Once it infects a device , Wroba behaves very aggressively . Even an experienced user can be fooled by downloading a malicious file that is apparently from adobe.com , since the URL and the IP address correspond to Adobe 's legitimate infrastructure . It allocates a buffer of 0x2800 bytes and copies the code for the ZxGetLibAndProcAddr function . Instead , it appeared that corresponding requests were made directly through the Outlook Web Application ( OWA ) endpoint , indicating a previously undisclosed exploit method for Exchange .


It searches for mobile banking applications , removes them and uploads counterfeit versions . However , to our knowledge , this is the first time Turla has used Metasploit as a first stage backdoor , instead of relying on one of its own tools such as Skipper . To copy memory , the memcpy function is invoked . The code hunted for several security products to evade – including Kaspersky .


From the outside , they are indistinguishable from the legitimate applications . Traffic was intercepted on a node between the end machine and the Adobe servers , allowing Turla 's operators to replace the legitimate Flash executable with a trojanized version . It is not directly used from msvcrt.dll but is instead copied to another memory chunk before being called . They claim to have compromised the company and are willing to help resolve the issue .


However , they possess no banking functions , and merely steal the logins and passwords entered by users . At the beginning of March 2018 , as part of our regular tracking of Turla 's activities , we observed some changes in the Mosquito campaign . Finally , the trojan Import Address Table ( IAT ) is resolved and the file path of the process that hosts the DLL is resolved and saved in a global variable . The most significant similarities we identified are with INDUSTROYER and INDUSTROYER.V2 , which were both malware variants deployed in the past to impact electricity transmission and distribution .


ViperRAT : The Mobile APT Targeting The Israeli Defense Force That Should Be On Your Radar February 16 , 2017 ViperRAT is an active , advanced persistent threat ( APT ) that sophisticated threat actors are actively using to target and spy on the Israeli Defense Force.The threat actors behind the ViperRAT surveillanceware collect a significant amount of sensitive information off of the device , and seem most interested in exfiltrating images and audio content . In this post , we have presented the evolutions of the Turla Mosquito campaign over the last few months . ZxShell.dll is injected in a shared SVCHOST process . If an IOC is malicious and the file available to us , Symantec Endpoint products will detect and block that file .


The attackers are also hijacking the device camera to take pictures . Primary targets for this adversary are in the government , aerospace , NGO , defense , cryptology and education sectors . The Svchost group registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost is opened and the netsvc group value data is queried to generate a name for the service . The findings , compiled together in the 2023 State of Ransomware Report , show alarming trends in the global ransomware surge from July 2022 to June 2023 .


Using data collected from the Lookout global sensor network , the Lookout research team was able to gain unique visibility into the ViperRAT malware , including 11 new , unreported applications . Turla 's campaign still relies on a fake Flash installer but , instead of directly dropping the two malicious DLLs , it executes a Metasploit shellcode and drops , or downloads from Google Drive , a legitimate Flash installer . Before the malware can be installed a unique name must to be generated for the service . But after being informed that Bradshaw was not subject to Canadian trademark laws , Avid Life offered to buy AshleyMadisonSucks.com for $ 10,000 .


We also discovered and analyzed live , misconfigured malicious command and control servers ( C2 ) , from which we were able to identify how the attacker gets new , infected apps to secretly install and the types of activities they are monitoring . The Turla espionage group has been targeting various institutions for many years . The malware accomplishes this through querying the netsvc group value data located in the svchost group registry key which is HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost . Given Sandworm 's global threat activity and the worldwide deployment of MicroSCADA products , asset owners globally should take action to mitigate their tactics , techniques , and procedures against IT and OT systems .


In addition , we uncovered the IMEIs of the targeted individuals ( IMEIs will not be shared publicly for the privacy and safety of the victims ) as well as the types of exfiltrated content . Recently , we found several new versions of Carbon , a second stage backdoor in the Turla group arsenal . At startup , Svchost.exe checks the services part of the registry and constructs a list of services to load . At the end of There is a call to the main function of the malware that contains all its functionality .


In aggregate , the type of information stolen could let an attacker know where a person is , with whom they are associated ( including contacts ’ profile photos ) , the messages they are sending , the websites they visit and search history , screenshots that reveal data from other apps on the device , the conversations they have in the presence of the device , and a myriad of images including anything at which device ’ s camera is pointed . The Turla group is known to be painstaking and work in stages , first doing reconnaissance on their victims' systems before deploying their most sophisticated tools such as Carbon . Each Svchost session can contain multiple shared services that are organized in groups . Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality , or without the logical preconditions to trigger their expected function .


Lookout has determined ViperRAT is a very sophisticated threat that adds to the mounting evidence that targeted mobile attacks against governments and business is a real problem . Kaspersky APT Intelligence Reporting subscription , customers received an update in mid-February 2017 . Therefore , separate services can run , depending on how and where Svchost.exe is started . The second step is simply the same exploit used in the second step of ProxyNotShell , allowing code execution through PowerShell remoting .


Lookout researchers have been tracking this threat for the last month . Like previous Turla activity , WhiteBear leverages compromised websites and hijacked satellite connections for command and control ( C2 ) infrastructure . Svchost.exe groups are identified in the above registry key . Fortunately , an artifact of its execution was discovered in the /private / var / db / oah directory .


Given that this is an active threat , we ’ ve been working behind-the-scenes with our customers to ensure both personal and enterprise customers are protected from this threat and only decided to come forward with this information after the research team at Kaspersky released a report earlier today . WhiteBear is a parallel project or second stage of the Skipper Turla cluster of activity documented in another private intelligence report " Skipper Turla – the White Atlas framework " from mid-2016 . Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes . The videos were quickly passed around offices while users ’ systems were silently infected in the background , and many of the APT ’s components were signed with phony Intel and AMD digital certificates .


Additionally , we have determined that though original reports of this story attribute this surveillanceware tool to Hamas , this may not be the case , as we demonstrate below . However , despite the similarities to previous Turla campaigns , we believe that WhiteBear is a distinct project with a separate focus . Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group . A Microsoft Exchange server is composed of two major components : the frontend , also known as the Client Access Service , and the backend .


The increasing sophistication of surveillanceware The structure of the surveillanceware indicates it is very sophisticated . From February to September 2016 , WhiteBear activity was narrowly focused on embassies and consular operations around the world . Each Svchost group can contain one or more service names that are extracted from the following registry key , whose Parameters key contains a ServiceDLL value : HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service . The final payload of the July 2023 campaign is njRAT , which increases our confidence that the threat actor 's goals are information stealing and remote control of the targeted systems .


Analysis indicates there are currently two distinct variants of ViperRAT . Continued WhiteBear activity later shifted to include defense-related organizations into June 2017 . On a Windows machine , the netsvc group contains names of both existing and non-existing services . $ HOME / Library / LaunchAgents / com.studentd.agent.plist


The first variant is a “ first stage application , ” that performs basic profiling of a device , and under certain conditions attempts to download and install a much more comprehensive surveillanceware component , which is the second variant . All of these early WhiteBear targets were related to embassies and diplomatic/foreign affair organizations . ZxShell exploits this fact by cycling between each of the names , verifying the existence of the real service . Sometimes this was a high profile , legitimate site such as ‘ diplomacy.pl ’ hosting a ZIP archive .


The first variant involves social engineering the target into downloading a trojanized app . Thus , Turla operators had access to some highly sensitive information ( such as emails sent by the German Foreign Office staff ) for almost a year . The service ’s existence is verified with the ServiceExists function , which attempts to open the relative registry sub-key in HKLM\SYSTEM\CurrentControlSet\Services . CrowdStrike incident responders found that renamed Plink and AnyDesk executable creation timestamps on affected backend Exchange servers were closely correlated with PowerShell execution events in the Remote PowerShell logs , indicating the threat actor leveraged the newly discovered exploit chain to drop other tooling for persistent access to the affected Exchange servers .


Previous reports alleged this surveillanceware tool was deployed using ‘ honey traps ’ where the actor behind it would reach out to targets via fake social media profiles of young women . Our investigation also led to the discovery of dozens of email addresses registered by Turla operators for this campaign and used to receive exfiltrated data from the victims . The first service name that is not installed on the system becomes the ZxShell service name . The MOVEit data breaches had widespread impacts , affecting everything from the Oregon DMV and Louisiana OMV ( Office of Motor Vehicles)—including the leak of nearly 10 million drivers ' licenses — to the University of Rochester and multiple corporations .


After building an initial rapport with targets , the actors behind these social media accounts would instruct victims to install an additional app for easier communication . It mainly targets Microsoft Outlook , a widely used mail client , but also targets The Bat! , a mail client very popular in Eastern Europe . A new service is then created using the service parser function ProcessScCommand . None Read about adversaries tracked by CrowdStrike in 2021 in the and in the • None Learn more about how can help your organization prepare to defend against sophisticated threats , respond and recover from incidents with speed and precision , and fortify your cybersecurity practices .


Specifically , Lookout determined these were trojanized versions of the apps SR Chat and YeeCall Pro . First , Turla steals emails by forwarding all outgoing emails to the attackers . ZxShell implemented its own version of the Windows B-TOOL S-OS SC command . The second step is simply the same exploit used in the second step of ProxyNotShell , allowing code execution through PowerShell remoting .


