Figure 26 : “ Agent Smith ” Campaign timeline Greater “ Agent Smith ” Campaign Discovery Orchestrating a successful 9Apps centric malware campaign , the actor behind “ Agent Smith ” established solid strategies in malware proliferation and payload delivery . We also believe that both clusters of activity have links to attacks with likely Indian origins , the CONFUCIUS_A attacks are linked to the use of SNEEPY/BYEBYESHELL and the CONFUCIUS_B have a loose link to Hangover . Dexphot : 537d7fe3b426827e40bbdd1d127ddb59effe1e9b3c160804df8922f92e0b366e . To me , simply asking critical infrastructure to consider these factors as part of their normal processes seems like a non - issue , but the U.S. Appeals Court has put a hold on this rule for the time being ( though it did n’t give a precise reason at the time of its ruling ) .


The actor also built solid backend infrastructures which can handle high volume concurrent requests . The two malware families themselves are also very similar , and therefore we think that the shared technique is an indication of a single developer , or development company , behind both CONFUCIUS_A and CONFUCIUS_B . Dexphot : 504cc403e0b83233f8d20c0c86b0611facc040b868964b4afbda3214a2c8e1c5 . Two leading Republican members of the U.S. House came out hours after the Biden administration released the roadmap , saying they would use their respective House panels to , “ exercise strict oversight on CISA ’s efforts ” to implement many of the policies outlined .


During our extended threat hunting , we uncovered 11 apps on the Google Play store that contain a malicious yet dormant SDK related to “ Agent Smith ” actor . In this blog post , we discussed two separate malware variations that behave in very similar ways and use similar techniques to acquire a C2 address , with both using Yahoo Answers and Quora to evade traditional mechanisms for blocking command and control domains . Dexphot : aa5c56fe01af091f07c56ac7cbd240948ea6482b6146e0d3848d450977dff152 . Regardless of which side of the political spectrum you fall , cybersecurity should be something our lawmakers can all agree on .


This discovery indicates the actor ’ s ambition in expanding operations into Google Play store with previous success experience from the main “ Agent Smith ” campaign . The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio . RevengeHotels : cybercrime targeting hotel front desks worldwide . Say these arguments extend through the 2024 election — what happens if control of the White House or Congress switches between parties ?


Instead of embedding core malware payload in droppers , the actor switches to a more low-key SDK approach . Confucius' backdoors are delivered through Office documents exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 . RevengeHotels is a targeted cybercrime malware campaign against hotels , hostels , hospitality and tourism companies , mainly , but not exclusively , located in Brazil . Our researchers recently discovered a threat actor conducting several campaigns against government entities , military organizations and civilian users in Ukraine and Poland .


In the dangerous module lies a kill switch logic which looks for the keyword “ infect ” . We dove deeper into Confucius' operations—namely , the malware-ridden documents , backdoors , and file stealers they use in their campaigns . We have confirmed more than 20 hotels that are victims of the group , located in eight states in Brazil , but also in other countries such as Argentina , Bolivia , Chile , Costa Rica , France , Italy , Mexico , Portugal , Spain , Thailand and Turkey . Our recent reporting states that these operations are very likely aimed at stealing information and gaining persistent remote access .


Once the keyword is present , the SDK will switch from innocent ads server to malicious payload delivery ones . The sctrls backdoor we came across is delivered via RTF files exploiting CVE-2015-1641 . The goal of the campaign is to capture credit card data from guests and travelers stored in hotel systems , as well as credit card data received from popular online travel agencies ( OTAs ) such as Booking.com . The final payloads include the AgentTesla remote access trojan ( RAT ) , Cobalt Strike beacons and njRAT .


Hence , we name this new spin-off campaign as Jaguar Kill Switch . The documents that exploit CVE2017-11882 download another payload — an HTML Application ( HTA ) file toting a malicious Visual Basic ( VBS ) script — from the server , which is executed accordingly by the command-line tool mshta.exe . The main attack vector is via email with crafted Word , Excel or PDF documents attached . If you ’re a user in Ukraine or Poland , especially someone working in the government or military sectors , this is a clear - cut example of a spam campaign targeting this population .


The below code snippet is currently isolated and dormant . In August 2015 a new incident related to the Corkow ( Metel ) Trojan was detected . Some of them exploit CVE-2017-0199 , loading it using VBS and PowerShell scripts and then installing customized versions of RevengeRAT , NjRAT , NanoCoreRAT , 888 RAT and other custom malware such as ProCC in the victim ’s machine . For those who fall outside of that demographic , it ’s interesting that this group is still relying on the user enabling macros in Office , since Microsoft disabled those by default earlier this year .


In the future , it will be invoked by malicious SDK during banner ads display . Corkow provided remote access to the ITS-Broker system terminal by 《 Platforma soft 》 Ltd , which enabled the fraud to be committed . The group has been active since 2015 , but increased its attacks in 2019 . These are also highly targeted emails with ( relatively speaking ) convincing lures , so whoever is behind these is not to be ignored .


Figure 26 : the kill switch code snippet Evidence implies that the “ Agent Smith ” actor is currently laying the groundwork , increasing its Google Play penetration rate and waiting for the right timing to kick off attacks . According to our statistics , as of the beginning of 2015 this botnet encompassed over 250 000 infected devices worldwide including infecting more than 100 financial institutions with 80% of them from the top 20 list . In our research , we were also able to track two groups targeting the hospitality sector , using separate but similar infrastructure , tools and techniques . There are multiple Cisco Secure protections in place to defend against the types of spam used in these campaigns .


By the time of this publication , two Jaguar Kill Switch infected app has reached 10 million downloads while others are still in their early stages . The interest among hackers in targeting trading systems is expected to grow . PaloAlto has already written about one of them . Other Snort rules and detection content can prevent the execution of the malware used as the final payload .


Check Point Research reported these dangerous apps to Google upon discovery . Russian-speaking hackers are believed to be responsible for these attacks and used the Corkow Trojan . We named the first group RevengeHotels , and the second ProCC . Chinese state - sponsored actors reportedly accessed email accounts belonging to several U.S.-based organizations and federal government agencies , including the State Department .


Currently , all bespoke apps have been taken down from the Google Play store . Hackers target primarily companies in Russia and CIS countries , though it is noticed that the amount of attacks targeting the USA has increased 5 times since 2011 . These groups use a lot of social engineering in their attacks , asking for a quote from what appears to be a government entity or private company wanting to make a reservation for a large number of people . The U.S. Cybersecurity and Infrastructure Security Agency ( CISA ) released a detailed timeline on the campaign , stating that an investigation from Microsoft revealed that “ advanced persistent threat ( APT ) actors accessed and exfiltrated unclassified Exchange Online Outlook data ” after users reported suspicious activities in their Microsoft 365 cloud environment .


Figure 28 : Jaguar Kill Switch infected GP apps Peek Into the Actor Based on all of the above , we connected “ Agent Smith ” campaign to a Chinese internet company located in Guangzhou whose front end legitimate business is to help Chinese Android developers publish and promote their apps on overseas platforms . One of the first botnets specializing in targeting the trading software called Quik was " Ranbyus " , created in 2012 . Their infrastructure also relies on the use of dynamic DNS services pointing to commercial hosting and self-hosted servers . While the full scope of the hack is still under investigation , reports indicate that the actors were primarily trying to steal sensitive information .


Various recruitment posts on Chinese job sites and Chinese National Enterprise Credit Information Public System ( NECIPS ) data led us one step further , linking the actor to its legal entity name . As of the Group-IB investigation of this malware program in March 2015 , Corkow v.7.118.1.1 had not been detected by a single antivirus program . They also sell credentials from the affected systems , allowing other cybercriminals to have remote access to hotel front desks infected by the campaign . While CISA or Microsoft have yet to disclose any specific vulnerabilities the actors exploited , the CISA report does say that the APT used a Microsoft account consumer key to forge tokens and impersonate targeted users .


Interestingly , we uncovered several expired job posting of Android reverse engineer from the actor ’ s front business published in 2018 and 2019 . Hackers gained access to a computer in the trading system in September 2014 . We monitored the activities of these groups and the new malware they are creating for over a year . “ Microsoft remediated the issue by first blocking tokens issued with the acquired key and then replacing the key to prevent continued misuse , ” the report states .


It seems that the people who filled these roles are key to “ Agent Smith ’ s success , yet not quite necessary for actor ’ s legitimate side of business . Starting in December 2014 , the criminal group began running keyloggers in the infected system . With a high degree of confidence , we can confirm that at least two distinct groups are focused on attacking this sector ; there is also a third group , though it is unclear if its focus is solely on this sector or if carries out other types of attacks . ( CISA , CNN )


With a better understanding of the “ Agent Smith ” actor than we had in the initial phase of campaign hunting , we examined the list of target innocent apps once again and discovered the actor ’ s unusual practices in choosing targets . To spread the Corkow malware criminals use a drive-by downloads method , when victims are infected while visiting compromised legitimate websites . One of the tactics used in operations by these groups is highly targeted spear-phishing messages . Popular tax preparation software companies are under fire from lawmakers for allegedly sharing personal information with social media sites , including Google and Meta .


It seems , “ Agent Smith ” prey list does not only have popular yet Janus vulnerable apps to ensure high proliferation , but also contain competitor apps of actor ’ s legitimate business arm to suppress competition . Group-IB specialists detected various sites used by criminals to spread the Trojan : mail tracking websites , news portals , electronic books , computer graphics resources , music portals , etc . They register typo-squatting domains , impersonating legitimate companies . Several Democratic lawmakers released a report last week that accused TaxAct , H&R Block and TaxSlayer of embedding Meta and Google ’s tracking pixels on their sites , potentially violating U.S. law and sharing taxpayers ’ information with those companies .


