At least in most recent versions , as of January 2019 , the Zip archive would actually contain the i686 , arm and arm64 versions of all deployed binaries . In the first week of May 2016 , FireEye 's DTI identified a wave of emails containing malicious attachments being sent to multiple banks in the Middle East region . This campaign started in November 2019 and it is still ongoing . According to Kaspersky telemetry , targeted organizations included political bodies in Europe .


File Name Modified Date SHA256 null_arm 2018-02-27 06:44:00 48a7dd672931e408662d2b5e1abcd6ef00097b8ffe3814f0d2799dd6fd74bd88 null_i686 2018-02-27 06:44:00 c228a534535b22a316a97908595a2d793d0fecabadc32846c6d1bfb08ca9a658 null_arm64 2018-02-27 06:43:00 48a7dd672931e408662d2b5e1abcd6ef00097b8ffe3814f0d2799dd6fd74bd88 Our data suggests that actors have deployed the RGDoor backdoor on webservers belonging to eight Middle Eastern government organizations , as well as one financial and one educational institution . At this time , the API key is revoked and the Twitter account is suspended . Analysis of memory core dump files


sepolicy-inject_arm 2019-01-08 04:55:00 47449a612697ad99a6fbd6e02a84e957557371151f2b034a411ebb10496648c8 sepolicy-inject_arm64 2019-01-08 04:55:00 824ad333320cbb7873dc49e61c14f749b0e0d88723635524463f2e6f56ea133a sepolicy-inject_i686 2019-01-08 04:55:00 13ec6cec511297ac3137cf7d6e4a7c4f5dd2b24478a06262a44f13a3d61070b6 In August 2018 , Unit 42 observed OilRig targeting a government organization using spear-phishing emails to deliver an updated version of a Trojan known as BONDUPDATER . However , the attacker can easily create new accounts and update the malicious files in order to still work . LIGHTWORK ( filename : OT_T855_IEC104_GR.exe ) ( MD5 : 7b6678a1c0000344f4faf975c0cfc43d ) is a disruption tool written in C++ that implements the IEC-104 protocol to modify the state of RTUs over TCP .


rootdaemon_arm 2019-01-08 04:55:00 00c787c0c0bc26caf623e66373a5aaa1b913b9caee1f34580bdfdd21954b7cc4 rootdaemon_arm64 2019-01-08 04:55:00 3ee3a973c62ba5bd9eab595a7c94b7a26827c5fa5b21964d511ab58903929ec5 mike.jar 2018-12-06 05:50:00 a42a05bf9b412cd84ea92b166d790e8e72f1d01764f93b05ace62237fbabe40e The OilRig group has been active since at least mid-2016 , and continues their attack campaigns throughout the Middle East , targeting both governmental agencies and businesses on an almost routine basis . This campaign shows us that network-based detection is important but must be completed by system behaviour analysis . KillMilk : Self - Proclaimed Founder of KillNet


rootdaemon_i686 2019-01-08 04:55:00 b46f282f9a1bce3798faee3212e28924730a657eb93cda3824c449868b6ee2e7 zygotedaemonarm 2019-01-08 04:55:00 e3f65f84dd6c2c3a5a653a3788d78920c0321526062a6b53daaf23fa57778a5f zygotedaemonarm64 2019-01-08 04:55:00 11499ff2418f4523344de81a447f6786fdba4982057d4114f64db929990b4b59 BONDUPDATER is a PowerShell-based Trojan first discovered by FireEye in mid-November 2017 , when OilRig targeted a different Middle Eastern governmental organization . JhoneRAT : 273aa20c4857d98cfa51ae52a1c21bf871c0f9cd0bf55d5e58caba5d1829846f . Marlin is a notable split from OilRigs typical TTPs .


zygotedaemoni686 2019-01-08 04:55:00 3c9f08b3280851f54414dfa5a57f40d3b7be7b73736fa0ba21b078e75ce54d33 sapp.apk 2019-01-08 04:53:00 4bf1446c412dd5c552539490d03e999a6ceb96ae60a9e7846427612bec316619 placeholder 2018-03-29 16:31:00 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 During the past month , Unit 42 observed several attacks against a Middle Eastern government leveraging an updated version of the BONDUPDATER malware , which now includes the ability to use TXT records within its DNS tunneling protocol for its C2 communications . JhoneRAT : 29886dbbe81ead9e9999281e62ecf95d07acb24b9b0906b28beb65a84e894091 . Adversaries may perform data destruction over the course of an operation .


After download , Exodus One would dynamically load and execute the primary stage 2 payload mike.jar using the Android API DexClassLoader ( ) . The email had no subject and what initially drew our attention to OilRig 's attack was the content of the spear phishing email . JhoneRAT : d5f10a0b5c103100a3e74aa9014032c47aa8973b564b3ab03ae817744e74d079 . Among the group ’s most interesting characteristics are : • Strong functional and structural similarities linking its malware toolset to early MiniDuke and more recent CosmicDuke and OnionDuke components In early 2013 , GReAT observed several incidents that were so unusual they suggested the existence of a new , previously unknown threat actor .


mike.jar implements most of the data collection and exfiltration capabilities of this spyware . As expected , OilRig is continuing their onslaught of attacks well into 2018 with continued targeting in the Middle East . JhoneRAT : 6cc0c11c754e1e82bca8572785c27a364a18b0822c07ad9aa2dc26b3817b8aa4 . NIST does not necessarily endorse the views expressed , or concur with the facts presented on these sites .


Of the various binaries downloaded , the most interesting are null , which serves as a local and reverse shell , and rootdaemon , which takes care of privilege escalation and data acquisition . First identified in January 2015 , Orangeworm has also conducted targeted attacks against organizations in related industries as part of a larger supply-chain attack in order to reach their intended victims . JhoneRAT : 7e1121fca3ac7c2a447b61cda997f3a8202a36bf9bb08cca3402df95debafa69 . Antivirus software identifies threats by matching a particular piece of softwares code to programs it has identified as malicious in its database .


rootdaemon will first attempt to jailbreak the device using a modified version of the DirtyCow exploit . According to Symantec telemetry , almost 40 percent of Orangeworm 's confirmed victim organizations operate within the healthcare industry . JhoneRAT : b4a43b108989d1dde87e58f1fd6f81252ef6ae19d2a5e8cd76440135e0fd6366 . Will Harrison was terminated as an Ashley Madison employee in November 2011 , and by early 2012 he ’d turned his considerable harassment skills squarely against the company .


Similarly to another Android spyware made in Italy , originally discovered by Lukas Stefanko and later named Skygofree and analyzed in depth by Kaspersky Labs , Exodus also takes advantage of " protectedapps '' , a feature in Huawei phones that allows to configure power-saving options for running applications . Their next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting , again attempting to extract all Word documents . JhoneRAT : https://drive.google.com/uc?export=download&id=1vED0wN0arm9yu7C7XrbCdspLjpoPKfrQ . Notably , CADDYWIPER has been the most frequently used disruptive tool against Ukrainian entities during the war and has seen consistent operational use since March 2022 , based on public reporting .


By manipulating a SQLite database , Exodus is able to keep itself running even when the screen goes off and the application would otherwise be suspended to reduce battery consumption . Sowbug 's next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting , again attempting to extract all Word documents . JhoneRAT : https://drive.google.com/uc?export=download&id=1LVdv4bjcQegPdKrc5WLb4W7ad6Zt80zl . The campaigns we discovered also involve malicious files intended for users in Poland .


Additionally , rootdaemon attempts to remove its own power usage statistics from Huawei phones ' SystemManager : Similarly , the malicious application probably attempts to minimize traces on Samsung phones by adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/apm_sp_status_of_apps.xml the following lines : And adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/com.samsung.android.securitylogagent_preferences.xml For example , in September 2016 , Sowbug infiltrated an organization in Asia , deploying the Felismus backdoor on one of its computers , Computer A , using the file name adobecms.exe in CSIDL_WINDOWS\debug . JhoneRAT : https://drive.google.com/uc?export=download&id=1OlQssMvjb7gI175qDx8SqTgRJIEp5Ypd . Money


these lines instead : Data Collection and Exfiltration As mentioned , mike.jar equips the spyware with extensive collection capabilities , including : Retrieve a list of installed applications . In this case , the attackers maintained a presence on the target 's network for nearly six months between September 2016 and March 2017 . JhoneRAT : https://drive.google.com/uc?export=download&id=1d-toE89QnN5ZhuNZIc2iF4-cbKWtk0FD . This newest edition of the malware includes novel documents containing macros that extract the embedded package once opened and execute it once the document closes instead of having the victim click on a video link as before .


Record surroundings using the built-in microphone in 3gp format . In other attacks , there was evidence that Felismus was installed using a tool known as Starloader ( detected by Symantec as Trojan.Starloader ) . JhoneRAT : https://drive.google.com/uc?export=download&id=1kbHVkvPIjX49qJ62TBz6drW2YPiiaX2a . The attackers ' aim is to put the organisation in an unbearable position by stopping it from functioning , and then demanding a ransom that can stretch to millions of dollars .


Retrieve the browsing history and bookmarks from Chrome and SBrowser ( the browser shipped with Samsung phones ) . Symantec has found evidence of Starloader files being named AdobeUpdate.exe , AcrobatUpdate.exe , and INTELUPDATE.EXE among others . JhoneRAT : https://twitter.com/jhone87438316 . They are usually motivated by a cause of some sort , such as highlighting human rights or alerting a large corporation to their system vulnerabilities .


Extract events from the Calendar app . Additionally , Starloader was also observed deploying additional tools used by the attackers , such as credential dumpers and keyloggers . New Cyber Espionage Campaigns Targeting Palestinians - Part 2 : The Discovery of the New , Mysterious Pierogi backdoor . When the marital infidelity website AshleyMadison.com learned in July 2015 that hackers were threatening to publish data stolen from 37 million users , the company ’s then - CEO Noel Biderman was quick to point the finger at an unnamed former contractor .


Extract the calls log . ASERT has learned of an APT campaign , possibly originating from DPRK , we are calling STOLEN PENCIL that is targeting academic institutions since at least May 2018 . Since December 2019 , the Cybereason Nocturnus team has been investigating a campaign targeting Palestinian individuals and entities in the Middle East , mostly within the Palestinian territories . If more groups start adopting CL0P 's zero - day exploitation techniques , the ransomware landscape could tilt from service - oriented attacks to a more aggressive , vulnerability - focused model — a move that could skyrocket the number of victims .


