The ransom demand for 0.2 Bitcoins ( roughly $ 180 ) is a much higher ransom demand than has been seen in mobile ransomware so far . He is responsible for developing tools for conducting attacks and is also able to modify complex exploits and third party software . In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software : browsers , email clients , messengers , etc. , and can act as a keylogger . Monitor for newly constructed user accounts that may attempt to hide artifacts associated with their behaviors to evade detection .


By comparison , the DataLust ransomware demanded merely $ 15 . Silence 's main targets are located in Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan . Since the beginning of 2019 , we have collected more than 1300 samples and extracted more than 130 C2s . Monitor for contextual data about an account , which may include a username , user ID , environmental data that may attempt to hide artifacts associated with their behaviors to evade detection .


Payments are made to a specific Bitcoin account , but we haven ’ t identified any payments so far . However , some phishing emails were sent to bank employees in more than 25 countries of Central and Western Europe , Africa and Asia including : Kyrgyzstan , Armenia , Georgia , Serbia , Germany , Latvia , Czech Republic , Romania , Kenya , Israel , Cyprus , Greece , Turkey , Taiwan , Malaysia , Switzerland , Vietnam , Austria , Uzbekistan , Great Britain , Hong Kong , and others . To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments : MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT . Monitor for changes made to windows registry keys and/or values that may attempt to hide artifacts associated with their behaviors to evade detection .


Adware commonly found on Play collects profits from ad networks , but mobile ransomware inflicts direct harm to users . In the same year , they conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans . They also use AutoIT droppers , password-protected EXE files and even ISO images . CSP can define a list of domains that the browser should be allowed to interact with for the visited URL .


Like FakeDefender and DataLust , Charger could be an indicator of a wider effort by mobile malware developers to catch up with their PC ransomware cousins . In the same year , Silence conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans . What is interesting , in some emails , they ask targets to phone them if they have any questions , like the FIN7 guys do . Designed to guard against XSS attacks , CSP helps control which domains can be accessed as part of a page and therefore restricts which domains to share data with .


Similar to other malware seen in the past , Charger checks the local settings of the device and does not run its malicious logic if the device is located in Ukraine , Russia , or Belarus . In two months , the group returned to their proven method and withdrew funds again through ATMs . During the investigation into FIN7 , our threat-hunting systems found an interesting overlap in between the infrastructure of FIN7 and AveMaria . It even can restrict forms to be sent only to specific hosts , using the form - action directive .


This is likely done to keep the developers from being prosecuted in their own countries or being extradited between countries . In September 2017 , we discovered a new targeted attack on financial institutions . Basically , two servers in the same IP range and AS14576 ( autonomous system ) share a non-standard SSH port , which is 222 . These restrictions are specified by a list of allowed URIs .


Most malware found on Google Play contains only a dropper that later downloads the real malicious components to the device . In September 2017 , we discovered Silence attack on financial institutions . One of the servers is a Griffon C2, and the other one , an AveMaria C2 . By analyzing field data we see a gap in the implementation of CSP , and even for sites that do use it correctly , this creates an open window to exfiltrate data .


Charger , however , uses a heavy packing approach which it harder for the malware to stay hidden , so it must compensate with other means . The infection vector is a spear-phishing email with a malicious attachment . Distribution of targets is another factor suggesting that these two malware families may be connected . Our demonstration shows how using the Google Analytics API , a web skimmer can send data to be collected in his own account instance .


The developers of Charger gave it everything they had to boost its evasion capabilities and so it could stay hidden on Google Play for as long as possible . An interesting point in the Silence attack is that the cybercriminals had already compromised banking infrastructure in order to send their spear-phishing emails from the addresses of real bank employees and look as unsuspicious as possible to future victims . We analyzed AveMaria targets during February and March of 2019 . As Google Analytics is allowed in the CSP configuration of many major sites , this demo shows how an attacker can bypass this security protection and steal data .


The malware uses several advanced techniques to hide its real intentions and makes it harder to detect . The spear-phishing infection vector is still the most popular way to initiate targeted campaigns . The spearphishing emails were sent to various kinds of businesses only and did not target individuals . Our gathered field data shows the following statistics on CSP usage across the Internet ( based on HTTPArchive March 2020 scan ):


It encodes strings into binary arrays , making it hard to inspect them . We conclude that the actor behind the attack is Silence group , a relatively new threat actor that's been operating since mid-2016 . Thirty percent of the targets were small and medium-sized companies that were suppliers or service providers for bigger players and 21% were various types of manufacturing companies . Looking at the top 3 M domains , only 210 K use CSP .


It loads code from encrypted resources dynamically , which most detection engines can not penetrate and inspect . A preliminary analysis caught the attention of our Threat Analysis and Intelligence team as it yielded interesting data that , among other things , shows that Silence was targeting employees from financial entities , specifically in the Russian Federation and the Republic of Belarus . We also spotted several typical FIN7 targets , such as retailers and hotels . Most do n’t even do much besides Since the most common allowed domain is google-analytics.com ( 17 K websites )


The dynamically-loaded code is also flooded with meaningless commands that mask the actual commands passing through . As shown above , the threat runs several native binaries to collect useful information for its recon phase . Most AveMaria targets ( 72% ) were in the EU . We took google - analytics as an example , but other services can also be used .


It checks whether it is being run in an emulator before it starts its malicious activity . The intelligence we have collected shows that Silence is part of a more extensive operation , still focused on financial institutions operating mainly on Russian territory . At the end of 2018 , while searching for new FIN7 campaigns via telemetry , we discovered a set of activity that we temporarily called “ CopyPaste ” from a previously unknown APT . As an example , we took the twitter login page , which implemented the following CSP rule ( which contains ): The following short JS code inserted into the site will send the credentials to google - analytics console controlled by us : The UA-#######- # parameter is the tag ID owner that Google Analytics uses to connect the data to a specific account .


PC malware first introduced this technique which is becoming a trend in mobile malware having been adopted by several malware families including Dendroid . These spearphishing attempts represent an evolution of Iranian actors based on their social engineering tactics and narrow targeting . Interestingly , this actor targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center . Instead of using twitter ’s google - analytic account , we used an account we control .


Emulator and location conditions for the malware ’ s activity Check Point Mobile Threat Prevention customers are protected from Charger and similar malware . Based on file modification dates and timestamps of samples , it appears that the observed campaign was initiated in the middle of February 2016 , with the infrastructure taken offline at the start of March . This set of activity relied on open-source tools , such as Powershell Empire , and well-documented red teaming techniques , in order to get a foothold within the victim’s networks and avoid detection . Unfortunately , the CSP policy ca n’t discriminate based on the Tag ID .


Check Point ’ s Analysis and Response Team ( ART ) disclosed the finding to Android ’ s Security team who took the appropriate security steps to remove the infected app and added the malware to Android ’ s built-in protection mechanisms . While the Sima moniker could similarly originate from software labels , it is a common female Persian name and a Persian-language word for " visage " or " appearance " . The links between CopyPaste and FIN7 are still very weak . Though Google meant to have this parameter be used to mention the page the user visited , we used it to exfiltrate the user name and password data encoded in base64 .


Charger SHA256 hash : 58eb6c368e129b17559bdeacb3aed4d9a5d3596f774cf5ed3fdcf51775232ba0 Infostealer , Keylogger , and Ransomware in One : Anubis Targets More than 250 Android Applications October 29 , 2021 The Cofense Phishing Defense Center uncovered a phishing campaign that specifically targets users of Android devices that could result in compromise if unsigned Android applications are permitted on the device . Given its use in more advanced social engineering campaigns against women 's rights activists , the label seem particularly apt . It is possible that the CopyPaste operators were influenced by open-source publications and do not have any ties with FIN7 . In our Google Analytics platform , we will see the data as : In our demo the DP will result in page view of Which will be decoded from base64 as : The source of the problem is that the CSP rule system is n’t granular enough .


The campaign seeks to deliver Anubis , a particularly nasty piece of malware that was originally used for cyber espionage and retooled as a banking trojan . Samples and resource names contained the family names of prominent Iranians , and several of these individuals received the malware located in their respective folder . During 2018 , Europol and DoJ announced the arrest of the leader of the FIN7 and Carbanak S-APT/CobaltGoblin cybercrime groups . Recognizing and stopping the above malicious JavaScript request requires advanced visibility solutions that can detect the access and exfiltration of sensitive user data ( in this case the user ’s email address and password ) .


Anubis can completely hijack an Android mobile device , steal data , record phone calls , and even hold the device to ransom by encrypting the victim ’ s personal files . The Sima group also engaged in impersonation of Citizenship and Immigration Services at the Department of Homeland Security , posing as a notice about the expiration of the recipient 's Permanent Residence status . It was believed that the arrest of the group leader will have an impact on the group’s operations . One might think we could have updated the CSP to only allow specific TIDs : .


With mobile devices increasingly used in the corporate environment , thanks to the popularity of BYOD policies , this malware has the potential to cause serious harm , mostly to consumers , and businesses that allow the installation of unsigned applications . In another case , Sima mirrored an announcement made about the broadcast of a television program on Iranian-American cultural affairs in order to impersonate the individual and engage in spearphishing within hours of the legitimate message . However , recent data seems to indicate that the attacks have continued without significant drawbacks . The problem is that CSP does n't support query strings ( See Spec ):


Here ’ s how it works : At first glance , the email shown in Figure 1 looks like any other phishing email that asks the user to download an invoice . The server used to host these malware samples was located on the German provider Hetzner ( 148.251.55.114 ) , within a small block of IP addresses that are registered with the customer ID " HOS-156205 " . One may say CobaltGoblin and FIN7 have even extended the number of groups operating under their umbrella . Having such a gap with the most commonly used domain allowed with CSP is a major risk indicator of the threats that can come from other domains that are used to serve multiple accounts .


