown downloader to targets . The group is known for frequently changing malware and driving global trends in criminal malware distribution .


For now , we observe only one payload version for following the ARM CPUs : arm64-v8a , armeabi , armeabi-v7a . The link to the final payload of KerrDown was still active during the time of analysis and hence we were able to download a copy which turned out to be a variant of Cobalt Strike Beacon . Magic Hound : Rocket Kitten , Operation Saffron Rose , Ajax Security Team , Operation Woolen-Goldfish , Newscaster , Cobalt Gypsy , APT35 .


Note that in almost all cases , this payload file , contained in zip archives , is named ‘ setting ’ or ‘ setting.o ’ . While investigating KerrDown we found multiple RAR files containing a variant of the malware . Magic Hound is an Iranian-sponsored threat group operating primarily in the Middle East that dates back as early as 2014 .


The main purpose of this module is providing reverse shell features on the device by connecting with the C & C server ’ s socket . Therefore , it is clear that the OceanLotus group works during weekdays and takes a break during the weekends . The group behind the campaign has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia . menuPass : Stone Panda , APT10 , Red Apollo , CVNX , HOGFISH . menuPass is a threat group that appears to originate from China and has been active since approximately 2009 .


Reverse shell payload The payload is started by the main module with a specified host and port as a parameter that is hardcoded to ‘ 54.67.109.199 ’ and ‘ 30010 ’ in some versions : Alternatively , they could be hardcoded directly into the payload code : We also observed variants that were equipped with similar reverse shell payloads directly in the main APK /lib/ path . The group was first revealed and named by SkyEye Team in May 2015 . The group has targeted healthcare , defense , aerospace , and government sectors , and has targeted Japanese victims since at least 2014 .


Equipped reverse shell payload with specific string After an in-depth look , we found that some versions of the reverse shell payload code share similarities with PRISM – a stealth reverse shell backdoor that is available on Github . OceanLotus's targets include China's maritime institutions , maritime construction , scientific research institutes and shipping enterprises . In 2016 and 2017 , the group targeted managed IT service providers , manufacturing and mining companies , and a university .


Reverse shell payload from update_dev.zip Exploit payload At the same time , we found an important payload binary that is trying to exploit several known vulnerabilities and escalate privileges . RedDrip Team (formerly SkyEye Team) has been to OceanLotus to keep track of high strength , groupactivity , found it in the near future to Indochinese Peninsula countries since 2019 On April 1 , 2019 , RedDrip discovered a Vietnamese file name Hop dong sungroup.rar in the process of daily monitoring the attack activities of the OceanLotus . Moafee is a threat group that appears to operate from the Guandong Province of China .


According to several timestamps , this payload is used by implant versions created since 2016 . COCCOC is a Vietnam was founded in 2013 . Due to overlapping TTPs , including similar custom tools , Moafee is thought to have a direct or indirect relationship with the threat group DragonOK .


It can also be downloaded by a specific command . In fact , according to reports of various security vendors , OceanLotus also attacked several countries , including Cambodia , Thailand , Laos , even some victims in Vietnam , like opinion leaders , media , real estate companies , foreign enterprises and banks . SilverTerrier is a Nigerian threat group that has been seen active since 2014 .


The exploit payload contains following file components : Component name Description run_root_shell/arrs_put_user.o/arrs_put_user/poc Exploit ELF db Sqlite3 tool ELF device.db Sqlite3 database with supported devices and their constants needed for privilege escalation ‘ device.db ’ is a database used by the exploit . Unlike the 2016 variants of Ratsnif that stored all packets to a PCAP file . SilverTerrier mainly targets organizations in high technology , higher education , and manufacturing .


It contains two tables – ‘ supported_devices ’ and ‘ device_address ’ . these threat actors targeted a number of government agencies Threat actors targeted a number of government agencies in East Asia . Operation Soft Cell is a group that is reportedly affiliated with China and is likely state-sponsored .


The first table contains 205 devices with some Linux properties ; the second contains the specific memory addresses associated with them that are needed for successful exploitation . Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT . The group has operated since at least 2012 and has compromised high-profile telecommunications networks .


You can find a full list of targeted models in the Appendix . Maudi Surveillance Operation which was previously reported in 2013 . Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia , particularly government entities , since at least 2015 .


Fragment of the database with targeted devices and specific memory addresses If the infected device is not listed in this database , the exploit tries to discover these addresses programmatically . specifically CVE-2018-0798 , before downloading subsequent payloads . Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan , the Philippines , and Hong Kong .


After downloading and unpacking , the main module executes the exploit binary file . The dropped PE file has the distinctive file name 8.t” . Tropic Trooper focuses on targeting government , healthcare , transportation , and high-tech industries and has been active since 2011 .


Once executed , the module attempts to get root privileges on the device by exploiting the following vulnerabilities : CVE-2013-2094 CVE-2013-2595 CVE-2013-6282 CVE-2014-3153 ( futex aka TowelRoot ) CVE-2015-3636 Exploitation process After an in-depth look , we found that the exploit payload code shares several similarities with the public project android-rooting-tools . The last process is utilized as part of the loading process for Cotx RAT and involves the legitimate Symantec binary noted above . Turla : Waterbug , WhiteBear , VENOMOUS BEAR , Snake , Krypton .


Decompiled exploit function code fragment run_with_mmap function from the android-rooting-tools project As can be seen from the comparison , there are similar strings and also a unique comment in Italian , so it looks like the attackers created this exploit payload based on android-rooting-tools project source code . These conflicts have even resulted in Haftar leading an attack on the capital city in April . Turla is a Russian-based threat group that has infected victims in over 45 countries , spanning a range of industries including government , embassies , military , education , research and pharmaceutical companies since 2004 .


Busybox payload Busybox is public software that provides several Linux tools in a single ELF file . The attackers have targeted a large number of organizations globally since early 2017 . Heightened activity was seen in mid-2015 .


In earlier versions , it operated with shell commands like this : Stealing WhatsApp encryption key with Busybox Social payload Actually , this is not a standalone payload file – in all the observed versions its code was compiled with exploit payload in one file ( ‘ poc_perm ’ , ‘ arrs_put_user ’ , ‘ arrs_put_user.o ’ ) . Attackers were initially discovered while investigating a phishing attack that targeted political figures in the MENA region . Turla is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware .


This is due to the fact that the implant needs to escalate privileges before performing social payload actions . Group's targets include high-profile entities such as parliaments , senates , top state offices and officials , political science scholars , military and intelligence agencies , ministries , media outlets , research centers , election commissions , Olympic organizations , large trading companies , and other unknown entities . Turla ’s espionage platform is mainly used against Windows machines , but has also been seen used against macOS and Linux machines .


This payload is also used by the earlier versions of the implant . Cisco Talos recently published a blogpost describing targeted attacks in the Middle East region which we believe may be connected . Winnti Group : Blackfly .


It has similar functionality to the ‘ AndroidMDMSupport ’ command from the current versions – stealing data belonging to other installed applications . Operation Parliament appears to be another symptom of escalating tensions in the Middle East region . Winnti Group is a threat group with Chinese origins that has been active since at least 2010 .


The payload will execute shell code to steal data from various applications . The attackers have taken great care to stay under the radar , imitating another attack group in the region . The group has heavily targeted the gaming industry , but it has also expanded the scope of its targeting .