Record phone calls audio in 3gp format . Once gaining a foothold on a user 's system , the threat actors behind STOLEN PENCIL use Microsoft 's Remote Desktop Protocol ( RDP ) for remote point-and-click access . This campaign uses social engineering and decoy documents related to geopolitical affairs and relations between the Palestinian government , and references Egypt , Hezbollah , and Iran . As with other groups , it is possible that espionage and intelligence gathering are the first steps toward deploying ransomware or wiper malware .


Take pictures with the embedded camera . The group uses an advanced piece of malware known as Remsec ( Backdoor.Remsec ) to conduct its attacks . Part one of this research investigates the Spark campaign , where attackers use social engineering to infect victims , mainly from the Palestinian territories , with the Spark backdoor . With ThreatConnect , teams get a single Platform to simplify the processing , categorization , and response to suspicious emails , reducing the time to remediate active threats from days to minutes .


Collect information on surrounding cellular towers ( BTS ) . Strider has been active since at least October 2011 . For more information about part one , click here . Because indicators of attack are all about interactions with your network , it may be possible that the actions performed during the early stages of the cyberattack kill chain are not considered harmful .


Extract the address book . Lua modules is a technique that has previously been used by Flamer . During the attacks , victims are infected with a previously undocumented backdoor , dubbed Pierogi by Cybereason . The frameworks evolving realworld tactics , techniques and procedures can help organizations better understand how to allocate resources properly to detect ransomware early enough to prevent a successful attack .


Extract the contacts list from the Facebook app . The Remsec malware used by Strider has a modular design . This backdoor allows attackers to spy on targeted victims . This includes hosting C&C domains that were used by Winnti such as mtrue.com , shenqi[.]kr and zhu[.]kr .


Extract logs from Facebook Messenger conversations . The group has maintained a low profile until now and its targets have been mainly organizations and individuals that would be of interest to a nation state 's intelligence services . Cybereason suspects that the backdoor may have been obtained in underground communities rather than home-grown , as the evidence found in the code of the backdoor suggests it may have been developed by Ukranian-speaking hackers . Malware detections do n’t matter nearly as much as malware damage — just one ransomware attack can close your business .


Take a screenshot of any app in foreground . The group 's targets include a number of organizations and individuals located in Russia . The tactics , techniques , and procedures ( TTPs ) , content , and theme of the decoy documents , as well as the victimology observed in the campaign , resemble previous attacks that have targeted Palestinians . Researchers at Akamai reported on a Magecart skimmer campaign disguised as Google Tag Manager that also made the news with the compromise of one of Canada 's largest liquor store ( LCBO ) .


Extract information on pictures from the Gallery . Remsec uses a Lua interpreter to run Lua modules which perform various functions . In particular , these campaigns appear to be related to attacks carried out by a group called MoleRATs ( aka , Gaza Cyber Gang , Moonlight ) , an Arabic-speaking , politically motivated group that has been operating in the Middle East since 2012 . One can only guess how they will be used .


Extract information from th GMail app . Russia . Cyber Espionage with a New Malware : The Cybereason Nocturnus team has discovered recent , targeted attacks in the Middle East to deliver the Pierogi backdoor for politically-driven cyber espionage . Ukrainian and Polish government and military organizations among those targeted Talos first discovered a campaign in late April using several malicious files very likely intended for users in Ukraine , based on the content of the lure displayed when the target opens a malicious Microsoft Excel file .


Dump data from the IMO messenger app . The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information . Targeting Palestinians : The campaigns seems to target Palestinian individuals and entities , likely related to the Palestinian government . Harrison signed his threatening missive with the salutation , “ We are legion , ” suggesting that whatever comeuppance he had in store for Ashley Madison would come from a variety of directions and anonymous hackers .


Extract call logs , contacts and messages from the Skype app . the group 's targets include an organization in Sweden . Using Geopolitically-charged Lure Content : The attackers use specially crafted lure content to trick their targets into opening malicious files that infect the victim ’s machine with the Pierogi backdoor . The name “ Anonymous Sudan ” is likely an attempted appropriation of the brand of the well - known hacktivist collective “ Anonymous , ” similar to another KillNet affiliate , “ Anonymous Russia . ”


Retrieve all SMS messages . the group 's targets include an embassy in Belgium . The decoy content of the malicious files revolves around various political affairs in the Middle East , specifically targeting the tension between Hamas and other entities in the region . All of these things point to threat actors and groups like Winnti will continue to try different methods of attack .


Extract messages and the encryption key from the Telegram app . Symantec will continue to search for more Remsec modules and targets in order to build upon our understanding of Strider and better protect our customers . Perpetrated by an Arabic-speaking APT , MoleRATs : The modus-operandi of the attackers as well as the social engineering decoy content seem aligned with previous attacks carried out by an Arabic-speaking APT group called MoleRATs ( aka Gaza Cybergang ) . .bat "


Dump data from the Viber messenger app . Another such an exceptional espionage platform is " ProjectSauron , also known as " Strider " . This group has been operating in the Middle East since 2012 . Indicators of compromise help answer the question What happened while indicators of attack can help answer questions like What is happening and why A proactive approach to detection uses both IOAs and IOCs to discover security incidents or threats in as close to real time as possible .


Extract logs from WhatsApp . In September 2015 , our anti-targeted attack technologies caught a previously unknown attack . Similar to previous attacks , this campaign starts with social engineering . As confirmed by our own research data , CISA also found LockBit took the top spot as the biggest global ransomware threat in 2022 .


Retrieve media exchanged through WhatsApp . Forensic analysis indicates that the APT has been operational since at least June 2011 and was still active in 2016 . In one instance , it lures victims to open an email attachment . Rhysida , a new ransomware gang claiming to be a " cybersecurity team , " has been in operation since May 17 , 2023 , making headlines for their high - profile attack against the Chilean Army .


Extract the Wi-Fi network 's password . After getting the IP , the ProjectSauron component tries to communicate with the remote server using its own ( ProjectSauron ) protocol as if it was yet another C&C server . In others , it persuades victims to download a report about a recent political affair pertaining to the Middle East and specifically to Palestinian matters . CrowdStrike Services recently investigated several Play ransomware intrusions where the common entry vector was suspected to be the Microsoft Exchange ProxyNotShell vulnerabilities CVE-2022 - 41040 and CVE-2022 - 41082 .


Extract data from WeChat app . In a number of the cases we analyzed , ProjectSauron deployed malicious modules inside the custom network encryption 's software directory , disguised under similar filenames and accessing the data placed beside its own executable . In most cases , the downloaded file is either an executable that masquerades as a Microsoft Word document or a weaponized Microsoft Word document . According to a recent study by Trellix and the Center for Strategic and International Studies CSIS , 86 of organizations believe they have been targeted by a nationstate threat actor .


Extract current GPS coordinates of the phone . The threat actor behind ProjectSauron commands a top-of-the-top modular cyber-espionage platform in terms of technical sophistication , designed to enable long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods . As soon as the victim double-clicks on the dropper , they are presented with the decoy document . We highly suspect the “ Pig network ” to have also been used as a bulletproof hosting service for cybercriminals who are unrelated to the Winnti group .


While some of these acquisition are performed purely through code in mike.jar , some others that require access to , for example , SQLite databases or other files in the application 's storage are performed through rootdaemon instead , which should be running with root privileges . In September 2015 , Kaspersky Lab 's Anti-Targeted Attack Platform discovered anomalous network traffic in a government organization network . The document lowers the victim ’s suspicions by distracting them with a real document while the dropper installs the backdoor . This file contains the ransom note .


In order to achieve this , mike.jar connects to rootdaemon through various TCP ports that the daemon binds on some extraction routines for supported applications : Port 6202 : WhatsApp extraction service . In late 2015 , Symantec identified suspicious activity involving a hacking tool used in a malicious manner against one of our customers . However , some of the documents also play an additional role in the attack . On Oct. 10 , 2023 , Citrix released a security bulletin for a sensitive information disclosure vulnerability ( CVE-2023 - 4966 ) impacting NetScaler ADC and NetScaler Gateway appliances .


Ports 6203 and 6204 : Facebook extraction service . Secondary ProjectSauron modules are designed to perform specific functions like stealing documents , recording keystrokes , and hijacking encryption keys from both infected computers and attached USB sticks . While some are more neutral , quoting from newspapers and the media , others seem to report fake news to spread misinformation that serves a political agenda . Ways our customers can detect and block this threat are listed below .


Port 6205 : Gmail extraction service . activity originated from three separate IP addresses , all located in Chengdu , China . With regards to decoy content themes , this campaign resembles previous campaigns reported in blogs by Vectra , Unit 42 , and Talos . Education accounts for a huge proportion of known Vice Society attacks .


Port 6206 : Skype extraction service . We don't know the exact date Suckfly stole the certificates from the South Korean organizations . The contents of the decoy documents seems to include : This was followed by an executable downloader and payload concealed in an image file , likely to make its detection more difficult .


Port 6207 : Viber extraction service . stolen certificates being used maliciously occurred in early 2014 . Potentially fake documents that appear to be issued by the Palestinian government . The alert described emails that delivered an Evernotethemed lure to entice targeted recipients into downloading a trojan .


Port 6208 : IMO extraction service . Symantec detects this threat as Backdoor.Nidiran . Meetings minutes of different Palestinian organizations . Request a demo meeting with us or reach out to us at salesthreatconnect.com to see how we can help automate phishing analysis and response for your organization .


Port 6209 : Telegram extraction service . Specifically , Suckfly used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows . News about Hamas and the Palestinian National Authority . The contents found in secure[.]66[.]to often lead to zhu[.]vn , which is Hack520 ’s domain for hosting his own private blog .


Port 6210 : SBrowser extraction service . The threat then executes " svchost.exe " . Potentially fake , leaked Hamas documents . " These [ Rising Sun ] implants were all based on the original Backdoor Duuzer source code , " the researchers say in their report .