Conclusion Although the actor behind “ Agent Smith ” decided to make their illegally acquired profit by exploiting the use of ads , another actor could easily take a more intrusive and harmful route . Hackers use the exploits " Nitris Exploit Kit " ( earlier known as CottonCastle ) , which is not available in open sources and sold only to trusted users . The emails are well written , with an abundance of detail . The report says the data was kept anonymous , but the companies could “ easily ” use the information to identify individuals or create targeted advertising for them .


With the ability to hide its icon from the launcher and hijack popular existing apps on a device , there are endless possibilities to harm a user ’ s digital even physical security . Group-IB Bot-trek TDS sensors are in place at a number of financial institutions and , unfortunately , we register that currently Corkow malware is present on 80% of protected corporate systems . They explain why the company has chosen to book that particular hotel . ( Vox , USA Today )


Today this malware shows unwanted ads , tomorrow it could steal sensitive information ; from private messages to banking credentials and much more . Considering the Trojan delivery method and through our analysis of infections on banks' networks , we can confirm that all infections were conducted on a random basis . By checking the sender information , it ’s possible to determine whether the company actually exists . Apple had to roll back and then re - release a security update that addressed an actively exploited vulnerability in WebKit .


The “ Agent Smith ” campaign serves as a sharp reminder that effort from system developers alone is not enough to build a secure Android eco-system . According to statistics , Corkow primarily targets users in Russia and the CIS , but it is worth noting that in 2014 the amount of attacks targeting the USA increased by 5 times , in comparison with 2011 . However , there is a small difference between the domain used to send the email and the real one . Apple initially released a Rapid Security Response patch for iPhones and iPads on July 11 to fix CVE-2023 - 37450 , a remote code execution vulnerability in the WebKit browser engine that Safari and other web browsers use .


It requires attention and action from system developers , device manufacturers , app developers , and users , so that vulnerability fixes are patched , distributed , adopted and installed in time . Moreover , the number of Corkow incidents detected in Q1 2015 in the United States exceeds the number of those in the CIS countries . This spear-phishing message , written in Portuguese , has a malicious file attached misusing the name of a real attorney office , while the domain sender of the message was registered one day before , using a typo-squatting domain . However , users reported that the fix was causing Safari to not connect correctly to major websites like Facebook , Instagram and Zoom , leading Apple to pull back the patch .


It is also another example for why organizations and consumers alike should have an advanced mobile threat prevention solution installed on the device to protect themselves against the possibility of unknowingly installing malicious apps , even from trusted app stores . Moreover , the number of Corkow incidents detected in Q1 2015 in the United States exceeds the number of those in the CIS countries . The group goes further in its social engineering effort : to convince the hotel personnel about the legitimacy of their request , a copy of the National Registry of Legal Entities card ( CNPJ ) is attached to the quotation . Since then , Apple released a new fix for iOS , iPadOS and macOS that reliably fixes the vulnerability again .


Dvmap : the first Android malware with code injection 08 JUN 2017 In April 2017 we started observing new rooting malware being distributed through the Google Play Store . Hackers first actively spread bots using the Niteris exploit , and then search for infected devices at banks amongst their bots by analyzing IP addresses , cracked passwords and results of the modules performance . The attached file , Reserva Advogados Associados.docx ( Attorneys Associates Reservation.docx ) , is a malicious Word file that drops a remote OLE object via template injection to execute macro code . Though few details are currently available about CVE-2023 - 37450 , Apple indicated it had been exploited in the wild and could be triggered by a vulnerable browser processing specially crafted web content .


Unlike other rooting malware , this Trojan not only installs its modules into the system , it also injects malicious code into the system runtime libraries . In addition to the legitimate AmmyAdmin tool , the hackers used Visconti Backdoor developed based on legitimate RMS ( remote manipulator system ) software . The macro code inside the remote OLE document contains PowerShell commands that download and execute the final payload . ( Forbes , Gizmodo ) • Vulnerability Roundup : Memory corruption vulnerability in Microsoft Edge ; MilesightVPN and router could be taken over • Malicious Microsoft Drivers Could Number in the Thousands : Cisco Talos • New Threat Actor Launches Cyber - attacks on Ukraine and Poland •


Kaspersky Lab products detect it as Trojan.AndroidOS.Dvmap.a . If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs . In the RevengeHotels campaign , the downloaded files are .NET binaries protected with the Yoda Obfuscator . Uncovering weaknesses in Apple macOS and VMWare vCenter : 12 vulnerabilities in RPC implementation •


The distribution of rooting malware through Google Play is not a new thing . To obtain logins and passwords they applied keyloggers built into Corkow , as well as a commonly used feature of Mimikatz , dumping clear text Windows credentials from LSA . After unpacking them , the code is recognizable as the commercial RAT RevengeRAT . Talos Takes Ep .


For example , the Ztorg Trojan has been uploaded to Google Play almost 100 times since September 2016 . Hackers used the remote access to detect servers of their interest in the internal network . An additional module written by the group called ScreenBooking is used to capture credit card data . # 147 : The dangers of " Mercenary " groups and the spyware they create Upcoming events where you can find Talos “ Most prevalent malware files ” is taking a break this week for maintenance .


But Dvmap is very special rooting malware . In 2015 , the Metel gang began to target banks and financial institutions directly . It monitors whether the user is browsing the web page . On December 17th , the Ukrainian capital Kiev was hit by a blackout .


It uses a variety of new techniques , but the most interesting thing is that it injects malicious code into the system libraries – libdmv.so or libandroid_runtime.so . Metel is a banking Trojan ( also known as Corkow ) discovered in 2011 when it was used to attack users of online banking services . In the initial versions , back in 2016 , the downloaded files from RevengeHotels campaigns were divided into two modules : a backdoor and a module to capture screenshots . Local investigators later confirmed that the energy outage was caused by a cyberattack .


This makes Dvmap the first Android malware that injects malicious code into the system libraries in runtime , and it has been downloaded from the Google Play Store more than 50,000 times . After the infection stage , criminals move laterally with the help of legitimate and pentesting tools , stealing passwords from their initial victims ( entry point ) to gain access to the computers within the organization that have access to money transactions . Recently we noticed that these modules had been merged into a single backdoor module able to collect data from clipboard and capture screenshots . Shortly thereafter , ESET ® researchers analyzed a sophisticated new malware , which is the main suspect in this case .


Kaspersky Lab reported the Trojan to Google , and it has now been removed from the store . With this level of access , the gang has been able to pull off a clever trick by automating the rollback of ATM transactions . In this example , the webpage that the attacker is monitoring is booking.com ( more specifically , the page containing the card details ) . They have named it Industroyer – the biggest threat to Industrial Control Systems ( ICS ) since Stuxnet .


To bypass Google Play Store security checks , the malware creators used a very interesting method : they uploaded a clean app to the store at the end of March , 2017 , and would then update it with a malicious version for short period of time . COVELLITE operates globally with targets primarily in Europe , East Asia , and North America . The code is specifically looking for data in Portuguese and English , allowing the attackers to steal credit card data from web pages written in these languages . This dangerous malware was developed to exploit weaknesses in those systems and the communication protocols they use – systems developed decades ago with almost no security measures .


Usually they would upload a clean version back on Google Play the very same day . US targets emerged in September 2017 with a small , targeted phishing campaign directed at select U.S. electric companies . In the ProCC campaigns , the downloaded files are Delphi binaries . Adversaries may manipulate physical process control within the industrial environment .


They did this at least 5 times between 18 April and 15 May . LAZARUS GROUP is responsible for attacks ranging from the 2014 attack on Sony Pictures to a number of Bitcoin heists in 2017 . The backdoor installed in the machine is more customized than that used by RevengeHotels : it ’s developed from scratch and is able to collect data from the clipboard and printer spooler , and capture screenshots . Methods of manipulating control can include changes to set point values , tags , or other parameters .


All the malicious Dvmap apps had the same functionality . Technical analysis of COVELLITE malware indicates an evolution from known LAZARUS toolkits . Because the personnel in charge of confirming reservations usually need to pull credit card data from OTA websites , it ’s possible to collect card numbers by monitoring the clipboard and the documents sent to the printer . Adversaries may manipulate control systems devices or possibly leverage their own , to communicate with and command physical control processes .


They decrypt several archive files from the assets folder of the installation package , and launch an executable file from them with the name “ start. ” The interesting thing is that the Trojan supports even the 64-bit version of Android , which is very rare . COVELLITE remains active but appears to have abandoned North American targets , with indications of activity in Europe and East Asia . According to the relevant underground forums and messaging groups , these criminals also infect front desk machines in order to capture credentials from the hotel administration software ; they can then steal credit card details from it too . The duration of manipulation may be temporary or longer sustained , depending on operator detection .


All encrypted archives can be divided into two groups : the first comprises Game321.res , Game322.res , Game323.res and Game642.res – and these are used in the initial phase of infection , while the second group : Game324.res and Game644.res , are used in the main phase . Given the group 's specific interest in infrastructure operations , rapidly improving capabilities , and history of aggressive targeting , Dragos considers this group a primary threat to the ICS industry . Some criminals also sell remote access to these systems , acting as a concierge for other cybercriminals by giving them permanent access to steal new data by themselves . A Polish student used a remote controller device to interface with the Lodz city tram system in Poland .


Initial phase During this phase , the Trojan tries to gain root rights on the device and to install some modules . Delivering a backdoor and spyware , this campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video . Some Brazilian criminals tout credit card data extracted from a hotel ’s system as high quality and reliable because it was extracted from a trusted source , i.e. , a hotel administration system . Using this remote , the student was able to capture and replay legitimate tram signals .