The example below steals Facebook data : All the other hardcoded applications targeted by the payload : Package name Name jp.naver.line.android LINE : Free Calls & Messages com.facebook.orca Facebook messenger com.facebook.katana Facebook com.whatsapp WhatsApp com.viber.voip Viber Parser payload Upon receiving a specific command , the implant can download a special payload to grab sensitive information from external applications . With deception and false flags increasingly being employed by threat actors , attribution is a hard and complicated task that requires solid evidence , especially in complex regions such as the Middle East . Some reporting suggests a number of other groups , including Axiom , APT17 , and Ke3chang , are closely linked to Winnti Group .


The case where we observed this involved WhatsApp . The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware . Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists , activists , and dissidents since at least 2012 .


In the examined version , it was downloaded from : hxxp : //url [ . The malware starts communicating with the C&C server by sending basic information about the infected machine . Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates ( UAE ) government , but that has not been confirmed .


] plus/Updates/tt/parser.apk The payload can be a .dex or .apk file which is a Java-compiled Android executable . The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests . Stolen Pencil is a threat group likely originating from DPRK that has been active since at least May 2018 .


After downloading , it will be loaded by the main module via DexClassLoader api : As mentioned , we observed a payload that exclusively targets the WhatsApp messenger and it does so in an original way . What lied beneath this facade was a well-engineered campaign of phishing attacks designed to steal credentials and spy on the activity of dozens of journalists , human rights defenders , trade unions and labour rights activists , many of whom are seemingly involved in the issue of migrants’ rights in Qatar and Nepal . The group appears to have targeted academic institutions , but its motives remain unclear .


The payload uses the Android Accessibility Service to get information directly from the displayed elements on the screen , so it waits for the targeted application to be launched and then parses all nodes to find text messages : Note that the implant needs special permission to use the Accessibility Service API , but there is a command that performs a request with a phishing text displayed to the user to obtain such permission . We refer to this campaign and the associated actor as Operation Kingphish Malik” , in one of its written forms in Arabic , translates to King” . Strider : ProjectSauron . Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia , China , Sweden , Belgium , Iran , and Rwanda .


Windows We have found multiple components that form an entire spyware system for the Windows platform . It is worth noting that in December 2016 , Amnesty International published an investigation into another social engineering campaign perpetrated by a seemingly fake human rights organization known as Voiceless Victims , which targeted international human rights and labour rights organizations campaigning on migrant workers’ rights in Qatar . Putter Panda : APT2 , MSUpdater .


Name MD5 Purpose msconf.exe 55fb01048b6287eadcbd9a0f86d21adf Main module , reverse shell network.exe f673bb1d519138ced7659484c0b66c5b Sending exfiltrated data system.exe d3baa45ed342fbc5a56d974d36d5f73f Surrounding sound recording by mic update.exe 395f9f87df728134b5e3c1ca4d48e9fa Keylogging wow.exe It appears that the attackers may have impersonated the identity of a real young woman and stole her pictures to construct the fake profile , along with a professional biography also stolen from yet another person . Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA ’s 3rd General Staff Department ( GSD ) .


16311b16fd48c1c87c6476a455093e7a Screenshot capturing skype_sync2.exe 6bcc3559d7405f25ea403317353d905f Skype call recording to MP3 All modules , except skype_sync2.exe , are written in Python and packed to binary files via the Py2exe tool . In the course of this email correspondence , the attacker — Safeena” — then sent what appeared to be invitations to access several documents on Google Drive . Rancor is a threat group that has led targeted campaigns against the South East Asia region .


This sort of conversion allows Python code to be run in a Windows environment without pre-installed Python binaries . The attackers were meticulous in making their phishing page as credible as possible . Rancor uses politically-motivated lures to entice victims to open malicious documents .


msconf.exe is the main module that provides control of the implant and reverse shell feature . Among the targets of this campaign is the International Trade Union Confederation (ITUC) . RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries .


It opens a socket on the victim ’ s machine and connects with a server-side component of the implant located at 54.67.109.199:6500 . Both in the attacks against ITUC and in other occasions , Operation Kingphish approached selected targets over social media , prominently Facebook , and engaged in chat conversations with them on and off , sometimes over a period of several months . The group uses a Trojan by the same name ( RTM ) .


Before connecting with the socket , it creates a malware environment in ‘ APPDATA/myupd ’ and creates a sqlite3 database there – ‘ myupd_tmp\\mng.db ’ : CREATE TABLE MANAGE ( ID INT PRIMARY KEY NOT NULL , Send INT NOT NULL , Keylogg INT NOT NULL , Screenshot INT NOT NULL , Audio INT NOT NULL ) ; INSERT INTO MANAGE ( ID , Send , Keylogg , Screenshot , Audio This time the document purported to be about the involvement of the Emir of Qatar in funding ISIS , which was seemingly copied from a website critical of Qatar . FIN4 is a financially motivated threat group that has targeted confidential information related to the public financial market , particularly regarding healthcare and pharmaceutical companies , since at least 2013 .


) VALUES ( 1 , 1 , 1 , 1 , 0 ) Finally , the malware modifies the ‘ Software\Microsoft\Windows\CurrentVersion\Run ’ registry key to enable autostart of the main module . While there is a clear underlying Qatar migrant workers theme in Operation Sheep , it is also hypothetically possible that these attacks could have been perpetrated by a malicious actor affiliated to a different government with an interest in damaging the reputation of the State of Qatar . FIN4 is unique in that they do not infect victims with typical persistent malware , but rather they focus on capturing credentials authorized to access email and other non-public correspondence .


The code contains multiple comments in Italian , here is the most noteworthy example : “ Receive commands from the remote server , here you can set the key commands to command the virus ” Here are the available commands : Name Description cd Change current directory to specified quit Close the socket nggexe Execute received command via Python ’ s subprocess.Popen ( ) without outputs ngguploads Upload specified file to the specified URL nggdownloads Download content from the specified URLs and save to specified file nggfilesystem Dump file structure of Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year . FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information .


the C : path , save it to the file in json format and zip it nggstart_screen nggstop_screen Enable/disable screenshot module . The SDK , named SWAnalytics is integrated into seemingly innocent Android applications published on major 3rd party Chinese app stores such as Tencent MyApp , Wandoujia , Huawei App Store , and Xiaomi App Store . The group has been active since at least 2008 and has targeted the restaurant , gaming , and hotel industries .


When enabled , it makes a screenshot every 25 seconds nggstart_key nggstop_key Enable/disable keylogging module nggstart_rec nggstop_rec Enable/disable surrounding sounds recording module ngg_status Send components status to the C & C socket * any other * Execute received command via Python ’ s subprocess.Popen ( ) , output result will be sent to the C & C socket . After app installation , whenever SWAnalytics senses victims opening up infected applications or rebooting their phones , it silently uploads their entire contacts list to Hangzhou Shun Wang Technologies controlled servers . The group is made up of actors who likely speak Russian .


All modules set hidden attributes to their files : Module Paths Exfiltrated data format msconf.exe % APPDATA % /myupd/gen/ % Y % m % d- % H % M % S_filesystem.zip ( file structure dump ) system.exe % APPDATA % /myupd/aud/ % d % m % Y % H % M % S.wav ( surrounding sounds ) update.exe % APPDATA % /myupd_tmp/txt/ % APPDATA % /myupd/txt/ % Y % m In theory , Shun Wang Technologies could have collected a third of China’s population names and contact numbers if not more . FIN6 : ITG08 .