Port 6211 : Calendar extraction service . Attackers have been known to distribute malicious files masquerading as the legitimate iviewers.dll file and then use DLL load hijacking to execute the malicious code and infect the computer . Criticism of and embarrassing content about Hamas . This includes tens of thousands of terminals outside of Ukraine that , among other things , support wind turbines and provide Internet services to private citizens .


Port 6212 : Chrome extraction service . Once exploit has been achieved , Nidiran is delivered through a self-extracting executable that extracts the components to a .tmp folder after it has been executed . APA S-IDTY adopted resolution Unlimited support for Palestinian people.docx : We can not independently confirm KillMilk 's claims of having previous affiliation with the hacktivist group Universal Dark Service .


These services appear to be running on all network interfaces and are therefore accessible to anyone sharing a local network with an infected device . The certificates Blackfly stole were also from South Korean companies , primarily in the video game and software development industry . Describes a resolution by the Asian Parliamentary Assembly ( APA ) held in Anatalya , announcing unlimited support for the Palestinian people 7b4c736b92ce702fb584845380e237aa55ddb4ef693ea65a766c9d9890b3852c . jalsa.rar : The attackers behind Earth Vetala use features of remote access software to steal sensitive information or download malware for additional cyber operations , leveraging spearphishing emails and lure documents containing embedded links to a legitimate filesharing service Onehub to distribute archives containing the ScreenConnect remote administrator tool and RemoteUtilities software .


Following we can see an example of a connection to port 6209 which is used to extract data from the Telegram app . Blackfly began with a campaign to steal certificates , which were later used to sign malware used in targeted attacks . Contains the above mentioned document , as well as photos of the assemblies and political cartoons criticizing Hamas 50a597aa557084e938e2a987ec5db99187428091e8141e616cced72e6a39de1b . Cisco Duo provides multi - factor authentication for users to ensure only those authorized are accessing your network .


We are able to send commands to the service such as dumpmsgdb or getkey ( which dumps the tgnet.dat file ) . In March 2016 , Symantec published a blog on Suckfly , an advanced cyberespionage group that conducted attacks against a number of South Korean organizations to steal digital certificates . Internet in government.pdf / Define the Internet in government institutions.pdf : These observations leave open the possibility that COSMICENERGY was developed with malicious intent , and at a minimum that it can be used to support targeted threat activity in the wild .


Data acquired from mike.jar 's extraction modules is normally XORed and stored in a folder named .lost+found on the SD card . Since then we have identified a number of attacks over a two-year period , beginning in April 2014 , which we attribute to Suckfly . Announcement about a new regulation regarding internet usage in Palestinian government institutions . A Cl0p representative confirmed that they had been testing the vulnerability since July 2021 and that they had decided to deploy it over the Memorial Day weekend .


Data is eventually exfiltrated over a TLS connection to the Command & Control server ws.my-local-weather [ . The attacks targeted high-profile targets , including government and commercial organizations . The announcement states that porn , gambling and entertainment sites will be blocked 9e4464d8dc8a3984561a104a93a7b8d6eb3d622d5187ae1d3fa6f6dafa2231a8 . Previous versions of TIEDYE were configured to persist via a LaunchAgent .


] com through an upload queue . these attacks were part of a planned operation against specific targets in India . Congratulations_Jan-7.pdf : Inside , we break down the 5 most dangerous threats facing businesses this year — including LockBit and SocGholish — dissecting how they ’re delivered , where they spread , what they destroy , and the best practices to protect against them .


As mentioned before , our test device was automatically from stage one to stage two , which started collecting data . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions . Letter allegedly from the Barcelona B-IDTY branch E-LOC of the SysUpdate has been in use by Budworm since at least 2020 , and the attackers appear to continually develop the tool to improve its capabilities and avoid detection .


For example , the password of the WiFi network used by the phone was stored in the folder /storage/emulated/0/.lost+found/0BBDA068-9D27-4B55-B226-299FCF2B4242/ using the following file name format DD_MM_2019_HH_mm_ss_XXXXXXXXXXXXX.txt.crypt ( the datetime followed by the IMEI ) . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions . Federation of Independent Palestinian Communities and Organizations and Events in the Diaspora . This is clear and shocking evidence of a deliberate and malicious attack by Russia against Ukraine which had significant consequences on ordinary people and businesses in Ukraine and across Europe .


Eventually we observed the agent exfiltrate the WiFi password from our test phone to the Command & Control server : Similarly , the agent also sent to the Command & Control the list of installed apps : This Command & Control seems to have been active since at least April 2017 and was registered impersonating the legitimate service AccuWeather . The first known Suckfly campaign began in April of 2014 . The letter commemorates the 73rd anniversary of the Syrian Army , and expresses the Palestinian support of Bashar Al-Asad . Attackers may perform seemingly authorized actions but left unchecked , victims may be met with an unwelcome surprise .


Local and Remote Shells In order to execute commands on the infected devices , as well as to provide a reverse shell to the Command & Control operators , Exodus Two immediately attempts to execute a payload it downloads with the name null . Suckfly 's attacks on government organizations that provide information technology services to other government branches is not limited to India . The letter ends with “ Death to Israel ” and “ Humiliation and shame to the tyrant America ” 65c8b9e9017ac84d90553a252c836c38b6a3902e5ab24d3a4b8a584e2d615fcc . This is just another example of how these groups can now quickly develop their own ransomware variants by standing on the shoulders of those criminals who had their previous work exposed publicly .


Once launched , null will first verify whether it is able to fork on the system and that there is no other instance of itself currently running by checking whether the local port number 6842 is available . It has conducted attacks on similar organizations in Saudi Arabia , likely because of the access that those organizations have . Daily_Report.docx : The Winnti group diversified its targets to include enterprises such as those in pharmaceutics and telecommunications .


This payload will then attempt to instantiate a remote reverse /system/bin/sh shell to the Command & Control ws.my-local-weather [ . Similar to its other attacks , Suckfly used the Nidiran back door along with a number of hacktools to infect the victim 's internal hosts . Daily summary of news concerning different Palestinian govenment related issues d3771d58051cb0f4435232769ed11c0c0e6457505962ddb6eeb46d900de55428 . Attackers could exploit these vulnerabilities to carry out a variety of attacks , in some cases gaining the ability to execute remote code on the targeted machine .


] com on port 22011 . In 2015 , Suckfly conducted a multistage attack . Directory of Government Services.pdf : Tracked by Mandiant as FREEFIRE , it is a lightweight backdoor written for .NET .


It is worth noticing that this remote reverse shell does not employ any transport cryptography . Suckfly conducted a multistage attack between April 22 and May 4 . A screenshot from a website of the Palestinian government , showing a directory of the different ministries 9e4464d8dc8a3984561a104a93a7b8d6eb3d622d5187ae1d3fa6f6dafa2231a8 . These requests are aimed at spreading the attack laterally within the network and can be investigated using Endpoint Detection and Response EDR solutions .


The traffic transits in clear and is therefore potentially exposed to man-in-the-middle attacks : At the same time , null will also bind a local shell on 0.0.0.0:6842 . On April 22 , 2015 , Suckfly exploited a vulnerability on the targeted employee 's operating system ( Windows ) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack . Meeting Agenda.pdf : That 's because a new ransomware called BlackSuit had appeared which shared 98 percent of its code with the infamous Royal ransomware .


This local port is used by Exodus Two to execute various commands on the Android device , such as enabling or disabling certain services , or parsing app databases . Suckfly conducted a multistage attack against an e-commerce organization . Corrupted file f6876fd68fdb9c964a573ad04e4e0d3cfd328304659156efc9866844a28c7427 . imgonline-com-ua-dexifEEdWuIbNSv7G.jpg : The FBI released an advisory warning users about NFT phishing scams where developers are often approached via social media and tricked into visiting a malicious link .


However , binding a shell on all available interfaces will obviously make it accessible to anyone who is sharing at least a local network with an infected device . Suckfly conducted a multistage attack against an e-commerce organization based in India . potentially leaked Hamas document detailing Hamas 32nd anniversary expenses in different regions in the Palestinian Territories 932ecbc5112abd0ed30231896752ca471ecd0c600b85134631c1d5ffcf5469fb . • Other actors merged into this group : 6 UNC1878 is a financially motivated group that monetizes their intrusions by extorting their victims following the deployment of RYUK ransomware .


For example , if an infected device is connected to a public Wi-Fi network any other host will be able to obtain a terminal on the device without any form of authentication or verification by simply connecting to the port . Most of the group 's attacks are focused on government or technology related companies and organizations . Asala.mp3 : The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


If the mobile operator does n't enforce proper client isolation , it is possible that the infected devices are also exposed to the rest of the cellular network . While we know the attackers used a custom dropper to install the back door , we do not know the delivery vector . An .mp3 file of a song by the famous Syrian singer Asala Nasri ( song name : Fen Habibi , translation : “ where is my loved one? ” ) 4583b49086c7b88cf9d074597b1d65ff33730e1337aee2a87b8745e94539d964 . Since the beginning of 2023 , the majority of observed KillNet targeting has focused on the U.S. , Europe , and international institutions such as NATO .


Obviously , this inevitably leaves the device open not only to further compromise but to data tampering as well . While tracking what days of the week Suckfly used its hacktools , we discovered that the group was only active Monday through Friday . In addition to the documents , the content includes a number of political cartoons that criticize Hamas ’ relations with Iran and Hamas ’ standing as a resistance movement . Facebook stated that the attackers also pretended to work in hospitality , medicine , journalism , NGOs , or airlines , sometimes conversing with their targets for months with profiles across various social media platforms .


null is not the only payload opening a shell on the phone . By targeting all of these organizations together , Suckfly could have had a much larger impact on India and its economy . While the majority of infections in this campaign did not originate from Malicious Microsoft Word document , the Cybereason Nocturnus team found several weaponized Microsoft Word document with an embedded downloader macro E-TOOL that downloads and installs the backdoor used in this attack . The intent of cybercriminals may be evaluated during the research stage of the cyberattack kill chain where they investigate potential entry points , and collect data about the company , users and technology systems in place .


The rootdaemon binary in fact offers several other possibilities to execute commands on the infected device just by connecting to TCP port 6200 and issuing one of the following commands . While we don't know the motivations behind the attacks , the targeted commercial organizations , along with the targeted government organizations , may point in this direction . CV Manal 1 : Cl0p 's precipitous rise to the top of the charts this month , on the other hand , can be explained by their exploitation of a zero - day in MOVEit Transfer , a widely used file transfer software .


