The Android permissions requested by HenBox , as defined in the apps ’ AndroidManifest.xml files , range from accessing location and network settings to messages , call , and contact data . Beginning in July 2018 , APT41 appeared to have directly targeted several East and Southeast Asia-based video game developers and distributors to inject legitimate executables with the CRACKSHOT backdoor . Compared to other backdoor tools associated with the Sofacy group , the use of Zebrocy in attack campaigns is far more widespread .


HenBox can also access sensors such as the device camera ( s ) and the microphone . The lure used to target the cryptocurrency exchange (displayed in Figure 5 and translated in Figure 6) referenced an online gaming platform , tying the cryptocurrency targeting to APT41's focus on video game-related targeting . As alluded to in our previous blog regarding the Cannon tool , the Sofacy group ( AKA Fancy Bear , APT28 , STRONTIUM , Pawn Storm , Sednit ) has persistently attacked various government and private organizations around the world from mid-October 2018 through mid-November 2018 .


Beyond the Android app itself , other components such as the aforementioned ELF libraries have additional data-stealing capabilities . FireEye malware analysis identified source code overlaps between malware used by APT41 in May 2016 targeting of a U.S.-based game development studio and the malware observed in supply chain compromises in 2017 and 2018 . Russian citizens—journalists , software developers , politicians , researchers at universities , and artists are also targeted by Pawn Storm .


One ELF library , libloc4d.so , handles amongst other things the loading of the app-decoded ELF library file “ sux ” , as well as handling connectivity to the C2 . In May 2016 , APT41 deployed a POISONPLUG sample at a U.S.-based game development studio . The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 .


The sux library appears to be a customized super user ( su ) tool that includes code from the com.koushikdutta.superuser app and carries the equivalent of a super user ( su ) binary in order to run privileged commands on the system . Alternatively , it is also possible that APT41 injected malicious code into the package prior to compilation , circumventing the need to steal the code-signing certificate and compile it on their own . While the JHUHUGIT ( and more recently , " JKEYSKW " ) implant used in most of the Sofacy attacks , high profile victims are being targeted with another first level implant , representing the latest evolution of their AZZY Trojan .


The primary goal of sux appears to be steal messages and other data from popular messaging and social media apps specified within the HenBox sample . Either APT41 is operating outside of state control but still working with other Chinese APT malware actors , tools , and infrastructure on a parttime or contractual basis , or APT41 is a full-time . Once a foothold is established , Sofacy trys to upload more backdoors , USB stealers as well as other hacking tools such as " Mimikatz " for lateral movement .


A similar tool , with the same filename , has been discussed in previous research but the SpyDealer malware appears unrelated to HenBox . APT41 uses many of the same tools and compromised digital certificates that have been leveraged by other Chinese espionage operators . Once a foothold is established , they try to upload more backdoors , USB stealers as well as other hacking tools such as " Mimikatz " for lateral movement .


More likely , this is a case of common attack tools being re-used between different threat actor groups . Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations . The Sofacy threat group continues to target government organizations in the EU , US , and former Soviet states to deliver the Zebrocy tool as a payload .


This particular HenBox variant , as listed in Table 3 above , harvests data from two popular messaging and social media apps : Voxer Walkie Talkie Messenger ( com.rebelvox.voxer ) and Tencent ’ s WeChat ( com.tencent.mm ) . APT41 has used several malware families that have also been used by other Chinese espionage operators , including variants of HIGHNOON , HOMEUNIX , PHOTO , SOGU , and ZXSHELL , among others . Of note , we also discovered the Sofacy group using a very similar delivery document to deliver a new Trojan called Cannon .


These types of apps tend to store their data in databases and , as an example , HenBox accesses Voxer ’ s database from the file “ /data/data/com.rebelvox.voxer/databases/rv.db ” . HIGHNOON , one of the main code families observed being used by APT41 , was also used by APT17 in 2015 to target semiconductor and chemical manufacturers . Komplex shares a significant amount of functionality and traits with another tool used by Sofacy – the Carberp variant that Sofacy had used in previous attack campaigns on systems running Windows .


Once opened , HenBox runs the following query to gather message information . HOMEUNIX , another popular backdoor used by APT41 , has been used by at least 14 separate Chinese espionage groups , including APT1 , APT10 , APT17 , APT18 , and APT20 . The Sofacy group created the Komplex Trojan to use in attack campaigns targeting the OS X operating system – a move that showcases their continued evolution toward multi-platform attacks .


Not long after this variant was public , newer variants of HenBox were seen , and some had significant increases in the number of targeted apps . APT41 has used CROSSWALK.BIN , a kernel driver , to circumvent firewalls and covertly send data . The Komplex Trojan revealed a design similar to Sofacy 's Carberp variant Trojan , which we believe may have been done in order to handle compromised Windows and OS X systems using the same C2 server application with relative ease .


Table 5 describes the latest variant seen in AutoFocus . Another Chinese espionage group used a similar tool , CLASSFON , to covertly proxy network communications in 2011 . This whitepaper explores the tools - such as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , etc- of the Dukes , a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making .


SHA256 Package Name App Name First Seen 07994c9f2eeeede199dd6b4e760fce3 71f03f3cc4307e6551c18d2fbd024a24f com.android.henbox 备份 ( Backup ) January 3rd 2018 Table 6 contains an updated list of targeted apps from which this newer variant of HenBox is capable of harvesting data . At least two of these malware families , HIGHNOON.CLI and GEARSHIFT , have been used by APT17 and another suspected Chinese espionage group . The Dukes are a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making .


Interestingly , the two communication apps described above as being targeted by the HenBox variant listed in Table 3 do not appear in this updated list . APT41 regularly leverages code-signing certificates to sign malware when targeting both gaming and nongaming organizations . The Dukes are known to employ a vast arsenal of malware toolsets , which we identify as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , CloudDuke , SeaDuke , HammerDuke , PinchDuke , and GeminiDuke .


Package Name App Name com.whatsapp WhatsApp Messenger com.pugna.magiccall n/a org.telegram.messenger Telegram com.facebook.katana Facebook com.twitter.android Twitter jp.naver.line.android LINE : Free Calls & Messages com.instanza.cocovoice Coco com.beetalk BeeTalk com.gtomato.talkbox TalkBox Voice Messenger - PTT com.viber.voip Viber Messenger com.immomo.momo MOMO陌陌 com.facebook.orca Messenger – Text and Video Chat for Free com.skype.rover In July 2017 , APT41 initiated a TeamViewer session and transferred files that were later deleted . The origins of the Duke toolset names can be traced back to when researchers at Kaspersky Labs coined the term " MiniDuke " to identify the first Duke-related malware they found .


Skype ; 3rd party stores only Most of these apps are well established and available on Google Play , however , com.skype.rover appears to be available only on third-party app stores . In these instances , APT41 leveraged TeamViewer to transfer malware into the compromised environment , although we do not have direct evidence of APT41 compromising TeamViewer . As researchers continued discovering new toolsets that were created and used by the same group that had been operating MiniDuke , and thus the threat actor operating the toolsets started to be commonly referred to as " Dukes " .


The same is likely to be the case for com.pugna.magiccall but this is unknown currently . In May 2018 , APT41 used TeamViewer for initial entry in the compromise of a healthcare company . Based on the campaign identifiers found in PinchDuke samples discovered from 2009 , the targets of the Dukes group during that year included organizations such as the Ministry of Defense of Georgia and the ministries of foreign affairs of Turkey and Uganda .


It ’ s clear to see that the capabilities of HenBox are very comprehensive , both in terms of an Android app with its native libraries and given the amount of data it can glean from a victim . Notably , APT41 was observed using proof-of-concept exploit code for CVE-2019-3396 within 23 days after the Confluence . Importantly , PinchDuke trojan samples alACTs contain a notable text string , which we believe is used as a campaign identifier by the Dukes group to distinguish between multiple attack campaigns that are run in parallel .


Such data includes contact and location information , phone and message activity , the ability to record from the microphone , camera , and other sensors as well as the capability to access data from many popular messaging and social media apps . APT41 has targeted payment services specializing in handling in-game transactions and real money transfer (RMT) purchases . This neatly ties together many of the tools used by the Dukes group , as versions of this one loader have been used to load malware from three different Dukes-related toolsets CosmicDuke , PinchDuke , and MiniDuke – over the course of five years .


