If the user ignores or rejects the request , the window reopens every few seconds . TG-3390 sends spearphishing emails with ZIP archive attachments . The a binary is a script wrapper to start run , a Perl-obfuscated script for installation of a Shellbot to gain control of the infected system . Ransomware source code is a malicious program that contains the instructions and algorithms that define the ransomware ’s behavior .


The Trojan requests Device Administrator rights The Trojan requests permission to use AccessibilityService After installation , the Trojan starts communicating with the cybercriminals ’ C & C server . CTU researchers have observed TG-3390 compromising a target organization 's externally and internally accessible assets , such as an OWA server , and adding redirect code to point internal users to an external website that hosts an exploit and delivers malware . The Shellbot disguises itself as a process named rsync , commonly the binary seen on many Unix- and Linux-based systems to automatically run for backup and synchronization . Anonymous Sudan has targeted organizations associated with infrastructure and key services , including in government and private sectors .


All data is transmitted in JSON format ( after decryption ) . TG-3390 actors have used Java exploits in their SWCs . This allows the malicious activity to evade detection . The victims have been in the Americas , EMEA , and APJ as of writing .


It includes information about the smartphone model , the OS version , the mobile operator , and the Trojan version . In particular , TG-3390 has exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code . The Shellbot script is added to run after the victim ’s system reboots , and scripts /a/upd , /b/sync/ , and /c/aptitude/ are added to the crontab . CozyDuke droppers and spyware components often maintain fairly common characteristics , but the files ’ functionality is slightly modified depending on the actor ’s needs .


Let ’ s take an in-depth look at Asacub 5.0.3 , the most widespread version in 2018 . In activity analyzed by CTU researchers , TG-3390 executed the Hunter web application scanning tool against a target server running IIS . However , while we observed the presence of the codes , the functions of upd , sync and aptitude were disabled in the kits ’ latest version . This is just another example of how these groups can now quickly develop their own ransomware variants by standing on the shoulders of those criminals who had their previous work exposed publicly .


Structure of data sent to the server : To begin with , the Trojan sends information about the device to the server : In response , the server sends the code of the command for execution ( “ command ” ) , its parameters ( “ params ” ) , and the time delay before execution ( “ waitrun ” in milliseconds ) . In particular , the threat actors have exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code . It remains unclear whether these are leftover code from the previous versions or their particular purposes were served . As more actors enter this space , Cisco Talos is seeing an increasing number of ransomware variants emerge , leading to more frequent attacks and new challenges for cybersecurity professionals , particularly regarding actor attribution .


List of commands sewn into the body of the Trojan : Command code Parameters Actions 2 – Sending a list of contacts from the address book of the infected device to the C & C server 7 “ to ” : int Calling the specified number 11 “ to ” : int , “ body ” : string Sending an SMS with the specified text to the specified number 19 “ text ” : string , “ n ” : string Sending SMS with the specified text to numbers from the address book of the infected device , with the name of the addressee from the TG-3390 uses DLL side loading , a technique that involves running a legitimate , typically digitally signed , program that loads a malicious DLL . Shellbot is also used to control the botnet , with a command that is sent and run from the C&C to determine if there is a code execution in the shell , the hostname , and its architecture . None Deploy advanced endpoint detection and response ( EDR ) tools to all endpoints to detect web services spawning PowerShell or command line processes .


address book substituted into the message text 40 “ text ” : string Shutting down applications with specific names ( antivirus and banking applications ) The set of possible commands is the most significant difference between the various flavors of Asacub . CTU researchers have observed the Threat Group-3390 employing legitimate Kaspersky antivirus variants in analyzed samples . All results and system information collected from the infected system are stored locally in the device for a period before Outlaw retrieves them via the C&C . The first , CVE-2022 - 41123 , has been revealed by ZDI to be DLL hijacking3 due to the loading of a non - existent component by a privileged executed command .


In the 2015-early 2016 versions examined in this article , C & C instructions in JSON format contained the name of the command in text form ( “ get_sms ” , “ block_phone ” ) . The adversaries have used this technique to allow PlugX and HTTPBrowser to persist on a system . We also found traces of Android Package Kits- ( APK- ) and Android Debug Bridge ( ADB )-based commands that enable cryptocurrency mining activities in Android-based TVs . The US Justice Department thinks he 's been deploying LockBit ransomware on victim networks both in the States and overseas , with the investigation having run from August 2020 through March 2023 .


In later versions , instead of the name of the command , its numerical code was transmitted . CTU researchers have observed the TG-3390 employing legitimate Kaspersky antivirus variants in analyzed samples . Since discovering the operations of this group in 2018 , Outlaw continues to use scripts , codes , and commands that have been previously used and deployed . For Snort coverage that can detect the exploitation of these vulnerabilities , download the latest rule sets from Snort.org , and our latest Vulnerability Advisories are always posted on Talos Intelligence ’s website .


The same numerical code corresponded to one command in different versions , but the set of supported commands varied . TG-3390 actors have deployed the OwaAuth web shell to Exchange servers , disguising it as an ISAPI filter . These routines are indicative of the group ’s aim to get quantitative returns through varied cybercriminal profit streams . In November 2016 , Volexity documented new Dukes - related activity involving spear phishing with links to a ZIP archive containing a malicious LNK file , which would run PowerShell commands to install a new custom backdoor called PowerDuke .


For example , version 9.0.7 ( 2017 ) featured the following set of commands : 2 , 4 , 8 , 11 , 12 , 15 , 16 , 17 , 18 , 19 , 20 . In other cases , threat actors placed web shells on externally accessible servers , sometimes behind a reverse proxy , to execute commands on the compromised system . This was also reinforced by their naming conventions , wherein different versions are simply named after the code iterations , following a specific format regardless of the actual function of the code . But a layered , comprehensive cyber security strategy can do even more to keep your organization safe and secure .


After receiving the command , the Trojan attempts to execute it , before informing C & C of the execution status and any data received . CTU researchers have discovered numerous details about TG-3390 operations , including how the adversaries explore a network , move laterally , and exfiltrate data . Furthermore , based on the group ’s use of dated exploits as vectors that companies would have likely addressed with monitoring and regular patching schedules , it appears that they ’re going after enterprises who have yet to patch their systems , as well as companies with internet-facing systems with weak to no monitoring of traffic and activities . Last month , NoEscape posted 7 victims on their leak site .


The “ id ” value inside the “ data ” block is equal to the “ timestamp ” value of the relevant command : In addition , the Trojan sets itself as the default SMS application and , on receiving a new SMS , forwards the sender ’ s number and the message text in base64 format to the cybercriminal : Thus , Asacub can withdraw funds from a bank card linked to the phone by sending SMS for the transfer of funds to another account using the number of the card or mobile phone . When the adversaries' operations are live , they modify the record again to point the C2 domain to an IP address they can access . Considering the amount of resources needed to deploy all the necessary patches for an enterprise ( such as quality testing and operations alignment ) , which implies costly downtime for operations and the hesitation to update all systems immediately , Outlaw may find even more targets and victims for their updated botnets every time there is a patch released and waiting to be downloaded . While no substantive posts have been made to the FuckNATO channel since late April 2023 , Mandiant anticipates that KillNet and its affiliates will continue to target NATO for the continued future , with the potential for developments in the war in Ukraine to reinvigorate targeting .


Moreover , the Trojan intercepts SMS from the bank that contain one-time passwords and information about the balance of the linked bank card . They then identify the Exchange server and attempt to install the OwaAuth web shell . Save for a few iteration updates , combinations from previous deployments , and using the routines repetitively for every campaign , we found very little changes in the group ’s toolkit , which allowed various honeypots across the Eastern European region to detect many of the sent binaries . The NCSC also assesses that it is almost certain Russia was responsible for the subsequent cyber - attack impacting Viasat on 24 February .


Some versions of the Trojan can autonomously retrieve confirmation codes from such SMS and send them to the required number . If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail , TG-3390 identify other externally accessible servers and deploy ChinaChopper web shells . Meanwhile , the group uses a wide range of IP addresses as input for scanning activities that are grouped by country , allowing them to attack certain regions or areas within particular periods of the year , as previously observed . This could indicate a lack of coordination across different individuals or operational subteams involved in the attack .


What ’ s more , the user can not check the balance via mobile banking or change any settings there , because after receiving the command with code 40 , the Trojan prevents the banking app from running on the phone . After compromising an initial victim 's system ( patient 0 ) , the threat actors use the Baidu search engine to search for the victim 's organization name . We think the group has likely become more enterprising , and learned to take advantage of some details from their previous campaigns to maximize profit opportunities while exerting minimal effort . CrowdStrike Services recently investigated several Play ransomware intrusions where the common entry vector was suspected to be the Microsoft Exchange ProxyNotShell vulnerabilities CVE-2022 - 41040 and CVE-2022 - 41082 .


User messages created by the Trojan during installation typically contain grammatical and spelling errors , and use a mixture of Cyrillic and Latin characters . CTU researchers discovered the threat actors searching for " [company] login " , which directed them to the landing page for remote access . By shaping the attack , the group may be able to create niches in the underground , catering to the specific needs of their customers . Will Harrison was terminated as an Ashley Madison employee in November 2011 , and by early 2012 he ’d turned his considerable harassment skills squarely against the company .


The Trojan also employs various obfuscation methods : from the simplest , such as string concatenation and renaming of classes and methods , to implementing functions in native code and embedding SO libraries in C/C++ in the APK file , which requires the use of additional tools or dynamic analysis for deobfuscation , since most tools for static analysis of Android apps support only Dalvik bytecode . TG-3390 actors keep track of and leverage existing ASPXTool web shells in their operations , preferring to issue commands via an internally accessible web shell rather than HTTPBrowser or PlugX . Also aware of the existing laws in Europe , they can avoid prosecution in certain countries as long as they avoid attacking them . The high similarity of the fake job recruitment campaigns both groups used to disguise their attacks , and the fact that Lazarus relied on similar versions of Rising Sun in activity tracked in 2017 , point to a connection between the two adversaries .


