Mobile users are called on to be on top of this news and be on guard for signs of monitoring . Artifacts indicated the involvement of the Cobalt that , according to Positive Technologies information , from August to October had performed similar successful attacks in Eastern Europe , and it 's likely that this group may will soon become active in the West . in MMAT_LOCOPT . Simultaneously , a threat researcher outside of CrowdStrike discovered an attacker ’s tooling via an open repository , downloaded all of the tools , and made them available through a MegaUpload link in a Twitter post.2


Some indicators may come in the form of peculiar behavior such as unexpected rebooting , finding unfamiliar apps installed , or instant messaging apps suddenly freezing . In a recent spear-phishing campaign , the Cobalt Hacking Group used a remote code execution vulnerability in Microsoft Office software to connect to its command and control server via Cobalt Strike . Additionally here is no mapping information in MMAT_GLBOPT2 because the condition block that contains the variable has been deleted . The response of the initial sent packet knock contains some commands to be executed on the victim machine


Should a device become infected , this backdoor can not be removed without root privilege . The basic principles of targeted attacks on financial institutions have not changed since 2013 when the Anunak , Corkow , Buhtrap , and Lurk groups began conducting the first attacks on Russian banks . So the next block of the first one in the level can not be determined . Information about executed programs that violate one or more of these rules is recorded in the XProtect Database ( XPdb ) , which is stored in SQLite 3 format and located at /var / protected / xprotect / XPdb .


Users may be required the help of their device manufacturer to get support for firmware flashing . In a recent spear-phishing campaign , the Cobalt Group used a known CVE to connect to its C&C server via Cobalt Strike , but ended up revealing all targets . To resolve that issue , The messages show that Harrison was hired in March 2010 to help promote Ashley Madison online , but the messages also reveal Harrison was heavily involved in helping to create and cultivate phony female accounts on the service .


Trend Micro offers security for Android mobile devices through Mobile Security for Android™ to protect against these types of attacks . This isn't the first time we've seen Cobalt makes this error—back in March , an attack focussing on 1,880 targets across financial institutions in Kazakhstan had the same flaw . the code was written to link the block comparison variable and block address in MMAT_LOCOPT , But as a new documentary series on Hulu reveals [ SPOILER ALERT ! ] , there was just one problem with that theory : Their top suspect had killed himself more than a year before the hackers began publishing stolen user data .


Find out more about the 7 Android Security Hacks You Need to Do Right Now to keep your mobile data safe . The Carbanak attacks targeting over a 100 financial institutions worldwide . as the block number is changed in each maturity level . For more information , contact : intelreports@kaspersky.comPowerShell event logs for the creation of an arbitrary process from PowerShell .


Update as of July 23 , 2015 1:00 AM PDT ( UTC-7 ) We have added a link to a previous report discussing this threat . The leader of the crime gang behind the Carbanak and Cobalt malware attacks targeting over a 100 financial institutions worldwide has been arrested in Alicante , Spain , after a complex investigation conducted by the Spanish National Police . If the code can’t determine the mapping in later maturity levels , It is thought they were likely targeted because they might have information on foreign policy of countries towards Iran , negotiations over Irans nuclear program , or information about Iranian dissidents .


Timeline of posts related to the Hacking Team DATE UPDATE July 5 The Italian company Hacking Team was hacked , with more than 400GB of confidential company data made available to the public . Since 2013 , the Cobalt have attempted to attack banks and financial institutions using pieces of malware they designed . it attempts to guess the next block number based on the address , This actor uses these vulnerabilities to deploy webshells including CHINACHOP .


July 7 Three exploits – two for Flash Player and one for the Windows kernel—were initially found in the information dump . Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt . considering each block and instruction addresses . Standard file deletion commands are available on most operating system and device interfaces to perform cleanup , but adversaries may use other tools as well .


One of these [ CVE-2015-5119 ] was a Flash zero-day . The organised crime group started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world . The guessing is not 100% accurate however it works for the majority of obfuscated functions tested . Duqu uses a custom command and control protocol that communicates over commonly used ports , and is frequently encapsulated by application layer protocols.[5 ]


The Windows kernel vulnerability ( CVE-2015-2387 ) existed in the open type font manager module ( ATMFD.dll ) and can be exploited to bypass the sandbox mitigation mechanism . One of the Cobalt Group 's latest campaigns , an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor , was investigated and presented by the Talos research team . Though the original implementation assumes an obfuscated function has only one control flow dispatcher , Compromise


The Flash zero-day exploit ( CVE-2015-5119 ) was added into the Angler Exploit Kit and Nuclear Exploit Pack . The Cobalt started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world . some functions in the ANEL sample have multiple control dispatchers . None Use of Python for malware development and/or packaging : We expect to continue to observe attackers compiling or packaging their OT malware via methods such as PyInstaller ( IRONGATE ) or Py2Exe ( TRITON ) given the proliferation of OT malware developed or packaged using Python in recent years .


It was also used in limited attacks in Korea and Japan . The Cobalt group misused Cobalt Strike , for instance , to perpetrate ATM cyber heists and target financial institutions across Europe , and interestingly , Russia . Originally the code called the optblock_t : :f unc callback in MMAT_GLBOPT1 and MMAT_GLBOPT2 , By analyzing the source code , researchers can identify similar patterns and techniques used by different threat actors , providing defenders with a way to proactively detect and block the new variants at the initial stage of an attack .


July 11 Two new Flash zero-day vulnerabilities , CVE-2015-5122 and CVE-2015-5123 , were found in the hacking team dump . The hacking group misused Cobalt Strike , for instance , to perpetrate ATM cyber heists and target financial institutions across Europe , and interestingly , Russia . as the result was not correct in MMAT_CALLS ( detecting call arguments ) CrowdStrike security researchers were working to develop proof - of - concept ( POC ) code for an exploit method indicative of the logging present after recent Play ransomware attacks .


July 13 Further analysis of the hacking team dump revealed that the company used UEFI BIOS rootkit to keep their Remote Control System ( RCS ) agent installed in their targets ’ systems . If successful , Cobalt goes on to attack financial institutions outside the country . . A typical log entry showing access to the PowerShell backend is detailed in the Remote PowerShell HTTP logs , located in , such as in the example below : CrowdStrike incident responders discovered Remote PowerShell logs similar to log entries for ProxyNotShell exploitation to gain initial access , suggesting the attacker leveraged Remote PowerShell .


July 14 A new zero-day vulnerability ( CVE-2015-2425 ) was found in Internet Explorer . The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled . However , DarkRace is a new ransomware group first discovered by researcher S!Ri .


July 16 On the mobile front , a fake news app designed to bypass Google Play was discovered . As part of our monitoring of Iranian threat agents activities , we have detected that since October 2016 and until the end of January 2017 , the Jerusalem Post , as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens . this did not work for functions with three or more dispatchers . However , not all insider threats are intentional , according to an Insider Threat Report from Crowd Research Partners .


July 20 A new zero-day vulnerability ( CVE-2015-2426 ) was found in Windows , which Microsoft fixed in an out-of-band patch . CopyKittens use several self-developed malware and hacking tools that have not been publicly reported to date , and are analyzed in this report : TDTESS backdoor ; Vminst , a lateral movement tool ; NetSrv , a Cobalt Strike loader ; and ZPP , a files compression console program . Additionally , In early 2023 , KillMilk , the claimed founder of KillNet , attempted to ransom the purportedly stolen documents to NATO for 3 bitcoin , possibly in part to increase attention surrounding the activity .


July 21 Analysis of the RCSAndroid spying tool revealed that Hacking Team can listen to calls and roots devices to get in . CopyKittens often uses the trial version of Cobalt Strike , a publicly available commercial software for " Adversary Simulations and Red Team Operations " . Hex-Rays kernel doesn’t optimize some functions in MMAT_GLBOPT2 if it judges the optimization within the level is not required . To get in , the attacker used spear phishing emails with a self - extracting archive attachment pretending to be a voicemail .


July 28 A recent campaign compromised Taiwan and Hong Kong sites to deliver Flash exploits related to Hacking Team . Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent . In this case , FULLHOUSE.DOORED is a backdoor written in C / C++ that communicates using HTTP .


Android users warned of malware attack spreading via SMS FEB 16 , 2016 Security researchers are warning owners of Android smartphones about a new malware attack , spreading via SMS text messages . The group , which we have given the name Gallmaker , has been operating since at least December 2017 , with its most recent activity observed in June 2018 . the callback is executed just once in the implementation . The campaign was carried out in late 2020 , but it was detected , analyzed , and published in late March 2021 .


As the team at Scandinavian security group CSIS describes , malware known as MazarBOT is being distributed via SMS in Denmark and is likely to also be encountered in other countries . Rather , the Gallmaker 's attack activity we observed is carried out exclusively using LotL tactics and publicly available hack tools . To handle multiple control flow dispatchers , In one case , certutil was used to decode multiple files related to credential theft .


Victims ’ first encounter with the malware reportedly comes via an unsolicited text message that their Android smartphone receives . Gallmaker used lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange ( DDE ) protocol in order to gain access to victim machines . a callback for decompiler events was implemented . Most 51 are due to carelessness , negligence , or compromised credentials , but the potential impact is still present even in an unintentional scenario .


