The GoogleUpdate.exe component is responsible for communicating with the remote C&C server . The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio .


This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries . Confucius' backdoors are delivered through Office documents exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage . We dove deeper into Confucius' operations—namely , the malware-ridden documents , backdoors , and file stealers they use in their campaigns .


The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format . The sctrls backdoor we came across is delivered via RTF files exploiting CVE-2015-1641 .


AdroMut downloads the malware ServHelper and FlawedAmmy RAT used by the SectorJ04 group from the attacker server and simultaneously performs the functions of a backdoor . The documents that exploit CVE2017-11882 download another payload — an HTML Application ( HTA ) file toting a malicious Visual Basic ( VBS ) script — from the server , which is executed accordingly by the command-line tool mshta.exe .


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer . In August 2015 a new incident related to the Corkow ( Metel ) Trojan was detected .


The exploit installs Silence’s loader , designed to download backdoors and other malicious programs . Corkow provided remote access to the ITS-Broker system terminal by 《 Platforma soft 》 Ltd. , which enabled the fraud to be committed .


As we described in Silence: Moving into the darkside report , Silence has experience with theft using compromised card processing systems . According to our statistics , as of the beginning of 2015 this botnet encompassed over 250 000 infected devices worldwide including infecting more than 100 financial institutions with 80% of them from the top 20 list .


The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine . The interest among hackers in targeting trading systems is expected to grow .


Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server . Russian-speaking hackers are believed to be responsible for these attacks and used the Corkow Trojan .


PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more . Hackers target primarily companies in Russia and CIS countries , though it is noticed that the amount of attacks targeting the USA has increased 5 times since 2011 .


A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests , TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution . One of the first botnets specializing in targeting the trading software called Quik was " Ranbyus " , created in 2012 .


PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file . As of the Group-IB investigation of this malware program in March 2015 , Corkow v.7.118.1.1 had not been detected by a single antivirus program .


The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation . Hackers gained access to a computer in the trading system in September 2014 .


The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method . Starting in December 2014 , the criminal group began running keyloggers in the infected system .


In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger . To spread the Corkow malware criminals use a drive-by downloads method , when victims are infected while visiting compromised legitimate websites .


Neptun is installed on Microsoft Exchange servers and is designed to passively listen for commands from the attackers . Group-IB specialists detected various sites used by criminals to spread the Trojan : mail tracking websites , news portals , electronic books , computer graphics resources , music portals , etc .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . Hackers use the exploits " Nitris Exploit Kit " ( earlier known as CottonCastle ) , which is not available in open sources and sold only to trusted users .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . Group-IB Bot-trek TDS sensors are in place at a number of financial institutions and , unfortunately , we register that currently Corkow malware is present on 80% of protected corporate systems .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . Considering the Trojan delivery method and through our analysis of infections on banks' networks , we can confirm that all infections were conducted on a random basis .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . According to statistics , Corkow primarily targets users in Russia and the CIS , but it is worth noting that in 2014 the amount of attacks targeting the USA increased by 5 times , in comparison with 2011 .


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . Moreover , the number of Corkow incidents detected in Q1 2015 in the United States exceeds the number of those in the CIS countries .


Upon execution , it will communicate with an attacker-controller website to download a variant of the Pony malware , pm.dll” along with a standard Vawtrak trojan . Moreover , the number of Corkow incidents detected in Q1 2015 in the United States exceeds the number of those in the CIS countries .


RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism . Hackers first actively spread bots using the Niteris exploit , and then search for infected devices at banks amongst their bots by analyzing IP addresses , cracked passwords and results of the modules performance .


RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself . In addition to the legitimate AmmyAdmin tool , the hackers used Visconti Backdoor developed based on legitimate RMS ( remote manipulator system ) software .


This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices . If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs .


From our trend analysis seen in Figure 3 , Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August . To obtain logins and passwords they applied keyloggers built into Corkow , as well as a commonly used feature of Mimikatz , dumping clear text Windows credentials from LSA .


Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before . Hackers used the remote access to detect servers of their interest in the internal network .


FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform . In 2015 , the Metel gang began to target banks and financial institutions directly .


Written in pure C language , Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions , and carries out integrity control of various system components to avoid debugging and security detection . Metel is a banking Trojan ( also known as Corkow ) discovered in 2011 when it was used to attack users of online banking services .


WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data . After the infection stage , criminals move laterally with the help of legitimate and pentesting tools , stealing passwords from their initial victims ( entry point ) to gain access to the computers within the organization that have access to money transactions .


Some of the documents exploited CVE-2017-0199 to deliver the payload . With this level of access , the gang has been able to pull off a clever trick by automating the rollback of ATM transactions .


To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys . COVELLITE operates globally with targets primarily in Europe , East Asia , and North America .


For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer . US targets emerged in September 2017 with a small , targeted phishing campaign directed at select U.S. electric companies .


The HTA files contained job descriptions and links to job postings on popular employment websites . LAZARUS GROUP is responsible for attacks ranging from the 2014 attack on Sony Pictures to a number of Bitcoin heists in 2017 .


ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints . Technical analysis of COVELLITE malware indicates an evolution from known LAZARUS toolkits .


We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded . COVELLITE remains active but appears to have abandoned North American targets , with indications of activity in Europe and East Asia .


Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload . Given the group 's specific interest in infrastructure operations , rapidly improving capabilities , and history of aggressive targeting , Dragos considers this group a primary threat to the ICS industry .


Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system . Delivering a backdoor and spyware , this campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video .


The vulnerability exists in the old Equation Editor ( EQNEDT32.EXE ) , a component of Microsoft Office that is used to insert and evaluate mathematical formulas . Lookout researchers have discovered a new mobile surveillanceware family , FrozenCell .


The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information . The threat is likely targeting employees of various Palestinian government agencies , security services , Palestinian students , and those affiliated with the Fatah political party .


Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection . Delivering a backdoor and spyware , Desert Falcons 's campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video .


MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com.mxi.videoplay ) . FrozenCell is the mobile component of a multi-platform attack we've seen a threat actor known as " Two-tailed Scorpion/APT-C-23 " , use to spy on victims through compromised mobile devices and desktops .


Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier . This threat is another proof point that attackers are clearly incorporating the mobile device into their surveillance campaigns as a primary attack vector .


Research presented in this report shows that the PUTTER PANDA operators are likely members of the 12th Bureau , 3rd General Staff Department ( GSD ) of the People 's Liberation Army ( PLA ) , operating from the unit 's headquarters in Shanghai with MUCD 61486 . Desert Falcons is keenly aware of the information they can derive from these devices and are using multi-stage ( phishing + an executable ) , multi-platform ( Android + desktop ) attacks to accomplish their spying .