In some versions of Asacub , strings in the app are encrypted using the same algorithm as data sent to C & C , but with different keys . Within six hours of entering the environment , the threat actors compromised multiple systems and stole credentials for the entire domain . Collection of results and data from scanning in this manner might be easier to sort ( while allowing them to stay under the radar ) , as compared to getting feedback from zombie bots deployed around the world simultaneously . That Budworm continues to use a known malware SysUpdate , alongside techniques it is known to favor , such as DLL sideloading using an application it has used for this purpose before , indicate that the group is nt too concerned about having this activity associated with it if it is discovered .


Example of using native code for obfuscation Examples of using string concatenation for obfuscation Example of encrypting strings in the Trojan Asacub distribution geography Asacub is primarily aimed at Russian users : 98 % of infections ( 225,000 ) occur in Russia , since the cybercriminals specifically target clients of a major Russian bank . Despite multiple public disclosures of their activities , BRONZE UNION remains an active and formidable threat as of this publication . We will continue to monitor this hacking group ’s activities and their toolkit ’s developments . Threat actors typically register and use several domains in order to discretely lead their malware to their Command and Control ( C&C ) servers .


The Trojan also hit users from Ukraine , Turkey , Germany , Belarus , Poland , Armenia , Kazakhstan , the US , and other countries . In 2015 , the SecureWorks® Counter Threat Unit™ ( CTU ) research team documented the BRONZE UNION threat group ( formerly labeled TG-3390 ) , which CTU™ analysis suggests is based in the People's Republic of China ( PRC ) . Outlaw ’s attack routines may not be new , but it still serves as a reminder for enterprises to update their systems regularly . Part of this can be explained by the fact that 8BASE disproportionately attacked Brazil with 11 attacks last month , while PLAY focused on Switzerland ( 5 ) .


Conclusion The case of Asacub shows that mobile malware can function for several years with minimal changes to the distribution scheme . After reestablishing access , the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used . Legacy system users may use their providers ’ virtual patches . It now appears those attacks were perpetrated by Harrison , who sent emails from different accounts at the free email service Vistomail pretending to be Bradshaw , his then - girlfriend and their friends .


It is basically SMS spam : many people still follow suspicious links , install software from third-party sources , and give permissions to apps without a second thought . In 2015 , the SecureWorks documented the BRONZE UNION threat group ( formerly labeled TG-3390 ) , which CTU analysis suggests is based in the People's Republic of China ( PRC ) . Users are advised to close unused ports , to secure ports and other internet-facing devices that are regularly open for system administrators ’ support . These frameworks are commonly delivered as part of traditional commodity malware , so infection chains can vary widely .


At the same time , cybercriminals are reluctant to change the method of communication with the C & C server , since this would require more effort and reap less benefit than modifying the executable file . BRONZE UNION threat campaigns that illustrate the evolution of the group 's methods and espionage objectives . Users can also adopt a multilayered security solution that can protect systems from the gateway to the endpoint , actively blocking malicious URLs by employing filtering , behavioral analysis , and custom sandboxing . Later in the month , Microsoft officially confirmed that numerous outages of its products were a direct result of DDoS attacks conducted by Anonymous Sudan .


The most significant change in this particular Trojan ’ s history was the encryption of data sent between the device and C & C . Based on BRONZE UNION 's targeting activity , CTU researchers assess it is highly likely that the group focuses on political and defense organization networks . Users can consider adopting security solutions that can defend against malicious bot-related activities such as Outlaw ’s through a cross-generational blend of threat defense techniques . Adversaries may also use CLIs to install and run new software , including malicious tools that may be installed over the course of an operation .


That said , so as to hinder detection of new versions , the Trojan ’ s APK file and the C & C server domains are changed regularly , and the Trojan download links are often one-time-use . this SWC was used to specifically target Turkish . Trend Micro™ XGen™ security provides high-fidelity machine learning that can secure the gateway and endpoints , and protect physical , virtual , and cloud workloads . Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality , or without the logical preconditions to trigger their expected function .


IOCs C & C IP addresses : 155.133.82.181 155.133.82.240 155.133.82.244 185.234.218.59 195.22.126.160 195.22.126.163 195.22.126.80 195.22.126.81 5.45.73.24 5.45.74.130 IP addresses from which the Trojan was downloaded : 185.174.173.31 185.234.218.59 188.166.156.110 195.22.126.160 195.22.126.80 195.22.126.81 In 2016 , the threat actors conducted a strategic web compromise ( SWC ) on the website of an international industry organization that affected aerospace , academic , media , technology , government , and utilities organizations around the world . With technologies that employ web/URL filtering , behavioral analysis , and custom sandboxing , XGen security offers protection against ever-changing threats that bypass traditional controls and exploit known and unknown vulnerabilities . Talos discovered multiple vulnerabilities in Foxit PDF Reader that could allow an adversary to execute , arbitrary code on the targeted machine .


195.22.126.82 195.22.126.83 SHA256 : 158c7688877853ffedb572ccaa8aa9eff47fa379338151f486e46d8983ce1b67 3aedbe7057130cf359b9b57fa533c2b85bab9612c34697585497734530e7457d f3ae6762df3f2c56b3fe598a9e3ff96ddf878c553be95bacbd192bd14debd637 df61a75b7cfa128d4912e5cb648cfc504a8e7b25f6c83ed19194905fef8624c8 In addition , BRONZE UNION activity on multiple U.S.-based defense manufacturer networks included the threat actors seeking information associated with aerospace technologies , combat processes , and naval defense systems . A multi-layered connected network defense and complete visibility into all network traffic , in addition to next-generation intrusion prevention system ( NGIPS ) , can help organizations stay a step ahead of threats that could compromise intangible assets . It is foreseeable that an organization such as the Earth Liberation Front ELF may attempt an attack to make a political or social statement while the same organization could be targeted by an adversarial nation state in an attempt to steal intellectual property .


c0cfd462ab21f6798e962515ac0c15a92036edd3e2e63639263bf2fd2a10c184 d791e0ce494104e2ae0092bb4adc398ce740fef28fa2280840ae7f61d4734514 38dcec47e2f4471b032a8872ca695044ddf0c61b9e8d37274147158f689d65b9 27cea60e23b0f62b4b131da29fdda916bc4539c34bb142fb6d3f8bb82380fe4c this SWC was used to specifically target Turkish goverment . XGen security also powers Trend Micro ’s suite of security solutions : Hybrid Cloud Security and User Protection . We initially tracked this activity as UNC3810 before merging the cluster with Sandworm .


31edacd064debdae892ab0bc788091c58a03808997e11b6c46a6a5de493ed25d 87ffec0fe0e7a83e6433694d7f24cfde2f70fc45800aa2acb8e816ceba428951 eabc604fe6b5943187c12b8635755c303c450f718cc0c8e561df22a27264f101 Kernel Backdoor found in Gadgets Powered by Popular Chinese ARM Since that analysis , CTU researchers have observed multiple BRONZE UNION threat campaigns that illustrate the evolution of the group 's methods and espionage objectives . Outlaw : 1800de5f0fb7c5ef3c0d9787260ed61bc324d861bc92d9673d4737d1421972aa Cryptocurrency miner Trojan.SH.MALXMR.UWEJP . In addition , individuals like Hack520 prove that these threat actors are composed of varied individuals who have their own set of expertise .


Maker May 12 , 2016 Mohit Kumar How to Hack an Android device ? this SWC was used to specifically target Turkish banking . Outlaw : b68bd3a54622792200b931ee5eebf860acf8b24f4b338b5080193573a81c747d Shellbot Backdoor.SH.SHELLBOT.AA . To prevent ProxyNotShell exploitation on older Microsoft Exchange servers , Microsoft released a blog4 advocating for a custom inside the Microsoft IIS server supporting Exchange .


It is possibly one of the most frequently asked questions on the Internet . this SWC was used to specifically target Turkish academic networks . Outlaw : 620635aa9685249c87ead1bb0ad25b096714a0073cfd38a615c5eb63c3761976 Tool Trojan.Linux.SSHBRUTE.B . In one exchange on Aug. 16 , 2012 , Ashley Madison ’s director of IT was asked to produce a list of all company employees with all - powerful administrator access .


Although it 's not pretty simple to hack Android devices and gadgets , sometimes you just get lucky to find a backdoor access . BRONZE UNION has consistently demonstrated the capability to conduct successful large-scale intrusions against high-profile networks and systems . Outlaw : fc57bd66c27066104cd6f8962cd463a5dfc05fa59b76b6958cddd3542dfe6a9a Cryptocurrency miner Coinminer.Linux.MALXMR.SMDSL32 . What prompted the data scientist Bullock to reach out were gobs of anti - Semitic diatribes from Harrison , who had taken to labeling Biderman and others “ greedy Jew bastards . ”


Thanks to Allwinner , a Chinese ARM system-on-a-chip maker , which has recently been caught shipping a version of Linux Kernel with an incredibly simple and easy-to-use built-in backdoor . The threat actors appear to be able to create and leverage multiple SWCs in parallel . Outlaw : 649280bd4c5168009c1cff30e5e1628bcf300122b49d339e3ea3f3b6ff8f9a79 Cryptocurrency miner Coinminer.Linux.MALXMR.SMDSL64 . The series also touches on shocking new details unearthed by KrebsOnSecurity and Jeremy Bullock , a data scientist who worked with the show ’s producers at the Warner Bros. production company Wall to Wall Media .


