The Rancor group 's attacks use two primary malware families which we describe in depth later in this blog and are naming DDKONG and PLAINTEE . The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server .


We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages . The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content .


Based on this , we believe the Rancor attackers were targeting political entities . Let’s take a closer look at ITG08’s TTPs that are relevant to the campaign we investigated , starting with its spear phishing and intrusion tactics and covering information on its use of the More_eggs backdoor .


Additionally , these decoy documents are hosted on legitimate websites including a government website belonging to the Cambodia Government and in at least once case , Facebook . Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe .


Our Investigation into both clusters further showed that they were both involved in attacks targeting organizations in South East Asia . Based on this , we believe the Rancor attackers were targeting political entities .


We observed DDKONG in use between February 2017 and the present , while PLAINTEE is a newer addition with the earliest known sample being observed in October 2017 . Other groups , such as Buhtrap , Corkow and Carbanak , were already known to target and successfully steal money from financial institutions and their customers in Russia .


The RANCOR campaign represents a continued trend of targeted attacks against entities within the South East Asia region . Since last week , iSIGHT Partners has worked to provide details on the power outage in Ukraine to our global customers .


They are interested in users of remote banking systems ( RBS ) , mainly in Russia and neighboring countries . The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes .


That this group is mostly targeting businesses is apparent from the processes they are looking for on a compromised system . The most recent Scarlet Mimic attacks we have identified were conducted in 2015 and suggest the group has a significant interest in both Muslim activists and those interested in critiques of the Russian government and Russian President Vladimir Putin .


While both RTM and Buhtrap are looking for a quite similar process list , the infection vectors are quite different . Based on analysis of the data and malware samples we have collected , Unit 42 believes the attacks described herein are the work of a group or set of cooperating groups who have a single mission , collecting information on minority groups who reside in and around northwestern China .


This group has used a large array of infection vectors , mostly revolving around drive-by downloads and spam . In the past , Scarlet Mimic has primarily targeted individuals who belong to these minority groups as well as their supporters , but we've recently found evidence to indicate the group also targets individuals working inside government anti-terrorist organizations .


They are both targeting businesses using accounting software , are fingerprinting systems of interest similarly , are looking for smart card readers , and finally , they deploy an array of malicious tools to spy on their victims . Our investigation showed that these attacks were targeted , and that the threat actor sought to steal communications data of specific individuals in various countries .


In particular , we will focus on the samples SHA-1 AA0FA4584768CE9E16D67D8C529233E99FF1BBF0 and 48BC113EC8BA20B8B80CD5D4DA92051A19D1032B . CapabilitiesFormBook is a data stealer , but not a full-fledged banker .


Despite its known weaknesses , the RC4 algorithm is regularly used by malware authors . While discussions of threats in this region often focus on " North America " generally or just the United States , nearly 100 campaigns during this period were either specifically targeted at Canadian organizations or were customized for Canadian audiences .


Based on the use of the relatively unique PLAINTEE malware , the malware 's use of the same file paths on in each cluster , and the similar targeting , we have grouped these attacks together under the RANCOR campaign moniker . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload .


Bdo is the Russian translation for RBS ( Remote Banking System ) so it is clear that RBS is a target for this malware . In this latest incident , the group registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day .


Other groups , such as Buhtrap , Corkow and Carbanak , were already known to target and successfully steal money from financial institutions and their customers in Russia . The first time this happened was at the beginning of the month , when Proofpoint researchers blew the lid off a cyber-espionage campaign named Operation Transparent Tribe , which targeted the Indian embassies in Saudi Arabia and Kazakhstan .


Our research on the RTM malware shows that the Russian banking system is still a target of choice for criminals . Back in February 2016 , Indian army officials issued a warning against the usage of three apps , WeChat , SmeshApp , and Line , fearing that these apps collected too much information if installed on smartphones used by Indian army personnel .


Since last week , iSIGHT Partners has worked to provide details on the power outage in Ukraine to our global customers . According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability .


Shortly after releasing information on their espionage operations , our friends at TrendMicro found evidence that the operators were not only conducting classic strategic espionage but targeting SCADA systems as well . In addition to these , the Animal Farm attackers used at least one unknown , mysterious malware during an operation targeting computer users in Burkina Faso .


iSiGHT has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 . PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


Sandworm Team went to ground shortly after being exposed in October of 2014 , and malware with Dune references ( the genesis for the ' Sandworm ' moniker ) which we had previously used to track them disappeared entirely . The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


However , the unique malware variant , BlackEnergy 3 , reemerged in Ukraine early in 2015 , where we had first found Sandworm Team . Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015 .


iSiGHT Partners has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 . The Poseidon Group actively targets this sort of corporate environment for the theft of intellectual property and commercial information , occasionally focusing on personal information on executives .


SIGHT Partners is still collecting information on the mechanics of the power outage and what role the KillDisk malware played in the greater event . The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


Last week iSIGHT 's sources provided us with the same KillDisk malware published by Rob Lee of SANS and Dragos Security . Mark Zuckerberg , Jack Dorsey , Sundar Pichai , and Daniel Ek — the CEOs of Facebook , Twitter , Google and Spotify , respectively — have also fallen victim to the hackers , dispelling the notion that a career in software and technology exempts one from being compromised .


The aggressive nature of Sandworm Team 's previous activity in Europe and the United States exposed their interest in targeting critical systems and indicated preparation for cyber attack . The group is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


This year we are going to be releasing a monthly blog post introducing the " Threat Actor of the Month " , complete with detailed background information on that actor . OurMine is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


VOODOO BEAR is a highly advanced adversary with a suspected nexus to the Russian Federation . Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February .


Destructive malware used by VOODOO BEAR includes a wiper called PassKillDisk . Further tracking of the Lazarus’s activities has enabled Kaspersky researchers to discover a new operation , active since at least November 2018 , which utilizes PowerShell to control Windows systems and Mac OS malware to target Apple customers .


Some tools used by this actor — specifically BlackEnergy and GCat — have been adapted from commodity malware . Users who failed to patch their systems may find themselves mining cryptocurrency for threat actors .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , industrial control systems and SCADA , government , and media for espionage and destructive purposes , since at least 2011 . Keeping in mind the sensitivity of passwords , GoCrack includes an entitlement-based system that prevents users from accessing task data unless they are the original creator or they grant additional users to the task .


A commonly observed element of implants from VOODOO BEAR — at least until this information was made public in late 2014 — were references in the malware to the 1965 science fiction novel Dune , by Frank Herbert . The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , government , and media for espionage and destructive purposes , since at least 2011 . The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


these characteristics all highlight the likelihood that VOODOO BEAR operates in alignment with Russian state interests . This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose .


This adversary displays a particular focus on targeting entities in the Ukraine and is believed to be behind the Ukrainian energy sector attacks that caused widespread power outages in late 2015 . The attackers used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


VOODOO BEAR appears to be integrated into an organization that also operates or tasks multiple pro-Russian hacktivist entities . The admin@338 used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


In the summer of 2014 , BlackEnergy caught our attention when we noticed that samples of it were now tailored to target Ukrainian government institutions . The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


Related or not , one thing is certain : the actor ( s ) using these customized BlackEnergy malware are intent on stealing information from the targets . The targets were similar to a 2015 TG-4127 campaign — individuals in Russia and the former Soviet states , current and former military and government personnel in the U.S. and Europe , individuals working in the defense and government supply chain , and authors and journalists — but also included email accounts linked to the November 2016 United States presidential election .


