One representative sample Chrysaor app that we analyzed was tailored to devices running Jellybean ( 4.3 ) or earlier . Between August 2 and 4 , the actor sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors . Wait time is chosen randomly in the range 2/3 t to 5/3 . The Winnti group diversified its targets to include enterprises such as those in pharmaceutics and telecommunications .


The following is a review of scope and impact of the Chrysaor app named com.network.android tailored for a Samsung device target , with SHA256 digest : ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5Upon installation , the app uses known framaroot exploits to escalate privileges and break Android 's application sandbox . Between August 2 and 4 , the Leviathan sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors . A string identifying a campaign . Systems are compromised to enable them to then attack other systems .


If the targeted device is not vulnerable to these exploits , then the app attempts to use a superuser binary pre-positioned at /system/csk to elevate privileges . The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period . A semicolon-separated list of executable filenames . COSMICENERGY is the latest example of specialized OT malware capable of causing cyber physical impacts , which are rarely discovered or disclosed .


After escalating privileges , the app immediately protects itself and starts to collect data , by : Installing itself on the /system partition to persist across factory resets Removing Samsung 's system update app ( com.sec.android.fotaclient ) and disabling auto-updates to maintain persistence ( sets Settings.System.SOFTWARE_UPDATE_AUTO_UPDATE to 0 ) Deleting WAP push messages and changing WAP message settings , possibly for anti-forensic purpose . The period between November 2014 and January 2015 marked one of the earlier instances in which Proofpoint observed persistent exploitation attempts by this actor . If any of them are running , the backdoor stops its execution . Identifying suspicious login patterns based on NetScaler logs


Starting content observers and the main task loop to receive remote commands and exfiltrate data The app uses six techniques to collect user data : Repeated commands : use alarms to periodically repeat actions on the device to expose data , including gathering location data . The Leviathan , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 . ESET researchers have identified five versions of the payload : At that time , Symantec observed the attackers breaching Saudi Arabian IT providers in an apparent supply chain attack designed to infect the customers with malware known as Syskit .


Data collectors : dump all existing content on the device into a queue . This actor , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 . Winnti : a045939f 2018-07-11 15:45:57 https://bugcheck.xigncodeservice.com/Common/Lib/Common_bsod.php . The file ’s name consists of six randomly - generated alphanumeric characters .


Data collectors are used in conjunction with repeated commands to collect user data including , SMS settings , SMS messages , Call logs , Browser History , Calendar , Contacts , Emails , and messages from selected messaging apps , including WhatsApp , Twitter , Facebook , Kakoa , Viber , and Skype by making /data/data directories of the apps world readable . The campaign is linked to a group of suspected Chinese cyber espionage actors we have tracked since 2013 , dubbed TEMP.Periscope . Winnti : a260dcf1 2018-07-11 15:45:57 https://bugcheck.xigncodeservice.com/Common/Lib/Common_Include.php . Command - line execution of MicroSCADA “ Scilc.exe ” binary and other native MicroSCADA binaries that may be leveraged to execute unauthorized SCIL program / commands .


Content observers : use Android 's ContentObserver framework to gather changes in SMS , Calendar , Contacts , Cell info , Email , WhatsApp , Facebook , Twitter , Kakao , Viber , and Skype . The Leviathan generally emailed Microsoft Excel documents with malicious macros to US universities with military interests , most frequently related to the Navy . Winnti : dde82093 2018-07-11 15:45:57 https://bugcheck.xigncodeservice.com/Common/Lib/common.php . As we 've discussed recently , there has been huge growth in the ransomware and extortion space , potentially linked to the plethora of leaked builders and source code related to various ransomware cartels .


Screenshots : captures an image of the current screen via the raw frame buffer . The current campaign is a sharp escalation of detected activity since summer 2017 . Winnti : 44260a1d 2018-08-15 10:59:09 https://dump.gxxservice.com/common/up/up_base.php . The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier .


Keylogging : record input events by hooking IPCThreadState : :Transact from /system/lib/libbinder.so , and intercepting android : :parcel with the interface com.android.internal.view.IInputContext . Since early 2018 , FireEye ( including our FireEye as a Service ( FaaS ) , Mandiant Consulting , and iSIGHT Intelligence teams ) has been tracking an ongoing wave of intrusions targeting engineering and maritime entities , especially those connected to South China Sea issues . Winnti : 8272c1f4 2018-11-01 13:16:24 https://nw.infestexe.com/version/last.php . The Platform can look for indicators across file attachments , embedded links , and more and provide inplatform risk scoring .


RoomTap : silently answers a telephone call and stays connected in the background , allowing the caller to hear conversations within the range of the phone 's microphone . Known targets of the Leviathan have been involved in the maritime industry , and research institutes , academic organizations , and private firms in the United States . In the first three variants , the code was not recompiled , but the configuration data was edited in the DLL file itself . Once an actor was able to successfully achieve session hijacking , the threat actor performed actions including host and network reconnaissance of the victim environment , credential harvesting , and lateral movement via RDP .


If the user unlocks their device , they will see a black screen while the app drops the call , resets call settings and prepares for the user to interact with the device normally . Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities . The rest of the content is a byte for byte copy . The new exploit method bypasses URL rewrite mitigations for the endpoint provided by Microsoft in response to •


Finally , the app can remove itself through three ways : Via a command from the server Autoremove if the device has not been able to check in to the server after 60 days Via an antidote file . TEMP.Periscope overlaps in targeting , as well as tactics , techniques , and procedures ( TTPs ) , with TEMP.Jumper , a group that also overlaps significantly with public reporting on NanHaiShu . Domain names were carefully chosen to look like they are related to the game or application publisher . When the malware is executed , it attempts to run the following commands , most of which attempt to stop various security and backup related software


If /sdcard/MemosForNotes was present on the device , the Chrysaor app removes itself from the device . The actor has conducted operations since at least 2013 in support of China 's naval modernization effort . The apex domain was set to redirect to a relevant legitimate site using the Namecheap redirection service , while the subdomain points to the malicious C&C server . None The motives have not yet been definitively determined , but are guessed to be the result of a oneoff attempt to gather intelligence that potentially can be used in further phishing campaigns .


Samples uploaded to VirusTotal To encourage further research in the security community , we ’ ve uploaded these sample Chrysaor apps to Virus Total . FireEye is highlighting a cyber espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40 . Winnti : xigncodeservice.com 2018-07-10 09:18:17 https://namu.wiki/w/XIGNCODE . If the main function is called with only , it will take the path that is intended for connect to the MSSQL server and , upload • None are supplied to the main function , it will immediately fail due to attempting to utilize command line arguments that were not parsed yet .


Package Name SHA256 digest SHA1 certificate com.network.android ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5 44f6d1caa257799e57f0ecaf4e2e216178f4cb3d com.network.android 3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86 516f8f516cc0fd8db53785a48c0a86554f75c3ba The Leviathan group has specifically targeted engineering , transportation , and the defense industry , especially where these sectors overlap with maritime technologies . Winnti : gxxservice.com 2018-08-14 13:53:41 None or unknown . The initial beacon contains hardcoded string added to IP parameters .


Additional digests with links to Chrysaor As a result of our investigation we have identified these additional Chrysaor-related apps . We believe APT40 's emphasis on maritime issues and naval technology ultimately support China 's ambition to establish a blue-water navy . Winnti : infestexe.com 2018-11-07 08:46:44 https://www.facebook.com/infest.in.th . • Unauthorized network connections to MSSQL servers ( TCP/1433 ) and irregular or unauthorized authentication .


Package Name SHA256 digest SHA1 certificate com.network.android 98ca5f94638768e7b58889bb5df4584bf5b6af56b188da48c10a02648791b30c 516f8f516cc0fd8db53785a48c0a86554f75c3ba com.network.android 5353212b70aa096d918e4eb6b49eb5ad8f59d9bec02d089e88802c01e707c3a1 Within a year APT40 was observed masquerading as a UUV manufacturer , and targeting universities engaged in naval research . Winnti : bugcheck.xigncodeservice.com 167.99.106.49 , 178.128.180.206 DigitalOcean . In September , the Department of the Treasury issued an advisory strongly discouraging consumers and organizations from making payments based on extortion attempts and encouraging them to strengthen their defense measures .


44f6d1caa257799e57f0ecaf4e2e216178f4cb3d com.binary.sms.receiver 9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae 7771af1ad3a3d9c0b4d9b55260bb47c2692722cf com.android.copy e384694d3d17cd88ec3a66c740c6398e07b8ee401320ca61e26bdf96c20485b4 APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia . Winnti : dump.gxxservice.com 142.93.204.230 DigitalOcean . An attacker may have more than a single motivation to target a particular organization .


7771af1ad3a3d9c0b4d9b55260bb47c2692722cf com.android.copy 12e085ab85db887438655feebd249127d813e31df766f8c7b009f9519916e389 7771af1ad3a3d9c0b4d9b55260bb47c2692722cf com.android.copy 6348104f8ef22eba5ac8ee737b192887629de987badbb1642e347d0dd01420f8 We assess with moderate confidence that APT40 is a state-sponsored Chinese cyber espionage operation . Winnti : nw.infestexe.com 138.68.14.195 DigitalOcean . While there are several motivations for hackers , we ve covered 6 of the most common ones in this article


31a8633c2cd67ae965524d0b2192e9f14d04d016 FinFisher exposed : A researcher ’ s tale of defeating traps , tricks , and complex virtual machines March 1 , 2018 Office 365 Advanced Threat Protection ( Office 365 ATP ) blocked many notable zero-day exploits in 2017 . The actor 's targeting is consistent with Chinese state interests and there are multiple technical artifacts indicating the actor is based in China . At the time of writing , none of the domains resolve and the C&C servers are not responding . Instead , it appeared that corresponding requests were made directly through the Outlook Web Application ( OWA ) endpoint , indicating a previously undisclosed exploit method for Exchange .