However , this particular email downloads an Android Package Kit ( APK ) , which is the common format used by Android to distribute and install applications . All the samples appear to be have been compiled between February 29 and March 1 2016 , shortly before our discovery , suggesting that , despite the known C&C servers having quickly gone offline shortly after , this spree of attacks might be fresh and currently undergoing . We observe , with various level of confidence , that there are several interconnected groups using very similar toolkits and the same infrastructure to conduct their cyberattacks . A possible solution would come from adaptive URLs , adding the ID as part of the URL or subdomain to allow admins to set CSP rules that restrict data exfiltration to other accounts .


Let ’ s take a closer look at the suspicious file . These archives provide further indication that those entities behind the campaigns are Persian-language speakers , due to the naming of files and folders in Persian . The first of them is the well-known FIN7 , which specializes in attacking various companies to get access to financial data or PoS infrastructure . A more granular future direction for strengthening CSP direction to consider as part of the CSP standard is XHR proxy enforcement .


Figure 1 – Phishing Email When the email link is opened from an Android device , an APK file ( Fattura002873.apk ) , is downloaded . For the sake of narrative we are going to focus exclusively to those samples we identified being used in attacks against Iranian civil society and diaspora . They rely on a Griffon JS backdoor and Cobalt S-MAL/Meterpreter , and in recent attacks , Powershell Empire . This will essentially create a client - side WAF that can enforce a policy on where specific data field are allowed to be transmitted .


Upon opening the file , the user is asked to enable “ Google Play Protect ” as shown in Figure 2 . Butterfly has attacked multi-billion dollar companies operating in the internet , IT software , pharmaceutical , and commodities sectors . The second one is CobaltGoblin S-APT/Carbanak S-APT/EmpireMonkey , which uses the same toolkit , techniques and similar infrastructure but targets only financial institutions and associated software/services providers . In addition to the complexity of managing CSP rules , this vulnerability shows how widely used services such as Google Analytics can be subverted to bypass this protection .


However , this is not a genuine “ Google Play Protect ” screen ; instead it gives the app all the permissions it needs while simultaneously disabling the actual Google Play Protect . The first signs of Butterfly 's activities emerged in early 2013 when several major technology and internet firms were compromised . We link the AveMaria botnet to these two groups with medium confidence : AveMaria ’s targets are mostly suppliers for big companies , and the way AveMaria manages its infrastructure is very similar to FIN7 . Over 5 years ago , we began tracking a new campaign that we called FakeUpdates ( also known as SocGholish ) that used compromised websites to trick users into running a fake browser update .


Figure 2 – Granting Permissions The following permissions are granted to the app : Figure 3 – Permissions Granted to App A closer look at the code reveals the application gathers a list of installed applications to compare the results against a list of targeted applications ( Figure 4 ) . However , an investigation by Symantec has found that the group has been active since at least March 2012 and its attacks have not only continued to the present day , but have also increased in number . The last piece is the newly discovered CopyPaste group , who targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center . Instead , victims would end up infecting their computers with the NetSupport RAT , allowing threat actors to gain remote access and deliver additional payloads .


The malware mainly targets banking and financial applications , but also looks for popular shopping apps such as eBay or Amazon . Symantec has to date discovered 49 different organizations in more than 20 countries that have been attacked by Butterfly . The links between CopyPaste and FIN7 are still very weak . As we have seen over the years , SocGholish is an established player that has managed to compromise countless victims and deliver ransomware after facilitating the installation of tools like Cobalt Strike or Mimikatz .


A full list of targeted applications is included in the IOC section at the end of this post . Aside from the four companies which have publicly acknowledged attacks , Symantec has identified five other large technology firms compromised by Butterfly , primarily headquartered in the US . It is possible that the operators of this cluster of activity were influenced by open-source publications and do not have any ties with FIN7 . The new campaign , which we call FakeSG , also relies on hacked WordPress websites to display a custom landing page mimicking the victim 's browser .


Once an application has been identified , Anubis overlays the original application with a fake login page to capture the user ’ s credentials . In the first attack , Butterfly gained a foothold by first attacking a small European office belonging to one firm and using this infection to then move on to its US office and European headquarters . All of the aforementioned groups greatly benefit from unpatched systems in corporate environments . The threat actors are distributing NetSupport RAT either as a zipped download or via an Internet shortcut .


Figure 4 – Checking for installed apps Based on a thorough analysis of the code , the most interesting technical capabilities include : Capturing screenshots Enabling or changing administration settings Opening and visiting any URL Disabling Play Protect Recording audio Making phone calls Stealing the contact list Controlling the device via VNC Sending , receiving and deleting SMS Locking the device Encrypting files on the device and external drives Searching for files Retrieving the GPS location Capturing remote control commands from Twitter and Telegram Pushing overlays Reading the device ID The malware includes However , technology is not the only sector the group has focused on and Symantec has found evidence that Butterfly has attacked three major European pharmaceutical firms . They thus continue to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework . While FakeSG appears to be a newcomer , it uses different layers of obfuscation and delivery techniques that make it a threat to take seriously and which could potentially rival with SocGholish .


a keylogger that works in every app installed on the Android device . Butterfly has also shown an interest in the commodities sector , attacking two major companies involved in gold and oil in late 2014 . So far , the groups have not used any zero-days . We first heard of this new campaign thanks to a Mastodon post by Randy McEoin .


However , the keylogger needs to be specifically enabled by a command sent from the C2 server . The company specializes in finance and natural resources specific to that region . FIN7 S-APT/Cobalt phishing documents may seem basic , but when combined with their extensive social engineering and focused targeting , they are quite successful . The tactics , techniques and procedures ( TTPs ) are very similar to those of SocGholish and it would be easy to think the two are related .


The keylogger can track three different events ( Figure 5 ) : TYPE_VIEW_CLICKED Represents the event of clicking on a View-like Button , CompoundButton , etc . The latter was one of at least three law firms Butterfly has targeted over the past three years . As with their previous fake company “ Combi Security ” , we are confident that they continue to create new personas for use in either targeting or recruiting under a “ new ” brand , “ IPC ” . In fact , this chain also leads to NetSupport RAT .


TYPE_VIEW_FOCUSED Represents the event of setting input focus of a View . In many attacks , the group has succeeded in compromising Microsoft Exchange or Lotus Domino email servers in order to intercept company emails and possibly use them to send counterfeit emails . AveMaria : 185.61.138.249 tain.warzonedns.com noreply377.ddns.net 185.162.131.97 91.192.100.62 server.mtcc.me doddyfire.dyndns.org 212.8.240.116 168.167.45.162 toekie.ddns.net warmaha.warzonedns.com . As a result , we decided to call this variant FakeSG .


TYPE_VIEW_TEXT_CHANGED Represents the event of changing the text of an EditText . A powerful threat actor known as " Wild Neutron " ( also known as " Jripbot " and " Morpho " ) has been active since at least 2011 , infecting high profile companies for several years by using a combination of exploits , watering holes and multi-platform malware . CopyPaste : digi-cert.org somtelnetworks.com geotrusts.com secureclientupdate.com digicertweb.com sport-pesa.org itaxkenya.com businessdailyafrica.net infotrak-research.com nairobiwired.com k-24tv.com . 2023 - 07 - 19 Update : On June 5 , @SecurityAura described an unknown campaign using .hta payloads disguised as driver updates .


Figure 5 – Keylogger component Figure 6 shows one of the most noteworthy functions of Anubis : its ransomware module . Based on the profile of the victims and the type of information targeted by the attackers , Symantec believes that Butterfly is financially motivated , stealing information it can potentially profit from . FIN7 S-APT/GRIFFON : hpservice-cdn.com realtek-cdn.com logitech-cdn.com pci-cdn.com appleservice-cdn.com servicebing-cdn.com . On June 22 , @AnFam17 spotted the same fake browser update leveraging URL shortcuts .


The malware searches both internal and external storage and encrypts them using RC4 . Wild Neutron hit the spotlight in 2013 , when it successfully infected companies such as Apple , Facebook , Twitter and Microsoft . ScarCruft continues to evolve, introduces Bluetooth harvester . Both of these campaigns use a similar structure with compromised WordPress sites hosting the lure shortcuts and a WebDav server that loads NetSupport RAT .


It adds the file extension .AnubisCrypt to each encrypted file and sends it to the C2 . Wild Neutron 's attacks in 2015 uses a stolen code signing certificate belonging to Taiwanese electronics maker Acer and an unknown Flash Player exploit . After publishing our initial series of blogposts back in 2016 , we have continued to track the ScarCruft threat actor . RussianPanda ( @AnFam17 ) named the URL shortcut campaign RogueRaticate .


Figure 6 – Ransomware component Anubis has been known to utilize Twitter or Telegram to retrieve the C2 address and this sample is no exception ( Figure 7 ) . During the 2013 attacks , the Wild Neutron actor successfully compromised and leveraged the website www.iphonedevsdk.com , which is an iPhone developers forum . ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula . FakeSG has different browser templates depending on which browser the victim is running .


Figure 7 – C2 As seen in Figure 8 , this version of Anubis is built to run on several iterations of the Android operating system , dating back to version 4.0.3 , which was released in 2012 . Wild Neutron 's attack took advantage of a Java zero-day exploit and used hacked forums as watering holes . We recently discovered some interesting telemetry on this actor , and decided to dig deeper into ScarCruft ’s recent activity . The themed " updates " look very professional and are more up to date than its SocGholish counterpart .