The txt message uses social engineering to dupe unsuspecting users into clicking on a link to a downloadable Android application . Should a user enable this content , the attackers are then able to use the DDE protocol to remotely execute commands in memory on the victim 's system . The code catches the “ hxe_prealloc ” The malware verifies that the server is authentic by downloading a signature file that is signed by the server and ensuring that it is the right one to make the operation more resilient to takedowns


CSIS provided a ( sanitised ) version of a typical message to warn users what to look out for : “ You have received a multimedia message from + [ country code ] [ sender number ] Follow the link http : //www.mmsforyou [ . Back in 2013 , CopyKittens used several Facebook profiles to spread links to a website impersonating Haaretz news , an Israeli newspaper . event ( according to Hex-Rays , The four - byte value at offset 0x416 ( 0x3e8 or decimal 1000 ) is the backdoor ’s version number .


] net/mms.apk to view the message ” Once the APK package is downloaded , potential victims are urged to grant the malicious app a wide range of permissions on their Android device : App permissions SEND_SMS RECEIVE_BOOT_COMPLETED INTERNET SYSTEM_ALERT_WINDOW WRITE_SMS ACCESS_NETWORK_STATE WAKE_LOCK GET_TASKS CALL_PHONE RECEIVE_SMS READ_PHONE_STATE READ_SMS ERASE_PHONE Once installed , MazarBOT downloads a copy of Gallmaker 's activity appears to be highly targeted , with its victims all related to government , military , or defense sectors . this is the final event for optimizations ) If you want a good example , just look at the infection map for Flame it is tightly grouped around the Gulf States .


Tor onto users ’ Android smartphones and uses it to connect anonymously to the net before sending a text message containing the victim ’ s location to an Iranian mobile phone number . Gallmaker 's targets are embassies of an Eastern European country . then calls optblock_t : :f unc callback . The regex , and thus the rule , will match only the requests made to the endpoint of the Microsoft Exchange server .


With the malware now in place , a number of actions can be performed , including allowing attackers to secretly monitor and control smartphones via a backdoor , send messages to premium-rate numbers , and intercept two-factor authentication codes sent by online banking apps and the like . There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors . Typically this event occurs a few times to several times , Honeypot Alerts Set up a honeypot mechanism to attract interest from adversaries .


In fact , with full access to the compromised Android smartphone , the opportunities for criminals to wreak havoc are significant – such as erasing infected phones or launching man-in-the-middle ( MITM ) attacks . The group has carried out attacks most months since December 2017 . so the callback can deobfuscate multiple control flow flattenings . Based on available information Mandiant has not been able to assess a general location that the group operates from .


In its analysis , CSIS notes that MazarBOT was reported by Recorded Future last November as being actively sold in Russian underground forums and intriguingly , the malware will not activate on Android devices configured with Russian language settings . Its activity subsequently increased in the second quarter of 2018 , with a particular spike in April 2018 . Other additional modifications were made to the code ( e.g , writing a new algorithm for finding control flow dispatcher and first block , In the past , we have seen such occurrences with Magecart threat actors for example in the breach of the Umbro website .


This , in itself , does not prove that the perpetrators of the malware campaign are based in Russia , but it certainly sounds as if that is a strong possibility . The fact that Gallmaker appears to rely exclusively on LotL tactics and publicly available hack tools makes its activities extremely hard to detect . validating a block comparison variable , The goal of this type of threat is often to shame or embarrass .


Malware authors in the past have often coded a “ safety net ” into their malware to prevent them from accidentally infecting their own computers and devices . The Gamaredon Group primarily makes use of compromised domains , dynamic DNS providers , Russian and Ukrainian country code top-level domains ( ccTLDs ) , and Russian hosting providers to distribute their custom-built malware . and so on ) This type of vulnerability is known as a server - side request forgery ( SSRF ) .


For more detailed information about the threat , check out the blog post from CSIS . Gallmaker may well have continued to avoid detection were it not for Symantec 's technology . . Lastly , we emphasize that although the samples of COSMICENERGY we obtained are potentially red team related , threat actors regularly leverage contractors and red team tools in real world threat activity , including during OT attacks .


And , of course , remember to always be wary of unsolicited , unusual text messages and installing apps from third-party sources on your Android smartphone . In this instance , Symantec identified the specific PowerShell commands used by Gallmaker as being suspicious , leading to the discovery of this new campaign . After the modification , Akamai notes that they identified multiple compromised websites that had similarities .


Coronavirus Update App Leads to Project Spy Android and iOS Spyware We discovered a cyberespionage campaign we have named Project Spy infecting Android and iOS devices with spyware by using the coronavirus disease ( Covid-19 ) as a lure . Without Symantec 's advanced AI-based capabilities , Gallmaker 's activities may well have remained undetected . for example , Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader , one of the most popular PDF reader alternatives to Adobe Acrobat .


By : Tony Bao , Junzhi Lu April 14 , 2020 We discovered a potential cyberespionage campaign , which we have named Project Spy , that infects Android and iOS devices with spyware ( detected by Trend Micro as AndroidOS_ProjectSpy.HRX and IOS_ProjectSpy.A , respectively ) . Previously , LookingGlass reported on a campaign they named " Operation Armageddon " , targeting individuals involved in the Ukrainian military and national security establishment . the following functions with multiple control flow dispatchers can be unflattened . A New Threat on the Horizon : CL0P


Project Spy uses the ongoing coronavirus pandemic as a lure , posing as an app called Coronavirus Updates . The earliest discovered sample ( based on compile times and sandbox submission times ) distributed by this threat group resembles the descriptions of Gamaredon provided by Symantec and Trend Micro . The original implementation supports the following two cases of flattened blocks to find a block comparison variable for the next block ( the cases are then simplified ) One interesting detail about Hack520 is his apparent love for pigs , as seen in his use of the word in his email addresses .


We also found similarities in two older samples disguised as a Google service and , subsequently , as a music app after further investigation . The scripts would also use wget to send POST requests to command and control ( C2 ) servers that would contain information about the compromised system . . Limited forensic evidence existed to determine exactly how TIEDYE was deployed to systems in the victim environment ; however , like STRATOFEAR , TIEDYE was likely deployed as a second - stage backdoor by FULLHOUSE.DOORED .


However , we have noted a significantly small number of downloads of the app in Pakistan , India , Afghanistan , Bangladesh , Iran , Saudi Arabia , Austria , Romania , Grenada , and Russia . These VNC exectuables would either be included in the SFX file or downloaded by the batch script . In the second case , While Mandiant was unable to determine the initial intrusion point , our analysis suggests the OT component of this attack may have been developed in as little as two months .


Project Spy routine At the end of March 2020 , we came across an app masquerading as a coronavirus update app , which we named Project Spy based on the login page of its backend server . The batch script would then attempt to have the VNC program connect to a command and control ( C2 ) server to enable the server to control the compromised system . block comparison variable is searched in each block of endsWithJcc and nonJcc . Simultaneously , a new variant of Monti , based on the Linux platform , has surfaced , demonstrating notable differences from its previous Linux - based versions .


This app carries a number of the capabilities : Upload GSM , WhatsApp , Telegram , Facebook , and Threema messages Upload voice notes , contacts stored , accounts , call logs , location information , and images Upload the expanded list of collected device information ( e.g. , IMEI , product , board , manufacturer , tag , host , Android version , application version , name , model brand , user , serial , hardware , bootloader , and device ID ) Upload SIM information ( e.g. While the most recent samples observed still use batch scripts and SFX files , the Gamaredon Group has moved away from applications like wget , Remote Manipulator Tool , VNC and ChkFlsh.exe . If the next block is resolved , The overlaps in targeting and sharing of infrastructure amongst DPRK groups highlights the continued targeting and coordinated interest in the cryptocurrency field .


, IMSI , operator code , country , MCC-mobile country , SIM serial , operator name , and mobile number ) Upload wifi information ( e.g. , SSID , wifi speed , and MAC address ) Upload other information ( e.g. , display , date , time , fingerprint , created at , and updated at ) The app is capable of stealing messages from popular messaging apps by abusing the notification permissions to read the notification content and saving it to the database . The threat group using these implants has been active since at least 2014 and has been seen targeting individuals likely involved in the Ukrainian government . the CFG ( specifically mblock_t : :p redset and mblock_t : :s uccset ) An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 ( update 1 ) , as exploited in the wild starting in December 2021 .


It requests permission to access the additional storage . Some of the samples share delivery mechanisms and infrastructure with samples which are detected by a few antivirus vendors as Gamaredon . and the destination of goto jump instruction are updated . Symantec has identified MuddyWater as responsible for a new cyberespionage campaign targeting telecommunication and IT service providers in Asia and the Middle East for over six months .


Project Spy ’ s earlier versions Searching for the domain in our sample database , we found that the coronavirus update app appears to be the latest version of another sample that we detected in May 2019 . Periodically , researchers at Palo Alto Networks hunt through WildFire execution reports , using AutoFocus , to identify untagged samples ' artifacts in the hopes of identifying previously undiscovered malware families , behaviors , and campaigns . The code tracks the block comparison variable in each predecessor and more ( if any conditional blocks before the predecessor ) When the marital infidelity website AshleyMadison.com learned in July 2015 that hackers were threatening to publish data stolen from 37 million users , the company ’s then - CEO Noel Biderman was quick to point the finger at an unnamed former contractor .