Sending the command sh to TCP port 6200 results in a full terminal being dropped : Sending the command cmd followed by a proper terminal command will execute it and print the output ( in the example we use id which displays the identity of the system user running the issued commands ) : Doing the same as above but with command sucmd will run the terminal command as root : Other commands supported by rootdaemon on TCP port 6200 are su ( which in our tests did n't properly work ) , loadsocketpolicy , loadfilepolicy , remount and removeroot There is no evidence that Suckfly gained any benefits from attacking the government organizations , but someone else may have benefited from these attacks . Resume of a woman from Abu-Dis , Palestinian Authority 4a6d1b686873158a1eb088a2756daf2882bef4f5ffc7af370859b6f87c08840f . The targeting of a telecommunications company and government also point to the motivation behind the campaign being intelligence gathering , which is the motivation that generally drives Budworm activity .


. During this time they were able to steal digital certificates from South Korean companies and launch attacks against Indian and Saudi Arabian government organizations . Employee-entitlements-2020.doc : What makes COSMICENERGY unique is that based on our analysis , a contractor may have developed it as a red teaming tool for simulated power disruption exercises hosted by Rostelecom - Solar , a Russian cyber security company .


At the cost of possibly being overly verbose , following is the output of an nmap scan of the infected Android device from a laptop in the same local network , which further demonstrantes the availability of the same open TCP ports that we have mentioned thus far : Identification of eSurv Presence of Italian language At a first look , the first samples of the spyware we obtained did not show immediately evident connections to any company . We believe that Suckfly will continue to target organizations in India and similar organizations in other countries in order to provide economic insight to the organization behind Suckfly 's operations . A statement of the Ministry of Finance on civil and military employee benefits and salaries , discussing the conterversial issue Palestinian Authority employees that have not been paid or paid in full their salaries b33f22b967a5be0e886d479d47d6c9d35c6639d2ba2e14ffe42e7d2e5b11ad80 . The first suspicious activity from the threat actor involved the use of the gpresult command to dump the policy settings enforced on the computer for a specified user .


However , the persistent presence of Italian language both on the Google Play Store pages as well as inside the spyware code was a clear sign that an Italian actor was behind the creation of this platform . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . When the victims open the document , they are encouraged to click on Enable Content , which causes the embedded malicious macro E-TOOL code to run . It is accessed using a path confusion exploit , CVE-2022 - 41040 , allowing the attacker to reach the backend for arbitrary URLs .


Initially some particular words from the decompiled classes.dex of Exodus Two sent us in the right direction . Proofpoint is tracking this attacker , believed to operate out of China , as TA459 . The macro code embedded in the document is rather simple and is not obfuscated . Many of the individuals work at organizations related to financial services , cryptocurrency , blockchain , web3 and related entities .


" Mundizza '' is a dialectal word , a derivative of the proper Italian word " immondizia '' that translates to " trash '' or " garbage '' in English . This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . In fact , it is almost unusual in its unsophistication . Regardless of the cause , these leaks are having a significant effect on the threat landscape , making it easier for novice or unskilled actors to develop their own ransomware variants without much effort or knowledge .


Interestingly , " mundizza '' is typical of Calabria , a region in the south of Italy , and more specifically it appears to be language native of the city of Catanzaro . TA549 possesses a diverse malware arsenal including PlugX , NetTraveler , and ZeroT . The macro code does the following : COSMICENERGY Possibly Associated With Russian Government - Funded Power Disruption and Emergency Response Exercises During our analysis of COSMICENERGY , we identified a comment in the code that indicated the sample uses a module associated with a project named “ Solar Polygon ” ( Figure 2 ) .


Additionally , some copies of Exodus One use the following XOR key : Rino Gattuso is a famous retired Italian footballer , originally from Calabria . TA459 is well-known for targeting organizations in Russia and neighboring countries . Downloads a Base64 encoded payload from the following URL : Apropos of my retrospective report , Bullock found that a great many messages in Biderman ’s inbox were belligerent and anti - Semitic screeds from a former Ashley Madison employee named William Brewster Harrison .


While not too seriously , these elements made us restrict our research into surveillance companies from the region . Ongoing activity from attack groups like TA459 who consistently target individuals specializing in particular areas of research and expertise further complicate an already difficult security situation for organizations dealing with more traditional malware threats , phishing campaigns , and socially engineered threats every day . http://linda-callaghan.icu/Minkowski/brown . Check the memory size with to check if it is less than 2 GB .


Overlapping Infrastructure with eSurv Surveillance Cameras The Command & Control domain configured in several of the malicious applications found on Google Play Store , ws.my-local-weather [ . Using data collected from the Trend Micro™ Smart Protection Network , we are able to identify victims whose networks communicated with Taidoor C&C servers . Writes the decoded payload to C:\ProgramData\IntegratedOffice.txt . Another wave of suspected Dukes attacks was identified in November 2018 by FireEye , this time again relying on Windows LNK files and deploying Cobalt Strike .


] com , points to the IP address 54.69.156.31 which serves a self-signed TLS certificate with the certificate common name MyCert and fingerprint 11:41:45:2F : A7:07:23:54 : AE:9A : CE : F4 : FE:56 : AE : AC : B1 : C2:15:9F:6A : FC:1E : CC:7D : F8:61 : E3:25:26:73:6A . The Taidoor attackers have been actively engaging in targeted attacks since at least March 4 , 2009 . Decodes the Base64 payload and writes the file to C:\ProgramData\IntegratedOffice.exe . First , the discovery of new OT malware presents an immediate threat to affected organizations , since these discoveries are rare and because the malware principally takes advantage of insecure by design features of OT environments that are unlikely to be remedied any time soon .


A search for this certificate fingerprint on the Internet scanning service Censys returns 8 additional servers : IP address 34.208.71.9 34.212.92.0 34.216.43.114 52.34.144.229 54.69.156.31 54.71.249.137 54.189.5.198 78.5.0.195 207.180.245.74 Opening the Command & Control web page in a browser presents a Basic Authentication prompt : Closing this prompt causes the server to send a " 401 Unauthorized Response '' with an " Access Denied '' message in Italian Taidoor spoofed Taiwanese government email addresses to send out socially engineered emails in the Chinese language that typically leveraged Taiwan-themed issues . Runs the executable file and deletes the .txt file . “ Who or what is asdfdfsda@asdf.com ? , ” Biderman asked , after being sent a list of nine email addresses .


. Despite some exceptions , the Taidoor campaign often used Taiwanese IP addresses as C&C servers and email addresses to send out socially engineered emails with malware as attachments . Pierogi , the backdoor in this attack , appears to be a new backdoor written in Delphi . The new exploit method bypasses URL rewrite mitigations for the endpoint provided by Microsoft in response to •


All of the other IP address we discovered sharing the same TLS certificate behave in the same way . One of the primary targets of the Taidoor campaign appeared to be the Taiwanese government . It enables the attackers to spy on victims using rather basic backdoor capabilities . Kaspersky ’s Global Research and Analysis Team ( GReAT ) has observed signs of its attacks in several countries including Germany , South Korea and Uzbekistan , as well as the US .


The Command & Control server also displays a favicon image which looks like a small orange ball . Suckfly targeted one of India 's largest e-commerce companies , a major Indian shipping company , one of India 's largest financial organizations , and an IT firm that provides support for India 's largest stock exchange . While it is unknown at this point whether the backdoor was coded by the same members of the group behind the attacks , there are indications that suggest that the malware was authored by Ukranian-speaking malware developers . The network sees a high number of data access and transfer requests by the same user , who may be authorized , but does not regularly work with the targeted data assets and network resources .


At the time of writing , a reverse image search for the favicon on Shodan using the query http.favicon.hash:990643579 returned around 40 web servers which use the same favicon . Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 . The commands used to communicate with the C2 servers and other strings in the binary are written in Ukrainian . Analyzing the code and data from the C2 , Ryan Sherstobitoff and Asheer Malhotra from McAfee , along with the company 's Advanced Threat Research Team ( ATR ) , discovered new variants of the Rising Sun backdoor that were used since at least 2016 .


Many of these servers are control panels for video surveillance systems developed by the Italian company eSurv , based in Catanzaro , in Calabria , Italy . Taidoor actively sent out malicious documents and maintained several IP addresses for command and control . This is why we chose to name the malware Pierogi , after the popular East European dish . Talos discovered multiple vulnerabilities in Foxit PDF Reader that could allow an adversary to execute , arbitrary code on the targeted machine .


Their publicly advertised products include CCTV management systems , surveillance drones , face and license plate recognition systems . The attackers actively sent out malicious documents and maintained several IP addresses for command and control . The backdoor has the following capabilities : Organizations can have hundreds , thousands or more of unremediated vulnerabilities that could open the door for an attacker .


eSurv 's logo is identical to the Command & Control server favicon . As part of their social engineering ploy , the Taidoor attackers attach a decoy document to their emails that , when opened , displays the contents of a legitimate document but executes a malicious payload in the background . Collects information about the infected machine . Cisco Secure Firewall ( formerly Next - Generation Firewall and Firepower NGFW ) appliances such as Threat Defense Virtual , Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat .


Older samples connecting to eSurv Finally , Google shared with us some older samples of Exodus One ( with hashes 2055584625d24687bd027a63bc0b8faa7d1a854a535de74afba24840a52b1d2f and a37f5d2418c5f2f64d06ba28fe62edee1293a56158ddfa9f04020e316054363f ) which are not obfuscated and use the following disguise : The configuration of these older samples Sometimes , however , certain samples made use of domain names for HTTP communication . Uploads files to the attackers ’ server . cmd /c " D:\pack


is very similar to newer ones , but it provides additional insights being not obfuscated : Firstly we can notice that , instead of generic domain names or IP addresses , these samples communicated with a Command & Control server located at attiva.exodus.esurv [ . Based on the command capabilities of the Taidoor malware , we were able to determine that data theft and data destruction was possible . Downloads additional payloads . Limited forensic evidence existed to determine exactly how STRATOFEAR was deployed to systems in the victim environment ; however , in each instance , STRATOFEAR was preceded by the deployment of FULLHOUSE.DOORED .