We also uncovered ViperRAT in a billiards game , an Israeli Love Songs player , and a Move To iOS app . We identified several European governments and defense companies compromised with this group . There are minor differences between the ZxShell implementation of this command and the original Windows one . Figure 6 : “ lun.vbs ” contents


The second stage The second stage apps contain the surveillanceware capabilities . What actually happens is that the malware is able to decode data from the PDF documents and interpret it as commands for the backdoor . The installed service registry key is opened and the 2 values under its Parameter subkey are created . A great example is that of the notorious bank robber slick Willy Sutton .


Lookout uncovered nine secondary payload applications : * These apps have not been previously reported and were discovered using data from the Lookout global sensor network , which collects app and device information from over 100 million sensors to provide researchers and customers with a holistic look at the mobile threat ecosystem today . In early 2018 , multiple media claimed that Turla operators used mail attachments to control infected machines . These 2 values , ServiceDll and ServiceDllUnloadOnStop are needed for services that run in a shared process . Postintrusion activities include lateral movement , as well as data collection and exfiltration via browserdata theft and a keylogger .


Naming additional payload applications as system updates is a clever technique used by malware authors to trick victims into believing a threat isn ’ t present on their device . As detailed in the previous section , this malware is able to manipulate and exfiltrate emails . Before the service is started ChangeServiceConfig is called to modify the service type to shared and interactive . Open Babel allows users to “ search , convert , analyze , or store data from molecular modeling , chemistry , solid - state materials , biochemistry , or related areas , ” according to its website , and is used in other popular pieces of software in the science field .


ViperRAT takes this one step further by using its dropper app to identify an appropriate second stage ‘ update ’ that may go unnoticed . To our knowledge , Turla is the only espionage group that currently uses a backdoor entirely controlled by emails , and more specifically via PDF attachments . If the service fails to start then a random service name formatted as netsvc_xxxxxxxx , where xxxxxxxx represent an 8-digit random hex value , is added to the netsvc group and the entire function is repeated . TIEDYE ( xpc.protect )


For example , if a victim has Viber on their device , it will choose to retrieve the Viber Update second stage . The attackers first infected in March 2017 . This function is the entry point of the service . As nations committed to upholding the rules - based international order in cyberspace , the United States and its allies and partners are taking steps to defend against Russia ’s irresponsible actions .


If he doesn ’ t have Viber , the generically-named System Updates app gets downloaded and installed instead . Our research shows that compromised organizations are at risk of not only being spied on by the Turla group who planted the backdoor , but also by other attackers . It registers the service using the RegisterServiceCtrlHandler Windows API function . There is an apocryphal story about why he robbed banks .


What was taken The actors behind ViperRAT seem to be particularly interested in image data . The developers refer to this tool by the name Kazuar , which is a Trojan written using the Microsoft.NET Framework that offers actors complete access to compromised systems targeted by its operator . The ZxShell service handler routine is only a stub : it responds to each service request code , doing nothing , and finally exits . Surprisingly enough , it does not take very long to get some information about Hack520 : someone with this handle runs a blog and a Twitter account ( with a handle close to Hack520 ) that is also directly linked to the blog .


We were able to identify that 8,929 files had been exfiltrated from compromised devices and that the overwhelming majority of these , 97 percent , were highly likely encrypted images taken using the device camera . We suspect the Kazuar tool may be linked to the Turla threat actor group ( also known as Uroburos and Snake ) , who have been reported to have compromised embassies , defense contractors , educational institutions , and research organizations across the globe . It sets the service status to RUNNING and finally calls the ShellMain function of ZxShell . This campaign has a multi - stage attack chain that begins with a phishing email delivered to victims impersonating CoinPayments , a legitimate global cryptocurrency payment gateway .


We also observed automatically generated files on the C2 , indicating the actor behind this campaign also issues commands to search for and exfiltrate PDF and Office documents . This is also a full-featured backdoor controlled by email , and which can work independently of any other Turla component . The ShellMain function is a stub that relocates the DLL to another buffer and spawns a thread that starts from ShellMainThreadInt at offset +0xC0CD . Through this entry , in which we take a closer look at an individual who we believe might be connected to the Winnti group , we hope to give both ordinary users and organizations better insights into some of the tools – notably the server infrastructures- these kinds of threat actors use , as well as the scale in which they operate .


This should be highly alarming to any government agency or enterprise . A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005 . The ShellMainThreadInt function gets the HeapDestroy Windows API address and replaces the first 3 bytes with the RET 4 opcode . Therefore , there are cases where these vulnerabilities are accessible via the internet .


We observed legitimate exfiltrated files of the following types of data : Contact information Compressed recorded audio in the Adaptive Multi-Rate ( amr ) file format Images captured from the device camera Images stored on both internal device and SDCard storage that are listed in the MediaStore Device geolocation information SMS content Chrome browser search history and bookmarks Call log information Cell tower information Device network metadata ; such as phone number , device software version , network country , network operator , SIM country , SIM operator , SIM serial , IMSI , voice mail number , phone If the hypothesis is correct and the Turla threat group is using Kazuar , we believe they may be using it as a replacement for Carbon and its derivatives . Subsequently , it calls the FreeLibrary function to free its own DLL buffer located at its original address . • new UK and US intelligence suggests Russia was behind an operation targeting commercial communications company Viasat in Ukraine • incident on 24 February caused outages for several thousand Ukrainian customers , and impacted windfarms and internet users in central Europe • cyber security leaders from the 5 Eyes , EU and other international allies meet at the NCSC ’s Cyber UK conference in Newport today to discuss shared threats Russia has been behind a series of cyber - attacks since the start of the renewed invasion of Ukraine , the EU , UK , US and other allies have announced today ( 10 May ) .


type , network type , data state , data activity , call state , SIM state , whether device is roaming , and if SMS is supported . We used a combination of tools such as NoFuserEx , ConfuserEx Fixer , ConfuserEx Switch Killer , and de4d0t in order to deobfuscate the code for in depth analysis . Because of this , the allocated heaps will not be freed . Anonymous Sudan appeared to be a core driver of claimed attacks targeting countries further afield , and it is primarily responsible for the recent surge of Israeli targeting ; however , nearly half of claimed Anonymous Sudan attacks still focused on U.S. or European organizations .


Standard browser search history Standard browser bookmarks Device handset metadata ; such as brand , display , hardware , manufacturer , product , serial , radio version , and SDK . Kazuar generates its mutex by using a process that begins with obtaining the MD5 hash of a string " [username]=>singleton-instance-mutex " . It re-copies the DLL from the new buffer to the original one using the memcpy function . CL0P used separate zero - days in GoAnywhere MFT and MOVEit Transfer to gain an edge .


Command and control API calls ViperRAT samples are capable of communicating to C2 servers through an exposed API as well as websockets . The subject is a series of targeted attacks against private companies . Finally , it spawns the main thread that starts at the original location of ShellMainThread procedure , and terminates . In October 2019 , ESET published “ Operation Ghost ” detailing a set of new trojans used by the Dukes , including PolyglotDuke , RegDuke and FatDuke .


Below is a collection of API methods and a brief description around their purpose . e uncovered the activity of a hacking group which has Chinese origins . At this point , the ZxShell library is no longer linked in the module list of the host process . In other highly successful runs , the actor sent out phony Flash videos directly as email attachments .


On attribution Media reporting on ViperRAT thus far attributes this surveillanceware tool to Hamas . Also , by creating this type of API access , Turla could use one accessible server as a single point to dump data to and exfiltrate data from . This is important because if any system tool tries to open the host process it will never display the ZxShell DLL . None on the CrowdStrike Falcon ® console and of the market - leading CrowdStrike Falcon ® platform in action .


Israeli media published the first reports about the social networking and social engineering aspects of this campaign . According to our estimations , this group has been active for several years and specializes in cyberattacks against the online video game industry . This thread implements the main code , responsible for the entire botnet DLL . Up until now , we ’ve been relatively lucky – our most recent examples of social network - based cybercrime reveal threat actors using relatively mild motives ( monetization ) .


However it ’ s unclear whether organizations that later reported on ViperRAT performed their own independent research or simply based their content on the original Israeli report . Based on our analysis , we believe that threat actors may compile Windows and Unix based payloads using the same code to deploy Kazuar against both platforms . First , it checks if the DLL is executed as a service . Adversaries may utilize command - line interfaces ( CLIs ) to interact with systems and execute commands .


Hamas is not widely known for having a sophisticated mobile capability , which makes it unlikely they are directly responsible for ViperRAT . The group 's main objective is to steal source codes . If so , it spawns the service watchdog thread . Wall to Wall reached out in July 2022 about collaborating with Bullock after KrebsOnSecurity published A Retrospective on the 2015 Ashley Madison Breach .


ViperRAT has been operational for quite some time , with what appears to be a test application that surfaced in late 2015 . In 2010 HBGary investigated an information security incident related to the Winnti group at one of HBGary 's customers – an American video game company . The watchdog thread checks the registry path of the ZxShell service every 2 seconds , to verify that it has n’t been modified . What the team uncovered was that the former MiniDuke attackers were still active , and using extremely effective social engineering techniques involving sending malicious PDF documents to compromise their victims .


Many of the default strings in this application are in Arabic , including the name . In 2010 US-based HBGary investigated an information security incident related to the Winnti group at one of HBGary 's customers – an American video game company . If a user or an application modifies the ZxShell service registry key , the code restores the original infected service key and values . The majority of the Excel campaigns show some element of luring the user to enable macros in Excel with specific content using Ukrainian language .


It is unclear whether this means early samples were targeting Arabic speakers or if the developers behind it are fluent in Arabic . For a long time the Winnti group had been considered as a Chinese threat actor targeting gaming companies specifically . The buffer containing the ZxShell Dll in the new location is freed using the VirtualFree API function . FREEFIRE communicates to a hard - coded channel to retrieve commands and upload responses .