% d- % H % M % S.txt ( keylogging ) wow.exe % APPDATA % /myupd/scr/ % Y % m % d- % H % M % S.jpg ( screenshots ) skype_sync2.exe % APPDATA % /myupd_tmp/skype/ % APPDATA % /myupd/skype/ yyyyMMddHHmmss_in.mp3 yyyyMMddHHmmss_out.mp3 ( skype calls records ) Moreover , we found one module written With no clear declaration of usage from Shun Wang , nor proper regulatory supervision , such data could circulate into underground markets for further exploit , ranging from rogue marketing , targeted telephone scams or even friend referral program abuse during November’s Single’s Day and December’s Asian online shopping fest . FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces .


in .Net – skype_sync2.exe . This paper will cover the discovery of this campaign , dubbed ‘Operation Sheep’ , and an analysis of SWAnalytics . This group has aggressively targeted and compromised point of sale ( PoS ) systems in the hospitality and retail sectors .


The main purpose of this module is to exfiltrate Skype call recordings . In mid-September , an app named ‘Network Speed Master’ stood out on our radar with its rather unusual behavior patterns . Leviathan : TEMP.Jumper , APT40 , TEMP.Periscope .


Just like the previous modules , it contains multiple strings in Italian . This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge . Leviathan is a cyber espionage group that has been active since at least 2013 .


After launch , it downloads a codec for MP3 encoding directly from the C & C server : http : //54.67.109.199/skype_resource/libmp3lame.dll The skype_sync2.exe module has a compilation timestamp – Feb 06 2017 and the following PDB string : \\vmware-host\Shared Folders\dati\Backup\Projects\REcodin_2\REcodin_2\obj\x86\Release\REcodin_2.pdb network.exe is a It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in . The group generally targets defense and government organizations , but has also targeted a range of industries including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities in the United States , Western Europe , and along the South China Sea .


module for submitting all exfiltrated data to the server . With default settings , SWAnalytics will scan through an Android device’s external storage , looking for directory tencent/MobileQQ/WebViewCheck” . Lotus Blossom : DRAGONFISH , Spring Dragon .


In the observed version of the implant it doesn ’ t have an interface to work with the skype_sync2.exe module . From our first malicious sample encounter back in mid-September until now , we have observed 12 infected applications , the majority of which are in the system utility category . Lotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia .


network.exe submitting to the server code snippet Code similarities We found some code similarities between the implant for Windows and other public accessible projects . By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device . Machete : El Machete .


https : //github.com/El3ct71k/Keylogger/ It appears the developers have copied the functional part of the keylogger module from this project . Operation Sheep is the first campaign we have observed in the wild that abuses similar concept since our MitD publication . Machete is a group that has been active since at least 2010 , targeting high-profile government entities in Latin American countries .


update.exe module and Keylogger by ‘ El3ct71k ’ code comparison Xenotix Python Keylogger including specified mutex ‘ mutex_var_xboz ’ . To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control . admin@338 is a China based cyber threat group .


update.exe module and Xenotix Python Keylogger code comparison ‘ addStartup ’ method from msconf.exe module ‘ addStartup ’ method from Xenotix Python Keylogger Distribution We found several landing pages that spread the Android implants . Whenever users reboot their device or open up Network Speed Master , SWAnalytics will fetch the latest configuration file from http[:]//mbl[.]shunwang[.]com/cfg/config[.]json” . It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial , economic , and trade policy , typically using publicly available RATs such as PoisonIvy , as well as some non-public backdoors .


Malicious URL Referrer Dates http : //217.194.13.133/tre/internet/Configuratore_3.apk http : //217.194.13.133/tre/internet/ 2015-02-04 to present time http : //217.194.13.133/appPro_AC.apk – 2015-07-01 http : //217.194.13.133/190/configurazione/vodafone/smartphone/VODAFONE % 20Configuratore % 20v5_4_2.apk http : //217.194.13.133/190/configurazione/vodafone/smartphone/index.html In order to understand SWAnalytics’ impact , we turned to public download volume data available on Chandashi , one of the app store optimization vendors specialized in Chinese mobile application markets . APT1 : Comment Crew , Comment Group , Comment Panda .


2015-01-20 to present time http : //217.194.13.133/190/configurazione/vodafone/smartphone/Vodafone % 20Configuratore.apk http : //217.194.13.133/190/configurazione/vodafone/smartphone/index.html currently active http : //vodafoneinfinity.sytes.net/tim/internet/Configuratore_TIM.apk http : //vodafoneinfinity.sytes.net/tim/internet/ 2015-03-04 http : //vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/VODAFONE Data points span from September 2018 to January 2019 where we observed over 17 million downloads in just five months . APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People ’s Liberation Army ( PLA ) General Staff Department ’s ( GSD ) 3rd Department , commonly known by its Military Unit Cover Designator ( MUCD ) as Unit 61398 .


% 20Configuratore % 20v5_4_2.apk http : //vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/ 2015-01-14 http : //windupdate.serveftp.com/wind/LTE/WIND % 20Configuratore % 20v5_4_2.apk http : //windupdate.serveftp.com/wind/LTE/ 2015-03-31 http : //119.network/lte/Internet-TIM-4G-LTE.apk http : //119.network/lte/download.html In China alone , we have seen underground market sheep shavers” ported SMS rogue marketing strategy to spread Alipay Red Packet referral URL links . APT12 : IXESHE , DynCalc , Numbered Panda , DNSCALC .


2015-02-04 2015-07-20 http : //119.network/lte/Configuratore_TIM.apk 2015-07-08 Many of these domains are outdated , but almost all ( except one – appPro_AC.apk ) samples located on the 217.194.13.133 server are still accessible . In Operation Sheep’s case , Shun Wang likely harvests end user contact lists without application developer acknowledgement . APT12 is a threat group that has been attributed to China .


All the observed landing pages mimic the mobile operators ’ web pages through their domain name and web page content as well . According to Cheetah Mobile’s follow-up investigation , fraudulent behaviors came from two 3rd party SDKs Batmobi , Duapps integrated inside Cheetah SDK . The group has targeted a variety of victims including but not limited to media outlets , high-tech companies , and multiple governments .


Further research of the attacker ’ s infrastructure revealed more related mimicking domains . It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns . The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


Unfortunately , for now we can ’ t say in what environment these landing pages were used in the wild , but according to all the information at our dsiposal , we can assume that they are perfect for exploitation using malicious redirects or man-in-the-middle attacks . Webinjects targeting Japan , a country we haven’t seen targeted by Panda Banker before . The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China .


For example , this could be when the victim ’ s device connects to a Wi-Fi access point that is infected or controlled by the attackers . Japan is no stranger to banking malware . Multiple China-based cyber threat groups have targeted international media organizations in the past .


Artifacts During the research , we found plenty of traces of the developers and those doing the maintaining . Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware . The admin@338 has targeted international media organizations in the past .


As already stated in the ‘ malware features ’ part , there are multiple giveaways in the code . This post was our first analysis of the first Panda Banker campaign that we’ve seen to target financial institutions in Japan . In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


Here are just some of them : ngglobal – FirebaseCloudMessaging topic name Issuer : CN = negg – from several certificates negg.ddns [ . Operation Pawn Storm is an active economic and political cyber-espionage operation that targets a wide range of entities , like the military , governments , defense industries , and the media . In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


] net , negg1.ddns [ . We believe the iOS malware gets installed on already compromised systems , and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems . In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations .


] net , negg2.ddns [ . We found two malicious iOS applications in Operation Pawn Storm . The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


] net – C & C servers NG SuperShell – string from the reverse shell payload ngg – prefix in commands names of the implant for Windows Signature with specific issuer Whois records and IP relationships provide many interesting insights as well . One is called XAgent detected as IOS_XAGENT.A and the other one uses the name of a legitimate iOS game , MadCap detected as IOS_ XAGENT.B . Once the LOWBALL malware calls back to the Dropbox account , the admin@338 will create a file called upload.bat which contains commands to be executed on the compromised computer .