] it ( " attiva '' is the Italian for " activate '' ) . The ultimate objective of targeted attacks is to acquire sensitive data . Takes screenshots from the infected machine . RDP is designed to allow legitimate users to remotely connect to and control a system , such as when IT support needs to remotely control an employees computer to troubleshoot an issue or conduct regular maintenance .


( We named the spyware " Exodus '' after this Command & Control domain name . In December 2017 , FireEye publicly released our first analysis on the TRITON attack where malicious actors used the TRITON custom attack framework to manipulate industrial safety systems at a critical infrastructure facility and inadvertently caused a process shutdown . Executes arbitrary commands via the CMD shell . Rather than limiting security to searching for a series of stringent profiles , security teams can attempt to analyze threat indicators in real time .


) Following is the snippet of code in these older Exodus One samples showing the connection to the Command & Control : Below is the almost identical composition of the request to the Command & Control server in mike.jar ( also containing the path 7e661733-e332-429a-a7e2-23649f27690f ) : To further corroborate the connection of the Exodus spyware with eSurv , the domain attiva.exodus.esurv.it resolves to the IP 212.47.242.236 which , according to In our most recent analysis , we attributed the intrusion activity that led to the deployment of TRITON to a Russian government-owned technical research institute in Moscow . In addition to spy features , the backdoor also implements a few checks to ensure it is running in a safe environment . The new documentary , The Ashley Madison Affair , begins airing today on Hulu in the United States and on Disney+ in the United Kingdom .


public passive DNS data , in 2017 was used to host the domain server1cs.exodus.connexxa.it . For more in-depth analysis of TRITON and other cyber threats , consider subscribing to FireEye Cyber Threat Intelligence . Specifically , it looks for antivirus and other security products . Attribution to the Dukes was made partly on the LNK file structure and other TTPs , including the targets of the attack .


Connexxa was a company also from Catanzaro . During this time , the attacker must ensure continued access to the target environment or risk losing years of effort and potentially expensive custom ICS malware . The backdoor queries Windows for installed antivirus software using WMI : SELECT * FROM AntiVirusProduct It looks for specific antivirus and security products installed on the infected machine , such as Kaspersky , eScan , F-secure and Bitdefender . Who is The Chaos Creator , and what else transpired between Harrison and Ashley Madison prior to his death ?


According to publicly available information , the founder of Connexxa seems to also be the CEO of eSurv . In this report we continue our research of the actor 's operations with a specific focus on a selection of custom information technology ( IT ) tools and tactics the threat actor leveraged during the early stages of the targeted attack lifecycle . The backdoor achieves persistence using a classic startup item autorun technique : Mandiant has also observed the deployment of various remote monitoring and management ( RMM ) tools following the successful exploitation of CVE-2023 - 4966 .


Interestingly , we found other DNS records mostly from 2017 that follow a similar pattern and appear to contain two-letters codes for districts in Italy : Server City server1bo.exodus.connexxa [ . Additionally , the actor possibly gained a foothold on other target networks—beyond the two intrusions discussed in this post – using similar strategies . A shortcut is added to the the startup folder : C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup . Indicators of compromise IOCs are pieces of forensic data , such as data found in system log entries or files , that identify potentially malicious activity on a system or network .


] it Bologna server1bs.exodus.connexxa [ . There is often a singular focus from the security community on ICS malware largely due to its novel nature and the fact that there are very few examples found in the wild . Once the user logs on to the infected machine , the shortcut points to the file binary location in the C:\ProgramData\ folder . CrowdStrike Falcon will detect the OWASSRF exploit method described in this blog , and will block the method if the prevention setting for • None Monitor Exchange servers for signs of exploitation visible in IIS and Remote PowerShell logs using this script developed by CrowdStrike Services • None Consider application - level controls such as web application firewalls .


] it Brescia server1cs.exodus.connexxa [ . ЦНИИХМ ) , a Russian government-owned technical research institution located in Moscow . The GUID generated by the malware is saved in a file called GUID.bin . If the main function is called with only , it will only perform its cleanup routine and immediately terminate .


] it Cosenza server1ct.exodus.connexxa [ . In this blog post we provide additional information linking TEMP.Veles and their activity surrounding the TRITON intrusion to a Russian government-owned research institute . This file is created in the same folder as the binary of the backdoor To learn more about how ThreatConnect can help you prepare for the potential of a ransomware attack , check out the ThreatConnect Platform .


] it Catania server1fermo.exodus.connexxa [ . Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates . ( C:\ProgramData\GUID.bin ) . They are specifically engaged in cyber crime to further their nations own interests .


] it server1fi.exodus.connexxa [ . TEMP.Veles' lateral movement activities used a publicly-available PowerShell-based tool , WMImplant . The backdoor has rather basic C2 functionality implemented through a predefined set of URLs : Who is the Winnti group ?


] it Firenze server1gioiat.exodus.connexxa [ . On multiple dates in 2017 , TEMP.Veles struggled to execute this utility on multiple victim systems , potentially due to AV detection . 1 . A typical log entry showing access to the PowerShell backend is detailed in the Remote PowerShell HTTP logs , located in , such as in the example below : CrowdStrike incident responders discovered Remote PowerShell logs similar to log entries for ProxyNotShell exploitation to gain initial access , suggesting the attacker leveraged Remote PowerShell .


] it server1na.exodus.connexxa [ . Custom payloads utilized by TEMP.Veles in investigations conducted by Mandiant are typically weaponized versions of legitimate open-source software , retrofitted with code used for command and control . Sending machine information and a heartbeat to the C2 : The group has since earned infamy for being involved in malicious activities associated with targeted attacks , such as deploying spear - phishing campaigns and building a backdoor .


] it Napoli server1rc.exodus.connexxa [ . We identified file creation times for numerous files that TEMP.Veles created during lateral movement on a target 's network . URL : http://nicoledotson.icu/debby/weatherford/Yortysnr The information sent to the C2 includes : One of the most common techniques used by Cuba actors exploited known vulnerabilities .


] it Reggio Calabria server2ct.exodus.connexxa [ . Adversary behavioral artifacts further suggest the TEMP.Veles operators are based in Moscow , lending some further support to the scenario that CNIIHM , a Russian research organization in Moscow , has been involved in TEMP.Veles activity . cname : Combating malware , ransomware , and malicious cyber attacks has always relied on information sharing , exposure of actors TTPs and the dissemination of reliable threat intelligence so that security professionals can quickly develop mitigations , remediations , and update their defenses to block future attacks .


] it Catania server2cz.exodus.connexxa [ . XENOTIME is easily the most dangerous threat activity publicly known . computer name , username , and GUID . av : Name of detected antivirus . osversion : version of the operating system . aname : the location of the malware on the infected machine . Initially , the group claimed DDoS attacks against entities located in Western countries , seemingly prioritizing Sweden , the Netherlands , and Denmark .


] it Catanzaro server2fi.exodus.connexxa [ . CNIIHM 's characteristics are consistent with what we might expect of an organization responsible for TEMP.Veles activity . Requesting commands from the C2 server : They have used phishing emails containing inline links to malicious URLs hosting DOUBLEDRAG malware , a highly obfuscated Javascript downloader .


] it Firenze server2mi.exodus.connexxa [ . Dragos identified several compromises of ICS vendors and manufacturers in 2018 by activity associated with XENOTIME , providing potential supply chain threat opportunities and vendor-enabled access to asset owner and operator ICS networks . URL : http://nicoledotson.icu/debby/weatherford/Ekspertyza . Once they successfully breached a network , MuddyWater attempted to steal credentials and move laterally .


] it Milano server2rc.exodus.connexxa [ . XENOTIME rose to prominence in December 2017 when Dragos and FireEye jointly published details of TRISIS destructive malware targeting Schneider Electric 's Triconex safety instrumented system . Ekspertyza means expertise or examination in Ukranian . Based on evidence of lateral movement , the attacker potentially had access to the SCADA system for up to three months .


] it Reggio Calabria server3bo.exodus.connexxa [ . Targeting a safety system indicates significant damage and loss of human life were either intentional or acceptable goals of the attack , a consequence not seen in previous disruptive attacks such as the 2016 CRASHOVERRIDE malware that caused a power loss in Ukraine . There are 3 basic commands coming from the server in the form of MD5 hashes : Masquerading the attacks as ransomware provides the threat actors with plausible deniability , which allows the nationstate to send a message without taking direct blame .


] it Bologna server3ct.exodus.connexxa [ . XENOTIME used credential capture and replay to move between networks , Windows commands , standard command-line tools such as PSExec , and proprietary tools for operations on victim hosts . Dfff0a7fa1a55c8c1a4966c19f6da452 : cmd . 51a7a76a7dd5d9e4651fe3d4c74d16d6 : downloadfile . 62c92ba585f74ecdbef4c4498a438984 : screenshot . First , the discovery of new OT malware presents an immediate threat to affected organizations , since these discoveries are rare and because the malware principally takes advantage of insecure by design features of OT environments that are unlikely to be remedied any time soon .


] it Catania server3.exodus.connexxa [ . XENOTIME configured TRISIS based on the specifics and functions of the Triconex system within the industrial control ( ICS ) environment . Uploading data ( mainly screenshots ) to the C2 : The leaked tooling included a Python script , , that when executed led CrowdStrike researchers to replicate the logs generated in recent Play ransomware attacks .


] it server3fi.exodus.connexxa [ . Dragos' data indicates XENOTIME remains active . URL : http://nicoledotson.icu/debby/weatherford/Zavantazhyty . Sandworm ’s substation attack reveals notable insights into Russia ’s continued investment in OT - oriented offensive cyber capabilities and overall approach to attacking OT systems .


] it Firenze server4fi.exodus.connexxa [ . TEMP.Veles created a custom malware framework and tailormade credential gathering tools , but an apparent misconfiguration prevented the attack from executing properly . Zavantazhyty means to load or download in Ukranian . For Snort coverage that can detect the exploitation of these vulnerabilities , download the latest rule sets from Snort.org , and our latest Vulnerability Advisories are always posted on Talos Intelligence ’s website .