In our analysis , one activity group stood out : NEODYMIUM . Analysis of the operational times of the group 's activities indicates that it is probably centered around China Standard Time ( UTC +8 ) . A bot identifier is generated from the machine’s MAC address . In an article for DarkReading , Ericka Chickowski highlights 15 key indicators of compromise


This threat actor is remarkable for two reasons : Its access to sophisticated zero-day exploits for Microsoft and Adobe software Its use of an advanced piece of government-grade surveillance spyware FinFisher , also known as FinSpy and detected by Microsoft security products as Wingbird FinFisher is such a complex piece of malware that , like other researchers , we had to devise special methods to crack it . APT40 relies heavily on web shells for an initial foothold into an organization . The backdoor reports information about the machine such as the user name , computer name , Windows version and system language to the C&C server and awaits commands . • Cisco Talos has discovered a threat actor conducting several campaigns against government entities , military organizations and civilian users in Ukraine and Poland .


We needed to do this to understand the techniques FinFisher uses to compromise and persist on a machine , and to validate the effectiveness of Office 365 ATP detonation sandbox , Windows Defender Advanced Threat Protection ( Windows Defender ATP ) generic detections , and other Microsoft security solutions . APT40 has been observed leveraging a variety of techniques for initial compromise , including web server exploitation , phishing campaigns delivering publicly available and custom backdoors , and strategic web compromises . The data is XOR encrypted with the key “ *&b0i0rong2Y7un1 ” and base64-encoded . In each case , CrowdStrike reviewed the relevant logs and determined there was no evidence of exploitation of CVE-2022 - 41040 for initial access .


This task proved to be nontrivial . Depending on placement , a web shell can provide continued access to victims ' environments , re-infect victim systems , and facilitate lateral movement . The data received from the C&C server is encrypted using the same key . As outlined in recent research detailing the GRU 's disruptive playbook , we have observed Sandworm adopting LotL tactics across its wider operations to similarly increase the speed and scale at which it can operate while minimizing the odds of detection .


FinFisher is not afraid of using all kinds of tricks , ranging from junk instructions and “ spaghetti code ” to multiple layers of virtual machines and several known and lesser-known anti-debug and defensive measures . The group 's capabilities are more than the much discussed CVE-2012-0158 exploits over the past few years . This simple backdoor has only four commands that can be used by the attacker : In the listed indicators of compromise , we noticed domains that we had seen used in a distinct skimming campaign which did n't seem to be documented yet .


Security analysts are typically equipped with the tools to defeat a good number of similar tricks during malware investigations . A paper released today by our colleagues at Palo Alto Networks presented a portion of data on this crew under the label " the Lotus Blossom Operation " , likely named for the debug string present in much of the " Elise " codebase since at least 2012 : " d:\lstudio\projects\lotus\… " . DownUrlFile DownRunUrlFile RunUrlBinInMem UnInstall . All companies are subject to these .


However , FinFisher is in a different category of malware for the level of its anti-analysis protection . Instead , the Spring Dragon group is known to have employed spearphish exploits , strategic web compromises , and watering holes attack . The commands are pretty much self-explanatory . This indicates that the threat actor is likely capable of quickly developing similar capabilities against other OT systems from different original equipment manufacturers ( OEMs ) leveraged across the world .


It ’ s a complicated puzzle that can be solved by skilled reverse engineers only with good amount of time , code , automation , and creativity . The group 's spearphish toolset includes PDF exploits , Adobe Flash Player exploits , and the common CVE-2012-0158 Word exploits including those generated from the infamous " Tran Duy Linh " kit . They allow the attacker to run additional executables from a given URL . We found roughly 500 domain names that lead or have led to the “ Pig network ” between 2015 to March 2017 .


The intricate anti-analysis methods reveal how much effort the FinFisher authors exerted to keep the malware hidden and difficult to analyze . The Spring Dragon appears to have rolled out a steady mix of exploits against government-related organizations in VN , TW , PH , and other locations over the past few years . The last one is perhaps less obvious . Although COSMICENERGY does not directly overlap with any previously observed malware families , its capabilities are comparable to those employed in previous incidents and malware .


This exercise revealed tons of information about techniques used by FinFisher that we used to make Office 365 ATP more resistant to sandbox detection and Windows Defender ATP to catch similar techniques and generic behaviors . Organizations located in Myanmar and targeted by Spring Dragon have gone unmentioned . The UnInstall command doesn’t remove the malware from the system . While many statesponsored threat actors engage in spear phishing , ransomware is the preferred weapon of these cybercriminals .


Using intelligence from our in-depth investigation , Windows Defender ATP can raise alerts for malicious behavior employed by FinFisher ( such as memory injection in persistence ) in different stages of the attack kill chain . Spring Dragon 's infiltration techniques there were not simply spearphish . After all , it is embedded inside a legitimate executable that still needs to run . In late 2021 and 2022 , Cuba ransomware delivered an increasing number of highprofile attacks .


Machine learning in Windows Defender ATP further flags suspicious behaviors observed related to the manipulation of legitimate Windows binaries . The download name was " Zawgyi_Keyboard_L.zip " , and it dropped a " setup.exe " that contained several backdoor components , including an Elise " wincex.dll " ( a42c966e26f3577534d03248551232f3 , detected as Backdoor.Win32.Agent.delp ) . Rather than removing anything , it disables the malicious code by setting the following registry value to 1: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ImageFlag . “ Who or what is asdfdfsda@asdf.com ? , ” Biderman asked , after being sent a list of nine email addresses .


Figure 1 . While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past , Spring Dragon employs more involved and creative intrusive activity as well . When the payload is started , the registry value is queried and execution is aborted if set . Instead of compiling a list of threats , this technique looks at what is already on a computer and identifies programs as safe , blocking software that does nt match .


Generic Windows Defender ATP detections trigger alerts on FinFisher behavior While our analysis has allowed us to immediately protect our customers , we ’ d like to share our insights and add to the growing number of published analyses by other talented researchers ( listed below this blog post ) . The well-known threat group called DRAGONFISH or Lotus Blossom are distributing a new form of Elise malware targeting organizations for espionage purposes . Perhaps the attackers are trying to reduce the load from their C&C servers by avoiding callbacks from uninteresting victims . The domain name was created on the same day the ad appeared and the website is a copy of the real one .


We hope that this blog post helps other researchers to understand and analyze FinFisher samples and that this industry-wide information-sharing translate to the protection of as many customers as possible . The threat actors associated with DRAGONFISH have previously focused their campaigns on targets in Southeast Asia , specifically those located in countries near the South China Sea . Based on ESET telemetry , one of the second stage payload delivered to victims is Win64/Winnti.BN . Its capabilities include retrieving and executing additional payloads , collecting basic system information , and executing shell commands .


Spaghetti and junk codes make common analyst tools ineffective In analyzing FinFisher , the first obfuscation problem that requires a solution is the removal of junk instructions and “ spaghetti code ” , which is a technique that aims to confuse disassembly programs . iDefense analysts have identified a campaign likely to be targeting members of— or those with affiliation or interest in—the ASEAN Defence Ministers ' Meeting ( ADMM ) . As far as we can tell , its dropper was downloaded over HTTPS from api.goallbandungtravel.com . The downloader uses managed AES ( Rijndael algorithm ) to decrypt the appended data which is then reflectively loaded as a byte array using the Assembly .


Spaghetti code makes the program flow hard to read by adding continuous code jumps , hence the name . iDefense analysts have identified a campaign likely to be targeting members of or those with affiliation or interest in the ASEAN Defence Minister 's Meeting ( ADMM ) . We have seen it installed as a Windows service and as a DLL in C:\Windows\System32 using the following file names : The threat actor was consistently observed removing prior payloads from disk ; however , the FSEvents artifacts were able to provide great insight into files that previously existed on disk .


An example of FinFisher ’ s spaghetti code is shown below . iDefense assesses with high confidence that this campaign is associated with the threat group DRAGONFISH ( also known as Lotus Blossom and Spring Dragon ) . cscsrv.dll dwmsvc.dll iassrv.dll mprsvc.dll nlasrv.dll powfsvc.dll racsvc.dll slcsvc.dll snmpsvc.dll sspisvc.dll . Indicators of compromise act as breadcrumbs that lead infosec and IT pros to detect malicious activity early in the attack sequence .


Figure 2 . To mitigate the threat of the described campaign , security teams can consider blocking access to the C2 server 103.236.150.14 and , where applicable , ensure that the Microsoft Security Update KB2553204 is installed in order to patch the CVE-2017-11882 vulnerability . The samples we have analyzed were actually quite large , each of them about 60 MB . In terms of detection , organizations should look to align their detection strategy with the MITRE ATTCK Framework to help detect a ransomware attack before its too late .


The spaghetti code in FinFisher dropper This problem is not novel , and in common situations there are known reversing plugins that may help for this task . The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign . This is , however , only for appearance because the real size or the PE file is between 63 KB and 72 KB , depending on the version . That makes highfidelity threat intelligence and a proactive security stance critically important to success in 2023 .


In the case of FinFisher , however , we could not find a good existing interactive disassembler ( IDA ) plugin that can normalize the code flow . The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan . The malware files simply have lots of clean files appended to them . To understand the context of a computing interaction between servers , tools , and users , we need to analyze the endtoend process .


So we decided to write our own plugin code using IDA Python . On November 10 , 2015 , threat actors sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs . This is probably done by the component that drops and installs this malicious service . The Monti ransomware collective has restarted their operations , focusing on institutions in the legal and governmental fields .