There are a lot of other ‘ Negg ’ mentions in Whois records and references to it . The obvious goal of the SEDNIT-related spyware is to steal personal data , record audio , make screenshots , and send them to a remote command-and-control (C&C) server . We observed the admin@338 upload a second stage malware , known as BUBBLEWRAP ( also known as Backdoor.APT.FakeWinHTTPHelper ) to their Dropbox account along with the following command .


For example : Conclusions The Skygofree Android implant is one of the most powerful spyware tools that we have ever seen for this platform . Madcap” is similar to the XAgent malware , but the former is focused on recording audio . We have previously observed the admin@338 group use BUBBLEWRAP .


As a result of the long-term development process , there are multiple , exceptional capabilities : usage of multiple exploits for gaining root privileges , a complex payload structure , never-before-seen surveillance features such as recording surrounding audio in specified locations . To learn more about this campaign , you may refer to our report , Operation Pawn Storm Using Decoys to Evade Detection . The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets .


Given the many artifacts we discovered in the malware code , as well as infrastructure analysis , we are pretty confident that the developer of the Skygofree implants is an Italian IT company that works on surveillance solutions , just like HackingTeam . Additionally , we discovered a new DNS hijacking technique that we assess with moderate confidence is connected to the actors behind Sea Turtle . The admin@338 linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


HenBox : The Chickens Come Home to Roost March 13 , 2018 at 5:00 AM Unit 42 recently discovered a new Android malware family we named “ HenBox ” masquerading as a variety of legitimate Android apps . Talos now has moderate confidence that the threat actors behind Sea Turtle have been using another DNS hijacking technique . An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


We chose the name “ HenBox ” based on metadata found in most of the malicious apps such as package names and signer detail . This technique was also observed against a government organizations in the Middle East and North African region . The group targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


HenBox masquerades as apps such as VPN and Android system apps and often installs legitimate versions of these apps along with HenBox to trick users into thinking they downloaded the legitimate app . Cisco telemetry confirmed that the actors behind Sea Turtle maintained access to the ICS-Forth network from an operational command and control (C2) node . The agroup targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


While some of the legitimate apps HenBox use as decoys can be found on Google Play , HenBox apps themselves have only been found on third-party ( non-Google Play ) app stores . Our telemetry indicates that the actors maintained access in the ICS-Forth network through at least April 24 , five days after the statement was publicly released . The admin@338 , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


HenBox appears to primarily target the Uyghurs – a minority Turkic ethnic group that is primarily Muslim and lives mainly in the Xinjiang Uyghur Autonomous Region in North West China . This full-blown spying framework consists of two packages named ‘Tokyo’ and ‘Yokohama’ . The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


It also targets devices made by Chinese manufacturer Xiaomi and those running MIUI , an operating system based on Google Android made by Xiaomi . Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue . In August 2013 , FireEye reported that admin@338 had been using the Poison Ivy RAT in its operations .


Smartphones are the dominant form of internet access in the region and Xinjiang was recently above the national average of internet users in China . The first confirmed date when TajMahal samples were seen on a victim’s machine is August 2014 . In March 2014 , the admin@338 leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank .


The result is a large online population who have been the subject of numerous cyber-attacks in the past . More details about TajMahal are available to customers of the Kaspersky Intelligence Reporting service (contact intelreports@kaspersky.com) . In March 2014 , the group leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank .


Once installed , HenBox steals information from the devices from a myriad of sources , including many mainstream chat , communication , and social media apps . The dropper first appeared in mid-July , suggesting that this APT activity is potentially ongoing , with Turla actively targeting G20 participants and/or those with interest in the G20 , including member nations , journalists , and policymakers . According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


The stolen information includes personal and device information . Turla is a well-documented , long operating APT group that is widely believed to be a Russian state-sponsored organization . According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


Of note , in addition to tracking the compromised device ’ s location , HenBox also harvests all outgoing phone numbers with an “ 86 ” prefix , which is the country code for the People ’ s Republic of China ( PRC ) . Turla is perhaps most notoriously suspected as responsible for the breach of the United States Central Command in 2008 . The admin@338 's Dropbox accounts have also been found to contain a different backdoor dubbed BUBBLEWRAP .


It can also access the phone ’ s cameras and microphone . More recently Turla was accused of breaching RUAG , a Swiss technology company , in a public report published by GovCERT.ch . Researchers have pointed out that it is not uncommon for China-based threat groups to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement .


HenBox has ties to infrastructure used in targeted attacks with a focus on politics in South East Asia . The delivery of KopiLuwak in this instance is currently unknown as the MSIL dropper has only been observed by Proofpoint researchers on a public malware repository . Researchers have pointed out that it is not uncommon for admin@338 to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement .


These attackers have used additional malware families in previous activity dating to at least 2015 that include PlugX , Zupdax , 9002 , and Poison Ivy . Assuming this variant of KopiLuwak has been observed in the wild , there are a number of ways it may have been delivered including some of Turla’s previous attack methods such as spear phishing or via a watering hole . This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose .


This also aligns with HenBox ’ s timeline , as in total we have identified almost 200 HenBox samples , with the oldest dating to 2015 . This could include diplomats , experts in the areas of interest related to the Digital Economy Task Force , or possibly even journalists . The attackers used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


Most of the samples we found date from the last half of 2017 , fewer samples date from 2016 , and a handful date back to 2015 . Turla's goal could include diplomats , experts in the areas of interest related to the Digital Economy Task Force , or possibly even journalists . The admin@338 used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


In 2018 , we have already observed a small but consistent number of samples . The earliest step in any possible attack(s) involving this variant of KopiLuwak of which Proofpoint researchers are currently aware begin with the MSIL dropper . FireEye analysts documented the admin@338 group 's activities in a previous paper titled Poison Ivy : Assessing Damage and Extracting Intelligence paper .


We believe this indicates a fairly sustained campaign that has gained momentum over recent months . The basic chain of events upon execution of the MSIL dropper include dropping and executing both a PDF decoy and a Javascript (JS) dropper . The spear-phishing campaign against Asian entities isn't isolated , the admin@338 also started another attack against the US-based think tank on 14th March .


HenBox Enters the Uyghur App Store In May 2016 , a HenBox app was downloaded from uyghurapps [ . As explained in further detail below , the JS dropper ultimately installs a JS decryptor onto an infected machine that will then finally decrypt and execute the actual KopiLuwak backdoor in memory only . Our analysis has led us to conclude that APT1 is likely government-sponsored and one of the most persistent of China 's cyber threat actors .


] net . As Proofpoint has not yet observed this attack in the wild it is likely that there is an additional component that leads to the execution of the MSIL payload . FireEye said it has tracked admin@338 's activity since 2013 and the group has largely targeted organizations involved in financial , economic , and trade policy .


Specifically , the app was an Android Package ( APK ) file that will be discussed in more detail shortly . The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine . The simplest conclusion based on these facts is that APT1 is operating in China , and most likely in Shanghai .


The domain name , language of the site and app content hosted suggest this site is a third-party app store for whom the intended users are the Uyghurs . Despite the added capabilities , we still agree with Kaspersky that this backdoor is likely used as an initial reconnaissance tool and would probably be used as a staging point to deploy one of Turla’s more fully featured implants . These data sets show that APT1 is either operating in China during normal Chinese business hours or that APT1 is intentionally going to painstaking lengths to look like they are .


Such app stores are so-called because they are not officially supported by Android , nor are they provided by Google , unlike the Play Store . Turla is a complex cyberattack platform focused predominantly on diplomatic and government-related targets , particularly in the Middle East , Central and Far East Asia , Europe , North and South America and former Soviet bloc nations . APT1 has used and steadily modified BISCUIT since as early as 2007 and continues to use it presently .