In this paper we focus only on BlackEnergy samples known to be used specifically by the actors we identify as Quedagh , who seem to have a particular interest in political targets . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


Special focus will be on the samples that were used in targeted attacks against Ukrainian government organizations earlier this year . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


Although they may have started much earlier , the earliest BlackEnergy sample we could attribute to the Quedagh gang is from December 14 , 2010 . APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


We warned our clients of new features suggesting an increased focus on European targets - though verification of targets was not possible at the time . We have reasons to believe that the operators of the APT28 network are either Russian citizens or citizens of a neighboring country that speak Russian .


Sandworm Team may have opted for a ' hide in plain sight ' approach to evade detections from rootkit scanners , such as GMER and RootkitRevealer , that checks for system anomalies . Russian citizens—journalists , software developers , politicians , researchers at universities , and artists are also targeted by Pawn Storm .


Table 3 ( above ) summarizes the commands supported by the variants used in the attack against Ukrainian government organizations . In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 .


In the summer of 2014 , we noted that certain samples of BlackEnergy malware began targeting Ukranian government organizations for information harvesting . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


These samples were identified as being the work of one group , referred to in this document as " Quedagh " , which has a history of targeting political organizations . In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines .


The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes . APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


To infect individuals with access to the data the actors desire , Scarlet Mimic deploys both spear-phishing and watering hole ( strategic web compromise ) attacks . APT37 targeted a research fellow , advisory member , and journalist associated with different North Korean human rights issues and strategic organizations .


As with many other attackers who use spear-phishing to infect victims , Scarlet Mimic makes heavy use of " decoy " files . The majority of APT37 activity continues to target South Korea , North Korean defectors , and organizations and individuals involved in Korean Peninsula reunification efforts .


The most recent Scarlet Mimic attacks we have identified were conducted in 2015 and suggest the group has a significant interest in both Muslim activists and those interested in critiques of the Russian government and Russian President Vladimir Putin . In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company .


Using these tactics Scarlet Mimic can directly target previously identified individuals ( spear phishing ) as well as unidentified individuals who are interested in a specific subject ( watering hole ) . Per the complaint , the email account watsonhenny@gmail.com was used to send LinkedIn invitations to employees of a bank later targeted by APT38 .


This group has been conducting attacks for at least four years using a backdoor Trojan that has been under active development . The APT38 uses DYEPACK to manipulate the SWIFT transaction records and hide evidence of the malicious transactions , so bank personnel are none the wiser when they review recent transactions .


Based on analysis of the data and malware samples we have collected , Unit 42 believes the attacks described herein are the work of a group or set of cooperating groups who have a single mission , collecting information on minority groups who reside in and around northwestern China . APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns .


Attacks launched by this group were publicly exposed on 2013 in a Trend Micro report about the FakeM Trojan . Other groups attributed to Iranian attackers , such as Rocket Kitten , have targeted Iranian individuals in the past , including anonymous proxy users , researchers , journalists , and dissidents .


We will also provide detailed analysis of the latest variants of the malware they deploy ( known as FakeM ) as well as other associated tools that allow Scarlet Mimic to target Android and OS X devices . We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers .


In the past , Scarlet Mimic has primarily targeted individuals who belong to these minority groups as well as their supporters , but we've recently found evidence to indicate the group also targets individuals working inside government anti-terrorist organizations . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


We also know Scarlet Mimic uses a number of toolkits to create documents that contain exploit code to install the FakeM payload on a compromised system . The group has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


Unit 42 tracks the toolkits delivering FakeM under the names MNKit , WingD and Tran Duy Linh . Gallmaker 's targets are embassies of an Eastern European country .


In July of 2015 , we identified a full e-mail uploaded to an antivirus scanning service that carried a Scarlet Mimic exploit document . However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers .


We are aware of one case where Scarlet Mimic broke from the spear-phishing pattern described above . 360 and Tuisec already identified some Gorgon Group members .


In 2013 , the group deployed a watering hole attack , also known as a strategic web compromise to infect victims with their backdoor . Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers .


FakeM 's functional code is shellcode-based and requires another Trojan to load it into memory and execute it . This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets Bitcoin users and global financial organizations .


First discussed in January 2013 in a Trend Micro whitepaper , FakeM is a Trojan that uses separate modules to perform its functionality . Beginning in 2017 , the Lazarus group heavily targeted individuals with spear phishing emails impersonating job recruiters which contained malicious documents .


We end this section with a discussion on tools related to FakeM and used by Scarlet Mimic . We concluded that Lazarus Group was responsible for WannaCry , a destructive attack in May that targeted Microsoft customers .


Microsoft patched this vulnerability in September 2012 , suggesting that this watering hole attack used an older vulnerability , which aligns with the threat groups continued use of older vulnerabilities in their spear-phishing efforts . The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan .


Microsoft patched this vulnerability in September 2012 , suggesting that this watering hole attack used an older vulnerability , which aligns with Scarlet Mimic continued use of older vulnerabilities in their spear-phishing efforts . On November 10 , 2015 , threat actors sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


Based on the timeline , it appears that the actors were actively developing several of the loaders at the same time from 2009 until the early months of 2014 . On November 10 , 2015 , Lotus Blossom sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


Unit 42 tracks this mobile Trojan as MobileOrder , as the authors specifically refer to commands within the app as orders . APT threat actors , most likely nation state-sponsored , targeted a diplomat in the French Ministry of Foreign Affairs with a seemingly legitimate invitation to a technology conference in Taiwan .


There are also infrastructure ties between some FakeM variants and older activity using Trojans such as Elirks , Poison Ivy , and BiFrost , which were used in attacks as old as 2009 . Additionally , the targeting of a French diplomat based in Taipei , Taiwan aligns with previous targeting by these actors , as does the separate infrastructure .


There is some infrastructure overlap in the C2 servers used by almost all of the FakeM variants , as well other Trojans such as MobileOrder , Psylo , and CallMe . Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents .


Trend Micro published their analysis of the FakeM Trojan on January 17 , 2013 that discussed the original variant of FakeM . APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors .


The primary source of data used in this analysis is Palo Alto Networks WildFire , which analyzes malware used in attacks across the world . COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites .


Scarlet Mimic also uses the infamous HTRAN tool on at least some of their C2 servers . The Magic Hound has repeatedly used social media to identify and interact with employees at targeted organizations and then used weaponized Excel documents .


Scarlet Mimic primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 . The May 2014 ' Operation Saffron Rose ' publication identifies an Iranian hacking group formerly named ' Ajax Security ' ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


Kaspersky Lab has produced excellent research on Scarlet Mimic group . An Iranian hacking group formerly named Ajax Security ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


Actors will run HTRAN on a server and configure their malware to interact with that server ; however , the actor will configure HTRAN to forward traffic to another server where the actual C2 server exists . PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 .


The information discovered by Unit 42 and shared here indicates Scarlet Mimic is likely a well-funded and skillfully resourced cyber adversary . APT10 is known to have exfiltrated a high volume of data from multiple victims , exploiting compromised MSP networks , and those of their customers , to stealthily move this data around the world .