The first version of Project Spy ( detected by Trend Micro as AndroidOS_SpyAgent.HRXB ) had the following capabilities : Collect device and system information ( i.e. , IMEI , device ID , manufacturer , model and phone number ) , location information , contacts stored , and call logs Collect and send SMS Take pictures via the camera Upload recorded MP4 files Monitor calls Searching further , we also found another sample that could be the second version of Project Spy . Just a few months later , in February 2015 , we announced the discovery of Carbanak , a cyber-criminal gang that used custom malware and APT techniques to steal millions of dollars while infecting hundreds of financial institutions in at least 30 countries . to identify each next block for unflattening . In those instances , the malicious was actually embedded in the Google Tag Manager library itself , which is very clever and difficult to detect .


This version appeared as Wabi Music , and copied a popular video-sharing social networking service as its backend login page . Today at the Security Analyst Summit ( SAS 2016 ) , Kaspersky Lab is announcing the discovery of two new gangs engaged in APT-style bank robberies – Metel and GCMAN – and the reemergence of the Carbanak group with new targets in its sights . And , While one of his signatures uses his own blog domain , there is also a second signature which uses 93[.]gd , a domain that was found to have been actively selling VPS services in the past .


In this second version , the developer ’ s name listed was “ concipit1248 ” in Google Play , and may have been active between May 2019 to February 2020 . In 2015 , Kaspersky Lab researchers conducted Incident Response for 29 organizations located in Russia and infected by these three groups . in the third case that was implemented , Based on these findings , CrowdStrike assesses it is highly likely that the OWA technique employed is in fact tied to CVE-2022 - 41080 .


This app appears to have become unavailable on Google Play in March 2020 . Kaspersky Lab is releasing crucial Indicators of Compromise ( IOCs ) and other data to help organizations search for traces of these attack groups in their corporate networks . the block comparison variables are not assigned in the flattened blocks but rather the first blocks according to a condition . Geographically , most victims are located in Europe , specifically Italy .


The second Project Spy version has similar capabilities to the first version , with the addition of the following : Stealing notification messages sent from WhatsApp , Facebook , and Telegram Abandoning the FTP mode of uploading the recorded images Aside from changing the app ’ s supposed function and look , the second and third versions ’ codes had little differences . In all , Kaspersky Lab discovered Metel in more than 30 financial institutions . For example , According to Kaspersky telemetry , targeted organizations included think tanks and individuals working in various areas related to security and geopolitics .


Potentially malicious iOS connection Using the codes and “ Concipit1248 ” to check for more versions , we found two other apps in the App Store . It is highly likely that this threat is far more widespread and we urge financial institutions around the world to scan their networks for signs of the Metel malware . the following microcode graph shows edi is assigned to esi ( the block comparison variable in this case ) Rhysida appears to have first popped up back in May , with several high - profile compromises posted on their leak site .


Further analysis of the iOS app “ Concipit1248 ” showed that the server used , spy [ . A second group , which we call GCMAN because the malware is based on code compiled on the GCC compiler , emerged recently using similar techniques to the Metel Group to infect banking institutions and attempt to transfer money to e-currency services . in block number 7 but the edi value is assigned in block number 1 and 2 . As we ’ve already previously discussed in our 2017 predictions , these groups will constantly evolve and employ unique and advanced attack techniques .


] cashnow [ . Our investigations revealed that the attackers drove around several cities in Russia , stealing money from ATMs belonging to different banks . If the immediate value for block comparison variable is not found in the flattened blocks , Threat intelligence is simply information about threats .


] ee , is the same one used in the Android version of Project Spy . Once inside the network , the GCMAN group uses legitimate and penetration testing tools such as Putty , VNC , and Meterpreter for lateral movement . the new code tries to trace the first blocks to obtain the value and reconnects block number 1 and 2 as successors of block number 7 , They collect , process , and analyze data about cyberthreats from a variety of public and private sources , creating timely , actionable , and engaging intelligence to keep organizations and our global partners up - to - date about today ’s threat landscape .


However , although the “ Concipit1248 ” app requested permissions to open the device camera and read photos , the code only can upload a self-contained PNG file to a remote sever . Our investigation revealed an attack where the GCMAN group then planted a cron script into bank 's server , sending financial transactions at the rate of $200 per minute . in addition to normal operations mentioned in the original cases . It is attributed to Iranian statesponsored APT Charming Kitten , whose other recent attacks include targeting world leaders attending the Munich Security Conference and the T20 Summit in Saudi Arabia in an effort to steal their email credentials , targeting Israeli scholars and U.S. government employees in another credentialstealing effort last July , and also attacking the reelection effort of former President Donald Trump .


This may imply the “ Concipit1248 ” app is still incubating . The GCMAN group used an MS SQL injection in commercial software running on one of bank 's public web services , and about a year and a half later , they came back to cash out . In this case , When the marital infidelity website AshleyMadison.com learned in July 2015 that hackers were threatening to publish data stolen from 37 million users , the company ’s then - CEO Noel Biderman was quick to point the finger at an unnamed former contractor .


The other iOS app “ Concipit Shop ” from the same developer appeared normal and was last updated on November 2019 . During that time they poked 70 internal hosts , compromised 56 accounts , making their way from 139 attack sources ( TOR and compromised home routers ) . the code parses the structure in first blocks then reconnects each conditional blocks under the flattened blocks ( #1 and #2 as successors of #13 , There are three main subroutines : the first is launched when the document is opened ( e.g. , Auto_Open , Workbook_Open ) , the second creates a randomly named dynamic loading library ( DLL ) file in the user ’s temporary files folder , and the third creates a randomly named shortcut ( LNK ) file which contains code to run regsvr32.exe ( or rundll32.exe ) to launch the next stage .


Apple has confirmed that the iOS apps are not functioning based on analysis of the codes , and stated that the sandbox is able to detect and block these malicious behaviors . However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . #3 and #4 as successors of #11 ) While a sudden dip in attacks is n't too unusual for top ransomware gangs , it 's worth mentioning that in last month ’s review we speculated that Royal might be going through a rebrand .


Conclusion The “ Corona Updates ” app had relatively low downloads in Pakistan , India , Afghanistan , Bangladesh , Iran , Saudi Arabia , Austria , Romania , Grenada , and Russia . Kaspersky Lab 's research team responded to three financial institutions in Russia that were infected with the GCMAN malware . . Most organizations receive and make use of intelligence published from third parties such as government agencies , specialist providers or collaborative groups .


Perhaps the app ’ s false capabilities also fueled the low number of downloads . In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company . Last , As the victims of commercial spyware are highly targeted individuals , the sobering truth is that some attackers have the means to be able to spend six figures to compromise a single target .


It also appears the apps may still be in development or incubation , maybe waiting for a “ right time ” to inject the malicious codes . Recently Subaat drew our attention due to renewed targeted attack activity . but not least , Rhysida appears to have first popped up back in May , with several high - profile compromises posted on their leak site .


It ’ s also possible that the apps are being used to test other possible techniques . Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec , in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking , which we are calling Gorgon Group . in all cases explained here , This plan should outline specific actions and procedures for attack mitigation and remediation , including guidelines for addressing extortion demands .


A possible indication for timing might be when the app reaches a specific number of downloads or infected devices . Starting in February 2018 , Palo Alto Networks identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States . the tail instruction of the dispatcher predecessor can be a conditional jump like jnz , The difference between ProxyNotShell and the newly discovered exploit method we are calling OWASSRF .


The coding style suggests that the cybercriminals behind this campaign are amateurs . Starting in February 2018 , Palo Alto Networks Unit 42 identified a not just goto . If passed , it would require U.S. financial institutions hit with ransomware to notify the Director of the Treasury Departments Financial Crimes Enforcement Network with details of the attack and the ransom demand .


The incomplete iOS codes used in this campaign may have been bought while other capabilities appear to have been added . of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States . The modified code checks the tail instruction and if the true case destination is a control flow dispatcher , JumpCloud reported this unauthorized access impacted fewer than five customers and less than 10 devices .


This may also explain the timing in between the apps becoming fully functional and “ incubation. ” As this is a group we have not observed before , we will continue monitoring this campaign for further developments . The GCMAN group has moved beyond banks and is now targeting the budgeting and accounting departments in any organization of interest to them , using the same APT-style tools and techniques . it updates the CFG and the destination of the instruction . This also ties into the fact that cyber criminals are competitive by nature , and they love the challenge their actions bring .


Users are cautioned to research and check reviews before they download apps . Starting in February 2018 , Unit 42 identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States . The following changes are minor compared with above referenced ones . For connections that occur internally within an enclave ( such as those between a proxy or pivot node and other nodes ) , commonly used protocols are SMB , SSH , or RDP .


Observe and look at the app ’ s display and text , stated functions , reviews from other users , and requested permissions before downloading . APT38 's increasingly aggressive targeting against banks . Additional jump instructions are supported when collecting block comparison variable candidates and mapping between the variable and ea or block number ( jnz/jle in JZCollector , The syntax of the command fragment includes “ scilc.exe ” , a native utility that is part of the MicroSCADA software suite .


Make sure that all other apps installed and the device operating systems are updated to the latest version . Gorgon Group used common URL shortening services to download payloads . jnz in JZMapper ) The PDFs used highly relevant , well - crafted content that fabricated human rights seminar information and Ukraine ’s foreign policy and NATO membership plans , and were rigged with exploits attacking Adobe Reader versions 9 , 10 and 11 , bypassing its sandbox .