This leads us to believe this is another actor . In April Novetta released its excellent report on the Winnti malware spotted in the operations of Axiom group . A handle to the DLL file is taken in order to make its deletion more difficult . None Read about adversaries tracked by CrowdStrike in 2021 in the and in the • None Learn more about how can help your organization prepare to defend against sophisticated threats , respond and recover from incidents with speed and precision , and fortify your cybersecurity practices .


What this means for you All Lookout customers are protected from this threat . The Axiom group has been presented as an advanced Chinese threat actor carrying out cyber-espionage attacks against a whole range of different industries . The ZxShell mutex is created named @_ZXSHELL_@ . The file c018c54eff8fd0b9be50b5d419d80f21 ( r3_iec104_control.py ) imports the " iec104_mssql_lib " module , which is contained within the extracted contents as adfa40d44a58e1bc909abca444f7f616 ( iec104_mssql_lib.pyc ): 2b86adb6afdfa9216ef8ec2ff4fd2558 ( iec104_mssql_lib.py ) implements PIEHOP ’s primary capabilities and contains many developer - supplied comments for the included code .


However , the existence of threats like ViperRAT and Pegasus , the most sophisticated piece of mobile surveillanceware we ’ ve seen to date , are evidence that attackers are targeting mobile devices . this library includes two drivers compiled on August 22 and September 4 , 2014 . ZxShell plugins are parsed and loaded with the AnalyseAndLoadPlugins function . OilRig uses two initial access vectors spearphishing and through ITbrain , which is a remote administration software , used in conjunction with the remote access tool TeamViewer .


Mobile devices are at the frontier of cyber espionage , and other criminal motives . Also our visibility as a vendor does not cover every company in the world ( at least so far ; ) ) and the Kaspersky Security Network ( KSN ) did not reveal other attacks except those against gaming companies . The plugin registry key HKLM\SYSTEM\CurrentControlSet\Control\zxplug is opened and each value is queried . RA Group , in its ongoing campaigns , has targeted the U.S. , South Korea , Taiwan , the U.K. and India across several business verticals , including manufacturing , wealth management , insurance providers , pharmaceuticals and financial management consulting companies .


Enterprise and government employees all use these devices in their day-to-day work , which means IT and security leaders within these organizations must prioritize mobile in their security strategies . Conversely , LokiBot and Agent Tesla are new malware tools . The registry value contains the plugin file name . This can lead to a ransom situation where hackers demand money from the company in exchange for not releasing their data onto the internet or for unlocking their systems .


Check Point researchers discovered another widespread malware campaign on Google Play , Google ’ s official app store . Based on multiple active compromises by the Axiom threat group , Novetta was able to capture and analyze new Winnti malware samples . The target file is loaded using the LoadLibrary API function , and the address of the exported function zxMain is obtained with GetProcAddress . Ransomware gangs are consistently rebranding or merging with other groups , as highlighted in our 2022 Year in Review , or these actors work for multiple ransomware - as - a - service ( RaaS ) outfits at a time , and new groups are always emerging .


The malware , dubbed “ Judy ” , is an auto-clicking adware which was found on 41 apps developed by a Korean company . Initial attack targets are commonly software and gaming organizations in United States , Japan , South Korea , and China . If the target filename is incorrect or invalid the plugin file is deleted and the registry value is erased . First , the discovery of new OT malware presents an immediate threat to affected organizations , since these discoveries are rare and because the malware principally takes advantage of insecure by design features of OT environments that are unlikely to be remedied any time soon .


The malware uses infected devices to generate large amounts of fraudulent clicks on advertisements , generating revenues for the perpetrators behind it . Initial attack targets are commonly software and gaming organizations in United States , Japan , South Korea , and China . That is performed by the function DeleteAndLogPlugin . Using differential firmware analysis , we identified the vulnerable endpoint and developed a PoC to validate the vulnerability .


The malicious apps reached an astonishing spread between 4.5 million and 18.5 million downloads . The samples Novetta obtained from the active Axiom infection were compiled in mid- to late 2014 and represent what Novetta is referring to as version 3.0 of the Winnti lineage . Otherwise , the plugin is added to an internal list . The directory choices and naming conventions of the Ruby script and second stage payloads indicated the threat actor placed significant priority into masquerading as legitimate files and applications .


Some of the apps we discovered resided on Google Play for several years , but all were recently updated . We assess with high confidence that the Winnti umbrella is associated with the Chinese state intelligence apparatus , with at least some elements located in the Xicheng District of Beijing . The thread KeyloggerThread is spawned and is responsible for doing keylogging on the target workstation . None Use of Python for malware development and/or packaging : We expect to continue to observe attackers compiling or packaging their OT malware via methods such as PyInstaller ( IRONGATE ) or Py2Exe ( TRITON ) given the proliferation of OT malware developed or packaged using Python in recent years .


It is unclear how long the malicious code existed inside the apps , hence the actual spread of the malware remains unknown . The Winnti umbrella continues to operate highly successfully in 2018 . We will take a look at the keylogger later on . Enable robust application logging for MicroSCADA and aggregate logs to a central location .


We also found several apps containing the malware , which were developed by other developers on Google Play . The Winnti umbrella and closely associated entities has been active since at least 2009 . Finally the main network communication function GetIpListAndConnect is called . The strings are obfuscated using the stack and simple Bitwise operation .


The connection between the two campaigns remains unclear , and it is possible that one borrowed code from the other , knowingly or unknowingly . The Winnti and Axiom group names were created by Kaspersky Lab and Symantec , respectively , for their 2013/2014 reports on the original group . This function is at the core of the RAT ’s network communication . Other interesting anomalies in June include 47 attacks on the Manufacturing industry ( which usually averages around 20 attacks a month ) and notable increases in attacks on Switzerland ( 14 ) and Brazil ( 13 ) , both of which are normally attacked only two or three times a month .


The oldest app of the second campaign was last updated in April 2016 , meaning that the malicious code hid for a long time on the Play store undetected . Their operations against gaming and technology organizations are believed to be economically motivated in nature . It starts by initializing a random number generator and reading 100 bytes inside the ZxShell Dll at a hardcoded location . Using tools that are more lightweight and generic than those observed in prior OT incidents , the actor likely decreased the time and resources required to conduct a cyber physical attack .


These apps also had a large amount of downloads between 4 and 18 million , meaning the total spread of the malware may have reached between 8.5 and 36.5 million users . However , based on the findings shared in this report we assess with high confidence that the actor 's primary long-term mission is politically focused . These bytes are XOR encrypted with the byte-key 0x85 and contains a list of remote hosts where to connect . If you can not apply the KB5019758 patch immediately , you should disable OWA until the patch can be applied .


Similar to previous malware which infiltrated Google Play , such as FalseGuide and Skinner , Judy relies on the communication with its Command and Control server ( C & C ) for its operation . The Winnti umbrella and linked groups' initial targets are gaming studios and high tech businesses . The data is decrypted , the remote host list is parsed and verified using the BuildTargetIpListStruct function . So , when LockBit , the most active ransomware group in the world , is hitting three times as many victims as the next most active gang , you need to know how to prepare .


After Check Point notified Google about this threat , the apps were swiftly removed from the Play store . During the same time period , we also observed the actor using the Browser Exploitation Framework ( BeEF ) to compromise victim hosts and download Cobalt Strike . There are 3 types of lists recognized by ZxShell : plain ip addresses , HTTP and FTP addresses . Cisco Secure Firewall ( formerly Next - Generation Firewall and Firepower NGFW ) appliances such as Threat Defense Virtual , Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat .


How Judy operates : To bypass Bouncer , Google Play ’ s protection , the hackers create a seemingly benign bridgehead app , meant to establish connection to the victim ’ s device , and insert it into the app store . In this campaign , the attackers experimented with publicly available tooling for attack operations . If the list does not contain any item , or if the verification has failed , the ZxShell sample tries to connect to a hardcoded host Budworm is a longrunning APT group that is believed to have been active since at least 2013 .


Once a user downloads a malicious app , it silently registers receivers which establish a connection with the C & C server . The primary goal of these attacks was likely to find code-signing certificates for signing future malware . with the goal of retrieving a new updated list . Danbot , Shark , and Milan use both DNS and HTTPS for C2 communications , while Marlin uses the OneDrive API for C2 communications .


The server replies with the actual malicious payload , which includes JavaScript code , a user-agent string and URLs controlled by the malware author . The Chinese intelligence apparatus has been reported on under many names , including Winnti , PassCV , APT17 , Axiom , LEAD , BARIUM , Wicked Panda , and GREF . Otherwise , ZxShell tries to connect to the first item of the list . This allows application control solutions to block unknown threats .


The malware opens the URLs using the user agent that imitates a PC browser in a hidden webpage and receives a redirection to another website . The attackers behind observed activity in 2018 operate from the Xicheng District of Beijing via the net block 221.216.0.0/13 . If ZxShell successfully connects to the remote host , the function DoHandshake is called . As 2021 ends , one critical theme remains constant within the world of enterprise security ransomware attacks are continuing to rise , yearoveryear , across private and public entities .


Once the targeted website is launched , the malware uses the JavaScript code to locate and click on banners from the Google ads infrastructure . ALLANITE activity closely resembles Palmetto Fusion described by the US Department of Homeland Security ( DHS ) . This function implements the initial handshake which consists of exchanging 16 bytes , 0x00001985 and 0x00000425, Iranian officials state the delegations agreed that good progress was made during the seventh round that ended 10 days earlier , and there is now a suitable framework to take the talks forward .