Armed with this code , we removed this first layer of anti-analysis protection . On November 10 , 2015 , Lotus Blossom sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs . Once the service runs , it appends the extension .mui to its DLL path , reads that file and decrypts it using RC5 . In one particular forum post , Hack520 mentions that he was previously jailed for a period of 10 months in a blog post dated May 31 , 2009 .


Removing the junk instructions revealed a readable block of code . Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 . The decrypted MUI file contains position-independent code at offset 0 . This type of vulnerability is known as a server - side request forgery ( SSRF ) .


This code starts by allocating two chunks of memory : a global 1 MB buffer and one 64 KB buffer per thread . Lotus Blossom attempted to exploit CVE-2014-6332 using the POC code available in the wild . The RC5 key is derived from the hard drive serial number and the string “ f@Ukd!rCto R$. ” — we were not able to obtain any MUI files nor the code that installs them in the first place . Malwarebytes customers are shielded against this campaign via our web protection in Endpoint Protection ( EP ) , Endpoint Detection and Response ( EDR ) and Malwarebytes Premium .


The big first buffer is used as index for multiple concurrent threads . This Trojan is related to the Elise backdoor described in the Operation Lotus Blossom report . Thus , we do not know the exact purpose of this malicious service . The log messages recorded in the nslog can include connection statistics for SSLVPN and ICA proxy sessions .


A big chunk of data is extracted from the portable executable ( PE ) file itself and decrypted two times using a custom XOR algorithm . Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 . Recent versions of the malware include an “ auto-update ” mechanism , using C&C server http://checkin.travelsanignacio.com . CrowdStrike Services recently investigated several Play ransomware intrusions where the common entry vector was suspected to be the Microsoft Exchange ProxyNotShell vulnerabilities CVE-2022 - 41040 and CVE-2022 - 41082 .


We determined that this chunk of data contains an array of opcode instructions ready to be interpreted by a custom virtual machine program ( from this point on referenced generically as “ VM ” ) implemented by FinFisher authors . APT threat actors , most likely nation state-sponsored , targeted a diplomat in the French Ministry of Foreign Affairs with a seemingly legitimate invitation to a technology conference in Taiwan . That C&C server served the latest version of the MUI files encrypted with a static RC5 key . A recent report from the United Kingdom ’s National CyberSecurity Center ( NCSC ) highlights how the accessibility of these tools “ lowers the barrier to entry to state and non - state actors in obtaining capability and intelligence . ”


Figure 3 . Additionally , the targeting of a French diplomat based in Taipei , Taiwan aligns with previous targeting by these actors , as does the separate infrastructure . The C&C server was not responding during our analysis . A typical web request to the frontend to exploit the SSRF vulnerability on CVE-2022 - 41040 involves some variation of path confusion that references the endpoint as shown below : The backend request for a typical ProxyNotShell exploitation is shown below : Once the PowerShell remoting service can be reached , the second step involves vulnerability CVE-2022 - 41082 being exploited in order to execute arbitrary commands .


The stages of the FinFisher multi-layered protection mechanisms Stage 0 : Dropper with custom virtual machine The main dropper implements the VM dispatcher loop and can use 32 different opcodes handlers . The Elise malware used by Lotus Blossom , which was an attack campaign on targets in Southeast Asia . Let’s start with who is not targeted . Because the cdhash is computed based on executable code in the application , Mandiant was able to identify additional malware in the environment despite the files being deleted by the threat actor and the samples having different file hashes .


Th 64KB buffer is used as a VM descriptor data structure to store data and the just-in-time ( JIT ) generated code to run . Based on the targeting and lures , Unit 42 assesses that the Lotus Blossom actors ' collection requirements include militaries and government agencies in Southeast Asia . Early in the payload , the malware checks to see if the system language is Russian or Chinese . e.g. , uses character as a separator and that contains valid IP list uses as a separator .


The VM dispatcher loop routine ends with a JMP to another routine . In December 2015 , Unit 42 published a blog about a cyber espionage attack using the Emissary Trojan as a payload . In either case , the malware stops running . Among the group ’s most interesting characteristics are : • Strong functional and structural similarities linking its malware toolset to early MiniDuke and more recent CosmicDuke and OnionDuke components In early 2013 , GReAT observed several incidents that were so unusual they suggested the existence of a new , previously unknown threat actor .


In total , there are 32 different routines , each of them implementing a different opcode and some basic functionality that the malware program may execute . The oldest sample we found was created in 2009 , indicating this tool has been in use for almost seven years . There is no way around this : the attackers are simply not interested in computers configured with those languages . The malware uses stack strings followed by a single bitwise operation .


Figure 4 . In addition , Emissary appears to against Taiwan or Hong Kong , all of the decoys are written in Traditional Chinese , and they use themes related to the government or military . ESET telemetry shows victims are mostly located in Asia , with Thailand having the largest part of the pie . Depending on the platform and on how the code is compiled , these vulnerabilities could lead to arbitrary code execution : Talos is disclosing these vulnerabilities despite no official fix from Open Babel .


A snapshot of the code that processes each VM opcode and the associate interpreter The presence of a VM and virtualized instruction blocks can be described in simpler terms : Essentially , the creators of FinFisher interposed a layer of dynamic code translation ( the virtual machine ) that makes analysis using regular tools practically impossible . Of note , this is three years earlier than the oldest Elise sample we have found , suggesting this group has been active longer than previously documented . Given the popularity of the compromised application that is still being distributed by its developer , it wouldn’t be surprising if the number of victims is in the tens or hundreds of thousands . There are also many examples of nation - state actors leveraging contractors to develop offensive capabilities , as shown most recently in contracts between Russia ’s Ministry of Defense and NTC Vulkan .


Static analysis tools like IDA may not be useful in analyzing custom code that is interpreted and executed through a VM and a new set of instructions . In addition , we observed a TTP shift post publication with regards to their malware delivery ; they started using compromised but legitimate domains to serve their malware . Supply-chain attacks are hard to detect from the consumer perspective . Several issues in Foxit PDF reader could lead to arbitrary code execution Foxit PDF Reader is one of the most popular PDF readers on the market , offering many similar features to Adobe Acrobat .


On the other hand , dynamic analysis tools ( like debuggers or sandbox ) face the anti-debug and anti-analysis tricks hidden in the virtualized code itself that detects sandbox environments and alters the behavior of the malware . All of the Emissary we've collected are written in Traditional Chinese , which is used primarily in Taiwan and Hong Kong . It is impossible to start analyzing every piece of software we run , especially with all the regular updates we are encouraged or required to install . TIEDYE can communicate with a C2 server using a range of supported protocols described as follows .


At this stage , the analysis can only continue by manually investigating the individual code blocks and opcode handlers , which are highly obfuscated ( also using spaghetti code ) . One of the most interesting observations made during this analysis is that the amount of development effort devoted to Emissary significantly increased after we published our Operation Lotus Blossom report in June 2015 , resulting in many new versions of the Emissary Trojan . So , we put our trust in software vendors that the files they distribute don’t include malware . CrowdStrike researchers replicated the exploit method attack on Exchange systems that had not received the November 8 , 2022 patch KB5019758 , but could not replicate the attack on systems that had received that patch .


Reusing our deobfuscation tool and some other tricks , we have been able to reverse and analyze these opcodes and map them to a finite list that can be used later to automate the analysis process with some scripting . Lotus Blossom targeted the government , higher education , and high tech companies . Perhaps that’s the reason multiple groups target software developers : compromising the vendor results in a botnet as popular as the software that is hacked . But on Mar. 5 , 2014 , Harrison committed suicide by shooting himself in the head with a handgun .


The opcode instructions generated by this custom VM are divided into different categories : Logical opcodes , which implement bit-logic operators ( OR , AND , NOT , XOR ) and mathematical operators Conditional branching opcodes , which implement a code branch based on conditions ( equals to JC , JE , JZ , other similar branching opcodes ) Load/Store opcodes , which write to or read from particular addresses of the virtual address space of the process Specialized opcodes for various purposes , Our evidence suggests that malware authors created Emissary as early as 2009 , which suggests that threat actors have relied on this tool as a payload in cyber-espionage attacks for many years . However , there is a downside of using such a technique : once the scheme is uncovered , the attacker loses control and computers can be cleaned through regular updates . What ’s more , two other vulnerabilities in MOVEit were found while new victims were still coming forward .


like execute specialized machine instruction that are not virtualized We are publishing below the ( hopefully ) complete list of opcodes used by FinFisher VM that we found during our analysis and integrated into our de-virtualization script : INDEX MNEMONIC DESCRIPTION 0x0 EXEC Execute machine code 0x1 JG Jump if greater/Jump if not less or equal 0x2 WRITE Write a value into the dereferenced internal VM value ( treated as a pointer ) 0x3 JNO Jump if not overflow 0x4 JLE Jump While it lacks more advanced functionality like screen capturing , it is still able to carry out most tasks desired by threat actors : exfiltration of files , ability to download and execute additional payloads , and gain remote shell access . We do not know the motives of the attackers at this point . 3AM is written in Rust and appears to be a completely new malware family .


if less or equal ( signed ) 0x5 MOV Move the value of a register into the VM descriptor ( same as opcode 0x1F ) 0x6 JO Jump if overflow 0x7 PUSH Push the internal VM value to the stack 0x8 ZERO Reset the internal VM value to 0 ( zero ) 0x9 JP Jump if parity even 0xA WRITE Write into an address 0xB ADD Add the value of a register to the internal VM value 0xC JNS Jump if not signed 0xD JL Jump if less ( signed ) 0xE The timeline in Figure 2 shows that the Emissary Trojan was first created ( version 1.0 ) in May 2009 and quickly received an update that resulted in version 1.1 in June 2009 . Is it simply financial gain? Are there any reasons why the three affected products are from Asian developers and for the Asian market? Do these attackers use a botnet as part of a larger espionage operation? ESET products detect this threat as Win32/HackedApp.Winnti.A , Win32/HackedApp.Winnti.B , the payload as Win32/Winnti.AG , and the second stage as Win64/Winnti.BN . The United States government also threatened to step in when it looked like a U.S. company was going to purchase NSO Group , an infamous Israeli maker of the Pegasus spyware .