Indicators of Compromise ( IoCs ) SHA256 Detection e394e53e53cd9047d6cff184ac333ef7698a34b777ae3aac82c2c669ef661dfe AndroidOS_SpyAgent.HRXB e8d4713e43241ab09d40c2ae8814302f77de76650ccf3e7db83b3ac8ad41f9fa AndroidOS_ProjectSpy.HRX 29b0d86ae68d83f9578c3f36041df943195bc55a7f3f1d45a9c23f145d75af9d The GCMAN group has moved beyond banks and is now targeting the budgeting and accounting departments in any organization of interest to them , using the same APT-style tools and techniques . . On April 16 , 2022 , KillNet dedicated its attack on a U.S. energy company to REvil .


AndroidOS_ProjectSpy.HRX 3a15e7b8f4e35e006329811a6a2bf291d449884a120332f24c7e3ca58d0fbbdb IOS_ProjectSpy.A URLs cashnow [ . APT38 has paralleled North Korea 's worsening financial condition . An entropy threshold adjustment due to check in high maturity level . Knowing what motivates hackers is a key part of keeping them out of your business


] ee Backend server ftp [ . On much of the C2 infrastructure we identified several crimeware family samples . Multiple block tracking for getting block comparison variable . None Why are Cyber Criminals More Likely to Target Small to Midsize Businesses "


] XXXX [ . While investigating the domains and infrastructure used by the phishing components of Gorgon Group , Unit 42 researchers witnessed several common operational security flaws with Gorgon Group 's actors throughout their many campaigns . And the last change that was introduced in regards to ConfuserEx obfuscator , an obfuscator that is very commonly used by malicious actors to obfuscate .NET code , is used with various levels of obfuscation , anti - tampering and anti - debugging , which makes the unpacking more difficult for malware researchers .


] com Backend server spy [ . 360 and Tuisec already identified some Gorgon Group members . the block update variable referred in the overview . Cybercriminals continue to identify and exploit an organizations weak spots and use common even basic techniques , including phishing or remote desktop protocol RDP to launch ransomware attacks , gain access to sensitive data , disrupt operations and , in some cases , put lives at risk .


] cashnow [ . RATs such as NjRat and infostealers like Lokibot were leveraging the same C2 infrastructure as that of the targeted attacks . Some functions in the ANEL sample utilize this , As these attacks continue to grow , security teams need tools to help save time and address the threats more effectively .


] ee Backend server xyz [ . it 's not known if the attackers physically reside in Pakistan . however the assignment is a little bit tricky . Specifically , the exec_signing_id field within the XPdb contains information about the signature of the binary , which can be used to help identify the author of a particular signed binary .


] cashnow [ . Gorgon used numerous decoy documents and phishing emails , both styles of attacks lacked overall sophistication . By using the and instruction , As confirmed by our own research data , CISA also found LockBit took the top spot as the biggest global ransomware threat in 2022 .


] ee Backend server October 8 , 2020 Sophisticated new Android malware marks the latest evolution of mobile ransomware Attackers are persistent and motivated to continuously evolve – and no platform is immune . While it 's not known if the attackers physically reside in Pakistan , all members of Gorgon Group purport to be in Pakistan based on their online personas . the immediate values used in comparison look different from assigned ones . COSMICENERGY accomplishes this via its two derivative components , which we track as PIEHOP and LIGHTWORK ( see appendices for technical analyses ) .


That is why Microsoft has been working to extend its industry-leading endpoint protection capabilities beyond Windows . Starting in mid-February , Unit 42 researchers have been tracking an active campaign sharing a significant portion of infrastructure leveraged by Gorgon Group for criminal and targeted attacks . The modified code will consider this . Kaspersky ’s Global Research and Analysis Team ( GReAT ) has observed signs of its attacks in several countries including Germany , South Korea and Uzbekistan , as well as the US .


The addition of mobile threat defense into these capabilities means that Microsoft Defender for Endpoint ( previously Microsoft Defender Advanced Threat Protection ) now delivers protection on all major platforms . Unit 42 researchers have been tracking Gorgon Group for criminal and targeted attacks . The modified tool was tested with an ANEL 5.4.1 payload dropped from a malicious document with the following hash ( previously reported by FireEye ) : The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim 's Facebook account and ultimately hijack any Facebook Business account that the victim has sufficient access to .


Microsoft ’ s mobile threat defense capabilities further enrich the visibility that organizations have on threats in their networks , as well as provide more tools to detect and respond to threats across domains and across platforms . As part of the investigation , Unit 42 researchers were able to identify an interesting characteristic about how the Gorgon Group crew uses shared infrastructure between cybercrime and targeted attacks . 3d2b3c9f50ed36bef90139e6dd250f140c373664984b97a97a5a70333387d18d . The collective has claimed responsibility for DDoS attacks , data theft , and leaks against entities across multiple industries , including transportation , defense , government and military , financial services , global institutions , and telecommunications .


Like all of Microsoft ’ s security solutions , these new capabilities are likewise backed by a global network of threat researchers and security experts whose deep understanding of the threat landscape guide the continuous innovation of security features and ensure that customers are protected from ever-evolving threats . The crew combines both regular crime and targeted attack objectives using the same domain infrastructure over time , rarely changing their TTPs . The code is able to deobfuscate 34 of 38 functions ( 89% ) In recent years , healthcare providers are increasingly being targeted with coordinated , sophisticated Phishing and Business Email Compromise BEC campaigns .


For example , we found a piece of a particularly sophisticated Android ransomware with novel techniques and behavior , exemplifying the rapid evolution of mobile threats that we have also observed on other platforms . One interesting note about the criminal activity of Gorgon Group is their usage of Bitly . . The differences between commercial spyware and digital extortion attacks You may have received an email something like , “ We know you ’ve visited this adult website .


The mobile ransomware , detected by Microsoft Defender for Endpoint as AndroidOS/MalLocker.B , is the latest variant of a ransomware family that ’ s been in the wild for a while but has been evolving non-stop . Between April 1 , 2018 and May 30 , 2018 , we observed the domain stevemike-fireforce.info used in a Gorgon Group cybercrime campaign involving more than 2,300 emails and 19 documents in the initial attack . It should be noted every function is not always obfuscated . Ashley Madison ’s executives understood that only a handful of employees at the time would have had access to the systems needed to produce the screenshots McNeill published online .


This ransomware family is known for being hosted on arbitrary websites and circulated on online forums using various social engineering lures , including masquerading as popular apps , cracked games , or video players . Similar to that of their targeted attacks , Gorgon Group leveraged Bitly for distribution and shortening of C2 domains . The failure examples are : From what we ’ve seen in Hack520 ’s blog , as well as the infrastructure deployed around it , it is quite safe to say that Hack520 is involved in aspects of the VPS service activity provided to groups like Winnti and other cybercriminals or threat actors .


The new variant caught our attention because it ’ s an advanced malware with unmistakable malicious characteristic and behavior and yet manages to evade many available protections , registering a low detection rate against security solutions . Beginning in early March 2018 , Unit 42 started observing targeted attacks against Russian , Spanish and United States government agencies operating in Pakistan . Not yet implemented cases ( e.g , Darkrace specifically targets Windows operating systems and has several similarities to LockBit .


As with most Android ransomware , this new threat doesn ’ t actually block access to files by encrypting them . Leveraging click counts for the campaign for Bitly , we were able to see Gorgon Group 's activity volume increase throughout April . a conditional jump of the dispatcher predecessor’s tail instruction in goto N predecessors case , SysUpdate is a featurerich backdoor that has multiple capabilities , including


Instead , it blocks access to devices by displaying a screen that appears over every other window , such that the user can ’ t do anything else . As we continued to investigate , it became apparent that Gorgon Group had been consistently targeting worldwide governmental organizations operating within Pakistan . consecutive if-statement flattened blocks ) FULLHOUSE.DOORED ( com.docker.vmnat , npx - cli , us.zoom . ZoomUpdate )


The said screen is the ransom note , which contains threats and instructions to pay the ransom . Starting in mid-February . . The file path at the end of the configuration is used to store configuration data that is encrypted using AES-128 .


What ’ s innovative about this ransomware is how it displays its ransom note . Additionally , during that time , members of Gorgon Group were also performing criminal operations against targets across the globe , often using shared infrastructure with their targeted attack operations . An incorrect choice of control flow dispatcher and first block ( algorithm error ) Mandiant has observed RGB units utilize a series of Operational Relay Boxes ( ORBs ) using L2TP IPsec tunnels along with commercial VPN providers to obscure their source address .


In this blog , we ’ ll detail the innovative ways in which this ransomware surfaces its ransom note using Android features we haven ’ t seen leveraged by malware before , as well as incorporating an open-source machine learning module designed for context-aware cropping of its ransom note . Unit 42 researchers have been tracking an active campaign . . The IP range for “ PIG GOD ” is 43[.]255[.]188.0/22 , which appears to be hosted in Hong Kong as seen in the information we found : The domain 66[.]to leads to another website that shows Hack520 ’s pet pig .


New scheme , same goal In the past , Android ransomware used a special permission called “ SYSTEM_ALERT_WINDOW ” to display their ransom note . This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 . These fixes will be prioritized for future releases . The key to the success of an effort like No More Ransomware is informationsharing and collaboration .