Figure 8 – Android requirements Android malware has been around for many years and will be with us for the foreseeable future . While the group used watering hole attacks in 2013 , it's still unclear how victims get redirected to the exploitation kits in the new 2014-2015 attacks . This shows that the actor is still very active and constantly trying to elaborate its attack tools . Compromised websites ( WordPress appears to be the top target ) are injected with a code snippet that replaces the current webpage with the aforementioned fake updates templates .


Users who have configured their Android mobile device to receive work-related emails and allow installation of unsigned applications face the most risk of compromise . Wild Neutron 's tools include a password harvesting trojan , a reverse-shell backdoor and customized implementations of OpenSSH , WMIC and SMB . Based on our telemetry , we can reassemble ScarCruft ’s binary infection procedure . The source code is loaded from one of several domains impersonating Google ( google - analytiks[.]com ) or Adobe ( updateadobeflash[.]website ): That code contains all the web elements ( images , fonts , text ) needed to render the fake browser update page .


APK files will not natively open in an environment other than an Android device . Instead of Flash exploits , older Wild Neutron exploitation and watering holes used what was a Java zero-day at the end of 2012 and the beginning of 2013 , detected by Kaspersky Lab products as Exploit.Java.CVE-2012-3213.b . It used a multi-stage binary infection to update each module effectively and evade detection . We should note that SocGholish used to retrieve media files from separate web requests until more recently when it started using self - contained Base64 encoded images .


With the increased use of Android phones in business environments , it is important to defend against these threats by ensuring devices are kept current with the latest updates . The victims for the 2014-2015 versions are generally IT and real estate/investment companies and in both cases , a small number of computers have been infected throughout Wild Neutron . In addition , we analyzed the victims of this campaign and spotted an interesting overlap of this campaign with another APT actor known as DarkHotel . There are different installation flows for this campaign , but we will focus on the one that uses a URL shortcut .


Limiting app installations on corporate devices , as well as ensuring that applications are created by trusted developers on official marketplaces , can help in reducing the risk of infection as well . Wild Neutron 's targeting of major IT companies , spyware developers ( FlexiSPY ) , jihadist forums ( the " Ansar Al-Mujahideen English Forum " ) and Bitcoin companies indicate a flexible yet unusual mindset and interests . The ScarCruft group uses common malware delivery techniques such as spear phishing and Strategic Web Compromises ( SWC ) . This shorcut uses the WebDav HTTP protocol extension to retrieve the file launcher-upd.hta from a remote server : This heavily obfuscated script is responsible for the execution of PowerShell that downloads the final malware payload ( NetSupport RAT ) .


ViceLeaker Operation : mobile espionage targeting Middle East 26 JUN 2019 In May 2018 , we discovered a campaign targeting dozens of mobile Android devices belonging to Israeli citizens . We continue to track the Wild Neutron group , which is still active as of June 2015 . As in Operation Daybreak , this actor performs sophisticated attacks using a zero-day exploit . Malwarebytes 's EDR shows the full attack chain ( please click to enlarge ): The NetSupport RAT files are hosted on the same compromised WordPress site used earlier to download the Internet shortcut .


Kaspersky spyware sensors caught the signal of an attack from the device of one of the victims ; and a hash of the APK involved ( Android application ) was tagged in our sample feed for inspection . A ransomware variant dubbed PyLocky was observed in September 2018 being distributed by a phishing campaign using an invoicing theme . However , sometimes using public exploit code is quicker and more effective for malware authors . The RAT 's main binary is launched from " C:\Users\%username%\AppData\Roaming\BranScale\client32.exe " .


Once we looked into the file , we quickly found out that the inner-workings of the APK included a malicious payload , embedded in the original code of the application . PyLocky was found to be targeting entities in France and Germany . We witnessed this actor extensively testing a known public exploit during its preparation for the next campaign . Fake browser updates are a very common decoy used by malware authors .


This was an original spyware program , designed to exfiltrate almost all accessible information . Fxmsp specialize in breaching highly secure protected networks to access private corporate and government information . In order to deploy an implant for the final payload , ScarCruft uses a multi-stage binary infection scheme . In addition to SocGholish , the Domen toolkit was a well - built framework that emerged in 2019 while another campaign known as sczriptzzbn dropped SolarMarker leading to the NetSupport RAT in both cases .


During the course of our research , we noticed that we were not the only ones to have found the operation . Fxmsp is a hacking collective that has operated in various top-tier Russian- and English-speaking underground communities since 2017 . As a rule , the initial dropper is created by the infection procedure . Initial access brokers use tools like NetSupport RAT to gather information and perform additional actions on victims of interest .


Researchers from Bitdefender also released an analysis of one of the samples in a blogpost . Throughout 2017 and 2018 , Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground . One of the most notable functions of the initial dropper is to bypass Windows UAC ( User Account Control ) in order to execute the next payload with higher privileges . Stolen credentials can be resold to other threat actors tied to ransomware gangs .


Although something had already been published , we decided to do something different with the data we acquired . On April 24 , 2019 , Fxmsp claimed to have secured access to three leading antivirus companies . This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams . We will continue to monitor these campaigns and in particular SocGholish to see if the web delivery landscape changes .


The following month , we released a private report on our Threat Intelligence Portal to alert our clients about this newly discovered operation and began writing YARA rules in order to catch more samples . According to the Fxmsp , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks . Afterwards , the installer malware creates a downloader and a configuration file from its resource and executes it . Malwarebytes customers are protected as we detect the infrastructure and final payload used in these attacks .


We decided to call the operation “ ViceLeaker ” , because of strings and variables in its code . Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body . For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2 This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP port 443 . The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload . Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected .


Mobile ViceLeaker The following table shows meta information on the observed samples , including compiler timestamps : MD5 Package Compiler C2 51df2597faa3fce38a4c5ae024f97b1c com.xapps.SexGameForAdults dexlib 2.x 188.165.28 [ . Previous reports have discussed Bisonal malware used in attacks against Japan , South Korea and Russia . In order to evade network level detection , the downloader uses steganography .


] 251 2d108ff3a735dea1d1fdfa430f37fab2 com.psiphon3 dexlib 2.x 188.165.49 [ . This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others . The downloaded payload is an image file , but it contains an appended malicious payload to be decrypted .


] 205 7ed754a802f0b6a1740a99683173db73 com.psiphon3 dexlib 2.x 188.165.49 [ . If it's Cyrillic and the command to the shell is not ‘ipconfig’ , the threat converts the command result text encoding from Cyrillic to UTF-16 . The final payload created by the aforementioned process is a well known backdoor , also known as ROKRAT by Cisco Talos .


] 205 3b89e5cd49c05ce6dc681589e6c368d9 ir.abed.dastan dexlib 2.x 185.141.60 [ . Similar to the Bisonal variant targeting the Russian organization , this sample was also disguised as PDF document . This cloud service-based backdoor contains many features .


] 213 To backdoor legitimate applications , attackers used a Smali injection technique – a type of injection that allows attackers to disassemble the code of original app with the Baksmali tool , add their malicious code , and assemble it with Smali . The contents of the decoy PDF is a job descriptions with the South Korean Coast Guard . One of its main functions is to steal information .


As a result , due to such an unusual compilation process , there were signs in the dex file that point to dexlib , a library used by the Smali tool to assemble dex files . The installed EXE file is almost exactly the same as the DLL version of Bisonal variant used against the Russian organization . Upon execution , this malware creates 10 random directory paths and uses them for a specially designated purpose .


Original code of the APK on the left , versus injected APK on the right The analysis of the APK was rather interesting , because some of the actions were very common spyware features , such as the exfiltration of SMS messages , call logs and other data . The targets are military or defense industry in particular countries , it used DDNS for C2 servers , and tracked connections from their victims by using target or campaign codes , as well as disguising the malware as document file , and using a dropper to install the malware and decoy file . The malware creates 11 threads simultaneously : six threads are responsible for stealing information from the infected host , and five threads are for forwarding collected data to four cloud services ( Box , Dropbox , Pcloud and Yandex ) .


However , in addition to the traditional functionality , there were also backdoor capabilities such as upload , download , delete files , camera takeover and record surrounding audio . A previous campaign of this APT group was uncovered by Talos in June 2017 , and since then very little of this operation was seen in the wild . When uploading stolen data to a cloud service , it uses predefined directory path such as /english , /video or /scriptout .


The malware uses HTTP for communication with the C2 server for command handling and data exfiltration . ined in the archive is called DriverInstallerU.exe but its metadata shows that its original name is Interenet Assistant.exe . The ScarCruft group keeps expanding its Exfiltration targets to steal further information from infected hosts and continues to create tools for additional data Exfiltration .


Here is a command and control protocol fragment : Commands from C2 server parsing In total , the malicious APK handles 16 different commands : Command Endpoint Description 1 reqsmscal.php Send specified SMS message 2 reqsmscal.php Call specified number 3 reqsmscal.php Exfiltrate device info , such as phone model and OS version 4 reqsmscal.php Exfiltrate a list of all installed applications 5 reqsmscal.php Exfiltrate default browser history ( limited to a given date ) 6 reqsmscal.php After reviewing all the malware functionalities , we are confident in saying that the attackers look for victims who answer well-defined characteristics and believe that further stages of the attack are delivered only to those who fit the specific victim profile . We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester .


Exfiltrate Chrome browser history ( limited to a given date ) 7 reqsmscal.php Exfiltrate memory card file structure 8 reqsmscal.php Record surrounding sound for 80 seconds 1 reqcalllog.php Exfiltrate all call logs 2 reqcalllog.php Exfiltrate all SMS messages 3 reqcalllog.php Upload specified file from the device to the C2 4 reqcalllog.php Download file from specified URL and save on device 5 reqcalllog.php Delete specified file 6,7,8 reqcalllog.php Commands not yet In this sample , however , the module names were changed from actors and characters’ names to car models , namely BMW_x1” , BMW_x2” and up to BMW_x8” . This malware is responsible for stealing Bluetooth device information .


implemented 9 reqcalllog.php Take photo ( muted audio ) with rear camera , send to C2 10 reqcalllog.php Take photo ( muted audio ) with front camera , send to C2 All observed samples with Smali injections were signed by the same debug certificate ( 0x936eacbe07f201df ) . But , thanks to the attackers known affection for decoy documents that pose as news summaries , we were able to date the campaign back to March 2018 . It is fetched by a downloader , and collects information directly from the infected host .


As we know from our investigation , traces of the first development activities were found at the end of 2016 , but the main distribution campaign began in 2018 ( end of 2017 ) . With the experience gained from the APT attack that began in March 2017 , it seems this campaign has evolved into an attack with new capabilities , and an even more specific target , over a year later . This malware uses Windows Bluetooth APIs to find information on connected Bluetooth devices and saves the following information .


Based on our detection statistics , the main infection vector is the spread of Trojanized applications directly to victims via Telegram and WhatsApp messengers . These unknown actors continued launching DDoS attacks over the next few years . We have found several victims of this campaign , based on our telemetry – investment and trading companies in Vietnam and Russia .


There are the following relevant detection paths ( the last one is an alternative Telegram client – “ Telegram X “ ) : Name Detection path Sex Game For Adults 18.apk /storage/emulated/0/WhatsApp/Media/WhatsApp Documents/ 4_6032967490689041387.apk /storage/emulated/0/Telegram/Telegram Documents/ Psiphon-v91.apk /storage/emulated/0/Android/data/org.thunderdog.challegram/files/documents/ Backdoored Open Source During the course For simplicity , Kaspersky is calling them the BlackEnergy APT group . We believe they may have some links to North Korea , which may explain why ScarCruft decided to closely monitor them .


of our analysis , we also found samples sharing code with the ViceLeaker malware , in particular they shared a delimiter that was used in both cases to parse commands from the C2 server . Since the middle of 2015 , one of the preferred attack vectors for BlackEnergy in Ukraine has been Excel documents with macros that drop the Trojan to disk if the user chooses to run the script in the document . ScarCruft also attacked a diplomatic agency in Hong Kong , and another diplomatic agency in North Korea .


This would be a very unusual coincidence . A very good analysis and overview of the BlackEnergy attacks in Ukraine throughout 2014 and 2015 was published by the Ukrainian security firm Cys Centrum the text is only available in Russian for now , but can be read via Google Translate . It appears ScarCruft is primarily targeting intelligence for political and diplomatic purposes .


Even when a false flag might also be a possibility , we consider this to be unlikely . The earliest signs of destructive payloads with BlackEnergy go back as far as June 2014 . We discovered one victim from Russia that also triggered a malware detection while staying in North Korea in the past .


The samples sharing this overlap are modified versions of an open source Jabber/XMPP client called “ Conversations ” with some code additions . BlackEnergy is a highly dynamic threat actor and the current attacks in Ukraine indicate that destructive actions are on their main agenda , in addition to compromising industrial control installations and espionage activities . The fact that this victim visits North Korea makes its special and suggests that it may have valuable information about North Korean affairs .


The legitimate version of this app is also available on Google Play . Kaspersky will continue to monitor the BlackEnergy attacks in Ukraine and update our readers with more data when available . ScarCruft infected this victim on September 21, 2018 .


The Conversations modified samples differ from the original one in the getKnownHosts method that was modified to replace the main XMPP host with the attackers ’ C2 server : It appears that the attackers were using a specific C2 for the use of that app . From Buhtrap perpetrating cybercrime for financial gain , its toolset has been expanded with malware used to conduct espionage in Eastern Europe and Central Asia . But before the ScarCruft infection , however , another APT group also targeted this victim with the host being infected with GreezeBackdoor on March 26, 2018 .


Another important modification is in the message transfer process : With this modification , an application sends device location coordinates with every message . Throughout our tracking , we've seen this group deploy its main backdoor as well as other tools against various victims , but June 2019 was the first time we saw the Buhtrap group use a zero-day exploit as part of a campaign . GreezeBackdoor is a tool of the DarkHotel APT group , which we have previously written about .


There are also many other modifications , fully described in our private report . In that case , we observed Buhtrap using a local privilege escalation exploit , CVE-2019-1132 , against one of its victims . In addition , this victim was also attacked by the Konni malware on 03 April 2018 .


In addition , we did not see traces of the Smali injection . However , as the shift in targets occurred before the source code leak , we assess with high confidence that the same people behind the first Buhtrap malware attacks against businesses and banks are also involved in targeting governmental institutions . The Konni malware was disguised as a North Korean news item in a weaponized documents ( the name of the document was “ Why North Korea slams South Korea ’s recent defense talks with U.S-Japan.zip ” ) This is not the first time we have seen an overlap of ScarCruft and DarkHotel actors .


In this case we found traces of dx/dexmerge compilers , which means that , this time , the attackers just imported the original source code into an Android IDE ( such as Android Studio , for instance ) and compiled it with their own modifications . When Buhtrap was targeting businesses , the decoy documents would typically be contracts or invoices . Members from our team have already presented on the conflict of these two threat actors at security conferences .


In addition to adding the code , the attackers also changed the icon and package name . The Buhtrap group is well known for its targeting of financial institutions and businesses in Russia . We have also shared more details with our threat intelligence customers in the past .


We do not know why , but we suspect that it was an attempt to hide the origin of the application . Figure 2 is a typical example of a generic invoice the group used in a campaign in 2014 . They are both Korean-speaking threat actors and sometimes their victimology overlaps .


Conversations-based app mimics Telegram messenger Even when we originally thought this was a backdoored version of the Conversations app , used to infect victims , we didn´t discovered anything malicious in it . When the group's focus shifted to banks , the decoy documents were related to banking system regulations or advisories from FinCERT , an organization created by the Russian government to provide help and guidance to its financial institutions . But both group seem to have different TTPs ( Tactics , Techniques and Procedures ) and it leads us to believe that one group regularly lurks in the other ’s shadow .


This brought to us the hypothesis that this might be a version used by the group behind ViceLeaker for internal communication or for other , unclear purposes . We confirmed that this is a DarkHydrus Group's new attack targeting Middle East region . The ScarCruft has shown itself to be a highly-skilled and active group .


All the detections of this backdoored app were geolocated in Iran . In July 2018 , Palo Alto disclosed DarkHydrus Group which showed its special interest to governments in Middle East . It has a keen interest in North Korean affairs , attacking those in the business sector who may have any connection to North Korea , as well as diplomatic agencies around the globe .


Backdoored Conversations C2 server analysis During the analysis of the Smali injected apps and their C2 server infrastructure we hadn ’ t found any interesting clues , but things changed when we looked at the C2 server of the linked Conversations messenger . Prior to that report , we published detail analysis on malware exploiting CVE-2018-8414 vulnerability (remote code execution in SettingContent-ms) , which is believed a work of DarkHydrus . ScarCruft tools : 02681a7fe708f39beb7b3cf1bd557ee9 Bluetooth info harvester .


It uses “ 185.51.201 [ . However , the final payload is something that welivesecurity have never seen associated with Buhtrap . ScarCruft tools : C781f5fad9b47232b3606e4d374900cd Installer .


] 133 ” as a main C2 address , and there is only one domain that is hosted on this dedicated server – iliageram [ . It's coincident that both 'darkhydrus' APT group name and ‘Williams’ user name in PDB path found in this Twitter user . ScarCruft tools : 032ed0cd234f73865d55103bf4ceaa22 Downloader .


] ir . In recent APT incidents , Dark Hydruns tend to adopt Office VBA macro instead of Office 0day vulnerability in the consideration of cost reduction . ScarCruft tools : 22aaf617a86e026424edb7c868742495 AV Remover .


Note that we later found versions that used the domain as a C2 directly instead of the IP address . ASERT uncovered a credential theft campaign we call LUCKY ELEPHANT where attackers masquerade as legitimate entities such as foreign government , telecommunications , and military . ScarCruft tools : 07d2200f5c2d03845adb5b20841faa94 AV Remover .


The record contains a personal email address : WHOIS records of C2 server exposing the attacker ’ s email address We were aware of the possibility that the attackers might be using a compromised email account , so we dug deeper to find more information related to this email address . From at least February 2019 to present , the actors in the LUCKY ELEPHANT campaign copied webpages to mimic South Asian government websites as well as Microsoft Outlook 365 login pages and hosted them on their own doppelganger domains , presumably to trick victims into providing login credentials . GreezaBackdoor of DarkHotel : 5e0e11bca0e94914e565c1dcc1ee6860 .


A quick search produced results about a personal page and , what is more interesting , a GitHub account that contains a forked Conversation repository . ASERT suspects that the Actors use phishing emails to lure victims to the doppelganger websites and entice users to enter their credentials . TA505 is Expanding its Operations In the last few days , during monitoring activities , Yoroi CERT noticed a suspicious attack against an Italian organization .


Related Github account contains forked Conversations repository Summarizing all the found clues , we have the following attribution flow : Conclusion The operation of ViceLeaker is still ongoing , as is our research . It is important to note that one domain , yahoomail[.]cf is only associated with this group from February 2019 onward . The malicious email contains a highly suspicious sample which triggered the ZLAB team to investigate its capabilities and its possible attribution , discovering a potential expansion of the TA505 operation .


The attackers have taken down their communication channels and are probably looking for ways to assemble their tools in a different manner . In late 2018 , the domain was associated with a different APT group / campaign of Chinese origin . The threat group is also known for its recent attack campaign against Bank and Retail business sectors , but the latest evidence indicates a potential expansion of its criminal operation to other industries too .