] it Firenze serverrt.exodus.connexxa [ . Furthermore , Dragos' analysis of the TRISIS event continues as we recover additional data surrounding the incident . This command is used to upload collected data to the C2 server . By creating awareness and using the right solutions , both individuals and organizations can take the steps needed to defend against the malicious tactics used by threat actors like the Winnti group .


] it Public Resume Confirms Development of Android Agent Additionally , an employee of eSurv quite precisely described their work in developing an " agent to gather data from Android devices and send it to a C & C server '' as well as researching " vulnerabilities in mobile devices ( mainly Android ) '' in a publicly available resume . XENOTIME operates globally , impacting regions far outside of the Middle East , their initial target . For example , in some instances the backdoor uploads screenshots taken from an infected machine , as can be seen in the example below . RA Group , in its ongoing campaigns , has targeted the U.S. , South Korea , Taiwan , the U.K. and India across several business verticals , including manufacturing , wealth management , insurance providers , pharmaceuticals and financial management consulting companies .


Further details in it reflect characteristics of Exodus ( such as the bypass of power managers we described from Exodus One , and more ) : Indicators of Compromise Exodus One 011b6bcebd543d4eb227e840f04e188fb01f2335b0b81684b60e6b45388d3820 0f5f1409b1ebbee4aa837d20479732e11399d37f05b47b5359dc53a4001314e5 2055584625d24687bd027a63bc0b8faa7d1a854a535de74afba24840a52b1d2f Intelligence suggests the group has been active since at least 2014 and is presently operating in multiple facilities targeting safety systems beyond Triconex . Removing information : Through it all , our 2023 State of Ransomware equips your organization with the knowledge to counter the hidden mechanics of global ransomware .


26fef238028ee4b5b8da631c77bfb44ada3d5db8129c45dea5df6a51c9ea5f55 33a9da16d096426c82f150e39fc4f9172677885cfeaedcff10c86414e88be802 34d000ee1e36efd10eb37e2b79d69249d5a85682a61390a89a1b9391c46bf2ba 4f6146956b50ae3a6e80a1c1f771dba848ba677064eb0e166df5804ac2766898 Dragos instead focuses on threat behaviors and appropriate detection and response . URL : http://nicoledotso.icu/debby/weatherford/Vydalyty . They can target a single company , maybe with the intention of stealing trade secrets or discrediting that company .


5db49122d866967295874ab2c1ce23a7cde50212ff044bbea1da9b49bb9bc149 70e2eea5609c6954c61f2e5e0a3aea832d0643df93d18d7d78b6f9444dcceef0 80810a8ec9624f317f832ac2e212dba033212258285344661e5da11b0d9f0b62 8453ce501fee1ca8a321f16b09969c517f92a24b058ac5b54549eabd58bf1884 Dragos assesses with moderate confidence that XENOTIME intends to establish required access and capability to cause a potential , future disruptive—or even destructive—event . Vydalyty means to remove or delete in Ukrainian . • None consisting of CVE-2022 - 41080 and CVE-2022 - 41082 to achieve remote code execution ( RCE ) through Outlook Web Access ( OWA ) .


a37f5d2418c5f2f64d06ba28fe62edee1293a56158ddfa9f04020e316054363f db59407f72666526fca23d31e3b4c5df86f25eff178e17221219216c6975c63f e0acbb0d7e55fb67e550a6bf5cf5c499a9960eaf5f037b785f9004585202593b Exodus One Package Names com.phonecarrier.linecheck However , full details on XENOTIME and other group tools , techniques , procedures , and infrastructure is available to network defenders via Dragos WorldView . The malware can delete various requests based on the command below . Cisco Secure Web Appliance ( formerly Web Security Appliance ) automatically blocks potentially dangerous sites and tests suspicious sites before users access them .


rm.rf operatore.italia it.offertetelefonicheperte it.servizipremium assistenza.sim assistenza.linea.riattiva assistenza.linea it.promofferte Exodus Two 64c11fdb317d6b7c9930e639f55863df592f23f3c7c861ddd97048891a90c64b a42a05bf9b412cd84ea92b166d790e8e72f1d01764f93b05ace62237fbabe40e Exodus Two This seems confusing as FireEye earlier publicly declared the TRITON as a discrete entity , linked to a Russian research institution , and christened it as " TEMP.Veles " . The records of the domains and IPs involved in this campaign seem to show that the attackers created a new infrastructure specifically for this campaign . Reconstruction of the host ’s anti - virus logs indicates “ lun.vbs ” and “ n.bat ” were executed in close time proximity .


ELF Utilities 00c787c0c0bc26caf623e66373a5aaa1b913b9caee1f34580bdfdd21954b7cc4 11499ff2418f4523344de81a447f6786fdba4982057d4114f64db929990b4b59 13ec6cec511297ac3137cf7d6e4a7c4f5dd2b24478a06262a44f13a3d61070b6 3c9f08b3280851f54414dfa5a57f40d3b7be7b73736fa0ba21b078e75ce54d33 This seems confusing as FireEye earlier publicly declared the " TRITON actor " as a discrete entity , linked to a Russian research institution , and christened it as " TEMP.Veles " . The domains were registered in November 2019 and operationalized shortly after . To prevent ProxyNotShell exploitation on older Microsoft Exchange servers , Microsoft released a blog4 advocating for a custom inside the Microsoft IIS server supporting Exchange .


3ee3a973c62ba5bd9eab595a7c94b7a26827c5fa5b21964d511ab58903929ec5 47449a612697ad99a6fbd6e02a84e957557371151f2b034a411ebb10496648c8 48a7dd672931e408662d2b5e1abcd6ef00097b8ffe3814f0d2799dd6fd74bd88 824ad333320cbb7873dc49e61c14f749b0e0d88723635524463f2e6f56ea133a Meanwhile , parallel work at Dragos ( my employer , where I have performed significant work on the activity described above ) uncovered similar conclusions concerning TTPs and behaviors , for both the 2017 event and subsequent activity in other industrial sectors . In part two of this research , we examined the Pierogi B-ACT S-MAL campaign . The Loader usage is to perform a lot of Antidebug , AntiVM and Antiemulation checks to make it harder for automated analysis and inject the core module .


b46f282f9a1bce3798faee3212e28924730a657eb93cda3824c449868b6ee2e7 c228a534535b22a316a97908595a2d793d0fecabadc32846c6d1bfb08ca9a658 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 e3f65f84dd6c2c3a5a653a3788d78920c0321526062a6b53daaf23fa57778a5f FireEye recently published a blog covering the tactics , techniques , and procedures ( TTPs ) for the " TRITON actor " when preparing to deploy the TRITON/TRISIS malware framework in 2017 . Cybereason suspects this These ransom demands are significantly lower than those made by many well - known ransomware gangs like RYUK , Babuk , REvil , Conti , DarkSide , BlackMatter , BlackCat , and Yanluowang , which are typically in the millions of dollars .


Command & Controls ad1.fbsba [ . Based on information gained from discussion with the initial TRITON/TRISIS responders and subsequent work on follow-on activity by this entity , Dragos developed a comprehensive ( public ) picture of adversary activity roughly matching FireEye 's analysis published in April 2019 , described in various media . campaign targets Palestinian individuals and entities in the Middle East , specifically directed at We searched for the unique string and identified a single match to a cyber range ( aka polygon ) developed by Rostelecom - Solar , a Russian cyber security company that received a government in 2019 to begin training cyber security experts and conducting electric power disruption and emergency response exercises .


] com ws.my-local-weather [ . Since late 2018 , based upon the most-recent posting , FireEye appears to have " walked back " the previously-used terminology of TEMP.Veles and instead refers rather cryptically to the " TRITON actor " , while Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME . those in the Palestinian government . If an adversary can send an unauthorized command message to a control system , then it can instruct the control systems device to perform an action outside the normal bounds of the device 's actions .


] com 54.71.249 [ . Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME . The threat actors behind the campaign use social engineering to infect their victims with the Pierogi backdoor for cyber espionage purposes . Two days following the OT activity , Sandworm deployed a new variant of CADDYWIPER throughout the IT environment .


] 137 54.69.156 [ . Aside from the competitive vendor naming landscape ( which I am not a fan of in cases on direct overlap , but which has more to say for itself when different methodologies are employed around similar observations ) , the distinction between FireEye and Dragos' approaches with respect to the " TRITON actor " comes down to fundamental philosophical differences in methodology . The threat actor behind the attack invested considerable time and effort to lure their victims with specially-crafted documents that target Palestinian individuals and entities in the Middle East . None Enablement and usage of SQL extended stored procedures for Windows shell command execution : PIEHOP ( filename : r3_iec104_control.exe ) ( MD5 : cd8f394652db3d0376ba24a990403d20 ) is a disruption tool written in Python and packaged with PyInstaller version 2.1 + that has the capability to connect to a user supplied remote MSSQL server for uploading files and issuing remote commands to a RTU .


] 31 162.243.172 [ . In the 2018 public posting announcing TEMP.Veles , FireEye researchers noted that the institute in question at least supported TEMP.Veles activity in deploying TRITON . In our analysis , we reviewed the TTPs and the decoy content , and pointed out the similarities between previous attacks that have been attributed to MoleRATs , an Arabic-speaking , politically motivated group that has operated The email address admin@93[.]gd is linked to IP addresses owned by a certain user with the nickname “ PIG GOD”—another


] 208 attiva.exodus.esurv [ . My understanding is FireEye labels entities where definitive attribution is not yet possible with the " TEMP " moniker ( hence , TEMP.Veles ) – yet in this case FireEye developed and deployed the label , then appeared to move away from it in subsequent reporting . in the Middle East since 2012 . But on Mar. 5 , 2014 , Harrison committed suicide by shooting himself in the head with a handgun .