Apps that have this permission can draw a window that belongs to the system group and can ’ t be dismissed . Beginning in early March 2018 , Unit 42 started observing Gorgon group attacks against Russian , Spanish and United States government agencies operating in Pakistan . Additionally there is a known issue with the result ( e.g , the remaining loop or paradoxical decompiled code ) With regards to these similarities , we highlight the following trends which could manifest in future OT malware : •


No matter what button is pressed , the window stays on top of all other windows . Like all of Gorgon Group 's members , Fudpage 's online profile , infrastructure utilization and standardization , connects them back to Gorgon Group . , A typical log entry showing access to the PowerShell backend is detailed in the Remote PowerShell HTTP logs , located in , such as in the example below : CrowdStrike incident responders discovered Remote PowerShell logs similar to log entries for ProxyNotShell exploitation to gain initial access , suggesting the attacker leveraged Remote PowerShell .


The notification was intended to be used for system alerts or errors , but Android threats misused it to force the attacker-controlled UI to fully occupy the screen , blocking access to the device . Ultimately , this lead us to the conclusion that several of Gorgon Group 's members have a nexus in Pakistan . using the following IDAPython command in Output window : The attackers then ran reconnaissance commands such as whoami , netstat , quser , and net share , and tried to enumerate other servers for lateral movement with the quser and net view commands .


Attackers create this scenario to persuade users to pay the ransom so they can gain back access to the device . Gorgon Group isn't the first actor group we've witnessed dabble in both nation state level and criminal attacks . idc.load_and_run_plugin None C2 RSA Verification


To catch these threats , security solutions used heuristics that focused on detecting this behavior . Overall , in spite of the lack of sophistication in Gorgon Group 's activity , they were still relatively successful ; once again proving that simple attacks on individuals without proper protections , work . ( A typical web request to the frontend to exploit the SSRF vulnerability on CVE-2022 - 41040 involves some variation of path confusion that references the endpoint as shown below : The backend request for a typical ProxyNotShell exploitation is shown below : Once the PowerShell remoting service can be reached , the second step involves vulnerability CVE-2022 - 41082 being exploited in order to execute arbitrary commands .


Google later implemented platform-level changes that practically eliminated this attack surface . On January 15 , Advanced Threat Research discovered an operation using a new variant of the SYSCON backdoor . “ HexRaysDeob ” The script downloads two files to locations defined by the variables ffn and fn , but only the first file is executed via the system function .


These changes include : Removing the SYSTEM_ALERT_WINDOW error and alert window types , and introducing a few other types as replacement Elevating the permission status of SYSTEM_ALERT_WINDOW to special permission by putting it into the “ above dangerous ” category , which means that users have to go through many screens to approve apps that ask for permission , instead of just one click Introducing an overlay kill switch on Android 8.0 and later that users can activate anytime to deactivate a system alert window To adapt , Android malware evolved to misusing The Korean-language Word document manual.doc appeared in Vietnam on January 17 , with the original author name of Honeybee . , The focus should be on isolating the affected devices andor networks to prevent further spread and minimize the impact .


other features , but these aren ’ t as effective . While Gorgon Group has been making minor changes in their methodologies , they are still actively involved in both targeted and criminal attacks . 0xdead ) All protocols use their standard assigned ports.[2][3 ] Dragonfly has used SMB for C2.[4 ]


For example , some strains of ransomware abuse accessibility features , a method that could easily alarm users because accessibility is a special permission that requires users to go through several screens and accept a warning that the app will be able to monitor activity via accessibility services . This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON , which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics . . These servers may be approved , but a compromised network endpoint can be modified to mask the final destination of the server requests originating externally .


Other ransomware families use infinite loops of drawing non-system windows , but in between drawing and redrawing , it ’ s possible for users to go to settings and uninstall the offending app . This key was also used in the Honeybee campaign and appears to have been used since August 2017 . The command will instruct the code to execute only opaque predicates deobfuscation in the current selected function . No More Ransom now includes 185 partners from the public sector , private industry , law enforcement , and academia .


The new Android ransomware variant overcomes these barriers by evolving further than any Android malware we ’ ve seen before . Several additional documents surfaced between January 17 and February 3 . This allows an analyst to quickly check if there are any lost blocks by control flow unflattening . one base64 encoded string but multiple , separated by a character .


To surface its ransom note , it uses a series of techniques that take advantage of the following components on Android : The “ call ” notification , among several categories of notifications that Android supports , which requires immediate user attention . All contain the same Visual Basic macro code and author name as Honeybee . After the check , Pikabot is a new malware first seen in early 2023 .


The “ onUserLeaveHint ( ) ” callback method of the Android Activity ( i.e. , the typical GUI screen the user sees ) is called as part of the activity lifecycle when the activity is about to go into the background as a result of user choice , for example , when the user presses the Home key . Some of the malicious documents were test files without the implant . the original result can be restored by using the following command : There are several methods in which SCIL programs can execute , such as an engineer / operator clicking a button or image within the MicroSCADA system , scheduled or process derived changes , or in this case manual execution .


The malware connects the dots and uses these two components to create a special type of notification that triggers the ransom screen via the callback . From our analysis , Honeybee submitted most of these documents from South Korea , indicating that some of the targeting was in South Korea . idc.load_and_run_plugin Additionally , 20 said they had experienced data breaches by former employees .


As the code snippet shows , the malware creates a notification builder and then does the following : setCategory ( “ call ” ) – This means that the notification is built as a very important notification that needs special privilege . Honeybee attacked beyond the borders of South Korea to target Vietnam , Singapore , Argentina , Japan , Indonesia , and Canada . ( On hosts of interest , Agrius deploys its own custom malware a .NET backdoor called IPsec Helper , which registers itself as a service to establish persistence .


setFullScreenIntent ( ) – This API wires the notification to a GUI so that it pops up when the user taps on it . Honeybee appears to target humanitarian aid and inter-Korean affairs . “ HexRaysDeob ” However , over time , it becomes tedious for fraudsters to constantly change information when registering new domains .


At this stage , half the job is done for the malware . McAfee Advanced Threat Research team 's analysis , we find multiple components from this operation are unique from a code perspective , even though the code is loosely based on previous versions of the SYSCON backdoor . , It allows security researchers to analyze the source code and understand the attacker ’s tactics , techniques and procedures ( TTPs ) , which helps security professionals develop effective detection rules and enhance security products ' capabilities in combating ransomware threats .


However , the malware wouldn ’ t want to depend on user interaction to trigger the ransomware screen , so , it adds another functionality of Android callback : As the code snippet shows , the malware overrides the onUserLeaveHint ( ) callback function of Activity class . Large-scale cyber espionage campaigns such as " GhostNet " . 0xf001 ) Therefore , having access to such code allows threat actors with minimum programming knowledge to modify and compile their own ransomware variants .


The function onUserLeaveHint ( ) is called whenever the malware screen is pushed to background , causing the in-call Activity to be automatically brought to the foreground . As the crisis in Syria escalates , FireEye researchers have discovered a cyber espionage campaign , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe . . The campaign started in at least June 2023 , and the ransom note appears to mimic certain aspects of the ransom note used in the global WannaCry attacks from 2017 .


Recall that the malware hooked the RansomActivity intent with the notification that was created as a “ call ” type notification . As the crisis in Syria escalates , FireEye researchers have discovered a threat group , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe . The compiler-level obfuscations like opaque predicates and control flow flattening are started to be observed in the wild by analyst and researchers . As for who was hit the hardest , around 16 percent of ransomware incidents affecting State , Local , Tribal , and Tribunal ( SLTT ) governments were from LockBit , says the MS - ISAC .


This creates a chain of events that triggers the automatic pop-up of the ransomware screen without doing infinite redraw or posing as system window . We believe that the Ke3chang attackers are operating out of China and have been active since at least 2010 . Currently malware with the obfuscations is limited , We would also like to thank Trellix for our continued partnership and for providing supporting detection YARA rules and associated indicators .


Machine learning module indicates continuous evolution As mentioned , this ransomware is the latest variant of a malware family that has undergone several stages of evolution . FireEye gained visibility into one of 23 known command-and-control ( CnC ) servers operated by the Ke3chang actor for about one week . however TAU expects not only APT10 but also other threat actors will start to use them . The Monti ransomware collective has restarted their operations , focusing on institutions in the legal and governmental fields .


The knowledge graph below shows the various techniques this ransomware family has been seen using , including abusing the system alert window , abusing accessibility features , and , more recently , abusing notification services . Each attack comprises a variety of phases , including reconnaissance , exploitation , command and control , lateral movement , and exfiltration . Unfortunately , • Identify and investigate the creation , transfer , and/or execution of unauthorized Python - packaged executables ( e.g. , PyInstaller or Py2Exe ) on OT systems or systems with access to OT resources .


This ransomware family ’ s long history tells us that its evolution is far from over . The Ke3chang attackers have been active since at least 2010 . in order to break the techniques we have to understand both of the obfuscation mechanisms and disassembler tool internals before we can automate the process . This includes hosting C&C domains that were used by Winnti such as mtrue.com , shenqi[.]kr and zhu[.]kr .


We expect it to churn out new variants with even more sophisticated techniques . traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors . TAU modified the original HexRaysDeob to make it work for APT10 ANEL obfuscations . In the case of a traditional ProxyNotShell exploit chain , the attack sequence is done in two steps :


In fact , recent variants contain code forked from an open-source machine learning module used by developers to automatically resize and crop images based on screen size , a valuable function given the variety of Android devices . The Ke3chang have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , chemicals , manufacturing , mining sectors . The modified code is available publically here . We highly suspect the “ Pig network ” to have also been used as a bulletproof hosting service for cybercriminals who are unrelated to the Winnti group .