Kaspersky detects and blocks samples of the ViceLeaker operation using the following verdict : Trojan-Spy.AndroidOS.ViceLeaker . Based on our analysis into the activity , ASERT deems with moderate confidence that an Indian APT group is behind the LUCKY ELEPHANT campaign . Dropper : 0c88e285b6fc183c96b6f03ca5700cc9ca7c83dfccc6ad14a946d1868d1cc273 Excel file with malicious macro .


* Actually , we are currently investigating whether this group might also be behind a large-scale web-oriented attack at the end of 2018 using code injection and exploiting SQL vulnerabilities . The targets are typical of known Indian APT activity and the infrastructure was previously used by an Indian APT group . The intercepted attack starts with a spear phishing email embedding a spreadsheet .


Even when this would not be directly related to the Android malware described in this blogpost , it would be an indicator of wider capabilities and objectives of this actor . DoNot Team has a history of heavily targeting Pakistan , in addition to other neighboring countries . The document is weaponized with malicious macro code triggered when the user opens the document to see the content under the obfuscated view .


XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing We have been detecting a new wave of network attacks since early March , which , for now , are targeting Japan , Korea , China , Taiwan , and Hong Kong . The 360 Intelligence Center observed four distinct campaigns against Pakistan since 2017 (link) , recently targeting Pakistani businessmen working in China . To understand its capabilities , the macro code has been isolated and analyzed in detail .


Trend Micro detects these as ANDROIDOS_XLOADER.HRX . DoNot Team’s confirmed use of this IP dates back to September 2018 , with a six-month gap until it was used to host doppelganger domains for the LUCKY ELEPHANT campaign in early February . Surprisingly , the source code is composed by more than 1600 lines of code and it is highly obfuscated .


By : Trend Micro April 20 , 2018 We have been detecting a new wave of network attacks since early March , which , for now , are targeting Japan , Korea , China , Taiwan , and Hong Kong . One of the IP addresses , 128.127.105.13 , was previously used by the DoNot Team (aka APT-C-35) , a suspected Indian APT group . Paying more attention during the code analysis , we discovered that it is full of junk instructions used to declare and initialize variables never used .


The attacks use Domain Name System ( DNS ) cache poisoning/DNS spoofing , possibly through infringement techniques such as brute-force or dictionary attacks , to distribute and install malicious Android apps . The actors behind LUCKY ELEPHANT recognize the effectiveness and use doppelganger webpages nearly identical to legitimate sites , enticing users to input their credentials . Only a small portion of this code is actually used to start the infection , the rest is just junk code .


Trend Micro detects these as ANDROIDOS_XLOADER.HRX . The heavier targeting in Pakistan adheres to historical targeting and the ongoing tension between the two countries , which has escalated since a terrorist attack in Kashmir on 14 February 2019 . Once the macro is executed , the malware downloads two files from “ kentona[.su ” , using an SSL encrypted communication , and stores them in “ C:\Users\Public ” path : “ rtegre.exe ” and “ wprgxyeqd79.exe ” .


These malware pose as legitimate Facebook or Chrome applications . The targeting of Pakistan , Bangladesh , Sri Lanka , Maldives , Myanmar , Nepal , and the Shanghai Cooperation Organization are all historical espionage targets by India . Generic : aafa83d5e0619e69e64fcac4626cfb298baac54c7251f479721df1c2eb16bee7 Trojan S-MAL/Downloader ( Executable file ) .


They are distributed from polluted DNS domains that send a notification to an unknowing victim ’ s device . However , it is clear is that Donot are actively establishing infrastructure and are targeting governments in South Asia . Trojan : 6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2 SFX ( self-extracting archive ) ( Executable file ) .


The malicious apps can steal personally identifiable and financial data and install additional apps . First attack of this campaign took place in May 2018 . The “ wprgxyeqd79.exe ” sample actually is a Self Extracting Archive ( SFX S-TOOL/SFA ) containing four files designed to be extracted in the %TEMP% folder .


XLoader can also hijack the infected device ( i.e. , send SMSs ) and sports self-protection/persistence mechanisms through device administrator privileges . Arbor also published APT research on this group , and named it ‘Donot’ . After that , it executes “ exit.exe ” which launches the “ i.cmd ” batch script .


Infection Chain As with our earlier reports in late March , the attack chain involves diverting internet traffic to attacker-specified domains by compromising and overwriting the router ’ s DNS settings . Donot attacked government agencies , aiming for classified intelligence . This new script performs a ping to “ www[.cloudflare[.com ” for three times with a delay of 3000ms , testing the connectivity of the victim machine .


A fake alert will notify and urge the user to access the malicious domain and download XLoader . We identified this APT group coded as ‘APT-C-35’ in 2017 , who is mainly targeting Pakistan and other South Asian countries for cyber espionage . If the host is successfully reached , the script renames a file named “ kernel.dll ” , obviously not the real one , in “ uninstall.exe ” , another misleading name .


Technical Analysis XLoader first loads the encrypted payload from Assets/db as test.dex to drop the necessary modules then requests for device administrator privileges . At least 4 attack campaigns against Pakistan have been observed by us since 2017 . Then it invokes the renamed executable and runs it passing a series of parameter : “ uninstall.exe x -pQELRatcwbU2EJ5 -y ”


Once granted permission , it hides its icon from the launcher application list then starts a service that it keeps running in the background . Spear phishing emails with vulnerable Office documents or malicious macros are sent to victims . These parameters are needed to self-decrypt the “ uninstall.exe ” file which is again another SFX archive .


The background service uses the reflection technique ( a feature that allows the inspection and modification of Java-based programs ’ internal properties ) to invoke the method com.Loader.start in the payload . In the latest attack , Donot group is targeting Pakistani businessman working in China . The “ -p ” parameter , indeed , specify the password of the archive to be extracted .


Monitoring Broadcast Events XLoader registers many broadcast receivers in the payload dynamically ( to monitor broadcast events sent between system and applications ) . Two unique malware frameworks , EHDevel and yty , are developed by attackers . The crucial file , at this point of the infection , is the SFX executable named “ uninstall.exe ” .


Registering broadcast receivers enable XLoader to trigger its malicious routines . wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 . It has a structure similar to previous “ wprgxyeqd79.exe ” file : two of their files have the same name , but the content of this new SFX is extracted in the “ %ALLUSERSPROFILE%\Windows Anytime Upgrade ” directory .


Here is a list of broadcast actions : android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.USER_PRESENT android.intent.action.PHONE_STATE android.net.wifi.SCAN_RESULTS android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.SCREEN_OFF android.intent.action.SCREEN_ON Furthermore , it has similar code logic as previous ones wuaupdt.exe in this attack appears in previous Donot attack , and C2 addresses are same to previous ones . Another time , the execution flow moves from “ exit.exe to “ i.cmd ” .


android.media.RINGER_MODE_CHANGED android.sms.msg.action.SMS_SEND android.sms.msg.action.SMS_DELIVERED Creating a Web Server to Phish XLoader creates a provisional web server to receive the broadcast events . From the attack activity captured this time , it is obvious that Donot APT group is still keen on Pakistan as primary target of attack , and even expands scope of attack to include Pakistani staffs and institutions in China . The script is quite different from the previous one : it guarantees its persistence on the victim machine through the setting of “ HKCU\Software\Microsoft\Windows\CurrentVersion\Run ” registry key , creating a new entry named “ Windows Anytime Upgrade ” which points to “ winserv.exe ” , just stored into the same folder .


It can also create a simple HTTP server on the infected device to deceive victims . Buhtrap still make extensive use of NSIS installers as droppers and these are mainly delivered through malicious documents . Thus , the script provides to run “ winserv.exe ” .


It shows a web phishing page whenever the affected device receives a broadcast event ( i.e. , if a new package is installed or if the device ’ s screen is on ) to steal personal data , such as those keyed in for banking apps . They first came to light in 2016 , when they managed to steal sensitive information from the US Democratic National Committee (DNC) . An interesting part of the script is the continuous killing of every “ rundll32.exe ” process running into the victim machine , generates a huge amount of noise , as visible in the following process explorer view .


The phishing page is translated in Korean , Japanese , Chinese , and English , which are hardcoded in the payload . Earworm first came to light in 2016 , when they managed to steal sensitive information from the US Democratic National Committee (DNC) . Anyway , just before the kill loop , the real malicious payload is executed : the


It will appear differently to users depending on the language set on the device . They were also behind an attack on the World Anti-Doping Agency (WADA) , in which they leaked confidential information about several drug tests . “ winserv.exe ” file .


XLoader as Spyware and Banking Trojan XLoader can also collect information related to usage of apps installed in the device . SPLM , GAMEFISH , and Zebrocy delivery all maintain their own clusters , but frequently overlap later . Analyzing it in depth , we discover it actually is the RMS ( Remote Manipulator System ) client by TektonIT , encrypted using the MPress PE compressor utility , a legitimate tool , to avoid antivirus detection .


Its data-stealing capabilities include collecting SMSs after receiving an SMS-related broadcast event and covertly recording phone calls . Our previous post on Sofacy's 2017 activity stepped away from the previously covered headline buzz presenting their association with previously known political hacks and interest in Europe and the US , and examines their under-reported ongoing activity in middle east , central asia , and now a shift in targeting further east , including China , along with an overlap surprise . TektonIT RMS acts as a remote administration tool , allowing the attacker to gain complete access to the victim machine .


XLoader can also hijack accounts linked to financial or game-related apps installed on the affected device . The larger , 300kb+ SPLM backdoors deployed in 2016 and 2017 are not observed any longer at targets in 2018 . Together with the RMS executable , there is another file named “ settings.dat ” containing the custom configuration prepared by the attacker .