Third-party app stores are ubiquitous in China for a number of reasons including : evermore powerful Chinese Original Equipment Manufacturers ( OEM ) , a lack of an official Chinese Google Play app store , and a growing smartphone market . We didn’t choose to name it after a vegetable; the .NET malware developers named it Topinambour themselves . While APT1 intruders occasionally use publicly available backdoors such as Poison Ivy and Gh0st RAT .


The HenBox app downloaded in May 2016 was masquerading as the DroidVPN app . The role of the .NET module is to deliver the known KopiLuwak JavaScript Trojan . Given the mission , resourcing , and location of PLA Unit 61398 , we conclude that PLA Unit 61398 is APT1 .


At the time of writing , the content served at the given URL on uyghurapps [ . Moreover , Turla now also has a heavily obfuscated PowerShell Trojan that is similar to KopiLuwak . APT1 were a highly prolific cyber-attack group operating out of China .


] net , is now a legitimate version of the DroidVPN app , and looks as shown in Figure 1 below . RocketMan!” (probably a reference to Donald Trump’s nickname for Kim Jong Un) and MiamiBeach” serve as the first beacon messages from the victim to the control server . APT1 is a China-based cyber-espionage group , active since mid-2006 .


henbox_2 Figure 1 Uyghurapps [ . These could be tools to circumvent internet censorship , such as Softether VPN 4.12” and psiphon3” , or Microsoft Office activators” . APT12 's targets are consistent with larger People 's Republic of China ( PRC ) goals .


] net app store showing the current DroidVPN app Virtual Private Network ( VPN ) tools allow connections to remote private networks , increasing the security and privacy of the user ’ s communications . These campaign-related VPSs are located in South Africa . Since the release of the Arbor blog post , FireEye has observed APT12 use a modified backdoor that we call HIGHTIDE .


According to the DroidVPN app description , it “ helps bypass regional internet restrictions , web filtering and firewalls by tunneling traffic over ICMP. ” Some features may require devices to be rooted to function and according to some 3rd party app stores , unconditional rooting is required , which has additional security implications for the device . The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems . However , the malware shared several traits with the RIPTIDE and HIGHTIDE backdoor that we have attributed to APT12 .


We have not been able to ascertain how the DroidVPN app on the uyghurapps [ . The PowerShell version of the Trojan also has the ability to get screenshots . From October 2012 to May 2014 , FireEye observed APT12 utilizing RIPTIDE , that communicates via HTTP to a hard-coded command and control ( C2 ) server .


] net app store was replaced with the malicious HenBox app ; however , some indicators point to the server running an outdated version of Apache Web Server on a Windows 32-Bit operating system . The Trojan is quite similar to the .NET RocketMan Trojan and can handle the same commands; additionally , it includes the #screen” command to take a screenshot . Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 .


In light of this , we believe an attack against unpatched vulnerabilities is a reasonable conjecture for how the server was compromised . The usage of KopiLuwak , a well-known and exclusive artefact previously used by the Turla group , makes us attribute this campaign to this actor with high confidence . FireEye believes the change from RIPTIDE to HIGHTIDE represents a temporary tool shift to decrease malware detection while APT12 developed a completely new malware toolset .


The HenBox app downloaded in May 2016 , as described in Table 1 below , masquerades as a legitimate version of the DroidVPN app by using the same app name “ DroidVPN ” and the same iconography used when displaying the app in Android ’ s launcher view , as highlighted in Figure 2 below Table 1 . Winnti's mode of operation: to collect information on the organizational charts of companies , on cooperating departments , on the IT systems of individual business units , and on trade secrets , obviously . They have largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


APK SHA256 Size ( bytes ) First Seen App Package name App name 0589bed1e3b3d6234c30061be3be1cc6685d786ab3a892a8d4dae8e2d7ed92f7 2,740,860 May 2016 com.android.henbox DroidVPN Table 1 Details of the HenBox DroidVPN app on the uyghurapps [ . Hackers usually take precautions , which experts refer to as Opsec . A China-based cyber threat group , which FireEye tracks as an uncategorized advanced persistent threat ( APT ) group and other researchers refer to as admin@338 , may have conducted the activity .


] net app store henbox_3 Figure 2 HenBox app installed , purporting to be DroidVPN Depending on the language setting on the device , and for this particular variant of HenBox , the installed HenBox app may have the name “ Backup ” but uses the same DroidVPN logo . The Winnti group’s Opsec was dismal to say the least . The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


Other variants use other names and logos , as described later . This mode of operation is typical of many hacker groups—and especially of Winnti . About four months after The New York Times publicized an attack on its network , the APT12 behind the intrusion deployed updated versions of their Backdoor.APT.Aumlib and Backdoor.APT.Ixeshe malware families .


Given the DroidVPN look and feel being used by this variant of HenBox , it ’ s highly likely the uyghurapps [ . They are a very , very persistent group , ” says Costin Raiu , who has been watching Winnti since 2011 . With this in mind , this week we are providing some indicators for a China based adversary who we crypt as " NUMBERED PANDA " Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc .


] net page for DroidVPN remained identical when serving either HenBox or DroidVPN apps , just that the legitimate APK file had been replaced with HenBox for an unknown period of time . Raiu and his team have followed the digital tracks left behind by some of the Winnti hackers . Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc .


In addition to the look and feel of DroidVPN , this HenBox variant also contained a legitimate DroidVPN app within its APK package as an asset , which could be compared to a resource item within a Windows Portable Executable ( PE ) file . One government official puts it very matter-of-factly: Winnti is very specific to Germany . The new campaigns mark the first significant stirrings from the APT12 since it went silent in January in the wake of a detailed expose of the group and its exploits — and a retooling of what security researchers believe is a massive spying operation based in China .


Once the HenBox app is installed and launched , it launches an install process for the embedded app as a decoy to other malicious behaviors occurring in the background , and to satisfy the victim with the app they were requesting , assuming they requested to download a particular app , such as DroidVPN . By 2014 , the Winnti malware code was no longer limited to game manufacturers . Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries .


The version of the legitimate DroidVPN embedded inside this HenBox variant is the same version of DroidVPN available for download from uyghurapps [ . Winnti is targeting high-tech companies as well as chemical and pharmaceutical companies . Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries .


] net , at the time of writing . Winnti is attacking companies in Japan , France , the U.S. and Germany . On November 26 , 2015 , a suspected China-based APT16 sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


It ’ s worth noting , newer versions of the DroidVPN app are available on Google Play , as well as in some other third-party app stores , which could indicate uyghurapps [ . The Winnti hackers broke into Henkel’s network in 2014 . On November 26 , 2015 , a suspected China-based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


] net is not awfully well maintained or updated to the latest apps available . Henkel confirms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions . While attribution of the first two spear phishing attacks is still uncertain , we attribute the second December phishing campaign to the China-based APT group that we refer to as APT16 .


At the time of writing , to our knowledge no other third-party app stores , nor the official Google Play store , were or are hosting this malicious HenBox variant masquerading as DroidVPN . Far from attacking Henkel and the other companies arbitrarily , Winnti takes a highly strategic approach . APT16 actors sent spear phishing emails to two Taiwanese media organizations .


The Right App at the Right Time The malicious HenBox and embedded DroidVPN app combination is one instance of the type of legitimate apps the attackers choose to mimic to compromise their victims . The hackers behind Winnti have also set their sights on Japan’s biggest chemical company , Shin-Etsu Chemical . On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website .