All archives from this phase contain the same files except for one called “ common ” . Lookout researchers have discovered a new mobile surveillanceware family , FrozenCell . The majority of the victims are associated with the hospitality sector . As a consequence , four trams were derailed and twelve people injured due to resulting emergency stops .


This is a local root exploit pack , and the Trojan uses 4 different exploit pack files , 3 for 32-bit systems and 1 for 64-bit-systems . The threat is likely targeting employees of various Palestinian government agencies , security services , Palestinian students , and those affiliated with the Fatah political party . Based on the routines used , we estimate that this attack has a global reach . The track controlling commands issued may have also resulted in tram collisions , a further risk to those on board and nearby the areas of impact .


If these files successfully gain root rights , the Trojan will install several tools into the system . Delivering a backdoor and spyware , Desert Falcons 's campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video . Based on data extracted from Bit.ly statistics , we can see that potential victims from many other countries have at least accessed the malicious link . On Feb 12th 2013 , FireEye announced the discovery of an Adobe Reader 0 - day exploit which is used to drop a previously unknown , advanced piece of malware .


It will also install the malicious app “ com.qualcmm.timeservices. ” These archives contain the file “ .root.sh ” which has some comments in Chinese : Main phase In this phase , the Trojan launches the “ start ” file from Game324.res or Game644.res . FrozenCell is the mobile component of a multi-platform attack we've seen a threat actor known as " Two-tailed Scorpion/APT-C-23 " , use to spy on victims through compromised mobile devices and desktops . This data suggests that the number of countries with potential victims is higher than our telemetry has registered . We called this new malware ?


It will check the version of Android installed and decide which library should be patched . This threat is another proof point that attackers are clearly incorporating the mobile device into their surveillance campaigns as a primary attack vector . RevengeHotels is a campaign that has been active since at least 2015 , revealing different groups using traditional RAT malware to infect businesses in the hospitality sector . ItaDuke because it reminded us of Duqu and because of the ancient Italian comments in the shellcode copied from Dante Alighieri - s ? Divine Comedy .


For Android 4.4.4 and older , the Trojan will patch method _Z30dvmHeapSourceStartupBeforeForkv from libdvm.so , and for Android 5 and newer it will patch method nativeForkAndSpecialize from libandroid_runtime.so . Desert Falcons is keenly aware of the information they can derive from these devices and are using multi-stage ( phishing + an executable ) , multi-platform ( Android + desktop ) attacks to accomplish their spying . While there is a marked interest in Brazilian victims , our telemetry shows that their reach has extended to other countries in Latin America and beyond . Since the original announcement , we have observed several new attacks using the same exploit ( CVE-2013 - 0640 ) which drop other malware .


Both of these libraries are runtime libraries related to Dalvik and ART runtime environments . FrozenCell masquerades as fake updates to chat applications like Facebook , WhatsApp , Messenger , LINE , and LoveChat . The use of spear-phishing emails , malicious documents and RAT malware is yielding significant results for at least two groups we have identified in this campaign . Together with our partner CrySyS Lab , we - ve performed a detailed analysis of these unusual incidents which suggest a new , previously unknown threat actor .


Before patching , the Trojan will backup the original library with a name bak_ { original name } . For example , the actors behind FrozenCell used a spoofed app called Tawjihi 2016 , which Jordanian or Palestinian students would ordinarily use during their general secondary examination . Other threat actors may also be part of this wave of attacks , though there is no confirmation at the current time . For the CrySyS Lab analysis , please read [ here ] .


During patching , the Trojan will overwrite the existing code with malicious code so that all it can do is execute /system/bin/ip . It appears the Desert Falcons sent malicious executables though phishing campaigns impersonating individuals associated with the Palestinian Security Services , the General Directorate of Civil Defence - Ministry of the Interior , and the 7th Fateh Conference of the Palestinian National Liberation Front ( held in late 2016 ) . If you want to be a savvy and safe traveler , it ’s highly recommended to use a virtual payment card for reservations made via OTAs , as these cards normally expire after one charge . The MiniDuke attackers are still active at this time and have created malware as recently as February 20 , 2013 .


This could be very dangerous and cause some devices to crash following the overwrite . The titles and contents of these files suggest that the actor targeted individuals affiliated with these government agencies and the Fatah political party . While paying for your reservation or checking out at a hotel , it ’s a good idea to use a virtual wallet such as Apple Pay , Google Pay , etc . To compromise the victims , the attackers used extremely effective social engineering techniques which involved sending malicious PDF documents to their targets .


Then the Trojan will put the patched library back into the system directory . We believe that this is a new variant of VAMP , indicating that the threat actors behind APT-C-23 are still active and continuously improving their product . RevengeHotels : 74440d5d0e6ae9b9a03d06dd61718f66 . The PDFs were highly relevant and well - crafted content that fabricated human rights seminar information ( ASEM ) and Ukraine - s foreign policy and NATO membership plans .


After that , the Trojan will replace the original /system/bin/ip with a malicious one from the archive ( Game324.res or Game644.res ) . VAMP targeted various types of data from the phones of victims : images , text messages , contacts , and call history , among others . RevengeHotels : e675bdf6557350a02f15c14f386fcc47 . These malicious PDF files were rigged with exploits attacking Adobe Reader versions 9 , 10 and 11 , bypassing its sandbox .


In doing so , the Trojan can be sure that its malicious module will be executed with system rights . Recently , Trend Micro researchers came across a new mobile malware family which we have called GnatSpy . RevengeHotels : df632e25c32e8f8ad75ed3c50dd1cd47 . Once the system is exploited , a very small downloader is dropped onto the victim - s disc that - s only 20 KB in size .


But the malicious ip file does not contain any methods from the original ip file . On Nov. 27 , 2018 , Cisco 's Talos research division published a write-up outlining the contours of a sophisticated cyber espionage campaign it dubbed DNSpionage . RevengeHotels : a089efd7dd9180f9b726594bb6cf81ae . This downloader is unique per system and contains a customized backdoor written in Assembler .


This means that all apps that were using this file will lose some functionality or even start crashing . Talos said the perpetrators of DNSpionage were able to steal email and other login credentials from a number of government and private sector entities in Lebanon and the United Arab Emirates by hijacking the DNS servers for these targets , so that all email and virtual private networking ( VPN ) traffic was redirected to an Internet address controlled by the attackers . RevengeHotels : 81701c891a1766c51c74bcfaf285854b . When loaded at system boot , the downloader uses a set of mathematical calculations to determine the computer - s unique fingerprint , and in turn uses this data to uniquely encrypt its communications later .


Malicious module “ ip ” This file will be executed by the patched system library . Talos reported that these DNS hijacks also paved the way for the attackers to obtain SSL encryption certificates for the targeted domains ( e.g.webmail.finance.gov.lb ) , which allowed them to decrypt the intercepted email and VPN credentials and view them in plain text . APT1 . If the target system meets the pre - defined requirements , the malware will use Twitter ( unbeknownst to the user ) and start looking for specific tweets from pre - made accounts .


It can turn off “ VerifyApps ” and enable the installation of apps from 3rd party stores by changing system settings . That changed on Jan. 25 , 2019 , when security firm CrowdStrike published a blog post listing virtually every Internet address known to be ( ab )used by the espionage campaign to date . Since 2004 , Mandiant has investigated computer security breaches at hundreds of organizations around the world.The majority of these security breaches are attributed to advanced threat actors referred to as the “ Advanced Persistent Threat ” ( APT ) . These accounts were created by MiniDuke - s Command and Control ( C2 ) operators and the tweets maintain specific tags labeling encrypted URLs for the backdoors .


Furthermore , it can grant the “ com.qualcmm.timeservices ” app Device Administrator rights without any interaction with the user , just by running commands . Working backwards from each Internet address , I was able to see that in the last few months of 2018 the hackers behind DNSpionage succeeded in compromising key components of DNS infrastructure for more than 50 Middle Eastern companies and government agencies , including targets in Albania , Cyprus , Egypt , Iraq , Jordan , Kuwait , Lebanon , Libya , Saudi Arabia and the United Arab Emirates . We first published details about the APT in our January 2010 M-Trends report . These URLs provide access to the C2s , which then provide potential commands and encrypted transfers of additional backdoors onto the system via GIF files .


It is a very unusual way to get Device Administrator rights . PCH is a nonprofit entity based in northern California that also manages significant amounts of the world 's DNS infrastructure , particularly the DNS for more than 500 top-level domains and a number of the Middle East top-level domains targeted by DNSpionage . As we stated in there port , our position was that “ The Chinese government may authorize this activity , but there ’s no way to determine the extent of its involvement. ” Now , three years later , we have the evidence required to change our assessment . • Based on the analysis , it appears that the MiniDuke - s creators provide a dynamic backup system that also can fly under the radar – if Twitter isn - t working or the accounts are down , the malware can use Google Search to find the encrypted strings to the next C2 .


Malicious app com.qualcmm.timeservices As I mentioned before , in the “ initial phase ” , the Trojan will install the “ com.qualcmm.timeservices ” app . This APT group usually carries out target attacks against government agencies to steal sensitive information . The details we have analyzed during hundreds of investigations convince us that the groups conducting these activities are based primarily in China and that the Chinese Government is aware of them . This model is flexible and enables the operators to constantly change how their backdoors retrieve further commands or malcode as needed .