That this group is mostly targeting businesses is apparent from the processes they are looking for on a compromised system . FrozenCell masquerades as fake updates to chat applications like Facebook , WhatsApp , Messenger , LINE , and LoveChat .


They are both targeting businesses using accounting software , are fingerprinting systems of interest similarly , are looking for smart card readers , and finally , they deploy an array of malicious tools to spy on their victims . For example , the actors behind FrozenCell used a spoofed app called Tawjihi 2016 , which Jordanian or Palestinian students would ordinarily use during their general secondary examination .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , industrial control systems and SCADA , government , and media for espionage and destructive purposes , since at least 2011 . It appears the Desert Falcons sent malicious executables though phishing campaigns impersonating individuals associated with the Palestinian Security Services , the General Directorate of Civil Defence - Ministry of the Interior , and the 7th Fateh Conference of the Palestinian National Liberation Front ( held in late 2016 ) .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , government , and media for espionage and destructive purposes , since at least 2011 . The titles and contents of these files suggest that the actor targeted individuals affiliated with these government agencies and the Fatah political party .


If you haven't heard about it for some reason , I would recommend to read this detailed report by Group-IB , as this APT attacks not only Russian banks , but also banks in more than 25 countries . We believe that this is a new variant of VAMP , indicating that the threat actors behind APT-C-23 are still active and continuously improving their product .


The credentials they use to register their malware infrastructure are easily associated with their public social media accounts on Google® , Facebook® , MySpace® , Instagram® , and various dating and blogging sites . VAMP targeted various types of data from the phones of victims : images , text messages , contacts , and call history , among others .


We have previously detected groups we suspect are affiliated with the North Korean government compromising electric utilities in South Korea , but these compromises did not lead to a disruption of the power supply . Recently , Trend Micro researchers came across a new mobile malware family which we have called GnatSpy .


North Korea linked hackers are among the most prolific nation-state threats , targeting not only the U.S. and South Korea but the global financial system and nations worldwide . On Nov. 27 , 2018 , Cisco 's Talos research division published a write-up outlining the contours of a sophisticated cyber espionage campaign it dubbed DNSpionage .


CapabilitiesFormBook is a data stealer , but not a full-fledged banker . Talos said the perpetrators of DNSpionage were able to steal email and other login credentials from a number of government and private sector entities in Lebanon and the United Arab Emirates by hijacking the DNS servers for these targets , so that all email and virtual private networking ( VPN ) traffic was redirected to an Internet address controlled by the attackers .


Furthermore , there are indications that APT32 actors are targeting peripheral network security and technology infrastructure corporations . Talos reported that these DNS hijacks also paved the ACT for the attackers to obtain SSL encryption certificates for the targeted domains ( webmail.finance.gov.lb ) , which allowed them to decrypt the intercepted email and VPN credentials and view them in plain text .


The targeting of private sector interests by APT32 is notable and FireEye believes the actor poses significant risk to companies doing business in , or preparing to invest in , the country . That changed on Jan. 25 , 2019 , when security firm CrowdStrike published a blog post listing virtually every Internet address known to be ( ab )used by the espionage campaign to date .


While the motivation for each APT32 private sector compromise varied – and in some cases was unknown – the unauthorized access could serve as a platform for law enforcement , intellectual property theft , or anticorruption measures that could ultimately erode the competitive advantage of targeted organizations . Working backwards from each Internet address , I was able to see that in the last few months of 2018 the hackers behind DNSpionage succeeded in compromising key components of DNS infrastructure for more than 50 Middle Eastern companies and government agencies , including targets in Albania , Cyprus , Egypt , Iraq , Jordan , Kuwait , Lebanon , Libya , Saudi Arabia and the United Arab Emirates .


The use of the CARBANAK malware in FIN7 operations also provides limited evidence that these campaigns are linked to previously observed CARBANAK operations leading to fraudulent banking transactions , ATM compromise , and other monetization schemes . PCH is a nonprofit entity based in northern California that also manages significant amounts of the world 's DNS infrastructure , particularly the DNS for more than 500 top-level domains and a number of the Middle East top-level domains targeted by DNSpionage .


For our M-Trends 2017 report , we took a look at the incidents we investigated last year and provided a global and regional (the Americas , APAC and EMEA) analysis focused on attack trends , and defensive and emerging trends . This APT group usually carries out target attacks against government agencies to steal sensitive information .


In April 2015 , we uncovered the malicious efforts of APT30 , a suspected China-based threat group that has exploited the networks of governments and organizations across the region , targeting highly sensitive political , economic and military information . In addition to spreading malware via spear fishing email with Office attachment containing either vulnerability or malicious macro , this group is particularly good at leveraging malicious Android APKs in the target attacks .


Yet the document cache published April 8 provides evidence that the NSA had once launched a series of successful computer-based intrusions against multiple high-profile foreign targets , including the Office of the President of Iran and the Russian Federal Nuclear Center . We named the actor DustSquad and have provided private intelligence reports to our customers on four of their campaigns involving custom Android and Windows malware .


Emotet activity in 2019 included several high-volume campaigns that collectively distributed tens of millions of messages primarily targeting the manufacturing and healthcare industries . In this blogpost we cover a malicious program for Windows called Octopus that mostly targets diplomatic entities .


Originally targeting Western European banks , Emotet has since been developed into a robust global botnet that is comprised of several modules , each of which equips Emotet with different spamming , email logging , information stealing , bank fraud , downloading , and DDoS , among others . We also started monitoring the malware and , using Kaspersky Attribution Engine based on similarity algorithms , discovered that Octopus is related to DustSquad , something we reported in April 2018 .


Originally targeting Western European banks , it has since been developed into a robust global botnet that is comprised of several modules , each of which equips Emotet with different spamming , email logging , information stealing , bank fraud , downloading , and DDoS , among others . From early 2014 until December 2018 , ns0.idm.net.lb pointed to 194.126.10.18 , which appropriately enough is an Internet address based in Lebanon .


Transparent Tribe has been active for several years and conducting suspected intelligence collection operations against South Asian political and military targets . Kaspersky Lab products detect the Octopus Trojan as Trojan.Win32.Octopus.gen .


In previous incidents involving this threat actor , we observed them using malicious documents hosted on websites about the Indian Army , instead of sending these documents directly as an email attachment . Political entities in Central Asia have been targeted throughout 2018 by different actors , including IndigoZebra , Sofacy ( with Zebrocy malware ) and most recently by DustSquad ( with Octopus malware ) .


To date , Whitefly has attacked organizations in the healthcare , media , telecommunications , and engineering sectors . El Machete is one of these threats that was first publicly disclosed and named by Kaspersky here .