Chinese fabless semiconductor company Allwinner is a leading supplier of application processors that are used in many low-cost Android tablets , ARM-based PCs , set-top boxes , and other electronic devices worldwide . In a separate incident , CTU researchers identified a file named s.txt , which is consistent with the output of the Netview host-enumeration tool . Outlaw : 159.203.141.208 . The hosting services offered at secure[.]66[.]to are in fact hosting services rented to other companies worldwide .


Simple Backdoor Exploit to Hack Android Devices All you need to do to gain root access of an affected Android device is… Send the text " rootmydevice '' to any undocumented debugging process . BRONZE UNION actors leveraged initial web shell access on Internet-facing systems to conduct internal reconnaissance . Outlaw : 104.236.192.6 . CrowdStrike incident responders found that renamed Plink and AnyDesk executable creation timestamps on affected backend Exchange servers were closely correlated with PowerShell execution events in the Remote PowerShell logs , indicating the threat actor leveraged the newly discovered exploit chain to drop other tooling for persistent access to the affected Exchange servers .


The local privileges escalation backdoor code for debugging ARM-powered Android devices managed to make its way in shipped firmware after firmware makers wrote their own kernel code underneath a custom Android build for their devices , though the mainstream kernel source is unaffected . BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control ( C2 ) and operational infrastructure . Outlaw : 45.9.148.129:80 Miner pool . Threat actors are always looking to expand the strategies they use , thus security practices and solutions that work for less organized cybercriminals might not work for determined groups who are willing to spend time , resources and manpower to accomplish their goals .


The backdoor code is believed to have been left by mistake by the authors after completing the debugging process . This script relays commands and output between the controller and the system . Outlaw : 45.9.148.125:80 Miner pool . The increasing usage of bring your own device BYOD in hybrid work environments has changed the technology landscape for organizations .


For exploiting this issue , any process running with any UID can be converted into root easily by simply using the following command : echo " rootmydevice '' > /proc/sunxi_debug/sunxi_debug The Linux 3.4-sunxi kernel was originally designed to support the Android operating system on Allwinner ARM for tablets , but later it was used to port Linux to many Allwinner processors on boards like Banana Pi micro-PCs , Orange Pi , and other devices . The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server ( systsm.webServer/httplogging ) and then delete existing logs from the system ( see Figure 4 ) . Outlaw : http://www.minpop.com/sk12pack/idents.php Command and control . The file collected system information , and then invoked a WMI instance in the rootsecuritycenter namespace to identify security products installed on the system before dropping more data collection malware .


At the forum of the Armbian operating system , a moderator who goes by the name Tkaiser noted that the backdoor code could remotely be exploitable " if combined with networked services that might allow access to /proc . In 2016 , CTU researchers observed the group using native system . Outlaw : http://www.minpop.com/sk12pack/names.php Command and control . “ Who or what is asdfdfsda@asdf.com ? , ” Biderman asked , after being sent a list of nine email addresses .


'' This security hole is currently present in every operating system image for A83T , H3 or H8 devices that rely on kernel 3.4 , he added . In March 2018 we detected an ongoing campaign . Winnti Group targeting universities in Hong Kong . Once a system was exploited a unique downloader was dropped onto the victim ’s disk , containing a customized micro backdoor written in Assembler .


This blunder made by the company has been frustrating to many developers . TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems . In November 2019 , we discovered a new campaign run by the Winnti Group against two Hong Kong universities . The discovery of COSMICENERGY illustrates that the barriers to entry for developing offensive OT capabilities are lowering as actors leverage knowledge from prior attacks to develop new malware .


Allwinner has also been less transparent about the backdoor code . As of this publication , BRONZE UNION remains a formidable threat group that targets intellectual property and executes its operations at a swift pace . We found a new variant of the ShadowPad backdoor , the group ’s flagship backdoor , deployed using a new launcher and embedding numerous modules . This convinced the user it was safe to download files once logged in .


David Manouchehri released the information about the backdoor through its own Github account ( Pastebin ) and then apparently deleted it . we detected an ongoing campaign targeting a national data center . The Winnti malware was also found at these universities a few weeks prior to ShadowPad . In addition , individuals like Hack520 prove that these threat actors are composed of varied individuals who have their own set of expertise .


Mobile Malware Evolution : 2013 24 FEB 2014 The mobile malware sector is growing rapidly both technologically and structurally . The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool ( RAT ) . The Winnti Group , active since at least 2012 , is responsible for for high-profile supply-chain attacks against the video game and software industries leading to the distribution of trojanized software ( such as CCleaner , ASUS LiveUpdate and multiple video games ) that is then used to compromise more victims . Method , where the code checks one of two values before running encryption logic


It is safe to say that today ’ s cybercriminal is no longer a lone hacker but part of a serious business operation . we detected an ongoing campaign targeting a national data center in the Centeral Asia . It is also known for having compromised various targets in the healthcare and education sectors . The attackers first attempted to use the LockBit ransomware but when that was blocked , they resorted to 3AM instead .


There are various types of actors involved in the mobile malware industry : virus writers , testers , interface designers of both the malicious apps and the web pages they are distributed from , owners of the partner programs that spread the malware , and mobile botnet owners . The tools found in this campaign , such as the HyperBro Trojan , are regularly used by a variety of Chinese-speaking actors . ESET researchers recently published a white paper updating our understanding of the arsenal of the Winnti Group , following a blog post documenting a supply-chain attack targeting the videogame industry in Asia . Two examples are Windows Sysinternals SDelete and Active@ Killdisk .


This division of labor among the cybercriminals can also be seen in the behavior of their Trojans . Due to tools and tactics in use we attribute the campaign to LuckyMouse Chinese-speaking actor ( also known as EmissaryPanda and APT27 ) . Additionally , we published a blog post on a new backdoor named skip-2.0 that targets Microsoft SQL Server . This fact was apparently unknown to Biderman and other Ashley Madison executives more than a year later when their July 2015 hack was first revealed .


In 2013 , there was evidence of cooperation ( most probably on a commercial basis ) between different groups of virus writers . It's possible TG-3390 used a waterhole to infect data center employees . This article focuses on the technical details of this new ShadowPad variant . Protecting your information and systems from every vantage point , including your networks , devices , applications , transmissions , privileges , and storage is critical , as is regularly training your staff on the latest cyber threats , trends , and ransomware phishing attacks .


For example , the botnet Trojan-SMS.AndroidOS.Opfake.a , in addition to its own activity , also spread Backdoor.AndroidOS.Obad.a by sending spam containing a link to the malware to the victim ’ s list of contacts . Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 ( Microsoft Office Equation Editor , widely used by Chinese-speaking actors since December 2017 ) , we can′t prove they were related to this particular attack . About the “ Winnti Group ” naming : After gaining access to a victim network , UNC2452 has a light malware footprint , often using legitimate credentials to access data and move laterally .


It is now clear that a distinct industry has developed and is becoming more focused on extracting profits , which is clearly evident from the functionality of the malware . We suspect this router was hacked as part of the campaign in order to process the malware 's HTTP requests . We have chosen to keep the name “ Winnti Group ” since it ’s the name first used to identify it , in 2013 , by Kaspersky . As we commonly see in the ransomware space , this threat is delivered through a variety of mechanisms which can include phishing and being dropped as secondary payloads from command and control ( C2 ) frameworks like Cobalt Strike .


2013 in figures A total of 143,211 new modifications of malicious programs targeting mobile devices were detected in all of 2013 ( as of January 1 , 2014 ) . In March 2017 , Wikileaks published details about an exploit affecting Mikrotik called ChimayRed . Since Winnti is also a malware family , we always write “ Winnti Group ” when we refer to the malefactors behind the attacks . TIEDYE has similarities to RABBITHUNT , which is a backdoor written in C++ that communicates via a custom binary protocol over TCP .


In 2013 , 3,905,502 installation packages were used by cybercriminals to distribute mobile malware . There were traces of HyperBro in the infected data center from mid-November 2017 . Since 2013 , it has been demonstrated that Winnti is only one of the many malware families used by the Winnti Group . Once the initial export is called ( in this case , the legitimately named function IETrackingProtectionEnabled ) , the downloader will copy itself and call regsvr32.exe with parameters “ /u /s ” to automatically call the function for unregistering COM servers DllUnregisterServer .


Overall in 2012-2013 we detected approximately 10,000,000 unique malicious installation packages : Different installation packages can install programs with the same functionality that differ only in terms of the malicious app interface and , for instance , the content of the text messages it spreads . In March 2017 , Wikileaks published details about an exploit affecting Mikrotik called ChimayRed . In November 2019 , ESET ’s machine-learning engine , Augur , detected a malicious and unique sample present on multiple computers belonging to two Hong Kong universities where the Winnti malware had already been found at the end of October . [ As the documentary points out , the domain AshleyMadisonSucks.com was eventually transferred to Ashley Madison , which then shrewdly used it for advertising and to help debunk theories about why its service was supposedly untrustworthy ] .


Android remains a prime target for malicious attacks . This is a hacking group with Chinese origins which targets selected organisations related with education , energy and technology . The suspicious sample detected by Augur is actually a new 32-bit ShadowPad launcher . The malware then checks the command execution functionality using a command that vary across the samples .


98.05 % of all malware detected in 2013 targeted this platform , confirming both the popularity of this mobile OS and the vulnerability of its architecture . Usually , the delivered payload is either the well-known ' PlugX ' or ' HTTPBrowser ' RAT , a tool which is believed to have Chinese origins and to be used only by certain Chinese hacking groups . Samples from both ShadowPad and Winnti found at these universities contain campaign identifiers and C&C URLs with the names of the universities , which indicates a targeted attack . The way Hack520 signs his messages in one hacker forum provides a clue pointing to this connection .