Its main purpose is to download archives and execute the “ start ” binary from them . In addition to spreading malware via spear fishing email with Office attachment containing either vulnerability or malicious macro , this group is particularly good at leveraging malicious Android APKs in the target attacks . Mandiant continues to track dozens of APT groups around the world ; however , this report is focused on the most prolific of these groups . Once the infected system locates the C2 , it receives encrypted backdoors that are obfuscated within GIF files and disguised as pictures that appear on a victim - s machine .


During the investigation , this app was able to successfully connect to the command and control server , but it received no commands . We named the actor DustSquad and have provided private intelligence reports to our customers on four of their campaigns involving custom Android and Windows malware . We refer to this group as “ APT1 ” and it is one of more than 20 APT groups with origins inChina . Once they are downloaded to the machine , they can fetch a larger backdoor which carries out the cyberespionage activities , through functions such as copy file , move file , remove file , make directory , kill process and of course , download and execute new malware and lateral movement tools .


So I don ’ t know what kind of files will be executed , but they could be malicious or advertising files . In this blogpost we cover a malicious program for Windows called Octopus that mostly targets diplomatic entities . APT1 is a single organization of operators that has conducted a cyber espionage campaign against a broad range of victims since at least 2006 . The final stage backdoor connects to two servers , one in Panama and one in Turkey to receive the instructions from the attackers .


Conclusions This Trojan was distributed through the Google Play Store and uses a number of very dangerous techniques , including patching system libraries . We also started monitoring the malware and , using Kaspersky Attribution Engine based on similarity algorithms , discovered that Octopus is related to DustSquad , something we reported in April 2018 . From our observations , it is one of the most prolific cyber espionage groups in terms of the sheer quantity of information stolen . The attackers left a small clue in the code , in the form of the number 666 ( 0x29A hex ) before one of the decryption subroutines : • By analysing the logs from the command servers , we have observed 59 unique victims in 23 countries : For the detailed analysis and information on how to protect against the attack , please read :


It installs malicious modules with different functionality into the system . From early 2014 until December 2018 , ns0.idm.net.lb pointed to 194.126.10.18 , which appropriately enough is an Internet address based in Lebanon . The scale and impact of APT1 ’s operations compelled us to write this report . Together with our partner CrySyS Lab , we ’ve discovered two new , previously - unknown infection mechanisms for Miniduke .


It looks like its main purpose is to get into the system and execute downloaded files with root rights . Kaspersky Lab products detect the Octopus Trojan as Trojan.Win32.Octopus.gen . The activity we have directly observed likely represents only a small fraction of the cyber espionage that APT1 has conducted . These new infection vectors rely on Java and IE vulnerabilities to infect the victim ’s PC .


But I never received such files from their command and control server . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) . Though our visibility of APT1 ’s activities is incomplete , we have analyzed the group ’s intrusions against nearly 150 victims over seven years . While inspecting one of the C&C servers of Miniduke , we have found files that were not related to the C&C code , but seemed to be prepared for infecting visitors using web - based vulnerabilities .


These malicious modules report to the attackers about every step they are going to make . El Machete is one of these threats that was first publicly disclosed and named by Kaspersky here . From our unique vantage point responding to victims , we tracked APT1 back to four large networks in Shanghai , two of which are allocated directly to the Pudong New Area . The page hxxp://[c2_hostname]/groups / business - principles.html is used as an starting point for the attack .


So I think that the authors are still testing this malware , because they use some techniques which can break the infected devices . We've found that this group has continued to operate successfully , predominantly in Latin America , since 2014 . We uncovered a substantial amount of APT1 ’s attack infrastructure , command and control , and modus operandi ( tools , tactics , and procedures ) . It consists of two frames , one for loading the decoy web page from a legitimate website ( copied from http://www.albannagroup.com/business-principles.html ) , and another for performing malicious activities ( hxxp://[c2_hostname]/groups / sidebar.html )


But they already have a lot of infected users on whom to test their methods . All attackers simply moved to new C2 infrastructure , based largely around dynamic DNS domains , in addition to making minimal changes to the malware in order to evade signature-based detection . In an effort to underscore there are actual individuals behind the keyboard , Mandiant is revealing three personas we have attributed to APT1 . The second webpage , “ sidebar.html ” contains 88 lines , mostly JavaScript code , and works as a primitive exploit pack .


I hope that by uncovering this malware at such an early stage , we will be able to prevent a massive and dangerous attack when the attackers are ready to actively use their methods . In the case of Octopus , DustSquad used Delphi as their programming language of choice , which is unusual for such an actor . These operators , like soldiers , may merely be following orders given to them by others . Its code identifies the victim ’s browser and then serves one of two exploits .


MD5 43680D1914F28E14C90436E1D42984E2 20D4B9EB9377C499917C4D69BF4CCEBE First widely distributed Android bootkit Malware infects more than 350,000 Devices January 29 , 2014 In the last quarter of 2013 , sale of a Smartphone with ANDROID operating system has increased and every second person you see is a DROID user . Targets included a wide array of high-profile entities , including intelligence services , military , utility providers ( telecommunications and power ) , embassies , and government institutions . Our analysis has led us to conclude that APT1 is likely government-sponsored and one of the most persistent of China ’s cyber threat actors . It also sends collected browser data to another script by sending a POST request to “ hxxp://[c2_hostname]/groups / count / write.php ” .


A Russian security firm 'Doctor Web ' identified the first mass distributed Android bootkit malware called 'Android.Oldboot ' , a piece of malware that 's designed to re-infect devices after reboot , even if you delete all working components of it . Some time ago , a Kaspersky Lab customer in Latin America contacted us to say he had visited China and suspected his machine was infected with an unknown , undetected malware . We believe that APT1 is able to wage such a long-running and extensive cyber espionage campaign in large part because it receives direct government support . The exploits are located in separate web pages .


The bootkit Android.Oldboot has infected more than 350,000 android users in China , Spain , Italy , Germany , Russia , Brazil , the USA and some Southeast Asian countries . It was a targeted attack we are calling " Machete " . In seeking to identify the organization behind this activity ,our research found that People ’s Liberation Army ( PLA ’s ) Unit 61398 is similar to APT1 in its mission , capabilities , and resources . Clients using Internet Explorer version 8 are served with “ about.htm ” , for other versions of the browser and for any other browser capable of running Java applets , the JavaScript code loads “ JavaApplet.html ” .


China seems to a mass victim of this kind of malware having a 92 % share . At first look , it pretends to be a Java related application but after a quick analysis , it was obvious this was something more than just a simple Java file . PLA Unit 61398 is also located in precisely the same area from which APT1 activity appears to originate . The web page “ JavaApplet.html ” loads “ JavaApplet.class ” that implements a Java exploit for the recently discovered vulnerability CVE-2013 - 0422 .


A Bootkit is a rootkit malware variant which infects the device at start-up and may encrypt disk or steal data , remove the application , open connection for Command and controller . " Machete " is a targeted attack campaign with Spanish speaking roots . APT1 is believed to be the 2nd Bureau of the People ’s Liberation Army ( PLA ) General Staff Department ’s ( GSD ) 3rd Department , which is most commonly known by its Military Unit Cover Designator ( MUCD ) as Unit 61398 . The code of the exploit is very similar to the one published in the Metasploit kit , but the inner class that disables the security manager is encoded differently , most likely to avoid detection .


A very unique technique is being used to inject this Trojan into an Android system where an attacker places a component of it into the boot partition of the file system and modify the 'init ' script ( initialize the operating system ) to re-load the malware as you switch on your android . The decoy slideshows all contain photos from very meaningful events to individuals in Thailand , suggesting that the actors continually look for impactful events to use to disguise their attacks . The nature of “ Unit 61398 ’s ” work is considered by China to be a state secret ; however , we believe it engages in harmful “ Computer Network Operations. ” Unit 61398 is partially situated on Datong Road in Gaoqiaozhen , which is located in the Pudong New Area of Shanghai . According to HTTP headers of the server , the applet was uploaded on February 11 , 2013 , one month after the Metasploit code was published and two days before Oracle issued a security alert regarding the vulnerability .


When you start your device , this script loads the Trojan 'imei_chk ' ( detects it as Android.Oldboot.1 ) which extract two files libgooglekernel.so ( Android.Oldboot.2 ) and GoogleKernel.apk ( Android.Oldboot.1.origin ) , copy them respectively in /system/lib and /system/app . In some cases , such as Russia , the target appears to be an embassy from one of the countries of this list . The central building in this compound is a 130,663 square foot facility that is 12 stories high and was built in early 2007 . It decodes the binary and writes it to a Java temporary directory with name “ ntuser.bin ” .


Android.Oldboot acts as a system service and connects to the command-and-controller server using libgooglekernel.so library and receives commands to download , remove installed apps , and install malicious apps . Both attackers and victims speak Spanish natively , as we see it consistently in the source code of the client side and in the Python code . APT1 has systematically stolen hundreds of terabytes of data from at least 141 organizations , and has demonstrated the capability and intent to steal from dozens of organizations simultaneously . Then , it copies the system file “ rundll32.exe ” to the same directory with name “ ntuser.exe ” and runs it with “ ntuser.bin ” as a parameter , effectively loading the malicious DLL file .


Since it becomes a part of the boot partition , formatting the device will not solve the problem . We are also grateful to the Private Office of his Holiness the Dalai Lama , the Tibetan Government-in-Exile , the missions of Tibet in London , Brussels , and New York , and Drewla ( a Tibetan NGO ) . Since 2006 , Mandiant has observed APT1 compromise 141 companies spanning 20 major industries . That DLL file is the main module of Miniduke , and it uses the URL http://twitter.com/TamicaCGerald to fetch commands .