Between May 2017 and December 2018 , a multi-purpose command tool that has been used by Whitefly was also used in attacks against defense , telecoms , and energy targets in Southeast Asia and Russia . We've found that this group has continued to operate successfully , predominantly in Latin America , since 2014 .


The malicious documents seen in recent activity refer to a number of topics , including recent military promotions within the Pakistan Army , information related to the Pakistan Atomic Energy Commission , as well as Pakistan 's Ministry of the Interior . All attackers simply moved to new C2 infrastructure , based largely around dynamic DNS domains , in addition to making minimal changes to the malware in order to evade signature-based detection .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . In the case of Octopus , DustSquad used Delphi as their programming language of choice , which is unusual for such an actor .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . Targets included a wide array of high-profile entities , including intelligence services , military , utility providers ( telecommunications and power ) , embassies , and government institutions .


APT41 has targeted payment services specializing in handling in-game transactions and real money transfer (RMT) purchases . Some time ago , a Kaspersky Lab customer in Latin America contacted us to say he had visited China and suspected his machine was infected with an unknown , undetected malware .


The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations . It was a targeted attack we are calling " Machete " .


They seem to have specialized knowledge about military operations , as they are focused on stealing specific files such as those that describe navigation routes . At first look , it pretends to be a Java related application but after a quick analysis , it was obvious this was something more than just a simple Java file .


Early in Q2 , Kaspersky identified an interesting Lazarus attack targeting a mobile gaming company in South Korea that we believe was aimed at stealing application source code . " Machete " is a targeted attack campaign with Spanish speaking roots .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . The decoy slideshows all contain photos from very meaningful events to individuals in Thailand , suggesting that the actors continually look for impactful events to use to disguise their attacks .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . In some cases , such as Russia , the target appears to be an embassy from one of the countries of this list .


We believe that these industries have also been targeted as part of a larger supply-chain attack in order for Orangeworm to get access to their intended victims related to healthcare . Both attackers and victims speak Spanish natively , as we see it consistently in the source code of the client side and in the Python code .


Orangeworm 's secondary targets include Manufacturing , Information Technology , Agriculture , and Logistics . We are also grateful to the Private Office of his Holiness the Dalai Lama , the Tibetan Government-in-Exile , the missions of Tibet in London , Brussels , and New York , and Drewla ( a Tibetan NGO ) .


While these industries may appear to be unrelated , we found them to have multiple links to healthcare , such as large manufacturers that produce medical imaging devices sold directly into healthcare firms , IT organizations that provide support services to medical clinics , and logistical organizations that deliver healthcare products . Between June 2008 and March 2009 the Information Warfare Monitor conducted an extensive and exhaustive two-phase investigation focused on allegations of Chinese cyber espionage against the Tibetan community .


Patchwork targets were chosen worldwide with a focus on personnel working on military and political assignments , and specifically those working on issues relating to Southeast Asia and the South China Sea . These instances of Gh0st RAT are consistently controlled from commercial Internet access accounts located on the island of Hainan , People's Republic of China .


Patchwork ( also known as Dropping Elephant ) is a cyberespionage group whose targets included diplomatic and government agencies as well as businesses . The fieldwork generated extensive data that allowed us to examine Tibetan information security practices , as well as capture real-time evidence of malware that had penetrated Tibetan computer systems .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools . It is therefore possible that the large percentage of high value targets identified in our analysis of the GhostNet are coincidental , spread by contact between individuals who previously communicated through e-mail .


In this case , a small group reusing exploit code , some powershell-based malware and mostly social engineering has been able to steal sensitive documents and data from victims since at least November 2015 . Where they exist , they often use grey market or pirated software .


The malicious documents seen in recent activity refer to a number of topics , including recent military promotions within the Pakistan Army , information related to the Pakistan Atomic Energy Commission , as well as Pakistan 's Ministry of the Interior . Contextually relevant emails are sent to specific targets with attached documents that are packed with exploit code and Trojan horse programmes designed to take advantage of vulnerabilities in software installed on the target 's computer .


PittyTiger leverages social engineering to deliver spearphishing emails , in a variety of languages including English , French and Chinese , and email phishing pages to their targets . GhostNet represents a network of compromised computers resident in high-value political , economic , and media locations spread across numerous countries worldwide .


The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies . After that , the attacker is capable to control the compromised device .


This particular unit is believed to hack into victim companies throughout the world in order to steal corporate trade secrets , primarily relating to the satellite , aerospace and communication industries . The computers of diplomats , military attachés , private assistants , secretaries to Prime Ministers , journalists and others are under the concealed control of unknown assailant .


PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries . The C&C server ( 82.137.255.56 ) used by the above backdoors was used by APT-C-27 ( Goldmouse ) many times since 2017 .


In 2015 and 2016 , Dridex was one of the most prolific eCrime banking trojans on the market and , since 2014 , those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits . According to 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor .


In August 2017 , a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K. 's National Health Service ( NHS ) , with a high ransom demand of 53 BTC ( approximately $200,000 USD ) . The banking malware GozNym has legs ; only a few weeks after the hybrid Trojan was discovered , it has reportedly spread into Europe and begun plaguing banking customers in Poland with redirection attacks .


Known for hijacking prominent social media accounts , the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network . The APT group is reportedly targeting the Middle East region .


Through research , 360 Helios Team has found that , since 2007 , the Poison Ivy Group has carried out 11 years of cyber espionage campaigns against Chinese key units and departments , such as national defense , government , science and technology , education and maritime agencies . The malware has started targeting corporate , SMB , investment banking and consumer accounts at banks , including some in Portugal and the U.S. , in addition to Poland , according to researchers at IBM 's X-Force team .


Dragos has reported that XENOTIME , the APT group behind the TRISIS (aka TRITON and HatMan) attack on a Saudi Arabian petro-chemical facility in 2017 , has expanded its focus beyond the oil and gas industries . According to Kessem the malware has redirection instructions for 17 banks , and features an additional 230 URLs to assist attackers in targeting community banks and email service providers in Poland .


Known targets of this group have been involved in the maritime industry , as well as engineering-focused entities , and include research institutes , academic organizations , and private firms in the United States . With GozNym , attackers dupe users by showing them the actual bank 's URL and SSL certificate .


Historically , the majority of their targeting has been focused on the South Korean government , military , and defense industrial base . Fresh from targeting banks in Poland , the banking Trojan GozNym has begun taking aim at banks in Germany .


Historically , the majority of their targeting has been focused on the South Korean government , military , and defense industrial base . Attackers went on to use the Trojan to steal $4 million from 24 banks , including 22 in the United States and two in Canada , in just two weeks .