The frozen TinyML model is useful for making sure images fit the screen without distortion . August 2013 , FireEye gained visibility on one of 22 CnC servers used at that time by the Ke3chang attackers . The summary of the modifications is : What the team uncovered was that the former MiniDuke attackers were still active , and using extremely effective social engineering techniques involving sending malicious PDF documents to compromise their victims .


In the case of this ransomware , using the model would ensure that its ransom note—typically fake police notice or explicit images supposedly found on the device—would appear less contrived and more believable , increasing the chances of the user paying for the ransom . In this report , we present the historical intelligence we have gathered on the Ke3chang campaign , as well as an in-depth assessment of the ongoing Syrian-themed attacks against these MFAs . New patterns and data-flow tracking for opaque predicates . An adversary could potentially instruct a control systems device to perform an action that will cause an Impact


The library that uses tinyML is not yet wired to the malware ’ s functionalities , but its presence in the malware code indicates the intention to do so in future variants . Ke3chang attackers have used spear-phishing emails . Analysis in multiple maturity levels , One interesting detail about Hack520 is his apparent love for pigs , as seen in his use of the word in his email addresses .


We will continue to monitor this ransomware family to ensure customers are protected and to share our findings and insights to the community for broad protection against these evolving mobile threats . Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . considering multiple control flow dispatchers and various jump cases for control flow flattening . The leaked tooling included a Python script , , that when executed led CrowdStrike researchers to replicate the logs generated in recent Play ransomware attacks .


Protecting organizations from threats across domains and platforms Mobile threats continue to rapidly evolve , with attackers continuously attempting to sidestep technological barriers and creatively find ways to accomplish their goal , whether financial gain or finding an entry point to broader network compromise . Traditionally , the Ke3chang attackers have used spear-phishing emails with either a malware attachment or a link to a malicious download . The tool can work for almost all obfuscated functions in the tested sample . Mandiant is investigating multiple instances of successful exploitation of CVE-2023 - 4966 that resulted in the takeover of legitimate user sessions on NetScaler ADC and Gateway appliances .


This new mobile ransomware variant is an important discovery because the malware exhibits behaviors that have not been seen before and could open doors for other malware to follow . Over the years , the Ke3chang attackers have used three types of malware that we call : " BS2005 " , " BMW " , and " MyWeb " . This implementation will deobfuscate approximately 89% of encountered functions . The next is to call with expecting it to return 0 as it is likely to have an environment variable name like that .


It reinforces the need for comprehensive defense powered by broad visibility into attack surfaces as well as domain experts who track the threat landscape and uncover notable threats that might be hiding amidst massive threat data and signals . it is a typical first stage backdoor commonly found in APT attacks . This provides researchers and analyst broad tool to attack this type of obfuscation , We note that the MicroSCADA control system became a Hitachi Energy product in 2022 after a divestiture from ABB .


Microsoft Defender for Endpoint on Android , now generally available , extends Microsoft ’ s industry-leading endpoint protection to Android . The attackers have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors . and if it adopted in other families . Actors behind many of these new ransomware variants , including Sirattacker , Chaos 2.0 , Chaos 4.0 , DCrypt , and Shadow Men Team , are demanding payments ranging from USD $ 3.50 to $ 4,390 in Bitcoin from victims .


It detects this ransomware ( AndroidOS/MalLocker.B ) , as well as other malicious apps and files using cloud-based protection powered by deep learning and heuristics , in addition to content-based detection . All of the CnC communications are performed over the HTTP protocol . In should be noted that the tool may not work for the updated versions of ANEL if they are compiled with different options of the obfuscating compiler . Based on the use of domain names they registered , the group started out in the business of fake / rogue anti - virus products in 2007 .


It also protects users and organizations from other mobile threats , such as mobile phishing , unsafe network connections , and unauthorized access to sensitive data . The current Ke3chang campaign leverages the BS2005 malware , while older activity from 2010 - 2011 leveraged BMW , followed by the MyWeb malware sporadically used in between . Testing in multiple versions is important , DarkRace is a new ransomware group first discovered by researcher S!Ri .


Learn more about our mobile threat defense capabilities in Microsoft Defender for Endpoint on Android . A trait common to all three malware families we analyzed is that they use the IWebBrowser2 COM interface to perform their CnC communication . so TAU is looking for newer versions ANEL samples . Whoever hacked Ashley Madison had access to all employee emails , but they only released Biderman ’s messages — three years worth .


Malware , phishing , and other threats detected by Microsoft Defender for Endpoint are reported to the Microsoft Defender Security Center , allowing SecOps to investigate mobile threats along with endpoint signals from Windows and other platforms using Microsoft Defender for Endpoint ’ s rich set of tools for detection , investigation , and response . Three months after the Olympics-themed attacks , FireEye observed a new BS2005 campaign labeled " newtiger " , which is possibly a reference to an older 2010 campaign labeled " tiger " . Please reach out to our unit if you have relevant samples or need assistance in deobfuscating the codes . Indicators of compromise aid information security and IT professionals in detecting data breaches , malware infections , or other threat activity .


Threat data from endpoints are combined with signals from email and data , identities , and apps in Microsoft 365 Defender ( previously Microsoft Threat Protection ) , which orchestrates detection , prevention , investigation , and response across domains , providing coordinated defense . Using information from the FireEye DTI cloud , FireEye observed that Ke3chang targeted a single firm . Double Loaded Zip File Delivers Nanocore Most malware sent via emails is packaged in archives such as ZIP, RAR, and 7z ) . How The Command are executed The malware add to the user environment variables and creates a pipe for covert communication and receiving the output .


Microsoft Defender for Endpoint on Android further enriches organizations ’ visibility into malicious activity , empowering them to comprehensively prevent , detect , and respond to against attack sprawl and cross-domain incidents . The Ke3chang attackers used the older " MyWeb " malware family from 2010 to 2011 . Occasionally, we encounter some clever and creative ways these malicious archives are . CADDYWIPER will attempt to wipe all files before proceeding to wipe any mapped drives .


Technical analysis Obfuscation On top of recreating ransomware behavior in ways we haven ’ t seen before , the Android malware variant uses a new obfuscation technique unique to the Android platform . The Ke3chang attackers used the older MyWeb malware family from 2010 to 2011 . Here we will examine an example of an oddly formatted ZIP archive hiding the NanoCore . The group 's 91 attacks come not long after their extensive GoAnywhere campaign in March , when they hit over 100 organizations using a nasty zero - day .


One of the tell-tale signs of an obfuscated malware is the absence of code that defines the classes declared in the manifest file . During our period of visibility into the BS2005 " moviestar " campaign against various ministries of foreign affairs in Europe , FireEye discovered that the Ke3chang had initially tested the malware in virtual machines , prior to compromising actual targets . We spotted a courier themed spam campaign on our Secure Email Gateway (SEG ) cloud . After further research , we were able to link Hack520 to different network administration activities , notably with a Virtual Private Server ( VPS ) hosting service .


The classes.dex has implementation for only two classes : The main application class gCHotRrgEruDv , which is involved when the application opens A helper class that has definition for custom encryption and decryption This means that there ’ s no code corresponding to the services declared in the manifest file : Main Activity , Broadcast Receivers , and Background . The MyWeb sample that FireEye analyzed has a compile date of 1/20/2011 . The message claimed to be from an Export Operation Specialist of USCO Logistics and that it was sent as per their customer . Collect NSPPE core dump files from NetScaler .


How does the malware work without code for these key components ? At least one of the attacks in this campaign leveraged a European security and defense-themed lure , which aligns with the targeting preferences for this group . Aside from this, there were several other suspicious items we noted: Headers mismatched: The Reply-To and From email address were . But while it was clear earlier on that attackers were actively exploiting CVE-2023 - 34362 , it was only a few days later that it became clear that Cl0p was behind the attacks .


As is characteristic for obfuscated threats , the malware has encrypted binary code stored in the Assets folder : When the malware runs for the first time , the static block of the main class is run . MyWeb is the second-generation malware used by Ke3chang . Furthermore, the email address used in Reply-To is from a free email client . This new ransomware variant does n't have any novel features or functionality and points to the challenges organizations are facing as the landscape continues to shift and a plethora of new actors join their ranks .


The code is heavily obfuscated and made unreadable through name mangling and use of meaningless variable names : Decryption with a twist The malware uses an interesting decryption routine : the string values passed to the decryption function do not correspond to the decrypted value , they correspond to junk code to simply hinder analysis . ministries of foreign affairs in Europe have been targeted and compromised by a threat actor we call Ke3chang . Suspicious message body: The attachment was mentioned in the message body twice, making sure to direct the reader’s attention towards the . The arrest makes him the third LockBit affiliate charged in the US since November .


On Android , an Intent is a software mechanism that allows users to coordinate the functions of different Activities to achieve a task . This attack used the crisis in Syria as a lure to deliver malware to its targets . Suspicious attachment name: The name of attachment SHIPPING_MX00034900_PL_INV_pdf.zip ends with pdf.zip . The group appears to commonly deploy double extortion of the victims that have been listed on the leak site , several of them have had some portion of their exfiltrated data exposed .


It ’ s a messaging object that can be used to request an action from another app component . Tracking the malicious activities of the elusive Ke3chang APT group , ESET researchers have discovered new versions of malware families linked to the group , and a previously unreported backdoor . That usually means that the name of the file inside the archive ends with 2 known file extensions “pdf.<extension>” (archiving tools usually defaults the <extension> to the archive’s format e.g. ) . The malware is designed to cause electric power disruption by interacting with IEC 60870 - 5 - 104 ( IEC-104 ) devices , such as remote terminal units ( RTUs ) , that are commonly leveraged in electric transmission and distribution operations in Europe , the Middle East , and Asia .