The researchers believe that the devices somehow had the malware pre-loaded at the time of shipping from the manufacturer , or was likely distributed inside modified Android firmware . Between June 2008 and March 2009 the Information Warfare Monitor conducted an extensive and exhaustive two-phase investigation focused on allegations of Chinese cyber espionage against the Tibetan community . APT1 has a well-defined attack methodology , honed over years and designed to steal large volumes of valuable intellectual property . The web page “ about.htm ” implements an exploit for Microsoft Internet Explorer 8 .


So , users should beware of certain modified Android firmware . These instances of Gh0st RAT are consistently controlled from commercial Internet access accounts located on the island of Hainan , People's Republic of China . Once APT1 has established access , they periodically revisit the victim ’s network over several months or years and steal broad categories of intellectual property , including technology blueprints , proprietary manufacturing processes , test results , business plans , pricing documents , partnership agreements , and emails and contact lists from victim organizations ’ leadership . It uses a vulnerability discovered at the end December 2012 , CVE-2012 - 4792 .


Two weeks ago , Some Chinese Security Researchers have also detected a bootkit called 'Oldboot ' , possibly the same malware or another variant of it . The fieldwork generated extensive data that allowed us to examine Tibetan information security practices , as well as capture real-time evidence of malware that had penetrated Tibetan computer systems . APT1 uses some tools and techniques that we have not yet observed being used by other groups including two utilities designed to steal email — GETMAIL and MAPIGET . The code is also very similar to the Metasploit version of the exploit , while the payload part of the shellcode has been written by the Miniduke authors re - using the backdoor ’s code .


" Due to the special RAM disk feature of Android devices ' boot partition , all current mobile antivirus products in the world ca n't completely remove this Trojan or effectively repair the system . It is therefore possible that the large percentage of high value targets identified in our analysis of the GhostNet are coincidental , spread by contact between individuals who previously communicated through e-mail . Establishing a foothold involves actions that ensure control of the target network ’s systems from outside the network . The Metasploit code was released on December 29 , 2012 and the vulnerability was officialy fixed on January 14 , 2013 ( MS13 - 008 ) while the page with the exploit was uploaded on February 11 , 2013 .


'' " According to our statistics , as of today , there 're more than 500 , 000 Android devices infected by this bootkit in China in last six months . Where they exist , they often use grey market or pirated software . APT1 establishes a foothold once email recipients open a malicious file and a backdoor is subsequently installed . [ c2_hostname ] The purpose of the shellcode is to download a GIF image file from URL hxxp://[c2_hostname]/groups / pic.gif , then search for and decrypt the hidden PE file inside of it .


The Android malware Android.Oldboot is almost impossible to remove , not even with formatting your device . Contextually relevant emails are sent to specific targets with attached documents that are packed with exploit code and Trojan horse programmes designed to take advantage of vulnerabilities in software installed on the target 's computer . A backdoor is software that allows an intruder to send commands to the system remotely . The PE file also appeared to be a modification of the Miniduke 's main backdoor module that uses the same Twitter URL as the Java payload .


But if your device is not from a Chinese manufacturer , then chances that you are a victim of it , are very less . GhostNet represents a network of compromised computers resident in high-value political , economic , and media locations spread across numerous countries worldwide . In almost every case , APT backdoors initiate outbound connections to the intruder ’s “ command and control ” ( C2 ) server . We have discovered and analysed two previously unknown infector vectors that were used in the MiniDuke attacks .


This bootkit is not the first of this kind . After that , the attacker is capable to control the compromised device . APT intruders employ this tactic because while network firewalls are generally adept at keeping malware outside the network from initiating communication with systems inside the network , they are less reliable at keeping malware that is already inside the network from communicating to systems outside . As previously recommended , updating Windows , Java and Adobe Reader to the latest versions should provide a basic level of defense against the known Miniduke attacks .


Two years back , in the month of March we reported , NQ Mobile Security Research Center uncovered the world 's first Android bootkit malware called 'DKFBootKit ' , that replaces certain boot processes and can begin running even before the system is completely booted up . The computers of diplomats , military attachés , private assistants , secretaries to Prime Ministers , journalists and others are under the concealed control of unknown assailant (s ) . While APT1 intruders occasionally use publicly available backdoors such as Poison Ivy and Gh0st RAT , the vast majority of the time they use what appear to be their own custom backdoors . Researchers have uncovered an ongoing cyberespionage campaign targeting more than 30 online video game companies over the past four years .


But Android.Oldboot malware is a bit more dangerous because even if you remove all working components of it from your android successfully , the component imei_chk will persist in a protected boot memory area and hence will reinstall itself on next boot and continuously infect the Smartphone . The C&C server ( 82.137.255.56 ) used by the above backdoors was used by APT-C-27 ( Goldmouse ) many times since 2017 . We will describe APT1 ’s backdoors in two categories : “ Beachhead Backdoors ” and “ Standard Backdoors. ” The companies infected by the malware primarily market so - called massively multiplayer online role - playing games .


Users are recommended to install apps from authorized stores such as Google Play , disable installation of apps from 'Unknown Sources ' and for a better security install a reputed security application . According to 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor . Beachhead backdoors are typically minimally featured . They 're mostly located in South East Asia , but are also in the US , Germany , Japan , China , Russia , Brazil , Peru , and Belarus , according to a release published Thursday by researchers from antivirus provider Kaspersky Lab .


You can also try to re-flash your device with its original ROM . The banking malware GozNym has legs ; only a few weeks after the hybrid Trojan was discovered , it has reportedly spread into Europe and begun plaguing banking customers in Poland with redirection attacks . They offer the attacker a toe-hold to perform simple tasks like retrieve files , gather basic system information and trigger the execution of other more significant capabilities such as a standard backdoor . The attackers work from computers with Chinese and Korean language configurations .


After flashing , the bootkit will be removed . The APT group is reportedly targeting the Middle East region . APT1 ’s beachhead backdoors are usually what we call WEBC2 backdoors . They used their unauthorized access to obtain digital certificates that were later exploited in malware campaigns targeting other industries and political activists .


FrozenCell : Multi-Platform Surveillance Campaign Against Palestinians October 5 , 2017 FrozenCell has been seen masquerading as various well known social media and chat applications as well as an app likely only used by Palestinian or Jordanian students sitting their 2016 general exams . The malware has started targeting corporate , SMB , investment banking and consumer accounts at banks , including some in Portugal and the U.S. , in addition to Poland , according to researchers at IBM 's X-Force team . WEBC2 backdoors are probably the most well-known kind of APT1 backdoor , and are the reason why some security companies refer to APT1 as the “ Comment Crew. ” A WEBC2 backdoor is designed to retrieve a webpage from a C2 server . So far , there 's no evidence that customers of the infected game companies were targeted , although in at least one case , malicious code was accidentally installed on gamers ' computers by one of the infected victim companies .


Lookout researchers have discovered a new mobile surveillanceware family , FrozenCell . According to Kessem the malware has redirection instructions for 17 banks , and features an additional 230 URLs to assist attackers in targeting community banks and email service providers in Poland . It expects the webpage to contain special HTML tags ; the backdoor will attempt to interpret the data between the tags as commands . Kaspersky said there was another case of end users being infected by the malware , which is known as " Winnti . "


The threat is likely targeting employees of various Palestinian government agencies , security services , Palestinian students , and those affiliated with the Fatah political party . With GozNym , attackers dupe users by showing them the actual bank 's URL and SSL certificate . Older versions of WEBC2 read data between HTML comments , though over time WEBC2 variants have evolved to read data contained within other types of tags . " Having infected gaming companies that do business in MMORPG , the attackers potentially get access to millions of users , " the researchers wrote .


FrozenCell is the mobile component of a multi-platform attack we 've seen a threat actor known as " Two-tailed Scorpion/APT-C-23 , '' use to spy on victims through compromised mobile devices and desktops . Fresh from targeting banks in Poland , the banking Trojan GozNym has begun taking aim at banks in Germany . From direct observation , we can confirm that APT1 was using WEBC2 backdoors as early as July 2006 . " So far we do n't have data that the attackers stole from common users but we do have at least two incidents when Winnti malware had been planted on an online game update server and


The desktop components of this attack , previously discovered by Palo Alto Network , are known as KasperAgent and Micropsia . Attackers went on to use the Trojan to steal $4 million from 24 banks , including 22 in the United States and two in Canada , in just two weeks . However , the first compile time35 we have for WEBC2 is 2004-01-23 , suggesting that APT1 has been crafting WEBC2 backdoors since early 2004 . The samples we have observed seemed not to be malware targeted for the game fans but a malware module which accidentally got into [ the ] wrong place .


We discovered 561MB of exfiltrated data from 24 compromised Android devices while investigating this threat . Recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the GozNym group appears up to the task . Based on the 400+ samples of WEBC2 variants that we have accumulated , it appears that APT1 has direct access to developers who have continually released new WEBC2 variants for over six years . But a potential of attackers to misuse such access to infect hundreds of millions of Internet users creates a great risk . "


More data is appearing daily , leading us to believe the actors are still highly active . The malware is distributed primarily through laced spam emails that lure recipients into opening attachments . WEBC2 backdoors are often packaged with spear phishing emails . Digital certificates stolen in some of the heists have been used to sign malware that targeted Tibetan and Uyghur activists .


We are continuing to watch it closely . Kessem . Once installed , APT1 intruders have the option to tell victim systems to download and execute additional malicious software of their choice . The cryptographic certificates have also been exploited in attacks that have hit companies in the aerospace industry .


This threat is another proof point that attackers are clearly incorporating the mobile device into their surveillance campaigns as a primary attack vector . Fresh from targeting banks in Poland , the banking Trojan has reportedly begun taking aim at banks in Germany . WEBC2 backdoors work for their intended purpose , but they generally have fewer features than the “ Standard Backdoors ” described below . Attackers frequently abuse stolen certificates to prevent the malware they 're spreading from being detected by various security protections .


