This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005 .


PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched . If the hypothesis is correct and the Turla threat group is using Kazuar , we believe they may be using it as a replacement for Carbon and its derivatives .


PROMETHIUM and NEODYMIUM both used a zero-day exploit that executed code to download a malicious payload . We used a combination of tools such as NoFuserEx , ConfuserEx Fixer , ConfuserEx Switch Killer , and de4d0t in order to deobfuscate the code for in depth analysis .


NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used , prior to public knowledge of the vulnerability 's existence . Kazuar generates its mutex by using a process that begins with obtaining the MD5 hash of a string " [username]=>singleton-instance-mutex " .


In May 2016 , two apparently unrelated activity groups , PROMETHIUM and NEODYMIUM , conducted attack campaigns in Europe that used the same zeroday exploit while the vulnerability was publicly unknown . The subject is a series of targeted attacks against private companies .


The Middle Eastern hacker group in this case is codenamed " BlackOasis " Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . e uncovered the activity of a hacking group which has Chinese origins .


The discovery by Kaspersky marks at least the fifth zero-day exploit used by BlackOasis and exposed by security researchers since June 2015 . Also , by creating this type of API access , Turla could use one accessible server as a single point to dump data to and exfiltrate data from .


Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14 , 2017 , FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East . According to our estimations , this group has been active for several years and specializes in cyberattacks against the online video game industry .


The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 . Based on our analysis , we believe that threat actors may compile Windows and Unix based payloads using the same code to deploy Kazuar against both platforms .


In this latest campaign , APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER . The group 's main objective is to steal source codes .


During the past few months , APT34 has been able to quickly incorporate exploits for at least two publicly vulnerabilities ( CVE-2017-0199 and CVE-2017-11882 ) to target organizations in the Middle East . In 2010 HBGary investigated an information security incident related to the Winnti group at one of HBGary 's customers – an American video game company .


In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch . In 2010 US-based HBGary investigated an information security incident related to the Winnti group at one of HBGary 's customers – an American video game company .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . For a long time the Winnti group had been considered as a Chinese threat actor targeting gaming companies specifically .


Specifically , Suckfly used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows . In April Novetta released its excellent report on the Winnti malware spotted in the operations of Axiom group .


This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . The Axiom group has been presented as an advanced Chinese threat actor carrying out cyber-espionage attacks against a whole range of different industries .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . this library includes two drivers compiled on August 22 and September 4 , 2014 .


Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 . Also our visibility as a vendor does not cover every company in the world ( at least so far ; ) ) and the Kaspersky Security Network ( KSN ) did not reveal other attacks except those against gaming companies .


TG-3390 uses older exploits to compromise targets , and CTU researchers have not observed the threat actors using zero-day exploits as of this publication . Conversely , LokiBot and Agent Tesla are new malware tools .


TG-3390 actors have used Java exploits in their SWCs . Based on multiple active compromises by the Axiom threat group , Novetta was able to capture and analyze new Winnti malware samples .


In particular , TG-3390 has exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code . Initial attack targets are commonly software and gaming organizations in United States , Japan , South Korea , and China .


In particular , the threat actors have exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code . Initial attack targets are commonly software and gaming organizations in United States , Japan , South Korea , and China .


TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems . The samples Novetta obtained from the active Axiom infection were compiled in mid- to late 2014 and represent what Novetta is referring to as version 3.0 of the Winnti lineage .


Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 ( Microsoft Office Equation Editor , widely used by Chinese-speaking actors since December 2017 ) , we can′t prove they were related to this particular attack . We assess with high confidence that the Winnti umbrella is associated with the Chinese state intelligence apparatus , with at least some elements located in the Xicheng District of Beijing .


LuckyMouse has been spotted using a widely used Microsoft Office vulnerability ( CVE-2017-11882 ) . The Winnti umbrella continues to operate highly successfully in 2018 .


No zero-day vulnerabilities were used to breach targeted networks , instead " TG-3390 relied on old vulnerabilities such as CVE-2011-3544 " — a near-year-old Java security hole — " and CVE-2010-0738 to compromise their targets " , Dell SecureWorks' researchers reported . The Winnti umbrella and closely associated entities has been active since at least 2009 .


Execute a command through exploits for CVE-2017-11882 . The Winnti and Axiom group names were created by Kaspersky Lab and Symantec , respectively , for their 2013/2014 reports on the original group .


Execute a command through exploits for CVE-2018-0802 . Their operations against gaming and technology organizations are believed to be economically motivated in nature .


The document attached to this e-mail exploits CVE-2012-0158 . However , based on the findings shared in this report we assess with high confidence that the actor 's primary long-term mission is politically focused .


Tropic Trooper is also still exploiting CVE-2012-0158 , as are many threat actors . The Winnti umbrella and linked groups' initial targets are gaming studios and high tech businesses .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . During the same time period , we also observed the actor using the Browser Exploitation Framework ( BeEF ) to compromise victim hosts and download Cobalt Strike .


the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated . In this campaign , the attackers experimented with publicly available tooling for attack operations .


While we were unable to recover the initial vulnerability used , it is possibly the same CVE-2014-0515 Adobe Flash exploit first reported by Cisco TRAC in late July . The primary goal of these attacks was likely to find code-signing certificates for signing future malware .


However , to increase success rates APT20 can use zero-day exploits , so even a properly patched system would be compromised . The Chinese intelligence apparatus has been reported on under many names , including Winnti , PassCV , APT17 , Axiom , LEAD , Barium , Wicked Panda , and GREF .


PLEAD also dabbled with a short-lived , fileless version of their malware when it obtained an exploit for a Flash vulnerability ( CVE-2015-5119 ) that was leaked during the Hacking Team breach . The attackers behind observed activity in 2018 operate from the Xicheng District of Beijing via the net block 221.216.0.0/13 .


PLEAD also uses CVE-2017-7269 , a buffer overflow vulnerability Microsoft Internet Information Services ( IIS ) 6.0 to compromise the victim 's server . ALLANITE activity closely resembles Palmetto Fusion described by the US Department of Homeland Security ( DHS ) .


Kaspersky Lab has detected a new method of first infection that uses a drive-by-download with a flash exploit ( CVE-2015-5119 , the one leaked from The Hacking Team incident ) . ALLANITE activity closely resembles Palmetto Fusion described by the US Department of Homeland Security .


If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros . ALLANITE uses email phishing campaigns and compromised websites called watering holes to steal credentials and gain access to target networks , including collecting and distributing screenshots of industrial control systems .


Moreover , they used the same exploit kit Niteris as that in the Corkow case . In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group Symantec calls Dragonfly ( which Dragos associates with DYMALLOY ) .


The CVE-2012-0773 was originally discovered by VUPEN and has an interesting story . In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group .


The decoy documents used by the InPage exploits suggest that the targets are likely to be politically or militarily motivated . We assess with high confidence that the attackers discussed here are associated with the Chinese state intelligence apparatus .


While documents designed to exploit the InPage software are rare , they are not new – however in recent weeks Unit42 has observed numerous InPage exploits leveraging similar shellcode , suggesting continued use of the exploit previously discussed by Kaspersky . ALLANITE operations limit themselves to information gathering and have not demonstrated any disruptive or damaging capabilities .


Compared to Patchwork , whose Trojanized documents exploit at least five security flaws , Confucius' backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 . In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group Symantec calls Dragonfly .


Lately , Patchwork has been sending multiple RTF files exploiting CVE-2017-8570 . Public disclosure by third-parties , including the DHS , associate ALLANITE operations with Russian strategic interests .


Confucius' backdoors are delivered through Office documents exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 . ALLANITE conducts malware-less operations primarily leveraging legitimate and available tools in the Windows operating system .


The sctrls backdoor we came across is delivered via RTF files exploiting CVE-2015-1641 . Dragos does not publicly describe ICS activity group technical details except in extraordinary circumstances in order to limit tradecraft proliferation .