Scarlet Mimic has carried out attacks using both spear-phishing and watering holes since at least 2009 with increasingly advanced malware , and has deployed malware to attack multiple operating systems and platforms . Targeted sectors of Molerats include governmental and diplomatic institutions , including embassies ; companies from the aerospace and defence Industries ; financial institutions ; journalists ; software developers .


This time I'm going to focus on malicious CHM files used by Silence APT . It was during operator X 's network monitoring that the attackers placed Naikon proxies within the countries ' borders , to cloak and support real-time outbound connections and data Exfiltration from high-profile victim organizations .


If you haven't heard about it for some reason , I would recommend to read this detailed report by Group-IB , as this APT attacks not only Russian banks , but also banks in more than 25 countries . In early May 2016 , both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe .


The group primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 . Although most malware today either seeks monetary gain or conducts espionage for economic advantage , both of these activity groups appear to seek information about specific individuals .


The group uses legitimate administration tools to fly under the radar in their post-exploitation phase , which makes detection of malicious activity , as well as attribution more complicated . Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information .


On January 12 , 2016 , Cylance published a blog linking an exploit document to the group Mandiant refers to as APT2 and CrowdStrike as " Putter Panda " . Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information .


In 2016 , Unit 42 launched an unprecedented analytic effort focused on developing a modern assessment of the size , scope and complexity of this threat . Additionally , HELIX KITTEN actors have shown an affinity for creating thoroughly researched and structured spear-phishing messages relevant to the interests of targeted personnel .


In 2014 , Unit 42 released a report titled " 419 Evolution " that documented one of the first known cases of Nigerian cybercriminals using malware for financial gain . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East .


A few months later , in February 2017 , the FBI published a press release revising its estimates and stating that " Since January 2015 , there has been a 1,300 percent increase in identified exposed losses , now totaling over $3 billion " Recognizing the significance of this threat group , Unit 42 continues to track the evolution of Nigerian cybercrime under the code name SilverTerrier . In late 2015 , Symantec identified suspicious activity involving a hacking tool used in a malicious manner against one of our customers .


In the 2016 Internet Crime Report published by the FBI , BEC was specifically highlighted as a " Hot Topic " , having been attributed to more than US$360 million in losses and gaining status as its own category of attack . The SWC of a Uyghur cultural website suggests intent to target the Uyghur ethnic group , a Muslim minority group primarily found in the Xinjiang region of China .


Recognizing the significance of this threat group , Unit 42 continues to track the evolution of Nigerian cybercrime under the code name SilverTerrier . It's possible TG-3390 used a waterhole to infect data center employees .


Pony is a fairly common malware family that has existed in various forms since 2012 , with our first indications of Nigerian use occurring in August 2014 . The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center .


Of the four , KeyBase stands out due to its rapid rise in popularity , with a peak deployment of 160 samples per month and usage by 46 separate SilverTerrier actors , followed by a fairly rapid decline . The group , believed to be based in China , has also targeted defense contractors , colleges and universities , law firms , and political organizations — including organizations related to Chinese minority ethnic groups .


NetWire , DarkComet , NanoCore , LuminosityLink , Remcos and Imminent Monitor are all designed to provide remote access to compromised systems . In all cases , based on the nature of the computers infected by Thrip , it appeared that the telecoms companies themselves and not their customers were the targets of these attacks .


Unit 42 analyzed the use of these six malware families and found that Nigerian actors are currently producing an average of 146 unique samples of malware per month ( see Figure 6 ) . Turla is a notorious group that has been targeting government officials .


Given this requirement , SilverTerrier actors often rely on Dynamic DNS and virtual private servers to provide a layer of obfuscation to protect their identities . Turla is a notorious group that has been targeting diplomats .


When using email scams , SilverTerrier actors preferred to use large target audiences , which maximized the likelihood of success with very little risk . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including embassies .


Unit 42 tracks roughly 300 SilverTerrier actors who have registered a combined 11,600 domains over the past five years . From February to September 2016 , WhiteBear activity was narrowly focused on embassies and consular operations around the world .


To support the rapid growth and pace of malware distribution efforts , SilverTerrier actors are in constant need of domains to serve as C2 nodes . All of these early WhiteBear targets were related to embassies and diplomatic/foreign affair organizations .


To that end , it is very unlikely that the United States government or Shell , a global energy company , would commission SilverTerrier actors to develop domains that impersonate their own legitimate websites and services . Thus , Turla operators had access to some highly sensitive information ( such as emails sent by the German Foreign Office staff ) for almost a year .


The credentials they use to register their malware infrastructure are easily associated with their public social media accounts on Google® , Facebook® , MySpace® , Instagram® , and various dating and blogging sites . We suspect the Kazuar tool may be linked to the Turla threat actor group ( also known as Uroburos and Snake ) , who have been reported to have compromised embassies , defense contractors , educational institutions , and research organizations across the globe .


Earlier this year , Cybereason identified an advanced , persistent attack targeting telecommunications providers that has been underway for years , soon after deploying into the environment . Deepen told Threatpost the group has been operating since at least since 2008 and has targeted China and US relations experts , Defense Department entities , and geospatial groups within the federal government .


Based on the data available to us , Operation Soft Cell has been active since at least 2012 , though some evidence suggests even earlier activity by the threat actor against telecommunications providers . Government officials said they knew the initial attack occurred in 2011 , but are unaware of who specifically is behind the attacks .


Threat actors , especially those at the level of nation state , are seeking opportunities to attack these organizations , conducting elaborate , advanced operations to gain leverage , seize strategic assets , and collect information . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 .


The tools and techniques used throughout these attacks are consistent with several Chinese threat actors , such as APT10 , a threat actor believed to operate on behalf of the Chinese Ministry of State Security . Later that month , the same tactics and patterns were seen in attempts against an Iranian women 's activist – an individual commonly targeted by Iranian actors , such as Charming Kitten and the Sima campaign documented in our 2016 Black Hat talk .


The threat actor attempted to compromise critical assets , such as database servers , billing servers , and the active directory . Several times , APT5 has targeted organizations and personnel based in Southeast Asia .


The attack began with a web shell running on a vulnerable , publicly-facing server , from which the attackers gathered information about the network and propagated across the network . Given our increased confidence that Bahamut was responsible for targeting of Qatari labor rights advocates and its focus on the foreign policy institutions other Gulf states , Bahamut 's interests are seemingly too expansive to be limited one sponsor or customer .


The initial indicator of the attack was a malicious web shell that was detected on an IIS server , coming out of the w3wp.exe process . Barium specializes in targeting high value organizations holding sensitive data , by gathering extensive information about their employees through publicly available information and social media , using that information to fashion phishing attacks intended to trickthose employees into compromising their computers and networks .


An investigation of the web shell , later classified as a modified version of the China Chopper web shell , uncovered several attack phases and TTPs . Barium has targeted Microsoft customers both in Virginia , the United States , and around the world .


The threat actor was able to leverage the web shell to run reconnaissance commands , steal credentials , and deploy other tools . BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years .


The web shell parameters in this attack match to the China Chopper parameters , as described in FireEye 's analysis of China Chopper . Our research indicates that it has started targeting Japanese users .


It is used to remotely control web servers , and has been used in many attacks against Australian web hosting providers . Our experts have found that cybercriminals are actively focusing on SMBs , and giving particular attention to accountants .