Infrastructure While investigating HenBox we discovered infrastructure ties to other malware families associated with targeted attacks against Windows users – notable overlaps included PlugX , Zupdax , 9002 , and Poison Ivy . We observed APT41 using a compromised account to create a scheduled task on a system , write a binary component of HIGHNOON containing the payload and C&C information to disk , and then modify the legitimate Windows WMI Performance Adaptor (wmiApSrv) to execute the HIGHNOON payload . The Dukes continued the expansion of their arsenal in 2011 with the addition of two more toolsets : MiniDuke and CozyDuke .


The overall image of these ties is below in Figure 5 and paints a picture of an adversary with at least 5 malware families in their toolbox dating back to at least 2015 . The group will also use a compromised account to create scheduled tasks on systems or modify legitimate Windows services to install the HIGHNOON and SOGU backdoors . As we now know , by February 2013 the Dukes group had been operating MiniDuke and other toolsets for at least 4 and a half years .


The overlap between the HenBox and 9002 malware families Unit 42 has seen involves three shared C2s between several samples ; the first IP below is used for more than half of the HenBox samples we have seen to date : 47.90.81 [ . APT41 uses multiple methods to perform lateral movement in an environment , including RDP sessions , using stolen credentials , adding accounts to User and Admin groups , and password brute-forcing utilities . Secondly , the value the Dukes intended to gain from these MiniDuke campaigns may have been so great that they deemed it worth the risk of getting noticed .


] 23 222.139.212 [ . To maintain presence , APT41 relies on backdoors , a Sticky Keys vulnerability , scheduled tasks , bootkits , rootkits , registry modifications , and creating or modifying startup files . This is in stark contrast to some other suspected Russian threat actors ( such as Operation Pawn Storm ) who appear to have increased their targeting of Ukraine following the crisis .


] 16 lala513.gicp [ . APT41 leveraged ROCKBOOT as a persistence mechanism for PHOTO and TERA backdoors . The Dukes actively targeted Ukraine before the crisis , at a time when Russia was still weighing her options , but once Russia moved from diplomacy to direct action , Ukraine was no longer relevant to the Dukes in the same ACT .


] net The overlaps between the Henbox , PlugX , Zupdax , and Poison Ivy malware families involves a web of shared C2s and IP resolutions centered around the below : 59.188.196 [ . APT41 has also been observed modifying firewall rules to enable file and printer sharing to allow for inbound Server Message Block (SMB) traffic . In the latter case however , the Dukes group appear to have also simultaneously developed an entirely new loader , which we first observed being used in conjunction with CosmicDuke during the spring of 2015 .


] 172 cdncool [ . In some instances , APT41 leveraged POISONPLUG as a first-stage backdoor to deploy the HIGHNOON backdoor in the targeted environment . The Dukes could have ceased all use of CosmicDuke ( at least until they had developed a new loader ) or retired it entirely , since they still had other toolsets available .


] com ( and third-levels of this domain ) www3.mefound [ . The group also deploys the SOGU and CROSSWALK malware families as means to maintain presence . For these CozyDuke campaigns however , the Dukes appear to have employed two particular later-stage toolsets , SeaDuke and HammerDuke .


] com www5.zyns [ . APT41 sent spear-phishing emails to multiple HR employees three days after the compromise had been remediated and systems were brought back online . Firstly , as with the MiniDuke campaigns of February 2013 and CosmicDuke campaigns in the summer of 2014 , again the group clearly prioritized the continuation of their operations over maintaining stealth .


] com w3.changeip [ . APT41 also deploys the SOGU and CROSSWALK malware families as means to maintain presence . In addition to the notably overt and large-scale campaigns with CozyDuke and CloudDuke , the Dukes also continued to engage in more covert , surgical campaigns using CosmicDuke .


] org Ties to previous activity The registrant of cdncool [ . Within hours of a user opening the malicious attachment dropping a HOMEUNIX backdoor , APT41 regained a foothold within the environment by installing PHOTO on the organization's servers across multiple geographic regions . We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit .


] com also registered six other domains . Before attempting to deploy the publicly available Ransomware-as-a-Service (RaaS) Encryptor RaaS through group policy , APT41 blocked victim systems from retrieving anti-virus updates by accessing the DNS management console and implementing a forward lookup on the domain used for anti-virus updates to the park IP address 1.1.1.1 . All of the available evidence however does in our opinion suggest that the group operates on behalf of the Russian Federation .


To date , Unit 42 has seen four of the seven ( the first three in the list below , along with cdncool [ . APT41 has been observed creating a RAR archive of targeted files for exfiltration . This assertion of time zone is also supported by timestamps found in many GeminiDuke samples , which similarly suggest the group work in the Moscow Standard TIME timezone , as further detailed in the section on the technical analysis of GeminiDuke .


] com ) used in malicious activity and it is reasonable to assume the remaining three are or were intended to serve the same purpose . APT41 is unique among tracked China-based actors in that it leverages non-public malware typically reserved for espionage campaigns in what appears to be activity for personal gain . Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years .


tcpdo [ . During multiple engagements , APT41 attempted to remove evidence of some of its activity by deleting Bash histories , clearing Windows security and system events , and modifying DNS management to avoid anti-virus detections . APT29 has used The Onion Router and the TOR domain fronting plugin meek to create a hidden , encrypted network tunnel that appeared to connect to Google services over TLS .


] net adminsysteminfo [ . Explicit financially-motivated targeting is unusual among Chinese statesponsored threat groups , and evidence suggests APT41 has conducted simultaneous cyber crime and cyber espionage operations from 2014 onward . Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY .


] com md5c [ . APT41 operations against higher education , travel services , and news/media firms provide some indication that the group also tracks individuals and conducts surveillance . Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years .


] net linkdatax [ . For example , the group has repeatedly targeted call record information at telecom companies . In the investigations Mandiant has conducted , it appeared that APT29 deployed POSHSPY as a secondary backdoor for use if they lost access to their primary backdoors .


] com csip6 [ . APT41 has established and maintained strategic access to organizations in the healthcare , high-tech , and telecommunications sectors . POSHSPY is an excellent example of the skill and craftiness of APT29 .


] biz adminloader [ . The group’s financially motivated activity has primarily focused on the video game industry , where APT41 has manipulated virtual currencies and even attempted to deploy ransomware . FireEye assesses that APT32 leverages a unique suite of fully-featured malware , in conjunction with commercially-available tools , to conduct targeted operations that are aligned with Vietnamese state interests .


] com Unit 42 published a blog in July 2016 about 9002 malware being delivered using a combination of shortened links and a file hosted on Google Drive . In another instance , APT41 targeted a hotel’s reservation systems ahead of Chinese officials staying there , suggesting the group was tasked to reconnoiter the facility for security reasons . In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 .


The spear phishing emails had Myanmar political-themed lures and , if the 9002 C2 server responded , the Trojan sent system specific information along with the string “ jackhex ” . These supply chain compromise tactics have also been characteristic of APT41’s best known and most recent espionage campaigns . From 2016 through 2017 , two subsidiaries of U.S. and Philippine consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations .


“ jackhex ” has also been part of a C2 for what is likely related Poison Ivy activity detailed below , along with additional infrastructure ties . Interestingly , despite the significant effort required to execute supply chain compromises and the large number of affected organizations , APT41 limits the deployment of follow-on malware to specific victim systems by matching against individual system identifiers . From 2016 through 2017 , two consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations .


The C2 for the aforementioned 9002 sample was logitechwkgame [ . Mapping the group’s activities since 2012 (Figure 2) also provides some indication that APT41 primarily conducts financially motivated operations outside of their normal day jobs . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


] com , which resolved to the IP address 222.239.91 [ . The latter is especially notable because APT41 has repeatedly returned to targeting the video game industry and we believe these activities were formative in the group’s later espionage operations . In 2015 and 2016 , two Vietnamese media outlets were targeted with malware that FireEye assesses to be unique to APT32 .


] 30 . APT41 leverages an arsenal of over 46 different malware families and tools to accomplish their missions , including publicly available utilities , malware shared with other Chinese espionage operations , and tools unique to the group . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


At the same time , the domain admin.nslookupdns [ . Once in a victim organization , APT41 can leverage more sophisticated TTPs and deploy additional malware . Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam 's manufacturing , consumer products , and hospitality sectors .


] com also resolved to the same IP address , suggesting that these two domains are associated with the same threat actors . APT41 often relies on spear-phishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims . APT32 operations are characterized through deployment of signature malware payloads including WINDSHIELD , KOMPROGO , SOUNDBITE , and PHOREAL .


In addition , admin.nslookupdns [ . APT41 has also deployed rootkits and Master Boot Record (MBR) bootkits on a limited basis to hide their malware and maintain persistence on select victim systems . In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines .


] com was a C2 for Poison Ivy samples associated with attacks on Myanmar and other Asian countries discussed in a blog published by Arbor Networks in April 2016 . The limited use of these tools by APT41 suggests the group reserves more advanced TTPs and malware only for high-value targets . APT32 often deploys these backdoors along with the commercially-available Cobalt Strike BEACON backdoor .


Another tie between the activity is the C2 jackhex.md5c [ . Like other Chinese espionage operators , APT41 appears to have moved toward strategic intelligence collection and establishing access and away from direct intellectual property theft since 2015 . APT32 often deploys these backdoors along with the commercially-available Cobalt Strike backdoor .


] net , which was also used as a Poison Ivy C2 in the Arbor Networks blog . This shift , however , has not affected the group's consistent interest in targeting the video game industry for financially motivated reasons . Based on incident response investigations , product detections , and intelligence observations along with additional publications on the same operators , FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests .


“ jackhex ” is not a common word or phrase and , as noted above , was also seen in the beacon activity with the previously discussed 9002 sample . BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e , possibly en masse . OceanLotus , also known as APT32 , is believed to be a Vietnam-based APT group that has become increasingly sophisticated in its attack tactics , techniques , and procedures ( TTPs ) .


Finally , since publishing the 9002 blog , Unit 42 has also seen the aforementioned 9002 C2 used as a Poison Ivy C2 with a Myanmar political-themed lure . With the contents of the emails , included links and decoy PDFs all involving taxes , the attackers are apparently targeting the financial departments of organizations in the Balkans region . While Volexity does not typically engage in attempting attribution of any threat actor , Volexity does agree with previously reported assessments that OceanLotus is likely operating out of Vietnam .


In our 9002 blog we noted some additional infrastructure used either as C2s for related Poison Ivy samples , or domain registrant overlap with those C2 domains . Some parts of the campaign were briefly described by a Serbian security provider in 2016 and the Croatian CERT in 2017 . During that phase , the APT32 operated a fileless PowerShell-based infrastructure , using customized PowerShell payloads taken from known offensive frameworks such as Cobalt Strike , PowerSploit and Nishang .


When we published that blog Unit 42 hadn ’ t seen any of the three registrants overlap domains used in malicious activity . The campaign has been active at least from January 2016 to the time of writing the most recent detections in our telemetry are from July 2019 . However , over the past few years , we have been tracking a separate , less widely known suspected Iranian group with potential destructive capabilities , whom we call APT33 .


Since then , we have seen Poison Ivy samples using third-levels of querlyurl [ . Our findings show that the mentioned attacks have been orchestrated and we consider them a single long-term campaign that spans Croatia , Serbia , Montenegro , and Bosnia and Herzegovina . Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 .


] com , lending further credence the remaining two domains , gooledriveservice [ . We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 . We assess APT33 works at the behest of the Iranian government .


] com and appupdatemoremagic [ . Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina . APT33 has targeted organizations – spanning multiple industries – headquartered in the United States , Saudi Arabia and South Korea .


] com are or were intended for malicious use . According to our telemetry , the campaign spreading these tools has been live since 2016 , with the most recent detections as late as in July 2019 . Cybereason also attributes the recently reported Backdoor.Win32.Denis to the OceanLotus Group , which at the time of this report 's writing , had not been officially linked to this threat actor .


While we do not have complete targeting , information associated with these Poison Ivy samples , several of the decoy files were in Chinese and appear to be part of a 2016 campaign targeting organizations in Taiwan with political-themed lures . In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 . APT33 has shown particular interest in organizations in the aviation sector , as well as organizations in the energy sector with ties to petrochemical production .


Conclusion Typically masquerading as legitimate Android system apps , and sometimes embedding legitimate apps within them , the primary goal of the malicious HenBox appears to be to spy on those who install them . Via the BalkanDoor backdoor , the attacker sends a backdoor command to unlock the screen… and using BalkanRAT , they can do whatever they want on the computer . From mid-2016 through early 2017 , APT33 compromised a U.S. organization in the aerospace sector and targeted a business conglomerate located in Saudi Arabia with aviation holdings .


Using similar traits , such as copycat iconography and app or package names , victims are likely socially engineered into installing the malicious apps , especially when available on so-called third-party ( i.e . The BalkanDoor backdoor does not implement any exfiltration channel . From mid-2016 through early 2017 , APT33 compromised organizations located in Saudi Arabia and U.S. in the aerospace sector .


non-Google Play ) app stores which often have fewer security and vetting procedures for the apps they host . APT41 leveraged ADORE.XSEC , a Linux backdoor launched by the Adore-NG rootkit , throughout an organization's Linux environment . During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals .


It ’ s possible , as with other Android malware , that some apps may also be available on forums , file-sharing sites or even sent to victims as email attachments , and we were only able to determine the delivery mechanism for a handful of the apps we have been able to find . The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience . More recently , in May 2017 , APT33 appeared to target a Saudi organization and a South Korean business conglomerate using a malicious file that attempted to entice victims with job vacancies for a Saudi Arabian petrochemical company .


The hosting locations seen for some HenBox samples , together with the nature of some embedded apps including : those targeted at extremist groups , those who use VPN or other privacy-enabling apps , and those who speak the Uyghur language , highlights the victim profile the threat actors were seeking to attack . The main part of the BalkanRAT malware is a copy of the Remote Utilities software for remote access . More recently , in May 2017 , APT33 appeared to target organizations in Saudi and South Korea using a malicious file that attempted to entice victims with job vacancies .


The targets and capabilities of HenBox , in addition to the ties to previous activity using four different Windows malware families with political-themed lures against several different South East Asian countries , indicates this activity likely represents an at least three-year-old espionage campaign . Interestingly , some of the APT41's POISONPLUG malware samples leverage the Steam Community website associated with Valve , a video game developer and publisher . We assess the targeting of multiple companies with aviation-related partnerships to Saudi Arabia indicates that APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia .


THURSDAY , OCTOBER 11 , 2018 GPlayed Trojan - .Net playing with Google Market Introduction In a world where everything is always connected , and mobile devices are involved in individuals ' day-to-day lives more and more often , malicious actors are seeing increased opportunities to attack these devices . The campaign targeting accountants in the Balkans shows some similarities with a campaign aimed at Ukrainian notaries reported in 2016 . APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia .


Cisco Talos has identified the latest attempt to penetrate mobile devices — a new Android trojan that we have dubbed " GPlayed . Based on the Let’s Encrypt certificate issuance date , we believe this campaign to be active from May 2019 . The generalized targeting of organizations involved in energy and petrochemicals mirrors previously observed targeting by other suspected Iranian threat groups , indicating a common interest in the sectors across Iranian actors .


'' This is a trojan with many built-in capabilities . One of the domains uncovered during the investigation was identified by the Chinese security vendor CERT 360 as being part of the BITTER APT campaign in May 2019 . APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


At the same time , it 's extremely flexible , making it a very effective tool for malicious actors . Further analysis of the BITTER APT’s infrastructure uncovered a broader phishing campaign targeting other government sites and state-owned enterprises in China . APT33 registered multiple domains that masquerade as Saudi Arabian aviation companies and Western organizations that together have partnerships to provide training , maintenance and support for Saudi 's military and commercial fleet .


The sample we analyzed uses an icon very similar to Google Apps , with the label " Google Play Marketplace '' to disguise itself . Further investigation revealed approximately 40 additional sites , all of which appear to be targeting the government of China and other organisations in China . We identified APT33 malware tied to an Iranian persona who may have been employed by the Iranian government to conduct cyber threat activity against its adversaries .


The malicious application is on the left-hand side . We expect to see BITTER APT continuing to target the government of China by employing spoofed login pages designed to steal user credentials and obtain access to privileged account information . APT33 's targeting of organizations involved in aerospace and energy most closely aligns with nation-state interests , implying that the threat actor is most likely government sponsored .


What makes this malware extremely powerful is the capability to adapt after it 's deployed . This domain and IP address has been previously associated with the BITTER APT and targeting government agencies in China with phishing attacks , based on reporting from 360-CERT . APT33 leverages popular Iranian hacker tools and DNS servers used by other suspected Iranian threat groups .


In order to achieve this adaptability , the operator has the capability to remotely load plugins , inject scripts and even compile new .NET code that can be executed . At the time of analysis , the subdomains did not host a website; however , based on BITTER APT group’s targeting patterns , it is highly likely that they were created to host faux login phishing pages designed to steal user’s credentials . This coupled with the timing of operations – which coincides with Iranian working hours – and the use of multiple Iranian hacker tools and name servers bolsters our assessment that APT33 may have operated on behalf of the Iranian government .