The Intent object carries a string value as “ action ” parameter . Furthermore , FireEye has presented evidence indicating that the Ke3chang attackers have been active since at least 2010 and have attacked targets related to G20 meetings in the past . The attachment SHIPPING_MX00034900_PL_INV_pdf.zip makes this message stand . An example of these log entries can be found below : By correlating the user , IP address and GUID from the Remote PowerShell HTTP logs to the Exchange frontend , CrowdStrike found a request using the mailbox to the following OWA URL , , corresponding to the IIS log entry below : The backend request for the new exploitation chain is similar to the example shown below : This request seemed to show a novel , previously undocumented , way to reach the PowerShell remoting service through the OWA frontend endpoint , instead of leveraging the endpoint .


The malware creates an Intent inside the decryption function using the string value passed as the name for the Intent . During our brief window of visibility into one of the known 22 CnC nodes , FireEye observed the Ke3chang conducting reconnaissance and moving laterally throughout the compromised networks . The ZIP file had a file size significantly greater than that of its uncompressed . These threats can come from internal employees , vendors , a contractor or a partnerand are viewed as some of the greatest cyber security threats to organizations .


It then decrypts a hardcoded encrypted value and sets the “ action ” parameter of the Intent using the setAction API . Ke3chang attackers are operating within China . Typically, the size of the ZIP file should be less than the uncompressed content or, in some cases, ZIP files will grow larger than the original files by a reasonable number of . The second step is simply the same exploit used in the second step of ProxyNotShell , allowing code execution through PowerShell remoting .


Once this Intent object is generated with the action value pointing to the decrypted content , the decryption function returns the Intent object to the callee . In May 2017 , NCC Group 's Incident Response team reacted to an ongoing incident . ZIP archives are supposed to have one “End of Central Directory” (EOCD) signifying the end of the . In 2015 GReAT reported that CozyDuke often spear phishes targets with emails containing a link to a hacked website .


The callee then invokes the getAction method to get the decrypted content . which provides a range of services to UK Government . Looking deeper into the structure of SHIPPING_MX00034900_PL_INV_pdf.zip , the attachment has two . Indicators of attack are not so much a static description of the attacker , but a dynamic profile of how an attacker interacts with your technologies and users .


Payload deployment Once the static block execution is complete , the Android Lifecycle callback transfers the control to the OnCreate method of the main class . APT15 was targeting information related to UK government departments and military technology . After the first EOCD comes some extra data – another ZIP file . Initially engaged in espionage activity , Agrius deployed a set of destructive wiper attacks against Israeli targets , masquerading the activity as ransomware attacks .


Malware code showing onCreate method Figure 9. onCreate method of the main class decrypting the payload Next , the malware-defined function decryptAssetToDex ( a meaningful name we assigned during analysis ) receives the string “ CuffGmrQRT ” as the first argument , which is the name of the encrypted file stored in the Assets folder . backdoors that now appear to be part of APT15 's toolset . It turns out that the first ZIP structure is for the image file order.jpg while the second one is for an executable file SHIPPING_MX00034900_PL_INV_pdf.exe . Astamirov is now facing charges of wire fraud and of intentionally damaging protected computers , plus he 's accused of making ransom demands through deploying ransomware .


Malware code showing decryption of assets Figure 10 . This report demonstrates that Ke3chang is able to successfully penetrate government targets using exploits for vulnerabilities that have already been patched and despite the fact that these ministries have defenses in place . Both are compressed when archived, and both indicate that they are the only file in their ZIP structures as indicated in their local file headers and EOCDs . We have observed individuals with managerial , digital marketing , digital media , and human resources roles in companies to have been targeted .


Decrypting the assets After being decrypted , the asset turns into the .dex file . RoyalDNS - required APT15 . The image file “order.jpg” contained in the first ZIP structure is actually a non-malicious PNG formatted image . Therefore , there are cases where these vulnerabilities are accessible via the internet .


This is a notable behavior that is characteristic of this ransomware family . The Ke3chang group also used keyloggers and their own .NET tool to enumerate folders and dump data from Microsoft Exchange mailboxes . This serves as a decoy, an attempt to hide the content of the other ZIP . Does your organization possess any PII or regulated data such as payment card data , health care data , social security numbers or bank accounts Financially motivated attacks


Comparison of code of Asset file before and after decryption Figure 11 . APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets . The image file has been correctly identified by SEG as a PNG when its file extension is .jpg denoting a JPEG formatted . None on the CrowdStrike Falcon ® console and of the market - leading CrowdStrike Falcon ® platform in action .


Asset file before and after decryption Once the encrypted executable is decrypted and dropped in the storage , the malware has the definitions for all the components it declared in the manifest file . This time , APT15 opted for a DNS based backdoor : RoyalDNS . The second ZIP structure contains SHIPPING_MX00034900_PL_INV_pdf.exe , which is a NanoCore . The CozyDuke malware utilizes a backdoor and dropper , and exfiltrates data to a C2 server .


It then starts the final detonator function to load the dropped .dex file into memory and triggers the main payload . APT15 then used a tool known as RemoteExec . This remote access Trojan has the capability that allows an attacker to completely take control of the compromised . None Organizations should apply the November 8 , 2022 patches for Exchange to prevent exploitation since the URL rewrite mitigations for ProxyNotShell are not effective against this exploit method .


Malware code showing loading of decrypted dex file Figure 12 . APT15 then used a tool known as RemoteExec ( similar to Microsoft . It connects to its command and control server at 194.5.98.85 on port . Take the case of a research and development firm .


Loading the decrypted .dex file into memory and triggering the main payload Main payload When the main payload is loaded into memory , the initial detonator hands over the control to the main payload by invoking the method XoqF ( which we renamed to triggerInfection during analysis ) from the gvmthHtyN class ( renamed to PayloadEntry ) . Coincidentally , following the recent hack of a US Navy contractor and theft of highly sensitive data on submarine warfare , we have found evidence of very recent activity by a group referred to as APT15 , known for committing cyber espionage which is believed to be affiliated with the Chinese government . This NanoCore RAT is version 1.2.2.0 which has been found to be offered for free on the Dark Web just a few months . The threat actor targets individuals and employees that may have access to a Facebook Business account with an information - stealer malware .


Malware code showing handover from initial module to main payload Figure 13 . APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more . We used different archiving tools such as PowerArchiver 2019 , WinZip , WinRar , 7Zip , and unzIP S-TOOL that is built into the Windows OS in attempting to extract the content of the attachment SHIPPING_MX00034900_PL_INV_pdf.zip . While this shift likely reflects the increased tempo of wartime cyber operations , it also reveals the GRU ’s priority objectives in OT attacks .


Handover from initial module to the main payload As mentioned , the initial handover component called triggerInfection with an instance of appObj and a method that returns the value for the variable config . Other names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon . Among these 5 tools, only WinZip and Windows’ unzIP S-TOOL were not able to extract anything from the ZIP file as they encountered an error at the start of the extraction . The hacking and defacement of a U.S. Government system in which the attackers post messages disparaging remarks about capitalism or democracy would be a solid example of hacktivism .


Malware code showing definition of populateConfigMap Figure 14 . ther names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon . The other archiving tools were able to extract one file from the ZIP attachment – either order.jpg or SHIPPING_MX00034900_PL_INV_pdf.exe . CADDYWIPER was then executed as a scheduled task at a predetermined time .


Definition of populateConfigMap , which loads the map with values Correlating the last two steps , one can observe that the malware payload receives the configuration for the following properties : number – The default number to be send to the server ( in case the number is not available from the device ) api – The API key url – The URL to be used in WebView to display on the ransom note The malware saves this configuration to the shared preferences of the app data and then it sets up all the Broadcast Receivers . There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group . WinZip version 11.2 and 24.0, and the built-in unzIP S-TOOL tool in Windows , recognized that the attachment SHIPPING_MX00034900_PL_INV_pdf.zip is an invalid . The threat actor first detected towards the end of last year when it attacked at least 87 organizations around the world in two months ' time .


This action registers code components to get notified when certain system events happen . There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group ; although posted in March 2018 , it refers to a campaign in 2017 , both attributed to Chinese government affiliated groups . Only WinZip gave an explicit reason – the start of central directory of the ZIP was not . For this reason , it is impossible to prevent all crime through deterrence .


This is done in the function initComponents . DLL hijacking techniques have been seen in the past with the APT15 group . The central directory it pertained to is the one in the second ZIP . But then , following an upsurge in attacks in the second half of 2014 , GReAT characterized MiniDuke , CosmicDuke and the actor ’s Nemesis Gemina project - targeting government , diplomatic , energy , military and telecom operators - as ‘ one of the world ’s most unusual APT operations ’ due to : • Its use of a customized backdoor written in Assembler using ‘ old school ’ virus writing techniques and habits • Stealthy transfer of updates as executables hidden inside GIF files ( a form of steganography )


Malware code showing initializing broadcast receiver Figure 15 . cyber actors of the North Korean to target the media , aerospace , financial , and critical infrastructure sectors in the United States and globally . At figure 2, the second EOCD indicates that its only central directory is located at file offset 0xd148f whereas it is at 0xd40d41. (The size of the first But while it was clear earlier on that attackers were actively exploiting CVE-2023 - 34362 , it was only a few days later that it became clear that Cl0p was behind the attacks .