These threat actors frequently offer malicious apps purporting to be legitimate apps that are broadly used or important to a targeted population . In the case of another Japanese company , Sumitomo Electric , Winnti apparently penetrated their networks during the summer of 2016 . It is possible , although not confirmed , that APT16 was also responsible for targeting this government agency , given both the timeframe and the use of the same n-day to eventually deploy the ELMER backdoor .


It ’ s worth noting however , about one-third of the HenBox apps contained embedded APK objects that did not refer to legitimate apps . Winnti hackers also penetrated the BASF and Siemens networks . Despite the differing sponsorship , penetration of Hong Kong and Taiwan-based media organizations continues to be a priority for China-based APT16 .


Some were only 3 bytes long , containing strings such as “ ddd ” and “ 333 ” , or were otherwise corrupted . Thanks to this tool , we found out back in March 2019 that the Bayer pharmaceutical group had been hacked by Winnti . The suspected APT16 targeting of the Taiwanese government agency – in addition to the Taiwanese media organizations – further supports this possibility .


Beyond the previously mentioned DroidVPN example , other viable embedded apps we found include apps currently available on Google Play , as well as many third-party app stores . At Gameforge , the Winnti hackers had already been removed from the networks when a staff member noticed a Windows start screen with Chinese characters . APT17 was embedding the encoded CnC IP address for the BLACKCOFFEE malware in legitimate Microsoft TechNet profiles pages and forum threads , a method some in the information security community call a " dead drop resolver " .


Table 2 below lists some of these apps with their respective metadata . To witnesses , the spy appears to be running a program showing videos (e.g VLC) , presenting slides (Prezi) , playing a computer game (Breakout2 , 2048) or even running a fake virus scanner . APT17 , also known as DeputyDog , is a China-based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


Sample 1 marks the first HenBox sample we saw embedding a legitimate app within its assets to be dropped and installed on the victim device as a decoy . From the time of file creation , the attacker started working at least as early as July 2018 . FireEye has monitored APT17 's use of BLACKCOFFEE variants since 2013 to masquerade malicious communication as normal web traffic by disguising the CnC communication as queries to web search engines .


The legitimate app in question was a Uyghur language keyboard app targeted at native speakers of the Uyghur language and their smartphones . The link to feeds.rapidfeeds.com left in its XML configuration file was also mentioned by Kaspersky’s report in the reference section , which confirms that the APT-C-09 group keeps updating its C2 configuration channel and the recent one reserves some past features . The use of BLACKCOFFEE demonstrates APT17 's evolving use of public websites to hide in plain sight .


Sample 2 , has the package name cn.android.setting masquerading as Android ’ s Settings app , which has a similar package name ( com.android.settings ) . For example , Donot and Bitter disguised as Kashmiri Voice to attack Pakistan , Transparent Tribe attacked India with decoy document regarding terrorist attacks in Kashmir . TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology .


This variant of HenBox also used the common green Android figure as the app logo and was named 设置 ( “ Backup ” in English ) . Considering APT-C-09 , Bitter and Donot have carried out targeted attacks against China , we must take actions in advance and keep a close eye on their recent activities . The APT18 then installed the hcdLoader RAT , which installs as a Windows service and provides command line access to the compromised system .


This variant ’ s app name , along with many others , is written in Chinese and describes the app as a backup tool . APT41 espionage operations against the healthcare , high-tech , and telecommunications sectors include establishing and maintaining strategic access , and through mid-2015 , the theft of intellectual property . The malware used by the Wekby group has ties to the HTTPBrowser malware family , and uses DNS requests as a command and control mechanism .


Please see the IOCs section for all app and package name combinations . FireEye Threat Intelligence assesses with high confidence that APT41 carries out an array of financially motivated intrusions , particularly against the video game industry , including stealing source code and digital certificates , virtual currency manipulation , and attempting to deploy ransomware . These URIs result in the download of an installer , which creates a PE of the malware typically known as HTTPBrowser , but called Token Control by the Wekby group themselves ( based upon the PDB strings found within many of the samples ) .


Interestingly , the embedded app in sample 2 is not a version of the Android Settings app but instead the “ Amaq Agency ” app , which reports on ISIS related news . APT41 has executed multiple software supply chain compromises , gaining access to software companies to inject malicious code into legitimate files before distributing updates . APT19 seemed to be going after defense sector firms , Chinese dissident groups and political , financial , pharmaceutical and energy sectors that could benefit the Chinese economy .


Reports indicate fake versions of the Amaq app exist , likely in order to spy on those that use it . APT41 is unique among tracked China-based actors in that it leverages non-public malware typically reserved for espionage operations in what appears to be activity that falls outside the scope of state-sponsored missions . APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy .


A month after observing sample 2 , we obtained another which used the same package name as sample 2 ( cn.android.setting ) . Based on early observed activity , consistent behavior , and APT41's unusual focus on the video game industry , we believe the group's cyber crime activities are most likely motivated by personal financial gain or hobbyist interests . FANCY BEAR ( also known as Sofacy or APT28 ) is a separate Russian-based threat actor , which has been active since mid 2000s , and has been responsible for targeted intrusion campaigns against the Aerospace , Defense , Energy , Government and Media sectors .


However , this time the app name for both HenBox and the embedded app were identical : Islamawazi . APT41 campaigns include most of the incidents previously attributed in FireEye Threat Intelligence reporting to GREF Team and a number of additional clusters that were previously unnamed . APT28 malware , in particular the family of modular backdoors that we call CHOPSTICK , indicates a formal code development environment .


Islamawazi is also known as the Turkistan Islamic Party or “ TIP ” . Activity traces back to 2012 when individual members of APT41 conducted primarily financially motivated operations focused on the video game industry before expanding into likely statesponsored activity . However , three themes in APT28 's targeting clearly reflects LOCs of specific interest to an Eastern European government , most likely the Russian government .


This organization was formerly known as the East Turkestan Islamic Party and is purported to be an Islamic extremist separatist organization founded by Uyghur jihadists . Learning to access video game production environments enabled APT41 to develop the tactics , techniques , and procedures (TTPs) that were later leveraged against software companies to inject malicious code into software updates . We identified three themes in APT28 's lures and registered domains , which together are particularly relevant to the Russian government .


The embedded app appears to be a media player . APT41 has targeted organizations in 14 countries (and Hong Kong) over seven years , including: France , India , Italy , Japan , Myanmar , the Netherlands , Singapore , South Korea , South Africa , Switzerland , Thailand , Turkey , the United Kingdom , and the United States (Figure 1) . Georgian military security issues , particularly with regard to U.S. cooperation and NATO , provide a strong incentive for Russian state-sponsored threat actors to steal information that sheds light on these topics .


These examples , together with the HenBox app placed on a very specific third-party app store , point clearly to at least some of the intended targets of these malicious apps being Uyghurs , specifically those with interest in or association with terrorist groups . APT41 espionage operations against entities in these countries follow targeting of verticals consistent with Chinese national policy priorities . Instead , we observed the two Russian espionage groups compromise the same systems and engage separately in the theft of identical credentials .


These threat actors appear to be choosing the right apps – those that could be popular with locals in the region , at the right time – while tensions grow in this region of China , to ensure a good victim install-base . We believe that like other Chinese espionage operators , APT41 has moved toward strategic intelligence collection and establishing access , but away from direct intellectual property theft . APT28 's malware settings suggest that the developers have done the majority of their work in a Russian language build environment during Russian business hours , which suggests that the Russian government is APT28 's sponsor .