EXEC Execute machine code and branch 0xF JBE Jump if below or equal or Jump if not above 0x10 SHL Shift left the internal value the number of times specified into the opcodes 0x11 JA Jump if above/Jump if not below or equal 0x12 MOV Move the internal VM value into a register 0x13 JZ JMP if zero 0x14 ADD Add an immediate value to the internal Vm descriptor 0x15 JB Jump if below ( unsigned ) 0x16 JS Jump if signed 0x17 EXEC Execute Between August and November 2015 the malware author creates several new versions of Emissary , specifically 5.0 , 5.1 , 5.3 and 5.4 in a much more rapid succession compared to development process in earlier versions . Compromised file samples ( Win32/HackedApp.Winnti.A and B ) mac-555549440ea0d64e96bb34428e08cc8d948b40e7


machine code ( same as opcode 0x0 ) 0x18 JGE Jump if greater or equal/Jump if not less 0x19 DEREF Write a register value into a dereferenced pointer 0x1A JMP Special obfuscated “ Jump if below ” opcode 0x1B * Resolve a pointer 0x1C LOAD Load a value into the internal VM descriptor 0x1D JNE Jump if not equal/Jump if not zero 0x1E CALL Call an external function or a function located in the dropper 0x1F MOV Version 2.0 received one update in October 2013 before the malware author released version 3.0 in December 2014 . Winnti : 7cf41b1acfb05064518a2ad9e4c16fde9185cd4b Tue Nov 13 10:12:58 2018 1729131071 8272c1f4 . Simultaneously , a new variant of Monti , based on the Linux platform , has surfaced , demonstrating notable differences from its previous Linux - based versions .


Move the value of a register into the VM descriptor 0x20 JNB Jump if not below/Jump if above or equal/Jump if not carry 0x21 JNP Jump if not parity/Jump if parity odd Each virtual instruction is stored in a special data structure that contains all the information needed to be properly read and executed by the VM . While this may be coincidental , the out-of-sequence version 3.0 sample was created ten days after we published the Operation Lotus Blossom paper that exposed the Elise Trojan that is closely related to Emissary . Winnti : 7f73def251fcc34cbd6f5ac61822913479124a2a Wed Nov 14 03:50:18 2018 19317120 44260a1d . Harrison signed his threatening missive with the salutation , “ We are legion , ” suggesting that whatever comeuppance he had in store for Ashley Madison would come from a variety of directions and anonymous hackers .


This data structure is 24 bytes and is composed of some fixed fields and a variable portion that depends on the opcode . The Lotus Blossom largely targets military or government , with some cases of higher education and high tech companies . Winnti : dac0bd8972f23c9b5f7f8f06c5d629eac7926269 Tue Nov 27 03:05:16 2018 1729131071 8272c1f4 . According to Kaspersky telemetry , targeted organizations included think tanks and individuals working in various areas related to security and geopolitics .


Before interpreting the opcode , the VM decrypts the opcode ’ s content ( through a simple XOR algorithm ) , which it then relocates ( if needed ) , using the relocation fields . The use of Emissary appears to be focused only on Taiwan and Hong Kong , with regular malware updates to avoid detection and to increase the odds of success . Some hashes were redacted per request from one of the vendor . A cybercriminal may be impersonating a legitimate external user by using a Man in the Middle MiTM attack ,


Here is an approximate diagram of the opcode data structure : Figure 5 . The Lotus Blossom actors using Emissary have been active for at least seven years in Southeast Asia . If for a particular reason you need them , reach out to us at threatintel@eset.com . Also , ideology as a motivator could mean your group is the target of nation states .


A graphical representation of the data structure used to store each VM opcode The VM handler is completely able to generate different code blocks and deal with relocated code due to address space layout randomization ( ASLR ) . Magic Hound has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia . Payload Samples ( Win32/Winnti.AG ) Surprisingly enough , it does not take very long to get some information about Hack520 : someone with this handle runs a blog and a Twitter account ( with a handle close to Hack520 ) that is also directly linked to the blog .


It is also able to move code execution into different locations if needed . Regardless of causation , the rapid development of new versions of Emissary suggests that the malware authors are making frequent modifications to evade detection , which as a corollary suggests the Lotus Blossom are actively using the Emissary Trojan as a payload in attacks . Winnti : a045939f53c5ad2c0f7368b082aa7b0bd7b116da https://bugcheck.xigncodeservice.com/Common/Lib/Common_bsod.php . Since early 2023 , we have seen several new Yashma strains emerge , including ANXZ , Sirattacker , and Shadow Men Team .


For instance , in the case of the “ Execute ” opcode ( 0x17 ) , the 32-bit code to run is stored entirely into the variable section with the value at offset 5 specifying the number of bytes to be copied and executed . Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called " Rocket Kitten " ( AKA Operation Saffron Rose , Ajax Security Team , Operation Woolen-Goldfish ) as well as an older attack campaign called Newscasters . Winnti : a260dcf193e747cee49ae83568eea6c04bf93cb3 https://bugcheck.xigncodeservice.com/Common/Lib/Common_Include.php . DDoS and MiTM Attacks Any anomalous increase in traffic or redirect through unrecognized external servers can be an indication of a cyberattack that s about to happen .


Otherwise , in the case of conditional opcodes , the variable part can contain the next JIT packet ID or the next relative virtual address ( RVA ) where code execution should continue . In addition to the malware evolution , the actors also shifted from solely spear-phishing targets with attachments to also compromising legitimate websites to host malware . Winnti : dde82093decde6371eb852a5e9a1aa4acf3b56ba https://bugcheck.xigncodeservice.com/Common/Lib/common.php . LockBit reportedly squeezed about $ 91 million out of US organizations with around 1,700 attacks since 2020 , according to a June report by CISA .


Of course , not all the opcodes are can be easily read and understood due to additional steps that the authors have taken to make analysis extremely complicated . It is highly likely the Lotus Blossom used spear-phishing attacks containing links to these malicious documents as a delivery mechanism . Winnti : 8272c1f41f7c223316c0d78bd3bd5744e25c2e9f https://nw.infestexe.com/version/last.php . By understanding the TTPs of the leaked source codes , defenders will gain invaluable insights that are helpful in identifying and mitigating any existing security weakness in their environment and improving their security defense against these attack vectors .


For example , this is how opcode 0x1A is implemented : The opcode should represent a JB ( Jump if below ) function , but it ’ s implemented through set carry ( STC ) instruction followed by a JMP into the dispatcher code that will verify the carry flag condition set by STC . We were ultimately able to identify multiple organizations in the government , energy , and technology sectors targeted by Magic Hound . Winnti : 44260a1dfd92922a621124640015160e621f32d5 https://dump.gxxservice.com/common/up/up_base.php . Another wave of suspected Dukes attacks was identified in November 2018 by FireEye , this time again relying on Windows LNK files and deploying Cobalt Strike .


Figure 6 . The Magic Hound attacks did not rely on exploit code to compromise targeted systems , instead relying on Excel and Word documents containing malicious macros . Second stage samples ( Win64/Winnti.BN ) A clever example was ‘ Office Monkeys LOL Video.zip ’ .


One of the obfuscation tricks included by the malware authors in a VM opcode dispatcher Even armed with the knowledge we have described so far , it still took us many hours to write a full-fledged opcode interpreter that ’ s able to reconstruct the real code executed by FinFisher . The MPK bot is not publicly available and had previously been attributed to an adversary group called " Rocket Kitten " which has often been thought to be a state sponsored adversary operating in the Middle East region . Winnti : Dropper delivered by api.goallbandungtravel.com . Sandworm potentially developed the disruptive capability as early as three weeks prior to the OT event , suggesting the attacker may have been waiting for a specific moment to deploy the capability .


Stage 1 : Loader malware keeps sandbox and debuggers away The first stage of FinFisher running through this complicated virtual machine is a loader malware designed to probe the system and determine whether it ’ s running in a sandbox environment ( typical for cloud-based detonation solution like Office 365 ATP ) . One payload was a Python based open source remote administration tool ( RAT ) called Pupy . Winnti : 4256fa6f6a39add6a1fa10ef1497a74088f12be0 2018-07-25 10:13:41 None . According to Kaspersky telemetry , targeted organizations included political bodies in Europe .


The loader first dynamically rebuilds a simple import address table ( IAT ) , resolving all the API needed from Kernel32 and NtDll libraries . The Magic Hound campaign used Word and Excel documents containing malicious macros as a delivery method , specifically attempting to load MagicHound.Rollover . Winnti : bb4ab0d8d05a3404f1f53f152ebd79f4ba4d4d81 2018-10-10 09:57:31 http://checkin.travelsanignacio.com . Developed in - house using C++ , the NoEscape ransomware uses a hybrid approach to encryption , combining ChaCha20 and RSA encryption algorithms for file encryption and key protection .


It then continues executing in a spawned new thread that checks if there are additional undesired modules inside its own virtual address space ( for example , modules injected by certain security solutions ) . Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES . Winnti : T1195 Supply Chain Compromise . Someone motivated by money will likely cast a wide net and look for easy targets .


It eventually kills all threads that belong to these undesired modules ( using ZwQueryInformationThread native API with ThreadQuerySetWin32StartAddress information class ) . The loader 's main goal was to run a PowerShell command to execute shellcode . Winnti : T1050 New Service . The script contains 1,759 lines of code .