Most mobile malware is designed to steal users ’ money , including SMS-Trojans , and lots of backdoors and Trojans . Emissary Panda has used many ways with the most notable being the exploits from the Hacking Team leak . In addition to the two compromised universities , thanks to the C&C URL format used by the attackers we have reasons to think that at least three additional Hong Kong universities may have been compromised using these same ShadowPad and Winnti variants . Further , NIST does not endorse any commercial products that may be mentioned on these sites .


Over the year , the number of mobile malware modifications designed for phishing , the theft of credit card information and money increased by a factor of 19.7 . Emissary Panda is still active and continues to target selected organisations . This campaign of the Winnti Group against Hong Kong universities was taking place in the context of Hong Kong facing civic protests that started in June 2019 triggered by an extradition bill . For example , the report shows that the US shouldered a hefty 43 percent of all global attacks and that ransomware attacks in France nearly doubled in the last five months .


In 2013 , Kaspersky Lab mobile products prevented 2,500 infections by banking Trojans . Cybersecurity researchers have uncovered an espionage campaign that has targeted a national data center of an unnamed central Asian country in order to conduct watering hole attacks . Even though the bill was withdrawn in October 2019 , protests continued , demanding full democracy and investigation of the Hong Kong police . STRATOFEAR contains an embedded configuration that includes two file paths .


Methods and techniques 2013 not only saw a radical increase in output from mobile virus writers but also saw them actively applying methods and technologies that allowed cybercriminals to use their malware more effectively . The campaign is believed to be active covertly since fall 2017 . These protests gathered hundreds of thousands of people in the streets with large support from students of Hong Kong universities , leading to multiple university campus occupations by the protesters . PIEHOP utilizes LIGHTWORK to execute the IEC-104 commands " ON ” or " OFF " on the remote system and immediately deletes the executable after issuing the commands .


There were several distinct areas where mobile malware underwent advances . LuckyMouse , also known as Iron Tiger , EmissaryPanda , APT 27 and Threat Group-3390 , is the same group of Chinese hackers who was found targeting Asian countries with Bitcoin mining malware early this year . We have contacted the compromised universities and provided the necessary information and assistance to remediate the compromise . Additional attacker backdoors identified on systems with names that masquaraded as legitimate binaries and also produced AOT files upon translation ( e.g. , npx - cli and npx-cli.aot ) .


Distribution Cybercriminals made use of some exceptionally sophisticated methods to infect mobile devices . March by security researchers from Kaspersky Labs . Unlike previous ShadowPad variants documented in our white paper on the arsenal of the Winnti Group , this launcher is not obfuscated using VMProtect . Victims of the campaign , which researchers named Out to Sea PDF , include diplomatic organizations , technology companies , and medical organizations in Israel , Tunisia , and the UAE .


Infecting legal web resources help spread mobile malware via popular websites . For example , at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network . Furthermore , the encrypted payload is neither embedded in the overlay nor located in a COM1:NULL.dat alternate data stream . If implemented correctly , PIEHOP can connect to a user supplied remote MSSQL server for uploading LIGHTWORK and issuing remote commands specifically targeting RTU , and then delete itself .


More and more smartphone and tablet owners use their devices to access websites , unaware that even the most reputable resources can be hacked . The group has been active since at least 2010 and was behind many previous attack campaigns resulting in the theft of massive amounts of data from the directors and managers of US-based defense contractors . And the usual RC5 encryption with a key derived from the volume ID of the system drive of the victim machine ( as seen in the PortReuse backdoor , skip-2.0 and some ShadowPad variants ) is not present either . They will frequently compromise a system to then place the hidden service on that particular system .


According to our data , 0.4 % of the websites visited by users of our products were compromised sites . attacks to a Chinese-speaking threat actor group called LuckyMouse . In this case , the launcher is much simpler . What makes COSMICENERGY unique is that based on our analysis , a contractor may have developed it as a red teaming tool for simulated power disruption exercises hosted by Rostelecom - Solar , a Russian cyber security company .


Distribution via alternative app stores . LuckyMouse has been spotted using a widely used Microsoft Office vulnerability ( CVE-2017-11882 ) . The launcher is a 32-bit DLL named hpqhvsei.dll , which is the name of a legitimate DLL loaded by hpqhvind.exe . In one of our previous blog entries , we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming , pharmaceutical , and telecommunications companies .


In Asia there are numerous companies producing Android-based devices and Android apps , and many of them offer users their own app stores containing programs that can not be found in Google Play . This time the group chose a national data center as its target from an unnamed country in Central Asia in an attempt to gain " access to a wide range of government resources at one fell swoop " . This executable is from HP and is usually installed with their printing and scanning software called “ HP Digital Imaging ” . So , instead of wasting time trying to figure out what is going on , I debugged the script using the browser .


The purely nominal control over the applications uploaded to these stores means attackers can conceal Trojans in apps made to look like innocent games or utilities . The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center . In this case the legitimate hpqhvind.exe was dropped by the attackers , along with their malicious hpqhvsei.dll , in C:\Windows\Temp . KillNet has remained relatively consistent in its targeting of Ukraine ’s supporters and prioritization of DDoS attacks since Russia invaded in February 2022 , and despite new capabilities , the collective has hardly altered its targeting patterns .


Distribution via botnets . According to the researchers , the group injected malicious JavaScript code into the official government websites associated with the data center in order to conduct watering hole attacks . Although we do not have the component that dropped and executed this launcher , the presence of these files leads us to think that the initial execution of this launcher is done through DLL side-l S-TOOLoading . Monitor MSSQL Servers with access to OT systems and networks for evidence of : • Reconnaissance and enumeration activity of MSSQL servers and credentials .


As a rule , bots self-proliferate by sending out text messages with a malicious link to addresses in the victim ’ s address book . the targeted system with a piece of malware called HyperBro , a Remote Access Trojan ( RAT ) . When the malicious DLL is loaded at hpqhvind.exe startup , its DLLMain function is called that will check its parent process for the following sequence of bytes at offset 0x10BA . It crafts configurable IEC-104 ASDU messages , to change the state of RTU IOAs to ON or OFF .


We also registered one episode of mobile malware spreading via a third-party botnet . The main command and control ( C&C ) server used in this attack is hosted on an IP address which belongs to a Ukrainian ISP , specifically to a MikroTik router running a firmware version released in March 2016 . In the case where the parent process is hpqhvind.exe , this sequence of bytes is present at this exact location and the malicious DLL will proceed to patch the parent process in memory . Sometimes this was a high profile , legitimate site such as ‘ diplomacy.pl ’ hosting a ZIP archive .


Resistance to anti-malware protection The ability of malicious software to operate continuously on the victim ’ s mobile device is an important aspect of its development . the targets of the hacking group were in the automotive . It replaces the original instructions at 0x10BA with an unconditional jump ( jmp – 0xE9 ) to the address of the function from hpqhvsei.dll that decrypts and executes the encrypted payload embedded in the launcher . In 2015 GReAT reported that CozyDuke often spear phishes targets with emails containing a link to a hacked website .


The longer a Trojan “ lives ” on a smartphone , the more money it will make for the owner . Dell SecureWorks researchers unveiled a report on Threat Group-3390 that has targeted companies around the world while stealing massive amounts of industrial data . The decompiled function responsible for patching the parent process . In fact , they often drive one another to complete more complicated hacks .


This is an area where virus writers are actively working , resulting in a large number of technological innovations . The group , believed to be based in China , has also targeted defense contractors , colleges and universities , law firms , and political organizations — including organizations related to Chinese minority ethnic groups . In case hpqhvsei.dll is loaded by a different process than hpqhvind.exe , the malicious code will not be decrypted and executed . Indicators of Attack are different from Indicators of Compromise IoC , the latter describing evidence of compromised network security .


Criminals are increasingly using obfuscation , the deliberate act of creating complex code to make it difficult to analyze . LAS VEGAS—Today at the Black Hat information security conference , Dell SecureWorks researchers unveiled a report on a newly detected hacking group that has targeted companies around the world while stealing massive amounts of industrial data . The difference between the original and patched hpqhvind.exe . Paired with KillNet ’s reported compromise and leak of North Atlantic Treaty Organization ( NATO ) documents , this sudden increase in capability could indicate significant investment from more sophisticated actors , particularly when measured against KillNet ’s capabilities since the collective ’s inception in late 2021 .


The more complex the obfuscation , the longer it will take an antivirus solution to neutralize the malicious code . Designated as Threat Group 3390 and nicknamed " Emissary Panda " by researchers , the hacking group has compromised victims' networks largely through " watering hole " attacks launched from over 100 compromised legitimate websites , sites picked because they were known to be frequented by those targeted in the attack . The part of the code that is patched is located at the very beginning of the main function of hpqhvind.exe . Once a system was exploited a unique downloader was dropped onto the victim ’s disk , containing a customized micro backdoor written in Assembler .


Tellingly , current virus writers have mastered commercial obfuscators . the United Kingdom had data stolen by members of Emissary Panda . The patched code is located right after the load of hpqhvsei.dll . Additionally , the IP address 198.244.135[.]250 is being utilized for another C2 domain prontoposer[.]com while still having a PTR record to the domain previously identified .


This implies they have made considerable investments . the US had data stolen by members of Emissary Panda . This means that the function responsible for decrypting and executing the payload is executed directly after the load of the malicious DLL . LIGHTWORK utilizes positional command line arguments for target device , port , and IEC-104 command .


For example , one commercial obfuscator , which cost €350 , was used for Trojans and Opfak.bo Obad.a Android vulnerabilities are used by criminals for three reasons : to bypass the code integrity check when installing an application ( vulnerability Master Key ) ; to enhance the rights of malicious applications , considerably extending their capabilities ; and to make it more difficult to remove malware . No zero-day vulnerabilities were used to breach targeted networks , instead " TG-3390 relied on old vulnerabilities such as CVE-2011-3544 " — a near-year-old Java security hole — " and CVE-2010-0738 to compromise their targets " , Dell SecureWorks' researchers reported . The encrypted payload is located in the .rdata section of hpqhvsei.dll and the decryption algorithm is an XOR loop where the XOR key is updated at each iteration . WithSecure has identified instances where the malware was delivered to victims through LinkedIn .