TEMP.Periscope BackgroundActive since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities . Recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the GozNym group appears up to the task .


TEMP.Periscope BackgroundActive since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities . The malware is distributed primarily through laced spam emails that lure recipients into opening attachments .


These malware families have a rich history of being used in many targeted attacks against government and private organizations . Kessem .


In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage . Fresh from targeting banks in Poland , the banking Trojan has reportedly begun taking aim at banks in Germany .


The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors . Now GozNym is now targeting 13 banks and subsidiaries in Germany , Limor Kessem , Executive Security Advisor at IBM , said Tuesday .


The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China . he Trojan , a hybrid of Nymaim and Gozi malware , initially formed in April and thrives on carrying out redirection attacks via DNS poisoning .


The admin@338 linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong . In April , shortly after the Trojan 's discovery , researchers observed a massive GozNym campaign targeting 24 North American banks .


An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong . The method , which technically redirects users through local DNS poisoning , requires a fair bit of work ; recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the group behind GozNym – Nymaim – appear up to the task .


The group targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy . Attackers behind Dyre have used similar tactics in the past but have only deployed their attacks in English speaking countries and Spain .


The agroup targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy . When we last heard from the Trojan , its operators were seen launching redirection attacks on four large , U.S. banks in June .


The admin@338 , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors . The fact that the cybercriminals behind GozNym have already adapted the Trojan for three different languages and in countries which have different banking systems is unique , according to Kessem .


The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors . By the end of April , GozNym had redirection instructions for 17 Polish banks in its repertoire , along with an extra 230 URLs designed to assist attackers in targeting community banks and email service providers in the Eastern European country .


FireEye said it has tracked admin@338 's activity since 2013 and the group has largely targeted organizations involved in financial , economic , and trade policy . Seeking to tease out any possible links between Operation Aurora , VOHO , Operation DeputyDog , and Ephemeral Hydra , we began with Symantec 's Hidden Lynx report as our foundation .


They have largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors . The authors of that report identify three primary tools used in the campaigns attributed to Hidden Lynx : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries . We will detail how the C&C infrastructure and tools used by hacker group Hidden Lynx during its VOHO campaign ( 2012 ) , excellently documented by Symantec researchers last September , overlap with tools used in other high profile operations during the past few years .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries . When the New York Times and Mandiant last year unmasked a large scale Chinese hacking operation , pinpointing its location down to the building , the report drew mainstream attention to what security professionals already well knew : sophisticated threat actors carry out persistent cyber operations over months and years .


TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology . By the end of April , GozNym had redirection instructions for 17 Polish banks in its repertoire , along with an extra 230 URLs designed to assist attackers in targeting community banks and email service providers in the Eastern European country .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and political , financial , pharmaceutical and energy sectors that could benefit the Chinese economy . Using Recorded Future , we quickly built a timeline of the reported use of those tools in major security incidents , finding many events prior to the early 2013 exposé on Hidden Lynx .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy . In particular , FireEye during the fall of 2013 called out infrastructure overlap between Ephemeral Hydra and DeputyDog .


FANCY BEAR ( also known as Sofacy or APT 28 ) is a separate Russian-based threat actor , which has been active since mid 2000s , and has been responsible for targeted intrusion campaigns against the Aerospace , Defense , Energy , Government and Media sectors . The above network shows relationships between three tools used by Hidden Lynx during its VOHO campaign : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government . Symantec during 2012 linked the Elderwood Project to Operation Aurora ; Trojan.Naid and Backdoor.Moudoor were also used in Aurora , by the Elderwood Gang , and by Hidden Lynx .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government . In addition to these , we also identified " Macfog " , a native Mac OS X implementation of Icefog that infected several hundred victims worldwide .


Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam 's manufacturing , consumer products , and hospitality sectors . Icefog , also known as the " Dagger Panda " by Crowdstrike 's naming convention , infected targets mainly in South Korea and Japan .


APT33 has targeted organizations – spanning multiple industries – headquartered in the United States , Saudi Arabia and South Korea . In 2013 , a public report reveals a group of actors conducted targeted attacks leverage a malware dubbed ICEFOG against mainly government organizations and defense industry of South Korea and Japan .


During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals . Similar to our approach with Symantec 's report on Hidden Lynx , we used Recorded Future to organize the technical details about the DeputyDog attacks to reveal technical information described in the open source reporting across multiple campaigns .


The generalized targeting of organizations involved in energy and petrochemicals mirrors previously observed targeting by other suspected Iranian threat groups , indicating a common interest in the sectors across Iranian actors . With Javafog , we are turning yet another page in the Icefog story by discovering another generation of backdoors used by the attackers .


APT33 's targeting of organizations involved in aerospace and energy most closely aligns with nation-state interests , implying that the threat actor is most likely government sponsored . Since January 2013 , we've been on the lookout for a possible RedOctober comeback .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making . One possible hit was triggered when we observed Mevade , an unusual piece of malware that appeared late in 2013 .


Specifically , the targeting of organizations in the aerospace and energy sectors indicates that the APT33 is likely in search of strategic intelligence capable of benefitting a government or military sponsor . In August 2014 , some of our users observed targeted attacks with a variation of CVE-2012-0158 and an unusual set of malware .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military aviation capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making . It wasn't until August 2014 that we observed something which made us wonder if RedOctober is back for good .


In 2017 , APT37 expanded its targeting beyond the Korean peninsula to include Japan , Vietnam and the Middle East , and to a wider range of industry verticals , including chemicals , electronics , manufacturing , aerospace , automotive and healthcare entities . The Cloud Atlas implants utilize a rather unusual C&C mechanism .


We surmise that the targeting of banks , media , and government agencies is conducted in support of APT38 's primary mission . We named it RedOctober because we started this investigation in October 2012 , an unusually hot month .


The APT38 targeted news outlets known for their business and financial sector reporting , probably in support of efforts to identify and compromise additional financial institutions . The attackers upload data to the account , which is downloaded by the implant , decrypted and interpreted .


APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry . Just like with RedOctober , the top target of Cloud Atlas is Russia , followed closely by Kazakhstan , according to data from the Kaspersky Security Network ( KSN ) .


APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns . In May 2015 , Palo Alto Networks WildFire detected two e-mails carrying malicious documents from a genuine and compromised Israeli Gmail account , sent to an Israeli industrial organization .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japanese organizations such as government agencies ( including defense ) as well as those in biotechnology , electronics manufacturing , and industrial chemistry . One e-mail carried a Microsoft PowerPoint file named " thanks.pps " ( VirusTotal ) , the other a Microsoft Word document named " request.docx " .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry . Around the same time , WildFire also captured an e-mail containing a Word document ( " hello.docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . attacks using this tool were still active as of April 2016 .