The first anti-sandbox technique is the loader checking the code segment . To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys . Winnti : T1022 Data Encrypted . Another finding in the activity of ' Sharpshooter ' were a set of unobfuscated connections from IP addresses in Windhoek , a city in Namibia , Africa .


If it ’ s not 0x1B ( for 32-bit systems ) or 0x23 ( for 32-bit system under Wow64 ) , the loader exits . The Magic Hound campaign was also discovered using a custom dropper tool , which we have named MagicHound.DropIt . Winnti : T1079 Multilayer Encryption . “ lun.vbs ” , which runs n.bat


Next , the dropper checks its own parent process for indications that it is running in a sandbox setup . We have also seen Magic Hound using DropIt as a binder , specifically dropping a legitimate decoy executable along with the malicious executable onto the target host . Winnti : T1032 Standard Cryptographic Protocol ( RC4 , RC5 ) . title : MicroSCADA SCILC Command Execution description : Identification of Events or Host Commands that are related to the MicroSCADA SCILC programming language and specifically command execution author : Mandiant date : 2023/02/27 logsource : product : windows service : security detection : selection : NewProcessName|endswith : - \scilc.exe CommandLine|contains : -


It calculates the MD5 hash of the lower-case process image name and terminates if one of the following conditions are met : The MD5 hash of the parent process image name is either D0C4DBFA1F3962AED583F6FCE666F8BC or 3CE30F5FED4C67053379518EACFCF879 The parent process ’ s full image path is equal to its own process path If these initial checks are passed , the loader builds a complete IAT by reading four imported libraries from disk ( ntdll.dll We also found a second IRC bot called MPK using the same IP for its C2 server that a Leash sample was hosted on . Winnti : T1043 Commonly Used Port ( 80 , 443 ) . Users were drawn to a login prompt that was designed to harvest user credentials with pages that looked like Adobe , Microsoft , etc .


, kernel32.dll , advapi32.dll , and version.dll ) and remapping them in memory . The Magic Hound attack campaign is an active and persistent espionage motivated adversary operating in the Middle East region . OceanLotus Steganography Malware Analysis White Paper . Eventually , when the DLL is copied into its final path , rundll32.exe is used to call the exported function SetQueryNetSessionCount , which downloads the next stage .


This technique makes use of debuggers and software breakpoints useless . Organizations in the government , energy , and technology sectors have been targeted by Magic Hound , specifically organizations based in or doing business in Saudi Arabia . While continuing to monitor activity of the OceanLotus APT Group , BlackBerry Cylance researchers uncovered a novel payload loader that utilizes steganography to read an encrypted payload concealed within a .png image file . An example of these log entries can be found below : By correlating the user , IP address and GUID from the Remote PowerShell HTTP logs to the Exchange frontend , CrowdStrike found a request using the mailbox to the following OWA URL , , corresponding to the IIS log entry below : The backend request for the new exploitation chain is similar to the example shown below : This request seemed to show a novel , previously undocumented , way to reach the PowerShell remoting service through the OWA frontend endpoint , instead of leveraging the endpoint .


During this stage , the loader may also call a certain API using native system calls , which is another way to bypass breakpoints on API and security solutions using hooks . At a high level , Retriever is a .NET downloader that downloads secondary payloads from servers associated with Magic Hound . The steganography algorithm appears to be bespoke and utilizes a least significant bit approach to minimize visual differences when compared with the original image to prevent analysis by discovery tools . " VP Labs RD and Deputy CSO at LogRhythm .


Figure 7 . For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer . Once decoded , decrypted , and executed , an obfuscated loader will load one of the APT32 backdoors . They also added a new user for persistence and used the Wput tool to exfiltrate the victims files to their own FTP server .


FinFisher loader calling native Windows API to perform anti-debugging tricks At this point , the fun in analysis is not over . M-Trends 2018 can arm security teams with the knowledge they need to defend against today 's most often used cyber attacks , as well as lesser seen and emerging threats . Thus far , BlackBerry Cylance has observed two backdoors being used in combination with the steganography loader – a version of Denes backdoor ( bearing similarities to the one described by ESET ) , and an updated version of Remy backdoor . PREDATOR is intended to work with another spyware component called “ ALIEN ” ( it ’s not “ Alien vs. Predator ” this time ; they ’re working together ) .


A lot of additional anti-sandbox checks are performed in this exact order : Check that the malware is not executed under the root folder of a drive Check that the malware file is readable from an external source Check that the hash of base path is not 3D6D62AF1A7C8053DBC8E110A530C679 Check that the full malware path contains only human readable characters ( “ a-z ” , “ A-Z ” , and “ 0-9 ” ) Check that no node in the full path contains the MD5 string of the malware FireEye tracks thousands of threat actors , but pays special attention to state-sponsored attackers who carry out advanced persistent threat ( APT ) attacks . However , this can be easily modified by the threat actor to deliver other malicious payloads . Adversaries may also use CLIs to install and run new software , including malicious tools that may be installed over the course of an operation .


file Fingerprint the system and check the following registry values : HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid should not be “ 6ba1d002-21ed-4dbe-afb5-08cf8b81ca32 ” HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DigitalProductId should not be “ 55274-649-6478953-23109 ” , “ A22-00001 ” , or “ 47220 ” HARDWARE\Description\System\SystemBiosDate should not contain “ 01/02/03 ” Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents . The complexity of the shellcode and loaders shows the group continues to invest heavily in development of bespoke tooling . Mandiant directly observed one ( 1 ) variant of STRATOFEAR as a Mach - O executable compiled for ARM64 systems that contained a self - signed certificate with a particular Common Name ( CN ) .


Check that the mutex WininetStartupMutex0 does not already exist Check that no DLL whose base name has hash value of 0xC9CEF3E4 is mapped into the malware address space The hashes in these checks are most likely correspond to sandbox or security products that the FinFisher authors want to avoid . During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros . This white paper describes the steganography algorithm used in two distinct loader variants and looks at the launcher of the backdoor that was encoded in one of the .png cover images . mcvsocfg.dll : In April , Talos discovered a new ransomware actor , RA Group , conducting double extortion attacks using their ransomware variant based on leaked Babuk source code .


Next , the loader checks that it ’ s not running in a virtualized environment ( VMWare or Hyper-V ) or under a debugger . Evidence also suggests that APT32 has targeted network security and technology infrastructure corporations with connections to foreign investors . ae1b6f50b166024f960ac792697cd688be9288601f423c15abbc755c66b6daa4 Malware/Backdoor 659 KB ( 674 , 816 bytes ) PE32 executable for MS Windows ( DLL ) ( console ) Intel 80386 32-bit September 2018 . Getting access to the C2 information helped the researchers get a clear view of the attacker 's operations and utilities .


For the hardware virtualization check , the loader obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list . Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations foreign governments . This particular OceanLotus malware loader attempts to imitate McAfee ’s McVsoCfg DLL and expects to be side-loaded by the legitimate " On Demand Scanner " executable . Seven of the vulnerabilities included in today ’s Vulnerability Roundup have a CVSS severity score of 9.8 out of a possible 10 .


In our tests , the malware sample was able to easily detect both VMWare and Hyper-V environments through the detection of the virtualized peripherals ( for example , Vmware has VEN_15AD as vendor ID , HyperV has VMBus as bus name ) . FireEye asesses that APT32 actors may be aligned with the national interests of Vietnam . It arrives together with an encrypted payload stored in a separate .png image file . Data transfer to a thirdparty tool may be authorized , but it may not be common practice to continuously ping internal servers for external data transfer requests .


Office 365 ATP sandbox employs special mechanisms to avoid being detected by similar checks . APT32 poses a threat to companies doing business or preparing to invest in Vietnam . The .png cover file is actually a valid image file that is not malicious on its own . This new ransomware variant does n't have any novel features or functionality and points to the challenges organizations are facing as the landscape continues to shift and a plethora of new actors join their ranks .


The loader ’ s anti-debugger code is based on the following three methods : The first call aims to destroy the debugger connection : NOTE : This call completely stops the execution of WinDbg and other debuggers The second call tries to detect the presence of a debugger : The final call tries to destroy the possibility of adding software breakpoint : Finally , if the loader is happy with all the checks done so far , based on the victim operating system ( 32 or 64-bit ) it proceeds to decrypt a set of fake bitmap resources ( stage 2 We believe recent activity targeting private interests in Vietnam suggests that APT32 poses a threat to companies doing business or preparing to invest in the country . The payload is encoded inside this image with the use of a technique called steganography , which utilizes the least significant bits of each pixel’s color code to store hidden information , without making overtly visible changes to the picture itself . The actor hunts for confidential information stored in the networks of governmental organizations , political groups and think tanks , as well as various individuals involved in defense and geopolitical related research .


) embedded in the executable and prepares the execution of a new layer of VM decoding . DROPSHOT is a notable piece of malware used to deliver variants of the TURNEDUP backdoor . The encoded payload is additionally encrypted with AES128 and further obfuscated with XOR in an attempt to fool steganography detection tools . Once installed , the trojan could disrupt operations within systems and networks or exfiltrate confidential data .


Each bitmap resource is extracted , stripped of the first 0x428 bytes ( BMP headers and garbage data ) , and combined into one file . Additionally , there is evidence to suggest APT33 targeted Saudi Arabia . Features : The executable within this not only played a very funny video , but dropped and ran another CozyDuke executable .