Upon clicking the ads , the malware author receives payment from the website developer , which pays for the illegitimate clicks and traffic . ALLANITE activity closely resembles Palmetto Fusion described by the US Department of Homeland Security . with the server . This is analogous to antivirus solutions using known virus signatures to determine if a computing interaction suggests virus installation or malware delivery across the network .


The JavaScript code locates the targeted ads by searching for iframes which contain ads from Google ads infrastructure , as shown in the image below : The fraudulent clicks generate a large revenue for the perpetrators , especially since the malware reached a presumably wide spread . ALLANITE uses email phishing campaigns and compromised websites called watering holes to steal credentials and gain access to target networks , including collecting and distributing screenshots of industrial control systems . The function GetLocalPcDescrStr is used to compose a large string that contains system information of the target workstation . Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader , one of the most popular PDF reader alternatives to Adobe Acrobat .


Who is behind Judy ? In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group Symantec calls Dragonfly ( which Dragos associates with DYMALLOY ) . The string is sent to the remote host and the response is checked to see if the first byte of the response is 0xF4, an arbitrary byte . The form also contains legitimate macro code modified by the attacker to call malicious subroutines .


The malicious apps are all developed by a Korean company named Kiniwini , registered on Google Play as ENISTUDIO corp . In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group . If it is , the botnet connection I/O procedure is called through the MainConnectionIo function . The cyber espionage campaign has been attributed to Iranian APT MuddyWater aka Static Kitten and is reported to be actively ongoing , targeting government agencies , as well as entities in the sectors of tourism and academia , within countries including the UAE , Saudi Arabia , and Israel .


The company develops mobile apps for both Android and iOS platforms . We assess with high confidence that the attackers discussed here are associated with the Chinese state intelligence apparatus . Otherwise , the ZxShell code closes the socket used and sleeps for 30 seconds . Maybe the text in the email jokes about the trip you took last week and how you came back sunburnt .


It is quite unusual to find an actual organization behind mobile malware , as most of them are developed by purely malicious actors . ALLANITE operations limit themselves to information gathering and have not demonstrated any disruptive or damaging capabilities . It will then retry the connection with the next remote host , if there is one . Sandworm ’s Threat Activity Reveals Insights into Russia ’s Offensive Cyber Capabilities


It is important to note that the activity conducted by the malware is not borderline advertising , but definitely an illegitimate use of the users ’ mobile devices for generating fraudulent clicks , benefiting the attackers . In October 2017 , a DHS advisory documented ALLANITE technical operations combined with activity with a group Symantec calls Dragonfly . It is noteworthy that this function includes the code to set the ZxShell node as a server : if one of the hardcoded boolean value is set to 1, a listening socket is created . After analyzing code from a command and control ( C2 ) server used in the global cyber - espionage campaign dubbed ' Sharpshooter ' , security researchers found more evidence linking it to North Korea 's Lazarus threat actor .


In addition to the clicking activity , Judy displays a large amount of advertisements , which in some cases leave users with no option but clicking on the ad itself . Public disclosure by third-parties , including the DHS , associate ALLANITE operations with Russian strategic interests . The code waits for an incoming connection . Module ID Internal Name 1 module_ipc 2 module_monitor 3 module_apu 4 module_event 5 module_net


Although most apps have positive ratings , some of the users have noticed and reported Judy ’ s suspicious activities , as seen in the images below : As seen in previous malware , such as DressCode , a high reputation does not necessarily indicate that the app is safe for use . ALLANITE conducts malware-less operations primarily leveraging legitimate and available tools in the Windows operating system . When the connection is established a new thread is spawned that starts with the MainConnectionIo function . The leaked Biderman emails show that Harrison made good on his threats , and that in the months that followed Harrison began targeting Biderman and other Ashley Madison executives with menacing anonymous emails and spoofed phone calls laced with profanity and anti - Semitic language .


Hackers can hide their apps ’ real intentions or even manipulate users into leaving positive ratings , in some cases unknowingly . Dragos does not publicly describe ICS activity group technical details except in extraordinary circumstances in order to limit tradecraft proliferation . The MainConnectionIo function checks if the Windows Firewall is enabled , sets the Tcp Keep Alive value and Non-blocking mode connection options and receives data from the remote host through the ReceiveCommandData function . • Other actors merged into this group : 0 Sign up for free Mandiant Threat Intelligence for detailed reports about UNC groups including :


Users can not rely on the official app stores for their safety , and should implement advanced security protections capable of detecting and blocking zero-day mobile malware . However , full details on ALLANITE and other group tools , techniques , procedures , and infrastructure is available to network defenders via Dragos WorldView . Then the connection is retried . Figure 2 : Historical Russia - nexus activity impacting OT


PHA Family Highlights : Bread ( and Friends ) January 9 , 2020 In this edition of our PHA Family Highlights series we introduce Bread , a large-scale billing fraud family . In addition to maritime operations in this region , Anchor Panda also heavily targeted western companies in the US , Germany , Sweden , the UK , and Australia , and other countries involved in maritime satellite systems , aerospace companies , and defense contractors . The received command is then processed by the ZxShell function with the ProcessCommand function . Since early 2023 , we have seen several new Yashma strains emerge , including ANXZ , Sirattacker , and Shadow Men Team .


We first started tracking Bread ( also known as Joker ) in early 2017 , identifying apps designed solely for SMS fraud . A current round of cyber-attacks from Chinese source groups are targeting the maritime sector in an attempt to steal technology . The command processing function starts by substituting the main module name and path in the hosting process PEB , with the one of the default internet browser . The attacks that Anonymous Sudan has claimed in support of KillNet , both before and after it officially joined the collective , have broadened the geographic scope of its targeting to include entities elsewhere in Europe and the U.S. ; it has since continued to expand the scope of its targeting further afield to include countries such as Israel and Ethiopia .


As the Play Store has introduced new policies and Google Play Protect has scaled defenses , Bread apps were forced to continually iterate to search for gaps . PLA Navy Anchor Panda is an adversary that CrowdStrike has tracked extensively over the last year targeting both civilian and military maritime operations in the green/brown water regions primarily in the area of operations of the South Sea Fleet of the PLA Navy . This trick renders identification by firewall more cumbersome . In general terms , spyware is software that can be installed on a device and used to monitor activity and/or capture potentially sensitive data .


They have at some point used just about every cloaking and obfuscation technique under the sun in an attempt to go undetected . ALLANITE operations continue and intelligence indicates activity since at least May 2017 . A host firewall Several issues in Foxit PDF reader could lead to arbitrary code execution Foxit PDF Reader is one of the most popular PDF readers on the market , offering many similar features to Adobe Acrobat .


Many of these samples appear to be designed specifically to attempt to slip into the Play Store undetected and are not seen elsewhere . APT Anchor Panda is a Chinese threat actor group who target maritime operations . S-TOOLwill recognize the outgoing connection as originated by the browser instead of the ZxShell service host process . Attackers send these emails to multiple accounts , hoping that someone will believe the story , and pay up .


In this post , we show how Google Play Protect has defended against a well organized , persistent attacker and share examples of their techniques . According to cyber security researchers , Anchor Panda , who work directly for the Chinese PLA Navy , likely remains active . The browser process always performs outgoing connections and the firewall should n’t block them . Whoever hacked Ashley Madison had access to all employee emails , but they only released Biderman ’s messages — three years worth .


TL ; DR Google Play Protect detected and removed 1.7k unique Bread apps from the Play Store before ever being downloaded by users Bread apps originally performed SMS fraud , but have largely abandoned this for WAP billing following the introduction of new Play policies restricting use of the SEND_SMS permission and increased coverage by Google Play Protect More information on stats and relative impact is available in the Android Security 2018 Year in Review report BILLING FRAUD Bread apps typically fall into two categories : SMS fraud ( older versions ) and toll fraud ( newer versions ) . Dragos does not corroborate nor conduct political attribution to threat activity . The command processing is straightforward . Subsequently , KillNet claimed to have compromised NATO ’s training site , Joint Advanced Distributed Learning , and published dozens of purportedly leaked images on its channels .


Both of these types of fraud take advantage of mobile billing techniques involving the user ’ s carrier . In the past they used Adobe Gh0st , Poison Ivy and Torn RAT malware as their primary attack vector is sphere phishing . Here is the list of common commands : Methods for doing that include built - in functionality of malware or by using utilities present on the system .


SMS Billing Carriers may partner with vendors to allow users to pay for services by SMS . Their targets are marine companies that operate in and around the South China Sea , an area of much Chinese interest . Help / ? Get help . Mandiant identified novel operational technology ( OT ) / industrial control system ( ICS)-oriented malware , which we track as COSMICENERGY , uploaded to a public malware scanning utility in December 2021 by a submitter in Russia .


The user simply needs to text a prescribed keyword to a prescribed number ( shortcode ) . As recently as this past week , researchers observed Chinese hackers escalating cyber-attack efforts to steal military research secrets from US universities . Exit / Quit Exit and shut down the botnet client . None The discovery was part of recent CrowdStrike Services investigations into several Play ransomware intrusions where the common entry vector was confirmed to be Microsoft Exchange .


A charge is then added to the user ’ s bill with their mobile service provider . The cyber-espionage campaign has labelled the group Advanced Persistent Threat ( APT ) 40 or , titled , Periscope . SysInfo Get target System information . We were able to find additional links between Hack520 ’s “ Pig network ” and the Winnti group ’s activities .