This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies . Considering the language being used in the malicious code is Arabic , it seems that the attacker is familiar with Arabic language as well .


From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space . The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll .


Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems . In this case , the file used the software name " Cyberlink " , and a description of " CLMediaLibrary Dynamic Link Library " and listing version 4.19.9.98 .


The Charming Kitten' focus appears to be individuals of interest to Iran in the fields of academic research . Unit 42 published a blog at the beginning of May titled " Prince of Persia " , in which we described the discovery of a decade-long campaign using a formerly unknown malware family , Infy , that targeted government and industry interests worldwide .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team . We noted in our original blog the large amount of targeting of Iranian citizens in this campaign , we observed almost one-third of all victims to be Iranian .


Since 2013 , the Cobalt have attempted to attack banks and financial institutions using pieces of malware they designed . In addition to the original " Infy " variant , we also see the newer , more sophisticated , interactive , and fuller-featured " Infy M " variant deployed against apparently-higher-value targets .


Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt . This documentation provides new insight into intrusion efforts conducted by at least four discrete Iranian threat actors , Rocket Kitten , Infy , Sima , and Operation Cleaver , including groups and tools that have not been previously disclosed .


Gallmaker 's activity appears to be highly targeted , with its victims all related to government , military , or defense sectors . Since early 2013 , we have observed activity from a unique threat actor group , which we began to investigate based on increased activities against human right activists in the beginning of 2015 .


There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors . Over the course of three years of observation of campaigns targeting civil society and human rights organizations , from records of well over two hundred spearphishing and other intrusion attempts against individuals inside of Iran and in the diaspora , a narrative of persistent intrusion efforts emerges .


traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors . Thanks to information we have been able to collect during the course of our research , such as characteristics of the group 's malware and development cycle , our research strongly supports the claim that the Infy group is of Iranian origin and potentially connected to the Iranian state .


The Ke3chang have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , chemicals , manufacturing , mining sectors . Amongst a backdrop of other incidents , Infy became one of the most frequently observed agents for attempted malware attacks against Iranian civil society beginning in late 2014 , growing in use up to the February 2016 parliamentary election in Iran .


The attackers have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors . Until the publication of the Palo Alto report , the developers of the Infy appeared to be actively updating and maintaining the codebase , and new releases were distributed to existing , as well as new , targets quite regularly .


APT15 was targeting information related to UK government departments and military technology . Other samples were found bearing a compilation time as early as June 2012 and version 00002 .


APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more . Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware .


cyber actors of the North Korean to target the media , aerospace , financial , and critical infrastructure sectors in the United States and globally . When activities targeting of civil society subsided , the actors instead appeared to have focused on external targets , such a series of attempts to spearphish the Danish Ministry of Foreign Affairs .


According to trusted third-party reporting , HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace , telecommunications , and finance industries . Palo Alto Networks has noted and described the differences of two malware agents developed in parallel , with commonalities in behavior but differing functionalities ; families described as Infy and Infy M. Our primary observation was of the Infy ( non-M ) malware , which primarily functions as a keylogger for the collection of account credentials .


McAfee Advanced Threat Research analysts have uncovered a global data reconnaissance campaign assaulting a wide number of industries including critical infrastructure , entertainment , finance , health care , and telecommunications . Our observation of Infy 's campaigns , primarily through the lens of spearphishing attacks against Iranian civil society and media organizations , indicates a wandering focus on particular demographics on a strategic basis over time .


Since at least 2013 , HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government , financial , automotive , and media industries . The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) .


Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others . Based on information collected in the course of this research , the targets and victims of Infy 's campaigns have continued to be strongly aligned with Iran 's " soft war " agenda , internal security policies , and regional adversaries of the hardline establishment of the Islamic Republic of Iran .


Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others . Until late December 2015 , in nearly every Infy message documented since our tracking began in May 2013 , no attempt included strong tailoring of the approach , often not even including an email body , instead relying on cryptic filenames and email subjects to attract interest .


Known targets of the Leviathan have been involved in the maritime industry , and research institutes , academic organizations , and private firms in the United States . One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges .


Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities . As in the past , these messages have been sent accounts believed to be fake and accounts compromised by Infy , including Kurdish activists that had previously been compromised by the Flying Kitten actor group .


Within a year APT40 was observed masquerading as a UUV manufacturer , and targeting universities engaged in naval research . The actors successfully compromised a host of an Saudi government institutions on January 17 , 2016 , and maintained access for at least two weeks .


APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia . The Infy group also appears to engage in espionage activities against foreign governments and businesses .


Lotus Blossom targeted the government , higher education , and high tech companies . In order to initially compromise the designated targets , Infy typically distributed specifically-crafted malicious documents containing Infy through spearphishing attacks .


The Lotus Blossom largely targets military or government , with some cases of higher education and high tech companies . In order to initially compromise the designated targets , the attackers typically distributed specifically-crafted malicious documents containing Infy through spearphishing attacks .


Organizations in the government , energy , and technology sectors have been targeted by Magic Hound , specifically organizations based in or doing business in Saudi Arabia . On May 2 , 2016 , Palo Alto Networks published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available .


Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents . Prior to the distribution of new versions of the agent , the Infy developers appear to consistently conduct tests from local hosts , which indicates that the control and maintenance of the software occurs in the Khorasan Razavi province of Iran , potentially in the city of Mashhad .


Evidence also suggests that APT32 has targeted network security and technology infrastructure corporations with connections to foreign investors . On May 2 , 2016 , Palo Alto published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available .


Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations foreign governments . Only one client , based in Iran , continued to communicate with the infrastructure .


Additionally , there is evidence to suggest APT33 targeted Saudi Arabian and Western organizations that provide training , maintenance and support for Saudi Arabia 's military and commercial fleets . A researcher has attributed a recently publicized attack on Citrix' internal network to the Iranian-linked group known as IRIDIUM – and said that the data heist involved 6 terabytes of sensitive data .


The OilRig group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries . " IRIDIUM has hit more than 200 government agencies , oil and gas companies and technology companies , including Citrix Systems Inc " , they said .


APT35 typically targets military , diplomatic and government , media , energy , engineering , business services and telecommunications sectors in U.S. and the Middle East . Citrix told Threatpost that this is indeed the same password-spraying attack it announced itself last week – but it wouldn't confirm the other details in Resecurity 's post , including the attribution .


APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors . In wake of these events , a security firm Resecurity reached out to NBC news and claimed that they had reasons to believe that the attacks were carried out by Iranian-linked group known as IRIDIUM .


Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations . Resecurity says that IRIDIUM " has hit more than 200 government agencies , oil and gas companies , and technology companies including Citrix .


Since at least 2013 , the Iranian threat group FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations . Resecurity claims that IRIDIUM breached Citrix 's network during December 2018 .


Ultimately , APT35 had used access to hundreds of mailboxes to read email communications and steal data related to Middle East organizations , which later became victims of destructive attacks . Infy engaged in malware spearphishing against the same targets as Flying Kitten from the outset of its campaign ; Operation Cleaver has registered several resources related to development agencies that have been the subject of intrusion attempts by others since February 2014 .


Further analysis revealed a well-established collection of fake social media profiles that appear intended to build trust and rapport with potential victims . The malicious samples we found are the early stage malware most often delivered by spear-phishing e-mails .


COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites . This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample .


The Magic Hound has repeatedly used social media to identify and interact with employees at targeted organizations and then used weaponized Excel documents . At this stage , the malware gathers information about the infected computer .


We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages . Hancom Office is widely used in South Korea .


This group has used a large array of infection vectors , mostly revolving around drive-by downloads and spam . Perhaps it also points to the suspected North Korean origin of attack .


To infect individuals with access to the data the actors desire , Scarlet Mimic deploys both spear-phishing and watering hole ( strategic web compromise ) attacks . The attacker is from North Korea .


As with many other attackers who use spear-phishing to infect victims , Scarlet Mimic makes heavy use of " decoy " files . All of them lie in ranges of the Jilin Province Network and Liaoning Province Network , in China .


The most recent Scarlet Mimic attacks we have identified were conducted in 2015 and suggest the group has a significant interest in both Muslim activists and those interested in critiques of the Russian government and Russian President Vladimir Putin . Finally , this geo-location supports the likely theory that the attackers behind Kimsuky are based in North Korea .


Using these tactics Scarlet Mimic can directly target previously identified individuals ( spear phishing ) as well as unidentified individuals who are interested in a specific subject ( watering hole ) . In this blog , we look at the Winnti malware implant as used by two known activity groups BARIUM and LEAD .


Scarlet Mimic primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 . According to the German press , the intruders used the Winnti family of malware as their main implant , giving them persistent access to the conglomerate 's network as early as February 2016 .


Scarlet Mimic has carried out attacks using both spear-phishing and watering holes since at least 2009 with increasingly advanced malware , and has deployed malware to attack multiple operating systems and platforms . In the case of this malware , the activity groups strongly associated with Winnti are BARIUM and LEAD .


The group primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 . But even though they share the use of Winnti , the BARIUM and LEAD activity groups are involved in very different intrusion scenarios .


When using email scams , SilverTerrier actors preferred to use large target audiences , which maximized the likelihood of success with very little risk . To show how this breach and similar breaches can be mitigated , we look at how Windows Defender ATP flags activities associated with BARIUM , LEAD , and other known activity groups and how it provides extensive threat intelligence about these groups .


The malware may inject itself into browser processes and explorer.exe . BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms .


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 . During these intrusions , LEAD 's objective was to steal sensitive data , including research materials , process documents , and project plans .


In their current campaign , APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros . Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles , collaborative document editing sites , and blogs for C&C .


APT32 actors continue to deliver the malicious attachments via spear-phishing emails . Once BARIUM has established rapport , they spear-phish the victim using a variety of unsophisticated malware installation vectors , including malicious shortcut ( .lnk ) files with hidden payloads .


In the following weeks , FireEye released threat intelligence products and updated malware profiles to customers while developing new detection techniques for APT32’s tools and phishing lures . Instead , the group often simply emails a Winnti installer to potential victims , relying on basic social engineering tactics to convince recipients to run the attached malware .


FIN7 is a financially motivated intrusion set that selectively targets victims and uses spear phishing to distribute its malware . Microsoft Analytics shows that Winnti has been used in intrusions carried out throughout Asia , Europe , Oceania , the Middle East , and the United States in the last six months ( Figure 1 ) .


The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits , including the EternalBlue exploit used in the WannaCry attack from May 2017 . Instead , Lead often simply emails a Winnti installer to potential victims , relying on basic social engineering tactics to convince recipients to run the attached malware .


The threat actors , observed by FireEye Labs , use a variety of different methods to either compromise or acquire already compromised payment card credentials , including sharing or purchasing dumps online , hacking vulnerable merchant websites and compromising payment card processing devices . In some other cases , LEAD gains access to a target by brute-forcing remote access login credentials , performing SQL injection , or exploiting unpatched web servers , and then they copy the Winnti installer directly to compromised machines .


Another common step taken by threat actors is changing their system's MAC Address to avoid being uniquely identified . This was the case in two known intrusions in 2015 , where attackers named the implant DLL " ASPNET_FILTER.DLL " to disguise it as the DLL for the ASP.NET ISAPI Filter .


The attachment in these emails is a weaponized Microsoft Office document containing a malicious macro that – when enabled – leads to the download of Hancitor . Windows Defender ATP helps network security professionals deal with intrusions from activity groups like LEAD and BARIUM in several ACTs .


FireEye Labs detects this phishing attack and customers will be protected against the usage of these sites in possible future campaigns . The following examples were developed using a Winnti installer that was used in attacks in December 2016 .


The threat actors used two publicly available techniques , an AppLocker whitelisting bypass and a script to inject shellcode into the userinit.exe process . The Windows 10 Creators Update will bring several enhancements to Windows Defender ATP that will provide SOC personnel with options for immediate mitigation of a detected threat .


To run its code in kernel mode in the most recent versions of operating systems , that have Driver Signature Enforcement , Slingshot loads signed vulnerable drivers and runs its own code through their vulnerabilities . LEAD and Barium are not known for large-scale spear-phishing , so it is unlikely that SOC personnel would have to deal with multiple machines having been compromised by these groups at the same time .


To date , all observed Snake Wine 's attacks were the result of spear phishing attempts against the victim organizations . And , finally , with the upcoming Creators Update , Windows Defender ATP will provide additional capabilities for detecting threats such as Winnti , as well as centralized response options , such as machine isolation and file blocking , that will enable fast containment of known attack jump off points .


Beginning in mid-January 2019 , TA542 distributed millions of Emotet-laden emails in both English and German . The police suspected Lurk of stealing nearly three billion rubles , using malicious software to systematically withdraw large sums of money from the accounts of commercial organizations , including banks .


Proofpoint researchers observed one DanaBot affiliate ( Affid 11 ) specifically targeting Canada with " Canada Post " themed lures between January 1 and May 1 , 2019 . When we first encountered Lurk , in 2011 , it was a nameless Trojan .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . While the machine is in isolation , SOC personnel can direct the infected machine to collect live investigation data , such as the DNS cache or security event logs , which they can use to verify alerts , assess the state of the intrusion , and support follow-up actions .