Our analysis indicates that this trojan is in its testing stage but given its potential , every mobile user should be aware of GPlayed . BITTER APT campaigns are primarily targeting China , Pakistan and Saudi Arabia historically . The publicly available backdoors and tools utilized by APT33 – including NANOCORE , NETWIRE , and ALFA Shell – are all available on Iranian hacking websites , associated with Iranian hackers , and used by other suspected Iranian threat groups .


Mobile developers have recently begun eschewing traditional app stores and instead want to deliver their software directly through their own means . As part of its ongoing research initiatives , the Anomali Threat Research Team has discovered a new phishing attack leveraging spoof sites that seem to be designed to steal email credentials from the target victims within the government of the People’s Republic of China . APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


But GPlayed is an example of where this can go wrong , especially if a mobile user is not aware of how to distinguish a fake app versus a real one . 360 Threat Intelligence Center has reported on related indicators being attributed to BITTER APT a South Asian country suspected Indian APT in open source reporting . Specifically , the targeting of organizations in the aerospace and energy sectors indicates that the APT33 is likely in search of strategic intelligence capable of benefitting a government or military sponsor .


Trojan architecture and capabilities This malware is written in .NET using the Xamarin environment for mobile applications . China Chopper is a tool that has been used by some state-sponsored actors such as Leviathan and Threat Group-3390 , but during our investigation we've seen actors with varying skill levels . APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military aviation capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


The main DLL is called " Reznov.DLL . China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool . We expect APT33 activity will continue to cover a broad scope of targeted entities , and may spread into other regions and sectors as Iranian interests dictate .


'' This DLL contains one root class called " eClient , '' which is the core of the trojan . Cisco Talos discovered significant China Chopper activity over a two-year period beginning in June 2017 , which shows that even nine years after its creation , attackers are using China Chopper without significant modifications . The Elfin espionage group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries .


The imports reveal the use of a second DLL called " eCommon.dll . Here , we investigate a campaign targeting an Asian government organization . On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " ( referred to as GroupB in this blog post ) to APT33 , operating at the behest of the Iranian government .


'' We determined that the " eCommon '' file contains support code and structures that are platform independent . We observed another campaign targeting an organisation located in Lebanon . The Elfin group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries .


The main DLL also contains eClient subclasses that implement some of the native capabilities . China Chopper contains a remote shell (Virtual Terminal) function that has a first suggested command of netstat an|find ESTABLISHED . On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " to APT33 , operating at the behest of the Iranian government .


The package certificate is issued under the package name , which also resembles the name of the main DLL name . They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword.exe . APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea .


Certificate information The Android package is named " verReznov.Coampany . The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords . In 2017 , APT37 expanded its targeting beyond the Korean peninsula to include Japan , Vietnam and the Middle East , and to a wider range of industry verticals , including chemicals , electronics , manufacturing , aerospace , automotive and healthcare entities .


'' The application uses the label " Installer '' and its name is " android.app.Application . The actor attempts to exploit CVE-2018–8440 — an elevation of privilege vulnerability in Windows when it improperly handles calls to Advanced Local Procedure Call — to elevate the privileges using a modified proof-of-concept exploit . In 2017 , APT37 targeted a company in Middle East that entered into a joint venture with the North Korean government to provide telecommunications service to the country .


'' Package permissions The trojan declares numerous permissions in the manifest , from which we should highlight the BIND_DEVICE_ADMIN , which provides nearly full control of the device to the trojan . The attacker obtains the required privileges and launches a few other tools to modify the access control lists (ACLs) of all websites running on the affected server . While not conclusive by itself , the use of publicly available Iranian hacking tools and popular Iranian hosting companies may be a result of APT33 's familiarity with them and lends support to the assessment that APT33 may be based in Iran .


This trojan is highly evolved in its design . The Windows branch of the Cloud Atlas intrusion set still uses spear-phishing emails to target high profile victims . North Korean defector and human rights-related targeting provides further evidence that APT37 conducts operations aligned with the interests of North Korea .


It has modular architecture implemented in the form of plugins , or it can receive new .NET source code , which will be compiled on the device in runtime . From the beginning of 2019 until July , we have been able to identify different spear-phishing campaigns related to this threat actor mostly focused on Russia , Central Asia and regions of Ukraine with ongoing military conflicts . In 2017 , APT37 targeted a Middle Eastern company that entered into a joint venture with the North Korean government to provide telecommunications service to the country ( read on for a case study ) .


Initialization of the compiler object The plugins can be added in runtime , or they can be added as a package resource at packaging time . We described one of the techniques used by Cloud Atlas in 2017 and our colleagues at Palo Alto Networks also wrote about it in November 2018 . APT37 targeted a research fellow , advisory member , and journalist associated with different North Korean human rights issues and strategic organizations .


This means that the authors or the operators can add capabilities without the need to recompile and upgrade the trojan package on the device . The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server . APT37 distributed SLOWDRIFT malware using a lure referencing the Korea Global Forum against academic and strategic institutions located in South Korea .


Trojan native capabilities This is a full-fledged trojan with capabilities ranging from those of a banking trojan to a full spying trojan . Previously , Cloud Atlas dropped its validator” implant named PowerShower” directly , after exploiting the Microsoft Equation vulnerability CVE-2017-11882 mixed with CVE-2018-0802 . We believe a organization located in Middle East was targeted by APT37 because it had been involved with a North Korean company and a business deal went bad .


This means that the malware can do anything from harvest the user 's banking credentials , to monitoring the device 's location . This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage . In one instance , APT37 weaponized a video downloader application with KARAE malware that was indiscriminately distributed to South Korean victims through torrent websites .


There are several indicators ( see section " trojan activity '' below ) that it is in its last stages of development , but it has the potential to be a serious threat . Cloud Atlas remains very prolific in Eastern Europe and Central Asia . FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims .


Trojan details Upon boot , the trojan will start by populating a shared preferences file with the configuration it has on its internal structures . During its recent campaigns , Cloud Atlas used a new polymorphic” infection chain relying no more on PowerShower directly after infection , but executing a polymorphic HTA hosted on a remote server , which is used to drop three different files on the local system . FireEye iSIGHT Intelligence confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims .


Afterward , it will start several timers to execute different tasks . The Gamaredon Group has been actively launching spear-phishing attacks against Ukrainian government and military departments from the mid-2013s . In April 2017 , APT37 targeted South Korean military and government organizations with the DOGCALL backdoor and RUHAPPY wiper malware .


The first timer will be fired on the configured interval ( 20 seconds in this case ) , pinging the command and control ( C2 ) server . In addition , the anonymous cybersecurity experts referenced in the article connected the malicious Gamaredon Group actors with Russian state-sponsored hackers . It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations .


The response can either be a simple " OK , '' or can be a request to perform some action on the device . In one article published in the Kharkiv Observer – an independent Ukranian online publication – an unnamed source stated that even the Ukrainian Presidential Administration has been attacked by malware developed by the Gamaredon Group . We assess with high confidence that APT37 acts in support of the North Korean government and is primarily based in North Korea .


The second timer will run every five seconds and it will try to enable the WiFi if it 's disabled . Gamaredon Group primarily target Ukrainian organizations and resources using spear-phishing attacks , and they use military or similar documents as bait . The compilation times of APT37 malware is consistent with a developer operating in the North Korea time zone ( UTC +8:30 ) and follows what is believed to be a typical North Korean workday .


The third timer will fire every 10 seconds and will attempt to register the device into the C2 and register wake-up locks on the system to control the device 's status . Once they have found a victim , they then deploy remote manipulation system binaries (RMS) via self-extracting archives and batch command files . The majority of APT37 activity continues to target South Korea , North Korean defectors , and organizations and individuals involved in Korean Peninsula reunification efforts .


During the trojan registration stage , the trojan exfiltrates private information such as the phone 's model , IMEI , phone number and country . The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . Similarly , APT37 targeting of a company located in Middle East in 2017 is also consistent with North Korean objectives given the entity 's extensive relationships inside North Korea .


It will also report the version of Android that the phone is running and any additional capabilities . During a recent incident response investigation , our team identified new attacks by the financially motivated attack group ITG08 , also known as FIN6 . Similarly , APT37 targeting of a Middle Eastern company in 2017 is also consistent with North Korean objectives given the entity 's extensive relationships inside North Korea .


Device registration This is the last of the three main timers that are created . More recently , ITG08 has been observed targeting e-commerce environments by injecting malicious code into online checkout pages of compromised websites — a technique known as online skimming — thereby stealing payment card data transmitted to the vendor by unsuspecting customers . In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company .