Toll Billing Carriers may also provide payment endpoints over a web page . The group has been active since at least January 2013 . SYNFlood Perform a SYN attack on a host . Many threat groups successfully leverage aging vulnerabilities , which , if they had been patched by their victims , may have prevented an attack .


The user visits the URL to complete the payment and enters their phone number . The group has also targeted businesses operating in the South China Sea , which is a strategically important region and the focus of disputes between China and other states . Ps Process service Unix command implementation . What ’s more , two other vulnerabilities in MOVEit were found while new victims were still coming forward .


Verification that the request is coming from the user ’ s device is completed using two possible methods : The user connects to the site over mobile data , not WiFi ( so the service provider directly handles the connection and can validate the phone number ) ; or The user must retrieve a code sent to them via SMS and enter it into the web page ( thereby proving access to the provided phone number ) . The main targets seem to be US companies in engineering , transport and defense , although it has targeted other organizations around the world . CleanEvent Clear System Event log . By using LotL techniques , the actor likely decreased the time and resources required to conduct its cyber physical attack .


Fraud Both of the billing methods detailed above provide device verification , but not user verification . The times of day the group is active also suggests that it is based near Beijing and the group has reportedly used malware that has been observed in other Chinese operations , indicating some level of collaboration . FindPass Find login account password . Although this wave did not use any zero day exploits , it relied on steganography and NTFS alternate data streams to complicate detection .


The carrier can determine that the request originates from the user ’ s device , but does not require any interaction from the user that can not be automated . Periscope 's activity has previously been suspected of being linked to China , but now researchers believe their evidence links the operation to the Chinese state . FileTime Get time information about a file . While there may be other groups they want to target also , they tend to be more persistent .


Malware authors use injected clicks , custom HTML parsers and SMS receivers to automate the billing process without requiring any interaction from the user . APT40 is described as a moderately sophisticated cyber-espionage group which combines access to significant development resources with the ability to leverage publicly available tools . FindDialPass List all the dial-up accounts and passwords . Although attacks on education have been a staple of the ransomware ecosystem for years , Vice Society appears to have specialised in delivering misery to schools , colleges , and universities in a highly unusual way .


STRING & DATA OBFUSCATION Bread apps have used many innovative and classic techniques to hide strings from analysis engines . Anchor Panda uses website and web-server compromise as a means of attack and leverages an enormous cache of tools in its campaigns , to include exploits that take advantage of known CVE software vulnerabilities . User Account Management System . While one of his signatures uses his own blog domain , there is also a second signature which uses 93[.]gd , a domain that was found to have been actively selling VPS services in the past .


Here are some highlights . Like many espionage campaigns , much of APT40 's activity begins by attempting to trick targets with phishing emails , before deploying malware such as the Gh0st RAT trojan to maintain persistence on a compromised network . TransFile Transfer file in or from remote host . Software developers can use coded certificates to digitally sign their software , which means any code with that signature becomes a trusted source .


Standard Encryption Frequently , Bread apps take advantage of standard crypto libraries in ` java.util.crypto ` . The group uses website and web-server compromise as a means of attack and leverages an enormous cache of tools in its campaigns , to include exploits that take advantage of known CVE software vulnerabilities . Execute Run a program in the remote host . The actor hunts for confidential information stored in the networks of governmental organizations , political groups and think tanks , as well as various individuals involved in defense and geopolitical related research .


We have discovered apps using AES , Blowfish , and DES as well as combinations of these to encrypt their strings . More than half of the organizations we have observed being targeted or breached by APT5 operate in these sectors . SC Service control command , implemented as the Windows one . Our initial investigation on the domains registered by Hack520 revealed that similar domains ( listed below ) were registered by another profile .


Custom Encryption Other variants have used custom-implemented encryption algorithms . APT5 has been active since at least 2007 . CA Clone user account . That 's because a new ransomware called BlackSuit had appeared which shared 98 percent of its code with the infamous Royal ransomware .


Some common techniques include : basic XOR encryption , nested XOR and custom key-derivation methods . APT5 has targeted or breached organizations across multiple industries , but its focus appears to be on telecommunications and technology companies , especially information about satellite communications . RunAs Create new process as another User or Process context . In a modern ransomware attack the target is an entire organisation , not just one or two computers .


Some variants have gone so far as to use a different key for the strings of each class . APT5 targeted the network of an electronics firm that sells products for both industrial and military applications . TermSvc Terminal service configuration ( working on Win Xp/2003 ) . None Follow Microsoft recommendations to disable remote PowerShell for non - administrative users where possible .


Split Strings Encrypted strings can be a signal that the code is trying to hide something . The group subsequently stole communications related to the firm 's business relationship with a national military , including inventories and memoranda about specific products they provided . GetCMD Remote Shell . June also witnessed a staggering increase in attacks from relatively new gangs such as Akira ( 26 ) and 8Base ( 41 ) , enough to propel both of them into the top five — a designation usually reserved for more familiar names like ALPHV , who was conspicuously silent in June .


Bread has used a few tricks to keep strings in plaintext while preventing basic string matching . In one case in late 2014 , APT5 breached the network of an international telecommunications company . Shutdown Logout , shutdown or restart the target system . Check the flag T as indicator if single stepping .


Going one step further , these substrings are sometimes scattered throughout the code , retrieved from static variables and method calls . The group used malware with keylogging capabilities to monitor the computer of an executive who manages the company 's relationships with other telecommunications companies . ZXARPS Spoofing , redirection , packet capture . The U.S. Government has developed new mechanisms to help Ukraine identify cyber threats and recover from cyber incidents .


Various versions may also change the index of the split ( e.g . APT5 also targeted the networks of some of Southeast Asia 's major telecommunications providers with Leouncia malware . ZXNC Run ZXNC v1.1 – a simple telnet client . This is just another example of how these groups can now quickly develop their own ransomware variants by standing on the shoulders of those criminals who had their previous work exposed publicly .


“ .clic ” and “ k ( ) ; ” ) . We suspect that the group sought access to these networks to obtain information that would enable it to monitor communications passing through the providers' systems . ZXHttpProxy Run a HTTP proxy server on the workstation . It is still unclear whether its authors have any links to known cybercrime organizations .


Delimiters Another technique to obfuscate unencrypted strings uses repeated delimiters . The FBI said the " group of malicious cyber actors " ( known as APT6 or 1.php ) used dedicated top-level domains in conjunction with the command and control servers to deliver " customized malicious software " to government computer systems . ZXSockProxy Run a Sock 4 & 5 Proxy server . Learn How ThreatConnect Can Help Protect Email From Phishing and BEC Attacks


A short , constant string of characters is inserted at strategic points to break up keywords : At runtime , the delimiter is removed before using the string : API OBFUSCATION SMS and toll fraud generally requires a few basic behaviors ( for example , disabling WiFi or accessing SMS ) , which are accessible by a handful of APIs . Deepen told Threatpost the group has been operating since at least since 2008 and has targeted China and US relations experts , Defense Department entities , and geospatial groups within the federal government . ZXHttpServer Run a custom HTTP server . In the case of the exploit method described here as OWASSRF , the endpoint is not used , in lieu , and the request will not be dropped .


Given that there are a limited number of behaviors required to identify billing fraud , Bread apps have had to try a wide variety of techniques to mask usage of these APIs . Government officials said they knew the initial attack occurred in 2011 , but are unaware of who specifically is behind the attacks . PortScan Run TCP Port MultiScanner v1.0 . Attribution to the Dukes was made partly on the LNK file structure and other TTPs , including the targets of the attack .


Reflection Most methods for hiding API usage tend to use Java reflection in some way . According to Deepen , APT6 has been using spear phishing in tandem with malicious PDF and ZIP attachments or links to malware infected websites that contains a malicious SCR file . KeyLog Capture or record the remote computer ’s keystrokes . The code contains the next stage stored as hexadecimal encoded strings and is split into multiple strings so that an antivirus scan would not detect the content as potentially malicious .


In some samples , Bread has simply directly called the Reflect API on strings decrypted at runtime . Nearly a month later , security experts are now shining a bright light on the alert and the mysterious group behind the attack . The implementation is a userland keylogger that polls the keymap with each keystroke . Notably , the Telegram channel in which actors claiming to be from REvil claimed links with KillNet had been created only days before the operation began on June 15 , 2023 .


JNI Bread has also tested our ability to analyze native code . The attacks discussed in this blog are related to an APT campaign commonly referred to as " th3bug " , named for the password the actors often use with their Poison Ivy malware . LoadDll Load a DLL into the specified process . This campaign also strays from Infys usual target group of Iranian individuals and entities , with victims of Foudre located in Sweden , the Netherlands , the U.S. , along with others across Europe , Iraq , and India .


In one sample , no SMS-related code appears in the DEX file , but there is a native method registered . Over the summer they compromised several sites , including a well-known Uyghur website written in that native language . End Terminate ZxShell DLL . In terms of the fallout , it ’s tough to overstate the havoc Cl0p was able to wreck thanks to the zero - day .


Two strings are passed into the call , the shortcode and keyword used for SMS billing ( getter methods renamed here for clarity ) . In contrast to many other APT campaigns , which tend to rely heavily on spear phishing to gain victims , " th3bug " is known for compromising legitimate websites their intended visitors are likely to frequent . Uninstall Uninstall and terminate ZxShell bot DLL . The exploits were sourced from different VPN provider IP addresses and previously compromised third - party devices .