XLoader can also start other attacker-specified packages . A previous , removed , report from another vendor claimed non-specific information about the groups' interest in Chinese universities , but that report has been removed – most likely detections were related to students’ and researchers’ scanning known collected samples and any incidents” remain unconfirmed and unknown . It contains information like : Server address and port the client will connect to ; The password chosen by the attacker for the remote access ; The ID associated to the victim client .


A possible attack scenario involves replacing legitimate apps with repackaged or malicious versions . Either way , the group's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion . All these information are automatically loaded by the RMS executable and firstly stored in the registry key “ HKCU\Software\tektonik\Remote MANIPULATOR System\Host\parameters ” .


By monitoring the package installation broadcast event , XLoader can start their packages . The actors behind this campaign we call LUCKY ELEPHANT use doppelganger webpages to mimic legitimate entities such as foreign governments , telecommunications , and military . At the next startup , the software will directly load the configuration from the just created key .


This enables it to launch malicious apps without the user ’ s awareness and explicit consent . Currently , Sofacy targets large air-defense related commercial organizations in China with SPLM , and moves Zebrocy focus across Armenia , Turkey , Kazahkstan , Tajikistan , Afghanistan , Mongolia , China , and Japan . The client establishes a new connection with the remote command and control server hosted on a Bulgarian remote host 217.12.201.159 , part of a Virtual Dedicated Server subnet of the AS-21100, operated by ITL LLC .


We reverse engineered XLoader and found that it appears to target South Korea-based banks and game development companies . Either way , Sofacy's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion . After the reconstruction of the full infection chain , we noticed strong similarities with a recent spear-phishing attack campaign against an unspecified US retail company .


XLoader also prevents victims from accessing the device ’ s settings or using a known antivirus ( AV ) app in the country . According to this new alert , Hidden Cobra the U.S government’s code name for Lazarus has been conducting FASTCash attacks stealing money from Automated Teller Machines (ATMs) from banks in Asia and Africa since at least 2016 . The attack , as stated by CyberInt , leveraged a command and control server located in Germany related to the TA505 actor : a very active group involved in cyber-criminal operation all around the world , threatening a wide range of high profile companies , active since 2014 .


XLoader can also load multiple malicious modules to receive and execute commands from its remote command-and-control ( C & C ) server , as shown below : Here ’ s a list of the modules and their functions : sendSms — send SMS/MMS to a specified address setWifi — enable or disable Wi-Fi connection gcont — collect all the device ’ s contacts lock — currently just an input lock status in the settings ( pref ) file , but may be used as a screenlocking ransomware bc — collect all contacts Lazarus is a very active attack group involved in both cyber crime and espionage . The comparison of the infection chains reveals in both cases the attacker used a couple of SFX stages to deploy the “ RMS ” software : a legitimate remote administration tool produced by the Russian company “ TektonIT ” .


from the Android device and SIM card setForward — currently not implemented , but can be used to hijack the infected device getForward — currently not implemented , but can be used to hijack the infected device hasPkg — check the device whether a specified app is installed or not setRingerMode — set the device ’ s ringer mode setRecEnable — set the device ’ s ringer mode as silent reqState — get a detailed phone connection status , which includes activated network and Wi-Fi ( with or without password ) showHome — The group was initially known for its espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures . The tool is able to grant remote access and full , direct control of the infected machine to the group .


force the device ’ s back to the home screen getnpki : get files/content from the folder named NPKI ( contains certificates related to financial transactions ) http — access a specified network using HttpURLConnection onRecordAction — simulate a number-dialed tone call — call a specified number get_apps — get all the apps installed on the device show_fs_float_window — show a full-screen window for phishing Of note is XLoader ’ s abuse of the WebSocket protocol ( supported in many browsers Following US-CERTs report , Symantec's research uncovered the key component used in Lazarus's recent wave of financial attacks . Also , some code pieces are directly re-used in the


and web applications ) via ws ( WebSockets ) or wss ( WebSockets over SSL/TLS ) to communicate with its C & C servers . More recently , Lazarus has also become involved in financially motivated attacks , including an US$81 million dollar theft from the Bangladesh Central Bank and the WannaCry ransomware . analyzed campaigns , such as the “ i.cmd ” and “ exit.exe ” files , and , at the same time , some new components have been introduced , for instance the “ rtegre.exe ” and the “ veter1605_MAPS_10cr0.exe ” file .


The URLs — abused as part of XLoader ’ s C & C — are hidden in three webpages , and the C & C server that XLoader connects to differ per region . Other open source and semi-legitimate pen-testing tools like nbtscan and powercat are being used for mapping available resources and lateral movement as well . During the analysis , we also noticed the “ veter1605_MAPS_10cr0.exe ” file slightly changed run after run , a few hours after the initial discovery the infection chain dropped it with different icons , different suffix , from “ cr0 ” to “ cr24 ” , and appendix from “ veter1605_ ” to “ veter2005_ ” .


The abuse of the WebSocket protocol provides XLoader with a persistent connection between clients and servers where data can be transported any time . To make the fraudulent withdrawals , Lazarus first breaches targeted banks' networks and compromises the switch application servers handling ATM transactions . This may indicate the campaign is still ongoing .


XLoader abuses the MessagePack ( a data interchange format ) to package the stolen data and exfiltrate it via the WebSocket protocol for faster and more efficient transmission . The operation , known as FASTCash” has enabled Lazarus to fraudulently empty ATMs of cash . The TA505 group is one of the most active threat groups operating since 2014 , it has traditionally targeted Banking and Retail industries , as we recently documented during the analysis of the “ Stealthy Email Stealer ” part of their arsenal .


Mitigations XLoader will not download malicious apps if the Android device uses a mobile data connection . In order to permit their fraudulent withdrawals from ATMs , Lazarus inject a malicious Advanced Interactive eXecutive (AIX) executable into a running , legitimate process on the switch application server of a financial transaction network , in this case a network handling ATM transactions . The peculiarity of this recent attack wave is it actually hit a company not strictly in the Banking or Retail sector , as they recently did , suggesting the threat group could be potentially widening their current operations .


Nevertheless , users should practice proper security hygiene to mitigate threats that may take advantage of a home or business router ’ s security gaps . It was previously believed that the attackers used scripts to manipulate legitimate software on the server into enabling the fraudulent activity . Dropurl : kentona[.su – 47.245.58.124 https://kentona[.su/xpepriubgpokejifuv7efrhguskdgfjn/ananas.exe https://kentona[.su/xpepriubgpokejifuv7efrhguskdgfjn/pasmmm.exe C2: 217[.12.201.159 TA505 : 0c88e285b6fc183c96b6f03ca5700cc9ca7c83dfccc6ad14a946d1868d1cc27325 TA505 : 1ee1ba514212f11a69d002005dfc623b1871cc808f18ddfa2191102bbb9f623b TA505 : fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 TA505 : c69ce39ac3e178a89076136af7418c6cb664844b0ce5cb643912ed56c373a08a TA505 : 5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3 .


Employ stronger credentials , for instance , to make them less susceptible to unauthorized access . In recent years , Lazarus has also become involved in financially motivated attacks . Winnti : More than just Windows and Gates .


Regularly update and patch the router ’ s software and firmware to prevent exploits , and enable its built-in firewall . This malware in turn intercepts fraudulent Lazarus cash withdrawal requests and sends fake approval responses , allowing the attackers to steal cash from ATMs . The Winnti malware family was first reported in 2013 by Kaspersky Lab .


For system administrators and information security professionals , configuring the router to be more resistant to attacks like DNS cache poisoning can help mitigate similar threats . Lazarus was linked to the $81 million theft from the Bangladesh central bank in 2016 , along with a number of other bank heists . Since then , threat actors leveraging Winnti malware have victimized a diverse set of targets forvaried motivations .


Everyday users can do the same by checking the router ’ s DNS settings if they ’ ve been modified . Lazarus was also linked to the WannaCry ransomware outbreak in May 2017 . While the name ‘ Winnti ’ in public reporting was previously used tosignify a single actor , pronounced divergence in targeting and tradecraft betweencampaigns has led industry consensus to break up the tracking of the continued use ofthe Winnti malware under different actor clusters .


Even threats like DNS cache poisoning employ social engineering , so users should also be more prudent against suspicious or unknown messages that have telltale signs of malware . WannaCry incorporated the leaked EternalBlue exploit that used two known vulnerabilities in Windows CVE-2017-0144 and CVE-2017-0145 to turn the ransomware into a worm , capable of spreading itself to any unpatched computers on the victim's network and also to other vulnerable computers connected to the internet . The underlying hypothesis is that themalware itself may be shared ( or sold ) across a small group of actors .


We have worked with Google and they ensure that Google Play Protect proactively catches apps of this nature . Lazarus was initially known for its involvement in espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures that saw large amounts of information being stolen and computers wiped by malware . In April 2019 , reports emerged of an intrusion involving Winnti malware at a GermanPharmaceutical company .


No instances of these apps were found in Google Play . In short , Lazarus continues to pose a serious threat to the financial sector and organizations should take all necessary steps to ensure that their payment systems are fully up to date and secured . Following these reports , Chronicle researchers doubled downon efforts to try to unravel the various campaigns where Winnti was leveraged .


September 08 , 2020 TikTok Spyware A detailed analysis of spyware masquerading as TikTok A recent threat to ban TikTok in the United States has taken the internet by storm and received mixed reactions from social media and internet users . As with the 2016 series of virtual bank heists , including the Bangladesh Bank heist , FASTCash illustrates that Lazarus possesses an in-depth knowledge of banking systems and transaction processing protocols and has the expertise to leverage that knowledge in order to steal large sums from vulnerable banks . Analysisof these larger convoluted clusters is ongoing .