For example , Svpeng uses a previously unknown vulnerability to protect itself from being removed manually or by the antivirus program . The group used a number of tools common to other Chinese hacking groups , but they had a few unique tools of their own with interfaces developed for Standard ( Simplified ) Chinese . The decrypted payload is the usual shellcode responsible for ShadowPad initialization ( obfuscated using fake conditional jumps to hinder disassembly ) . The threat of Iranian cyber operations continues to rise as challenges in relation to the renewal of the 2015 Iranian Nuclear Deal persist and regional tensions , specifically between Israel and Iran , escalate .


Cybercriminals also exploit the Master Key vulnerability and have learned to embed unsigned executable files in Android installation packages . If the address falls within ranges that the attackers are interested in , the malicious site waits for their next page view to drop an exploit on the desirable target 's PC . After having been decrypted , ShadowPad ’s shellcode is executed . But then , following an upsurge in attacks in the second half of 2014 , GReAT characterized MiniDuke , CosmicDuke and the actor ’s Nemesis Gemina project - targeting government , diplomatic , energy , military and telecom operators - as ‘ one of the world ’s most unusual APT operations ’ due to : • Its use of a customized backdoor written in Assembler using ‘ old school ’ virus writing techniques and habits • Stealthy transfer of updates as executables hidden inside GIF files ( a form of steganography )


Digital signature verification can be bypassed by giving the malicious file exactly the same name as a legitimate file and placing it on the same level in the archive . Visitors to sites exploited by Emissary Panda are directed by code embedded in the sites to a malicious webpage , which screens their IP address . It will first achieve persistence on the system by writing the in-memory patched parent process to disk to a path specified in the configuration string pool . ThreatConnect Can Help Protect Your Organization from Phishing and BEC Attacks


The system verifies the signature of the legitimate file while installing the malicious file . There has also been at least one victim targeted by a spear-phishing attack . In the case we examined , the path was C:\ProgramData\DRM\CLR\CLR.exe . The campaign started in at least June 2023 , and the ransom note appears to mimic certain aspects of the ransom note used in the global WannaCry attacks from 2017 .


Unfortunately , there is a specific feature of Android vulnerabilities that means it is only possible to get rid of them by receiving an update from the device manufacturers . A variety of malware , including the PlugX tool , was shared with other known Chinese threat groups . It then creates a service named clr_optimization_v4.0.30229_32 , which is responsible for executing CLR.exe . The sample of LIGHTWORK we obtained includes eight hardcoded IEC-104 information object addresses ( IOA ) , which typically correlate with input or output data elements on a device and may correspond to power line switches or circuit breakers in an RTU or relay configuration .


However , many users are in no hurry to update the operating systems of their products . Once inside networks , the group generally targeted Windows network domain controllers and Exchange e-mail servers , targeting user credentials to allow them to move to other systems throughout the targeted network . To avoid suspicion , this service name , as well as the executable name , were chosen to look similar to the name of a Microsoft .NET optimiza S-IDTYtion Service . Nevertheless , previous analyses by CERT - UA and FortiGuard Labs indicate that final payloads , which included AgentTesla and Cobalt Strike , were used for information theft and remote access to infected systems .


If a smartphone or tablet was released more than a year ago , it is probably no longer supported by the manufacturer and patching of vulnerabilities is no longer provided . They used an exploit of Internet Information Server to inject keylogger and backdoor malware onto the Exchange server . The numbering on each arrow corresponds to the chronological sequence of events . Considering that both Royal and BlackSuit were active last month , however , a rebrand probably is n’t happening any time soon .


In that case , the only help comes from an antivirus solution , for example , Kaspersky Internet Security for Android . But two tools used were unique to the group : ASPXTool , an Internet Information Services ( IIS ) specific " Web shell " used to gain access to servers inside a target 's network ; and the OwaAuth credential stealing tool and Web shell , used to attack Microsoft Exchange servers running the Web Outlook interface . ShadowPad is a multimodular backdoor where the modules are referenced from the Root module with a circular list from which one can extract the module address , a UNIX timestamp ( probably embedded automatically during the module ’s compilation process ) and a module identifier . DLL sideloading attacks use the DLL search order mechanism in Windows to plant and then invoke a legitimate application that executes a malicious payload .


Embedding malicious code in legitimate programs helps conceal infections from the victim . By using such features and tools , attackers are hoping to blend in on the victim 's network and hide their activity in a sea of legitimate processes . From the module itself we can also extract the name the developer gave to the module . Sandworm utilized a novel technique to impact the OT environment by executing code within an End - of - Life ( EOL ) MicroSCADA control system and issuing commands that impacted the victim ’s connected substations .


Of course , this does not mean the digital signature of the software developer can be used . TAA leverages advanced artificial intelligence and machine learning that combs through Symantec 's data lake of telemetry in order to spot patterns associated with targeted attacks . This version embeds the 17 modules listed in the following table : An attacker could place HTML containing executable JavaScript inside element attributes .


However , due to the absence of certification centers verifying the digital signatures of Android programs , nothing prevents criminals from adding their own signature . January 2018 , TAA triggered an alert at a large telecoms operator in Southeast Asia . 100 Root Thu 24 Oct 2019 12:08:27 PM UTC Initial shellcode . 101 Plugins Thu 24 Oct 2019 12:07:02 PM UTC Provides API for the other modules ; loads modules . 102 Config Thu 24 Oct 2019 12:07:09 PM UTC Handles encrypted configuration string pool . 103 Install Thu 24 Oct 2019 12:07:46 PM UTC Achieves persistence . 104 Online Thu 24 Oct 2019 12:07:17 PM UTC Overall communications with the C&C server . 106 ImpUser Thu 24 Oct 2019 12:07:24 PM UTC User impersonation via token duplication . 200 TCP Thu 24 Oct 2019 12:01:01 PM UTC TCP communications . 202 HTTPS Thu 24 Oct 2019 12:01:15 PM UTC HTTPS communications . 207 Pipe Thu 24 Oct 2019 12:01:35 PM UTC Handles named pipes . 300 Disk Thu 24 Oct 2019 12:02:29 PM UTC File system operations . 301 Process Thu 24 Oct 2019 12:02:36 PM UTC Process handling . 302 Servcie Thu 24 Oct 2019 12:02:45 PM UTC Service handling . 303 Register Thu 24 Oct 2019 12:02:52 PM UTC Registry operations . 304 Shell Thu 24 Oct 2019 12:03:00 PM UTC Command line operations . 306 Keylogger Thu 24 Oct 2019 12:03:16 PM UTC Keylogging to file system . 307 Screen Thu 24 Oct 2019 12:03:25 PM UTC Screenshot capture . 317 RecentFiles Thu 24 Oct 2019 12:04:44 PM UTC Lists recently accessed files . Since early 2022 , KillNet has claimed on multiple occasions to be partnering or coordinating with several criminal elements , including multiple occasions in which it claimed to be working with the widely known ransomware group REvil .


As a result , a copy of Angry Birds installed from an unofficial app store or downloaded from a forum could easily contain malicious functionality . Thrip was using PsExec to move laterally between computers on the company 's network . These modules , except for RecentFiles , have already been mentioned by Kaspersky and Avast . The article highlighted the increasing popularity of targeted attacks .


Capabilities and functionality In 2013 , we detected several technological innovations developed and used by criminals in their malicious software . TAA triggered an alert at a large telecoms operator in Southeast Asia . Notice the “ Servcie ” typo . Based on these symbols , Mandiant assesses with moderate confidence that com.docker.vmnat was a version of the FULLHOUSE.DOORED backdoor .


Below are descriptions of some of the most interesting . AA triggered an alert at a large telecoms operator in Southeast Asia . As usual , all the module timestamps are spread over a short time range , which could suggest the use of a build framework to compile these modules . Currently , Mandiant has observed the deployment of Atera , AnyDesk , and SplashTop to establish and maintain a foothold following exploitation of CVE-2023 - 4966 .


Control of malware from a single center provides maximum flexibility . PsExec is a Microsoft Sysinternals tool for executing processes on other systems and is one of the most frequently seen legitimate pieces of software used by attackers attempting to live off the land . This also suggests that these modules were built a few hours before the launcher itself , whose compilation timestamp is Thu Oct 24 14:10:32 2019 . Hello . 3 am The time of mysticism , is nt it


Botnets can make considerably more money than autonomous Trojans . TAA not only flagged this malicious use of PsExec , it also told us what the attackers were using it for . Since this compilation timestamp dates back two weeks before this campaign , it ’s likely that it has n’t been tampered with by the attackers . An example of these log entries can be found below : By correlating the user , IP address and GUID from the Remote PowerShell HTTP logs to the Exchange frontend , CrowdStrike found a request using the mailbox to the following OWA URL , , corresponding to the IIS log entry below : The backend request for the new exploitation chain is similar to the example shown below : This request seemed to show a novel , previously undocumented , way to reach the PowerShell remoting service through the OWA frontend endpoint , instead of leveraging the endpoint .


It comes as no surprise then that many SMS-Trojans include bot functionality . Thrip was attempting to remotely install a previously unknown piece of malware ( Infostealer.Catchamas ) on computers within the victim 's network . One might also note that the number of modules embedded in this variant is much higher ( 17 ) than the number of modules embedded in the variants previously documented in our white paper ( 8 to 10 modules ) . Ransomware attacks have shown no signs of slowing down in 2023 .