Government agencies and enterprises should look at this threat as an example of the kind of spying that is now possible given how ubiquitous mobile devices are in the workplace . Now GozNym is now targeting 13 banks and subsidiaries in Germany , Limor Kessem , Executive Security Advisor at IBM , said Tuesday . The standard , non-WEBC2 APT1 backdoor typically communicates using the HTTP protocol ( to blend in with legitimate web traffic ) or a custom protocol that the malware authors designed themselves . In addition to stealing digital certificates , the Winnti gang 's campaign appears to be motivated by the desire to manipulate in - game currency , such as " runes " or " gold , " that can in many cases be converted into real currency .


Attackers are keenly aware of the information they can derive from these devices and are using multi-stage ( phishing + an executable ) , multi-platform ( Android + desktop ) attacks to accomplish their spying . he Trojan , a hybrid of Nymaim and Gozi malware , initially formed in April and thrives on carrying out redirection attacks via DNS poisoning . These backdoors give APT intruders a laundry list of ways to control victim systems . The attackers may also want to use source code stolen from the game companies so it can be deployed in rogue servers offering pirated versions of the games .


All Lookout customers are protected from this threat . In April , shortly after the Trojan 's discovery , researchers observed a massive GozNym campaign targeting 24 North American banks . The BISCUIT backdoor ( so named for the command “ bdkzt ” ) is an illustrative example of the range of commands that APT1 has built into its “ standard ” backdoors . Kaspersky has more here .


What it does FrozenCell masquerades as fake updates to chat applications like Facebook , WhatsApp , Messenger , LINE , and LoveChat . The method , which technically redirects users through local DNS poisoning , requires a fair bit of work ; recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the group behind GozNym – Nymaim – appear up to the task . APT1 has used and steadily modified BISCUIT since as early as 2007 and continues to use it presently . Whether known as commodity malware or “ as - a - service , ” threat actors have long been turning to their fellow adversaries in the hopes of selling off their tools and opening a new stream of revenue .


We also detected it in apps targeted toward specific Middle Eastern demographics . Attackers behind Dyre have used similar tactics in the past but have only deployed their attacks in English speaking countries and Spain . Some APT backdoors attempt to mimic legitimate Internet traffic other than the HTTP protocol . The software is centrally hosted on that third - party company ’s servers .


For example , the actors behind FrozenCell used a spoofed app called Tawjihi 2016 , which Jordanian or Palestinian students would ordinarily use during their general secondary examination . When we last heard from the Trojan , its operators were seen launching redirection attacks on four large , U.S. banks in June . When network defenders see the communications between these backdoors and their C2 servers , they might easily dismiss them as legitimate network traffic . Think of cloud storage solutions like Dropbox or Plex , for example .


Once installed on a device FrozenCell is capable of : Recording calls Retrieving generic phone metadata ( e.g. , cell location , mobile country code , mobile network code ) Geolocating a device Extracting SMS messages Retrieving a victim 's accounts Exfiltrating images Downloading and installing additional applications Searching for and exfiltrating pdf , doc , docx , ppt , pptx , xls , and xlsx file types Retrieving contacts The graph below represents a split of the types of data The fact that the cybercriminals behind GozNym have already adapted the Trojan for three different languages and in countries which have different banking systems is unique , according to Kessem . APT1 . Threat actors have been using this business model for a decade - plus , originally known as commodity malware .


from only one misconfigured command and control server ( out of over 37 servers ) . By the end of April , GozNym had redirection instructions for 17 Polish banks in its repertoire , along with an extra 230 URLs designed to assist attackers in targeting community banks and email service providers in the Eastern European country . APT1 maintains an extensive infrastructure of computers around the world . This is when threat actors create a suite of malware tools and offer them up for sale on illicit websites .


This is only a small picture of the threat actor 's operations . Seeking to tease out any possible links between Operation Aurora , VOHO , Operation DeputyDog , and Ephemeral Hydra , we began with Symantec 's Hidden Lynx report as our foundation . We have evidence suggesting that APT1 manually controls thousands of systems in support of their attacks , and have directly observed their control over hundreds of these systems . It can range from asking “ customers ” to pay a monthly fee for access to this set of tools to use in cyber attacks , or users can even pay the original creators to distribute the malware on their behalf and manage the infection .


Split of exfiltrated data Some noteworthy files identified in content taken from compromised devices include passport photos , audio recordings of calls , other images , and a PDF document with data on 484 individuals . The authors of that report identify three primary tools used in the campaigns attributed to Hidden Lynx : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit . Although they control systems in dozens of countries , their attacks originate from four large networks in Shanghai — two of which are allocated directly to the Pudong New Area , the home of Unit 61398 . Recently , this model for threat actors has come to be known as the “ as - a - service " model , borrowing the term from the growing trend in the tech industry .


The PDF lists dates of birth , gender , passport numbers , and names . We will detail how the C&C infrastructure and tools used by hacker group Hidden Lynx during its VOHO campaign ( 2012 ) , excellently documented by Symantec researchers last September , overlap with tools used in other high profile operations during the past few years . The sheer number of APT1 IP addresses concentrated in these Shanghai ranges , coupled with Simplified Chinese keyboard layout settings on APT1 ’s attack systems , betrays the true location and language of the operators . Ransomware - as - a - service is a relatively new version of these commodity groups , such as DarkSide , known for the cyber attack in 2021 that disrupted the Colonial oil pipeline and made gas more expensive for thousands of U.S. consumers .


Potential targets The actors behind FrozenCell used an online service that geolocates mobile devices based on nearby cell towers to track targets . When the New York Times and Mandiant last year unmasked a large scale Chinese hacking operation , pinpointing its location down to the building , the report drew mainstream attention to what security professionals already well knew : sophisticated threat actors carry out persistent cyber operations over months and years . To help manage the vast number of systems they control , APT1 has registered hundreds of domain names , the majority of which also point to a Shanghai locale . But other bad actors have since adopted this businesses model , offering every from command and control servers to phishing bots - as - a - service .


This data shows a distinct concentration of infected devices beaconing from Gaza , Palestine . By the end of April , GozNym had redirection instructions for 17 Polish banks in its repertoire , along with an extra 230 URLs designed to assist attackers in targeting community banks and email service providers in the Eastern European country . The domain names and IP addresses together comprise APT1 ’s command and control framework which they manage in concert to camouflage their true origin from their English speaking targets . There are a few reasons why attackers may opt to pay for an as - a - service malware tool for their chosen campaign : • As - a - service saves attackers time .


Map of potential targets Early samples of FrozenCell used an online service for storing geolocation information of infected devices . Using Recorded Future , we quickly built a timeline of the reported use of those tools in major security incidents , finding many events prior to the early 2013 exposé on Hidden Lynx . As covered in the previous “ Attack Lifecycle ” section , WEBC2 backdoor variants download and interpret data stored between tags in HTML pages as commands . When they pay for someone else ’s malware kit , whether it be ransomware or a phishing bot , they do n’t have to invest time , money or labor to write their own malicious code or tools and instead can hop right into deploying the malware .


Analysis of this telemetry shows infected devices are completely based in Gaza , Palestine . In particular , FireEye during the fall of 2013 called out infrastructure overlap between Ephemeral Hydra and DeputyDog . They usually download HTML pages from a system within APT1 ’s hop infrastructure . For the actors and groups who originally created the malware , it is a more reliable income stream for them .


It has not been confirmed whether these are from test devices or the devices of victims . The above network shows relationships between three tools used by Hidden Lynx during its VOHO campaign : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit . We have observed APT1 intruders logging in to WEBC2 servers and manually editing the HTML pages that backdoors will download . Usually , they ’d have to hope a successful attack leads to a ransom payment or some sort of other financial windfall .


We were also able to link the FrozenCell 's Android infrastructure to numerous desktop samples that are part of the larger multi-platform attack . Symantec during 2012 linked the Elderwood Project to Operation Aurora ; Trojan.Naid and Backdoor.Moudoor were also used in Aurora , by the Elderwood Gang , and by Hidden Lynx . Because the commands are usually encoded and difficult to spell from memory , APT1 intruders typically do not type these strings , but instead copy and paste them into the HTML files . Instead , they can make money by marketing their services to other bad actors for a fee .


It appears the attackers sent malicious executables though phishing campaigns impersonating individuals associated with the Palestinian Security Services , the General Directorate of Civil Defence - Ministry of the Interior , and the 7th Fateh Conference of the Palestinian National Liberation Front ( held in late 2016 ) . In addition to these , we also identified " Macfog " , a native Mac OS X implementation of Icefog that infected several hundred victims worldwide . They likely generate the encoded commands on their own systems before pasting them in to an HTML file hosted by the hop point . • Bad actors who want to get into the cyber attack business need little to no technical skills to get started .


The titles and contents of these files suggest that the actor targeted individuals affiliated with these government agencies and the Fatah political party . Icefog , also known as the " Dagger Panda " by Crowdstrike 's naming convention , infected targets mainly in South Korea and Japan . For example , we observed an APT attacker pasting the string “ czo1NA== ” into an HTML page . When an attacker pays for an as - a - service malware , they often get an individual login with dedicated customer support , much like any user would with a legitimate piece of software .