] it The rise of mobile banker Asacub 28 AUG 2018 We encountered the Trojan-Banker.AndroidOS.Asacub family for the first time in 2015 , when the first versions of the malware were detected , analyzed , and found to be more adept at spying than stealing funds . In comparison , XENOTIME was defined based on principles of infrastructure ( compromised third-party infrastructure and various networks associated with several Russian research institutions ) , capabilities ( publicly- and commercially-available tools with varying levels of customization ) and targeting ( an issue not meant for discussion in this blog ) . The Pierogi backdoor discovered by Cybereason during this investigation seems to be undocumented and gives the threat actors espionage capabilities over their victims . Indicators of Compromise vs. Indicators of Attack


The Trojan has evolved since then , aided by a large-scale distribution campaign by its creators ( in spring-summer 2017 ) , helping Asacub to claim top spots in last year ’ s ranking by number of attacks among mobile banking Trojans , outperforming other families such as Svpeng and Faketoken . Of note , this methodology of naming abstracts away the " who " element – XENOTIME may represent a single discrete entity ( such as a Russian research institution ) or several entities working in coordination in a roughly repeatable , similar manner across multiple events . Based on the Ukranian language embedded in the backdoor , Cybereason raises the possibility that the backdoor was obtained in underground communities by the threat actors , rather than developed in-house by the group . The trojan acted like a legitimate application or file in order to trick users into running it .


We decided to take a peek under the hood of a modern member of the Asacub family . Much like the observers watching the shadows of objects cast upon the wall of the cave , these two definitions ( XENOTIME and TEMP.Veles , both presumably referring to " the TRITON actor " ) describe the same phenomena , yet at the same time appear different . Outlaw Updates Kit to Kill Older Miner Versions , Targets More Systems . PIEHOP utilizes LIGHTWORK to execute the IEC-104 commands " ON ” or " OFF " on the remote system and immediately deletes the executable after issuing the commands .


Our eyes fell on the latest version of the Trojan , which is designed to steal money from owners of Android devices connected to the mobile banking service of one of Russia ’ s largest banks . To better understand how the adversary was operating and what other actions they had performed , CTU researchers examined cmd.exe and its supporting processes to uncover additional command line artifacts . As we ’ve observed with cybercriminal groups that aim to maximize profits for every campaign , silence does n’t necessarily mean inactivity . None LIGHTWORK is a disruption tool written in C++ that implements the IEC-104 protocol to modify the state of RTUs over TCP .


Asacub versions Sewn into the body of the Trojan is the version number , consisting of two or three digits separated by periods . CTU researchers assess with high confidence that threat groups like Threat Group-1314 will continue to live off of the land to avoid detection and conduct their operations . It appears hacking group Outlaw , which has been silent for the past few months , was simply developing their toolkit for illicit income sources . Threat actors often compete for the same resources , and this could n't be further from the truth when it comes to website compromises .


The numbering seems to have started anew after the version 9 . Analysis of TG-3390 's operations , targeting , and tools led CTU researchers to assess with moderate confidence the group is located in the People's Republic of China . While they have been quiet since our June analysis , we observed an increase in the group ’s activities in December , with updates on the kits ’ capabilities reminiscent of their previous attacks . They claim to have compromised the company and are willing to help resolve the issue .


The name Asacub appeared with version 4 in late 2015 ; previous versions were known as Trojan-SMS.AndroidOS.Smaps . The threat actors target a wide range of organizations : CTU researchers have observed TG-3390 actors obtaining confidential data on defense manufacturing projects , but also targeting other industry verticals and attacking organizations involved in international relations . The updates expanded scanner parameters and targets , looped execution of files via error messages , improved evasion techniques for scanning activities , and improved mining profits by killing off both the competition and their own previous miners . The use of zero - day vulnerabilities by ransomware groups like CL0P may trigger a significant shift in ransomware strategies , mirroring the adoption of the " double extortion " tactic in 2019 .


Versions 5.X.X-8.X.X were active in 2016 , and versions 9.X.X-1.X.X in 2017 . In comparison to other threat groups , TG-3390 is notable for its tendency to compromise Microsoft Exchange servers using a custom backdoor and credential logger . We analyzed the kits , which were designed to steal information from the automotive and finance industries , launch subsequent attacks on already compromised systems , and ( possibly ) sell stolen information . In some campaigns , the random names are generated by a specific function in the VBA code .


In 2018 , the most actively distributed versions were 5.0.0 and 5.0.3 . CTU researchers have evidence that the TG-3390 compromised U.S and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations . Comparing this development to their previous attacks , we think Outlaw may be aiming to go after enterprises that have yet to update their systems , assessing security and changes with their previously infected hosts , finding new and old targets , and possibly testing their updates in the wild . None Read about adversaries tracked by CrowdStrike in 2021 in the and in the • None Learn more about how can help your organization prepare to defend against sophisticated threats , respond and recover from incidents with speed and precision , and fortify your cybersecurity practices .


Communication with C & C Although Asacub ’ s capabilities gradually evolved , its network behavior and method of communication with the command-and-control ( C & C ) server changed little . Based on analysis of the group 's SWCs , TG-3390 operations likely affect organizations in other countries and verticals . We will continue to observe the group ’s activities as they target industries from the United States and Europe . The purpose of these socially engineered lures is to convince the targeted users to enable macros , thereby allowing the execution chain to commence .


This strongly suggested that the banking Trojans , despite differing in terms of capability , belong to the same family . TG-3390 operates a broad and long-running campaign of SWCs and has compromised approximately 100 websites as of this publication . Based on the samples we collected and traced to 456 distinct IPs , we expect the group to be more active in the coming months as we observed changes on the versions we acquired . PIEHOP utilizes LIGHTWORK to issue the IEC-104 commands " ON " or " OFF " to the remote system and then immediately deletes the executable after issuing the command .


Data was always sent to the C & C server via HTTP in the body of a POST request in encrypted form to the relative address /something/index.php . CTU researchers have evidence that the threat group compromised U.S and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations . These new samples targeted Linux- and Unix-based operating systems , vulnerable servers , and internet of things ( IoT ) devices by exploiting known vulnerabilities with available exploits . The customers of these commercial spyware organizations know who their victim(s ) are .


In earlier versions , the something part of the relative path was a partially intelligible , yet random mix of words and short combinations of letters and numbers separated by an underscore , for example , “ bee_bomb ” or “ my_te2_mms ” . Like many threat groups , TG-3390 conducts strategic web compromises ( SWCs ) , also known as watering hole attacks , on websites associated with the target organization 's vertical or demographic to increase the likelihood of finding victims with relevant information . This time , the group explored unpatched systems vulnerable to CVE-2016-8655 and Dirty COW exploit ( CVE-2016-5195 ) as attack vectors . According to the Education Data Initiative , " Public education spending in the United States falls short of global benchmarks and lags behind economic growth . "


Example of traffic from an early version of Asacub ( 2015 ) The data transmitted and received is encrypted with the RC4 algorithm and encoded using the base64 standard . Through an IP address whitelisting process , the threat group selectively targets visitors to these websites . Files using simple PHP-based web shells were also used to attack systems with weak SSH and Telnet credentials . CrowdStrike researchers replicated the exploit method attack on Exchange systems that had not received the November 8 , 2022 patch KB5019758 , but could not replicate the attack on systems that had received that patch .


The C & C address and the encryption key ( one for different modifications in versions 4.x and 5.x , and distinct for different C & Cs in later versions ) are stitched into the body of the Trojan . After the initial compromise , TG-3390 delivers the HTTPBrowser backdoor to its victims . While no phishing- or social engineering-initiated routines were observed in this campaign , we found multiple attacks over the network that are considered “ loud. ” These involved large-scale scanning operations of IP ranges intentionally launched from the command and control ( C&C ) server . Cisco Talos is aware of the recent advisory published by the U.S. Department of Health and Human Services ( HHS ) warning the healthcare industry about Rhysida ransomware activity .


In early versions of Asacub , .com , .biz , .info , .in , .pw were used as top-level domains . CTU researchers assess with high confidence that TG-3390 uses information gathered from prior reconnaissance activities to selectively compromise users who visit websites under its control . The honeynet graphs , which show activity peaks associated with specific actions , also suggest that the scans were timed . When ransomware source code or builders are leaked , it becomes easier for aspiring cybercriminals who lack the technical expertise to develop their own ransomware variants by making only minor modifications to the original code .


In the 2016 version , the value of the User-Agent header changed , as did the method of generating the relative path in the URL : now the part before /index.php is a mix of a pronounceable ( if not entirely meaningful ) word and random letters and numbers , for example , “ muromec280j9tqeyjy5sm1qy71 ” or “ parabbelumf8jgybdd6w0qa0 ” . TG-3390 uses the PlugX remote access tool . We also considered the move as an obfuscation technique , as it was mixed with a lot of script kiddie activities that can easily be mistaken for grey noise online . In its spear phish , CloudLook also used a self - extracting archive containing a PDF file that lured its victims with information regarding world terrorism .


Moreover , incoming traffic from the C & C server began to use gzip compression , and the top-level domain for all C & Cs was .com : Since December 2016 , the changes in C & C communication methods have affected only how the relative path in the URL is generated : the pronounceable word was replaced by a rather long random combination of letters and numbers , for example , “ ozvi4malen7dwdh ” or “ f29u8oi77024clufhw1u5ws62 ” . The SWC of a Uyghur cultural website suggests intent to target the Uyghur ethnic group , a Muslim minority group primarily found in the Xinjiang region of China . The attackers could hide their activities if they noted the business hours of the intended targets and performed the actions coinciding with said times . Ashley Madison ’s long - suspected army of fake female accounts came to the fore in August 2012 after the former sex worker turned activist and blogger Maggie McNeill published screenshots apparently taken from Ashley Madison ’s internal systems suggesting that a large percentage of the female accounts on the service were computer - operated bots .


At the time of writing this article , no other significant changes in Asacub ’ s network behavior had been observed : The origin of Asacub It is fairly safe to say that the Asacub family evolved from Trojan-SMS.AndroidOS.Smaps . The threat actors have used the Baidu search engine , which is only available in Chinese , to conduct reconnaissance activities . From the sample we analyzed , attacks started from one virtual private server ( VPS ) that searches for a vulnerable machine to compromise ( previous techniques used malicious URLs or infecting legitimate websites for bot propagation ) . We also want to specifically thank Google ’s Threat Analysis Group ( TAG ) , Mandiant ’s DPRK Fusion Cell , and our government partners for their continued collaboration and support .