In this latest incident , the group registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day . This article is an attempt to share this experience with other experts , particularly the IT security specialists in companies and financial institutions that increasingly find themselves the targets of cyber-attacks .


In previous incidents involving this threat actor , we observed them using malicious documents hosted on websites about the Indian Army , instead of sending these documents directly as an email attachment . In most cases , the attackers only had to infect the computer on which the RBS software was installed in order to start stealing the cash .


In this latest incident , Transparent Tribe registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day . We were soon able to help investigate another incident involving Lurk .


This exploit file made use of the same shellcode that we have observed Transparent Tribe use across a number of spear phishing incidents . This event significantly affected the Russian cybercriminal world as the gang had stolen hundreds of millions of rubles during a few years of activity , and was considered a " leader " among cybercriminals .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . In Russia , there were several relatively large cybercriminal groups engaged in financial theft via attacks on RBS .


Whitefly compromises its victims using custom malware alongside open-source hacking tools and living off the land tactics , such as malicious PowerShell scripts . In April 2013 , a year after we found the " bodiless " Lurk module , the Russian cybercriminal underground exploited several families of malicious software that specialized in attacks on banking software .


After the demise of Storm , it was replaced by another new botnet known as Waledac that also leveraged peer-to-peer communications . Through the information exchanges used by people in the security industry , we learned that several Russian banks were struggling with malicious programs created specifically to attack a particular type of legal banking software .


ESET recently analyzed a new Mac OS sample from the OceanLotus group that had been uploaded to VirusTotal . If it did , the malware downloaded additional modules , including ones allowing for the automatic creation of unauthorized payment orders , changing details in legal payment orders , etc .


At this point , the attackers know the user has opened the document and send another spear-phishing email , this time containing an MS Word document with an embedded executable . As far as we can judge from the data we have , in 2014 the criminal group behind Lurk seriously reduced its activity and " lived from hand to mouth " , attacking anyone they could , including ordinary users .


In one case from 2013 , the target was sent a malicious document through a spear phishing email message . In February 2015 , Kaspersky Lab 's Global Research and Analysis Team ( GReAT ) released its research into the Carbanak campaign targeting financial institutions .


The malware may communicate with its command and control (C2) server over The Onion Router (Tor) network if configured to do so . Since 2011 , the robbers had allegedly been stealing money directly from bank accounts in Russia and other countries of the Commonwealth of Independent States ( CIS ) by using a Trojan called Lurk .


Harvested credentials provided by an embedded Mimikatz executable facilitate the infection of other systems on the network . which they launched targeted attacks against Russian banks , businesses and media companies .


This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . Lurk uses a form of steganography : that's where one file is hidden aACT inside another file of a completely different sort , such as an image , audio , or video file .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . The latest version of Madi also has the ability to monitor the Russian social network Vkontakte ( VK ) along with the Jabber messaging platform to look for users who visit websites that contain words like " USA " , " Skype " , and " gov " .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . Madi was found capturing computer screens , recording audio and stealing screenshots , keystrokes , documents and e-mail correspondence from " Middle Eastern critical infrastructure engineering firms , government agencies , financial houses and academia .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . A timeline of new activity can be scoped out for the group , with the greatest number of related downloaders created by the developers in December 2011 , Feb and March of 2012 , followed by June of 2012 .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . it reports to was created on August 10 , 2011 .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . Since at least 2008 , The Lamberts have used multiple sophisticated attack tools against high-profile victims .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . Longhorn , which we internally refer to as " The Lamberts " , first came to the attention of the ITSec community in 2014 , when our colleagues from FireEye discovered an attack using a zero day vulnerability ( CVE-2014-4148 ) .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . The attack leveraged malware we called ' BlackLambert ' , which was used to target a high profile organization in Europe .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . Their arsenal includes network-driven backdoors , several generations of modular backdoors , harvesting tools , and wipers .


Alternatively , it is also possible that APT41 injected malicious code into the package prior to compilation , circumventing the need to steal the code-signing certificate and compile it on their own . The first time the Lambert family malware was uncovered publicly was in October 2014 , when FireEye posted a blog about a zero day exploit ( CVE-2014-4148 ) used in the wild .


SectorJ04 used the spear phishing email to spread malicious Excel or malicious Word files , and downloaded the MSI files from the attacker’s server when the malicious documents were run . Interestingly , while most Blue Lambert variants have version numbers in the range of 2.x , Green Lambert is mostly in 3.x versions .


Spam emails targeting email accounts used in the integrated mail service of public officials were also found in the hacking activity . While investigating one of these infections involving White Lambert ( network-driven implant ) and Blue Lambert ( active implant ) , we found yet another family of tools that appear to be related .


Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials . Versions of this particular orchestrator were found on other victims , together with White Lambert samples , indicating a close relationship between the White and Pink Lambert malware families .


During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros . While in most cases the infection vector remains unknown , the high profile attack from 2014 used a very complex Windows TTF zero-day exploit ( CVE-2014-4148 ) .


Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() . This migration activity was last observed in October 2016 .


This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . Most of the Blue and Green Lambert samples have two C&C servers hardcoded in their configuration block : a hostname and an IP address .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . Some of the known filenames for Gray Lambert are mwapi32.dll and poolstr.dll – it should be pointed though that the filenames used by the Lamberts are generally unique and have never been used twice .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . Black Lambert was seen only briefly and we assume it was " retired " from the arsenal after being discovered by FireEye in 2014 .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . The Lamberts toolkit spans across several years , with most activity occurring in 2013 and 2014 .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . To further exemplify the proficiency of the attackers leveraging the Lamberts toolkit , deployment of Black Lambert included a rather sophisticated TTF zero day exploit , CVE-2014-4148 .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . Taking that into account , we classify the Lamberts as the same level of complexity as Regin , ProjectSauron , Equation and Duqu2 , which makes them one of the most sophisticated Cyber Espionage toolkits we have ever analysed .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . Taking that into account , we classify the Lamberts as the same level of complexity as Regin , ProjectSauron , Equation and Duqu2 , which makes them one of the most sophisticated Cyber Espionage toolkits we have ever analysed .


Should a user enable this content , Gallmaker is then able to use the DDE protocol to remotely execute commands in memory on the victima 's system . On January 15 , Confiant exposed the activity of the Zirconium group , spreading malicious ads via a network of fake ad agencies through 2017 , in what amounted to the largest malvertising campaign of recent times .


These socially engineered emails contain web links of weaponized documents containing exploits or macros . Cadelle , uses Backdoor.Cadelspy .