Some malicious files associated with these samples were titled the following : Council_of_ministres_decision Minutes of the Geneva Meeting on Troops Summary of today 's meetings.doc.exe The most important points of meeting the memory of the late President Abu Omar may Allah have mercy on him - Paper No . In 2013 , a public report reveals a group of actors conducted targeted attacks leverage a malware dubbed ICEFOG against mainly government organizations and defense industry of South Korea and Japan . That string is the base64 encoded version of “ s : 54 ” , meaning “ sleep for 54 minutes ” ( or hours , depending on the particular backdoor ) . As Nick Biasini explained in a past episode of Talos Takes , name recognition also plays a major part in the rising popularity of this business model .


1 Fadi Alsalamin scandal with an Israeli officer - exclusive - watched before the deletion - Fadi Elsalameen The details of the assassination of President Arafat_06-12-2016_docx Quds.rar Many of these executables are associated with various short links created using Bit.ly , a URL shortening service . Similar to our approach with Symantec 's report on Hidden Lynx , we used Recorded Future to organize the technical details about the DeputyDog attacks to reveal technical information described in the open source reporting across multiple campaigns . In lieu of manually editing an HTML file on a hop point , we have also observed APT1 intruders uploading new ( already-edited ) HTML files . Lesser - known threat actors want to piggyback off having a big name associated with them , like DarkSide , to intimidate their actors or lend more credence to the effectiveness of their threats .


After analyzing the traffic associated with these short links , we determined that each one was associated with a referral path from mail.mosa.pna.ps . With Javafog , we are turning yet another page in the Icefog story by discovering another generation of backdoors used by the attackers . When APT1 attackers are not using WEBC2 , they require a “ command and control ” ( C2 ) user interface so they can issue commands to the backdoor . Cisco Talos researchers recently discovered Greatness , one of the most advanced phishing - as - a - service tools ever seen in the wild .


MOSA is the Palestinian Directorate of Social Development whose mandate is to achieve comprehensive development , social security , and economic growth for Palestinian families , according to publicly available information on this ministry . Since January 2013 , we've been on the lookout for a possible RedOctober comeback . This interface sometimes runs on their personal attack system , which is typically in Shanghai . Our analysis indicates that attackers may have been using attackers since mid-2022 .


Infrastructure At the time of writing the following domains have either been used by this family or are currently active . One possible hit was triggered when we observed Mevade , an unusual piece of malware that appeared late in 2013 . In these instances , when a victim backdoor makes contact with a hop , the communications need to be forwarded from the hop to the intruder ’s Shanghai system so the backdoor can talk to the C2 server software . Greatness offers the ability for users to bypass targets ’ multi - factor authentication protections , IP filtering and integration with Telegram bots .


We expect this list to grow given that this actor has changed its infrastructure numerous times in 2017 . In August 2014 , some of our users observed targeted attacks with a variation of CVE-2012-0158 and an unusual set of malware . We have observed 767 separate instances in which APT1 intruders used the publicly available “ HUC Packet Transmit Tool ” or HTRAN on a hop . Greatness incorporates features seen in some of the most advanced PaaS offerings , such as multi - factor authentication ( MFA ) bypass , IP filtering and integration with Telegram bots .


cecilia-gilbert [ . It wasn't until August 2014 that we observed something which made us wonder if RedOctober is back for good . As always , keep in mind that these uses are confirmed uses , and likely represent only a small fraction of APT1 ’s total activity . Greatness , for now , is only focused on Microsoft 365 phishing pages , providing its affiliates with an attachment and link builder that creates highly convincing decoy and login pages .


] comgooogel [ . The Cloud Atlas implants utilize a rather unusual C&C mechanism . The HTRAN utility is merely a middle-man , facilitating connections between the victim and the attacker who is using the hop point . It contains features such as having the victim ’s email address pre - filled and displaying their appropriate company logo and background image , extracted from the target organization ’s real Microsoft 365 login page .


] orgmary-crawley [ . We named it RedOctober because we started this investigation in October 2012 , an unusually hot month . Typical use of HTRAN is fairly simple : the attacker must specify the originating IP address ( of his or her workstation in Shanghai ) , and a port on which to accept connections . This makes Greatness particularly well - suited for phishing business users .


] commydriveweb [ . The attackers upload data to the account , which is downloaded by the implant , decrypted and interpreted . For example , the following command , which was issued by an APT1 actor , will listen for incoming connections on port 443 on the hop and automatically proxy them to the Shanghai IP address 58.247.242.254 on port 443 . Any Greatness affiliates do n’t need a specific set of skills .


] comrose-sturat [ . Just like with RedOctober , the top target of Cloud Atlas is Russia , followed closely by Kazakhstan , according to data from the Kaspersky Security Network ( KSN ) . Occasionally , APT1 attackers have installed C2 server components on systems in their hop infrastructure rather than forwarding connections back to C2 servers in Shanghai . All they need to do is deploy and configure the provided phishing kit with an API key .


] infokalisi [ . In May 2015 , Palo Alto Networks WildFire detected two e-mails carrying malicious documents from a genuine and compromised Israeli Gmail account , sent to an Israeli industrial organization . In these instances they do not need to use a proxy tool like HTRAN to interact with victim systems . If used successfully , the attacker can set up a proxy Microsoft 365 authentication system and steal a victim ’s authentication credentials or cookies with a “ man - in - the - middle " attack .


] xyzdebra-morgan [ . One e-mail carried a Microsoft PowerPoint file named " thanks.pps " ( VirusTotal ) , the other a Microsoft Word document named " request.docx " . However , it does mean that the intruders need to be able to interface with the ( often graphical ) C2 server software running on the hop . Greatness is specifically designed to work in a standardized way so that the experience is the same for each customer who buys into the service , potentially allowing anyone with a moderate amount of technical ability to carry out advanced , convincing phishing attacks .


] comarnani [ . Around the same time , WildFire also captured an e-mail containing a Word document ( " hello.docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient . We have observed APT1 intruders log in to their hop point , start the C2 server , wait for incoming connections , and then proceed to give commands to victim systems . Since as - a - service or commodity malware can include all types of malware , it can be tough to provide specific advice for detection and prevention .


] infoacount-manager [ . Attacks using this tool were still active as of April 2016 . WEBC2 variants may include a server component that provides a simple C2 interface to the intruder . For Greatness specifically , anyone implementing multi - factor authentication should opt for code - based authentication through their MFA app of choice , such as Cisco Duo , rather than the easier - to - break method of a simple “ yes ” or “ no ” push notification .


] infogooogel-drive [ . Considering the language being used in the malicious code is Arabic , it seems that the attacker is familiar with Arabic language as well . This saves the intruder from having to manually edit webpages . Adversaries may attempt to hide artifacts associated with their behaviors to evade detection .


] commediauploader [ . The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll . That is , this server component receives connections from victim backdoors , displays them to the intruder , and then translates the intruder ’s commands into HTML tags that the victim backdoors read . Operating systems may have features to hide various artifacts , such as important system files and administrative task execution , to avoid disrupting user work environments and prevent users from changing files or features on the system .


] meacount-manager [ . In this case , the file used the software name " Cyberlink " , and a description of " CLMediaLibrary Dynamic Link Library " and listing version 4.19.9.98 . In the last two years alone , we have confirmed 937 APT1 C2 servers — that is , actively listening or communicating programs — running on 849 distinct IP addresses . Adversaries may abuse these features to hide artifacts such as files , directories , user accounts , or other system activity to evade detection.[1][2][3 ]


] netupload404 [ . Unit 42 published a blog at the beginning of May titled " Prince of Persia " , in which we described the discovery of a decade-long campaign using a formerly unknown malware family , Infy , that targeted government and industry interests worldwide . However , we have evidence to suggest that APT1 is running hundreds , and likely thousands , of other servers ( see the Domains section below ) . Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation , such as through the use of virtualization technology.[4 ] Bundlore uses the mktemp utility to make unique file and directory names for payloads , such as TMP_DIR=`mktemp


] clubupload999 [ . We noted in our original blog the large amount of targeting of Iranian citizens in this campaign , we observed almost one-third of all victims to be Iranian . The programs acting as APT1 servers have mainly been : FTP , for transferring files ; web , primarily for WEBC2 ; RDP , for remote graphical control of a system ; HTRAN , for proxying ; and C2 servers associated with various backdoor families . DarkTortilla has used % HiddenReg%


] infoal-amalhumandevelopment [ . In addition to the original " Infy " variant , we also see the newer , more sophisticated , interactive , and fuller-featured " Infy M " variant deployed against apparently-higher-value targets . The Domain Name System ( DNS ) is the phone book of the Internet . and % HiddenKey% as part of its persistence via the Windows registry.[6 ] OSX / Shlayer has used the mktemp utility to make random and unique filenames for payloads , such as export tmpDir="$(mktemp -d /tmp / XXXXXXXXXXXX ) " or mktemp -t Installer .


] commargaery [ . This documentation provides new insight into intrusion efforts conducted by at least four discrete Iranian threat actors , Rocket Kitten , Infy , Sima , and Operation Cleaver , including groups and tools that have not been previously disclosed . In the same way that people program named contacts into their cell phones and no longer need to remember phone numbers , DNS allows people to remember names like “ google.com ” instead of IP addresses . Tarrask is able to create " hidden " scheduled tasks by deleting the Security Descriptor ( SD ) registry value.[9 ] WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it 's attempts to elevate privileges through IFileOperation .


] coupload202 [ . Since early 2013 , we have observed activity from a unique threat actor group , which we began to investigate based on increased activities against human right activists in the beginning of 2015 . When a person types “ google.com ” into a web browser , a DNS translation to an IP address occurs so that the person ’s computer can communicate with Google . This type of attack technique can not be easily mitigated with preventive controls since it is based on the abuse of system features .