In the native library , it stores the strings to access the SMS API . While we were unable to recover the initial vulnerability used , it is possibly the same CVE-2014-0515 Adobe Flash exploit first reported by Cisco TRAC in late July . ShareShell Share a shell to other . In the case of a traditional ProxyNotShell exploit chain , the attack sequence is done in two steps :


The nativesend method uses the Java Native Interface ( JNI ) to fetch and call the Android SMS API . However , to increase success rates APT20 can use zero-day exploits , so even a properly patched system would be compromised . CloseFW Switch off Windows Firewall . The group appears to commonly deploy double extortion of the victims that have been listed on the leak site , several of them have had some portion of their exfiltrated data exposed .


The following is a screenshot from IDA with comments showing the strings and JNI functions . Our direct observation of in-the-wild spearphishing attacks staged by the Bahamut group have been solely attempts to deceive targets into providing account passwords through impersonation of notices from platform providers . FileMG File Manager . winvnc Remote Desktop . rPortMap Port Forwarding . capsrv Video Device Spying . zxplug Add and load a ZxShell custom plugin . Wall to Wall reached out in July 2022 about collaborating with Bullock after KrebsOnSecurity published A Retrospective on the 2015 Ashley Madison Breach .


WebView JavaScript Interface Continuing on the theme of cross-language bridges , Bread has also tried out some obfuscation methods utilizing JavaScript in WebViews . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 . This set of functionality allows the operator complete control of a system . Astamirov is now facing charges of wire fraud and of intentionally damaging protected computers , plus he 's accused of making ransom demands through deploying ransomware .


The following method is declared in the DEX . Later that month , the same tactics and patterns were seen in attempts against an Iranian women 's activist – an individual commonly targeted by Iranian actors , such as Charming Kitten and the Sima campaign documented in our 2016 Black Hat talk . Being able to transfer and execute files on the infected system means the attacker can run any code they please . Following a three - month lull of activity , Cl0p returned with a vengeance in June and beat out LockBit as the month ’s most active ransomware gang .


Without context , this method does not reveal much about its intended behavior , and there are no calls made to it anywhere in the DEX . In June we published on a previously unknown group we named " Bahamut " , a strange campaign of phishing and malware apparently focused on the Middle East and South Asia . Further , the keylogging and remote desktop functionality allows the operator to spy on the infected machine , observing all keystrokes and viewing all user actions . It allows security researchers to analyze the source code and understand the attacker ’s tactics , techniques and procedures ( TTPs ) , which helps security professionals develop effective detection rules and enhance security products ' capabilities in combating ransomware threats .


However , the app does create a WebView and registers a JavaScript interface to this class . Once inside a network , APT40 uses credential-harvesting tools to gain usernames and passwords , allowing it to expand its reach across the network and move laterally through an environment as it moves to towards the ultimate goal of stealing data . Unloads ZxShell and deletes all of the active components . The first , CVE-2022 - 41123 , has been revealed by ZDI to be DLL hijacking3 due to the loading of a non - existent component by a privileged executed command .


This gives JavaScript run in the WebView access to this method . Bahamut was shown to be resourceful , not only maintaining their own Android malware but running propaganda sites , although the quality of these activities varied noticeably . This simply deletes the ZxShell service key from the Windows registry ( using SHDeleteKey Api ) and all of the subkeys . The second , CVE-2022 - 41080 , has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022 - 41040 used in the ProxyNotShell exploit chain , and it has been marked “ exploitation more likely . ”


The app loads a URL pointing to a Bread-controlled server . In June we published on a previously unknown group we named " Bahamut " , a strange campaign of phishing and malware apparently focused on the Middle East and South Asia . Finally , it marks ZxShell main Dll for deletion with the MoveFileEx Windows API . TIEDYE supports the following protocols : tcp , tcp6 , udp , upd6 , http , https , proxy_socks4 , proxy_socks4a , pipe , ssl , ssl3 , and rdp .


The response contains some basic HTML and JavaScript . Several times , APT5 has targeted organizations and personnel based in Southeast Asia . This function is the supporting functionality for WinVNC . “ So good luck , I ’m sure we ’ll talk again soon , but for now , I ve got better things in the oven , ” Harrison wrote to Biderman after his employment contract with Ashley Madison was terminated .


In green , we can see the references to the SMS API . However , in the same week of September a series of spearphishing attempts once again targeted a set of otherwise unrelated individuals , employing the same tactics as before . To allow the VNC session to connect , the current network socket WSAProtcol_Info structure is written to a named pipe prior to calling zxFunction001 . zxFunction001 modifies the current process memory , uses data contained in the named pipe to create a socket , and then executes the code that sends the remote desktop session to the server controller . The rare opportunity to examine Sharpshooter 's backend operations allowed the researchers to create a fuller picture of the activity and interaction between the various tools used by the threat actor .


In red , we see those values being passed into the suspicious Java method through the registered interface . Our primary contribution in this update is to implicate Bahamut in what are likely counterterrorism-motivated surveillance operations , and to further affirm our belief that the group is a hacker-for-hire operation . ZxFunction002 This will either bind the calling process to a port or has the calling process connect to a remote host . Therefore , there are cases where these vulnerabilities are accessible via the internet .


Now , using these strings method1 can use reflection to call sendTextMessage and process the payment . As we wrote then , compared to Kingphish , Bahamut operates as though it were a generation ahead in terms of professionalism and ambition . The functionality ( connect or bind ) depends on the data contained within the named pipe . This has been coined as the Mark Heptad yes after this author and creator .


PACKING In addition to implementing custom obfuscation techniques , apps have used several commercially available packers including : Qihoo360 , AliProtect and SecShell . In the Bahamut report , we discussed two domains found within our search that were linked with a custom Android malware agent . Unlike zxFunction001, this is not used by The SCIL commands would have caused the MicroSCADA server to relay the commands to the substation RTUs via either the IEC-60870 - 5 - 104 protocol for TCP / IP connections or the IEC-60870 - 5 - 101 protocol for serial connections .


More recently , we have seen Bread-related apps trying to hide malicious code in a native library shipped with the APK . After the publication of the original report , these sites were taken offline despite the fact that one agent was even updated a six days prior to our post ( the " Khuai " application ) . any of the RAT commands in the zxshell.dll . There are several indicators of compromise that organizations should monitor .


Earlier this year , we discovered apps hiding a JAR in the data section of an ELF file which it then dynamically loads using DexClassLoader . FIF is notable for its links to the Lashkar-e-Taiba ( LeT ) terrorist organization , which has committed mass-casualty attacks in India in support of establishing Pakistani control over the disputed Jammu and Kashmir border region . Apart from user-mode ZxShell droppers mentioned earlier , there is a file ( SHA256 : 1e200d0d3de360d9c32e30d4c98f07e100f6260a86a817943a8fb06995c15335 ) that installs a kernel device driver called loveusd.sys . None After initial access via this new exploit method , the threat actor leveraged maintain access , and performed anti - forensics techniques on the Microsoft Exchange server in an attempt to hide their activity .


The figure below shows a fragment of encrypted JAR stored in .rodata section of a shared object shipped with the APK as well as the XOR key used for decryption . As a result , it is already flagged as Bahamut by antivirus engines . The architecture of this dropper is different from the others : it starts extracting the main driver from itself . A new report from the Malwarebytes Threat Intelligence team shows 1,900 total ransomware attacks within just four countries — the US , Germany , France , and the UK — in one year .


After we blocked those samples , they moved a significant portion of malicious functionality into the native library , which resulted in a rather peculiar back and forth between Dalvik and native code : COMMAND & CONTROL Dynamic Shortcodes & Content Early versions of Bread utilized a basic command and control infrastructure to dynamically deliver content and retrieve billing details . Our initial observation of the Bahamut group originated from in-the-wild attempts to deceive targets into providing account passwords through impersonation of platform providers . It adds the SeLoadDriver privilege to its access token and proceeds to install the driver as a fake disk filter driver . In its spear phish , CloudLook also used a self - extracting archive containing a PDF file that lured its victims with information regarding world terrorism .


In the example server response below , the green fields show text to be shown to the user . One curious trait of Bahamut is that it develops fully-functional applications in support of its espionage activities , rather than push nonfunctional fake apps or bundle malware with legitimate software . It then adds the “ Loveusd.sys ” extracted driver name to the upper filter list . In the case of ProxyNotShell , the targeted backend service is the Remote PowerShell service .


The red fields are used as the shortcode and keyword for SMS billing . Curiously , Bahamut appears to track password attempts in response to failed phishing attempts or to provoke the target to provide more passwords . In our analysed sample the “ Loveusd.sys ” driver is installed with the name “ USBHPMS ” . In some cases , the threat actors may have been using compromised organizations to gain access to other victims in supplychaintype attacks .


State Machines Since various carriers implement the billing process differently , Bread has developed several variants containing generalized state machines implementing all possible steps . Bahamut spearphishing attempts have also been accompanied with SMS messages purporting to be from Google about security issues on their account , including a class 0 message or " flash text " . Finally the driver is started using the ZwLoadDriver native API . Most of the time , unsolicited messages from various people are the first entry point .


At runtime , the apps can check which carrier the device is connected to and fetch a configuration object from the command and control server . These text messages did not include links but are intended to build credibility around the fake service notifications later sent to the target 's email address . The ZxShell driver starts by acquiring some kernel information and then hooking “ ObReferenceObjectByHandle ” API . UNC4899 's targeting is selective , and they have been observed gaining access to victim networks through JumpCloud .


The configuration contains a list of steps to execute with URLs and JavaScript . We have not found evidence of Bahamut engaging in crime or operating outside its limited geographic domains , although this narrow perspective could be accounted for by its compartmentalization of operations . Finally it spawns 2 system threads . I will use Qiling in the emulation .