This tool has been used by several Chinese-affiliated threat actors , such as APT 27 and APT 40 . Clever Kitten actors have a strong affinity for PHP server-side attacks to make access ; this is relatively unique amongst targeted attackers who often favor targeting a specific individual at a specific organization using social engineering .


The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes . Some of the exploit server paths contain modules that appear to have been designed to infect Linux computers , but we have not yet located the Linux backdoor .


The threat actor relied on WMI and PsExec to move laterally and install their tools across multiple assets . Confucius targeted a particular set of individuals in South Asian countries , such as military personnel and businessmen , among others .


Nbtscan has been used by APT10 in Operation Cloud Hopper to search for services of interest across the IT estate and footprint endpoints of interest . According to statistics , Corkow primarily targets users in Russia and the CIS , but it is worth noting that in 2014 the amount of attacks targeting the USA increased by 5 times , in comparison with 2011 .


A second method the threat actor used to maintain access across the compromised assets was through the deployment of the PoisonIvy RAT ( PIVY ) . The threat is likely targeting employees of various Palestinian government agencies , security services , Palestinian students , and those affiliated with the Fatah political party .


This infamous RAT has been associated with many different Chinese threat actors , including APT10 , APT1 , and DragonOK . For example , the actors behind FrozenCell used a spoofed app called Tawjihi 2016 , which Jordanian or Palestinian students would ordinarily use during their general secondary examination .


It is a powerful , multi-featured RAT that lets a threat actor take total control over a machine . The titles and contents of these files suggest that the actor targeted individuals affiliated with these government agencies and the Fatah political party .


In an attempt to hide the contents of the stolen data , the threat actor used winrar to compress and password-protect it . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) .


The winrar binaries and compressed data were found mostly in the Recycle Bin folder , a TTP that was previously observed in APT10-related attacks , as well as others . Targets included a wide array of high-profile entities , including intelligence services , military , utility providers ( telecommunications and power ) , embassies , and government institutions .


This ' connection bouncer ' tool lets the threat actor redirect ports and connections between different networks and obfuscate C2 server traffic . The computers of diplomats , military attachés , private assistants , secretaries to Prime Ministers , journalists and others are under the concealed control of unknown assailant (s ) .


In order to exfiltrate data from a network segment not connected to the Internet , the threat actor deployed a modified version of hTran . The banking malware GozNym has legs ; only a few weeks after the hybrid Trojan was discovered , it has reportedly spread into Europe and begun plaguing banking customers in Poland with redirection attacks .


There have been numerous reports of hTran being used by different Chinese threat actors , including : APT3 , APT27 and DragonOK . We noted in our original blog the large amount of targeting of Iranian citizens in this campaign , we observed almost one-third of all victims to be Iranian .


The threat actor made some modifications to the original source code of hTran . Since early 2013 , we have observed activity from a unique threat actor group , which we began to investigate based on increased activities against human right activists in the beginning of 2015 .


The threat actor had a specific pattern of behavior that allowed us to understand their modus operandi : they used one server with the same IP address for multiple operations . Over the course of three years of observation of campaigns targeting civil society and human rights organizations , from records of well over two hundred spearphishing and other intrusion attempts against individuals inside of Iran and in the diaspora , a narrative of persistent intrusion efforts emerges .


There are previous reports of threat actors including APT10 and APT1 using dynamic DNS . Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware .


Our investigation showed that these attacks were targeted , and that the threat actor sought to steal communications data of specific individuals in various countries . The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) .


The data exfiltrated by this threat actor , in conjunction with the TTPs and tools used , allowed us to determine with a very high probability that the threat actor behind these malicious operations is backed by a nation state , and is affiliated with China . One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges .


Symantec saw the first evidence of Sowbug-related activity with the discovery in March 2017 of an entirely new piece of malware called Felismus used against a target in Southeast Asia . As in the past , these messages have been sent accounts believed to be fake and accounts compromised by Infy , including Kurdish activists that had previously been compromised by the Flying Kitten actor group .


Symantec saw the first evidence of Sowbug group with the discovery in March 2017 of an entirely new piece of malware called Felismus used against a target in Southeast Asia . The Windows 10 Creators Update will bring several enhancements to Windows Defender ATP that will provide SOC personnel with options for immediate mitigation of a detected threat .


Symantec has also been able to connect earlier attack campaigns with Sowbug , demonstrating that it has been active since at least early-2015 and may have been operating even earlier . LEAD and Barium are not known for large-scale spear-phishing , so it is unlikely that SOC personnel would have to deal with multiple machines having been compromised by these groups at the same time .


To date , Sowbug appears to be focused mainly on government entities in South America and Southeast Asia and has infiltrated organizations in Argentina , Brazil , Ecuador , Peru , Brunei and Malaysia . While the machine is in isolation , SOC personnel can direct the infected machine to collect live investigation data , such as the DNS cache or security event logs , which they can use to verify alerts , assess the state of the intrusion , and support follow-up actions .


For example , in a 2015 attack on one South American foreign ministry , the group appeared to be searching for very specific information . The samples provided were alleged to be targeting Tibetan and Chinese Pro-Democracy Activists .


The first evidence of its intrusion dated from May 6 , 2015 but activity appeared to have begun in earnest on May 12 . They are often targeted simultaneously with other ethnic minorities and religious groups in China .


In total , the attackers maintained a presence on the target 's network for four months between May and September 2015 . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups .


We have previously detected groups we suspect are affiliated with the North Korean government compromising electric utilities in South Korea , but these compromises did not lead to a disruption of the power supply . Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China .


Instead , sensitive KHNP documents were leaked by the actors as part of an effort to exaggerate the access they had and embarrass the South Korean Government , a technique we assess North Korea would turn to again in order to instill fear and/or meet domestic propaganda aims . NetTraveler has been used to target diplomats , embassies and government institutions for over a decade , and remains the tool of choice by the adversaries behind these cyber espionage campaigns .


North Korea linked hackers are among the most prolific nation-state threats , targeting not only the U.S. and South Korea but the global financial system and nations worldwide . The NetTraveler group has infected victims across multiple establishments in both the public and private sector including government institutions , embassies , the oil and gas industry , research centers , military contractors and activists .


FireEye has detected more than 20 cyber threat groups suspected to be sponsored by at least four other nation-states attempting to gain access to targets in the energy sector that could have been used to cause disruptions . The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People 's Republics .


CapabilitiesFormBook is a data stealer , but not a full-fledged banker . Although Silence 's phishing emails were also sent to bank employees in Central and Western Europe , Africa , and Asia ) .


FormBook OverviewFormBook is a data stealer and form grabber that has been advertised in various hacking forums since early 2016 . They tried new techniques to steal from banking systems , including AWS CBR ( the Russian Central Bank 's Automated Workstation Client ) , ATMs , and card processing .


The malware may inject itself into browser processes and explorer.exe . However , some phishing emails were sent to bank employees in more than 25 countries of Central and Western Europe , Africa and Asia including : Kyrgyzstan , Armenia , Georgia , Serbia , Germany , Latvia , Czech Republic , Romania , Kenya , Israel , Cyprus , Greece , Turkey , Taiwan , Malaysia , Switzerland , Vietnam , Austria , Uzbekistan , Great Britain , Hong Kong , and others .