HenBox Roosts HenBox has evolved over the past three years , and of the almost two hundred HenBox apps in AutoFocus , the vast majority contain several native libraries as well as other components in order to achieve their objective . In 2014 , APT41 was observed carrying out espionage campaigns concurrently with financially motivated intrusions , demonstrating that they could balance different objectives simultaneously . We believe that APT28 's targeting of the MOD aligns with Russian threat perceptions .


Most components are obfuscated in some way , whether it be simple XOR with a single-byte key , or through the use of ZIP or Zlib compression wrapped with RC4 encryption . Since 2017 , APT41's activities have included a series of supply chain compromises . We assess that APT28 is most likely sponsored by the Russian government .


These components are responsible for a myriad of functions including handling decryption , network communications , gaining super-user privileges , monitoring system logs , loading additional Dalvik code files , tracking the device location and more . The group also targeted companies involved in producing motherboards , processors , and server solutions for enterprises . Given the available data , we assess that APT28 's work is sponsored by the Russian government .


The remainder of this section describes at a high-level what HenBox is capable of , and how it operates . Since 2013 , APT41 has targeted organizations involved in the research , development , and sale of computer components used for machine-learning , autonomous vehicles , medical imaging , and the consumer market . The targets were similar to a 2015 TG-4127 campaign — individuals in Russia and the former Soviet states , current and former military and government personnel in the U.S. and Europe , individuals working in the defense and government supply chain , and authors and journalists — but also included email accounts linked to the November 2016 United States presidential election .


The description is based on analysis of the sample described in Table 3 below , which was of interest given its C2 domain mefound [ . In a 2014 compromise , APT41 targeted a European conglomerate and specifically focused on systems physically located in China . The targets of TG-4127 include military , government and defense sectors .


] com overlaps with PlugX , Zupdax , and Poison Ivy malware families discussed in more detail later . In spring 2015 , APT41 targeted information related to two entities undergoing a merger announced the previous year . Some of APT28 's more commonly used tools are the SOURFACE downloader , its second stage backdoor EVILTOSS , and a modular family of implants that we call CHOPSTICK .


SHA256 Package Name App Name a6c7351b09a733a1b3ff8a0901c5bde fdc3b566bfcedcdf5a338c3a97c9f249b com.android.henbox 备份 ( Backup ) Table 3 HenBox variant used in description Once this variant of HenBox is installed on the victim ’ s device , the app can be executed in two different ways : One method for executing HenBox is for the victim to launch the malicious app ( named “ Backup ” , in Since 2017 , APT41 has consistently targeted telecommunications companies , possibly a crucial first step to establish a foothold in targeting a particular region . While TG-4127 continues to primarily threaten organizations and individuals operating in Russia and former Soviet states , this campaign illustrates its willingness to expand its scope to other targets that have intelligence of interest to the Russian government .


this instance ) from the launcher view on their device , as shown in Figure 3 below . Targeted telecom companies spanned several countries , and recently identified intrusions were concentrated in countries where we had not identified any prior APT41 activity . CTU researchers assess with moderate confidence that the group is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government .


This runs code in the onCreate ( ) method of the app ’ s MainActivity class , which in effect is the program ’ s entry point . In July and August 2016 , APT41 sent spear-phishing emails to Hong Kong media organizations known for pro-democracy editorial content . This intelligence has been critical to protecting and informing our clients , exposing this threat , and strengthening our confidence in attributing APT28 to the Russian government .


This process is defined in the app ’ s AndroidManifest.xml config file , as shown in the following snippet . This was the first instance we have observed of APT41 targeting pro-democracy groups in Hong Kong . Our visibility into the operations of APT28 - a group we believe the Russian government sponsors - has given us insight into some of the government 's targets , as well as its objectives and the activities designed to further them .


Doing so executes code checking if the device is manufactured by Xiaomi , or if Xiaomi ’ s fork of Android is running on the device . APT41 frequently leverages timely news stories as the lure content in their spear-phishing emails , although social engineering content does not always correlate with targeted users or organizations . Since at least 2007 , APT28 has engaged in extensive operations in support of Russian strategic interests .


Under these conditions , the app continues executing and the intent of targeting Xiaomi devices and users could be inferred , however poorly written code results in execution in more environments than perhaps intended ; further checks are made to ascertain whether the app is running on an emulator , perhaps to evade researcher analysis environments . In 2015 , APT41 targeted a Japanese media organization with a lure document (Figure 3) titled 中東呼吸器症候 群(MERS)の予防 , ” which translates to Prevention of Middle East Respiratory Syndrome (MERS) . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


Assuming these checks pass , one of the main ELF libraries is loaded that orchestrates other components and provides functionality to the app ’ s Dalvik code through the Java Native Interface ( JNI ) . APT41 activity aimed at medical device companies and pharmaceuticals is demonstrative of the group's capacity to collect sensitive and highly valuable intellectual property (IP) , although we have not observed evidence of IP theft since late 2015 . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


HenBox checks whether this execution is its first by using Android ’ s shared preferences feature to persist XML key-value pair data . Unlike other observed Chinese espionage operators , APT41 conducts explicit financially motivated activity , which has included the use of tools that are otherwise exclusively used in campaigns supporting state interests . Over the past two years , Russia appears to have increasingly leveraged APT28 to conduct information operations commensurate with broader strategic military doctrine .


If it is the first execution , and if the app ’ s path does not contain “ /system/app ” ( i.e . Although APT41 initially targeted the parent company , 30 percent of the victimized hosts were related to a subsidiary specialized in manufacturing medical devices . After compromising a victim organization , APT28 will steal internal data that is then leaked to further political narratives aligned with Russian interests .


HenBox is not running as a system app ) , another ELF library is loaded to aid with executing super-user commands . In 2018 , we observed APT41 target a third healthcare company , although their goals during this compromise were unclear . After compromising a political organization , APT28 will steal internal data .


The second method uses intents , broadcasts , and receivers to execute HenBox code . In June 2018 , APT41 sent spear-phishing emails using an invitation lure to join a decentralized gaming platform linked to a cryptocurrency service (Figure 5) that had positioned itself as a medium of exchange for online games and gambling sites . On December 29 , 2016 , the Department of Homeland Security ( DHS ) and Federal Bureau of Investigation ( FBI ) released a Joint Analysis Report confirming FireEye 's long held public assessment that the Russian government sponsors APT28 .


Providing the app has registered an intent to process particular events from the system , and one of said events occurs , HenBox is effectively brought to life through external stimulus from another app on the system broadcasting a request , or the system itself broadcasting a particular event has occurred . This provides another connection between the targeting of the cryptocurrency organizations and video game targeting . In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations , and characterized APT28 's activity as aligning with the Russian government 's strategic intelligence requirements .


These intents are typically defined statically in the app ’ s AndroidManifest.xml config file ; some HenBox variants register further intents from their code at run-time . In October 2018 , the group compiled an instance of XMRig , a Monero cryptocurrency mining tool , demonstrating a continued interest in cryptocurrency . In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations' , and characterized APT28 's activity as aligning with the Russian government 's strategic intelligence requirements .


Once a matching intent is triggered , the respective Receiver code will be executed , leading to other HenBox behaviors being launched , which are described later . APT41 campaigns focused on the video game sector have largely affected studios and distributors in East and Southeast Asia , although global companies based in the United States have also been targeted . APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


Table 4 below lists the intents that are statically registered in this HenBox variant ’ s AndroidManifest.xml config file , together with a description of what that intent does , and when it would be used . APT41 continuously returns to targeting the video game sector and seems to have matured its campaigns through lessons learned in operations against the industry . Our investigation of APT28 's compromise of WADA 's network , and our observations of the surrounding events reveal how Russia sought to counteract a damaging narrative and delegitimize the institutions leveling criticism .