U.S. President Donald Trump has ordered ByteDance , the parent company of TikTok , to sell its U.S. TikTok assets and also issued executive orders that would ban the social media apps TikTok and WeChat from operating in the U.S. if the sale doesn ’ t happen in the next few weeks . The attack , which starts with a malicious attachment disguised as a top secret US document , weaponizes TeamViewer , the popular remote access and desktop sharing software , to gain full control of the infected computer . While reviewing a 2015 report of a Winnti intrusion at a Vietnamese gaming company , we identified a small cluster of Winnti samples designed specifically for Linux .


On the other side , ByteDance has filed a lawsuit suing the Trump administration . As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC . The following is a technical analysis of thisvariant .


When popular applications come under fire and are featured prominently in the news , hackers get excited as these newsworthy apps can become their latest target . It is hard to tell if there are geopolitical motives behind this campaign by looking solely at the list of countries it was targeting , since it was not after a specific region and the victims came from different places in the world . The Linux version of Winnti is comprised of two files : a main backdoor ( libxselinux ) and a library ( libxselinux.so ) used to hide it ’s activity on an infected system . ‘ libxselinux.so ’ — the userland rootkit . libxselinux.so.old : 11a9f798227be8a53b06d7e8943f8d68 906dc86cb466c1a22cf847dda27a434d04adf065 4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a .


And TikTok is no exception . The initial infection vector used by the threat actor also changed over time , during 2018 we have seen multiple uses of self-extracting archives instead of malicious documents with AutoHotKey , which displayed a decoy image to the user . Ids.me .


Generally , after an application gets banned from an official app store , such as Google Play , users try to find alternative ways to download the app . The recent wave of FASTCash attacks demonstrates that financially motivated attacks are not simply a passing interest for the Lazarus group and can now be considered one of its core activities . The library used to hide Winnti ’s system activity is a copy of the open-source userland rootkit Azazel , with minor changes .


In doing so , users can become victims to malicious apps portraying themselves as the original app . Although both examples of the different delivery methods described above show an exclusive targeting of Russian speakers , the recurring financial and political themes that they use highlight the attacker's interest in the financial world once more . When executed , it will register symbols for multiple commonly used functions , including : open() , rmdir() , and unlink() , and modify their returns to hide the malware ’s operations .


Recently there was a huge wave of SMS messages , as well as Whatsapp messages , making the rounds asking users to download the latest version of TikTok at hxxp : //tiny [ . Throughout our investigation , we have found evidence that shows operational similarities between this implant and Gamaredon Group . Distinct changes to Azazel by the Winnti developers include the addition of a function named ‘ Decrypt2 ’ , which is used to decode an embedded configuration similar to the core implant .


] cc/TiktokPro . Gamaredon Group is an alleged Russian threat group . Unlike standard Azazel which is configured to hide network activity based on port ranges , the Winnti modified version keeps a list of process identifiers and network connections associated with the malware ’s activity .


In reality , this downloaded app is a fake app that asks for credentials and Android permissions ( including camera and phone permissions ) , resulting in the user being bombarded with advertisements . Gamaredon Group has been active since at least 2013 , and has targeted individuals likely involved with the Ukrainian government . This modification likely serves to simplify the operator ’s sample configuration process by not having to denote specific ports to hide .


Recently , we have come across another variant of this app portraying itself as TikTok Pro , but this is a full-fledged spyware with premium features to spy on victim with ease . EvilGnome's functionalities include desktop screenshots , file stealing , allowing capturing audio recording from the user’s microphone and the ability to download and execute further modules . Strings within this sample associated with the malware ’s operations are encoded using a single-byte XOR encoding .


( Please note this is a different app and not the same as the one being spread by hxxp : //tiny [ . Gamaredon Group primarily makes use of Russian hosting providers in order to distribute its malware . The following is an example Python function to decode these strings . libxselinux.old : 7f4764c6e6dabd262341fd23a9b105a3 dc96d0f02151e702ef764bbc234d1e73d2811416 ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23 .


] cc/TiktokPro . Gamaredon Group's implants are characterized by the employment of information stealing tools — among them being screenshot and document stealers delivered via a SFX , and made to achieve persistence through a scheduled task . Ids.me .


) Technical Analysis App Name : TikTok Pro Hash : 9fed52ee7312e217bd10d6a156c8b988 Package Name : com.example.dat.a8andoserverx Upon installation , the spyware portrays itself as TikTok using the name TikTok Pro . Gamaredon Group infects victims using malicious attachments , delivered via spear phishing techniques . Winnti Linux variant ’s core functionality is within ‘ libxselinux ’ .


As soon as a user tries to open the app , it launches a fake notification and soon the notification as well as the app icon disappears . The techniques and modules employed by EvilGnome — that is the use of SFX , persistence with task scheduler and the deployment of information stealing tools—remind us of Gamaredon Group’s Windows tools . Upon execution , an embedded configuration is decoded from the data section using a simple XOR cipher .


This fake notification tactic is used to redirect the user 's attention , meanwhile the app hides itself , making the user believe the app to be faulty . We can observe that the sample is very recent , created on Thursday , July 4 . The decoded configuration is similar in structure to the version Kaspersky classifies as Winnti 2.0, as well as samples in the 2015 Novetta report .


This functionality can be seen in Figure 1 . As can be observed in the illustration above , the makeself script is instructed to run ./setup.sh after unpacking . Embedded in this sample ’s configuration three command-and-control server addresses and two additional strings we believe to be campaign designators .


App Icon Figure 1 : App icon and fake notification . The ShooterAudio module uses PulseAudio to capture audio from the user's microphone . Winnti ver.1 , these values were designated as ‘ tag ’ and ‘ group ’ .


Behind the scenes , there are number of process occurring simultaneously . makeself.sh is a small shell script that generates a self-extractable compressed tar archive from a directory . For context , embedded Winnti campaign designators have ranged from target names , geographic areas , industry , and profanity .


First , an activity named MainActivity fires up , taking care of hiding the icon and showing the fake notification . During our 2018 monitoring of this group , we were able to identify different techniques utilized by very similar attackers in the MENA region , sometimes on the same target . Winnti malware handles outbound communications using multiple protocols including : ICMP , HTTP , as well as custom TCP and UDP protocols .


It also starts an Android service named MainService . Gaza Cybergang Group3 (highest sophistication) whose activities previously went by the name Operation Parliament . Use of these protocols is thoroughly documented in the Novetta and Kaspersky reports .


The spyware also appears to have an additional payload stored under the /res/raw/ directory . Gaza Cybergang has been seen employing phishing , with several chained stages to evade detection and extend command and control server lifetimes . While the outbound communication mechanisms are well documented , less attention has been paid to a feature of recent versions of Winnti we came across in the Linux variant ( as well as Windows ) that allows the operators to initiate a connection directly to an infected host , without requiring a connection to a control server .


This is a common technique used by malware developers to bundle the main payload inside the Android package to avoid easy detection . The most popular targets of SneakyPastes are embassies , government entities , education , media outlets , journalists , activists , political parties or personnel , healthcare and banking . This secondary communication channel may be used by operators when access to the hard-coded control servers is disrupted .


As seen in Figure 2 , the app tries to open the payload from the /res/raw/ directory and generate an additional Android Package Kit ( APK ) named .app.apk : Decoy Code Figure 2 : The decoy code for the fake TikTok . Through our continuous monitoring of threats during 2018 , we observed a new wave of attacks by Gaza Cybergang Group1 targeting embassies and political personnel . Additionally , the operators could leverage this feature when infecting internet-facing devices in a targeted organization to allow them to reenter a network if evicted from internal hosts .


Upon analysis , we discovered that this is a decoy functionality and no new payload is generated . Gaza Cybergang Group1 is an attack group with limited infrastructure and an open-source type of toolset , which conducts widespread attacks , but is nevertheless focused on Palestinian political problems . This passive implant approach to network persistence has been previously observed with threat actors like Project Sauron and the Lamberts .


The conditions to build an additional payload are never met . In this campaign , Gaza Cybergang used disposable emails and domains as the phishing platform to target the victims . Initial technical information about this feature was shared by the Thyssenkrupp CERT in the form of an Nmap script that could be used to identify Winnti infections through network scanning .


Going one step further , we rebuilt the malware to execute the apparent functionality of generating a payload , but discovered that the APK stored in the /res/raw/ directory is empty . The RAT , however , had a multitude of functionalities (as listed in the table below) such as to download and execute , compress , encrypt , upload , search directories , etc . This script identifies infected hosts by first sending a custom hello packet , immediately followed by an encoded request for host information , and then parsing the response .


The placement of the decoy functionality is likely designed to confuse the malware researchers . We expect the damage caused by these groups to intensify and the attacks to extend into other regions that are also linked to the complicated Palestinian situation . The initial request , referred to as the helo/hello request in the Nmap script , is comprised of four DWORDs .


It is also possible that this functionality is under development , making this placeholder code incomplete . Cylance determined that the ‘Ghost Dragon’ group utilized specifically tailored variants of Gh0st RAT , which the group modified from the 3.6 version of the source code released in 2008 . The first three are generated by rand() and the fourth is computed based on the first and third .


Coming back to the execution flow , once the spyware hides itself , it starts an Android service named MainService . The standard network protocol for Gh0st RAT 3.6 employs zlib compression , which utilizes ‘Gh0st’ as a static five-byte packet flag that must be included in the first five bytes of initial transmission from the victim . When received by a Winnti infected host , it will validate the received packet and listen for a second inbound request containing tasking .