According to our estimates , about 60 % of mobile malware are elements of both large and small mobile botnets . three computers in China being used to launch the Thrip attacks . By default , every keystroke is recorded using the Keylogger module ( 306, previously documented by Avast ) and saved to disk in the file %APPDATA%\PAGM\OEY\XWWEYG\WAOUE . Mandiant Threat Intelligence assesses that UNC2452 activity aligns with nation - state priorities broadly and that the group ’s targeting patterns are consistent with Russian strategic interests .


By using Google Cloud Messaging botnet owners can operate without a C & C server , thus eliminating the threat of the botnet being detected and blocked by law enforcement authorities . Perhaps the most worrying discovery we made was that Thrip had targeted a satellite communications operator . The log file is encrypted using the same algorithm as the one used to encrypt static strings from the module . Open Babel allows users to “ search , convert , analyze , or store data from molecular modeling , chemistry , solid - state materials , biochemistry , or related areas , ” according to its website , and is used in other popular pieces of software in the science field .


Google Cloud Messaging is designed to send short message ( up to 4 KB ) to mobile devices via Google services . Thrip seemed to be mainly interested in the operational side of the company . Using this module by default indicates that the attackers are interested in stealing information from the victims ’ machines . Who is The Chaos Creator , and what else transpired between Harrison and Ashley Madison prior to his death ?


The developer simply has to register and receive a unique ID for his applications . This suggests to us that Thrip 's motives go beyond spying and may also include disruption . In contrast , the variants we described in our white paper did n’t even have that module embedded . Now , there are some key differences to note in the newest versions of Foudre


The commands received via GCM can not be blocked immediately on an infected device . Armed with this information about the malware and living off the land tactics being used by this group of attackers whom we named Thrip , we broadened our search to see if we could find similar patterns that indicated Thrip had been targeting other organizations . As with previous ShadowPad variants , the Config module ( 102 ) contains an encrypted string pool that can be accessed from any other module . If an adversary can send an unauthorized command message to a control system , then it can instruct the control systems device to perform an action outside the normal bounds of the device 's actions .


We have detected several malicious programs using GCM for command and control – the widespread Trojan-SMS.AndroidOS.FakeInst.a , Trojan-SMS.AndroidOS.Agent.ao , and Trojan-SMS.AndroidOS.OpFake.a among others . The group had also targeted three different telecoms operators , all based in Southeast Asia . The string pool is never stored entirely decrypted in memory ; the field of interest is decrypted when needed and then immediately freed ( thus quickly unavailable ) . Mandiant observed the threat actor use e.exe to load d.dll into lsass process memory .


Google is actively combating this use of the service , responding quickly to reports from antivirus companies and blocking the IDs of cybercriminals . In all cases , based on the nature of the computers infected by Thrip , it appeared that the telecoms companies themselves and not their customers were the targets of these attacks . The configuration size is 2180 bytes and the encrypted strings are located at offset 0x84 . Threat actors like the Winnti group rarely ever stay static in terms of both tools and tactics .


Attacks on Windows XP allows mobile malware to infect a PC after connecting a smartphone or tablet . Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection . The algorithm used to decrypt the strings is the same as the one used to decrypt the static strings of the module . Who is the Winnti group ?


In early 2013 we detected two identical applications on Google Play that were allegedly designed for cleaning the operating system of Android-based devices from unnecessary processes . Many of the tools they use now feature new behaviors , including a change in the way they maintain a foothold in the targeted network . The campaign ID is located at offset 0x99 and is the name of the targeted university . Open Babel allows users to “ search , convert , analyze , or store data from molecular modeling , chemistry , solid - state materials , biochemistry , or related areas , ” according to its website , and is used in other popular pieces of software in the science field .


In fact , the applications are designed to download the autorun.inf file , an icon file and the win32-Trojan file , which the mobile malicious program locates in the root directory of an SD card . Execute a command through exploits for CVE-2017-11882 . Having a campaign ID related to the target is quite common in the case of ShadowPad and Winnti . The image will still display in viewers but the downloader will extract the executable content using the appropriate decryption key and the decryption algorithm .


On connecting a smartphone in the USB drive emulation mode to a computer running Windows XP , the system automatically starts the Trojan ( if AutoPlay on the external media is not disabled ) and is infected . Execute a command through exploits for CVE-2018-0802 . Interestingly , the timestamp present in this config at offset 0x84 is later than the modules ’ timestamps and the loader compilation timestamp . It crafts configurable IEC-104 Application Service Data Unit ( ASDU ) messages , to change the state of RTU Information Object Addresses ( IOAs ) to ON or OFF .


The Trojan allows the criminals to remotely control the victim ’ s computer and is capable of recording sound from a microphone . The backdoor will load the encrypted configuration file and decrypt it , then use Secure Sockets Layer ( SSL ) protocol to connect to command-and-control ( C&C ) servers . This suggests that this config is added manually to the sample after having been built . As we commonly see in the ransomware space , this threat is delivered through a variety of mechanisms which can include phishing and being dropped as secondary payloads from command and control ( C2 ) frameworks like Cobalt Strike .


We would like to emphasize that this method of attack only works on Windows XP and Android versions prior to 2.2 . TClient is actually one of Tropic Trooper 's other backdoors . Even though it ’s probably coincidental , the date within the config corresponds to the date of the first detection of this sample at the corresponding university . CrowdStrike security researchers were working to develop proof - of - concept ( POC ) code for an exploit method indicative of the logging present after recent Play ransomware attacks .


The most advanced mobile malicious programs today are Trojans targeting users ’ bank accounts – the most attractive source of criminal earnings . The malicious loader will use dynamic-link library ( DLL ) hijacking — injecting malicious code into a process of a file/application — on sidebar.exe and launch dllhost.exe ( a normal file ) . Once installed on the system , ShadowPad starts a hidden and suspended Microsoft Windows Media Player wmplayer.exe process and injects itself into that process . Although we have not identified sufficient evidence to determine the origin or purpose of COSMICENERGY , we believe that the malware was possibly developed by either Rostelecom - Solar or an associated party to recreate real attack scenarios against energy grid assets .


Trend of the year : mobile banking Trojans 2013 was marked by a rapid rise in the number of Android banking Trojans . TClient , for instance , uses DLL hijacking and injection that may not be as noticeable to others . The path to wmplayer.exe is provided by the Config module . Additionally , Mandiant has observed the use of the SoftPerfect network scanner ( netscan.exe ) to perform internal network enumeration .


The cyber industry of mobile malware is becoming more focused on making profits more effectively , i.e. , mobile phishing , theft of credit card information , money transfers from bank cards to mobile phones and from phones to the criminalas ’ e-wallets . The backdoor noted by other security researchers was encoded with different algorithms and configured with different parameter names in 2016 , for instance . Once ShadowPad is injected into wmplayer.exe , the Online module will contact the C&C server using the URL specified in the configuration . A riskaverse actor , Iran generally seeks to avoid direct military confrontation against conventionally superior foes .


Cybercriminals have become obsessed by this method of illegal earnings : at the beginning of the year we knew only 67 banking Trojans , but by the end of the year there were already 1321 unique samples . Taiwan has been a regular target of cyber espionage threat actors for a number of years . The communication is then handled by the TCP module ( 200 ) , which was previously documented by Kaspersky . In June 2023 , Anonymous Sudan claimed an operation targeting Microsoft services .


Kaspersky Lab mobile products prevented 2,500 infections by banking Trojans . In early August , Unit 42 identified two attacks using similar techniques . In addition to ShadowPad , the Winnti malware was found on some machines at these two universities at the end of October ( i.e . two weeks before ShadowPad ) in the file C:\Windows\System32\oci.dll and is detected by ESET products as Win64/Winnti.CA . Organizations evaluating their security posture and developing a risk based security framework would be well served to consider the various potential motivational related threats .


mobile_treats_2013_04s The number of mobile banking Trojans in our collection Mobile banking Trojans can run together with Win-32 Trojans to bypass the two-factor authentication – mTAN theft ( the theft of banking verification codes that banks send their customers in SMS messages ) . which has been active since at least 2011 . The Winnti malware usually contains a configuration specifying a campaign ID and a C&C URL . Monitor systems with access to OT resources for the creation of legitimate temporary folders , files , artifacts , and external libraries required as evidence of the execution of packaged Python scripts .


However , in 2013 , autonomous mobile banking Trojans developed further . One of the attacks used Tropic Trooper 's known Yahoyah malware , but the other attack deployed the widely available Poison Ivy RAT . On all machines the campaign ID matches the name of the targeted university and the C&C URLs are : If you are talking to someone who may be a target of commercial spyware ( i.e. , human rights journalists , activists , dissidents and lawyers )


Currently , such Trojans attack a limited number of bank customers , but it is expected that cybercriminals will invent new techniques that will allow them to expand the number and the geography of potential victims . This confirms the actors are using Poison Ivy as part of their toolkit , something speculated in the original Trend Micro report but not confirmed by them . w[redacted].livehost.live : 443 . w[redacted].dnslookup.services : 443 . where the redacted part corresponds to the name of the targeted university . Therefore , there are cases where these vulnerabilities are accessible via the internet .


mobile_treats_2013_05s Infections caused by mobile banking programs Today , the majority of banking Trojan attacks affect users in Russia and the CIS . The document attached to this e-mail exploits CVE-2012-0158 . One can observe that the C&C URL used by both Winnti and ShadowPad complies to the scheme [backdoor_type][target_name].domain.tld : 443 where [backdoor_type] is a single letter which is either “ w ” in the case of the Winnti malware or “ b ” in the case of ShadowPad . The vulnerability , which could allow attackers to gain escalated privileges and unauthorized access to an environment , was first disclosed on May 31st in a security bulletin released by Progress .