The attackers involved in these email campaigns leveraged a variety of distribution mechanisms to deliver the information stealing FormBook malware . An interesting point in the Silence attack is that the cybercriminals had already compromised banking infrastructure in order to send their spear-phishing emails from the addresses of real bank employees and look as unsuspicious as possible to future victims .


Much of the activity was observed in the United States (Figure 11) , and the most targeted industry vertical was Aerospace/Defense Contractors (Figure 12) . A preliminary analysis caught the attention of our Threat Analysis and Intelligence team as it yielded interesting data that , among other things , shows that Silence was targeting employees from financial entities , specifically in the Russian Federation and the Republic of Belarus .


In the last few weeks , FormBook was seen downloading other malware families such as NanoCore . While the Sima moniker could similarly originate from software labels , it is a common female Persian name and a Persian-language Word for " visage " or " appearance " . Given its use in more advanced social engineering campaigns against women 's rights activists , the label seem particularly apt .


We have associated this campaign with APT19 , a group that we assess is composed of freelancers , with some degree of sponsorship by the Chinese government . Samples and resource names contained the family names of prominent Iranians , and several of these individuals received the malware located in their respective folder .


The vulnerability is bypassing most mitigations; however , as noted above , FireEye email and network products detect the malicious documents . For the sake of narrative we are going to focus exclusively to those samples we identified being used in attacks against Iranian civil society and diaspora .


We have previously observed APT19 steal data from law and investment firms for competitive economic purposes . After reviewing all the malware functionalities , we are confident in saying that the attackers look for victims who answer well-defined characteristics and believe that further stages of the attack are delivered only to those who fit the specific victim profile .


Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download . It's coincident that both 'darkhydrus' APT group name and ‘Williams’ user name in PDB path found in this Twitter user .


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 . The 360 Intelligence Center observed four distinct campaigns against Pakistan since 2017 (link) , recently targeting Pakistani businessmen working in China .


Furthermore , there are indications that APT32 actors are targeting peripheral network security and technology infrastructure corporations . In the latest attack , Donot group is targeting Pakistani businessman working in China


This focused intelligence and detection effort led to new external victim identifications as well as providing sufficient technical evidence to link twelve prior intrusions , consolidating four previously unrelated clusters of threat actor activity into FireEye’s newest named advanced persistent threat group: APT32 . A previous , removed , report from another vendor claimed non-specific information about the groups' interest in Chinese universities , but that report has been removed – most likely detections were related to students’ and researchers’ scanning known collected samples and any incidents” remain unconfirmed and unknown .


In mid-2016 , malware that FireEye believes to be unique to APT32 was detected on the networks of a global hospitality industry developer with plans to expand operations into Vietnam . The most popular targets of SneakyPastes are embassies , government entities , education , media outlets , journalists , activists , political parties or personnel , healthcare and banking .


In March 2017 , in response to active targeting of FireEye clients , the team launched a Community Protection Event (CPE) – a coordinated effort between Mandiant incident responders , FireEye as a Service (FaaS) , FireEye iSight Intelligence , and FireEye product engineering – to protect all clients from APT32 activity . Through our continuous monitoring of threats during 2018 , we observed a new wave of attacks by Gaza Cybergang Group1 targeting embassies and political personnel .


In their current campaign , APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros . This could include diplomats , experts in the LOCs of interest related to the Digital Economy Task Force , or possibly even journalists .


APT32 actors continue to deliver the malicious attachments via spear-phishing emails . This focus on training aligns with LYCEUM’s targeting of executives , HR staff , and IT personnel .


APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel files to deliver their initial exploits . Despite the initial perception that the maldoc sample was intended for ICS or OT staff , LYCEUM has not demonstrated an interest in those environments .


In the following weeks , FireEye released threat intelligence products and updated malware profiles to customers while developing new detection techniques for APT32’s tools and phishing lures . The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


Also in 2014 , APT32 carried out an intrusion against a Western country’s national legislature . Group-IB specialists determined that the email addresses of IT bank employees were among the recipients of these emails .


In 2015 , SkyEye Labs , the security research division of the Chinese firm Qihoo 360 , released a report detailing threat actors that were targeting Chinese public and private entities including government agencies , research institutes , maritime agencies , sea construction , and shipping enterprises . While OceanLotus’ targets are global , their operations are mostly active within the APAC region which encompasses targeting private sectors across multiple industries , foreign governments , activists , and dissidents connected to Vietnam .


In order to track who opened the phishing emails , viewed the links , and downloaded the attachments in real-time , APT32 used cloud-based email analytics software designed for sales organizations . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East .


Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnama's manufacturing , consumer products , and hospitality sectors . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups .


Mandiant consultants suspect that APT32 was monitoring web logs to track the public IP address used to request remote images . Based on this , we believe the Rancor attackers were targeting political entities .


APT32 often deploys these backdoors along with the commercially-available Cobalt Strike BEACON backdoor . Other groups , such as Buhtrap , Corkow and Carbanak , were already known to target and successfully steal money from financial institutions and their customers in Russia .


The targeting of private sector interests by APT32 is notable and FireEye believes the actor poses significant risk to companies doing business in , or preparing to invest in , the country . Since last week , iSIGHT Partners has worked to provide details on the power outage in Ukraine to our global customers .


While the motivation for each APT32 private sector compromise varied – and in some cases was unknown – the unauthorized access could serve as a platform for law enforcement , intellectual property theft , or anticorruption measures that could ultimately erode the competitive advantage of targeted organizations . The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes .


While actors from China , Iran , Russia , and North Korea remain the most active cyber espionage threats tracked and responded to by FireEye , APT32 reflects a growing host of new countries that have adopted this dynamic capability . The most recent Scarlet Mimic attacks we have identified were conducted in 2015 and suggest the group has a significant interest in both Muslim activists and those interested in critiques of the Russian government and Russian President Vladimir Putin .


Several Mandiant investigations revealed that , after gaining access , APT32 regularly cleared select event log entries and heavily obfuscated their PowerShell-based tools and shellcode loaders with Daniel Bohannon’s Invoke-Obfuscation framework . Based on analysis of the data and malware samples we have collected , Unit 42 believes the attacks described herein are the work of a group or set of cooperating groups who have a single mission , collecting information on minority groups who reside in and around northwestern China .


Furthermore , APT32 continues to threaten political activism and free speech in Southeast Asia and the public sector worldwide . In the past , Scarlet Mimic has primarily targeted individuals who belong to these minority groups as well as their supporters , but we've recently found evidence to indicate the group also targets individuals working inside government anti-terrorist organizations .


North Korea's Office 39 is involved in activities such as gold smuggling , counterfeiting foreign currency , and even operating restaurants . Our investigation showed that these attacks were targeted , and that the threat actor sought to steal communications data of specific individuals in various countries .


With these details , we will then draw some conclusions about the operators of CARBANAK . CapabilitiesFormBook is a data stealer , but not a full-fledged banker .


Most of these data-stealing capabilities were present in the oldest variants of CARBANAK that we have seen and some were added over time . While discussions of threats in this region often focus on " North America " generally or just the United States , nearly 100 campaigns during this period were either specifically targeted at Canadian organizations or were customized for Canadian audiences .


Since May 2017 , Mandiant experts observed North Korean actors target at least three South Korean cryptocurrency exchanges with the suspected intent of stealing funds . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload .


February saw three particularly interesting publications on the topic of macOS malware: a Trojan Cocoa application that sends system information including keychain data back to the attacker , a macOS version of APT28’s Xagent malware , and a new Trojan ransomware . In this latest incident , the group registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day .


Per a 2015 report from CitizenLab , Gamma Group licenses their software to clients and each client uses unique infrastructure , making it likely that the two documents are being used by a single client . The first time this happened was at the beginning of the month , when Proofpoint researchers blew the lid off a cyber-espionage campaign named Operation Transparent Tribe , which targeted the Indian embassies in Saudi Arabia and Kazakhstan .


As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware . Back in February 2016 , Indian army officials issued a warning against the usage of three apps , WeChat , SmeshApp , and Line , fearing that these apps collected too much information if installed on smartphones used by Indian army personnel .


LATENTBOT is a modular and highly obfuscated type of malware first discovered by FireEye iSIGHT intelligence in December 2015 . According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability .


It is capable of a variety of functions , including credential theft , hard drive and data wiping , disabling security software , and remote desktop functionality . In addition to these , the Animal Farm attackers used at least one unknown , mysterious malware during an operation targeting computer users in Burkina Faso .


Additionally , this incident exposes the global nature of cyber threats and the value of worldwide perspective – a cyber espionage incident targeting Russians can provide an opportunity to learn about and interdict crime against English speakers elsewhere . PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


Recent DRIDEX activity began following a disclosure on April 7 , 2017 . The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


This campaign primarily affected the government sector in the Middle East , U.S. , and Japan . Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015 .


This campaign primarily affected the government sector in the Middle East , U.S. , and Japan . The Poseidon Group actively targets this sort of corporate environment for the theft of intellectual property and commercial information , occasionally focusing on personal information on executives .


FireEye believes that two actors – Turla and an unknown financially motivated actor – were using the first EPS zero-day CVE-2017-0261 , and APT28 was using the second EPS zero-day CVE-2017-0262 along with a new Escalation of Privilege (EOP) zero-day CVE-2017-0263 . The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


Turla and APT28 are Russian cyber espionage groups that have used these zero-days against European diplomatic and military entities . Mark Zuckerberg , Jack Dorsey , Sundar Pichai , and Daniel Ek — the CEOs of Facebook , Twitter , Google and Spotify , respectively — have also fallen victim to the hackers , dispelling the notion that a career in software and technology exempts one from being compromised .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . The group is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . OurMine is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


It is possible that CVE-2017-8759 was being used by additional actors . Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February .


Russian cyber espionage actors use zero-day exploits in addition to less complex measures . Further tracking of the Lazarus’s activities has enabled Kaspersky researchers to discover a new operation , active since at least November 2018 , which utilizes PowerShell to control Windows systems and Mac OS malware to target Apple customers .


The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities . Users who failed to patch their systems may find themselves mining cryptocurrency for threat actors .


Given the release of sensitive victim data , extortion , and destruction of systems , FireEye considers FIN10 to be one of the most disruptive threat actors observed in the region so far . Keeping in mind the sensitivity of passwords , GoCrack includes an entitlement-based system that prevents users from accessing task data unless they are the original creator or they grant additional users to the task .


To install and register the malicious shim database on a system , FIN7 used a custom Base64 encoded PowerShell script , which ran the sdbinst.exe utility to register a custom shim database file containing a patch onto a system . The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


During the investigations , Mandiant observed that FIN7 used a custom shim database to patch both the 32-bit and 64-bit versions of services.exe with their CARBANAK payload . The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


FIN7 is a financially motivated intrusion set that selectively targets victims and uses spear phishing to distribute its malware . This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose .


During the investigations , Mandiant observed that FIN7 used a custom shim database to patch both the 32-bit and 64-bit versions of services.exe with their CARBANAK payload . The attackers used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


CARBANAK malware has been used heavily by FIN7 in previous operations . The admin@338 used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials .


We have not yet identified FIN7’s ultimate goal in this campaign , as we have either blocked the delivery of the malicious emails or our FaaS team detected and contained the attack early enough in the lifecycle before we observed any data targeting or theft . The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


If the attackers are attempting to compromise persons involved in SEC filings due to their information access , they may ultimately be pursuing securities fraud or other investment abuse . The targets were similar to a 2015 TG-4127 campaign — individuals in Russia and the former Soviet states , current and former military and government personnel in the U.S. and Europe , individuals working in the defense and government supply chain , and authors and journalists — but also included email accounts linked to the November 2016 United States presidential election .


The use of the CARBANAK malware in FIN7 operations also provides limited evidence that these campaigns are linked to previously observed CARBANAK operations leading to fraudulent banking transactions , ATM compromise , and other monetization schemes . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


Figure 1 shows a sample phishing email used by HawkEye operators in this latest campaign . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian government .


The HawkEye malware is primarily used for credential theft and is often combined with additional tools to extract passwords from email and web browser applications . APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


HawkEye is a versatile Trojan used by diverse actors for multiple purposes . We have reasons to believe that the operators of the APT28 network are either Russian citizens or citizens of a neighboring country that speak Russian .


We have seen different HawkEye campaigns infecting organizations across many sectors globally , and stealing user credentials for diverse online services . Russian citizens—journalists , software developers , politicians , researchers at universities , and artists are also targeted by Pawn Storm .


Mandiant disclosed these vulnerabilities to Lenovo in May of 2016 . In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 .


For our M-Trends 2017 report , we took a look at the incidents we investigated last year and provided a global and regional (the Americas , APAC and EMEA) analysis focused on attack trends , and defensive and emerging trends . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


As we noted in M-Trends 2016 , Mandiant’s Red Team can obtain access to domain administrator credentials within roughly three days of gaining initial access to an environment , so 99 days is still 96 days too long . In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines .


On top of our analysis of recent trends , M-Trends 2017 contains insights from our FireEye as a Service (FaaS) teams for the second consecutive year . APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


In Figure 1 , which is based on FireEye Dynamic threat Intelligence (DTI) reports shared in March 2017 , we can see the regions affected by Magnitude EK activity during the last three months of 2016 and the first three months of 2017 . APT37 targeted a research fellow , advisory member , and journalist associated with different North Korean human rights issues and strategic organizations .


Magnitude EK activity then fell off the radar until Oct. 15 , 2017 , when it came back and began focusing solely on South Korea . The majority of APT37 activity continues to target South Korea , North Korean defectors , and organizations and individuals involved in Korean Peninsula reunification efforts .


The Magnitude EK landing page consisted of CVE-2016-0189 , which was first reported by FireEye as being used in Neutrino Exploit Kit after it was patched . In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company .


Throughout the final quarter of 2016 and first month of 2017 , FireEye Dynamic Threat Intelligence (DTI) observed consistent Magnitude EK hits from several customers , the majority of whom reside in the APAC region . Per the complaint , the email account watsonhenny@gmail.com was used to send LinkedIn invitations to employees of a bank later targeted by APT38 .


In January 2017 , new domain names appeared in the campaign hosted on a different IP location . The APT38 uses DYEPACK to manipulate the SWIFT transaction records and hide evidence of the malicious transactions , so bank personnel are none the wiser when they review recent transactions .


Many groups leverage the regsvr32.exe application whitelisting bypass , including APT19 in their 2017 campaign against law firms . APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns .


This trend continued until late September 2017 , when we saw Magnitude EK focus primarily on the APAC region , with a large chunk targeting South Korea . Other groups attributed to Iranian attackers , such as Rocket Kitten , have targeted Iranian individuals in the past , including anonymous proxy users , researchers , journalists , and dissidents .


These ransomware payloads only seem to target Korean systems , since they won’t execute if the system language is not Korean . We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers .


The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits , including the EternalBlue exploit used in the WannaCry attack from May 2017 . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


In our Revoke-Obfuscation white paper , first presented at Black Hat USA 2017 , we provide background on obfuscated PowerShell attacks seen in the wild , as well as defensive mitigation and logging best practices . The group has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


The malware leverages an exploit , codenamed EternalBlue” , that was released by the Shadow Brokers on April 14 , 2017 . Gallmaker 's targets are embassies of an Eastern European country .


The malware appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD (via Bitcoin) to decrypt the data . However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers .


The malware then builds two DLLs in memory – they are 32 and 64-bit DLLs that have identical functionality . 360 and Tuisec already identified some Gorgon Group members .


The malware continues by creating a service named mssecsvc2.0 with a binary path pointing to the running module with the arguments -m security . Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers .


The malware then writes the R resource data to the file C:\WINDOWS\tasksche.exe . This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets Bitcoin users and global financial organizations .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . Beginning in 2017 , the Lazarus group heavily targeted individuals with spear phishing emails impersonating job recruiters which contained malicious documents .


Attaching with IDA Pro via WinDbg as in Figure 11 shows that the program counter points to the infinite loop written in memory allocated by flare-qdb . We concluded that Lazarus Group was responsible for WannaCry , a destructive attack in May that targeted Microsoft customers .


We recently observed a resurgence of the same phishing campaign when our systems detected roughly 90 phony Apple-like domains that were registered from July 2016 to September 2016 . The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan .


In this blog we provide insight into the tactics , techniques and procedures (TTPs) of a Brazilian cyber crime group that specializes in payment card fraud operations . On November 10 , 2015 , threat actors sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


The threat actors , observed by FireEye Labs , use a variety of different methods to either compromise or acquire already compromised payment card credentials , including sharing or purchasing dumps online , hacking vulnerable merchant websites and compromising payment card processing devices . On November 10 , 2015 , Lotus Blossom sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


Once in their possession , the actors use these compromised payment card credentials to generate further card information . APT threat actors , most likely nation state-sponsored , targeted a diplomat in the French Ministry of Foreign Affairs with a seemingly legitimate invitation to a technology conference in Taiwan .


The members of the group use a variety of tools , including CCleaner , on a daily basis to effectively remove any evidence of their operations . Additionally , the targeting of a French diplomat based in Taipei , Taiwan aligns with previous targeting by these actors , as does the separate infrastructure .


Another common step taken by threat actors is changing their system's MAC Address to avoid being uniquely identified . Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents .


For this purpose , these actors often use tools such as Technitium MAC Address Changer . APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors .


We have observed these actors using Tor or proxy-based tools similar to Tor (e.g , UltraSurf , as seen in Figure 2) . COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . The Magic Hound has repeatedly used social media to identify and interact with employees at targeted organizations and then used weaponized Excel documents .


Based on our observations , this group uses a variety of different methods to either compromise or acquire already compromised payment card credentials . The May 2014 ' Operation Saffron Rose ' publication identifies an Iranian hacking group formerly named ' Ajax Security ' ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


Payment card dumps are commonly shared amongst Brazilian threat actors via social media forums such as Facebook , Skype , and web-based WhatsApp messenger . An Iranian hacking group formerly named Ajax Security ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


Similarly , the group takes advantage of freely available consolidations of email credentials , personal information , and other data shared in eCrime forums for fraud purposes . PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 .


These actors scan websites for vulnerabilities to exploit to illicitly access databases . APT10 is known to have exfiltrated a high volume of data from multiple victims , exploiting compromised MSP networks , and those of their customers , to stealthily move this data around the world .


They most commonly target Brazilian merchants , though others use the same tactics to exploit entities outside Brazil . Targeted sectors of Molerats include governmental and diplomatic institutions , including embassies ; companies from the aerospace and defence Industries ; financial institutions ; journalists ; software developers .


The group also uses the SQL injection (SQLi) tools Havij Advanced SQL Injection Tool and SQLi Dumper version 7.0 (Figure 4) to scan for and exploit vulnerabilities in targeted eCommerce sites . It was during operator X 's network monitoring that the attackers placed Naikon proxies within the countries ' borders , to cloak and support real-time outbound connections and data Exfiltration from high-profile victim organizations .


At least eight sellers update the website as frequently as daily , offering newly obtained databases from the U.S . In early May 2016 , both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe .


Once in possession of compromised payment card credentials , these actors use tools commonly known as card generators to generate new card numbers based on the compromised ones , creating additional opportunities for monetization . Although most malware today either seeks monetary gain or conducts espionage for economic advantage , both of these activity groups appear to seek information about specific individuals .


One bulk card-checking tool this group uses is Testador Amazon.com v1.1 ( Figure 8 ) . Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information .


Despite its name , this tool does not use Amazon’s website , but exploits an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability of a merchant website allowing the abuse of PayPal Payflow link functionality (Figure 9) . Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information .


Based on our observations of interactions in this channel , between May 2016 and June 2016 , malicious actors validated 2 , 987 cards from 62 countries , with the most coming from the U.S. (nearly half) , Brazil , and France . Additionally , HELIX KITTEN actors have shown an affinity for creating thoroughly researched and structured spear-phishing messages relevant to the interests of targeted personnel .


The actors frequently use the stolen data to create cloned physical cards , which they use to attempt to withdraw funds from ATMs . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East .


The group primarily uses the MSR 606 Software (Figure 12) and Hardware (Figure 13) to create cloned cards . In late 2015 , Symantec identified suspicious activity involving a hacking tool used in a malicious manner against one of our customers .


However , Brazilian actors commonly use several methods to do so , such as reselling cards they have created , paying bills with stolen cards in return for a portion of the bill's value and reselling illicitly obtained goods . The SWC of a Uyghur cultural website suggests intent to target the Uyghur ethnic group , a Muslim minority group primarily found in the Xinjiang region of China .


Some attacker tools were used to almost exclusively target organizations within APAC . It's possible TG-3390 used a waterhole to infect data center employees .


In April 2015 , we uncovered the malicious efforts of APT30 , a suspected China-based threat group that has exploited the networks of governments and organizations across the region , targeting highly sensitive political , economic and military information . The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center .


The individuals using Hancitor malware also known by the name Chanitor are no exception and have taken three approaches to deliver the malware in order to ultimately steal data from their victims . The group , believed to be based in China , has also targeted defense contractors , colleges and universities , law firms , and political organizations — including organizations related to Chinese minority ethnic groups .


We recently observed Hancitor attacks against some of our FireEye Exploit Guard customers . In all cases , based on the nature of the computers infected by Thrip , it appeared that the telecoms companies themselves and not their customers were the targets of these attacks .


The group has performed these activities at multiple locations across Brazil , possibly using multiple mules . Turla is a notorious group that has been targeting government officials .


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . Turla is a notorious group that has been targeting diplomats .


The attachment in these emails is a weaponized Microsoft Office document containing a malicious macro that – when enabled – leads to the download of Hancitor . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including embassies .