The trojan will register the SMS handler , which will forward the contents and the sender of all of the SMS messages on the phone to the C2 . This tool , a TTP observed in ITG08 attacks since 2018 , is sold on the dark web by an underground malware-as-a-service (MaaS) provider . Though they have primarily tapped other tracked suspected North Korean teams to carry out the most aggressive actions , APT37 is an additional tool available to the regime , perhaps even desirable for its relative obscurity .


The final step in the trojan 's initialization is the escalation and maintenance of privileges in the device . ITG08 is an organized cybercrime gang that has been active since 2015 , mostly targeting pointof-sale (POS) machines in brick-and-mortar retailers and companies in the hospitality sector in the U.S. and Europe . ScarCruft is a relatively new APT group , victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania .


This is done both by requesting admin privileges on the device and asking the user to allow the application to access the device 's settings . Past campaigns by ITG08 using the More_eggs backdoor were last reported in February 2019 . Certain details , such as using the same infrastructure and targeting , make us believe that Operation Daybreak is being done by the ScarCruft APT group .


Privilege escalation requests The screens asking for the user 's approval wo n't close unless the user approves the privilege escalation . Attackers use it to create , expand and cement their foothold in compromised environments . Prior to the discovery of Operation Daybreak , we observed the ScarCruft APT launching a series of attacks in Operation Erebus .


If the user closes the windows , they will appear again due to the timer configuration . Lastly , ITG08 used Comodo code-signing certificates several times during the course of the campaign . Operation Daybreak appears to have been launched by unknown attackers to infect high profile targets through spear-phishing e-mails .


After the installation of the trojan , it will wait randomly between three and five minutes to activate one of the native capabilities — these are implemented on the eClient subclass called " GoogleCC . Let’s take a closer look at ITG08’s TTPs that are relevant to the campaign we investigated , starting with its spear phishing and intrusion tactics and covering information on its use of the More_eggs backdoor . Operation Daybreak appears to have been launched by APT37 to infect high profile targets through spear-phishing e-mails .


'' This class will open a WebView with a Google-themed page asking for payment in order to use the Google services . Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe . On occasion the APT37 directly included the ROKRAT payload in the malicious document and during other campaigns the attackers leveraged multi-stage infection processes .


This will take the user through several steps until it collects all the necessary credit card information , which will be checked online and exfiltrated to the C2 . X-Force IRIS determined that the More_eggs backdoor later downloaded additional files , including a signed binary shellcode loader and a signed Dynamic Link Library (DLL) , as described below , to create a reverse shell and connect to a remote host . In the early part of 2017 , Group123 started the " Evil New Year " campaign .


During this process , an amount of money , configured by the malicious operator , is requested to the user . Once the ITG08 established a foothold on the network , they employed WMI and PowerShell techniques to perform network reconnaissance and move laterally within the environment . In November 2017 , Talos observed the latest Group123 campaign of the year , which included a new version of ROKRAT being used in the latest wave of attacks .


Steps to request the user 's credit card information In our sample configuration , the request for the views above can not be canceled or removed from the screen — behaving just like a screen lock that wo n't be disabled without providing credit card information . The attackers used this technique to remotely install a Metasploit reverse TCP stager on select systems , subsequently spawning a Meterpreter session and Mimikatz . Group123 is constantly evolving as the new fileless capability that was added to ROKRAT demonstrates .


All communication with the C2 is done over HTTP . In addition to the More_eggs malware , ITG08 leveraged in-memory attacks by injecting malicious code , in this case Mimikatz , into legitimate system processes . In this campaign , the Group123 used a classical HWP document in order to download and execute a previously unknown malware : NavRAT .


It will use either a standard web request or it will write data into a web socket if the first method fails . A recently rising attack tool in ITG08 campaigns has been the More_eggs JScript backdoor . However , we asses with medium confidence that NavRAT is linked to Group123 .


The C2 can also use WebSocket as a backup communication channel . Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world 's largest cyber heists .


Before sending any data to the C2 using the trojan attempts to disguise its data , the data is serialized using JSON , which is then encoded in Base64 . After a successful phishing attack in which users have opened emails and browsed to malicious links , ITG08 attackers install the More_eggs JScript backdoor on user devices alongside several other malware components . APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world .


However , the trojan replaces the '= ' by 'AAAZZZXXX ' , the '+ ' by '| ' and the '/ ' by ' . Beyond using More_eggs as a backdoor , ITG08 in this campaign also used offensive security tools and PowerShell scripts to carry out the different stages of the attack . APT38 is believed to operate more similarly to an espionage operation , carefully conducting reconnaissance within compromised financial institutions and balancing financially motivated objectives with learning about internal systems .


' to disguise the Base64 . After injecting Meterpreter into memory , the attacker had complete control of the infected device . The group has compromised more than 16 organizations in at least 13 different countries , sometimes simultaneously , since at least 2014 .


Request encoding process The HTTP requests follow the format below , while on the WebSocket only the query data is written . IBM X-Force IRIS has gained insight into ITG08’s intrusion methods , ability to navigate laterally , use of custom and open-source tools , and typical persistence mechanisms . APT38 shares malware code and other development resources with TEMP.Hermit North Korean cyber espionage activity , although we consider APT38 .


? After the phishing email resulted in a successful infiltration , ITG08 used the More_eggs backdoor to gain a foothold and infect additional devices . We consider APT38 's operations more global and highly specialized for targeting the financial sector .


q= - : As is common with trojans , the communication is always initiated by the trojan on the device to the C2 . In addition , configuring PowerShell script logging and identifying any obfuscation will assist in mitigating ITG08’s use of PowerShell to conduct malicious activity . APT38 is a financially motivated group linked to North Korean cyber espionage operators , renown for attempting to steal hundreds of millions of dollars from financial institutions and their brazen use of destructive malware .


The request codes are actually replies to the C2 action requests , which are actually called " responses . The LYCEUM threat group targets organizations in sectors of strategic national importance , including oil and gas and possibly telecommunications . Because APT38 is backed by ( and acts on behalf of ) the North Korean regime , we opted to categorize the group as an " APT " instead of a " FIN " .


'' There are 27 response codes that the C2 can use to make requests to the trojan , which pretty much match what 's listed in the capabilities section . CTU research indicates that LYCEUM may have been active as early as April 2018 . Over time these malware similarities diverged , as did targeting , intended outcomes , and TTPs , almost certainly indicating that TEMP.Hermit activity is made up of multiple operational groups primarily linked together with shared malware development resources and North Korean state sponsorship .


Error Registration Ok Empty SendSMS RequestGoogleCC Wipe OpenBrowser SendUSSD RequestSMSList RequestAppList RequestLocation ShowNotification SetLockPassword LockNow MuteSound LoadScript LoadPlugin ServerChange StartApp CallPhone SetPingTimer SMSBroadcast RequestContacts AddInject RemoveInject Evaluate Another feature of this trojan is the ability to register injects , which are JavaScript snippets of code . In May 2019 , the threat group launched a campaign against oil and gas organizations in the Middle East . Based on observed activity , we judge that APT38 's primary mission is targeting financial institutions and manipulating inter-bank financial systems to raise large sums of money for the North Korean regime .


These will be executed in a WebView object created by the trojan . This campaign followed a sharp uptick in development and testing of their toolkit against a public multivendor malware scanning service in February 2019 . Since 2015 , APT38 has attempted to steal hundreds of millions of dollars from financial institutions .


This gives the operators the capability to trick the user into accessing any site while stealing the user 's cookies or forging form fields , like account numbers or phone numbers . Stylistically , the observed tradecraft resembles activity from groups such as COBALT GYPSY (which is related to OilRig , Crambus , and APT34 and COBALT TRINITY also known as Elfin and APT33 . APT38 has pursued their main objective of targeting banks and financial entities since at least 2014 .


Trojan activity At the time of the writing of this post , all URLs ( see IOC section ) found on the sample were inactive , and it does not seem to be widespread . When CTU researchers first published information about LYCEUM to Secureworks Threat Intelligence clients , no public documentation on the group existed . We surmise that the targeting of banks , media , and government agencies is conducted in support of APT38 's primary mission .


There are some indicators that this sample is just a test sample on its final stages of development . Using compromised accounts , LYCEUM send spearphishing emails with malicious Excel attachments to deliver the DanBot malware , which subsequently deploys post-intrusion tools . The APT38 targeted news outlets known for their business and financial sector reporting , probably in support of efforts to identify and compromise additional financial institutions .