However , this situation will not last long : given the cybercriminals ’ interest in user bank accounts , the activity of mobile banking Trojans is expected to grow in other countries in 2014 . As we have noted in many earlier reports , attackers commonly use decoy files to trick victims into thinking a malicious document is actually legitimate . From this format , we were able to find several C&C URLs , including three additional Hong Kong universities ’ names . A typical web request to the frontend to exploit the SSRF vulnerability on CVE-2022 - 41040 involves some variation of path confusion that references the endpoint as shown below : The backend request for a typical ProxyNotShell exploitation is shown below : Once the PowerShell remoting service can be reached , the second step involves vulnerability CVE-2022 - 41082 being exploited in order to execute arbitrary commands .


As mentioned above , banking Trojans are perhaps the most complex of all mobile threats , and Svpeng is one of the most striking examples . Further analysis uncovered a handful of ties indicating the actors may also be using the PCShare malware family , which has not been previously tied to the group . The campaign identifiers found in the samples we ’ve analyzed match the subdomain part of the C&C server , showing that these samples were really targeted against these universities . SocialPolitical Hacktivism primarily intrinsic Social or Ideological issues create a motivation for some to attack organizations to make a statement .


Svpeng In mid-July , we detected Trojan-SMS.AndroidOS.Svpeng.a which , unlike its SMS Trojan counterparts , is focused on stealing money from the victiim ’ s bank account rather than from his mobile phone . This matches with known Tactics , Techniques , and Procedures ( TTPs ) for Tropic Trooper , targeting both government institutions and also the energy industry in Taiwan . The Winnti Group is still actively using one of its flagship backdoors , ShadowPad , this time against Hong Kong universities . None The discovery was part of recent CrowdStrike Services investigations into several Play ransomware intrusions where the common entry vector was confirmed to be Microsoft Exchange .


It can not act independently and operates strictly in accordance with commands received from the C & C server . Tropic Trooper is also still exploiting CVE-2012-0158 , as are many threat actors . In this campaign , the VMProtected launcher used with ShadowPad , as well as with the PortReuse backdoor and skip-2.0 , was replaced by a simpler one . These types of approaches are not uncommon historically , groups have done things like provide " security reports " to compromised organizations to help them " resolve the issue . "


This malicious program spreads via SMS spam and from compromised legitimate sites that redirect mobile users to a malicious resource . The Tropic Trooper threat actor group has been known to target governments and organizations in the Asia Pacific region for at least six years . That these samples , in addition to having been found at these universities , contain campaign IDs matching the universities ’ names and use C&C URLs containing the universities ’ names are good indications that this campaign is highly targeted . 8.8 Management of technical vulnerabilities – prioritizing the mitigation and patching of vulnerabilities based on their potential and current risk of abuse requires identifying the assessed severity of a vulnerability and how this may change .


There the user is prompted to download and install a Trojan imitating an Adobe Flash Player update . Turla is a notorious group that has been targeting governments . We will continue to monitor new activities of the Winnti Group and will publish relevant information on our blog . Revenge intrinsic Disgruntled employees or former employees are those that typically commit the lions share of revengebased cyberattacks .


Svpeng is capable of doing lots of things . Turla is known to run watering hole and spearphishing campaigns to better pinpoint their targets . For any inquiries , contact us at threatintel@eset.com . An attacker could exploit these issues by tricking a user into opening a specially crafted PDF document or , if the user has the browser extension enabled , by visiting a malicious web page :


It collects information about the smartphone ( IMEI , country , service provider , operating system language ) and sends it to the host via the HTTP POST request . Turla is a notorious group that has been targeting government officials . The IoCs are also available in our GitHub repository . Other big stories in June include a suspected LockBit affiliate arrest , the Royal ransomware gang toying with a new encryptor , and a notable increase in attacks on the Manufacturing sector .


This appears to be necessary to determine the number of banks the victim may use . The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . ESET detection names : Win32 / Shadowpad.C trojan Win64 / Winnti.CA trojan . When CrowdStrike researchers later reproduced the attack , events were present in CozyDuke - also known as CozyBear , CozyCar and Office Monkeys ( among others ) , and whose activity appears to align with advanced persistent threat APT29 - is a threat actor which came to prominence in 2014 when it is believed to have staged a series of precise attacks on high profile targets including the US White House , Department of State and the Democratic National Committee .


Svpeng is only currently attacking clients of Russian banks . Turla is a notorious group that has been targeting diplomats . Winnti : hpqhvsei.dll . The messages show that Harrison was hired in March 2010 to help promote Ashley Madison online , but the messages also reveal Harrison was heavily involved in helping to create and cultivate phony female accounts on the service .


Typically , however , cybercriminals first test-run a technology on the Russian sector of the Internet and then roll it out globally , attacking users in other countries . The codename for Turla APT group in this presentation is MAKERSMARK . Winnti : CLR.exe . We searched for the unique string and identified a single match to a cyber range ( aka polygon ) developed by Rostelecom - Solar , a Russian cyber security company that received a government in 2019 to begin training cyber security experts and conducting electric power disruption and emergency response exercises .


It steals SMS messages and information about voice calls . The Intercept reported that there exists a 2011 presentation by Canada 's Communication Security Establishment ( CSE ) outlining the errors made by the Turla operators during their operations even though the tools they use are quite advanced . Winnti : hpqhvsei.dll . Identifying suspicious virtual desktop agent Windows Registry keys


It helps the attacker find out which banks the owner of the smartphone calls – the Trojan receives a list of bank phone numbers from its C & C server . The witnessed techniques , tactics and procedures ( TTPs ) are in-line with what we usuallysee in Turla 's operation : a first stage backdoor , such as Skipper , likely delivered through spearphishing followed by the appearance on the compromised system of a second stage backdoor , Gazerin this case . Winnti : hpqhvind.exe . The configuration contains two C2 servers that are prefixed with a protocol identifier .


It steals money from the victim ’ s bank account . Southeastern Europe as well as countries in the former Soviet Union Republichas recently been the main target . Winnti : hpqhvsei.dll . Simultaneously , a threat researcher outside of CrowdStrike discovered an attacker ’s tooling via an open repository , downloaded all of the tools , and made them available through a MegaUpload link in a Twitter post.2


In Russia , some major banks offer their clients a special service that allows them to transfer money from their bank card to their mobile phone account . Finally , there are many similarities between Gazer and other second stage backdoors used by the Turla group such as Carbon and Kazuar . Winnti : oci.dll . ThreatConnect collects realtime intelligence from the CISA Known Exploited Vulnerabilities Catalog and Google Project Zero , as well as other feeds and sources , enriching it with insights from sources such as the National Vulnerability Database NVD and the global ThreatConnect community .


Customers have to send a set text message from their phone to a specific bank number . Skipper , which has been linked to Turla in the past , was found alongside Gazer in most cases we investigated . Winnti : C&C : b[org_name].dnslookup.services : 443 . Organizations can collect this intelligence , review the threats described , consider if and how the threat is relevant to them , and the necessity of making any potential additional mitigations .


Svpeng sends the corresponding messages to the SMS services of two banks . Turla APT group makes an extra effort to avoid detection by wiping files securely , changing the strings and randomizing what could be simple markers through the different backdoor versions . Winnti : C&C : w[org_name].livehost.live : 443 . The ISO file contained at least the following :


Svpeng does this to check if the cards from these banks are attached to the number of the infected phone and to find out the account balance . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including government institutions . Winnti : C&C : w[org_name].dnslookup.services : 443 . Analysis into the malware and its functionality reveals that its capabilities are comparable to those employed in previous incidents and malware , such as and , which were both malware variants deployed in the past to impact electricity transmission and distribution via IEC-104 .


If the phone is attached to a bank card , commands are sent from the C & C server with instructions to transfer money from the user ’ s bank account to his/her mobile account . Turla all uses an encrypted container to store the malware 's components and configuration and they also log their actions in a file . Middle Eastern hacking group is using FinFisher malware to conduct international espionage . Looking at the motivations of hackers and cybercriminals is just one possible way to look at how we can dictate our cybersecurity priorities .


The cybercriminals then send this money to a digital wallet or to a premium number and cash it in . Over the last 10 months , Kaspersky Lab researchers have analyzed a massive cyber-espionage operation which we call " Epic Turla " . Recently , there was a blog post on the takedown of a botnet used by threat actor group known as Group 72 and their involvement in Operation SMN . In November 2016 , Volexity documented new Dukes - related activity involving spear phishing with links to a ZIP archive containing a malicious LNK file , which would run PowerShell commands to install a new custom backdoor called PowerDuke .


It steals logins and passwords to online banking accounts by substituting he window displayed by the bank application . We also observed exploits against older ( patched ) vulnerabilities , social engineering techniques and watering hole strategies in these attacks . This group is sophisticated , well funded , and exclusively targets high profile organizations with high value intellectual property in the manufacturing , industrial , aerospace , defense , and media sector . None PIEHOP is a disruption tool written in Python and packaged with PyInstaller that is capable of connecting to a user - supplied remote MSSQL server for uploading files and issuing remote commands to a RTU .


Currently , this only affects Russian banks , but the technology behind Svpeng could easily be used to target other banking applications . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including embassies . The primary attack vectors are watering-hole , spear phishing , and other web-based attacks . KillMilk continues to be a central coordinator for the KillNet Collective , despite claims of leaving the group in mid-2022 .


It steals bank card information ( the number , the expiry date , CVC2/CVV2 ) imitating the process of registering the bank card with Google Play . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including military . Frequently , a remote administration tool ( RAT ) is used to maintain persistence within a victim ’s organization . Copies of the site at archive.org show it was the work of someone calling themselves “ The Chaos Creator . ”


If the user has launched Play Market , the Trojan intercepts the event and displays a window on top of the Google Play window , prompting the user to enter his/her bank card details in the fake window . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including education . These tools are used to further compromise the organization by attacking other hosts inside the targets network . Furthermore , these reports indicated that Zarya was cooperating with or being handled by officers of Russia ’s Federal Security Service ( FSB ) .