The documents that exploit CVE2017-11882 download another payload — an HTML Application ( HTA ) file toting a malicious Visual Basic ( VBS ) script — from the server , which is executed accordingly by the command-line tool mshta.exe . However , full details on ALLANITE and other group tools , techniques , procedures , and infrastructure is available to network defenders via Dragos WorldView .


Hackers use the exploits " Nitris Exploit Kit " ( earlier known as CottonCastle ) , which is not available in open sources and sold only to trusted users . In addition to maritime operations in this region , Anchor Panda also heavily targeted western companies in the US , Germany , Sweden , the UK , and Australia , and other countries involved in maritime satellite systems , aerospace companies , and defense contractors .


Hackers first actively spread bots using the Niteris exploit , and then search for infected devices at banks amongst their bots by analyzing IP addresses , cracked passwords and results of the modules performance . A current round of cyber-attacks from Chinese source groups are targeting the maritime sector in an attempt to steal technology .


In August 2014 , some of our users observed targeted attacks with a variation of CVE-2012-0158 and an unusual set of malware . PLA Navy Anchor Panda is an adversary that CrowdStrike has tracked extensively over the last year targeting both civilian and military maritime operations in the green/brown water regions primarily in the LOC of operations of the South Sea Fleet of the PLA Navy .


Longhorn , which we internally refer to as " The Lamberts " , first came to the attention of the ITSec community in 2014 , when our colleagues from FireEye discovered an attack using a zero day vulnerability ( CVE-2014-4148 ) . ALLANITE operations continue and intelligence indicates activity since at least May 2017 .


The first time the Lambert family malware was uncovered publicly was in October 2014 , when FireEye posted a blog about a zero day exploit ( CVE-2014-4148 ) used in the wild . APT Anchor Panda is a Chinese threat actor group who target maritime operations .


While in most cases the infection vector remains unknown , the high profile attack from 2014 used a very complex Windows TTF zero-day exploit ( CVE-2014-4148 ) . According to cyber security researchers , Anchor Panda , who work directly for the Chinese PLA Navy , likely remains active .


To further exemplify the proficiency of the attackers leveraging the Lamberts toolkit , deployment of Black Lambert included a rather sophisticated TTF zero day exploit , CVE-2014-4148 . Dragos does not corroborate nor conduct political attribution to threat activity .


This sample was also found to be deployed using the CVE-2012-0158 vulnerability . In the past they used Adobe Gh0st , Poison Ivy and Torn RAT malware as their primary attack vector is sphere phishing .


Our analysis shows that actors attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . Their targets are marine companies that operate in and around the South China Sea , an LOC of much Chinese interest .


Unit 42 's analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . As recently as this past week , researchers observed Chinese hackers escalating cyber-attack efforts to steal military research secrets from US universities .


Our analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . The cyber-espionage campaign has labelled the group Advanced Persistent Threat ( APT ) 40 or , titled , Periscope .


In this report , we'll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . The group has been active since at least January 2013 .


In this report , we'll review how NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . The group has also targeted businesses operating in the South China Sea , which is a strategically important region and the focus of disputes between China and other states .


In this report , we'll review how the NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . The main targets seem to be US companies in engineering , transport and defense , although it has targeted other organizations around the world .


Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit.MSWord.CVE-2010-333 , Exploit.Win32.CVE-2012-0158 . The times of day the group is active also suggests that it is based near Beijing and the group has reportedly used malware that has been observed in other Chinese operations , indicating some level of collaboration .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Periscope 's activity has previously been suspected of being linked to China , but now researchers believe their evidence links the operation to the Chinese state .


Earlier this month , Securelist 's technology caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . APT40 is described as a moderately sophisticated cyber-espionage group which combines access to significant development resources with the ability to leverage publicly available tools .


Operation Daybreak appears to have been launched by ScarCruft in March 2016 and employs a previously unknown ( 0-day ) Adobe Flash Player exploit . Anchor Panda uses website and web-server compromise as a means of attack and leverages an enormous cache of tools in its campaigns , to include exploits that take advantage of known CVE software vulnerabilities .


Adobe Flash Player exploit . Like many espionage campaigns , much of APT40 's activity begins by attempting to trick targets with phishing emails , before deploying malware such as the Gh0st RAT trojan to maintain persistence on a compromised network .


It is also possible that ScarCruft deployed another zero day exploit , CVE-2016-0147 , which was patched in April . The group uses website and web-server compromise as a means of attack and leverages an enormous cache of tools in its campaigns , to include exploits that take advantage of known CVE software vulnerabilities .


Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . More than half of the organizations we have observed being targeted or breached by APT5 operate in these sectors .


ScarCruft 's Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . APT5 has been active since at least 2007 .


Nevertheless , resourceful threat actors such as ScarCruft will probably continue to deploy zero-day exploits against their high profile targets . APT5 has targeted or breached organizations across multiple industries , but its focus appears to be on telecommunications and technology companies , especially information about satellite communications .


This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams . APT5 targeted the network of an electronics firm that sells products for both industrial and military applications .


Earlier this month , we caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . The group subsequently stole communications related to the firm 's business relationship with a national military , including inventories and memoranda about specific products they provided .


The other one , ScarCruft 's Operation Erebus employs an older exploit , for CVE-2016-4117 and leverages watering holes . In one case in late 2014 , APT5 breached the network of an international telecommunications company .


The other one , " Operation Erebus " employs an older exploit , for CVE-2016-4117 and leverages watering holes . The group used malware with keylogging capabilities to monitor the computer of an executive who manages the company 's relationships with other telecommunications companies .


The ScarCruft APT gang has made use of a Flash zero day patched Thursday by Adobe to attack more than two dozen high-profile targets in Russia and Asia primarily . APT5 also targeted the networks of some of Southeast Asia 's major telecommunications providers with Leouncia malware .


Adobe on Thursday patched a zero-day vulnerability in Flash Player that has been used in targeted attacks carried out by a new APT group operating primarily against high-profile victims in Russia and Asia . We suspect that the group sought access to these networks to obtain information that would enable it to monitor communications passing through the providers' systems .


Researchers at Kaspersky Lab privately disclosed the flaw to Adobe after exploits against the zero-day were used in March by the ScarCruft APT gang in what Kaspersky Lab is calling Operation Daybreak . The FBI said the " group of malicious cyber actors " ( known as APT6 or 1.php ) used dedicated top-level domains in conjunction with the command and control servers to deliver " customized malicious software " to government computer systems .


Kaspersky speculates that ScarCruft could also be behind another zero-day , CVE-2016-0147 , a vulnerability in Microsoft XML Core Services that was patched in April . Deepen told Threatpost the group has been operating since at least since 2008 and has targeted China and US relations experts , Defense Department entities , and geospatial groups within the federal government .


Another set of attacks called Operation Erebus leverages another Flash exploit , CVE-2016-4117 , and relies on watering hole attacks as a means of propagation . Government officials said they knew the initial attack occurred in 2011 , but are unaware of who specifically is behind the attacks .


Thursday 's Flash Player update patched 36 vulnerabilities in total including the zero day CVE-2016-4171 . According to Deepen , APT6 has been using spear phishing in tandem with malicious PDF and ZIP attachments or links to malware infected websites that contains a malicious SCR file .


Wild Neutron 's attacks in 2015 uses a stolen code signing certificate belonging to Taiwanese electronics maker Acer and an unknown Flash Player exploit . Nearly a month later , security experts are now shining a bright light on the alert and the mysterious group behind the attack .


Wild Neutron 's attack took advantage of a Java zero-day exploit and used hacked forums as watering holes . The attacks discussed in this blog are related to an APT campaign commonly referred to as " th3bug " , named for the password the actors often use with their Poison Ivy malware .