Communication between both Trojans and their C & C servers is based on the same principle , the relative addresses to which Trojans send network requests are generated in a similar manner , and the set of possible commands that the two Trojans can perform also overlaps . Recently , CTU researchers responded to an intrusion perpetrated by Threat Group-1314 , one of numerous threat groups that employ the " living off the land " technique to conduct their intrusions . Once infected , the C&C commands for the infected system launches a loud scanning activity and spreads the botnet by sending a “ whole kit ” of binary files at once with naming conventions same as the ones already in the targeted host , likely banking on breaking through via “ security through obscurity. ” They attempted to evade traffic inspection by encoding the code for the scanner with base-64 . In April 2021 , a new campaign by OilRig was discovered by researchers at Checkpoint in which the group employed a new backdoor variant dubbed SideTwist against what appears to be a Lebanese target .


What ’ s more , the numbering of Asacub versions is a continuation of the Smaps system . CTU researchers have observed the Threat Group-3390 obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both . The zombie host initiates the scan — another routine from previous campaigns — but updated with a larger set of parameters and programmed to run in the background . Following a three - month lull of activity , Cl0p returned with a vengeance in June and beat out LockBit as the month ’s most active ransomware gang .


The main difference is that Smaps transmits data as plain text , while Asacub encrypts data with the RC4 algorithm and then encodes it into base64 format . CTU researchers have observed the threat group obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both . The kit we found is in tgz format , though we have observed some samples disguised as png or jpg . Tools for phishing analysis and remediation that save security operations teams time and help find indicators of compromise across a sea of suspicious messages can also make a big difference in the fight against ransomware .


Let ’ s compare examples of traffic from Smaps and Asacub — an initializing request to the C & C server with information about the infected device and a response from the server with a command for execution : Smaps request Asacub request Decrypted data from Asacub traffic : { “ id ” : ” 532bf15a-b784-47e5-92fa-72198a2929f5″ , ” type ” : ” get ” , ” info ” : ” imei:365548770159066 , country : PL , cell : Tele2 TG-3390 can quickly leverage compromised network infrastructure during an operation and can conduct simultaneous intrusions into multiple environments . While previous routines took advantage of competing miners ’ activities and unrelated components to hijack the profit , the latest version of the code attempts to remove all related files and codes from previous infections ( including their own to make sure the running components are updated , as well as those from other cybercriminals to maximize the resources of the zombie host ) and creates a new working directory /tmp/.X19-unix to move the kit and extract the files . After Kaspersky ’s reports of these attacks , the rest of 2013 saw reduced intensity of the campaign .


, android:4.2.2 , model : GT-N5100 , phonenumber : +486679225120 , sim:6337076348906359089f , app : null , ver:5.0.2″ } Data sent to the server [ { “ command ” : ” sent & & & ” , ” params ” : { “ to ” : ” +79262000900″ , ” body ” : ” \u0410\u0412\u0422\u041e\u041f\u041b\u0410\u0422\u0415\u0416 Malware used by the threat group can be configured to bypass network-based detection ; however , the threat actors rarely modify host-based configuration settings when deploying payloads . The tsm binary then runs in the background , forwarding a series of error messages to /dev/null to keep the code running , ensuring the continuous execution of the code referenced with a set of parameters /tmp/up.txt . Based on our research , we discovered an unknown threat actor using MortalKombat ransomware since December 2022 to target individuals and smaller companies .


1000 50″ , ” timestamp ” : ” 1452272572″ } } , { “ command ” : ” sent & & & ” , ” params ” : { “ to ” : ” +79262000900″ , ” body ” : ” BALANCE ” , ” timestamp ” : ” 1452272573″ } } ] Instructions received from the server A comparison can also be made of the format in which Asacub and Smaps forward incoming SMS ( encoded with the base64 algorithm ) from the device to the C & C server : Smaps TG-3390 uses older exploits to compromise targets , and CTU researchers have not observed the threat actors using zero-day exploits as of this publication . The script then waits 20 minutes before it runs the wrapper script initall : The CozyDuke malware utilizes a backdoor and dropper , and exfiltrates data to a C2 server .


format Asacub format Decrypted data from Asacub traffic : { “ data ” : ” 2015:10:14_02:41:15″ , ” id ” : ” 532bf15a-b784-47e5-92fa-72198a2929f5″ , ” text ” : ” SSB0aG91Z2h0IHdlIGdvdCBwYXN0IHRoaXMhISBJJ20gbm90IGh1bmdyeSBhbmQgbmU= ” , ” number ” : ” 1790″ , ” type In addition to using SWCs to target specific types of organizations , TG-3390 uses spearphishing emails to target specific victims . 2e2c9d08c7c955f6ce5e27e70b0ec78a888c276d71a72daa0ef9e3e40f019a1a install . Utilizing multiple security solutions may become even more important as the level of sophistication in malware grows .


” : ” load ” } Propagation The banking Trojan is propagated via phishing SMS containing a link and an offer to view a photo or MMS . After gaining access to a target network in one intrusion analyzed by CTU researchers , TG-3390 actors identified and exfiltrated data for specific projects run by the target organization , indicating that they successfully obtained the information they sought . Another variant executes a set of commands once a system is successfully compromised . Bullock had spent many hours poring over the hundreds of thousands of emails that the Ashley Madison hackers stole from Biderman and published online in 2015 .


The link points to a web page with a similar sentence and a button for downloading the APK file of the Trojan to the device . Based on this information , CTU researchers assess that TG-3390 aims to collect defense technology and capability intelligence , other industrial intelligence , and political intelligence from governments and NGOs . Most of these commands are related to gathering information from the infected machine ( number of CPU cores , users , scheduled tasks , running processes , OS installed , and CPU and memory information ) via the dota3 payload , as well as changing the password to a random string also stored in /tmp/up.txt . Recently , concerns have grown regarding the rapid growth of commercial spyware tools , and the way in which they are being used against their intended victims .


The Trojan download window Asacub masquerades under the guise of an MMS app or a client of a popular free ads service . Incident response engagements have given CTU researchers insight into the tactics TG-3390 employs during intrusions . In a previous execution ( published in June 2019 ) , we observed that dota2 had its own folder but it was hardly executed , indicating that this version is the updated iteration . A rough translation of this message is as follows : Hack520 seems to be very interested in hosting services and his profile fits that of a system administrator profile with some programming and hacking skills .


We came across the names Photo , Message , Avito Offer , and MMS Message . CTU researchers have not observed TG-3390 actors performing reconnaissance prior to compromising organizations . Running the script removes the remaining files and scripts from previous attacks , keeping a low profile to evade detection . “ It appears to be the email address Will used for his profiles , ” the IT director replied .


App icons under which Asacub masks itself The APK files of the Trojan are downloaded from sites such as mmsprivate [ . CTU researchers have observed the threat actors installing a credential logger and backdoor on Microsoft Exchange servers , which requires a technical grasp of Internet Information Services ( IIS ) . If the system has been previously infected with a cryptominer , it also attempts to kill the running miner and all its related activities . Rhysida , a new ransomware gang claiming to be a " cybersecurity team , " has been in operation since May 17 , 2023 , making headlines for their high - profile attack against the Chilean Army .


] site , photolike [ . TG-3390 is capable of using a C2 infrastructure that spans multiple networks and registrars . Based on a bashtemp directory of the latest sample we found , there are other compiled ELF scripts , named init and init2 , that loops the kit to keep running : However , a log file on the server indicates that the C2 framework has been active since at least September 2017 , and probably " hosted on different servers over time . "


] fun , you-foto [ . TG-3390 SWCs may be largely geographically independent , but the group 's most frequently used C2 registrars and IP net blocks are located in the U.S . 0c458dfe0a2a01ab300c857fdc3373b75fbb8ccfa23d16eff0d6ab888a1a28f6 The utility is located in the “ \sc\prog\exec ” folder within the MicroSCADA installation directory , amongst other utilities , libraries , and resources used by MicroSCADA .


] site , and mms4you [ . Using a U.S.-based C2 infrastructure ( see Figure 7 ) to compromise targets in the U.S. helps TG-3390 actors avoid geo-blocking and geo-flagging measures used in network defense . S-SHA2init . 93ce211a71867017723cd78969aa4cac9d21c3d8f72c96ee3e1b2712c0eea494 For example , in its 2020 Internet Crime Report released in March , the FBI confirmed the total cost of attacks reported to the bureau in 2020 amounted to 29.1 million , an increase of more than 200 from the year before .


] me under names in the format : photo_ [ number ] _img.apk , mms_ [ number ] _img.apk avito_ [ number ] .apk , mms.img_ [ number ] _photo.apk , mms [ number ] _photo.image.apk , mms [ number ] _photo.img.apk , mms.img.photo_ [ number ] .apk , photo_ [ number ] _obmen.img.apk . The threat actors create PlugX DLL stub loaders that will run only after a specific date . S-SHA2init2 . To continue the home security analogy , if the window was nt left open , the attacker would likely have gone somewhere else , and the same principle applies in the digital world .


For the Trojan to install , the user must allow installation of apps from unknown sources in the device settings . The compile dates of the samples analyzed by CTU researchers are all later than the hard-coded August 8 , 2013 date , indicating that the code might be reused from previous tools . Both init and init2 scripts make sure all other running mining services are killed , and that all the files in the working directory are executed by giving 777 permissions . Budworm executes SysUpdate on victim networks by DLL sideloading the payload using the legitimate INISafeWebSSO application .


Infection During installation , depending on the version of the Trojan , Asacub prompts the user either for Device Administrator rights or for permission to use AccessibilityService . One archive sample analyzed by CTU researchers contained a legitimate PDF file , a benign image of interest to targets ( see Figure 8 ) , and an HTTPBrowser installer disguised as an image file . We also found the init0 script running ; the script cleans out all miners regardless of its origin . Additionally , Mandiant was able to uncover additional infrastructure due to the fact that a PTR record was never changed from a previous operation .


After receiving the rights , it sets itself as the default SMS app and disappears from the device screen . CTU researchers have observed TG-3390 activity between 04:00 and 09:00 UTC , which is 12:00 to 17:00 local time in China ( UTC +8 ) . It then resets cron and removes possible cache files from other programs , starts scripts and binaries a , init0 , and start , and sets the persistence by modifying the crontab . CrowdStrike Services recently investigated several Play ransomware intrusions where the common entry vector was suspected to be the Microsoft Exchange ProxyNotShell vulnerabilities CVE-2022 - 41040 and CVE-2022 - 41082 .