The steps implemented include : Load a URL in a WebView Run JavaScript in WebView Toggle WiFi state Toggle mobile data state Read/modify SMS inbox Solve captchas Captchas One of the more interesting states implements the ability to solve basic captchas ( obscured letters and numbers ) . Thus far , Bahamut 's campaigns have appeared to be primarily espionage or information operations – not destructive attacks or fraud . The first thread is the “ communication ” thread . If executed successfully , LIGHTWORK provides the operator the following command - line output : Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis .


First , the app creates a JavaScript function to call a Java method , getImageBase64 , exposed to WebView using addJavascriptInterface . The targets and themes of Bahamut 's campaigns have consistently fallen within two regions – South Asia ( primarily Pakistan , specifically Kashmir ) and the Middle East ( from Morocco to Iran ) . ZxShell employs a strange method for communication : it hooks the NtWriteFile API and recognizes 5 different special handle values as commands : In this blog post , we show how the newly found Kritec skimmer was found along side one of its competitors .


The value used to replace GET_IMG_OBJECT comes from the JSON configuration . Our prior publication also failed to acknowledge immensely valuable input from a number of colleagues , including Nadim Kobeissi 's feedback on how the API endpoints on the Android malware were encrypted . 0x111111111 : Hide “ Loveusd ” driver from the system kernel driver list . 0x22222222 : Securely delete an in-use or no-access target file-name . 0x44444444 : Unhook the ZwWriteFile API and hook KiFastCallEntry . 0x55555555 : Remove the ZxShell Image Load Notify routine . 0x88888888 : Set a special value called “ type ” in Windows registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverMain . Ukraine ’s Computer Emergency Response Team ( CERT - UA ) has attributed the July campaign to the threat actor group UNC1151 , as a part of the GhostWriter operational activities allegedly linked to the Belarusian government .


The app then uses JavaScript injection to create a new script in the carrier ’ s web page to run the new function . Bahamut targeted similar Qatar-based individuals during their campaign . The second Loveusd system thread does a lot of things . In other news , a suspected LockBit affiliate named Ruslan Magomedovich Astamirov , a 20 - year - old from the Chechen Republic , was arrested in Arizona last month .


The base64-encoded image is then uploaded to an image recognition service . Bellingcat also reported the domain had been used previously to host potential decoy documents as detailed in VirusTotal here using hxxp://voguextra.com/decoy.doc . Its principal duties are to create the ZxShell main DLL in “ c:\Windows\System32\commhlp32.dll ” and to install the Kernel “ Load Image Notify routine ” . We provide at - risk organizations with the following discovery methods to conduct threat hunts for tactics , techniques , and procedures ( TTPs ) implemented derived from the toolset : • Establish collection and aggregation of host - based logs for crown jewels systems such as human - machine interfaces ( HMI ) , engineering workstations ( EWS ) , and OPC client servers within their environments and review logs for the evidence of Python script or unauthorized code execution on these systems .


If the text is retrieved successfully , the app uses JavaScript injection again to submit the HTML form with the captcha answer . The China-backed BARIUM APT is suspected to be at the helm of the project . The code then tries to kill each process and service that belongs to the following list of AV products : Symantec B-TOOL S-IDTY Firewall Norton ESET McAfee Avast Avira Sophos Malwarebytes . The name of the shortcut file , depending on the campaign , is either randomly generated by a random string generator function or hardcoded in the macro code .


CLOAKING Client-side Carrier Checks In our basic command & control example above , we didn ’ t address the ( incorrectly labeled ) “ imei ” field . Trojanized versions of the utility were then signed with legitimate certificates and were hosted on and distributed from official ASUS update servers – which made them mostly invisible to the vast majority of protection solutions , according to Kaspersky Lab . Next , the ZxShell Load-Image Notify function prevents the AV processes from restarting . The gang attacked 10 victims last month , the majority of them being from the Information and Communications Technology ( ICT ) sectors .


This contains the Mobile Country Code ( MCC ) and Mobile Network Code ( MNC ) values that the billing process will work for . Kaspersky Lab To compromise the utility , Kaspersky Lab determined that the cyberattackers used stolen digital certificates used by ASUS to sign legitimate binaries , and altered older versions of ASUS software to inject their own malicious code . The installation procedure continues in the user-mode dropper . A survey conducted by security firm OneLogin found that only about half of IT decision makers were very confident that former employees were no longer able to access corporate applications .


In this example , the server response contains several values for Thai carriers . To compromise the utility , Kaspersky Lab determined that Barium used stolen digital certificates used by ASUS to sign legitimate binaries , and altered older versions of ASUS software to inject their own malicious code . The ZxShell service is installed as usual , and the in-execution dropper is deleted permanently using the special handle value 0x22222222 for the WriteFile API call . Ransomware builders usually have a user interface that allows users to choose the underlying features and customize the configurations to build a new ransomware binary executable without exposing the source code or needing a compiler installed .


The app checks if the device ’ s network matches one of those provided by the server . BARIUM , a Chinese state player that also goes by APT17 , Axiom and Deputy Dog , was previously linked to the ShadowPad and CCleaner incidents , which were also supply-chain attacks that used software updates to sneak onto machines . This handle value is invalid : all the windows kernel handle values are by design a multiple of 4 . It has an interesting way of loading the malicious JavaScript we had not seen before either .


If it does , it will commence with the billing process . That said , the " fingerprints " left on the samples by the attackers – including techniques used to achieve unauthorized code execution – suggest that the BARIUM APT is behind the effort , according to the researchers . The ZxShell hook code knows that and intercept it . None The discovery was part of recent CrowdStrike Services investigations into several Play ransomware intrusions where the common entry vector was confirmed to be Microsoft Exchange .


If the value does not match , the app skips the “ disclosure ” page and billing process and brings the user straight to the app content . In the 2017 ShadowPad attack , the update mechanism for Korean server management software provider NetSarang was compromised to serve up an eponymous backdoor . ObReferenceObjectByHandle is a Kernel routine designed to validate a target object and return the pointer to its object body ( and even its handle information ) , starting from the object handle ( even the user-mode one ) . An example of these log entries can be found below : By correlating the user , IP address and GUID from the Remote PowerShell HTTP logs to the Exchange frontend , CrowdStrike found a request using the mailbox to the following OWA URL , , corresponding to the IIS log entry below : The backend request for the new exploitation chain is similar to the example shown below : This request seemed to show a novel , previously undocumented , way to reach the PowerShell remoting service through the OWA frontend endpoint , instead of leveraging the endpoint .


In some versions , the server would only return valid responses several days after the apps were submitted . In the next incident , also in 2017 , software updates for the legitimate computer cleanup tool CCleaner was found to have been compromised by hackers to taint them with the same ShadowPad backdoor . The hook installed by ZxShell implements one of its filtering routine . A full report describing the timeline of DUCKTAIL ’s activities , a detailed analysis of its malware component , and appendices containing indicators of compromise , Yara detection rules , metadata , and MITRE ATT&CK techniques can be downloaded from a link on this page .


Server-side Carrier Checks In the JavaScript bridge API obfuscation example covered above , the server supplied the app with the necessary strings to complete the billing process . NetSarang , which has headquarters in South Korea and the United States , removed the backdoored update , but not before it was activated on at least one victim 's machine in Hong Kong . It filters each attempt to open the ZxShell protected driver or the main DLL , returning a reference to the “ netstat.exe ” file . Figure 11 : Sandworm TANKTRAP GPO 2


However , analysts may not always see the indicators of compromise in the server ’ s response . Given our increased confidence that Bahamut was responsible for targeting of Qatari labor rights advocates and its focus on the foreign policy institutions other Gulf states , Bahamut 's interests are seemingly too expansive to be limited one sponsor or customer . The protection is enabled to all processes except for ones in the following list : Svchost.exe , Lsass.exe , Winlogon.exe , Services.exe , Csrss.exe , ctfmon.exe , Rundll32.exe , mpnotify.exe , update.exe . The first with a valid handle to close the process created .


In this example , the requests to the server take the following form : Here , the “ operator ” query parameter is the Mobile Country Code and Mobile Network Code . Barium specializes in targeting high value organizations holding sensitive data , by gathering extensive information about their employees through publicly available information and social media , using that information to fashion phishing attacks intended to trickthose employees into compromising their computers and networks . If the type of the object that the system is trying to validate is a process , the hook code rewrites again the configuration data of the ZxShell service in the windows registry . “ s1.txt ” , which likely contains the unauthorized MicroSCADA commands


The server can use this information to determine if the user ’ s carrier is one of Bread ’ s targets . We identified an overlap in the domain voguextra.com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post . The last type of Kernel modification that ZxShell rootkit performs is the system call dispatcher ( KiFastCallEntry ) hook . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


If not , the response is scrubbed of the strings used to complete the billing fraud . Althoughthe BariumDefendants have relied on differentand distinct infrastructures in an effortto evade detection , Bariumused the same e-mail address (hostay88@gmail.com ) to register malicious domains used in connection with at least two toolsets that Barium has employed to compromise victim computers . In this manner , ZxShell is able to completely hide itself , intercepting the following Kernel API calls : ZwAllocateVirtualMemory , ZwOpenEvent , ZwQueryDirectoryFile , ZwWriteFile , ZwEnumerateKey , and ZwDeviceIoControlFile . CADDYWIPER is a disruptive wiper written in C that is focused on making data irrecoverable and causing maximum damage within an environment .