Instead of Flash exploits , older Wild Neutron exploitation and watering holes used what was a Java zero-day at the end of 2012 and the beginning of 2013 , detected by Kaspersky Lab products as Exploit.Java.CVE-2012-3213.b . Over the summer they compromised several sites , including a well-known Uyghur website written in that native language .


In that case , we observed Buhtrap using a local privilege escalation exploit , CVE-2019-1132 , against one of its victims . In contrast to many other APT campaigns , which tend to rely heavily on spear phishing to gain victims , " th3bug " is known for compromising legitimate websites their intended visitors are likely to frequent .


Prior to that report , we published detail analysis on malware exploiting CVE-2018-8414 vulnerability (remote code execution in SettingContent-ms) , which is believed a work of DarkHydrus . While we were unable to recover the initial vulnerability used , it is possibly the same CVE-2014-0515 Adobe Flash exploit first reported by Cisco TRAC in late July .


WannaCry incorporated the leaked EternalBlue exploit that used two known vulnerabilities in Windows CVE-2017-0144 and CVE-2017-0145 to turn the ransomware into a worm , capable of spreading itself to any unpatched computers on the victim's network and also to other vulnerable computers connected to the internet . However , to increase success rates APT20 can use zero-day exploits , so even a properly patched system would be compromised .


One vulnerability is a Windows zero-day vulnerability (CVE-2019-0703) discovered by Symantec . Our direct observation of in-the-wild spearphishing attacks staged by the Bahamut group have been solely attempts to deceive targets into providing account passwords through impersonation of notices from platform providers .


Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 .


The second Windows vulnerability (CVE-2017-0143) was patched in March 2017 after it was discovered to have been used by two exploit tools—EternalRomance and EternalSynergy—that were also released as part of the Shadow Brokers leak . Later that month , the same tactics and patterns were seen in attempts against an Iranian women 's activist – an individual commonly targeted by Iranian actors , such as Charming Kitten and the Sima campaign documented in our 2016 Black Hat talk .


These include CVE-2010-3962 as part of an attack campaign in 2010 and CVE-2014-1776 in 2014 . In June we published on a previously unknown group we named " Bahamut " , a strange campaign of phishing and malware apparently focused on the Middle East and South Asia .


Beginning in August 2016 , a group calling itself the Shadow Brokers began releasing tools it claimed to have originated from the Equation Group . Once inside a network , APT40 uses credential-harvesting tools to gain usernames and passwords , allowing it to expand its reach across the network and move laterally through an environment as it moves to towards the ultimate goal of stealing data .


The zero-day vulnerability found and reported by Symantec (CVE-2019-0703) occurs due to the way the Windows SMB Server handles certain requests . Bahamut was shown to be resourceful , not only maintaining their own Android malware but running propaganda sites , although the quality of these activities varied noticeably .


CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 . In June we published on a previously unknown group we named " Bahamut " , a strange campaign of phishing and malware apparently focused on the Middle East and South Asia .


this RTF exploits again the CVE-2017_1882 on eqnedt32.exe . Several times , APT5 has targeted organizations and personnel based in Southeast Asia .


At this time , we do not believe that the attackers found a new ASA exploit . However , in the same week of September a series of spearphishing attempts once again targeted a set of otherwise unrelated individuals , employing the same tactics as before .


We believe the groups moved to use CVE-2018-0798 instead of the other Microsoft Equation Editor Remote Code Execution (RCE) vulnerabilities because the former is more reliable as it works on all known versions of Equation Editor . Our primary contribution in this update is to implicate Bahamut in what are likely counterterrorism-motivated surveillance operations , and to further affirm our belief that the group is a hacker-for-hire operation .


The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 . As we wrote then , compared to Kingphish , Bahamut operates as though it were a generation ahead in terms of professionalism and ambition .


After further analysis , it was discovered that the RTF files were exploiting the CVE-2018-0798 vulnerability in Microsoft’s Equation Editor (EQNEDT32) . In the Bahamut report , we discussed two domains found within our search that were linked with a custom Android malware agent .


Anomali Researchers were able to identify multiple samples of malicious RTF documents ITW using the same exploit for CVE-2018-0798 . After the publication of the original report , these sites were taken offline despite the fact that one agent was even updated a six days prior to our post ( the " Khuai " application ) .


CVE-2018-0798 is an RCE vulnerability , a stack buffer overflow that can be exploited by a threat actor to perform stack corruption . FIF is notable for its links to the Lashkar-e-Taiba ( LeT ) terrorist organization , which has committed mass-casualty attacks in India in support of establishing Pakistani control over the disputed Jammu and Kashmir border region .


As observed previously with CVE-2017-11882 and CVE-2018-0802 , the weaponizer was used exclusively by Chinese cyber espionage actors for approximately one year December 2017 through December 2018 , after which cybercrime actors began to incorporate it in their malicious activity . As a result , it is already flagged as Bahamut by antivirus engines .


Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer . Our initial observation of the Bahamut group originated from in-the-wild attempts to deceive targets into providing account passwords through impersonation of platform providers .


These findings also suggest that the threat groups have robust exploit developing capabilities because CVE-2018-0798 is not widely reported on and it is typically not incorporated into publicly available weaponizers . One curious trait of Bahamut is that it develops fully-functional applications in support of its espionage activities , rather than push nonfunctional fake apps or bundle malware with legitimate software .


Upon opening of the MS Word document , our embedded file exploits CVE-2017-11882 to drop a malicious fake Norton Security Shell Extension module , 'NavShExt.dll' , which is then injected into iexplore.exe to install the backdoor , begin collection , and activate command and control . Curiously , Bahamut appears to track password attempts in response to failed phishing attempts or to provoke the target to provide more passwords .


Moving through the infection process , NetWitness Endpoint detects the initial exploit CVE-2017-1182 in action as the Microsoft Equation Editor , EQNEDT32.exe , scores high for potentially malicious activity . Bahamut spearphishing attempts have also been accompanied with SMS messages purporting to be from Google about security issues on their account , including a class 0 message or " Flash text " . These text messages did not include links but are intended to build credibility around the fake service notifications later sent to the target 's email address .


Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT Maudi Surveillance Operation which was previously reported in 2013 . We have not found evidence of Bahamut engaging in crime or operating outside its limited geographic domains , although this narrow perspective could be accounted for by its compartmentalization of operations .


specifically CVE-2018-0798 , before downloading subsequent payloads . Thus far , Bahamut 's campaigns have appeared to be primarily espionage or information operations – not destructive attacks or fraud .


Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year . The targets and themes of Bahamut 's campaigns have consistently fallen within two regions – South Asia ( primarily Pakistan , specifically Kashmir ) and the Middle East ( from Morocco to Iran ) .


Notably , APT41 was observed using proof-of-concept exploit code for CVE-2019-3396 within 23 days after the Confluence . Our prior publication also failed to acknowledge immensely valuable input from a number of colleagues , including Nadim Kobeissi 's feedback on how the API endpoints on the Android malware were encrypted .


We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 . Bahamut targeted similar Qatar-based individuals during their campaign .


In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 . Bellingcat also reported the domain had been used previously to host potential decoy documents as detailed in VirusTotal here using http://voguextra.com/decoy.doc .


The actor attempts to exploit CVE-2018–8440 — an elevation of privilege vulnerability in Windows when it improperly handles calls to Advanced Local Procedure Call — to elevate the privileges using a modified proof-of-concept exploit . The China-backed Barium APT is suspected to be at the helm of the project .


The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server . Trojanized versions of the utility were then signed with legitimate certificates and were hosted on and distributed from official ASUS update servers – which made them mostly invisible to the vast majority of protection solutions , according to Kaspersky Lab .