Initializing the BroadcastReceiver against system events From this point on , the malware execution is driven by callback functions that are triggered on system events like connectivity change , unlocking the phone , elapsed time interval , and others . The U.S. Government refers to the malicious cyber activity by the North Korean government as HIDDEN COBRA . ZIP structure was not considered.) Meanwhile, the archiving tools PowerArchiver 2019 , WinRar , and 7Zip were able to extract a file from the attachment SHIPPING_MX00034900_PL_INV_pdf.zip . That is very concerning to us , however , there are a couple of things that end users can look out for : Although zero - click exploits do exist , they 're not very common .


Lookout researchers have identified a new , highly targeted surveillanceware family known as Desert Scorpion in the Google Play Store . Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets , keyloggers , remote access tools ( RATs ) , and wiper malware . The latest versions of PowerArchiver 2019 and WinRar displayed in their respective UI the executable SHIPPING_MX00034900_PL_INV_pdf.exe as the only content of the ZIP . However , lessons learned this year can help organizations take proactive steps to protect themselves from ransomware in 2023 .


Lookout notified Google of the finding and Google removed the app immediately while also taking action on it in Google Play Protect . Variants of malware and tools used by HIDDEN COBRA actors include Destover and Hangman . No error or warning was prompted during the . Ideology is a motivation that makes the threat a little trickier .


The app ties together two malware families - Desert Scorpion and another targeted surveillanceware family named FrozenCell - that we believe are being developed by a single , evolving surveillanceware actor called APT-C-23 targeting individuals in the Middle East . DHS has previously released Alert TA14-353A . Older versions of 7Zip also behave like PowerArchiver and WinRAR . 7Zip version 9.22 and older saw the executable as . Simultaneously , a threat researcher outside of CrowdStrike discovered an attacker ’s tooling via an open repository , downloaded all of the tools , and made them available through a MegaUpload link in a Twitter post.2


We 've seen this actor rely heavily on phishing campaigns to trick victims into downloading their malicious apps , specifically on Facebook . The DeltaCharlie DDoS bot was originally reported by Novetta in their 2016 Operation Blockbuster Malware Report . However, starting from 7Zip version 9.34 (next available installer after version 9.22) up to its latest version 19.0, 7zip saw and was able to extract the image file order.jpg . Second , as COSMICENERGY was potentially developed as part of a red team , this discovery suggests that the barriers to entry are lowering for offensive OT threat activity since we normally observe these types of capabilities limited to well resourced or state sponsored actors .


Even sophisticated actors are using lower cost , less technologically impressive means like phishing to spread their malware because it 's cheap and very effective , especially on mobile devices where there are more ways to interact with a victim ( messaging apps , social media apps , etc . Our analysis shows that the cybercriminals behind the attack against an online casino in Central America , and several other targets in late-2017 , were most likely the infamous Lazarus hacking group . The second ZIP structure was treated as extra data; hence, a warning was added to the extracted image file’s . /Library / LaunchDaemons / com.studentd.agent.plist


) , and less screen real estate for victims to identify potential indicators of a threat . The Lazarus Group was first identified in Novetta 's report Operation Blockbuster in February 2016 . Among the archiving tools we tried, WinRar 3.30 behaved differently and . It has two components Loader and core module .


Lookout customers are protected against this threat and additionally we have included a list of IOCs at the end of this report . cyberattacks against high-value targets in Ukraine in December 2015 and December 2016 . The content of the ZIP attachment it displayed in its UI was not the one it extracted! This sample challenges gateways . Surprisingly enough , it does not take very long to get some information about Hack520 : someone with this handle runs a blog and a Twitter account ( with a handle close to Hack520 ) that is also directly linked to the blog .


The potential actor and who they target Our current analysis strongly suggests Desert Scorpion is being deployed in targeted attacks against Middle Eastern individuals of interest specifically those in Palestine and has also been highlighted by other researchers . In all of these incidents , the Lazarus utilized similar toolsets , including KillDisk that was executed on compromised machines . Depending on the type of decompression engine used, there is a good probability that only the decoy file may be scrutinized and vetted, and the malicious content unnoticed – just like how some of the most popular archiving tools failed to notice the second ZIP . STRATOFEAR is a modular backdoor that communicates with C2 servers using a protocol specified in its C2 configuration , which is decrypted from a local file .


We have been able to tie the malware to a long-running Facebook profile that we observed promoting the first stage of this family , a malicious chat application called Dardesh via links to Google Play . We are confident this KillDisk malware was deployed by Lazarus , rather than by another , unrelated attacker . Despite what the gateway does, this attack would only succeed if the message got through the gateway and a particular archive utility is used by the end-user, such as certain versions of PowerArchiver , WinRar , and older 7Zip as described . The new exploit method bypasses URL rewrite mitigations for the endpoint provided by Microsoft in response to •


The Lookout Threat Intelligence team identified that this same Facebook profile has also posted Google Drive links to Android malware belonging to the FrozenCell family attributed to APT-C-27 . This recent attack against an online casino in Central America suggests that hacking tools from the Lazarus toolset are recompiled with every attack ( we didn't see these exact samples anywhere else ) . In this case, the Trustwave Secure email Gateway flagged the message as suspicious and it did not get . Based on our research , we discovered an unknown threat actor using MortalKombat ransomware since December 2022 to target individuals and smaller companies .


These factors , in combination with the fact that the command and control infrastructure used by Frozen Cell and Desert Scorpion resides in similar IP blocks , supports the theory that the same actor is responsible for operating , if not developing , both families . Utilizing KillDisk in the attack scenario most likely served one of two purposes : the attackers covering their tracks after an espionage operation , or it was used directly for extortion or cyber-sabotage . Nevertheless, this case does highlight the types of tricks the bad guys are using in an attempt to deliver malware through . It also reveals direct links to secure[.]66[.]to and zhu[.]vn , both of which also belong to Hack520 and contains his personal blog .


What it does The surveillance functionality of Desert Scorpion resides in a second stage payload that can only be downloaded if the victim has downloaded , installed , and interacted with the first-stage chat application . Today we'd like to share some of our findings , and add something new to what 's currently common knowledge about Lazarus Group activities , and their connection to the much talked about February 2016 incident , when an unknown attacker attempted to steal up to $851M USD from Bangladesh Central Bank . SHIPPING_MX00034900_PL_INV_pdf.zip : 9474e1517c98d4165300a49612888d16643efbf6 . CrowdStrike incident responders found that renamed Plink and AnyDesk executable creation timestamps on affected backend Exchange servers were closely correlated with PowerShell execution events in the Remote PowerShell logs , indicating the threat actor leveraged the newly discovered exploit chain to drop other tooling for persistent access to the affected Exchange servers .


The chat application acts as a dropper for this second-stage payload app . Since the Bangladesh incident there have been just a few articles explaining the connection between Lazarus Group and the Bangladesh bank heist . Elfin : Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S . KillNet ’s targeting has consistently aligned with established and emerging Russian geopolitical priorities , which suggests that at least part of the influence component of this hacktivist activity is intended to directly promote Russia 's interests within perceived adversary nations vis - a - vis the invasion of Ukraine .


At the time of writing Lookout has observed two updates to the Dardesh application , the first on February 26 and the second on March 28 . However , from this it 's only clear that Lazarus might have attacked Polish banks . The Elfin espionage group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries . None The discovery was part of recent CrowdStrike Services investigations into several Play ransomware intrusions where the common entry vector was confirmed to be Microsoft Exchange .


The malicious capabilities observed in the second stage include the following : Upload attacker-specified files to C2 servers Get list of installed applications Get device metadata Inspect itself to get a list of launchable activities Retrieves PDF , txt , doc , xls , xlsx , ppt , pptx files found on external storage Send SMS Retrieve text messages Track device location Handle limited attacker commands via out of band text messages Record surrounding audio Record calls Record video Retrieve account information such as email addresses Retrieve contacts Removes copies of itself if Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers . The group , which first became active in late 2015 or early 2016 , specializes in scanning for vulnerable websites and using this to identify potential targets , either for attacks or creation of command and control ( C&C ) infrastructure . We judge that these operations are very likely aimed at stealing information and gaining persistent remote access .


any additional APKs are downloaded to external storage . Considering that the afterhack publications by the media mentioned that the investigation stumbled upon three different attackers , it was not obvious whether Lazarus was the one responsible for the fraudulent SWIFT transactions , or if Lazarus had in fact developed its own malware to attack banks ' systems . It has compromised a wide range of targets , including governments along with organizations in the research , chemical , engineering , manufacturing , consulting , finance , telecoms , and several other sectors . NuisanceDestruction intrinsic There are some that are intrinsically motivated to simply attack an organization or person for no other reason than to create chaos and destruction .


Call an attacker-specified number Uninstall apps Check if a device is rooted Hide its icon Retrieve list of files on external storage If running on a Huawei device it will attempt to add itself to the protected list of apps able to run with the screen off Encrypts some exfiltrated data Desert Scorpion 's second stage masquerades as a generic " settings '' application . We would like to add some strong facts that link some attacks on banks to Lazarus , and share some of our own findings as well as shed some light on the recent TTPs used by the attacker , including some yet unpublished details from the attack in Europe in 2017 . Elfin continues to be focused heavily on Saudi Arabia , which accounted for 42 percent of attacks observed by Symantec since the beginning of 2016 . Tortoiseshell Facebook Attack Campaign