The block is decrypted using a customized algorithm that uses a key derived from the original malware dropper ’ s TimeDateStamp field multiplied by 5 . APT33 often conducts spear-phishing operations using a built-in phishing module . Side-loaded DLL Loads next-stage payload using custom .png steganography Uses AES128 implementation from Crypto++ library for payload decryption Known to load Denes backdoor , might possibly be used also with other payloads . Threat actors regularly adapt and make use of red team tools - such as commercial and publicly available exploitation frameworks - to facilitate real world attacks , like TEMP.Veles ’ use of METERPRETER during .


Figure 8 . Additionally , there is evidence to suggest APT33 targeted Saudi Arabian and Western organizations that provide training , maintenance and support for Saudi Arabia 's military and commercial fleets . The malicious DLL exports the same function names as the original mcvsocfg.dll library . HHS HC3 warned that the stolen credentials may have been used to compromise a number of healthcare organizations and enterprises in other industries .


The fake bitmap image embedded as resource The 32-bit stage 2 malware uses a customized loading mechanism ( i.e. , the PE file has a scrambled IAT and relocation table ) and exports only one function . Although we have only observed APT33 use DROPSHOT to deliver TURNEDUP , we have identified multiple DROPSHOT samples in the wild that delivered wiper malware we call SHAPESHIFT . All exports contain the exact same code which will decrypt the payload , inject it into memory , and execute it . STRATOFEAR ’s code references five predefined module types that have an ID value and an internal name :


For the 64-bit stage 2 malware , the code execution is transferred from the loader using a well-known technique called Heaven ’ s Gate . The SHAPESHIFT wiper is capable of wiping disks and volumes , as well as deleting files . The payload is encoded inside a separate .png file using a technique called steganography . After further research , we were able to link Hack520 to different network administration activities , notably with a Virtual Private Server ( VPS ) hosting service .


In the next sections , for simplicity , we will continue the analysis only on the 64-bit payload . Ties to SHAPESHIFT suggest that APT33 may engage in destructive operations or shares tools or development resources with an Iranian threat group that conducts destructive operations . On top of that , the decoded payload is also encrypted with AES-128 and finally obfuscated with XOR 0x3B . This then offered a means to log on using email providers , which could then capture the passwords and user names .


Figure 9 . In a recent attack , APT33 sent spear-phishing emails to workers in the aviation industry . It’s worth noting that the XOR key is not hardcoded , but instead is read from the first byte of the C:\Windows\system.ini file . Based on these findings , CrowdStrike assesses it is highly likely that the OWA technique employed is in fact tied to CVE-2022 - 41080 .


Heaven ’ s gate is still in use in 2017 Stage 2 : A second multi-platform virtual machine The 64-bit stage 2 malware implements another loader combined with another virtual machine . The HTA files contained job descriptions and links to job postings on popular employment websites . One of the payloads we encountered was encoded inside an image of Kaito Kuroba1 , the gentleman thief character from a popular Japanese manga series . Exploitation of CVE-2023 - 4966 will not crash the NSPPE process and generate memory core dump files .


The architecture is quite similar to the one described previously , but the opcodes are slightly different . Since at least 2014 , an Iranian threat group tracked by FireEye as APT34 has conducted reconnaissance aligned with the strategic interests of Iran . To extract the payload , the malware will first initialize the GDI+ API and get the image width and height values . New variants based on leaked code are becoming more common We have continued seeing various malicious campaigns since the start of 2023 , where the threat actors have used new ransomware variants based on leaked source code or builders .


After reversing these opcodes , we were able to update our interpreter script to support both 32-bit and 64-bit virtual machines used by FinFisher . These emails included recruitment-themed lures and links to malicious HTML application ( HTA ) files . The size of the payload is encoded within the first four pixels of the image . TLDR OilRig is leveraging a new backdoor dubbed Marlin as part of a longrunning espionage campaign that started in April 2018 .


INDEX MNEMONIC DESCRIPTION 0x0 JMP Special obfuscated conditional Jump ( always taken or always ignored ) 0x1 JMP Jump to a function ( same as opcode 0x10 ) 0x2 CALL Call to the function pointed by the internal VM value 0x3 CALL Optimized CALL function ( like the 0x1E opcode of the 32-bit VM ) 0x4 EXEC Execute code and move to the next packet 0x5 JMP Jump to an internal function 0x6 NOP No operation , move to the The OilRig group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries . After obtaining the size , the malware will allocate an appropriate memory buffer and proceed to decode the remaining payload byte by byte . “ n.bat ” , which likely runs the native scilc.exe utility


next packet 0x7 CALL Call an imported API ( whose address is stored in the internal VM value ) 0x8 LOAD Load a value into the VM descriptor structure * 0x9 STORE Store the internal VM value inside a register 0xA WRITE Resolve a pointer and store the value of a register in its content 0xB READ Move the value pointed by the VM internal value into a register 0xC LOAD Load a value into the VM descriptor structure ( not optimized ) 0xD CMP Compare the value pointed by the internal VM descriptor APT34 uses a mix of public and non-public tools . The payload is encoded in the same way as the size – each byte of the payload is computed from the ARGB color codes of each subsequent pixel in the image . It uses a hardcoded mutex value to make sure that the victim is not infected twice by calling followed by a call to to check the last error code .


with a register 0xE CMP Compare the value pointed by the internal VM descriptor with an immediate value 0xF XCHG Exchange the value pointed by the internal VM descriptor with a register 0x10 SHL Jump to a function ( same as opcode 0x1 ) This additional virtual machine performs the same duties as the one already described but in a 64-bit environment . APT34 often uses compromised accounts to conduct spear-phishing operations . In case the payload is bigger than the image used to store it , the remaining payload bytes are simply attached to the image after its IEND marker , and read directly from the file . NoEscape is a new ransomware which been doing the rounds in underground forums since May 2023 .


It extracts and decrypts the stage 3 malware , which is stored in encrypted resources such as fake dialog boxes . APT33 leverages a mix of public and non-public tools and often conducts spear-phishing operations using a built-in phishing module from " ALFA TEaM Shell " , a publicly available web shell . The pixel encoding algorithm is fairly straightforward and aims to minimize visual differences when compared to the original image by only modifying the least significant bits of the red , green , and blue color byte values . For these reasons , OT defenders and asset owners should take mitigating actions against COSMICENERGY to preempt in the wild deployment and to better understand common features and capabilities that are frequently deployed in OT malware .


The extraction method is the same , but the encryption algorithm ( also XOR ) is much simpler . In July 2017 , FireEye observed APT34 targeting an organization in the Middle East using the POWRUNER PowerShell-based backdoor and the downloader BONDUPDATER , which includes a domain generation algorithm ( DGA ) for command and control . The alpha channel byte remains unchanged . In particular , we managed to gather details on an individual using the handle Hack520 , who we believe is connected to Winnti .


The new payload is decrypted , remapped , and executed in memory , and represents the installation and persistence stage of the malware . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . To encode a byte of the payload , the first three bits ( 0-2 ) are stored in the red color , the next three bits ( 3-5 ) are stored in the green color , and the final two bits ( 6-7 ) are stored in the blue color . This type of vulnerability is known as a server - side request forgery ( SSRF ) .


Stage 3 : Installer that takes DLL side-loading to a new level Stage 3 represents the setup program for FinFisher . In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch . Decoding is a simple inverse operation . The ransomware will then scan the disk and any files matching predefined criteria are encrypted and the original files are deleted .


It is the first plain stage that does not employ a VM or obfuscation . FireEye has identified APT35 operations dating back to 2014 . Windows converts the .png pixel RGBA value to an ARGB encoding via the GdpiBitmapGetPixel API . Notably , the main function contains logic flaws that cause it to only be able to connect to an MSSQL server and upload ( LIGHTWORK ) to it , before immediately attempting to clean itself up .


The code supports two different installation methods : setup in a UAC-enforced environment ( with limited privileges ) , or an installation with full-administrative privileges enabled ( in cases where the malware gains the ability to run with elevated permissions ) . APT35 , also known as the Newscaster Team , is a threat group sponsored by the Iranian government that conducts long term , resource-intensive operations to collect strategic intelligence . To aid in the recovery of encrypted payloads , the following Python script can be used to decode pixel colors from a .png image . If the main function is called with only , it will take the path that is intended for connect to the MSSQL server and , upload • None are supplied to the main function , it will immediately fail due to attempting to utilize command line arguments that were not parsed yet .


We were a bit disappointed that we did not see traces of a true privilege escalation exploit after all this deobfuscation work , but it seems these FinFisher samples were designed to work just using UAC bypasses . APT35 typically targets military , diplomatic and government , media , energy , engineering , business services and telecommunications sectors in U.S. and the Middle East . After decoding the .png image , the loader then proceeds to initialize the key and IV used to perform AES decryption of the encrypted payload . This is expressed in the form of decimal digits .


The setup code receives an installation command from the previous stage . APT35 has historically used unsophisticated tools like those listed below in Figure 3 . Both values are supplied from an array of 256 pseudo-random bytes hardcoded in the binary’s .rdata section . Methods of manipulating control can include changes to set point values , tags , or other parameters .


In our test , this command was the value 3 . APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors . The first two bytes of that array specify the relative offsets to the key and IV respectively . Furthermore , our analysis of the activity suggests Russia would be capable of developing similar capabilities against other SCADA systems and programming languages beyond MicroSCADA and SCIL .


The malware creates a global event named 0x0A7F1FFAB12BB2 and drops some files under a folder located in C : \ProgramData or in the user application data folder . Many of the fake personas utilized by APT35 claimed to be part of news organizations , which led to APT35 being referred to as the Newscaster Team . The loader uses the AES128 implementation from the open-source Crypto++2 library . The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier .


The name of the folder and the malware configuration are read from a customized configuration file stored in the resource section of the setup program . Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations . We were able to correlate most of the disassembly to the corresponding functions from the Crypto++ github source , and it doesn’t appear that the malware authors have modified much of the original code . So far in 2023 , ransomware gangs hit the US , Germany , France , and the UK hard , with the US shouldering a hefty 43 % of all global attacks .