Previously , Cloud Atlas dropped its validator” implant named PowerShower” directly , after exploiting the Microsoft Equation vulnerability CVE-2017-11882 mixed with CVE-2018-0802 . Kaspersky Lab To compromise the utility , Kaspersky Lab determined that the cyberattackers used stolen digital certificates used by ASUS to sign legitimate binaries , and altered older versions of ASUS software to inject their own malicious code .


The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . To compromise the utility , Kaspersky Lab determined that Barium used stolen digital certificates used by ASUS to sign legitimate binaries , and altered older versions of ASUS software to inject their own malicious code .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . BARIUM , a Chinese state player that also goes by APT17 , Axiom and Deputy Dog , was previously linked to the ShadowPad and CCleaner incidents , which were also supply-chain attacks that used software updates to sneak onto machines .


Analysis of the emails has shown that the attachment contains an exploit for the CVE-2017-11882 vulnerability . That said , the " fingerprints " left on the samples by the attackers – including techniques used to achieve unauthorized code execution – suggest that the BARIUM APT is behind the effort , according to the researchers .


The exploit installs Silence’s loader , designed to download backdoors and other malicious programs . In the 2017 ShadowPad attack , the update mechanism for Korean server management software provider NetSarang was compromised to serve up an eponymous backdoor .


We believe Emissary Panda exploited a recently patched vulnerability in Microsoft SharePoint tracked by CVE-2019-0604 , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell . In the next incident , also in 2017 , software updates for the legitimate computer cleanup tool CCleaner was found to have been compromised by hackers to taint them with the same ShadowPad backdoor .


Of particular note is their use of tools to identify systems vulnerable to CVE-2017-0144 , which is the same vulnerability exploited by EternalBlue that is best known for its use in the WannaCry attacks of 2017 . NetSarang , which has headquarters in South Korea and the United States , removed the backdoored update , but not before it was activated on at least one victim 's machine in Hong Kong .


NetWire , DarkComet , NanoCore , LuminosityLink , Remcos and Imminent Monitor are all designed to provide remote access to compromised systems . Given our increased confidence that Bahamut was responsible for targeting of Qatari labor rights advocates and its focus on the foreign policy institutions other Gulf states , Bahamut 's interests are seemingly too expansive to be limited one sponsor or customer .


The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes . Barium specializes in targeting high value organizations holding sensitive data , by gathering extensive information about their employees through publicly available information and social media , using that information to fashion phishing attacks intended to trickthose employees into compromising their computers and networks .


This ' connection bouncer ' tool lets the threat actor redirect ports and connections between different networks and obfuscate C2 server traffic . We identified an overlap in the domain voguextra.com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post .


It is capable of a variety of functions , including credential theft , hard drive and data wiping , disabling security software , and remote desktop functionality . Althoughthe BariumDefendants have relied on differentand distinct infrastructures in an effortto evade detection , Bariumused the same e-mail address ( hostay88@gmail.com ) to register malicious domains used in connection with at least two toolsets that Barium has employed to compromise victim computers .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . The second method , described in Part D.2 , below , involves the " ShadowPad " malware , which the Barium Defendants have distributed via a third-party software provider 's compromised update .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . To enhance the effectiveness of phishing attacks into the organization , Barium will collect additional background informationfrom social media sites .


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . Employing a technique known as " spear phishing " , Barium has heavily targeted individuals within HumanResources or Business Developmentdepartments ofthe targeted organizations in order to compromise the computers ofsuch individuals .


Upon execution , it will communicate with an attacker-controller website to download a variant of the Pony malware , pm.dll” along with a standard Vawtrak trojan . The first method , described in Part D.l , below , involves the " Barlaiy " and " PlugXL " malware , which the Barium Defendants propagate using phishing techniques .


RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism . Using the information gathered from its reconnaissance on social media sites , Barium packages the phishing e-mail in a ACT that gives the e-mail credibility to the target user , often by making the e-mail appear as ifit were sent from an organization known to and trusted by the victim or concerning a topic of interest to the victim .


RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself . Barium Defendants install the malicious " Win32/Barlaiy " malware and the malicious " Win32/PlugX.L " malware on victim computers using the means described above .


Once a valid card with a malicious EMV chip is detected , RIPPER will instantiate a timer to allow a thief to control the machine . Both Win32/Barlaiy & Win32/PlugX.L are remote access " trojans " , which allow Barium to gather a victim 's information , control a victim 's device , install additional malware , and exfiltrate information fi-om a victim 's device .


This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices . Barium Defendants install the malicious credential stealing and injection tool known as " Win32/RibDoor.A!dha " .


From our trend analysis seen in Figure 3 , Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August . While not detected at the time , Microsoft 's antivirus and security products now detect this Barium malicious file and flag the file as " Win32/ShadowPad.A " .


Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before . MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com.mxi.videoplay ) .


FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform . Figure 9a , below , shows detections of encounters with the Barium actors and their infrastructure , including infected computers located in Virginia , and Figure 9b , below , shows detections of encounters throughout the United States .


That post included download links for a slew of NSA hacking tools and exploits , many of which could be used to break into hardware firewall appliances , and in turn , corporate or government networks . Barium has targeted Microsoft customers both in Virginia , the United States , and around the world .


Some hackers even went onto use the Cisco exploits in the wild . Once the Barium Defendants have access to a victim computer through the malware described above , they monitor the victim 's activity and ultimately search for and steal sensitive documents ( for example , Exfiltration of intellectual property regarding technology has been seen ) , and personal information fi"om the victim 's network .


DanderSpritz consists entirely of plugins to gather intelligence , use exploits and examine already controlled machines . According to a 49-page report published Thursday , all of the attacks are the work of Chinese government 's intelligence apparatus , which the report 's authors dub the Winnti Umbrella .


DanderSpritz consists entirely of plugins to gather intelligence , use exploits and examine already controlled machines . Researchers from various security organizations have used a variety of names to assign responsibility for the hacks , including LEAD , BARIUM , Wicked Panda , GREF , PassCV , Axiom , and Winnti .


PeddleCheap is a plugin of DanderSpritz which can be used to configure implants and connect to infected machines . It targets organizations in Japan , South Korea , and Taiwan , leveling its attacks on public sector agencies and telecommunications and other high-technology industries .


Each of them consists of a set of plugins designed for different tasks : while FuzzBunch plugins are responsible for reconnaissance and attacking a victim , plugins in the DanderSpritz framework are developed for managing already infected victims . In 2016 , for instance , we found their campaigns attacking Japanese organizations with various malware tools , notably the Elirks backdoor .


In their latest leak , they have released the UNITEDRAKE NSA exploit , which is a remote access and control tool that can remotely target Windows-based systems to capture desired information and transfer it to a server . Blackgear has been targeting various industries since its emergence a decade ago .


The ShadowBrokers is a group of hackers known for leaking exclusive information about the National Security Agency – NSA 's hacking tools and tactics . Blackgear 's campaigns also use email as an entry point , which is why it's important to secure the email gateACT .


It captures information using plugins to compromise webcam and microphone output along with documenting log keystrokes , carrying out surveillance and access external drives . BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years .


Written in pure C language , Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions , and carries out integrity control of various system components to avoid debugging and security detection . Our research indicates that it has started targeting Japanese users .


The toolset includes reams of documentation explaining how the cyber weapons work , as well as details about their use in highly classified intelligence operations abroad . The malware tools used by BLACKGEAR can be categorized into three categories : binders , downloaders and backdoors .


The Ham Backdoor functions primarily as a modular platform , which provides the attacker with the ability to directly download additional modules and execute them in memory from the command and control ( C2 ) server . Binders are delivered by attack vectors ( such as phishing and watering hole attacks ) onto a machine .


Originally targeting Western European banks , Emotet has since been developed into a robust global botnet that is comprised of several modules , each of which equips Emotet with different spamming , email logging , information stealing , bank fraud , downloading , and DDoS , among others . Based on the mutexes and domain names of some of their C&C servers , BlackTech 's campaigns are likely designed to steal their target 's technology .