The data entered by the user is sent to the cybercriminals . When G-Data published on Turla/Uroburos back in February , several questions remained unanswered . ZxShell ( aka Sensocode ) is a Remote Administration Tool ( RAT ) used by Group 72 to conduct cyber-espionage operations . If we look at our previous cyberattack incident , a spear phishing attack likely left indications of malicious browser redirects and malware installation attempts .


mobile_treats_2013_06s It extorts money from users by threatening to block the smartphone : it displays a message demanding $ 500 to unblock the device . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including research and pharmaceutical companies . Once the RAT is installed on the host it will be used to administer the client , exfiltrate data , or leverage the client as a pivot to attack an organization ’s internal infrastructure . The group has since earned infamy for being involved in malicious activities associated with targeted attacks , such as deploying spear - phishing campaigns and building a backdoor .


In actual fact , the Trojan does not block anything and the phone can be used without any problems . The primary backdoor used in the Epic attacks is also known as " WorldCupSec " , " TadjMakhal " , " Wipbot " or " Tavdig " . Here is a short list of the types of tools included with ZxShell : A rough translation of this message is as follows : Hack520 seems to be very interested in hosting services and his profile fits that of a system administrator profile with some programming and hacking skills .


It hides traces of its activity by masking the outgoing and incoming text messages and blocking calls and messages from numbers belonging to the bank . Thrip 's motive is likely espionage and its targets include those in the communications , geospatial imaging , and defense sectors , both in the United States and Southeast Asia . Keylogger ( used to capture passwords and other interesting data ) . By looking at the most likely perpetrators , we can ask who would be motivated to come after the company , what are the tactics , techniques and procedures and priorities , and what defenses are needed .


The Trojan gets the list of bank phone numbers from its C & C server . One big unknown was the infection vector for Turla ( aka Snake or Uroburos ) . Command line shell for remote administration . These groups can steal information and argue that they are practicing free speech , but more often than not , these groups will employ a DDoS Distributed Denial of Service attack to overload a website with too much traffic and cause it to crash .


It protects itself from deletion by requesting Device Administrator rights during the installation . The mothership server is generally a VPS , which runs the Control panel software used to interact with the victims . Remote desktop . Organizations can validate their security controls using the following actions with Mandiant Security Validation .


As a result , the Trojan delete button in the list of applications becomes inactive , which may cause problems for inexperienced users . the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated . Various network attack tools used to fingerprint and compromise other hosts on the network . The attacker also executed various Cobalt Strike components and tried to escalate privileges on the computer using PsExec .


It is impossible to deprive it of these rights without the use of specialized tools ( such as Kaspersky Internet Security for Android ) . Once a victim is confirmed as " interesting " , the attackers upload another Epic backdoor which has a unique ID used to control this specific victim . Local user account creation tools . /Library / Ruby / Gems/2.6.0 / extensions / init.rb Ruby script 53789519 /usr / local / bin / com.docker.vmnat FULLHOUSE.DOORED 53789522 /usr / local / bin / com.docker.vmnat.lock Not recovered 54101444 /Library / Fonts / ArialUnicode.ttf.md5 STRATOFEAR ( Config ) 54102142


To protect itself from being removed , Svpeng uses a previously unknown vulnerability in Android . Our analysis indicates this is a sophisticated multi-stage infection ; which begins with Epic Turla . For a complete list of tools please see the MainConnectionIo section . Minidionis – one more APT with a usage of cloud drives • Miniduke is back : Nemesis Gemina and the Botgen Studio More details about CozyDuke are available to customers of Kaspersky Intelligence Reporting .


It uses the same trick to prevent the smartphone from being returned to its factory settings . this attack against a Kaspersky Lab user on August 5 , 2014 . The following paper is a technical analysis on the functionality of ZxShell . In the case of a traditional ProxyNotShell exploit chain , the attack sequence is done in two steps :


The Trojan is distributed in Russia and CIS countries . VENOMOUS BEAR is an advanced , Russia-based adversary that's been active since at least 2004 . The analysts involved were able to identify command and control ( C2 ) servers , dropper and installation methods , means of persistence , and identify the attack tools that are core to the RAT ’s purpose . The VPNs used by RGB actors occasionally fail , which reveals the IP addresses of the actor 's true origins .


But , as we have already mentioned , the criminals could easily turn their attention to users in other countries . Venomous Bear has deployed malware to targets using several novel methods . In addition , the researchers used their analysis to provide detection coverage for Snort , Fireamp , and ClamAV . In July 2023 , Mandiant Consulting responded to a supply chain compromise affecting a US - based software solutions entity .


Perkele and Wroba Foreign users have also been on the receiving end of several malicious innovations targeting bank accounts . For years , Turla has relied , among other impersonations , on fake Flash installers to compromise victims . ZxShell has been around since 2004 . Monitor systems with access to OT resources for the creation of legitimate temporary folders , files , artifacts , and external libraries required as evidence of the execution of packaged Python scripts .


The Perkele Android Trojan not only attacks Russian users but also clients of several European banks . Turla merely uses the Adobe brand to trick users into downloading the malware . There are a lot of versions available in the underground market . Evernote is a popular app in the healthcare community for data sharing files , notes , schedules , etc . across phones and other devices .


It is of interest primarily because it operates in conjunction with various banking win32-Trojans . By looking at our telemetry , we found evidence that Turla installers were exfiltrating information to get.adobe.com URLs since at least July 2016 . We have analyzed the most common version of ZxShell , version 3.10 . None The Foudre string no longer present The window used for keylogging was originally named Foudre giving the malware its name , but has now been renamed to form1 to help the malware evade signaturebased detection


Its main task is to bypass the two-factor authentication of the client in the online banking system . Thus , it is clear they are trying to be as stealthy as possible by hiding in the network traffic of the targeted organizations . There are newer versions , up to version 3.39 as of October 2014 . An exhaustive analysis of domains registered to the various Vistomail pseudonyms used by Harrison shows he also ran Bash - a - Business[.]com , which Harrison dedicated to “ all those sorry ass corporate executives out there profiting from your hard work , organs , lives , ideas , intelligence , and wallets . ”


Due to the specific nature of its activity , Perkele is distributed in a rather unusual way . Finally , some of the victims are also infected with other Turla-related malware such as ComRAT or Gazer . An individual who goes by the name LZX in some online forums is believed to be the original author of ZxShell . Supply Chain Attack


When a user enters an Internet banking site on a computer infected by banking malware ( ZeuS , Citadel ) , a request about the smartphone number and type of operating system is injected into the code of the authentication page . Kaspersky Lab documented this behavior in 2014 . Since ZxShell has been around since at least 2004 , numerous people have purchased or obtained the tools necessary to set up ZxShell command and control servers ( C&C ) and generate the malware that is placed on the victim ’s network . The RAT was likely not detected before as it has the ability to remove itself from the victim machine in time for the deployment of malware .


This data is immediately sent to the cybercriminals and the computer displays the QR code containing a link to the alleged certificate of the online banking system . It is not a new tactic for Turla to rely on fake Flash installers to try to trick the user to install one of their backdoors . ZxShell has been observed to be distributed through phishing attacks , dropped by exploits that leverage vulnerabilities such as CVE-2011-2462 , CVE-2013-3163 , and CVE-2014-0322 . In each case , CrowdStrike reviewed the relevant logs and determined there was no evidence of exploitation of CVE-2022 - 41040 for initial access .


After scanning the QR code and installing a component downloaded from the link , the user infects his smartphone with the Trojan program that boasts functionality that is of great interest to the attackers . Turla operators could use an already-compromised machine in the network of the victim 's organization to perform a local MitM attack . To illustrate the functionality of main ZxShell module , Let ’s take a look at the following sample : “ So good luck , I ’m sure we ’ll talk again soon , but for now , I ve got better things in the oven , ” Harrison wrote to Biderman after his employment contract with Ashley Madison was terminated .


Perkele intercepts mTANs ( confirmation codes for banking operations ) sent by the bank via text message . Our January 2018 white paper was the first public analysis of a Turla campaign called Mosquito . MD5 : e3878d541d17b156b7ca447eeb49d96a . Minidionis – one more APT with a usage of cloud drives • Miniduke is back : Nemesis Gemina and the Botgen Studio More details about CozyDuke are available to customers of Kaspersky Intelligence Reporting .


By using the login and password stolen from the browser , the Windows Trojan initiates a fake transaction while Perkele intercepts ( via the C & C server ) the mTAN sent by the bank to the user . It is not the first time Turla has used generic tools . SHA256 : 1eda7e556181e46ba6e36f1a6bfe18ff5566f9d5e51c53b41d08f9459342e26c . Harrison even went after Bradshaw ’s lawyer and wife , listing them both on a website he created called Contact - a - CEO[.]com , which Harrison used to besmirch the name of major companies — including several past employers — all entities he believed had slighted him or his family in some way .


Money then disappears from the victim ’ s account and is cashed in without the owner ’ s knowledge . In the past , we have seen the group using open-source password dumpers such as Mimikatz . It exports the following functions , which are examined in greater detail below : DllMain Install UnInstall ServiceMain ShellMain ShellMainThread zxFunction001 zxFunction002 . An attacker with access to a valid cookie can establish an authenticated session to the NetScaler appliance without knowledge of the username , password , or access to a multi - factor authentication token or device .


The Korean malware Wroba , in addition to the traditional vector of infection via file-sharing services , spreads via alternative app stores . Starting in March 2018 , we observed a significant change in the campaign : it now leverages the open source exploitation framework Metasploit before dropping the custom Mosquito backdoor . DllMain performs the initialization of ZxShell . Get Ready for Ransomware in 2023 with the ThreatConnect Platform