Here the list of the files potentially dropped during the installation stage : FILE NAME STAGE DESCRIPTION d3d9.dll Stage 4 Malware loader used for UAC environments with limited privileges ; also protected by VM obfuscation aepic.dll , sspisrv.dll , userenv.dll Stage 4 Malware loader used in presence of administrative privileges ; executed from ( and injected into ) a fake service ; also protected by VM obfuscation msvcr90.dll Stage 5 Malware payload injected into Since at least 2013 , the Iranian threat group FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations . A SimpleKeyringInterface class is used to initialize the key , while the IV is passed to the SetCipherWithIV function . The government even offered a reward of up to $ 10 million for information on Cl0p after several federal agencies in the US fell victim to the gang .


the explorer.exe or winlogon.exe process ; also protected by VM obfuscation .cab Config Main configuration file ; encrypted setup.cab Unknown Last section of the setup executable ; content still unknown .7z Plugin Malware plugin used to spy the victim network communications wsecedit.rar Stage 6 Main malware executable After writing some of these files , the malware decides which kind of installation to perform based on the current privilege provided by the hosting process ( for example , if a Microsoft Office process was used as exploit vector ) : Installation process under In early 2017 , Mandiant responded to an incident involving APT35 targeting an energy company . The decryption is performed with the use of the StreamTransformationFilter class with the StreamTransformation cipher set to AES CBC decryption mode . The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


UAC When running under a limited UAC account , the installer extracts d3d9.dll and creates a persistence key under HKCU\Software\Microsoft\Windows\Run . The attacker used a spear-phishing email containing a link to a fake resume hosted on a legitimate website that had been compromised . The library code performs numerous checks for the CPU features , and based on the outcome , it will choose a processor-specific implementation of the cryptographic function . The file c018c54eff8fd0b9be50b5d419d80f21 ( r3_iec104_control.py ) imports the " iec104_mssql_lib " module , which is contained within the extracted contents as adfa40d44a58e1bc909abca444f7f616 ( iec104_mssql_lib.pyc ): 2b86adb6afdfa9216ef8ec2ff4fd2558 ( iec104_mssql_lib.py ) implements PIEHOP ’s primary capabilities and contains many developer - supplied comments for the included code .


The malware sets a registry value ( whose name is read from the configuration file ) to “ C : \Windows\system32\rundll32.exe c : \ProgramData\AuditApp\d3d9.dll , Control_Run ” . APT35 also installed BROKEYOLK , a custom backdoor , to maintain persistence on the compromised host . One of the AES implementations makes use of the Intel AES-NI encryption instruction set which is supported by several modern Intel and AMD CPUs . By analyzing the source code , researchers can identify similar patterns and techniques used by different threat actors , providing defenders with a way to proactively detect and block the new variants at the initial stage of an attack .


Before doing this , the malware makes a screenshot of the screen and displays it on top of all other windows for few seconds . They then proceeded to log directly into the VPN using the credentials of the compromised user . The decrypted payload undergoes one final transformation , where it is XORed with the first byte read from the C:\Windows\system . ini file , which is expected to begin with a comment character " ; " ( 0x3B ) . Curl An opensource commandline tool for transferring data using various network protocols .


This indicates that the authors are trying to hide some messages showed by the system during the setup process . The resume contained the PupyRAT backdoor , which communicated with known APT35 infrastructure . Performing the same steps in CyberChef , it is possible to decode the encrypted payload , which should yield x86 shellcode , starting with a call immediate opcode sequence . If the main function is called with only , it will only perform its cleanup routine and immediately terminate .


When loaded with startup command 2 , the installer can copy the original explorer.exe file inside its current running directory and rename d3d9.dll to uxtheme.dll . Once connected to the VPN , APT35 focused on stealing domain credentials from a Microsoft Active Directory Domain Controller to allow them to authenticate to the single-factor VPN and Office 365 instance . Varies : The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


In this case the persistence is achieved by loading the original explorer.exe from its startup location and , using DLL side-loading , passing the execution control to the stage 4 malware ( discussed in next section ) . While having access to the organization 's environment , the Magic Hound targeted data related to entities in the Middle East . 4c02b13441264bf18cc63603b767c3d804a545a60c66ca60512ee59abba28d4d Malware/Backdoor 658 KB ( 674 , 304 bytes ) PE32 executable for MS Windows ( DLL ) ( console ) Intel 80386 32-bit September 2018 . COSMICENERGY lacks discovery capabilities , which implies that to successfully execute an attack the malware operator would need to perform some internal reconnaissance to obtain environment information , such as MSSQL server IP addresses , MSSQL credentials , and target IEC-104 device IP addresses .


Finally , the malware spawns a thread that has the goal to load , remap , and relocate the stage 5 malware . Mandiant has previously observed targeted attackers stealing email , but few threat actors have been as successful at this as APT35 . While this loader differs somewhat in general implementation , the payload extraction routine seems to be the same as in the previous variant . In this incident , the attacker leveraged an EOL version of the MicroSCADA supervisory control system .


In this context , there is indeed no need to execute the stage 4 malware . The campaigns delivered PupyRAT , an open-source cross-platform remote access trojan ( RAT ) . The main differences are : The social media platform says it tied the groups malware samples to a specific Iranianbased IT contractor called Mahak Rayan Afraz , which has previously provided malware to the IRGC , indicating a link between the Tortoiseshell group and the Iranian government .


The msvcr90.dll file is opened , read , and decrypted , and the code execution control is transferred to the RunDll exported routine . Ultimately , APT35 had used access to hundreds of mailboxes to read email communications and steal data related to Middle East organizations , which later became victims of destructive attacks . The way the decryption routine is called ( from within the DllMain function , as opposed to an exported function ) . KillNet has also repeatedly promoted messaging related to changes or expansions in the collective ’s operations , ranging from KillNet reforming to become a “ private military hacker company ” to purported partnerships with cyber crime groups .


In the case of 32-bit systems , the malware may attempt a known UAC bypass by launching printui.exe system process and using token manipulation with NtFilterToken as described in this blog post . CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash . The way the payload is invoked ( by overwriting the return address on the stack , as opposed to a direct call ) . The Talos Threat Spotlight posts and Quarterly Trends reports provide details of threats and the techniques used by threat actors .


Installation process with administrative privilege This installation method is more interesting because it reveals how the malware tries to achieve stealthier persistence on the machine . Further analysis revealed a well-established collection of fake social media profiles that appear intended to build trust and rapport with potential victims . Implementation of an additional anti-analysis check that compares the name of the parent process to a string stored in an encrypted resource . The opportunities for governments and law enforcement to use spyware as part of legal investigations led to the development of commercial spyware .


The method is a well-known trick used by penetration testers that was automated and generalized by FinFisher The procedure starts by enumerating the KnownDlls object directory and then scanning for section objects of the cached system DLLs . COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites . We came across multiple variations of this DLL containing different parent process names , possibly targeted specifically to the victim’s environment . then the data decoded with Base64 and sent to C2 server IP using POST request to the subdirectory .


Next , the malware enumerates all .exe programs in the % System % folder and looks for an original signed Windows binary that imports from at least one KnownDll and from a library that is not in the KnownDll directory . The connections associated with these profiles indicate the threat actor began using the persona to target organizations in April 2016 . Some of these names include processes related to security software : Ashley Madison ’s long - suspected army of fake female accounts came to the fore in August 2012 after the former sex worker turned activist and blogger Maggie McNeill published screenshots apparently taken from Ashley Madison ’s internal systems suggesting that a large percentage of the female accounts on the service were computer - operated bots .


When a suitable .exe file candidate is found , it is copied into the malware installation folder ( for example , C : \ProgramData ) . Between December 28 , 2016 and January 1 , 2017 , CTU researchers observed a phishing campaign targeting Middle Eastern organizations . wsc_proxy.exe plugins-setup.exe SoftManager.exe GetEFA.exe . Rhysida appears to have first popped up back in May , with several high - profile compromises posted on their leak site .


At this point the malware extracts and decrypts a stub DLL from its own resources ( ID 101 ) . The macro ran a PowerShell command that attempted to download additional PowerShell loader scripts for PupyRAT , a research and penetration-testing tool that has been used in attacks . Features : Do you have cyber security concerns about your business Contact CoreTech today , and we will conduct an IT security assessment .


It then calls a routine that adds a code section to a target module . The survey contained macros that , once enabled , downloaded PupyRAT . Side-loaded DLL Anti-debugging/anti-sandboxing check for parent process name . Why does this matter Because nation states are well funded and super determined .


This section will contain a fake export table mimicking the same export table of the original system DLL chosen . CTU researchers determined that the COBALT GYPSY threat group orchestrated this activity due to the tools , techniques , and procedures ( TTPs ) used in both campaigns . Loads next-stage payload using custom .png steganography . Further analysis of COSMICENERGY is available as part of .


At the time of writing , the dropper supports aepic.dll , sspisrv.dll , ftllib.dll , and userenv.dll to host the malicious FinFisher payload . The Magic Hound has repeatedly used social media to identify and interact with employees at targeted organizations and then used weaponized Excel documents . Uses AES128 implementation from Crypto++ library for payload decryption . We were able to find additional links between Hack520 ’s “ Pig network ” and the Winnti group ’s activities .


Finally , a new Windows service is created with the service path pointing to the candidate .exe located in this new directory together with the freshly created , benign-looking DLL . The group has repeatedly used social media , particularly LinkedIn , to identify and interact with employees at targeted organizations , and then used weaponized Excel documents to deliver RATs such as PupyRAT . Executes the payload by overwriting the return address on the stack . The dropper first creates a shortcut file but the dropped DLL is launched with rundll32.exe instead of regsvr32.exe .