Depending on the intent triggered , one of two Receivers would be called , in this instance they are called Boot or Time but the name is somewhat immaterial . We believe these operations include broadly malicious activity that can enable further operations , such as targeting game source code and compromising digital certificates , while other activities are explicitly financially motivated , such as abusing in-game currency mechanics . Since releasing our 2014 report , we continue to assess that APT28 is sponsored by the Russian government .


Receiver Intent Name Description BootReceiver android.intent.action.BOOT_COMPLETED System notification that the device has finished booting . In October 2012 , APT41 used captured credentials to compromise a jump server and access a production environment where they deployed a Linux version of PHOTO . In our 2014 report , we identified APT28 as a suspected Russian government-sponsored espionage actor .


android.intent.action.restart A legacy intent used to indicate a system restart . Since at least 2012 , APT41 has repeatedly gained access to game development environments within affected companies , including online multiplayer networks , as well as targeting of production database administrators . For full details , please reference our 2014 report , APT28 : A Window into Russia 's Cyber Espionage Operations .


android.intent.action.SIM_STATE_CHANGED System notification that the SIM card has changed or been removed . APT41 has been observed inserting malicious code into legitimate video game files to distribute malware . The espionage group , which according to the U.S. Department of Homeland Security ( DHS ) and the Federal Bureau of Investigation ( FBI ) is linked to the Russian government , returned to low-key intelligence-gathering operations during 2017 and into 2018 , targeting a range of military and government targets in Europe and South America .


android.intent.action.PACKAGE_INSTALL System notification that the download and eventual installation of an app package is happening ( this is deprecated ) android.intent.action.PACKAGE_ADDED System notification that a new app package has been installed on the device , including the name of said package . In 2018 , the group inserted CRACKSHOT malware into game files that were signed with legitimate codesigning certificates , most likely indicating access to the production environment , which facilitated a supply chain compromise . The APT28 , which is linked to the Russian government , returned to low-key intelligence-gathering operations during 2017 and into 2018 , targeting a range of military and government targets in Europe and South America .


com.xiaomi.smarthome.receive_alarm Received notifications from Xiaomi ’ s smart home IoT devices . We have also observed APT41 limitedly deploy rootkits on Linux systems and Master Boot Record (MBR) bootkits , such as ROCKBOOT , on Windows systems to hide their malware and maintain persistence on victim systems . Another attack group , Earworm ( aka Zebrocy ) , has been active since at least May 2016 and is involved in what appears to be intelligence gathering operations against military targets in Europe , Central Asia , and Eastern Asia .


TimeReceiver android.intent.action.ACTION_TIME_CHANGED System notification that the time was set . Selective deployment of ROCKBOOT suggests that APT41 reserves more advanced TTPs and malware only for high-value targets . Several sources consider APT28 a group of CyberMercs based in Russia .


android.intent.action.CONNECTIVITY_CHANGE System notification that a change in network connectivity has occurred , either lost or established . APT41 has blatantly engaged in financially motivated activity targeting the video game industry , including manipulating virtual currencies . The primary targets of APT28 are potential victims in several countries such as Ukraine , Spain , Russia , Romania , the United States and Canada .


Since Android version 7 ( Nougat ) this information is gathered using other means , perhaps inferring the devices used by potential victim run older versions of Android . In a highly unusual case , APT41 attempted to extort a game company by deploying the Encryptor RaaS ransomware . We have reasons to believe that the operators of the APT28 network are either Russian citizens or citizens of a neighboring country that speak Russian .


Table 4 HenBox variant 's Intents and Receivers Most of the intents registered in the AndroidManifest.xml file , or loaded during run-time , are commonly found in malicious Android apps . APT41 is well-known for leveraging compromised digital certificates from video game studios to sign malware . Previous work published by security vendor FireEye in October 2014 suggests the group might be of Russian origin .


What ’ s more interesting , and much less common , is the inclusion of the com.xiaomi.smarthome.receive_alarm intent filter . We suggest that APT41 sought to target in-game currency but found they could not monetize the specific targeted game , so the group resorted to ransomware to attempt to salvage their efforts and profit from the compromise . Finally , the use of recent domestic events and a prominent US military exercise focused on deterring Russian aggression highlight APT28 's ability and interest in exploiting geopolitical events for their operations .


Xiaomi , a privately owned Chinese electronics and software company , is the 5th largest smart phone manufacturer in the world and also manufactures IoT devices for the home . APT41 has also used credentials compromised in previous operations . In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM , JHUHUGIT , AZZY and a few others .


Most devices can be controlled by Xiaomi ’ s “ MiHome ” Android app , which is available on Google Play with between 1,000,000 and 5,000,000 downloads . In 2014 , APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service . In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM ( aka Xagent , aka CHOPSTICK ) , JHUHUGIT ( which is built with code from the Carberp sources ) , AZZY ( aka ADVSTORESHELL , NETUI , EVILTOSS , and spans across 4-5 generations ) and a few others .


Given the nature of connected devices in smart homes , it ’ s highly likely many of these devices , and indeed the controller app itself , communicate with one another sending status notifications , alerts and so on . Although we do not have first-hand evidence of APT41's compromise of TeamViewer , we have observed APT41 use compromised TeamViewer credentials as an entry point at multiple organizations . The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


Such notifications would be received by the MiHome app or any other , such as HenBox , so long as they register their intent to do so . Public reports of supply chain compromises linked to APT41 date back to at least 2014 , and technical evidence associated with these incidents was used to determine a relationship , if any , with APT41 . APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


This could essentially allow for external devices to act as a trigger to execute the malicious HenBox code , or perhaps afford additional data HenBox can collect and exfiltrate . As demonstrated in operations targeting the video game industry , APT41 leverages a variety of TTPs to access production environments where they can inject malicious code into legitimate files . The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


Either method to load HenBox ultimately results in an instance of a service being launched . In March 2017 , suspected Chinese espionage operators targeted CCleaner , a utility that assists in the removal of unwanted files from a computer . Their evolving and modified SPLM , CHOPSTICK , XAgent code is a long-standing part of Sofacy activity , however much of it is changing .


This service hides the app from plain sight and loads another ELF library to gather environmental information about the device , such as running processes and apps , and details about device hardware , primarily through parsing system logs and querying running processes . In July 2017 , APT41 injected malicious code into a software update package maintained by Netsarang and signed it with a legitimate Netsarang certificate in an operation referred to as ShadowPad by Kaspersky . FireEye has moderate confidence that a campaign targeting the hospitality sector is attributed to Russian actor APT28 .


The service continues by loading an ELF , created by Baidu , which is capable of tracking the device location before setting up a monitor to harvest phone numbers associated with outgoing calls for those numbers with a country code “ +86 ” prefix , which relates to the People ’ s Republic of China . Both APT41 and the actors in the CCleaner incident used TeamViewer during initial compromise . APT28 is using novel techniques involving the EternalBlue exploits and the open source tool Responder to spread laterally through networks and likely target travelers .


Further assets are decrypted and deployed , including another Dalvik DEX code file , which has various capabilities including registering itself as the incoming SMS handler for the device to intercept SMS messages , loading another ELF library that includes a version of BusyBox - a package containing various stripped-down Unix tools useful for administering such systems – and , interestingly , is capable of turning off the sound played when the device ’ s cameras take pictures . Supply chain compromises are most likely an extension of APT41's tactics used in gaining access to gaming development environments and to other gaming organizations via third-party service providers . Upon gaining access to the machines connected to corporate and guest Wi-Fi networks , APT28 deployed Responder .