Originally targeting Western European banks , it has since been developed into a robust global botnet that is comprised of several modules , each of which equips Emotet with different spamming , email logging , information stealing , bank fraud , downloading , and DDoS , among others . Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns : PLEAD , Shrouded Crossbow , and of late , Waterbear .


Beginning in mid-January 2019 , TA542 distributed millions of Emotet-laden emails in both English and German . Active since 2012 , it has so far targeted Taiwanese government agencies and private organizations .


DanaBot is a Trojan that includes banking site web injections and stealer functions . PLEAD uses spear-phishing emails to deliver and install their backdoor , either as an attachment or through links to cloud storage services .


Two binder tools — used to disguise custom executables as legitimate Microsoft implants — were discovered by Falcon Intelligence and linked to MYTHIC LEOPARD in July 2017 . PLEAD also dabbled with a short-lived , fileless version of their malware when it obtained an exploit for a Flash vulnerability ( CVE-2015-5119 ) that was leaked during the Hacking Team breach .


Neptun is installed on Microsoft Exchange servers and is designed to passively listen for commands from the attackers . PLEAD also uses CVE-2017-7269 , a buffer overflow vulnerability Microsoft Internet Information Services ( IIS ) 6.0 to compromise the victim 's server .


At a high level , hot patching can transparently apply patches to executables and DLLs in actively running processes , which does not happen with traditional methods of code injection such as CreateRemoteThread or WriteProcessMemory . This campaign , first observed in 2010 , is believed to be operated by a well-funded group given how it appeared to have purchased the source code of the BIFROST backdoor , which the operators enhanced and created other tools from .


This isn’t a bad thing as it shows a natural grouping of nodes that could be a good candidate to group to help simplify the overall graph and make analysis easier . Shrouded Crossbow targeted privatized agencies and government contractors as well as enterprises in the consumer electronics , computer , healthcare , and financial industries .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Shrouded Crossbow employs three BIFROST-derived backdoors : BIFROSE , KIVARS , and XBOW .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . Like PLEAD , Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents .


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . XBOW 's capabilities are derived from BIFROSE and KIVARS ; Shrouded Crossbow gets its name from its unique mutex format .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . While PLEAD and KIVARS are most likely to be used in first phase attacks , Waterbear can be seen as a secondary backdoor installed after attackers have gained a certain level of privilege .


Both groups can set permissions on specific files to Everyone , and work in tandem with the PLATINUM backdoors . Recently , the JPCERT published a thorough analysis of the Plead backdoor , which , according to Trend Micro , is used by the cyberespionage group BlackTech .


At a high level , hot patching can transparently apply patches to executables and DLLs in actively running processes , which does not happen with traditional methods of code injection such as CreateRemoteThread or WriteProcessMemory . Despite the fact that the Changing Information Technology Inc. certificate was revoked on July 4 , 2017 , the BlackTech group is still using it to sign their malicious tools .


Hot patching is an operating system-supported feature for installing updates without having to reboot or restart a process . The BlackTech group is primarily focused on cyberespionage in Asia .


Until this incident , no malware had been discovered misusing the AMT SOL feature for communication . The new activity described in this blogpost was detected by ESET in Taiwan , where the Plead malware has alACTs been most actively deployed .


The folders seem to contain information about the company 's development documentation , artificial intelligence model , web security software , and antivirus software base code . Attackers are targeting Windows platform and aiming at government institutions as well as big companies in Colombia .


As mentioned in the Hermes to Ryuk section , Ryuk uses a combination of symmetric ( AES ) and asymmetric ( RSA ) encryption to encrypt files . Attackers like to use spear-fishing email with password protected RAR attachment to avoid being detected by the email gateACT .


Their software , once surreptitiously installed on a target 's cell phone or computer , can be used to monitor the target 's communications , such as phone calls , text messages , Skype calls , or emails . The first sample being captured was in April 2018 and since that we observed a lot more related ones .


This isn’t a bad thing as it shows a natural grouping of nodes that could be a good candidate to group to help simplify the overall graph and make analysis easier . After performing investigations on the classified victims , we find the attacker targets big companies and government agencies in Colombia .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . After monitoring and correlating the APT attack , 360 Threat Intelligence Center discovered multiple related emails to attack Colombian government agencies , financial institutions and large enterprises .


The GoogleUpdate.exe component is responsible for communicating with the remote C&C server . The oldest sample we've seen up to now is from November 2013 .


This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries . One of the top targets is the Japan Pension Service , but the list of targeted industries includes government and government agencies , local governments , public interest groups , universities , banks , financial services , energy and so on .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . However , the attack is different in two respects : unlike other APTs , the main focus of Blue Termite is to attack Japanese organizations ; and most of their C2s are located in Japan .


The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system . Originally , the main infection vector of Blue Termite was spear-phishing emails .


The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format . Kaspersky Lab has detected a new method of first infection that uses a drive-by-download with a flash exploit ( CVE-2015-5119 , the one leaked from The Hacking Team incident ) .


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer . Kaspersky Lab also found some watering hole attacks , including one on a website belonging to a prominent member of the Japanese government .


The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine . In early July 2015 , however , Kaspersky Lab found a sample that creates a decryption key with Salt1 , Salt2 , and Salt3 .


Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server . From early June , when the cyber-attack on the Japan Pension Service started to be reported widely , various Japanese organizations would have started to deploy protection measures .


PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more . It employs AES in addition to SID tricks , making it difficult to decrypt sensitive data .


TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution . In order to fight back against this cyber-espionage , Kaspersky Lab will continue its research .


PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file . Bookworm 's functional code is radically different from PlugX and has a rather unique modular architecture that warranted additional analysis by Unit 42 .


The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation . Bookworm has little malicious functionality built-in , with its only core ability involving stealing keystrokes and clipboard contents .


The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method . The Plead malware is a backdoor which , according to Trend Micro , is used by the BlackTech group in targeted attacks .


In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger . So far , it appears threat actors have deployed the Bookworm Trojan primarily in attacks on targets in Thailand .


Some of the documents exploited CVE-2017-0199 to deliver the payload . The threat actors use a commercial installation tool called Smart Installer Maker to encapsulate and execute a self-extracting RAR archive and in some cases a decoy slideshow or Flash installation application .


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests . The self-extracting RAR writes a legitimate executable , an actor-created DLL called Loader.dll and a file named readme.txt to the filesystem and then executes the legitimate executable .


Some of the documents exploited CVE-2017-0199 to deliver the payload . targeted attacks .


The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets . Using XREFs during static analysis is a common technique to quickly find where functions of interest are called .


The batch script would then attempt to have the VNC program connect to a command and control ( C2 ) server to enable the server to control the compromised system . The developers designed Bookworm to be a modular Trojan not limited to just the initial architecture of the Trojan , as Bookworm can also load additional modules provided by the C2 server .


The IndiaBravo-PapaAlfa installer is responsible for installing the service DLL variant . Although the developers of Bookworm have included only keylogging functionality in Bookworm as a core ability , as suggested in Table 1 , several of the embedded DLLs provide Leader with cryptographic and hashing functions , while others support Leader 's ability to communicate with its C2 server .


These tools often lay the groundwork for further malicious activity , such as the targeting of antivirus capabilities and the disabling of firewalls , both of which are very fundamental defensive measures . While we did not discuss the surrounding attacks using Bookworm in detail , we have observed threat actors deploying Bookworm primarily in attacks on targets in Thailand .


The first class , colloquially known as " wipers " , are a class of malware has the primary intent of destroying data on a victim 's machine . Also , Bookworm uses a combination of encryption and compression algorithms to obfuscate the traffic between the system and C2 server .