There are several strings and labels still mentioning 'test ' or 'testcc ' — even the URL used for the credit card data exfiltration is named " testcc.php . The developer consistently used Accept-Enconding” (note the extra ‘n’) in all DanBot samples analyzed by CTU researchers . APT38 also targeted financial transaction exchange companies likely because of their proximity to banks .


'' Debug information on logcat Another indicator is the amount of debugging information the trojan is still generating — a production-level trojan would keep its logging to a minimum . Get-LAPSP.ps1 is a PowerShell script that gathers account information from Active Directory via LDAP . Given the lapse in time between the spear-phishing and the heist activity in the above example , we suggest two separate but related groups under the North Korean regime were responsible for carrying out missions ; one associated with reconnaissance ( TEMP.Hermit or a related group ) and another for the heists ( APT38 ) .


The only sample was found on public repositories and almost seemed to indicate a test run to determine the detection ratio of the sample . LYCEUM deployed this tool via DanBot shortly after gaining initial access to a compromised environment . APT38 , in particular , is strongly distinguishable because of its specific focus on financial institutions and operations that attempt to use SWIFT fraud to steal millions of dollars at a time .


We have observed this trojan being submitted to public antivirus testing platforms , once as a package and once for each DLL to determine the detection ratio . LYCEUM delivers weaponized maldocs via spearphishing from the compromised accounts to the targeted executives , human resources (HR) staff , and IT personnel . We can confirm that the APT38 operator activity is linked to the North Korean regime , but maintains a set of common characteristics , including motivation , malware , targeting , and TTPs that set it apart from other statesponsored operations .


The sample analyzed was targeted at Russian-speaking users , as most of the user interaction pages are written in Russian . This focus on training aligns with LYCEUM’s targeting of executives , HR staff , and IT personnel . As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions to raise money for the North Korean regime .


However , given the way the trojan is built , it is highly customizable , meaning that adapting it to a different language would be extremely easy . Despite the initial perception that the maldoc sample was intended for ICS or OT staff , LYCEUM has not demonstrated an interest in those environments . As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions and financial systems to raise money for the North Korean regime .


The wide range of capabilities does n't limit this trojan to a specific malicious activity like a banking trojan or a ransomware . However , CTU researchers cannot dismiss the possibility that the LYCEUM could seek access to OT environments after establishing robust access to the IT environment . Although the APT38 's primary targets appear to be Financial Exchange banks and other financial organizations , they have also Financial Exchange targeted countries ' media organizations with a focus on the financial sector .


This makes it impossible to create a target profile . LYCEUM is an emerging threat to energy organizations in the Middle East , but organizations should not assume that future targeting will be limited to this sector . Since at least the beginning of 2014 , APT38 operations have focused almost exclusively on developing and conducting financially motivated campaigns targeting international entities , whereas TEMP.Hermit is generally linked to operations focused on South Korea and the United States .


Conclusion This trojan shows a new path for threats to evolve . Aside from deploying novel malware , LYCEUM’s activity demonstrates capabilities CTU researchers have observed from other threat groups and reinforces the value of a few key controls . TEMP.Hermit is generally linked to operations focused on South Korea and the United States .


Having the ability to move code from desktops to mobile platforms with no effort , like the eCommon.DLL demonstrates that malicious actors can create hybrid threats faster and with fewer resources involved than ever before . Password spraying , DNS tunneling , social engineering , and abuse of security testing frameworks are common tactics , particularly from threat groups operating in the Middle East . While North Korean cyber operations against specific countries may have been driven by diplomatic factors and perceived insults against Pyongyang , the application of increasingly restrictive and numerous financial sanctions against North Korea probably contributed to the formation of APT38 .


This trojan 's design and implementation is of an uncommonly high level , making it a dangerous threat . The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations . APT38 's operations began in February 2014 and were likely influenced by financial sanctions enacted in March 2013 that blocked bulk cash transfers and restricted North Korea 's access to international banking systems .


These kinds of threats will become more common , as more and more companies decide to publish their software directly to consumers . Machete is still very active at the time of this publication , regularly introducing changes to its malware , infrastructure and spearphishing campaigns . APT37 ( Reaper ) , another North Korean state-sponsored group , targeted a Middle Eastern financial company , but there was no evidence of financial fraud .


There have been several recent examples of companies choosing to release their software directly to consumers , bypassing traditional storefronts . ESET has been tracking a new version of Machete (the group’s Python-based toolset) that was first seen in April 2018 . APT37 , another North Korean state-sponsored group , targeted a Middle Eastern financial company , but there was no evidence of financial fraud .


The average user might not have the necessary skills to distinguish legitimate sites from malicious ones . This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted with the Machete malware . Early APT38 operations suggest that the group began targeting financial institutions with an intent to manipulate financial transaction systems at least as early as February 2014 , although we did not observe fraudulent transactions until 2015 .


We 've seen that this has been the case for many years with spear-phishing campaigns on desktop and mobile platforms , so , unfortunately , it does n't seem that this will change any time soon . Their long run of attacks , focused on Latin American countries , has allowed them to collect intelligence and refine their tactics over the years . We do not have evidence that the earliest targeted financial institutions were victimized by fraudulent transactions before APT38 left the compromised environments , possibly indicating that APT38 was conducting reconnaissance-only activity at that time .


And this just means attackers will continue to be successful . Machete is interested in files that describe navigation routes and positioning using military grids . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank .


Coverage Additional ways our customers can detect and block this threat are listed below . The Machete group sends very specific emails directly to its victims , and these change from target to target . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank .


Advanced Malware Protection ( AMP ) is ideally suited to prevent the execution of the malware used by these threat actors . The Machete group is very active and has introduced several changes to its malware since a new version was released in April 2018 . From November 2015 through the end of 2016 , APT38 was involved in at least nine separate compromises against banks .


Cisco Cloud Web Security ( CWS ) or Web Security Appliance ( WSA ) web scanning prevents access to malicious websites and detects malware used in these attacks . Previous versions were described by Kaspersky in 2014 and Cylance in 2017 . Per the complaint , the email account watsonhenny@gmail.com was used to send LinkedIn invitations to employees of a bank later targeted by APT38 .


Email Security can block malicious emails sent by threat actors as part of their campaign . Since August 2018 , the Machete components have been delivered with an extra layer of obfuscation . Further , the recent DOJ complaint provides insight into initial compromise techniques conducted by North Korean operators against APT38 targets , which may have been leveraged as part of the initial compromise into the targeted organizations .


Network Security appliances such as Next-Generation Firewall ( NGFW ) , Next-Generation Intrusion Prevention System ( NGIPS ) , and Meraki MX can detect malicious activity associated with this threat . The GoogleUpdate.exe component is responsible for communicating with the remote C&C server . This is corroborated by our identification of TEMP.Hermit 's use of MACKTRUCK at a bank , preceding the APT38 operation targeting the bank 's SWIFT systems in late 2015 .


AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products . ESET has been tracking this threat for months and has observed several changes , sometimes within weeks . APT38 relies on DYEPACK , a SWIFT transaction-hijacking framework , to initiate transactions , steal money , and hide any evidence of the fraudulent transactions from the victimized bank .


Umbrella , our secure internet gateway ( SIG ) , blocks users from connecting to malicious domains , IPs , and URLs , whether users are on or off the corporate network . This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries . The APT38 uses DYEPACK to manipulate the SWIFT transaction records and hide evidence of the malicious transactions , so bank personnel are none the wiser when they review recent transactions .


Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org . The presence of code to exfiltrate data to removable drives when there is physical access to a compromised computer may indicate that Machete operators could have a presence in one of the targeted countries , although we cannot be certain . During this heist , APT38 waited for a holiday weekend in the respective countries to increase the likelihood of hiding the transactions from banking authorities .


Indicators of compromise ( IOC ) URLs hxxp : //5.9.33.226:5416 hxxp : //172.110.10.171:85/testcc.php hxxp : //sub1.tdsworker.ru:5555/3ds/ Hash values Package.apk - A342a16082ea53d101f556b50532651cd3e3fdc7d9e0be3aa136680ad9c6a69f eCommon.dl - 604deb75eedf439766896f05799752de268baf437bf89a7185540627ab4a4bd1 This group is very active and continues to develop new features for its malware , and implement infrastructure changes in 2019 . During one reported incident , APT38 caused an outage in the bank 's essential services .