] comgo-mail-accounts [ . Over the course of three years of observation of campaigns targeting civil society and human rights organizations , from records of well over two hundred spearphishing and other intrusion attempts against individuals inside of Iran and in the diaspora , a narrative of persistent intrusion efforts emerges . Names that can be translated through DNS to IP addresses are referred to as Fully Qualified Domain Names ( FQDNs ) . for third - party application logging , messaging , and/or other artifacts that may attempt to hide artifacts associated with their behaviors to evade detection .


] comupload101 [ . Thanks to information we have been able to collect during the course of our research , such as characteristics of the group 's malware and development cycle , our research strongly supports the claim that the Infy group is of Iranian origin and potentially connected to the Iranian state . A DNS zone represents a collection of FQDNs that end with the same name , and which are usually registered through a domain registration company and controlled by a single owner . Monitor executed commands and arguments that may attempt to hide artifacts associated with their behaviors to evade detection .


] netsybil-parks [ . Amongst a backdrop of other incidents , Infy became one of the most frequently observed agents for attempted malware attacks against Iranian civil society beginning in late 2014 , growing in use up to the February 2016 parliamentary election in Iran . For example , “ hugesoft.org ” is an FQDN but also represents a zone . Monitor for newly constructed files that may attempt to hide artifacts associated with their behaviors to evade detection .


] infodavos-seaworth [ . Until the publication of the Palo Alto report , the developers of the Infy appeared to be actively updating and maintaining the codebase , and new releases were distributed to existing , as well as new , targets quite regularly . The FQDNs “ ug-co.hugesoft.org ” and “ 7cback.hugesoft.org ” are part of the “ hugesoft.org ” zone and are called “ subdomains ” of the zone . Monitor for contextual data about a file , which may include information such as name , the content ( ex : signature , headers , or data / media ) , user / ower , permissions that may attempt to hide artifacts associated with their behaviors to evade detection .


] infoupload999 [ . Other samples were found bearing a compilation time as early as June 2012 and version 00002 . The person who registered “ hugesoft.org ” may add as many subdomains as they wish and controls the IP resolutions of these FQDNs . Monitor for changes made to files that may attempt to hide artifacts associated with their behaviors to evade detection .


] orgacount-manager [ . Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware . APT1 has registered at least 107 zones since 2004 . Monitor for changes made to firewall rules for unexpected modifications to allow / block specific network traffic that may attempt to hide artifacts associated with their behaviors to evade detection .


] comlila-tournai [ . When activities targeting of civil society subsided , the actors instead appeared to have focused on external targets , such a series of attempts to spearphish the Danish Ministry of Foreign Affairs . Within these zones , we know of thousands of FQDNs that have resolved to hundreds of IP addresses ( which we suspect are hops ) and in some instances to APT1 ’s source IP addresses in Shanghai . Monitor for API calls that may attempt to hide artifacts associated with their behaviors to evade detection .


] comaccount-manager [ . Palo Alto Networks has noted and described the differences of two malware agents developed in parallel , with commonalities in behavior but differing functionalities ; families described as Infy and Infy M. Our primary observation was of the Infy ( non-M ) malware , which primarily functions as a keylogger for the collection of account credentials . The first zone we became aware of was “ hugesoft.org ” , which was registered through eNom , Inc. in October 2004 . Monitor newly executed processes that may attempt to hide artifacts associated with their behaviors to evade detection .


] orgmediauploader [ . Our observation of Infy 's campaigns , primarily through the lens of spearphishing attacks against Iranian civil society and media organizations , indicates a wandering focus on particular demographics on a strategic basis over time . The registrant supplied “ uglygorilla@163.com ” as an email address . Monitor for any attempts to enable scripts running on a system would be considered suspicious .


] infokalisi [ . The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) . The supplied registration information , which is still visible in public “ whois ” data as of February 3, 2013 . If scripts are not commonly used on a system , but enabled , scripts running out of cycle from patching or other administrator functions are suspicious .


] orgaryastark [ . Based on information collected in the course of this research , the targets and victims of Infy 's campaigns have continued to be strongly aligned with Iran 's " soft war " agenda , internal security policies , and regional adversaries of the hardline establishment of the Islamic Republic of Iran . The supplied registrant information does not need to be accurate for the zone to be registered successfully . Scripts should be captured from the file system when possible to determine their actions and intent .


] infomavis-dracula [ . Until late December 2015 , in nearly every Infy message documented since our tracking began in May 2013 , no attempt included strong tailoring of the approach , often not even including an email body , instead relying on cryptic filenames and email subjects to attract interest . For example , “ shanghai ” is not a street name . Monitor for newly constructed services / daemons that may attempt to hide artifacts associated with their behaviors to evade detection .


] comkalisi [ . One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges . Nevertheless , it is noteworthy that Shanghai appeared in the first known APT1 domain registration , along with a phone number that begins with China ’s “ +86 ” international code . Monitor for newly constructed user accounts that may attempt to hide artifacts associated with their behaviors to evade detection .


] infogoogle-support-team [ . As in the past , these messages have been sent accounts believed to be fake and accounts compromised by Infy , including Kurdish activists that had previously been compromised by the Flying Kitten actor group . In fact , Shanghai was listed as the registrant ’s city in at least 24 of the 107 ( 22% ) registrations . Monitor for contextual data about an account , which may include a username , user ID , environmental data that may attempt to hide artifacts associated with their behaviors to evade detection .


] com9oo91e [ . The actors successfully compromised a host of an Saudi government institutions on January 17 , 2016 , and maintained access for at least two weeks . Overall , the combination of a relatively high number of “ Shanghai ” registrations with obviously false registration examples in other registrations suggests a partially uncoordinated domain registration campaign from 2004 until present , in which some registrants tried to fabricate non-Shanghai locations but others did not . Monitor for changes made to windows registry keys and/or values that may attempt to hide artifacts associated with their behaviors to evade detection .


] comuseraccount [ . The Infy group also appears to engage in espionage activities against foreign governments and businesses . This is supported by contextual information on the Internet for the email address “ lfengg@163.com , ” which was supplied in the registration information for seven of the 107 zones . CSP can define a list of domains that the browser should be allowed to interact with for the visited URL .


] websiteaccounts-fb [ . In order to initially compromise the designated targets , Infy typically distributed specifically-crafted malicious documents containing Infy through spearphishing attacks . On the site “ www.china-one.org , ” the email address “ lfengg@163.com ” appears as the contact for the Shanghai Kai Optical Information Technology Co. , Ltd. , a website production company located in a part of Shanghai that is across the river from PLA Unit 61398 . Designed to guard against XSS attacks , CSP helps control which domains can be accessed as part of a page and therefore restricts which domains to share data with .


] comakashipro [ . In order to initially compromise the designated targets , the attackers typically distributed specifically-crafted malicious documents containing Infy through spearphishing attacks . About half of APT1 ’s known zones were named according to three themes : news , technology and business . It even can restrict forms to be sent only to specific hosts , using the form - action directive .


] comfeteh-asefa [ . On May 2 , 2016 , Palo Alto Networks published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available . These themes cause APT1 command and control addresses to appear benign at first glance . These restrictions are specified by a list of allowed URIs .


] comlagertha-lothbrok [ . Prior to the distribution of new versions of the agent , the Infy developers appear to consistently conduct tests from local hosts , which indicates that the control and maintenance of the software occurs in the Khorasan Razavi province of Iran , potentially in the city of Mashhad . However , we believe that the hundreds of FQDNs within these zones were created for the purpose of APT1 intrusions . ( Note : these themes are not unique to APT1 or even APT in general . ) The news-themed zones include the names of well-known news media outlets such as CNN , Yahoo and Reuters . By analyzing field data we see a gap in the implementation of CSP , and even for sites that do use it correctly , this creates an open window to exfiltrate data .


] info OpSec fails and use of cryptography While looking at this infrastructure , we identified that one of these domains has directory indexing enabled . On May 2 , 2016 , Palo Alto published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available . However , they also include names referencing English-speaking countries , such as “ aunewsonline.com ” ( Australia ) , “ canadatvsite.com ” ( Canada ) , and “ todayusa.org ” ( U.S . ) . Our demonstration shows how using the Google Analytics API , a web skimmer can send data to be collected in his own account instance .


This mistake in operational security allowed us to gain visibility into exfiltrated content for a number of devices . Only one client , based in Iran , continued to communicate with the infrastructure . Below is a list of zones registered by APT1 that are newsthemed : As Google Analytics is allowed in the CSP configuration of many major sites , this demo shows how an attacker can bypass this security protection and steal data .


Continued mirroring suggests it is likely a regularly cleaned staging server . A researcher has attributed a recently publicized attack on Citrix' internal network to the Iranian-linked group known as IRIDIUM – and said that the data heist involved 6 terabytes of sensitive data . aoldaily.com aunewsonline.com canadatvsite.com canoedaily.com cnndaily.com cnndaily.net cnnnewsdaily.com defenceonline.net freshreaders.net giftnews.org reutersnewsonline.com rssadvanced.org saltlakenews.org sportreadok.net todayusa.org usapappers.com usnewssite.com yahoodaily.com . Our gathered field data shows the following statistics on CSP usage across the Internet ( based on HTTPArchive March 2020 scan ):


We sourced the over 561MB of exfiltrated data from this domain alone , all of which we found to be 7z compressed and password protected . " IRIDIUM has hit more than 200 government agencies , oil and gas companies and technology companies , including Citrix Systems Inc " , they said . The technology-themed zones reference well-known technology companies ( AOL , Apple , Google , Microsoft ) , antivirus vendors ( McAfee , Symantec ) , and products ( Blackberry , Bluecoat ) . Looking at the top 3 M domains , only 210 K use CSP .