DDoS malware floods a target 's network-connected service with an excessive number of request at once in order to overload the capacity of the server . The developers of Bookworm have gone to great lengths to create a modular framework that is very flexible through its ability to run additional modules directly from its C2 server .


The naming scheme used by Novetta for the malware identified during Operation Blockbuster consists of at least two identifiers which each identifier coming from the International Civil Aviation Organization ( ICAO ) 's phonetic alphabet ,2 commonly referred to as the NATO phonetic alphabet . Unit 42 recently published a blog on a newly identified Trojan called Bookworm , which discussed the architecture and capabilities of the malware and alluded to Thailand being the focus of the threat actors' campaigns .


Loaders are typically responsible for loading a DLL component into memory given that a DLL cannot operate in a standalone mode such as an executable . Leader is Bookworm 's main module and controls all of the activities of the Trojan , but relies on the additional DLLs to provide specific functionality .


This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans . The developers of Bookworm use these modules in a rather unique ACT , as the other embedded DLLs provide API functions for Leader to carry out its tasks .


FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware or as a file downloaded unknowingly by users when visiting sites compromised by HIDDEN COBRA actors . Unit 42 does not have detailed targeting information for all known Bookworm samples , but we are aware of attempted attacks on at least two branches of government in Thailand .


As a backdoor Trojan , Volgmer has several capabilities including : gathering system information , updating service registry keys , downloading and uploading files , executing commands , terminating processes , and listing directories . We speculate that other attacks delivering Bookworm were also targeting organizations in Thailand based on the contents of the associated decoys documents , as well as several of the dynamic DNS domain names used to host C2 servers that contain the words " Thai " or " Thailand " .


RATANKBA is delivered to its victims using a variety of lure documents , including Microsoft Office documents , malicious CHM files , and different script downloaders . We believe that it is likely threat actors will continue development Bookworm , and will continue to use it for the foreseeable future .


These files have the capability to download and install malware , install proxy and Remote Access Trojans ( RATs ) , connect to command and control ( C2 ) servers to receive additional instructions , and modify the victim 's firewall to allow incoming connections . Threat actors have delivered Bookworm as a payload in attacks on targets in Thailand .


The WannaCry malware consists of two distinct components , one that provides ransomware functionality and a component used for propagation , which contains functionality to enable SMB exploitation capabilities . Analysis of compromised systems seen communicating with Bookworm C2 servers also confirms our speculation on targeting with a majority of systems existing within Thailand .


WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data . As mentioned in our previous blog on Bookworm , the Trojan sends a static date string to the C2 server that we referred to as a campaign code .


WCry uses a combination of the RSA and AES algorithms to encrypt files . We believed that the actors would use this date code to track their attack campaigns ; however , after continued analysis of the malware , we think these static dates could also be a build identifier for the Trojan .


Some of the documents exploited CVE-2017-0199 to deliver the payload . Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier .


Depending on placement , a web shell can provide continued access to victims ' environments , re-infect victim systems , and facilitate lateral movement . A Trojan sending a build identifier to its C2 server is quite common , as it notifies the threat actors of the specific version of the Trojan in which they are interacting .


While it lacks more advanced functionality like screen capturing , it is still able to carry out most tasks desired by threat actors : exfiltration of files , ability to download and execute additional payloads , and gain remote shell access . Due to these changes without a new date string , we believe the date codes are used for campaign tracking rather than a Bookworm build identifier .


To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys . We believe that Bookworm samples use the static date string as campaign codes , which we used to determine the approximate date of each attack that we did not have detailed targeting information .


For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer . Another decoy slideshow associated with the Bookworm attack campaign contains photos of an event called Bike for Dad 2015 .


DROPSHOT is a notable piece of malware used to deliver variants of the TURNEDUP backdoor . The campaign code " 20150920 " is associated with this decoy , which is a week prior to media articles announcing that the Crown Price of Thailand Maha Vajiralongkorn will lead the Bike for Dad 2015 event .


The SHAPESHIFT wiper is capable of wiping disks and volumes , as well as deleting files . Chitpas is heavily involved with Thailand politics and was a core leader of the People 's Committee for Absolute Democracy ( PCAD ) , which is an organization that staged anti-government campaigns in 2013 and 2014 .


The HTA files contained job descriptions and links to job postings on popular employment websites . The final remaining known decoy includes photos of Chitpas Tant Kridakon ( Figure 7 ) , who is known as heiress to the largest brewery in Thailand .


The attacker used a spear-phishing email containing a link to a fake resume hosted on a legitimate website that had been compromised . These images were associated with the Bookworm campaign code " 20150905 " .


Further analysis revealed a well-established collection of fake social media profiles that appear intended to build trust and rapport with potential victims . Unit 42 analyzed the systems communicating with the Bookworm C2 domains and found that a majority of the IP addresses existed within autonomous systems located in Thailand .


The macro ran a PowerShell command that attempted to download additional PowerShell loader scripts for PupyRAT , a research and penetration-testing tool that has been used in attacks . The pie chart in Figure 8 shows that the vast majority ( 73% ) of the hosts are geographically located in Thailand , which matches the known targeting of this threat group .


ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints . We believe that the IP addresses from Canada , Russia and NorACT are analysis systems of antivirus companies or security researchers .


Poison Ivy is a remote access tool that is freely available for download from its official web site at www.poisonivy-rat.com . Overall , the Bookworm infrastructure overlaps with the infrastructure hosting C2 servers used by various attack tools , including FFRAT , Poison Ivy , PlugX , and others .


Poison Ivy includes features common to most Windows-based RATs , including key logging , screen capturing , video capturing , file transfers , system administration , password theft , and traffic relaying . Overall , the Bookworm infrastructure overlaps with the infrastructure hosting C2 servers used by various attack tools , including FFRAT , Poison Ivy , PlugX , and others .


The Poison Ivy builder kit allows attackers to customize and build their own PIVY server , which is delivered as mobile code to a target that has been compromised , typically using social engineering . Unit 42 enumerated the threat infrastructure related to Bookworm and created a chart to visualize connected entities to its current attack campaign .


We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded . Threat actors have targeted the government of Thailand and delivered the newly discovered Bookworm Trojan since July 2015 .


Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload . The actors appear to follow a set playbook , as the observed TTPs are fairly static within each attack in this campaign .


Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system . So far , Unit 42 has seen infrastructure overlaps with servers hosting C2 servers for samples of the FFRAT , PlugX , Poison Ivy and Scieron Trojans , suggesting that the threat actors use these tools as the payload in their attacks .


The vulnerability exists in the old Equation Editor ( EQNEDT32.EXE ) , a component of Microsoft Office that is used to insert and evaluate mathematical formulas . The threat actors have continually used Flash Player installers and Flash slideshows for decoys .


ISMDoor is able to exfiltrate data , take screenshots , and execute arbitrary commands on the victim 's machine . The vast majority of systems communicating with Bookworm C2 servers are within the Bangkok metropolitan LOC where a majority of the government of Thailand exists .


The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information . Buhtrap has been active since 2014 , however their first attacks against financial institutions were only detected in August 2015 .


Based on the command capabilities of the Taidoor malware , we were able to determine that data theft and data destruction was possible . At the moment , the group is known to target Russian and Ukrainian banks .


This script relays commands and output between the controller and the system . Buhtrap is the first hacker group using a network worm to infect the overall bank infrastructure that significantly increases the difficulty of removing all malicious functions from the network .


But two tools used were unique to the group : ASPXTool , an Internet Information Services ( IIS ) specific " Web shell " used to gain access to servers inside a target 's network ; and the OwaAuth credential stealing tool and Web shell , used to attack Microsoft Exchange servers running the Web Outlook interface . Malicious programs intentionally scan for machines with an automated Bank-Customer system of the Central bank of Russia ( further referred to as BCS CBR ) .