Android services are components that can be made to execute independently in the background without the victim 's knowledge . In a more recent version of the modified Gh0st RAT malware , Ghost Dragon implemented dynamic packet flags which change the first five bytes of the header in every login request with the controller . This second request ( Encoded Get System Information Request ) is encoded using the same method as the custom TCP protocol used for communication with command-and-control servers , which uses a four-byte XOR encoding .


MainService is the brain of this spyware and controls almost everything—from stealing the victim 's data to deleting it . SPEAR has observed numerous different XOR keys utilized by Ghost Dragon . Before acting on the request , Winnti will validate the third DWORD contains the magic value 0xABC18CBA before executing tasking .


All of its capabilities are discussed later in this blog . Exploit and tools continued to be used after Buckeye's apparent disappearance in 2017 . Clusters of Winnti related activity have become a complex topic in threat intelligence circles , with activity vaguely attributed to different codenamed threat actors .


Hide Icon Figure 3 : Code showing the hiding icon and starting service . The Buckeye attack group was using Equation Group tools to gain persistent access to target organizations at least a year prior to the Shadow Brokers leak . The threat actors utilizing this toolset have repeatedly demonstrated their expertise in compromising Windows based environments .


As MainService is the main controller , the developer has taken the appropriate actions to keep it functional and running at all times . Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability . An expansion into Linux tooling indicates iteration outside of their traditional comfort zone .


The malware developer uses various tactics to do so , and one of them is using Android 's broadcast receivers . While Buckeye appeared to cease operations in mid-2017 , the Equation Group tools it used continued to be used in attacks until late 2018 . This may indicate the OS requirements of their intended targets but it may also be an attempt to take advantage of a security telemitry blindspot in many enterprises , as is with Penquin Turla and APT28 ’s Linux XAgent variant .


Broadcast receivers are components that allow you to register for various Android events . The 2017 leak of Equation Group tools by a mysterious group calling itself the Shadow Brokers was one of the most significant cyber security stories in recent years . Utilizing a passive listener as a communications channel is characteristic of the Winnti developers ’ foresight in needing a failsafe secondary command-and-control mechanisms .


In this case , it registers three broadcast receivers : MyReceiver - Triggers when the device is booted . However , Symantec has now found evidence that the Buckeye cyber espionage group (aka APT3 , Gothic Panda ) began using Equation Group tools in attacks at least a year prior to the Shadow Brokers leak . BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group .


Intercept Call - Triggers on incoming and outgoing calls . Equation is regarded as one of the most technically adept espionage groups and the release of a trove of its tools had a major impact , with many attackers rushing to deploy the malware and exploits disclosed . The group has shown interest in prominent figures in the United Nations , as well as opposition bloggers , activists , regional news correspondents , and think tanks .


AlarmReceiver - Triggers every three minutes . DoublePulsar was delivered to victims using a custom exploit tool (Trojan.Bemstour) that was specifically designed to install DoublePulsar . A group known by Microsoft as NEODYMIUM is Oreportedly associated closely with BlackOasis operations , but evidence that the group names are aliases has not been identified .


MyReceiver and AlarmReceiver start the MainService whenever appropriate events occur . One vulnerability is a Windows zero-day vulnerability (CVE-2019-0703) discovered by Symantec . BRONZE BUTLER : REDBALDKNIGHT , Tick .


This tactic is very common among malware developers to ensure the malware is not killed by the Android OS or by any other means . Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers . BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008 .


Figure 4 shows MyReceiver in action where it eventually calls the MainService service . The second Windows vulnerability (CVE-2017-0143) was patched in March 2017 after it was discovered to have been used by two exploit tools—EternalRomance and EternalSynergy—that were also released as part of the Shadow Brokers leak . The group primarily targets Japanese organizations , particularly those in government , biotechnology , electronics manufacturing , and industrial chemistry .


Broadcast Receiver Figure 4 : MyReceiver broadcast receiver . It was reported by Symantec to Microsoft in September 2018 and was patched on March 12 , 2019 . Carbanak : Anunak , Carbon Spider .


The InterceptCall receiver is triggered whenever there is an incoming or outgoing call . How Buckeye obtained Equation Group tools at least a year prior to the Shadow Brokers leak remains unknown . Carbanak is a threat group that mainly targets banks .


It sets particular parameters in relation to call details and a further service named calls takes the control as seen in Figure 5 . The Buckeye attack group had been active since at least 2009 , when it began mounting a string of espionage attacks , mainly against organizations based in the U.S . It also refers to malware of the same name ( Carbanak ) .


Call Service Figure 5 : Code for the calls service As seen above , the calls service stores incoming call details in .mp3 format in the /sdcard/DCIM/.dat/ directory with file name appended with " In_ '' for incoming calls and " Out_ '' for outgoing calls . These include CVE-2010-3962 as part of an attack campaign in 2010 and CVE-2014-1776 in 2014 . It is sometimes referred to as FIN7 , but these appear to be two groups using the same Carbanak malware and are therefore tracked separately .


How these recorded calls are sent to the command and control server ( CnC ) is taken care of by MainService , which is discussed next . Beginning in August 2016 , a group calling itself the Shadow Brokers began releasing tools it claimed to have originated from the Equation Group . Gamaredon Group is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government .


MainService is the central controller of this spyware . Over the coming months , it progressively released more tools , until April 2017 , when it released a final , large cache of tools , including the DoublePulsar backdoor , the FuzzBunch framework , and the EternalBlue , EternalSynergy , and EternalRomance exploit tools . GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency sevises .


It controls each and every functionality based on the commands sent by the command and control ( C & C ) server . However , Buckeye had already been using some of these leaked tools at least a year beforehand . Gorgon Group is a threat group consisting of members who are suspected to be Pakistan based or have other connections to Pakistan .


As soon as this service is started , it creates two processes that take care of connection and disconnection to the C & C server . The earliest known use of Equation Group tools by Buckeye is March 31 , 2016 , during an attack on a target in Hong Kong . The group has performed a mix of criminal and targeted attacks , including campaigns against government organizations in the United Kingdom , Spain , Russia , and the United States .


This functionality can be seen in Figure 6 . Beginning in March 2016 , Buckeye began using a variant of DoublePulsar (Backdoor.Doublepulsar) , a backdoor that was subsequently released by the Shadow Brokers in 2017 . Sandworm Team : Quedagh , VOODOO BEAR .


TimerTask Figure 6 : The timer task . However , while activity involving known Buckeye tools ceased in mid-2017 , the Bemstour exploit tool and the DoublePulsar variant used by Buckeye continued to be used until at least September 2018 in conjunction with different malware . Sandworm Team is a Russian cyber espionage group that has operated since approximately 2009 .


MainService has the following capabilities : Steal SMS messages Send SMS messages Steal the victim 's location Capture photos Execute commands Capture screenshots Call phone numbers Initiate other apps Steal Facebook credentials , etc All of the above functionalities take place on the basis of commands sent by the attacker . During this attack , the Bemstour exploit tool was delivered to victims via known Buckeye malware (Backdoor.Pirpi) . The group likely consists of Russian pro-hacktivists .


Stolen data is stored in external storage under the /DCIM/ directory with a hidden sub-directory named " .dat '' . One hour later , Bemstour was used against an educational institution in Belgium . Sandworm Team targets mainly Ukrainian entities associated with energy , industrial control systems , SCADA , government , and media .


Below is the list of all the commands catered by the C & C server . Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor . Sandworm Team has been linked to the Ukrainian energy sector attack in late 2015 .


Command Action Unistxcr Restart the app dowsizetr Send the file stored in the /sdcard/DCIM/.dat/ directory to the C & C server Caspylistx Get a list of all hidden files in the /DCIM/.dat/ directory spxcheck Check whether call details are collected by the spyware S8p8y0 Delete call details stored by the spyware screXmex Take screenshots of the device screen Batrxiops Check battery status L4oclOCMAWS Fetch the victim 's location GUIFXB Launch DoublePulsar is then used to inject a secondary payload , which runs in memory only . Scarlet Mimic is a threat group that has targeted minority rights activists .


the fake Facebook login page IODBSSUEEZ Send a file containing stolen Facebook credentials to the C & C server FdelSRRT Delete files containing stolen Facebook credentials chkstzeaw Launch Facebook LUNAPXER Launch apps according to the package name sent by the C & C server Gapxplister Get a list of all installed applications DOTRall8xxe Zip all the stolen files and store in the /DCIM/.dat/ directory Acouxacour Get a list of accounts on the victim 's device Fimxmiisx Open the camera A significantly improved variant of the Bemstour exploit tool was rolled out in September 2016 , when it was used in an attack against an educational institution in Hong Kong . This group has not been directly linked to a government source , but the group 's motivations appear to overlap with those of the Chinese government .


Scxreexcv4 Capture an image micmokmi8x Capture audio Yufsssp Get latitude and longitude GExCaalsss7 Get call logs PHOCAs7 Call phone numbers sent by the C & C server Gxextsxms Get a list of inbox SMS messages Msppossag Send SMS with message body sent by the C & C server Getconstactx Get a list of all contacts Rinxgosa Play a ringtone bithsssp64 Execute commands sent by the C & C server DOWdeletx Deletes When used against 32-bit targets , Bemstour still delivered the same DoublePulsar backdoor . While there is some overlap between IP addresses used by Scarlet Mimic E-APT and Putter Panda , it has not been concluded that the groups are the same .


the file specified by the C & C server Deldatall8 Delete all files stored in the /sdcard/DCIM/.dat/ directory We do n't have the space to cover all of the commands , but let 's take a look at some of the major ones . Bemstour was used again in June 2017 in an attack against an organization in Luxembourg . Silence is a financially motivated threat actor targeting financial institutions in different countries .


Facebook phishing One of the interesting features of this spyware is the ability to steal Facebook credentials using a fake login page , similar to phishing . Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam . The group was first seen in June 2016 .