Reznov.dll - 17b8665cdbbb94482ca970a754d11d6e29c46af6390a2d8e8193d8d6a527dec3 Custom activity prefix com.cact.CAct Cerberus - A new banking Trojan from the underworld August 2019 In June 2019 , ThreatFabric analysts found a new Android malware , dubbed “ Cerberus ” , being rented out on underground forums . Machete's long run of attacks , focused in Latin American countries , has allowed them to collect intelligence and refine their tactics over the years . We attribute APT38 to North Korean state-sponsored operators based on a combination of technical indicators linking the activity to Pyongyang and details released by DOJ implicating North Korean national Park Jin Hyok in a criminal conspiracy .


Its authors claim that it was used for private operations for two years preceding the start of the rental . ESET researchers have detected an ongoing , highly targeted campaign , with a majority of the targets being military organizations . As detailed in the DOJ complaint , a sample of WHITEOUT malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank .


They also state that the code is written from scratch and is not using parts of other existing banking Trojans unlike many other Trojans that are either based completely on the source of another Trojan ( such as the leaked Anubis source code that is now being resold ) or at least borrow parts of other Trojans . The group behind Machete uses effective spearphishing techniques . APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition .


After thorough analysis we can confirm that Cerberus was indeed not based on the Anubis source code . First described by Kaspersky in 2014 [1] and later , by Cylance in 2017 [2] , Machete is a piece of malware found to be targeting high profile individuals and organizations in Latin American countries . APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition .


One peculiar thing about the actor group behind this banking malware is that they have an “ official ” twitter account that they use to post promotional content ( even videos ) about the malware . In 2018 Machete reappeared with new code and new features . APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition .


Oddly enough they also use it to make fun of the AV community , sharing detection screenshots from VirusTotal ( thus leaking IoC ) and even engaging in discussions with malware researchers directly The following screenshot shows tweets from their advertisement campaign : That unusual behavior could be explained by the combination of the need for attention and a probable lack of experience . As of June 2019 , ESET has seen over 50 victims being actively spied upon by Machete , with more than half of them being computers belonging to the Venezuelan military forces . Malware overlaps between APT38 and TEMP.Hermit highlight the shared development resources accessible by multiple operational groups linked to North Korean state-sponsored activity .


What is sure is that the gap in the Android banking malware rental business left open after the rental of the Anubis 2 and RedAlert 2 Trojans ended provides a good opportunity for the actors behind Cerberus to grow their business quickly . Machete has Latin American targets and has been developed by a Spanish-speaking group , presumably from a LATAM country . APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry .


The Android banking Trojan rental business Rental of banking Trojans is not new . Machete was active and constantly working on very effective spearphishing campaigns . This is evidence of shared motivation and intent to target the SWIFT system by the North Korean operators performing the reconnaissance and APT38 which later targeted that organization .


It was an existing business model when computer-based banking malware was the only form of banking malware and has shifted to the Android equivalent a few years later . In some cases , Machete trick new victims by sending real documents that had been stolen on the very same day . Although APT38 is distinct from other TEMP.Hermit activity , both groups operate consistently within the interests of the North Korean state .


The life span of Android banking malware is limited to either the will of its author ( s ) to support it or the arrest of those actors . Machete relies on spearphishing to compromise its targets . Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea .


This malware-life-cycle has been observed to reoccur every few years , bringing new malware families into light . They seem to have specialized knowledge about military operations , as they are focused on stealing specific files such as those that describe navigation routes . As detailed in the DOJ complaint , a sample of WHITEOUT ( aka Contopee ) malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank .


Each time a rented malware reaches the end of its life it provides the opportunity for other actors a to take over the malware rental market-share . Attackers take advantage of that , along with their knowledge of military jargon and etiquette , to craft very convincing phishing emails . Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea 's Reconnaissance General Bureau ( RGB ) .


As visible on following chart , the lifespan of many well-known rented Android bankers is usually no more than one or two years . Operators behind Machete apparently already have information about individuals or organizations of interest to them in Latin America , how to reach them , and how best to trick them into getting compromised . APT38 .


When the family ceases to exist a new one is already available to fill the void , proving that the demand for such malware is always present and that therefore Cerberus has a good chance to survive . Since the end of March up until the end of May 2019 , ESET observed that there were more than 50 victimized computers actively communicating with the C&C server . As detailed in the DOJ complaint , a sample of WHITEOUT ( aka Contopee ) malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank .


After the actor behind RedAlert 2 decided to quit the rental business , we observed a surge in Anubis samples in the wild . This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted by Machete . APT38 's targeting of financial institutions is most likely an effort by the North Korean government to supplement their heavily-sanctioned economy .


After the Anubis actor was allegedly arrested and the source code was leaked there was also huge increase in the number of Anubis samples found in the wild , but the new actors using Anubis have no support or updates . Machete is malware that has been developed and is actively maintained by a Spanish-speaking group . We have moderate confidence APT39 operations are conducted in support of Iranian national interests based on regional targeting patterns focused in the Middle East .


Due to this Cerberus will come in handy for actors that want to focus on performing fraud without having to develop and maintain a botnet and C2 infrastructure . Since it was active in 2012 , it has been carrying out attacks against sensitive targets in China and is one of the most active APT attack organizations targeting mainland China in recent years . APT39 's focus on the widespread theft of personal information sets it apart from other Iranian groups FireEye tracks , which have been linked to influence operations , disruptive attacks , and other threats .


Analysis of evasion techniques Along with the standard payload and string obfuscation , Cerberus uses a rather interesting technique to prevent analysis of the Trojan . By introducing small changes to their code and infrastructure , the group has bypassed several security products . APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns .


Using the device accelerometer sensor it implements a simple pedometer that is used to measure movements of the victim . OceanLotus will release malicious sub-packages in the background , receive the remote control command , steal the privacy information of users such as SMS messages , contacts , call records , geographic locations , and browser records . Other groups attributed to Iranian attackers , such as Rocket Kitten , have targeted Iranian individuals in the past , including anonymous proxy users , researchers , journalists , and dissidents .


The idea is simple - if the infected device belongs to a real person , sooner or later this person will move around , increasing the step counter . They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . Remexi is a basic back door Trojan that allows Cadelle to open a remote shell on the computer and execute commands .


The Trojan uses this counter to activate the bot - if aforementioned step counter hits the pre-configured threshold it considers running on the device to be safe . It can be seen that after the code leakage , the CEO of the HackingTeam organization said that the leaked code is only a small part is based on the facts , which also reflects that the network arms merchants have lowered the threshold of APT attacks to a certain extent , making more uncertainties of cyber attacks . Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands .


This simple measure prevents the Trojan from running and being analyzed in dynamic analysis environments ( sandboxes ) and on the test devices of malware analysts . This report includes details related to the major hacking targets of the SectorJ04 group in 2019 , how those targets were hacked , characteristics of their hacking activities this year and recent cases of the SectorJ04 group’s hacking . One group , which we call Cadelle , uses Backdoor.Cadelspy , while the other , which we've named Chafer , uses Backdoor.Remexi and Backdoor.Remexi.B .


The code responsible for this verification is shown in the following snippet : How it works When the malware is first started on the device it will begin by hiding its icon from the application drawer . In 2019 , the SectorJ04 group expanded its hacking activities to cover various industrial sectors located across Southeast Asia and East Asia , and is changing the pattern of their attacks from targeted attacks to searching for random victims . APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol ( RDP ) , Secure Shell ( SSH ) , PsExec , RemCom , and xCmdSvc .


Then it will ask for the accessibility service privilege as visible in the following screenshot : After the user grants the requested privilege , Cerberus starts to abuse it by granting itself additional permissions , such as permissions needed to send messages and make calls , without requiring any user interaction . The SectorJ04 group has maintained the scope of its existing hacking activities while expanding its hacking activities to companies in various industrial sectors located in East Asia and Southeast Asia . The APT39 were using an improved version of Remexi in what the victimology suggests might be a domestic cyber-espionage operation .


It also disables Play Protect ( Google ’ s preinstalled antivirus solution ) to prevent its discovery and deletion in the future . There was a significant increase in SectorJ04's hacking activities in 2019 , especially those targeting South Korea . A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group .


After conveniently granting itself additional privileges and securing its persistence on the device , Cerberus registers the infected device in the botnet and waits for commands from the C2 server while also being ready to perform overlay attacks . They mainly utilize spam email to deliver their backdoor to the infected system that can perform additional commands from the attacker’s server . A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group .


The commands supported by the analyzed version of the Cerberus bot are listed below . We saw SectorJ04 group activity in Germany , Indonesia , the United States , Taiwan , India . The Middle Eastern hacker group in this case is codenamed " BlackOasis " .