In this way , when the service runs during boot , the original Windows executable is executed from a different location and it will automatically load and map the malicious DLL inside its address space , instead of using the genuine system library . By compromising a user account that has administrative or elevated access , Magic Hound can quickly access a targeted environment to achieve their objectives . Known to load an updated version of Remy backdoor . For operational plans development , the combination of threats , vulnerabilities , and impacts must be evaluated in order to identify important trends and decide where effort should be applied to eliminate or reduce threat capabilities eliminate or reduce vulnerabilities and assess , coordinate , and deconflict all cyberspace operations NIST , 2010 .


This routine is a form of generic and variable generator of DLL side-loading combinations . These characteristics suggest that COBALT GYPSY executed the January and February phishing campaigns and that it created the Mia Ash persona . This DLL does not contain an export table and its entire functionality resides in the DllMain routine . • None consisting of CVE-2022 - 41080 and CVE-2022 - 41082 to achieve remote code execution ( RCE ) through Outlook Web Access ( OWA ) .


Figure 10 . CTU researchers have observed multiple COBALT GYPSY campaigns since 2015 and consider it highly likely that the group is associated with Iranian government-directed cyber operations . Upon execution , the malware will first decrypt a string from its resources and compare it against the name of the parent process . During the course of researching the Winnti group , we came across previously unreported malware samples that we attributed to the group based on the malware arsenal and the use of registered domains as attack infrastructure .


Windows Defender ATP timeline can pinpoint the service DLL side-loading trick ( in this example , using fltlib.dll ) . The use of the Mia Ash persona demonstrates the creativity and persistence that threat actors employ to compromise targets . If the names differ , the malware will simply exit without touching the payload . If you receive such an email , just delete it and do n’t give it a second thought .


In the past , we have seen other activity groups like LEAD employ a similar attacker technique named “ proxy-library ” to achieve persistence , but not with this professionalism . CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering . The resource containing the expected process name ( ICON/1 ) is XORed with the first byte of the legitimate C:\Windows\system.ini file – 0x3B ( " ; " ) . [ As the documentary points out , the domain AshleyMadisonSucks.com was eventually transferred to Ashley Madison , which then shrewdly used it for advertising and to help debunk theories about why its service was supposedly untrustworthy ] .


The said technique brings the advantage of avoiding auto-start extensibility points ( ASEP ) scanners and programs that checks for binaries installed as service ( for the latter , the service chosen by FinFisher will show up as a clean Windows signed binary ) . The persistent use of social media to identify and manipulate victims indicates that COBALT GYPSY successfully achieves its objectives using this tactic . If the parent name matches , the malware will traverse the stack in order to find a return address that falls into the memory of the parent process’s text section . A Systemd service unit allows for a program to be run under certain conditions , and in this case , it was used to execute the GOGETTER binary on reboot .


The malware cleans the system event logs using OpenEventLog/ClearEventLog APIs , and then terminates the setup procedure with a call to StartService to run the stage 4 malware . COBALT GYPSY 's continued social media use reinforces the importance of recurring social engineering training . Next , the payload is read from the .png cover file , which seems to have been taken from an inspirational quotes website3 . In the case of ProxyNotShell , the targeted backend service is the Remote PowerShell service .


Figure 11 . SecureWorks Counter Threat Unit ( CTU ) researchers analyzed a phishing campaign that targeted a Middle Eastern organization in early January 2017 . In this instance , the payload is fully contained within the image’s pixel color codes , leaving no remaining data beyond the IEND marker . DOUBLEDRAG attempts to download a second - stage obfuscated PowerShell memory - only dropper , which Mandiant tracks as DOUBLEDROP , that will launch a backdoor into memory .


The DLL side-loaded stage 4 malware mimicking a real export table to avoid detection Stage 4 : The memory loader – Fun injection with GDI function hijacking Depending on how stage 4 was launched , two different things may happen : In the low-integrity case ( under UAC ) the installer simply injects the stage 5 malware into the bogus explorer.exe process started earlier and terminates In the high-integrity case ( with administrative privileges or after UAC bypass ) , the code searches for the process hosting the Plug and Play service ( usually svchost.exe SecureWorks® Counter Threat Unit™ ( CTU ) researchers analyzed a phishing campaign that targeted a Middle Eastern organization in early January 2017 . Finally , the loader will decrypt the payload to a memory buffer and overwrite the previously found return address with the pointer to that buffer , ensuring that the malicious shellcode will be executed when the DLL attempts to return to the caller . Examples of indicators of attack , and why they matter


) loaded in memory and injects itself into it For the second scenario , the injection process works like this : The malware opens the target service process . CTU analysis suggests this activity is related to Iranian threat actors closely aligned with or acting on behalf of the COBALT GYPSY threat group ( formerly labeled Threat Group-2889 ) . The loader embedded in the payload seems to be a variant of the Veil " shellcode_inject " payload , previously used by OceanLotus to load older versions of Remy backdoor . the malware uses and to get the function Address .


It allocates and fills four chunks of memory inside the service process . Since early 2014 , an attacker group of Iranian origin has been actively targeting persons of interest by means of malware infection , supported by persistent spear phishing campaigns . In this instance , the shellcode is configured to load an encoded backdoor from within the payload . OT asset owners leveraging IEC-104 compliant devices should take action to preempt potential in the wild deployment of COSMICENERGY .


One chunk contains the entire malware DLL code ( without PE headers ) . This cyber-espionage group was dubbed ' Rocket Kitten ' , and remains active as of this writing , with reported attacks as recent as October 2015 . The final payload comes in a form of a launcher DLL that contains an encrypted backdoor in its .rdata section and a plain-text configuration in its resources . Astamirov is now facing charges of wire fraud and of intentionally damaging protected computers , plus he 's accused of making ransom demands through deploying ransomware .


Another chunk is used to copy a basic Ntdll and Kernel32 import address table . Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East ( including targets inside Iran itself ) , as well as across Europe and in the United States . The resources also store one or more C2 communication modules . There is another important point we stole a fairly large amount of sensitive data from your local network financial documents personal information of your employees , customers , partners work documentation , postal correspondence and much more .


Two chunks are filled with an asynchronous procedure call ( APC ) routine code and a stub . The May 2014 ' Operation Saffron Rose ' publication identifies an Iranian hacking group formerly named ' Ajax Security ' ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) . The backdoor DLL and the C2 communication DLLs are heavily obfuscated using high quantities of junk code , which significantly inflates their size and makes both static analysis and debugging more difficult . Wind farms in central Europe and internet users were also affected .


It opens the service thread of the service process and uses the ZwQueueApcThread native API to inject an APC . An Iranian hacking group formerly named Ajax Security ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) . In addition to Denes and Remy backdoors , at least two different communication modules were observed with different versions of this launcher – DNSProvider and HTTPProv . The ThreatConnect Platform also offers workflows and lowcode automation to automate the analysis and response process of reported emails .


The APC routine creates a thread in the context of the svchost.exe process that will map and execute the stage 5 malware into the winlogon.exe process . The report specifies the Magic Hound targeted political , military and defense industry in the US , UK and Israel . The launcher binary , which contains the final backdoor , is RC4 encrypted and wrapped in a layer of obfuscated shellcode . Adversaries may manipulate control systems devices or possibly leverage their own , to communicate with and command physical control processes .


The injection method used for winlogon.exe is also interesting and quite unusual . ClearSky 's September 2014 blog post first described active attacks using a piece of malware they dubbed ' Gholee ' ( as appears in a malicious payload export function , potentially named after a popular Iranian singer9 ) . We can see the familiar DOS stub in plain text , but the rest of the header and binary body are encrypted . We have been documenting it recently and are reporting the abuse to Cloudflare which it uses to hide its real infrastructure .


We believe that this method is engineered to avoid trivial detection of process injection using the well-detected CreateRemoteThread or ZwQueueApcThread API . The Rocket Kitten attacker group 's main attack vector is spear-phishing . The shellcode is obfuscated using OceanLotus ’s standard approach of flattening the control flow and inserting junk opcodes ( as described in the ESET white paper on OceanLotus ) . For example , analysts need to consider during analysis whether the appliance is recording the true client IP addresses ( opposed to network address translation [ NAT ] addresses ) , and what normal user behavior looks like ( do users shift IP addresses frequently ) .


The malware takes these steps : Check if the system master boot record ( MBR ) contains an infection marker ( 0xD289C989C089 8-bytes value at offset 0x2C ) , and , if so , terminate itself Check again if the process is attached to a debugger ( using the techniques described previously ) Read , decrypt , and map the stage 5 malware ( written in the previous stage in msvcr90.dll ) Open winlogon.exe process Load user32.dll system library and read the KernelCallbackTable After learning of an active attack incident from the Rocket Kitten group on a customer network , Check Point researchers decided to actively join the investigation . The shellcode starts in a fairly standard way – by walking the list of loaded modules in order to find the base of kernel32.dll library . It is accessed using a path confusion exploit , CVE-2022 - 41040 , allowing the attacker to reach the backend for arbitrary URLs .


pointer from its own process environment block ( PEB ) ( Note : The KernelCallbackTable points to an array of graphic functions used by Win32 kernel subsystem module win32k.sys as call-back into user-mode . As described in previous publications , the Rocket Kitten attackers make extensive use of various phishing schemes . Once kernel32 base is found , the shellcode will calculate the addresses of LoadLibraryA and GetProcAddress functions , and use them to resolve other necessary APIs , which include VirtualAlloc , RtlMoveMemory , and RtlZeroMemory . Further analyses of these similarities are available via Mandiant Advantage .