PsExec is a Microsoft Sysinternals tool for executing processes on other systems and is one of the most frequently seen legitimate pieces of software used by attackers attempting to live off the land . If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros .


Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection . We noticed that criminals were spreading Buhtrap using this method from May 2015 to August 2015 .


As detailed in the previous section , this malware is able to manipulate and exfiltrate emails . It is worth noting that attackers used the same compromised websites to spread Buhtrap as those that had been used for the Corkow Trojan .


Kazuar generates its mutex by using a process that begins with obtaining the MD5 hash of a string " [username]=>singleton-instance-mutex " . Moreover , they used the same exploit kit Niteris as that in the Corkow case .


MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com.mxi.videoplay ) . Purportedly during one of the first attacks hackers intercepted the mailing list of the Anti-drop " club and created a specific phishing email for its members .


Using XREFs during static analysis is a common technique to quickly find where functions of interest are called . However , it is still widely used , notably in Russia .


Although the developers of Bookworm have included only keylogging functionality in Bookworm as a core ability , as suggested in Table 1 , several of the embedded DLLs provide Leader with cryptographic and hashing functions , while others support Leader 's ability to communicate with its C2 server . As noted in our previous blog on Buhtrap , this gang has been actively targeting Russian businesses , mostly through spear-phishing .


As mentioned in our previous blog on Bookworm , the Trojan sends a static date string to the C2 server that we referred to as a campaign code . It is thus interesting to see Buhtrap add strategic web compromises to their arsenal .


We believed that the actors would use this date code to track their attack campaigns ; however , after continued analysis of the malware , we think these static dates could also be a build identifier for the Trojan . The first malware we saw was the lurk downloader , which was distributed on October 26th .


Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier . The executable would install the real Ammyy product , but would also launch a file called either AmmyyService.exe or AmmyySvc.exe which contained the malicious payload .


A Trojan sending a build identifier to its C2 server is quite common , as it notifies the threat actors of the specific version of the Trojan in which they are interacting . Buhtrap is getting better at disguising the code they inject into compromised websites .


Due to these changes without a new date string , we believe the date codes are used for campaign tracking rather than a Bookworm build identifier . With the recent arrests of actors using the Lurk banking trojan , Buhtrap appears to be a likely alternative for actors wishing to target Russian banks and software .


We believe that Bookworm samples use the static date string as campaign codes , which we used to determine the approximate date of each attack that we did not have detailed targeting information . They have different functions and ACTs of spreading , but the same purpose — to steal money from the accounts of businesses .


Malicious programs intentionally scan for machines with an automated Bank-Customer system of the Central bank of Russia ( further referred to as BCS CBR ) . Our experts have found that cybercriminals are actively focusing on SMBs , and giving particular attention to accountants .


In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task . The first encounter with Buhtrap was registered back in 2014 .


Tweety Chat 's Android version can record audio , too . For now , we can call RTM one of the most active financial Trojans .


One of its file stealers , swissknife2 , abuses a cloud storage service as a repository of exfiltrated files . At that time it was the name of a cybercriminal group that was stealing money from Russian financial establishments — to the tune of at least $150,000 per hit .


The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon . Buhtrap resurfaced in the beginning of 2017 in the TwoBee campaign , where it served primarily as means of malware delivery .


The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio . After the source codes of their tools became public in 2016 , the name Buhtrap was used for the financial Trojan .


If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs . Just like last time , Buhtrap is spreading through exploits embedded in news outlets .


To obtain logins and passwords they applied keyloggers built into Corkow , as well as a commonly used feature of Mimikatz , dumping clear text Windows credentials from LSA . Estimating the damages is challenging , but as we learned , the criminals are siphoning off assets in transactions that do not exceed $15,000 each .


Palo Alto Networks has noted and described the differences of two malware agents developed in parallel , with commonalities in behavior but differing functionalities ; families described as Infy and Infy M. Our primary observation was of the Infy ( non-M ) malware , which primarily functions as a keylogger for the collection of account credentials . As explained later , we believe this campaign is financially-motivated and that it targets accounting departments in Russian businesses .


At this stage , the malware gathers information about the infected computer . " Buhgalter " means " accountant " in Russian .


Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles , collaborative document editing sites , and blogs for C&C . Seeing a campaign like this , inevitably the Anunak/Carbanak documented by Fox-IT and Kaspersky comes to mind .


The Windows 10 Creators Update will bring several enhancements to Windows Defender ATP that will provide SOC personnel with options for immediate mitigation of a detected threat . The infection vector is similar , it uses a similar modified mimikatz application , and it uses a third-party remote access tool , changes system settings to allow concurrent RDP sessions , and so on .


If it did , the malware downloaded additional modules , including ones allowing for the automatic creation of unauthorized payment orders , changing details in legal payment orders , etc . The second , aptly titled " kontrakt87.doc " , copies a generic telecommunications service contract from MegaFon , a large Russian mobile phone operator .


Lurk uses a form of steganography : that's where one file is hidden away inside another file of a completely different sort , such as an image , audio , or video file . In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task .


To do this , it employs a number of specific commands via DNSMessenger . Careto 's Mask campaign we discovered relies on spear-phishing e-mails with links to a malicious website .


This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics . Sometimes , the attackers use sub-domains on the exploit websites , to make them seem more legitimate .


There is the exploit code and malware used to gain access to systems , the infrastructure that provides command and control to the malware operator , and the human elements – developers who create the malware , operators who deploy it , and analysts who extract value from the stolen information . These sub-domains simulate sub-sections of the main newspapers in Spain plus some international ones like the Guardian and the Washington Post .


We believe the 2013 , 2015 , and 2016 KeyBoy samples provide evidence of a development effort focused on changing components that would be used by researchers to develop detection signatures . The CVE-2012-0773 was originally discovered by VUPEN and has an interesting story .


KeyBoy provides basic backdoor functionality , allowing the operators to select from various capabilities used to surveil and steal information from the victim machine . In other words , the attackers attracted our attention by attempting to exploit Kaspersky Lab products .


If KeyBoy is a single component of a larger espionage toolkit , the developers may have realized that this older , static-key based , configuration encoding algorithm was inadvertently providing a link between disparate components of their malware suite . We initially became aware of Careto when we observed attempts to exploit a vulnerability in our products to make the malware " invisible " in the system .


The NetTraveler trojan has been known to be used in targeted cyber espionage attacks for more than a decade by nation state threat actors and continues to be used to target its victims and exfiltrate data . Most modules were created in 2012 .


This program is designed to capture keystrokes , take screenshots of the user 's desktop and get contents from the clipboard . The attackers began taking them offline in January 2014 .


This file requires the target to attempt to open the .lnk file , which redirects the user to a Windows Scripting Component ( .wsc ) file , hosted on an adversary-controlled microblogging page . Last week we discussed Numbered Panda , a group that is also based out of China and is fairly well known to the security community , though by many names .


Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique . We revealed a Chinese-based adversary we crypt as Anchor Panda , a group with very specific tactics , techniques , and procedures ( TTPs ) and a keen interest in maritime operations and naval and aerospace technology .


In addition , the NetTraveler toolkit was able to install additional info-stealing malware as a backdoor , and it could be customized to steal other types of sensitive information such as configuration details for an application or computer-aided design files . The campaign was active until January 2014 , but during our investigations the C&C servers were shut down .


The PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) . This week we are going to discuss Clever Kitten , whom , by virtue of several indicators , we have affiliated with the Islamic Republic of Iran .


he PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) . Clever Kitten has moved to leveraging strategic web compromises .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Clever Kitten actors have a strong affinity for PHP server-side attacks to make access ; this is relatively unique amongst targeted attackers who often favor targeting a specific individual at a specific organization using social engineering .


One of the most notable functions of the initial dropper is to bypass Windows UAC ( User Account Control ) in order to execute the next payload with higher privileges . Clever Kitten primarily targets global companies with strategic importance to countries that are contrary to Iranian interests .