MISLEADING USERS Bread apps sometimes display a pop-up to the user that implies some form of compliance or disclosure , showing terms and conditions or a confirm button . The second method , described in Part D.2 , below , involves the " ShadowPad " malware , which the Barium Defendants have distributed via a third-party software provider 's compromised update . Command and Control Server : Sample ( SHA256 : 1eda7e556181e46ba6e36f1a6bfe18ff5566f9d5e51c53b41d08f9459342e26c ) is configured to act as a server . Please address comments about this page to nvd@nist.gov .


However , the actual text would often only display a basic welcome message . To enhance the effectiveness of phishing attacks into the organization , Barium will collect additional background informationfrom social media sites . The symbol “ g_bCreateListenSck ” is set to 1 . Of the two file types , the PowerPoint files are more unusual in that they would not show any actual slides when opened , but would still execute the malicious VBA code , a finding consistent with CERT - UA ’s analysis .


Other versions included all the pieces needed for a valid disclosure message . Employing a technique known as " spear phishing " , Barium has heavily targeted individuals within HumanResources or Business Developmentdepartments ofthe targeted organizations in order to compromise the computers ofsuch individuals . This means that , as seen above , the ZxShell Dll is started in listening mode . The videos were quickly passed around offices while users ’ systems were silently infected in the background , and many of the APT ’s components were signed with phony Intel and AMD digital certificates .


However , there are still two issues here : The numbers to contact for cancelling the subscription are not real The billing process commences even if you don ’ t hit the “ Confirm ” button Even if the disclosure here displayed accurate information , the user would often find that the advertised functionality of the app did not match the actual content . The first method , described in Part D.l , below , involves the " Barlaiy " and " PlugXL " malware , which the Barium Defendants propagate using phishing techniques . It connects to the first remote C&C that tries to contact it and succeeds in the handshake . When combined with the data from your vulnerability scanners , it delivers a full picture of the exposures in your environment .


Bread apps frequently contain no functionality beyond the billing process or simply clone content from other popular apps . Using the information gathered from its reconnaissance on social media sites , Barium packages the phishing e-mail in a way that gives the e-mail credibility to the target user , often by making the e-mail appear as ifit were sent from an organization known to and trusted by the victim or concerning a topic of interest to the victim . The encrypted IP address is “ 127.0.0.2 ” ( used as loopback ) and no connection is made on that IP address ( due to the listening variable set to 1 ) . Zarya ’s Telegram channel was created in March 2022 , although the group ’s alleged leader claimed that elements of Zarya existed well before this , and were previously known by various names including “ 0x000000 ” and “ Quarantine ” ( Russian : Карантин ) .


VERSIONING Bread has also leveraged an abuse tactic unique to app stores : versioning . Barium Defendants install the malicious " Win32/Barlaiy " malware and the malicious " Win32/PlugX.L " malware on victim computers using the means described above . We used the ZxShell package for version 3.10 ( SHA256 : 1622460afbc8a255141256cb77af61c670ec21291df8fe0989c37852b59422b4 ).The convenient thing about this is that the CNC panel worked with any version , 3.10 and above . Lowcode automation of processes can make the required actions fast , reliable , and repeatable .


Some apps have started with clean versions , in an attempt to grow user bases and build the developer accounts ’ reputations . Both Win32/Barlaiy & Win32/PlugX.L are remote access " trojans " , which allow Barium to gather a victim 's information , control a victim 's device , install additional malware , and exfiltrate information fi-om a victim 's device . The buttons are all in Chinese , with the help of Google Translate and keen detective skills ( read : button clicking ) , we ’ve deciphered the functionality . These group policies contained instructions to copy a file from a server to the local hard drive and to schedule a task to run the copied file at a particular time .


Only later is the malicious code introduced , through an update . Barium Defendants install the malicious credential stealing and injection tool known as " Win32/RibDoor.A!dha " . Once an infected machine connects , you see its information displayed in a selection box at the top . An attacker could exploit these issues by tricking a user into opening a specially crafted PDF document or , if the user has the browser extension enabled , by visiting a malicious web page :


Interestingly , early “ clean ” versions contain varying levels of signals that the updates will include malicious code later . While not detected at the time , Microsoft 's antivirus and security products now detect this Barium malicious file and flag the file as " Win32/ShadowPad.A " . There are some built in functions on the side for the more common features . The sample of LIGHTWORK we obtained includes eight hardcoded IEC-104 information object addresses ( IOA ) , which typically correlate with input or output data elements on a device and may correspond to power line switches or circuit breakers in an RTU or relay configuration .


Some are first uploaded with all the necessary code except the one line that actually initializes the billing process . MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com.mxi.videoplay ) . These include remote desktop , webcam spying , remote shell , and file management . By the end of 2022 , Cuba ransomware threat actors had compromised over 100 organizations worldwide .


Others may have the necessary permissions , but are missing the classes containing the fraud code . Figure 9a , below , shows detections of encounters with the Barium actors and their infrastructure , including infected computers located in Virginia , and Figure 9b , below , shows detections of encounters throughout the United States . You can also select a host and type help for a full list of commands . • Identify and investigate the creation , transfer , and/or execution of unauthorized Python - packaged executables ( e.g. , PyInstaller or Py2Exe ) on OT systems or systems with access to OT resources .


And others have all malicious content removed , except for log comments referencing the payment process . Barium has targeted Microsoft customers both in Virginia , the United States , and around the world . I have the same machine infected with two different version of ZxShell . As opposed to the PowerPoint documents that did not display any slides in our testing environments , all Excel documents display legitimate - looking documents related to the targeted military organizations , or generic descriptions on how to enable VBA macro functionality in Excel .


All of these methods attempt to space out the introduction of possible signals in various stages , testing for gaps in the publication process . Once the Barium Defendants have access to a victim computer through the malware described above , they monitor the victim 's activity and ultimately search for and steal sensitive documents ( for example , exfiltration of intellectual property regarding technology has been seen ) , and personal information fi"om the victim 's network . Sending the help command for each , you can see the extra features added between version 3.1 and 3.2 . The “ ExecStart ” value specifies the path of the program to be run , which in this case was GOGETTER .


However , GPP does not treat new apps and updates any differently from an analysis perspective . According to a 49-page report published Thursday , all of the attacks are the work of Chinese government 's intelligence apparatus , which the report 's authors dub the Winnti Umbrella . Keylogging , ZXARPS ( IP and URL spoofing ) , and SYNFlood are some of the interesting features added to version 3.2 . The content of the form is legitimate and targets Ukrainian government organizations , as seen in the image below .


FAKE REVIEWS When early versions of apps are first published , many five star reviews appear with comments like : “ So .. good .. ” “ very beautiful ” Later , 1 star reviews from real users start appearing with comments like : “ Deception ” “ The app is not honest … ” SUMMARY Sheer volume appears to be the preferred approach for Bread developers . Researchers from various security organizations have used a variety of names to assign responsibility for the hacks , including LEAD , BARIUM , Wicked Panda , GREF , PassCV , Axiom , and Winnti . In versions 3.1 – 3.21, the configuration info is xor encoded with 0x85 . Most fraudsters create one - time email addresses or use stolen email addresses , both of which are easy to create or obtain .


At different times , we have seen three or more active variants using different approaches or targeting different carriers . It targets organizations in Japan , South Korea , and Taiwan , leveling its attacks on public sector agencies and telecommunications and other high-technology industries . This configuration info can be changed with a tool included in the ZxShell package . TANKTRAP is a utility written in PowerShell that utilizes Windows group policy to spread and launch a wiper .


Within each variant , the malicious code present in each sample may look nearly identical with only one evasion technique changed . In 2016 , for instance , we found their campaigns attacking Japanese organizations with various malware tools , notably the Elirks backdoor . In versions 3.22 and 3.39 the routine changes . None Organizations should apply the November 8 , 2022 patches for Exchange to prevent exploitation since the URL rewrite mitigations for ProxyNotShell are not effective against this exploit method .


Sample 1 may use AES-encrypted strings with reflection , while Sample 2 ( submitted on the same day ) will use the same code but with plaintext strings . Blackgear has been targeting various industries since its emergence a decade ago . The new xor encoding byte is 0x5B . As well as SysUpdate , the attackers used a number of legitimate or publicly available tools to map the network and dump credentials .


At peak times of activity , we have seen up to 23 different apps from this family submitted to Play in one day . Blackgear 's campaigns also use email as an entry point , which is why it's important to secure the email gateway . The data is stored in the last 0x100 bytes of the file . Next , it sends a “ C_SC_NA_1 – single command ” to each hardcoded IOA to modify the state of the target station ’s IOA ( OFF or ON ) .


At other times , Bread appears to abandon hope of making a variant successful and we see a gap of a week or longer before the next variant . BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years . The first 8 bytes of data are static . On June 27 , 2023 , at 18:51:57 UTC , Mandiant identified a malicious Ruby script executed via the JumpCloud agent at a downstream customer ( a software solutions entity ) .


This family showcases the amount of resources that malware authors now have to expend . Our research indicates that it has started targeting Japanese users . Then there is the dll install name , the domain , and the port . Talos discovered multiple vulnerabilities in Foxit PDF Reader that could allow an adversary to execute , arbitrary code on the targeted machine .


Google Play Protect is constantly updating detection engines and warning users of malicious apps installed on their device . The malware tools used by BLACKGEAR can be categorized into three categories : binders , downloaders and backdoors . Knowing the obfuscation routines for this data we wrote a script to extract the URLs / IPs and ports stored . • Unauthorized network connections to MSSQL servers ( TCP/1433 ) and irregular or unauthorized authentication .