After the executable is executed , it downloads Pony and Vawtrak malware variants to steal data . From February to September 2016 , WhiteBear activity was narrowly focused on embassies and consular operations around the world .


Upon execution , it will communicate with an attacker-controller website to download a variant of the Pony malware , pm.dll” along with a standard Vawtrak trojan . All of these early WhiteBear targets were related to embassies and diplomatic/foreign affair organizations .


In this blog , FireEye Labs dissects this new ATM malware that we have dubbed RIPPER (due to the project name ATMRIPPER” identified in the sample) and documents indicators that strongly suggest this piece of malware is the one used to steal from the ATMs at banks in Thailand . Thus , Turla operators had access to some highly sensitive information ( such as emails sent by the German Foreign Office staff ) for almost a year .


RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism . We suspect the Kazuar tool may be linked to the Turla threat actor group ( also known as Uroburos and Snake ) , who have been reported to have compromised embassies , defense contractors , educational institutions , and research organizations across the globe .


RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself . Deepen told Threatpost the group has been operating since at least since 2008 and has targeted China and US relations experts , Defense Department entities , and geospatial groups within the federal government .


Once a valid card with a malicious EMV chip is detected , RIPPER will instantiate a timer to allow a thief to control the machine . Government officials said they knew the initial attack occurred in 2011 , but are unaware of who specifically is behind the attacks .


This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 .


From our trend analysis seen in Figure 3 , Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August . Later that month , the same tactics and patterns were seen in attempts against an Iranian women 's activist – an individual commonly targeted by Iranian actors , such as Charming Kitten and the Sima campaign documented in our 2016 Black Hat talk .


Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before . Several times , APT5 has targeted organizations and personnel based in Southeast Asia .


FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform . Given our increased confidence that Bahamut was responsible for targeting of Qatari labor rights advocates and its focus on the foreign policy institutions other Gulf states , Bahamut 's interests are seemingly too expansive to be limited one sponsor or customer .


The samples we identified target the ATM vendor Diebold . Barium specializes in targeting high value organizations holding sensitive data , by gathering extensive information about their employees through publicly available information and social media , using that information to fashion phishing attacks intended to trickthose employees into compromising their computers and networks .


This blog covers the changes , improvements , and Indicators of Compromise (IOC) of Ploutus-D in order to help financial organizations identify and defend against this threat . Barium has targeted Microsoft customers both in Virginia , the United States , and around the world .


Ploutus-D also allows the attackers to enter the amount to withdraw (billUnits – 4 digits) and the number of cycles (billCount – 2 digits) to repeat the dispensing operation (see Figure 10) . BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years .


Ploutus-D will load KXCashDispenserLib” library implemented by Kalignite Platform (K3A.Platform.dll) to interact with the XFS Manager and control the Dispenser (see Figure 13) . Our research indicates that it has started targeting Japanese users .


Since Ploutus-D interacts with the Kalignite Platform , only minor modifications to the Ploutus-D code may be required to target different ATM vendors worldwide . Our experts have found that cybercriminals are actively focusing on SMBs , and giving particular attention to accountants .


Finally , Mandiant’s Devon Kerr and John Miller of FireEye iSIGHT Intelligence will expose the tactics of FIN7 , a financially motivated hacker group that FireEye tracked throughout 2016 . Clever Kitten actors have a strong affinity for PHP server-side attacks to make access ; this is relatively unique amongst targeted attackers who often favor targeting a specific individual at a specific organization using social engineering .


In mid-November , Mandiant , a FireEye company , responded to the first Shamoon 2.0 incident against an organization located in the Gulf states . Some of the exploit server paths contain modules that appear to have been designed to infect Linux computers , but we have not yet located the Linux backdoor .


These attackers can potentially grab sensitive online banking information and other personal data , and even provided support for multifactor authentication and OTP . Confucius targeted a particular set of individuals in South Asian countries , such as military personnel and businessmen , among others .


FireEye Labs detects this phishing attack and customers will be protected against the usage of these sites in possible future campaigns . According to statistics , Corkow primarily targets users in Russia and the CIS , but it is worth noting that in 2014 the amount of attacks targeting the USA increased by 5 times , in comparison with 2011 .


Our visibility into APT28’s operations , which date to at least 2007 , has allowed us to understand the group’s malware , operational changes and motivations . The threat is likely targeting employees of various Palestinian government agencies , security services , Palestinian students , and those affiliated with the Fatah political party .


This intelligence has been critical to protecting and informing our clients , exposing this threat and strengthening our confidence in attributing APT28 to the Russian government . For example , the actors behind FrozenCell used a spoofed app called Tawjihi 2016 , which Jordanian or Palestinian students would ordinarily use during their general secondary examination .


The threat actors used two publicly available techniques , an AppLocker whitelisting bypass and a script to inject shellcode into the userinit.exe process . The titles and contents of these files suggest that the actor targeted individuals affiliated with these government agencies and the Fatah political party .


The regsvr32.exe executable can be used to download a Windows Script Component file (SCT file) by passing the URL of the SCT file as an argument . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) .


We observed implementation of this bypass in the macro code to invoke regsvr32.exe , along with a URL passed to it which was hosting a malicious SCT file . Targets included a wide array of high-profile entities , including intelligence services , military , utility providers ( telecommunications and power ) , embassies , and government institutions .


There was code to download a decoy document from the Internet and open it in a second winword.exe process using the Start-Process cmdlet . The computers of diplomats , military attachés , private assistants , secretaries to Prime Ministers , journalists and others are under the concealed control of unknown assailant (s ) .


Ordnance will be able to immediately generate shellcode after users provide the IP and Port that the shellcode should connect to or listen on . The banking malware GozNym has legs ; only a few weeks after the hybrid Trojan was discovered , it has reportedly spread into Europe and begun plaguing banking customers in Poland with redirection attacks .


Therefore , the Stuxnet MOF file creation tool that the Shadow Brokers dropped on Friday is possibly the earliest technical evidence that NSA hackers and developers coded Stuxnet , as many suspect . We noted in our original blog the large amount of targeting of Iranian citizens in this campaign , we observed almost one-third of all victims to be Iranian .


Of course , it 's also possible that whatever group The Shadow Brokers have exposed simply gained access to the Stuxnet tools secondhand , and reused them . Since early 2013 , we have observed activity from a unique threat actor group , which we began to investigate based on increased activities against human right activists in the beginning of 2015 .


That post included download links for a slew of NSA hacking tools and exploits , many of which could be used to break into hardware firewall appliances , and in turn , corporate or government networks . Over the course of three years of observation of campaigns targeting civil society and human rights organizations , from records of well over two hundred spearphishing and other intrusion attempts against individuals inside of Iran and in the diaspora , a narrative of persistent intrusion efforts emerges .


Some hackers even went onto use the Cisco exploits in the wild . Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware .


DanderSpritz consists entirely of plugins to gather intelligence , use exploits and examine already controlled machines . The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) .


DanderSpritz consists entirely of plugins to gather intelligence , use exploits and examine already controlled machines . One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges .


DarkPulsar is a very interesting administrative module for controlling a passive backdoor named ' sipauth32.tsp ' that provides remote control , belonging to this category . As in the past , these messages have been sent accounts believed to be fake and accounts compromised by Infy , including Kurdish activists that had previously been compromised by the Flying Kitten actor group .