Afterwards , the installer malware creates a downloader and a configuration file from its resource and executes it . A Clever Kitten attack starts with the use of a web vulnerability scanner to conduct reconnaissance .


The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload . The scanner was identified as the Acunetix Web Vulnerability Scanner which is a commercial penetration testing tool that is readily available as a 14-day trial .


He is responsible for developing tools for conducting attacks and is also able to modify complex exploits and third party software . Once an exploitable page is identified , Clever Kitten will attempt to upload a PHP backdoor to gain remote access to the system .


wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 . The reason for this is likely the availability of exploits against web browsers , which for a variety of reasons allows an attacker to bypass security features such as Data Execution Prevention ( DEP ) or Address Space Layout Randomization ( ASLR ) .


As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC . Once an exploitable page is identified , the actor will attempt to upload a PHP backdoor to gain remote access to the system .


The RAT , however , had a multitude of functionalities (as listed in the table below) such as to download and execute , compress , encrypt , upload , search directories , etc . In Clever Kitten 's attacks , the goal is lateral movement ; this is an attempt to move further into the target environment in order to begin intelligence collection .


Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor . This activity is a longer tail for the actor than a spearphish ; this is likely based on the Clever Kitten background , which may be focused on web development/application testing .


DoublePulsar is then used to inject a secondary payload , which runs in memory only . Without going too deep into the rabbit hole , there are several indicators pointing to an Iranian nexus , including language artifacts in the tool-marks used by the attacker , as well as network activity tying this actor to a very specific location that we have high confidence in not being spoofed .


The detection evasion techniques we observed in the Okrum malware include embedding the malicious payload within a legitimate PNG image , employing several anti-emulation and anti-sandbox tricks , as well as making frequent changes in implementation . Clever Kitten 's goal is to eventually be able to masquerade as a legitimate user by compromising credentials either through a pass-the-hash attack , or by dumping password hashes from a compromised host .


The threat actors behind the Sea Turtle campaign were successful in compromising entities by manipulating and falsifying DNS records at various levels in the domain name space . The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates , though , Indian and Canadian companies with interests in those Middle Eastern countries are also targeted .


The diagram below illustrates how we believe the actors behind the Sea Turtle campaign used DNS hijacking to achieve their end goals . There are new TTPs used in this attack – for example Agent_Drable is leveraging the Django Python framework for command and control infrastructure , the technical details of which are outlined later in the blog .


If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file . n summary , Cold River is a sophisticated threat actor making malicious use of DNS tunneling for command and control activities , compelling lure documents , and previously unknown implants .


The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell's 1984 , but Weeping Angel , developed by the CIA's Embedded Devices Branch (EDB) , which infests smart TVs , transforming them into covert microphones , is surely its most emblematic realization . Some of the exploit server paths contain modules that appear to have been designed to infect Linux computers , but we have not yet located the Linux backdoor .


Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies . The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates , though , Indian and Canadian companies with interests in those Middle Eastern countries may have also been targeted .


The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant . The decoy documents used by the InPage exploits suggest that the targets are likely to be politically or militarily motivated .


UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques . The use of InPage as an attack vector is not commonly seen , with the only previously noted attacks being documented by Kaspersky in late 2016 .


'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS (JukeBox) and Linux (DanceFloor) . The decoy documents dropped suggest that the targets are likely to be politically or militarily motivated , with subjects such as Intelligence reports and political situations being used as lure documents .


This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 . While documents designed to exploit the InPage software are rare , they are not new – however in recent weeks Unit42 has observed numerous InPage exploits leveraging similar shellcode , suggesting continued use of the exploit previously discussed by Kaspersky .


The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process . Confucius targeted a particular set of individuals in South Asian countries , such as military personnel and businessmen , among others .


Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials . Tweety Chat 's Android version can record audio , too .


This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more . Confucius' operations include deploying bespoke backdoors and stealing files from their victim 's systems with tailored file stealers , some of which bore resemblances to Patchwork 's .


In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document . Compared to Patchwork , whose Trojanized documents exploit at least five security flaws , Confucius' backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .


The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” . Back in February , we noted the similarities between the Patchwork and Confucius groups and found that , in addition to the similarities in their malware code , both groups primarily went after targets in South Asia .


The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware . Back in February , Trend Micro noted the similarities between the Patchwork and Confucius groups and found that , in addition to the similarities in their malware code , both groups primarily went after targets in South Asia .


The malware starts communicating with the C&C server by sending basic information about the infected machine . One of its file stealers , swissknife2 , abuses a cloud storage service as a repository of exfiltrated files .


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests . During the months that followed in which we tracked Confucius' activities , we found that they were still aiming for Pakistani targets .


After app installation , whenever SWAnalytics senses victims opening up infected applications or rebooting their phones , it silently uploads their entire contacts list to Hangzhou Shun Wang Technologies controlled servers . During their previous campaign , we found Confucius using fake romance websites to entice victims into installing malicious Android applications .


This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge . Periodically , the malware tries to contact the command-and-control ( C&C ) server with the username encoded into parameters .


It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in . This function is similar to the various versions of backdoors ( such as sctrls and sip_telephone ) that we analyzed in our previous blog post and whitepaper .


With default settings , SWAnalytics will scan through an Android device’s external storage , looking for directory tencent/MobileQQ/WebViewCheck” . This algorithm was previously discussed by security researchers in a Confucius-related blog post .


By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device . Lately , Patchwork has been sending multiple RTF files exploiting CVE-2017-8570 .


To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control . The group still uses the Badnews malware , a backdoor with information-stealing and file-executing capabilities , albeit updated with a slight modification in the encryption routine at the end of 2017 , when they added Blowfish encryption on top of their custom encryption described in our former Patchwork blogpost .


Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue . Threat actors like Confucius and Patchwork are known for their large arsenal of tools and ever-evolving techniques that can render traditional security solutions — which are often not designed to handle the persistent and sophisticated threats detailed in this blog — ineffective .


The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine . The reality is that IT departments of small to large-sized organizations are not equipped to handle the more advanced threats that groups like Confucius use in their attacks .


The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems . Patchwork uses email as an entry point , which is why securing the email gateACT is important .


The PowerShell version of the Trojan also has the ability to get screenshots . This blog post examines two similar malware families that utilize the aforementioned technique to abuse legitimate websites , their connections to each other , and their connections to known espionage campaigns .


Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations . In order to increase the likelihood of their malware successfully communicating home , Cyber Espionage threat actors are increasingly abusing legitimate web services , in lieu of DNS lookups to retrieve a command and control address .


BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e , possibly en masse . In 2013 , Rapid7 reported on a series of relatively amateur attacks against Pakistani targets .


The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience . The first of which we call ' CONFUCIUS_A ' , a malware family that has links to a series of attacks associated with a backdoor attack method commonly known as SNEEPY ( aka ByeByeShell ) first reported by Rapid7 in 2013 .


China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool . At first glance CONFUCIUS_B looks very similar to CONFUCIUS_A , and they are also packaged in plain SFX binary files .


China Chopper contains a remote shell (Virtual Terminal) function that has a first suggested command of netstat an|find ESTABLISHED . The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon .


The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords . We also believe that both clusters of activity have links to attacks with likely Indian origins , the CONFUCIUS_A attacks are linked to the use of SNEEPY/BYEBYESHELL and the CONFUCIUS_B have a loose link to Hangover .


Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe . The two malware families themselves are also very similar , and therefore we think that the shared technique is an indication of a single developer , or development company , behind both CONFUCIUS_A and CONFUCIUS_B .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory . In this blog post , we discussed two separate malware variations that behave in very similar ACTs and use similar techniques to acquire a C2 address , with both using Yahoo Answers and Quora to evade traditional mechanisms for blocking command and control domains .