It contains an additional meta tag at the end of the web page source code , " refreshing " ( redirecting ) the site visitor to the weaponized document . Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014 , however , it's likely that activity began well before this date .


Volexity has also found that , in addition to sending malware lures , the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages . Chafer , uses Backdoor.Remexi .


At this point , the attackers know the user has opened the document and send another spear-phishing email , this time containing an MS Word document with an embedded executable . Cadelle 's threats are capable of opening a back door and stealing information from victims' computers .


The majority of the code for TINYTYPHON is taken from the MyDoom worm and has been repurposed to find and exfiltrate documents . Chafer , uses Backdoor.Remexi.B .


Pitty Tiger group is sometimes using stolen material as spear phishing content to target other persons . registrant information points to activity possibly as early as 2011 .


The Pitty Tiger group mostly uses spear phishing in order to gain an initial foothold within the targeted environment . These threats are capable of opening a back door and stealing information from victims' computers .


PittyTiger leverages social engineering to deliver spearphishing emails , in a variety of languages including English , French and Chinese , and email phishing pages to their targets . executable compilation times suggest early 2012 .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . It's unclear how Cadelle infects its targets with Backdoor.Cadelspy .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . The affected organizations we were able to identify are mostly based in the Middle East .


PLATINUM often spear phishes its targets at their non-official or private email accounts , to use as a stepping stone into the intended organization 's network . one organization is located in the US .


PLATINUM primarily targets its intended victims using spear phishing . There are a number of factors in these groups' campaigns that suggests that the attackers may be based in Iran .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television . Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands .


In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television . Their primary interest appears to be gathering intelligence .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations . This stands in opposition to the data gathered from export timestamps and C&C domain activity that points to Green Lambert being considerably older than the Blue variant .


The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences . security policy in the Eastern Europe and South Caucasus regions .


When the document was opened in Word , PLATINUM exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer . Callisto Group via credential phishingThese spear phishing emails were crafted to appear highly convincing , including being sent from legitimate email accounts suspected to have been previously compromised by the Callisto Group via credential phishing .


n one case from 2013 , the target was sent a malicious document through a spear phishing email message . In early 2016 the Callisto Group began sending highly targeted spear phishing emails with malicious attachments that contained , as their final payload , the " Scout " malware tool from the HackingTeam RCS Galileo platform .


According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . These spear phishing emails were crafted to appear highly convincing , including being sent from legitimate email accounts suspected to have been previously compromised by the Callisto Group via credential phishing .


According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . Callisto Group appears to be intelligence gathering related to European foreign and security policy .


This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose . some indications of loosely linked activity dating back to at least 2013 .


The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences . In October 2015 , the Callisto Group was observed sending targeted credential phishing emails .


On November 26 , 2015 , a suspected China-based APT16 sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies . In early 2016 , the Callisto Group was observed sending targeted spear phishing emails .


On November 26 , 2015 , a suspected China-based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies . The malicious attachments purported to be invitations or drafts of the agenda for the conference .


APT16 actors sent spear phishing emails to two Taiwanese media organizations . Based on our analysis of Callisto Group 's usage of RCS Galileo , we believe the Callisto Group did not utilize the leaked RCS Galileo source code , but rather used the leaked readymade installers to set up their own installation of the RCS Galileo platform .


On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website . In the known spear phishing attacks by the Callisto Group , they employed the " Scout " malware tool from the RCS Galileo platform .


APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails . We are confident the Callisto Group used this type of access to a target 's email account for the purposes of sending spear phishing to other targets .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia . If a target of the spear phishing described in " Phase 2 : malware deployment " opened the email attachment and , crucially , clicked on the icon in the attachment , this would lead to the target 's computer becoming infected with the " Scout " malware tool from the RCS Galileo platform .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " . Callisto Group and related infrastructure contain links to at least Russia , Ukraine , and China .


APT33 sent spear phishing emails to employees whose jobs related to the aviation industry . they have been last known to employ malware in February 2016 .


It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations . RCS Galileo platform .


In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company . The spear phishing emails used in the known attacks by the Callisto Group were so convincing that even skilled and alert users would likely have attempted to open the malicious attachment .


Operation Daybreak appears to have been launched by unknown attackers to infect high profile targets through spear-phishing e-mails . In October 2015 the Callisto Group targeted a handful of individuals with phishing emails that attempted to obtain the target 's webmail credentials .


Operation Daybreak appears to have been launched by APT37 to infect high profile targets through spear-phishing e-mails . The Callisto Group has been active at least since late 2015 and continues to be so , including continuing to set up new phishing infrastructure every week .


BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . Called Greenbug , this group is believed to be instrumental in helping Shamoon steal user credentials of targets ahead of Shamoon 's destructive attacks .


The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . On Tuesday , Arbor Networks said that it has new leads on a credential stealing remote access Trojan ( RAT ) called Ismdoor , possibly used by Greenbug to steal credentials on Shamoon 's behalf .


BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . " With our latest research we now see how Greenbug has shifted aACT from HTTP-based C2 communication with Ismdoor .


The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . It's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost .


While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization . t's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost .


While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization . By relying on a native PDF command to navigate to a new URL , Zirconium successfully circumvented Chrome 's anti-redirect protection .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when the group compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks . In the context of the Ismdoor RAT , the DNS attack technique is used primarily by Greenbug for stealing credentials .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when BRONZE BUTLER compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks . To do this , it employs a number of specific commands via DNSMessenger .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team . Iranian Threat Agent Greenbug has been registering domains similar to those of Israeli High-Tech and Cyber Security Companies .


In several cases , the Cobalt compromised company infrastructure and employee accounts in order to send phishing messages to partner companies in North and South America , Europe , CIS countries , and Central and Southeast Asia . By pivoting off the registration details and servers data of the two domains we discovered others registered by the threat agent .


To ensure remote access to the workstation of an employee at a target organization , the Cobalt group ( as in previous years ) uses Beacon , a Trojan available as part of commercial penetration testing software . Named Trochilus , this new RAT was part of Group 27 's malware portfolio that included six other malware strains , all served together or in different combinations , based on the data that needed to be stolen from each victim .


In a recent spear-phishing campaign , the Cobalt Hacking Group used a remote code execution vulnerability in Microsoft Office software to connect to its command and control server via Cobalt Strike . According to the security experts , this collection of malware was discovered after their first initial report was published , meaning that Group 27 ignored the fact they were unmasked and continued to infect their targets regardless , through the same entry point , the Myanmar Union Election Commission ( UEC ) website .


Gallmaker used lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange ( DDE ) protocol in order to gain access to victim machines . Trochilus RAT activity was discovered during both months of October and November 2015 .