As can be seen , the possibilities offered by the bot are pretty common . The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system . Kaspersky found the BlackOasis group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


Command Description push Shows a push notification . The SectorJ04 group’s preexisting targets were financial institutions located in countries such as North America and Europe , or general companies such as retail and manufacturing , but they recently expanded their areas of activity to include the medical , pharmaceutical , media , energy and manufacturing industries . Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


Clicking on thenotification will result in launching a specified app startApp Starts the specified application getInstallApps Gets the list of installedapplications on the infected device getContacts Gets the contact names and phone numbers from the addressbook on the infected device deleteApplication Triggers the deletion of the specified application forwardCall Enables call forwarding to the specified number sendSms Sends a text message with specified text from the infecteddevice to the specified phone number startInject Triggers the overlay attack against the specified application startUssd The SectorJ04 group mainly used their own backdoor , ServHelper and FlawedAmmy RAT , for hacking . BlackOasis ' interests span a wide gamut of figures involved in Middle Eastern politics .


Calls the specified USSD code openUrl Opens the specified URL in the WebView getSMS Gets all text messages from the infected device killMe Triggers the kill switch for the bot updateModule Updates the payload module Cerberus features Cerberus malware has the same capabilities as most other Android banking Trojans such as the use of overlay attacks , SMS control and contact list harvesting . SectorJ04 also used the Remote Manipulator System (RMS) RAT , a legitimate remote management software created in Russia . REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japanese organizations such as government agencies ( including defense ) as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


The Trojan can also leverage keylogging to broaden the attack scope . Backdoors are installed in infected systems and SectorJ04 also distributed email stealers , botnet malware and ransomware through those backdoors . REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


Overall , Cerberus has a pretty common feature list and although the malware seems to have been written from scratch there does not seem to be any innovative functionality at this time . Backdoor installed in the infected system distributed additional botnet malware , ransomware and email stealers . In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets .


For example , some of the more advanced banking Trojans now offer features such as a back-connect proxy , screen-streaming and even remote control . SectorJ04 was recently confirmed to use additional backdoor called AdroMut and FlowerPippi , which is used to install other backdoor such as FlawedAmmy RAT on behalf of the MSI file , or to collect system information and send it to the attacker’s server . In fact , REDBALDKNIGHT has been zeroing in on Japanese organizations as early as 2008 — at least based on the file properties of the decoy documents they've been sending to their targets .


Cerberus embeds the following set of features that allows itself to remain under the radar and successfully perform attacks : Overlaying : Dynamic ( Local injects obtained from C2 ) Keylogging SMS harvesting : SMS listing SMS harvesting : SMS forwarding Device info collection Contact list collection Application listing Location collection Overlaying : Targets list update SMS : Sending Calls : USSD request making Calls : Call forwarding Remote actions : App installing Remote actions : App starting Remote actions : App removal Remote actions : Showing arbitrary web pages Remote actions : Screen-locking Although the SectorJ04 group mainly targeted countries located in Europe or North America , it has recently expanded its field of activities to countries located in Southeast Asia and East Asia . Secureworks® incident responders and Counter Threat Unit™ ( CTU ) researchers investigated activities associated with the BRONZE BUTLER ( also known as Tick ) threat group , which likely originates in the People .


Notifications : Push notifications C2 Resilience : Auxiliary C2 list Self-protection : Hiding the App icon Self-protection : Preventing removal Self-protection : Emulation-detection Architecture : Modular Overlay attack Most Android banking Trojans use overlay attacks to trick the victim into providing their personal information ( such as but not limited to : credit card information , banking credentials , mail credentials ) and Cerberus is no exception . The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format . Targeting data supports the belief that APT39 's key mission is to track or monitor targets of interest , collect personal information , including travel itineraries , and gather customer data from telecommunications firms .


In this particular case , the bot abuses the accessibility service privilege to obtain the package name of the foreground application and determine whether or not to show a phishing overlay window , as shown in the following code snippet : Targets Some examples of phishing overlays are shown below . A new type of backdoor called AdroMut and a new malware called FlowerPippi was also found coming from SectorJ04 . BRONZE BUTLER has used a broad range of publicly available ( Mimikatz and gsecdump ) and proprietary ( Daserf and Datper ) tools .


They exist in two types : the credentials stealers ( first 2 screenshots ) and the credit card grabbers ( last screenshot ) . But after 2019 SectorJ04 has changed its hacking strategy to attack using spam email . BRONZE BUTLER are also fluent in Japanese , crafting phishing emails in native Japanese and operating successfully within a Japanese-language environment .


The only active target list observed in the wild is available in the appendix and contains a total of 30 unique targets . The hacking activities of SectorJ04 group , which targeted South Korea in the first half of 2019 , have been continuously discovered . BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


It is interesting to observe that the actual target list contains : 7 French banking apps 7 U.S. banking apps 1 Japanese banking app 15 non-banking apps This uncommon target list might either be the result of specific customer demand , or due to some actors having partially reused an existing target list . Prior to 2019 , the SectorJ04 group conducted large-scale hacking activities for financial gain using exploit kits on websites to install ransomware , such as Locky and GlobeImporter , along with its banking Trojan , on its victims computers . The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


Conclusion Although not yet mature enough to provide the equivalent of a full-blown set of Android banking malware features ( such as RAT , RAT with ATS ( Automated Transaction Script ) , back-connect proxy , media streaming ) , or providing an exhaustive target list , Cerberus should not be taken lightly . In June 2019 , continuous SectorJ04's activities targeting South Korea were found again and spam emails were written with various contents , including transaction statements , receipts and remittance cards . BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


Due to the current absence of maintained and supported Android banking Malware-as-a-Service in the underground community , there is a certainly demand for a new service . The SectorJ04 group has carried out large-scale hacking activities targeting South Korea , while also expanding the field of attacks to Southeast Asian countries such as Taiwan and the Philippines . The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


Cerberus is already capable to fulfill this demand . In June , SectorJ04 group conducted hacking using spam emails written in various languages , including English , Arabic , Korean and Italian , and the emails were written with various contents , including remittance card , invoice and tax invoice . BRONZE BUTLER uses credential theft tools such as Mimikatz and WCE to steal authentication information from the memory of compromised hosts .


In addition to the feature base it already possesses and the money that can be made from the rental , it could evolve to compete with the mightiest Android banking Trojans . Spam emails and attachments written in Chinese were found in May , and the SectorJ04 group at that time targeted industrial sectors such as electronics and telecommunications , international schools and manufacturing . While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


Next to the features , we expect the target list to be expanded to contain additional ( banking ) apps in the near future . In addition to their preexist backdoor , ServHelper and FlawedAmmy , they have also been confirmed to use the backdoor called AdroMut and FlowerPippi . While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


Knowledge of the threat landscape and implementation of the right detection tools remains crucial to be able to protect yourself from fraud ; Cerberus is yet a new Trojan active in the wild ! AdroMut downloads the malware ServHelper and FlawedAmmy RAT used by the SectorJ04 group from the attacker server and simultaneously performs the functions of a backdoor . Several xxmm samples analyzed by CTU researchers incorporate Mimikatz , allowing BRONZE BUTLER to issue Mimikatz commands directly from xxmm .


Appendix Samples Some of the latest Cerberus samples found in the wild : App name Package name SHA 256 hash Flash Player com.uxlgtsvfdc.zipvwntdy 728a6ea44aab94a2d0ebbccbf0c1b4a93fbd9efa8813c19a88d368d6a46b4f4f Flash Player com.ognbsfhszj.hqpquokjdp fe28aba6a942b6713d7142117afdf70f5e731c56eff8956ecdb40cdc28c7c329 The SectorJ04 group , which has been utilizing the same pattern of infection and the same malware for more than six months , is believed to be attempting to change its infection methods such as downloading malware directly from malicious documents without using MSI installation files , changing their spam email format and using new types of backdoor . BRONZE BUTLER compromises organizations to conduct cyberespionage , primarily focusing on Japan .


Flash Player com.mwmnfwt.arhkrgajn ffa5ac3460998e7b9856fc136ebcd112196c3abf24816ccab1fbae11eae4954c Flash Player com.wogdjywtwq.oiofvpzpxyo 6ac7e7ed83b4b57cc4d28f14308d69d062d29a544bbde0856d5697b0fc50cde4 Flash Player com.hvdnaiujzwo.fovzeukzywfr Until 2019 , SectorJ04 group had carried out massive website-based hacking activities that mainly utilize ransomware and banking trojans for financial profit , and has also been carrying out information gathering activities to secure attack resources such as email accounts and system login information from users since 2019 . Symantec discovered the most recent wave of Tick attacks in July 2015 , when the group compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .