PHA authors usually try to hide their tracks , so attribution is difficult . At the end of June 2015 Mofang started its campaign to gather information of a specific target in relation to the sezs : the cpg Corporation . IRONHALO is a downloader that uses the HTTP protocol to retrieve a Base64 encoded payload from a hard-coded command-and-control ( C2 ) server and uniform resource locator ( URL ) path . Per Microsoft ’s blog , they have identified additional post - exploitation activities , including : • Compression of data for exfiltration via 7 - Zip . • Use of Exchange PowerShell Snap - ins to export mailbox data .


Sometimes , we can attribute different apps to the same author based on a small , unique pieces of evidence that suggest similarity , such as a repetition of an exceptionally rare code snippet , asset , or a particular string in the debug logs . MoneyTaker uses ' fileless ' malware only existing in RAM and is destroyed after reboot . The encoded payload is written to a temporary file , decoded and executed in a hidden window . • Use of additional offensive security tools Covenant , Nishang , and PowerCat for remote access .


Every once in a while , authors leave behind a trace that allows us to attribute not only similar apps , but also multiple different PHA families to the same group or person . To ensure persistence in the system MoneyTaker relies on PowerShell and VBS scripts - they are both difficult to detect by antivirus and easy to modify . The encoded and decoded payloads are written to files named igfxHK[%rand%].dat and igfxHK[%rand%].exe respectively , where [%rand%] is a 4-byte hexadecimal number based on the current timestamp . The activity we have observed , coupled with others in the information security industry , indicate that these threat actors are likely using Exchange Server vulnerabilities to gain a foothold into environments .


However , the actual timeline of the creation of different variants is unclear . After successfully infecting one of the computers and gaining initial access to the system , the attackers perform reconnaissance of the local network in order to gain domain administrator privileges and eventually consolidate control over the network . IRONHALO : AcroRd32Info.exe.exe a8ccb2fc5fec1b89f778d93096f8dd65 . This activity is followed quickly by additional access and persistent mechanisms .


In April 2013 , we saw the first sample , which made heavy use of dynamic code loading ( i.e. , fetching executable code from remote sources after the initial app is installed ) . MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs . IRONHALO persists by copying itself to the current user ’s Startup folder . We recommend checking the following for potential evidence of compromise : • Child processes of on Exchange Servers , particularly .


Dynamic code loading makes it impossible to state what kind of PHA it was . This newly observed activity uses a series of redirections and fileless , malicious implementations of legitimate tools to gain access to the targeted systems . This variant sends an HTTP request to a legitimate Japanese website using a malformed User-Agent string , as shown in Figure 2 . • New , unexpected compiled ASPX files in the directory • Reconnaissance , vulnerability - testing requests to the following resources from an external IP address : In our investigations to date , the web shells placed on Exchange Servers have been named differently in each intrusion , and thus the file name alone is not a high - fidelity indicator of compromise .


This sample displayed ads from various sources . Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China . The threat actors likely compromised the legitimate site and attempted to use it as a staging server for second-stage payloads . If you believe your Exchange Server was compromised , we recommend investigating to determine the scope of the attack and dwell time of the threat actor .


More recent variants blend rooting capabilities and click fraud . Since that time , MoneyTaker attacked companies in California , Utah , Oklahoma , Colorado , Illinois , Missouri , South Carolina , North Carolina , Virginia and Florida . On December 1, 2015, threat actors launched two additional spear phishing attacks exploiting the undisclosed EPS vulnerability and CVE-2015-1701 . Furthermore , as system and web server logs may have time or size limits enforced , we recommend preserving the following artifacts for forensic analysis : • At least 14 days of HTTP web logs from the directories ( include logs from all subdirectories ) •


As rooting exploits on Android become less prevalent and lucrative , PHA authors adapt their abuse or monetization strategy to focus on tactics like click fraud . In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy . Unlike the Nov. 26 campaign , these attacks targeted Taiwanese governmental and media and entertainment organizations . The contents of the Exchange Web Server ( also found within the folder ) • At least 14 days of Exchange Control Panel ( ECP ) logs , located in We have found significant hunting and analysis value in these log folders , especially for suspicious CMD parameters in the ECP Server logs .


This post does n't follow the chronological evolution of Zen , but instead covers relevant samples from least to most complex . Our analysis shows that actors attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . Moreover , the exploit dropped a different malware payload , a backdoor we refer to as ELMER . To increase investigation transparency , we are including a Last Known True , or LKT , value for network indicators .


Apps with a custom-made advertisement SDK The simplest PHA from the author 's portfolio used a specially crafted advertisement SDK to create a proxy for all ads-related network traffic . Unit 42 's analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . The first spear phishing message was sent to a Taiwanese governmental employee on Dec. 1 . FireEye detects this activity across our platforms .


By proxying all requests through a custom server , the real source of ads is opaque . Our analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan . The attachment was created using the traditional Chinese character set , and contained a flowchart that appeared to be taken from the legitimate Taiwanese government auction website http://shwoo.gov.taipei/buyer_flowchart.asp . The following contains specific detection names that provide an indicator of Exchange Server exploitation or post - exploitation activities we associated with these threat actors .


This example shows one possible implementation of this technique . In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker , 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks . The second December spear phishing attack targeted Taiwan based news media organizations . Last week , the Biden administration released its formal roadmap for its national cybersecurity initiative meant to encourage greater investment in cybersecurity and strengthen the U.S. ’s critical infrastructure security ( and more ) .


This approach allows the authors to combine ads from third-party advertising networks with ads they created for their own apps . If KeyBoy is a single component of a larger espionage toolkit , the developers may have realized that this older , static-key based , configuration encoding algorithm was inadvertently providing a link between disparate components of their malware suite . The emails originated from the address dpptccb.dpp@msa.hinet.net , and contained the subject DPP's Contact Information Update . Republican state lawmakers are backing a legal challenge in the court systems to block an Environmental Protection Administration rule that asked local water systems to evaluate their current cybersecurity systems and protections while conducting sanitation surveys .


It may even allow them to sell ad space directly to application developers . In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker ; 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks . Based on the email address naming convention and message subject , the threat actors may have tried to make the message appear to be a legitimate communication from the Democratic Progressive Party ( DPP ) , Taiwan ’s opposition party . To me , simply asking critical infrastructure to consider these factors as part of their normal processes seems like a non - issue , but the U.S. Appeals Court has put a hold on this rule for the time being ( though it did n’t give a precise reason at the time of its ruling ) .


The advertisement SDK also collects statistics about clicks and impressions to make it easier to track revenue . The NetTraveler trojan has been known to be used in targeted cyber espionage attacks for more than a decade by nation state threat actors and continues to be used to target its victims and exfiltrate data . Unlike the previous exploit documents , this malicious attachment did not contain any visible text when opened in Microsoft Word . Two leading Republican members of the U.S. House came out hours after the Biden administration released the roadmap , saying they would use their respective House panels to , “ exercise strict oversight on CISA ’s efforts ” to implement many of the policies outlined .


Selling the ad traffic directly or displaying ads from other sources in a very large volume can provide direct profit to the app author from the advertisers . The exploit document carrying this alternate KeyBoy configuration also used a decoy document which was displayed to the user after the exploit launched . The exploit documents delivered during the December campaigns dropped a binary containing an embedded variant of a backdoor we refer to as ELMER . Regardless of which side of the political spectrum you fall , cybersecurity should be something our lawmakers can all agree on .


We have seen two types of apps that use this custom-made SDK . Only one incident involving a Russian bank was promptly identified and prevented that is known to Group-IB . ELMER is a non-persistent proxy-aware HTTP backdoor written in Delphi , and is capable of performing file uploads and downloads , file execution , and process and directory listings . Say these arguments extend through the 2024 election — what happens if control of the White House or Congress switches between parties ?


The first are games of very low quality that mimic the experience of popular mobile games . This program is designed to capture keystrokes , take screenshots of the user 's desktop and get contents from the clipboard . To retrieve commands , ELMER sends HTTP GET requests to a hard-coded C2 server , and parses the HTTP response packets received from the C2 server for an integer string corresponding to the command that needs to be executed . Our researchers recently discovered a threat actor conducting several campaigns against government entities , military organizations and civilian users in Ukraine and Poland .


While the counterfeit games claim to provide similar functionality to the popular apps , they are simply used to display ads through a custom advertisement SDK . To conduct targeted attacks , MoneyTaker use a distributed infrastructure that is difficult to track . Table 2 lists the ELMER backdoors observed during the December campaigns . Our recent reporting states that these operations are very likely aimed at stealing information and gaining persistent remote access .


The second type of apps reveals an evolution in the author 's tactics . This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files . The ELMER variant 6c33223db475f072119fe51a2437a542 beaconed to the C2 IP address 121.127.249.74 over port 443 . The final payloads include the AgentTesla remote access trojan ( RAT ) , Cobalt Strike beacons and njRAT .


Instead of implementing very basic gameplay , the authors pirated and repackaged the original game in their app and bundled with it their advertisement SDK . Hackers use Metasploit to conduct all these activities : network reconnaissance , search for vulnerable applications , exploit vulnerabilities , escalate systems privileges , and collect information . APT16 . If you ’re a user in Ukraine or Poland , especially someone working in the government or military sectors , this is a clear - cut example of a spam campaign targeting this population .


The only noticeable difference is the game has more ads , including ads on the very first screen . Over the years they've used application components from Norman , McAfee and Norton . While attribution of the first two spear phishing attacks is still uncertain , we attribute the second December phishing campaign to the China based APT group that we refer to as APT16 . For those who fall outside of that demographic , it ’s interesting that this group is still relying on the user enabling macros in Office , since Microsoft disabled those by default earlier this year .


In all cases , the ads are used to convince users to install other apps from different developer accounts , but written by the same group . Recently , Falcon Intelligence observed new activity from MUSTANG PANDA , using a unique infection chain to target likely Mongolia-based victims . This is based on the use of the known APT16 domain rinpocheinfo.com , as well as overlaps in previously observed targeting and tactics , techniques and procedures ( TTPs ) . These are also highly targeted emails with ( relatively speaking ) convincing lures , so whoever is behind these is not to be ignored .


Those apps use the same techniques to monetize their actions . Throughout the years , the Mofang group has compromised countless servers belonging to government or other Myanmar related organizations , in order to stage attacks . Taiwanese citizens will go to the polls on January 16 , 2016 , to choose a new President and legislators . There are multiple Cisco Secure protections in place to defend against the types of spam used in these campaigns .


Click fraud apps The authors ' tactics evolved from advertisement spam to real PHA ( Click Fraud ) . This file requires the target to attempt to open the .lnk file , which redirects the user to a Windows Scripting Component ( .wsc ) file , hosted on an adversary-controlled microblogging page . According to recent opinion polls , the Democratic Progressive Party ( DPP ) candidate Tsai Ing-wen is leading her opponents and is widely expected to win the election . Other Snort rules and detection content can prevent the execution of the malware used as the final payload .


Click fraud PHAs simulate user clicks on ads instead of simply displaying ads and waiting for users to click them . A report published by Kaspersky Labs in 2011 on NetTraveler also mentions the C2 servers were being hosted by Krypt Technolgies . The DPP is part of the pan-green coalition that favors Taiwanese independence over reunification with the mainland , and the party ’s victory would represent a shift away from the ruling Kuomintang ’s closer ties with the PRC . Chinese state - sponsored actors reportedly accessed email accounts belonging to several U.S.-based organizations and federal government agencies , including the State Department .


This allows the PHA authors to monetize their apps more effectively than through regular advertising . Obviously , the developers behind NetTraveler have taken steps to try to hide the malware 's configuration . Since 1949 , Beijing has claimed Taiwan as a part of China and strongly opposes any action toward independence . The U.S. Cybersecurity and Infrastructure Security Agency ( CISA ) released a detailed timeline on the campaign , stating that an investigation from Microsoft revealed that “ advanced persistent threat ( APT ) actors accessed and exfiltrated unclassified Exchange Online Outlook data ” after users reported suspicious activities in their Microsoft 365 cloud environment .


This behavior negatively impacts advertisement networks and their clients because advertising budget is spent without acquiring real customers , and impacts user experience by consuming their data plan resources . In this report , we'll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . The Chinese government is therefore concerned whether a DPP victory might weaken the commercial and tourism ties between China and Taiwan , or even drive Taiwan closer to independence . While the full scope of the hack is still under investigation , reports indicate that the actors were primarily trying to steal sensitive information .


The click fraud PHA requests a URL to the advertising network directly instead of proxying it through an additional SDK . In this report , we'll review how NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . In 2005 , the Chinese government passed an “ anti-secession ” law that signified its intention to use “ non-peaceful ” means to stymie any Taiwanese attempt to secede from China . While CISA or Microsoft have yet to disclose any specific vulnerabilities the actors exploited , the CISA report does say that the APT used a Microsoft account consumer key to forge tokens and impersonate targeted users .


The command & control server ( C & C server ) returns the URL to click along with a very long list of additional parameters in JSON format . In this report , we'll review how the NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan . APT16 actors sent spear phishing emails to two Taiwanese media organization addresses and three webmail addresses . “ Microsoft remediated the issue by first blocking tokens issued with the acquired key and then replacing the key to prevent continued misuse , ” the report states .


After rendering the ad on the screen , the app tries to identify the part of the advertisement website to click . Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique . The message subject read “ DPP ’s Contact Information Update ” , apparently targeting those interested in contact information for DPP members or politicians . ( CISA , CNN )


If that part is found , the app loads Javascript snippets from the JSON parameters to click a button or other HTML element , simulating a real user click . NetTraveler has been used to target diplomats , embassies and government institutions for over a decade , and remains the tool of choice by the adversaries behind these cyber espionage campaigns . The Chinese government would benefit from improved insight into local media coverage of Taiwanese politics , both to better anticipate the election outcome and to gather additional intelligence on politicians , activists , and others who interact with journalists . Popular tax preparation software companies are under fire from lawmakers for allegedly sharing personal information with social media sites , including Google and Meta .


Because a user interacting with an ad often leads to a higher chance of the user purchasing something , ad networks often " pay per click '' to developers who host their ads . WildFire correctly classifies NetTraveler as malicious . This tactic is not without precedent ; in 2013 , the New York Times revealed it had been the target of China based actors shortly after it reported on the alleged mass accumulation of wealth by then-Prime Minister Wen Jiabao and his family . Several Democratic lawmakers released a report last week that accused TaxAct , H&R Block and TaxSlayer of embedding Meta and Google ’s tracking pixels on their sites , potentially violating U.S. law and sharing taxpayers ’ information with those companies .


Therefore , by simulating fraudulent clicks , these developers are making money without requiring a user to click on an advertisement . The NetTraveler group has infected victims across multiple establishments in both the public and private sector including government institutions , embassies , the oil and gas industry , research centers , military contractors and activists . The actors likely sought information on the newspaper ’s sources in China , who could be silenced by the government . The report says the data was kept anonymous , but the companies could “ easily ” use the information to identify individuals or create targeted advertising for them .


This example code shows a JSON reply returned by the C & C server . Today Kaspersky Lab 's team of experts published a new research report about NetTraveler , which is a family of malicious programs used by APT actors to successfully compromise more than 350 high-profile victims in 40 countries . Compromising these Taiwanese news organizations would also allow the actors to gain access to informants or other protected sources , who might then be targeted for further intelligence collection or even retribution . ( Vox , USA Today )


It has been shortened for brevity . According to Kaspersky Lab 's report , this threat actor has been active since as early as 2004 ; however , the highest volume of activity occurred from 2010 – 2013 . The webmail addresses , while unknown , were possibly the personal-use addresses of the individuals whose corporate domain emails were targeted . Apple had to roll back and then re - release a security update that addressed an actively exploited vulnerability in WebKit .


Based on this JSON reply , the app looks for an HTML snippet that corresponds to the active element ( show_hide btnnext ) and , if found , the Javascript snippet tries to perform a click ( ) method on it . Most recently , the NetTraveler group 's main domains of interest for cyberespionage activities include space exploration , nanotechnology , energy production , nuclear power , lasers , medicine and communications . As corporate networks become more secure and users become more vigilant , personal accounts can still offer a means to bypass security systems . Apple initially released a Rapid Security Response patch for iPhones and iPads on July 11 to fix CVE-2023 - 37450 , a remote code execution vulnerability in the WebKit browser engine that Safari and other web browsers use .


Rooting trojans The Zen authors have also created a rooting trojan . In addition , the NetTraveler toolkit was able to install additional info-stealing malware as a backdoor , and it could be customized to steal other types of sensitive information such as configuration details for an application or computer-aided design files . This tactic exploits users ’ reduced vigilance when reading their own personal email , even when using corporate IT equipment to do so . However , users reported that the fix was causing Safari to not connect correctly to major websites like Facebook , Instagram and Zoom , leading Apple to pull back the patch .


Using a publicly available rooting framework , the PHA attempts to root devices and gain persistence on them by reinstalling itself on the system partition of rooted device . During Kaspersky Lab 's analysis of NetTraveler , the company 's experts identified six victims that had been infected by both NetTraveler and Red October , which was another cyberespionage operation analyzed by Kaspersky Lab in January 2013 . On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website . Since then , Apple released a new fix for iOS , iPadOS and macOS that reliably fixes the vulnerability again .


Installing apps on the system partition makes it harder for the user to remove the app . Kaspersky Lab 's products detect and neutralize the malicious programs and its variants used by the NetTraveler Toolkit , including Trojan-Spy.Win32.TravNet and Downloader.Win32.NetTraveler . It is possible , although not confirmed , that APT16 was also responsible for targeting this government agency , given both the timeframe and the use of the same n-day to eventually deploy the ELMER backdoor . Though few details are currently available about CVE-2023 - 37450 , Apple indicated it had been exploited in the wild and could be triggered by a vulnerable browser processing specially crafted web content .


This technique only works for unpatched devices running Android 4.3 or lower . Based on Kaspersky Lab 's analysis of NetTraveler 's C&C data , there were a total of 350 victims in 40 countries across including the United States , Canada , United Kingdom , Russia , Chile , Morocco , Greece , Belgium , Austria , Ukraine , Lithuania , Belarus , Australia , Hong Kong , Japan , China , Mongolia , Iran , Turkey , India , Pakistan , South Korea , Thailand , Qatar , Kazakhstan , and Jordan . One of the media organizations involved in this latest activity was targeted in June 2015 , while its Hong Kong branch was similarly targeted in August 2015 . ( Forbes , Gizmodo ) • Vulnerability Roundup : Memory corruption vulnerability in Microsoft Edge ; MilesightVPN and router could be taken over • Malicious Microsoft Drivers Could Number in the Thousands : Cisco Talos • New Threat Actor Launches Cyber - attacks on Ukraine and Poland •


Devices running Android 4.4 and higher are protected by Verified Boot . Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit.MSWord.CVE-2010-333 , Exploit.Win32.CVE-2012-0158 . APT16 actors were likely also responsible for the June 2015 activity . Uncovering weaknesses in Apple macOS and VMWare vCenter : 12 vulnerabilities in RPC implementation •


Zen 's rooting trojan apps target a specific device model with a very specific system image . In this case , it was a group commonly referred to as " Nitro " , which was coined by Symantec in its 2011 whitepaper . They sent spear phishing messages with the subject “ 2015 Taiwan Security and Cultural Forum Invitation Form ” , and used a different tool – a tool that we refer to as DOORJAMB – in their attempt to compromise the organization . Talos Takes Ep .


After achieving root access the app tries to replace the framework.jar file on the system partition . Historically , Nitro is known for targeted spear phishing campaigns and using Poison Ivy malware , which was not seen in these attacks . A different group , known as admin@338 , used LOWBALL malware during its Hong Kong activity . # 147 : The dangers of " Mercenary " groups and the spyware they create Upcoming events where you can find Talos “ Most prevalent malware files ” is taking a break this week for maintenance .


Replicating framework.jar allows the app to intercept and modify the behavior of the Android standard API . Since at least 2013 , Nitro appears to have somewhat modified their malware and delivery methods to include Spindest and legitimate compromised websites , as reported by Cyber Squared 's TCIRT . Despite the differing sponsorship , penetration of Hong Kong and Taiwan based media organizations continues to be a priority for China based threat groups . On December 17th , the Ukrainian capital Kiev was hit by a blackout .


In particular , these apps try to add an additional method called statistics ( ) into the Activity class . In July , Nitro compromised a South Korean clothing and accessories manufacturer 's website to serve malware commonly referred to as " Spindest " . The difference in sponsorship could be the result of tasking systems that allocate targeting responsibility to different groups based on their targets ’ geographic location . Local investigators later confirmed that the energy outage was caused by a cyberattack .


When inserted , this method runs every time any Activity object in any Android app is created . Of all the samples we've tied to this activity so far noted in this blog , this is the only one configured to connect directly to an IP address for Command and Control ( C2 ) . In other words , while media organizations are important targets , it is possible that two separate groups are responsible for Hong Kong and Taiwan , respectively . Shortly thereafter , ESET ® researchers analyzed a sophisticated new malware , which is the main suspect in this case .


This happens all the time in regular Android apps , as Activity is one of the fundamental Android UI elements . The next sample was another Spindest variant and had the same timestamp as the aforementioned PcClient sample . The suspected APT16 targeting of the Taiwanese government agency – in addition to the Taiwanese media organizations – further supports this possibility . They have named it Industroyer – the biggest threat to Industrial Control Systems ( ICS ) since Stuxnet .


The only purpose of this method is to connect to the C & C server . As this post and previous cited research show , APT groups such as Nitro will continue to evolve their techniques within the kill chain to avoid detection . IRONHALO : CVE-2015-1701 . This dangerous malware was developed to exploit weaknesses in those systems and the communication protocols they use – systems developed decades ago with almost no security measures .


The Zen trojan After achieving persistence , the trojan downloads additional payloads , including another trojan called Zen . Attacks on the chemical industry are merely their latest attack wave . ELMER : CVE-2015-1701 . Adversaries may manipulate physical process control within the industrial environment .


Zen requires root to work correctly on the Android operating system . The goal of the attackers appears to be to collect intellectual property such as design documents , formulas , and manufacturing processes . These clusters of activity raise interesting questions about the use of an identical silently-patched vulnerability , possibly by multiple threat groups . Methods of manipulating control can include changes to set point values , tags , or other parameters .


The Zen trojan uses its root privileges to turn on accessibility service ( a service used to allow Android users with disabilities to use their devices ) for itself by writing to a system-wide setting value enabled_accessibility_services . The attack wave started in late July 2011 and continued into midSeptember 2011 . Both Japan and Taiwan are important intelligence collection targets for China , particularly because of recent changes to Japan ’s pacifist constitution and the upcoming Taiwanese election . Adversaries may manipulate control systems devices or possibly leverage their own , to communicate with and command physical control processes .


Zen does n't even check for the root privilege : it just assumes it has it . The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage . Based on our visibility and available data , we only attribute one campaign to the Chinese APT group APT16 . The duration of manipulation may be temporary or longer sustained , depending on operator detection .


This leads us to believe that Zen is just part of a larger infection chain . They then moved on to the motor industry in late May . APT17 . A Polish student used a remote controller device to interface with the Lodz city tram system in Poland .


The trojan implements three accessibility services directed at different Android API levels and uses these accessibility services , chosen by checking the operating system version , to create new Google accounts . From late April to early May , the attackers focused on human rights related NGOs . FireEye Threat Intelligence and the Microsoft Threat Intelligence Center investigated a command-and-control ( C2 ) obfuscation tactic used on Microsoft ’s TechNet , a web portal for IT professionals . Using this remote , the student was able to capture and replay legitimate tram signals .


This is done by opening the Google account creation process and parsing the current view . Attackers then moved on to the motor industry in late May . TechNet ’s security was in no way compromised by this tactic , which is likely possible on other message boards and forums . As a consequence , four trams were derailed and twelve people injured due to resulting emergency stops .


The app then clicks the appropriate buttons , scrollbars , and other UI elements to go through account sign-up without user intervention . At this point , the current attack campaign against the chemical industry began . FireEye Threat Intelligence assesses that APT17 , a China based threat group , was behind the attempt . The track controlling commands issued may have also resulted in tram collisions , a further risk to those on board and nearby the areas of impact .


During the account sign-up process , Google may flag the account creation attempt as suspicious and prompt the app to solve a CAPTCHA . The attackers first researched desired targets and then sent an email specifically to the target . Other groups have used legitimate websites to host C2 IP address in the past . On Feb 12th 2013 , FireEye announced the discovery of an Adobe Reader 0 - day exploit which is used to drop a previously unknown , advanced piece of malware .


To get around this , the app then uses its root privilege to inject code into the Setup Wizard , extract the CAPTCHA image , and sends it to a remote server to try to solve the CAPTCHA . First , when a specific recipient was targeted , the mails often purported to be meeting invitations from established business partners . APT17 was embedding the encoded C2 IP address for the BLACKCOFFEE malware in legitimate Microsoft TechNet profiles pages and forum threads , a method some in the information security community call a “ dead drop resolver. ” Encoding the IP address makes it more difficult to identify the true C2 address for network security professionals . We called this new malware ?


It is unclear if the remote server is capable of solving the CAPTCHA image automatically or if this is done manually by a human in the background . While the attackers used different pretexts when sending these malicious emails , two methodologies stood out . Few security companies have publicly discussed this tactic . ItaDuke because it reminded us of Duqu and because of the ancient Italian comments in the shellcode copied from Dante Alighieri - s ? Divine Comedy .


After the server returns the solution , the app enters it into the appropriate text field to complete the CAPTCHA challenge . Secondly , when the emails were being sent to a broad set of recipients , the mails purported to be a necessary security update . After discovering the BLACKCOFFEE activity , the FireEye-Microsoft team encoded a sinkhole IP address into the profile pages and forum threads and locked the accounts to prevent the threat actors from making any changes . Since the original announcement , we have observed several new attacks using the same exploit ( CVE-2013 - 0640 ) which drop other malware .


The Zen trojan does not implement any kind of obfuscation except for one string that is encoded using Base64 encoding . The attacks were traced back to a computer system that was a virtual private server ( VPS ) located in the United States . This collaborative approach allowed the team to observe the malware and its victims . Together with our partner CrySyS Lab , we - ve performed a detailed analysis of these unusual incidents which suggest a new , previously unknown threat actor .


It 's one of the strings - " How you 'll sign in '' - that it looks for during the account creation process . Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor.Sogu . Though the security community has not yet broadly discussed this technique , FireEye has observed other threat groups adopting these measures and expect this trend to continue on other community sites . For the CrySyS Lab analysis , please read [ here ] .


The code snippet below shows part of the screen parsing process . This particular threat was also used by hackers to compromise a Korean social network site to steal records of 35 million users . Today , FireEye released Indicators of Compromise ( IOCs ) for BLACKCOFFEE and Microsoft released signatures for its anti-malware products . The MiniDuke attackers are still active at this time and have created malware as recently as February 20 , 2013 .


Apart from injecting code to read the CAPTCHA , the app also injects its own code into the system_server process , which requires root privileges . The Sogu gang use a custom developed threat – Backdoor.Sogu , whereas the group described in this document use an off the shelf threat – Poison Ivy . APT17 , also known as DeputyDog , is a Chinabased threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations . To compromise the victims , the attackers used extremely effective social engineering techniques which involved sending malicious PDF documents to their targets .


This indicates that the app tries to hide itself from any anti-PHA systems that look for a specific app process name or does not have the ability to scan the memory of the system_server process . The Sogu gang , in contrast , use PDF and DOC files in very tailored , targeted emails . BLACKCOFFEE ’s functionality includes uploading and downloading files ; creating a reverse shell ; enumerating files and processes ; renaming , moving , and deleting files ; terminating processes ; and expanding its functionality by adding new backdoor commands . The PDFs were highly relevant and well - crafted content that fabricated human rights seminar information ( ASEM ) and Ukraine - s foreign policy and NATO membership plans .


The app also creates hooks to prevent the phone from rebooting , going to sleep or allowing the user from pressing hardware buttons during the account creation process . These attacks are primarily targeting private industry in search of key intellectual property for competitive advantage , military institutions , and governmental organizations often in search of documents related to current political events and human rights organizations . FireEye has monitored APT17 ’s use of BLACKCOFFEE variants since 2013 to masquerade malicious communication as normal web traffic by disguising the C2 communication as queries to web search engines . These malicious PDF files were rigged with exploits attacking Adobe Reader versions 9 , 10 and 11 , bypassing its sandbox .


These hooks are created using the root access and a custom native code called Lmt_INJECT , although the algorithm for this is well known . Nitro 's campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes . The use of BLACKCOFFEE demonstrates threat actors ’ evolving use of public websites to hide in plain sight . Once the system is exploited , a very small downloader is dropped onto the victim - s disc that - s only 20 KB in size .


First , the app has to turn off SELinux protection . This attack campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes . In the past , threat actors would modify easily compromised websites to host C2 commands and configuration , as observed in the China based APT1 ’s WEBC2 suite of backdoors . This downloader is unique per system and contains a customized backdoor written in Assembler .


Then the app finds a process id value for the process it wants to inject with code . These have been highly active in the Middle East region and unveiled ongoing targeted attacks in multiple regions . Now , threat actors are using well-known websites—that they do not need to compromise to host C2 IP addresses . When loaded at system boot , the downloader uses a set of mathematical calculations to determine the computer - s unique fingerprint , and in turn uses this data to uniquely encrypt its communications later .


This is done using a series of syscalls as outlined below . The attackers try to lure targets through spear phishing emails that include compressed executables . They simply use the website for legitimate purposes , such as posting forum threads or creating profile pages . If the target system meets the pre - defined requirements , the malware will use Twitter ( unbeknownst to the user ) and start looking for specific tweets from pre - made accounts .


The " source process '' refers to the Zen trojan running as root , while the " target process '' refers to the process to which the code is injected and [ pid ] refers to the target process pid value . We found that the group behind this campaign targeted mainly industrial , engineering and manufacturing organizations in more than 30 countries . APT17 went further to obfuscate their C2 IP address and employed a multi-layered approach for the malware to finally beacon the true C2 IP . These accounts were created by MiniDuke - s Command and Control ( C2 ) operators and the tweets maintain specific tags labeling encrypted URLs for the backdoors .


The source process checks the mapping between a process id and a process name . Using the Kaspersky Security Network ( KSN ) and artifacts from malware files and attack sites , we were able to trace the attacks back to March 2015 . They used legitimate infrastructure—the ability to post or create comments on forums and profile pages—to embed a string that the malware would decode to find and communicate with the true C2 IP address . These URLs provide access to the C2s , which then provide potential commands and encrypted transfers of additional backdoors onto the system via GIF files .


This is done by reading the /proc/ [ pid ] /cmdline file . Operation Ghoul is one of the many attacks in the wild targeting industrial , manufacturing and engineering organizations , Kaspersky Lab recommends users to be extra cautious while checking and opening emails and attachments . This additional obfuscation puts yet another layer between APT17 and the security professionals attempting to chase them down . • Based on the analysis , it appears that the MiniDuke - s creators provide a dynamic backup system that also can fly under the radar – if Twitter isn - t working or the accounts are down , the malware can use Google Search to find the encrypted strings to the next C2 .


This very first step fails in Android 7.0 and higher , even with a root permission . The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People's Republics . This BLACKCOFFEE variant contains one or more URLs that link to the biography sections of attacker-created profiles as well as forum threads that contain comments from those same profiles . This model is flexible and enables the operators to constantly change how their backdoors retrieve further commands or malcode as needed .


The /proc filesystem is now mounted with a hidepid=2 parameter , which means that the process can not access other process /proc/ [ pid ] directory . The attacks appear to be geopolitically motivated and target high profile organizations . A URL is randomly selected and the malware searches at that location for an encoded IP address located between two tags , “ @MICR0S0FT ” and “ C0RP0RATI0N ” . Once the infected system locates the C2 , it receives encrypted backdoors that are obfuscated within GIF files and disguised as pictures that appear on a victim - s machine .


A ptrace_attach syscall is called . The objective of the attacks is clearly espionage – they involve gaining access to top legislative , executive and judicial bodies around the world . The malware then communicates directly with the retrieved and decoded IP address to receive commands and send stolen information . Once they are downloaded to the machine , they can fetch a larger backdoor which carries out the cyberespionage activities , through functions such as copy file , move file , remove file , make directory , kill process and of course , download and execute new malware and lateral movement tools .


This allows the source process to trace the target . The attackers have targeted a large number of organizations globally since early 2017 , with the main focus on the Middle East and North Africa ( MENA ) , especially Palestine . If the C2 server is discovered or shut down , the threat actors can update the encoded IP address on TechNet to maintain control of the victims ’ machines . The final stage backdoor connects to two servers , one in Panama and one in Turkey to receive the instructions from the attackers .


The source process looks at its own memory to calculate the offset between the beginning of the libc library and the mmap address . The attacks were initially discovered while investigating a phishing attack that targeted political figures in the MENA region . BLACKCOFFEE supports an initial set of fifteen commands , including creating a reverse shell , uploading and downloading files , and enumerating files and processes . The attackers left a small clue in the code , in the form of the number 666 ( 0x29A hex ) before one of the decryption subroutines : • By analysing the logs from the command servers , we have observed 59 unique victims in 23 countries : For the detailed analysis and information on how to protect against the attack , please read :


The source process reads /proc/ [ pid ] /maps to find where libc is located in the target process memory . Like BlackEnergy ( a.k.a Sandworm , Quedagh ) , Potao is an example of targeted espionage ( APT ) malware detected mostly in Ukraine and a number of other CIS countries , including Russia , Georgia and Belarus . The attackers can also extend BLACKCOFFEE ’s functionality through additional commands sent as shellcode . Together with our partner CrySyS Lab , we ’ve discovered two new , previously - unknown infection mechanisms for Miniduke .


By adding the previously calculated offset , it can get the address of the mmap function in the target process memory . The main reason for the increase in Potao detections in 2014 and 2015 were infections through USB drives . APT17 : de56eb5046e518e266e67585afa34612 . These new infection vectors rely on Java and IE vulnerabilities to infect the victim ’s PC .


The source process tries to determine the location of dlopen , dlsym , and dlclose functions in the target process . The first Potao campaign that we examined took place in August 2011 . APT17 : 195ade342a6a4ea0a58cfbfb43dc64cb . While inspecting one of the C&C servers of Miniduke , we have found files that were not related to the C&C code , but seemed to be prepared for infecting visitors using web - based vulnerabilities .


It uses the same technique as it used to determine the offset to the mmap function . In March 2014 , the gang behind Potao started using a new infection vector . APT17 : 4c21336dad66ebed2f7ee45d41e6cada . The page hxxp://[c2_hostname]/groups / business - principles.html is used as an starting point for the attack .


The source process writes the native shellcode into the memory region allocated by mmap . Since March 2015 , ESET has detected Potao binaries at several high-value Ukrainian targets that include government and military entities and one of the major Ukrainian news agencies . APT17 : 0370002227619c205402c48bde4332f6 . It consists of two frames , one for loading the decoy web page from a legitimate website ( copied from http://www.albannagroup.com/business-principles.html ) , and another for performing malicious activities ( hxxp://[c2_hostname]/groups / sidebar.html )


Additionally , it also writes addresses of dlopen , dlsym , and dlclose into the same region , so that they can be used by the shellcode . As confirmation that the malware writers are still very active even at the time of this writing , ESET detected a new Potao sample compiled on July 20 , 2015 . APT17 : ac169b7d4708c6fa7fee9be5f7576414 . The second webpage , “ sidebar.html ” contains 88 lines , mostly JavaScript code , and works as a primitive exploit pack .


Shellcode simply uses dlopen to open a .so file within the target process and then dlsym to find a symbol in that file and run it . In the previous pages we have presented our findings based on ESET detection telemetry and our analysis of Win32/Potao and Win32/FakeTC samples . APT17 : 130.184.156.62 . Its code identifies the victim ’s browser and then serves one of two exploits .


The source process changes the registers in the target process so that PC register points directly to the shellcode . Potao is another example of targeted espionage malware , a so-called APT , to use the popular buzzword , although technically the malware is not particularly advanced or sophisticated . APT17 : 69.80.72.165 . It also sends collected browser data to another script by sending a POST request to “ hxxp://[c2_hostname]/groups / count / write.php ” .


This is done using the ptrace syscall . Examples of notable Potao dissemination techniques , some of which were previously unseen , or at least relatively uncommon , include the use of highly-targeted spear-phishing SMS messages to drive potential victims to malware download sites and USB worm functionality that tricked the user into ' willingly ' executing the trojan . APT17 : 110.45.151.43 . The exploits are located in separate web pages .


This diagram illustrates the whole process . The PassCV group continues to be one of the most successful and active threat groups that leverage a wide array of stolen Authenticode-signing certificates . APT17 : 121.101.73.231 . Clients using Internet Explorer version 8 are served with “ about.htm ” , for other versions of the browser and for any other browser capable of running Java applets , the JavaScript code loads “ JavaApplet.html ” .


Summary PHA authors go to great lengths to come up with increasingly clever ways to monetize their apps . The PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) . APT18 . The web page “ JavaApplet.html ” loads “ JavaApplet.class ” that implements a Java exploit for the recently discovered vulnerability CVE-2013 - 0422 .


Zen family PHA authors exhibit a wide range of techniques , from simply inserting an advertising SDK to a sophisticated trojan . he PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) . Dell SecureWorks Counter Threat Unit ( CTU ) analysts were recently engaged with a client thought to have been compromised by a threat group CTU researchers have named Threat Group-0416 ( TG-0416 ) . The code of the exploit is very similar to the one published in the Metasploit kit , but the inner class that disables the security manager is encoded differently , most likely to avoid detection .


The app that resulted in the largest number of affected users was the click fraud version , which was installed over 170,000 times at its peak in February 2018 . PassCV continues to maintain a heavy reliance on obfuscated and signed versions of older RATs like ZxShell and Ghost RAT , which have remained a favorite of the wider Chinese criminal community since their initial public release . Various artifacts from the initial phases of the incident provided strong indications of the existence of this particular threat group within the client's infrastructure . According to HTTP headers of the server , the applet was uploaded on February 11 , 2013 , one month after the Metasploit code was published and two days before Oracle issued a security alert regarding the vulnerability .


The most affected countries were India , Brazil , and Indonesia . SPEAR identified recent PassCV samples which implemented another commercial off-the-shelf ( COTS ) RAT called Netwire . TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology . It decodes the binary and writes it to a Java temporary directory with name “ ntuser.bin ” .


In most cases , these click fraud apps were uninstalled by the users , probably due to the low quality of the apps . SPEAR identified recent PassCV samples which implemented another commercial off-the-shelf ( COTS ) RAT called Netwire . The threat actors achieved an initial foothold into the infrastructure via phishing email that convinced victims to install the Xyligan remote access Trojan ( RAT ) on a system . Then , it copies the system file “ rundll32.exe ” to the same directory with name “ ntuser.exe ” and runs it with “ ntuser.bin ” as a parameter , effectively loading the malicious DLL file .


If Google Play Protect detects one of these apps , Google Play Protect will show a warning to users . The first new connection SPEAR identified was derived from an email address listed in Blue Coat Systems' original report on PassCV . The threat actors then installed the hcdLoader RAT , which installs as a Windows service and provides command line access to the compromised system . That DLL file is the main module of Miniduke , and it uses the URL http://twitter.com/TamicaCGerald to fetch commands .


We are constantly on the lookout for new threats and we are expanding our protections . Syncopate is a well-known Russian company that is best known as the developer and operator of the ' GameNet ' platform . Using host-based digital forensic analysis , CTU analysts observed the intruders using the native ‘ at.exe ’ Windows task scheduler tool to move laterally within the infrastructure . The web page “ about.htm ” implements an exploit for Microsoft Internet Explorer 8 .


Every device with Google Play includes Google Play Protect and all apps on Google Play are automatically and periodically scanned by our solutions . The PassCV group continues to be extremely effective in compromising both small and large game companies and surreptitiously using their code-signing certificates to infect an even larger swath of organizations . Many threat groups use lateral movement techniques , but this engagement allowed CTU analysts to not only further validate indicators of lateral movement , but also to look a bit closer at those indicators and expand the cluster of indicators surrounding the use of at.exe for lateral movement within the infrastructure . It uses a vulnerability discovered at the end December 2012 , CVE-2012 - 4792 .


You can check the status of Google Play Protect on your device : Open your Android device 's Google Play Store app . Since the last report , PassCV has significantly expanded its targets to include victims in the United States , Taiwan , China and Russia . Threat actors accessed the source host via the hcdLoader RAT . The code is also very similar to the Metasploit version of the exploit , while the payload part of the shellcode has been written by the Miniduke authors re - using the backdoor ’s code .


Tap Menu > Play Protect . Based on data collected from Palo Alto Networks AutoFocus threat intelligence , we discovered continued operations of activity very similar to the Roaming Tiger attack campaign that began in the August 2015 timeframe , with a concentration of attacks in late October and continuing into December . The sole indicator on the source host that at.exe had been run was an application Prefetch file ( C:\Windows\Prefetch\AT.EXE-BB02E639.pf ) that was created when the tool was executed . The Metasploit code was released on December 29 , 2012 and the vulnerability was officialy fixed on January 14 , 2013 ( MS13 - 008 ) while the page with the exploit was uploaded on February 11 , 2013 .


Look for information about the status of your device . The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Beyond the file system metadata for the Prefetch file ( creation and last modification times ) and the last execution time within the file metadata , CTU analysts did not observe any indicators of value on the source host . [ c2_hostname ] The purpose of the shellcode is to download a GIF image file from URL hxxp://[c2_hostname]/groups / pic.gif , then search for and decrypt the hidden PE file inside of it .


Hashes of samples Type Package name SHA256 digest Custom ads com.targetshoot.zombieapocalypse.sniper.zombieshootinggame 5d98d8a7a012a858f0fa4cf8d2ed3d5a82937b1a98ea2703d440307c63c6c928 Click fraud com.counterterrorist.cs.elite.combat.shootinggame 84672fb2f228ec749d3c3c1cb168a1c31f544970fd29136bea2a5b2cefac6d04 BBSRAT is typically packaged within a portable executable file , although in a few of the observed instances , a raw DLL was discovered to contain BBSRAT . Two files are created for the task at approximately the same time : C:\Windows\System32\Tasks\At1 and C:\Windows\Tasks\At1.job . The PE file also appeared to be a modification of the Miniduke 's main backdoor module that uses the same Twitter URL as the Java payload .


Rooting trojan com.android.world.news bd233c1f5c477b0cc15d7f84392dab3a7a598243efa3154304327ff4580ae213 Zen trojan com.lmt.register eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d Mobile Campaign ‘ Bouncing Golf ’ Affects Middle East We uncovered a cyberespionage campaign targeting Middle WildFire properly classifies BBSRAT malware samples as malicious . The first file is an Extensible Markup Language ( XML ) file that can be opened and viewed in a text editor . We have discovered and analysed two previously unknown infector vectors that were used in the MiniDuke attacks .


Eastern countries . This week we will discuss another Chinese nexus adversary we call Samurai Panda . The second file follows a decodable binary format . As previously recommended , updating Windows , Java and Adobe Reader to the latest versions should provide a basic level of defense against the known Miniduke attacks .


We named this campaign “ Bouncing Golf ” based on the malware ’ s code in the package named “ golf. ” June 18 , 2019 We uncovered a cyberespionage campaign targeting Middle Eastern countries . Samurai Panda is interesting in that their target selection tends to focus on Asia Pacific victims in Japan , the Republic of Korea , and other democratic Asian victims . The operating system also creates a registry key within the software registry hive that is specifically associated with the creation of the scheduled task on the destination host : Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\At1 . Researchers have uncovered an ongoing cyberespionage campaign targeting more than 30 online video game companies over the past four years .


We named this campaign “ Bouncing Golf ” based on the malware ’ s code in the package named “ golf. ” The malware involved , which Trend Micro detects as AndroidOS_GolfSpy.HRX , is notable for its wide range of cyberespionage capabilities . Next , in an effort to demonstrate it wasn't relegated to China , CrowdStrike exposed Clever Kitten , an actor we track out of Iran who leverages some very distinct TTPs when viewed next to a more visible adversary . The Task Scheduler service names the tasks , so subsequent tasks are named At2 , At3 , and so on . The companies infected by the malware primarily market so - called massively multiplayer online role - playing games .


Malicious codes are embedded in apps that the operators repackaged from legitimate applications . Next , in an effort to demonstrate it wasn't relegated to China , we exposed Clever Kitten , an actor we track out of Iran who leverages some very distinct TTPs when viewed next to a more visible adversary . FIN7.5 : the infamous cybercrime rig FIN7 continues its activities . They 're mostly located in South East Asia , but are also in the US , Germany , Japan , China , Russia , Brazil , Peru , and Belarus , according to a release published Thursday by researchers from antivirus provider Kaspersky Lab .


Monitoring the command and control ( C & C ) servers used by Bouncing Golf , we ’ ve so far observed more than 660 Android devices infected with GolfSpy . Beginning in 2009 , we've observed this actor conduct more than 40 unique campaigns that we've identified in the malware configurations' campaign codes . On August 1, 2018 , the US Department of Justice announced that it had arrested several individuals suspected of having ties to the FIN7 cybercrime rig . The attackers work from computers with Chinese and Korean language configurations .


Much of the information being stolen appear to be military-related . These codes are often leveraged in the malware used by coordinated targeted attackers to differentiate victims that were successfully compromised from different target sets . FIN7 operations are linked to numerous intrusion attempts having targeted hundreds of companies since at least as early as 2015 . They used their unauthorized access to obtain digital certificates that were later exploited in malware campaigns targeting other industries and political activists .


The campaign ’ s attack vector is also interesting . When conducting programmatic espionage activity , it can presumably become quite confusing if the attacker targets a heavy industry company , an avionics program , and seven other unique targets as to which infected host you will collect what information from . Interestingly , this threat actor created fake companies in order to hire remote pentesters , developers and interpreters to participate in their malicious business . So far , there 's no evidence that customers of the infected game companies were targeted , although in at least one case , malicious code was accidentally installed on gamers ' computers by one of the infected victim companies .


These repackaged , malware-laden apps are neither on Google Play nor popular third-party app marketplaces , and we only saw the website hosting the malicious apps being promoted on social media when we followed GolfSpy ’ s trail . These rules detect the malware " beaconing " to the command-and-control server , the initial malware check-in , and an attempt to download a backdoor module . The main goal behind its malicious activities was to steal financial assets from companies , such as debit cards , or get access to financial data or computers of finance department employees in order to conduct wire transfers to offshore accounts . Kaspersky said there was another case of end users being infected by the malware , which is known as " Winnti . "


We were also able to analyze some GolfSpy samples sourced from the Trend Micro mobile app reputation service . Earlier this month , Securelist 's technology caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . In 2018-2019 , researchers of Kaspersky Lab ’s Global Research and Analysis Team analyzed various campaigns that used the same Tactics Tools and Procedures ( TTPs ) as the historic FIN7 , leading the researchers to believe that this threat actor had remained active despite the 2018 arrests . " Having infected gaming companies that do business in MMORPG , the attackers potentially get access to millions of users , " the researchers wrote .


Also of note is Bouncing Golf ’ s possible connection to a previously reported mobile cyberespionage campaign that researchers named Domestic Kitten . Securelist believe the attacks are launched by an APT Group we track under the codename " ScarCruft " . In addition , during the investigation , we discovered certain similarities to other attacker groups that seemed to share or copy the FIN7 TTPs in their own operations . " So far we do n't have data that the attackers stole from common users but we do have at least two incidents when Winnti malware had been planted on an online game update server and


The strings of code , for one , are similarly structured . ScarCruft is a relatively new APT group ; victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania . The FIN7 intrusion set continued its tailored spear phishing campaigns throughout last year . The samples we have observed seemed not to be malware targeted for the game fans but a malware module which accidentally got into [ the ] wrong place .


The data targeted for theft also have similar formats . ScarCruft has several ongoing operations , utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer . Kaspersky Lab has been able to retrieve some of these exchanges from a FIN7 target . But a potential of attackers to misuse such access to infect hundreds of millions of Internet users creates a great risk . "


Figure 1 . ScarCruft is a relatively new APT group ; victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania . The spear phishing campaigns were remarkably sophisticated from a social engineering perspective . Digital certificates stolen in some of the heists have been used to sign malware that targeted Tibetan and Uyghur activists .


GolfSpy ’ s infection chain GolfSpy 's Potential Impact Given GolfSpy ’ s information-stealing capabilities , this malware can effectively hijack an infected Android device . Operation Daybreak appears to have been launched by ScarCruft in March 2016 and employs a previously unknown ( 0-day ) Adobe Flash Player exploit . In various cases , the operators exchanged numerous messages with their victims for weeks before sending their malicious documents . The cryptographic certificates have also been exploited in attacks that have hit companies in the aerospace industry .


Here is a list of information that GolfSpy steals : Device accounts List of applications installed in the device Device ’ s current running processes Battery status Bookmarks/Histories of the device ’ s default browser Call logs and records Clipboard contents Contacts , including those in VCard format Mobile operator information Files stored on SDcard Device location List of image , audio , and video files stored on the device Storage and memory information Connection information Sensor information SMS messages Pictures GolfSpy also has a function that lets it connect to a remote server to fetch and perform commands Adobe Flash Player exploit . The emails were efficient social-engineering attempts that appealed to a vast number of human emotions ( fear , stress , anger , etc. ) to elicit a response from their victims . Attackers frequently abuse stolen certificates to prevent the malware they 're spreading from being detected by various security protections .


, including : searching for , listing , deleting , and renaming files as well as downloading a file into and retrieving a file from the device ; taking screenshots ; installing other application packages ( APK ) ; recording audio and video ; and updating the malware . It is also possible that ScarCruft deployed another zero day exploit , CVE-2016-0147 , which was patched in April . One of the domains used by the attackers in their 2018 campaign of spear phishing contained more than 130 email aliases , leading us to think that more than 130 companies had been targeted by the end of 2018 . In addition to stealing digital certificates , the Winnti gang 's campaign appears to be motivated by the desire to manipulate in - game currency , such as " runes " or " gold , " that can in many cases be converted into real currency .


Technical Analysis The repackaged applications are embedded with malicious code , which can be found in the com.golf package . Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . We have seen two types of documents sent to victims in these spear phishing campaigns . The attackers may also want to use source code stolen from the game companies so it can be deployed in rogue servers offering pirated versions of the games .


These repackaged apps pose as communication , news , lifestyle , book , and reference apps popularly used in the Middle East . ScarCruft 's Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks . The first one exploits the INCLUDEPICTURE feature of Microsoft Word to get context information about the victim’s computer , and the availability and version number of Microsoft Word . Kaspersky has more here .


The GolfSpy malware embedded in the apps is hardcoded with an internal name used by the attacker . Nevertheless , resourceful threat actors such as ScarCruft will probably continue to deploy zero-day exploits against their high profile targets . The second one , which in many cases is an Office document protected with a trivial password , such as “ 12345 ” , “ 1234 ” , etc. , uses macros to execute a GRIFFON implant on the target’s computer . Whether known as commodity malware or “ as - a - service , ” threat actors have long been turning to their fellow adversaries in the hopes of selling off their tools and opening a new stream of revenue .


Figure 2 . After publishing our initial series of blogposts back in 2016 , Kaspersky have continued to track the ScarCruft threat actor . In various cases , the associated macro also scheduled tasks to make GRIFFON persistent . The software is centrally hosted on that third - party company ’s servers .


Icons of the apps that Bouncing Golf ’ s operators repackaged ( top ) and a comparison of packages between the original legitimate app ( bottom left ) and GolfSpy ( bottom right ) Figure 3 . After publishing our initial series of blogposts back in 2016 , we have continued to track the ScarCruft threat actor . Interestingly , following some open-source publications about them , the FIN7 operators seems to have developed a homemade builder of malicious Office document using ideas from ThreadKit , which they employed during the summer of 2018 . Think of cloud storage solutions like Dropbox or Plex , for example .


GolfSpy ’ s configurations encoded by a custom algorithm ( right ) and its decoded version ( left ) As shown in Figure 3 , GolfSpy ’ s configurations ( e.g. , C & C server , secret keys ) are encoded by a customized algorithm . ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula . The new builder inserts random values in the Author and Company metadata fields . Threat actors have been using this business model for a decade - plus , originally known as commodity malware .


After it is launched , GolfSpy will generate a unique ID for the affected device and then collect its data such as SMS , contact list , location , and accounts in this format : “ % , [ ] , time ” ( shown in Figure 4 ) . The ScarCruft group uses common malware delivery techniques such as spear phishing and Strategic Web Compromises ( SWC ) . Moreover , the builder allows these to modify different IOCs , such as the filenames of wscript.exe or sctasks.exe copies , etc . This is when threat actors create a suite of malware tools and offer them up for sale on illicit websites .


The information is written into a file on the device . ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula . The GRIFFON implant is a lightweight JScript validator-style implant without any persistence mechanism . It can range from asking “ customers ” to pay a monthly fee for access to this set of tools to use in cyber attacks , or users can even pay the original creators to distribute the malware on their behalf and manage the infection .


The attacker can choose the data types to collect , which are written in a certain format . ScarCruft uses a multi-stage binary infection scheme . The malware is designed for receiving modules to be executed in-memory and sending the results to C2s . Recently , this model for threat actors has come to be known as the “ as - a - service " model , borrowing the term from the growing trend in the tech industry .


Figure 4 . One of the most notable functions of the initial dropper is to bypass Windows UAC ( User Account Control ) in order to execute the next payload with higher privileges . We were able to obtain four different modules during the investigation . Ransomware - as - a - service is a relatively new version of these commodity groups , such as DarkSide , known for the cyber attack in 2021 that disrupted the Colonial oil pipeline and made gas more expensive for thousands of U.S. consumers .


Code snippet showing GolfSpy generating UUID The value of % is in the range of 1-9 or a-j . This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams . The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation . But other bad actors have since adopted this businesses model , offering every from command and control servers to phishing bots - as - a - service .


Each value represents a different type of data to steal from the device : Value Data Type 1 Accounts 2 Installed APP list 3 Running processes list 4 Battery status 5 Browser bookmarks and histories 6 Call logs 7 Clipboard 8 Contacts 9 Mobile operator information a File list on SD card b Location c Image list d Audio list e Video list f Storage and memory information g Connection information h Sensors information i SMS messages j VCard format contacts Table 1 . Afterwards , the installer malware creates a downloader and a configuration file from its resource and executes it . This module mainly relies on WMI and Windows objects to deliver results , which will be sent back to the operators . There are a few reasons why attackers may opt to pay for an as - a - service malware tool for their chosen campaign : • As - a - service saves attackers time .


The type of data corresponding to the value coded in GolfSpy Figure 5 shows the code snippets that are involved in monitoring and recording the device ’ s phone call . The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload . Interestingly , more than 20 artifacts are retrieved from the system by this implant during the reconnaissance stage , from the date and time of operating system installation and membership in a Windows domain to a list of and the resolutions of the workstation’s monitors . When they pay for someone else ’s malware kit , whether it be ransomware or a phishing bot , they do n’t have to invest time , money or labor to write their own malicious code or tools and instead can hop right into deploying the malware .


It will also take a photo using the device ’ s front camera when the user wakes the device . The ScarCruft group keeps expanding its exfiltration targets to steal further information from infected hosts and continues to create tools for additional data exfiltration . The second module is used by the operators to execute an obfuscated PowerShell script , which contains a Meterpreter downloader widely known as “ Tinymet “ . For the actors and groups who originally created the malware , it is a more reliable income stream for them .


Apart from collecting the above data , the spyware monitors users ’ phone calls , records them , and saves the recorded file on the device . We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester . This downloader , seen in past FIN7 campaigns , downloads a one-byte XOR encrypted ( eg. with the key equal to 0x50 or 0x51 ) piece of meterpreter shellcode to execute . Usually , they ’d have to hope a successful attack leads to a ransom payment or some sort of other financial windfall .


GolfSpy encrypts all the stolen data using a simple XOR operation with a pre-configured key before sending it to the C & C server using the HTTP POST method . We believe they may have some links to North Korea , which may explain why ScarCruft decided to closely monitor them . The third module allows the operators to take a screenshot of the remote system . Instead , they can make money by marketing their services to other bad actors for a fee .


Figure 5 . ScarCruft also attacked a diplomatic agency in Hong Kong , and another diplomatic agency in North Korea . To do that , it also drops a PowerShell script on the workstation to execute . • Bad actors who want to get into the cyber attack business need little to no technical skills to get started .


Code snippets showing how GolfSpy monitors phone calls via register receiver ( top left ) , its actions when the device is woken up ( top right ) , and how it encrypts the stolen data ( bottom ) The malware retrieves commands from the C & C server via HTTP , and attackers can steal specific files on the infected device . It appears ScarCruft is primarily targeting intelligence for political and diplomatic purposes . The script executes an open-source .NET class used for taking a screenshot . When an attacker pays for an as - a - service malware , they often get an individual login with dedicated customer support , much like any user would with a legitimate piece of software .


The command is a constructed string split into three parts using " " as a separator . ScarCruft infected this victim on September 21 , 2018 . The resulting screenshot is saved at “ %TMP%/image.png ” , sent back to the attackers by the GRIFFON implant and then deleted . As Nick Biasini explained in a past episode of Talos Takes , name recognition also plays a major part in the rising popularity of this business model .


The first part is the target directory , the second is a regular expression used to match specific files , while the last part is an ID . But before the ScarCruft infection , however , another APT group also targeted this victim with the host being infected with GreezeBackdoor on March 26 , 2018 . The last retrieved module is a persistence module . Lesser - known threat actors want to piggyback off having a big name associated with them , like DarkSide , to intimidate their actors or lend more credence to the effectiveness of their threats .


Figure 6 . ScarCruft has a keen interest in North Korean affairs , attacking those in the business sector who may have any connection to North Korea , as well as diplomatic agencies around the globe . If the victim appears valuable to the attackers , a GRIFFON implant installer is pushed to the victim’s workstation . Cisco Talos researchers recently discovered Greatness , one of the most advanced phishing - as - a - service tools ever seen in the wild .


Example of a command that steals specific files from an infected device ’ s application ( top ) , and GolfSpy ’ s parse-and-perform command ( bottom ) Apart from the HTTP POST method , GolfSpy also creates a socket connection to the remote C & C server in order to receive and perform additional commands . Earlier this month , we caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . This module stores another instance of the GRIFFON implant inside the registry to achieve persistence . Our analysis indicates that attackers may have been using attackers since mid-2022 .


Stolen data will also be encrypted and sent to the C & C server via the socket connection . ScarCruft is a relatively new APT group ; victims have been observed in several countries , including Russia , Nepal , South Korea , China , India , Kuwait and Romania . Here is a PowerLinks style method used by the attackers to achieve persistence and execute the GRIFFON implant at each user logon . Greatness offers the ability for users to bypass targets ’ multi - factor authentication protections , IP filtering and integration with Telegram bots .


The encryption key is different from the one used for sending stolen data via HTTP . Currently , the group is engaged in two major operations : Operation Daybreak and Operation Erebus . The new GRIFFON implant is written to the hard drive before each execution , limiting the “ file-less ” aspect of this method . Greatness incorporates features seen in some of the most advanced PaaS offerings , such as multi - factor authentication ( MFA ) bypass , IP filtering and integration with Telegram bots .


Figure 7 . The other one , ScarCruft 's Operation Erebus employs an older exploit , for CVE-2016-4117 and leverages watering holes . Through its light weight and modular architecture , the GRIFFON implant is the perfect validator . Greatness , for now , is only focused on Microsoft 365 phishing pages , providing its affiliates with an attachment and link builder that creates highly convincing decoy and login pages .


The additional commands that attackers can carry out via a socket connection ( top ) and the key used to encrypt the stolen data ( bottom ) Correlating Bouncing Golf 's Activities We monitored Bouncing Golf ’ s C & C-related activities and saw that the campaign has affected more than 660 devices as of this writing . The other one , " Operation Erebus " employs an older exploit , for CVE-2016-4117 and leverages watering holes . Even though we have been able to retrieve four different modules , it is possible that the FIN7 operators have more modules in their toolsets for achieving their objectives on the victim’s workstation . It contains features such as having the victim ’s email address pre - filled and displaying their appropriate company logo and background image , extracted from the target organization ’s real Microsoft 365 login page .


The small or limited number is understandable given the nature of this campaign , but we also expect it to increase or even diversify in terms of distribution . We will publish more details about the attack once Adobe patches the vulnerability , which should be on June 16 . Attackers make mistakes , and FIN7 are no exception . This makes Greatness particularly well - suited for phishing business users .


Most of the affected devices were located in the Middle East , and many of the stolen data we saw is military-related ( e.g. , images , documents ) . The ScarCruft APT gang has made use of a Flash zero day patched Thursday by Adobe to attack more than two dozen high-profile targets in Russia and Asia primarily . The major error made by its operators allowed us to follow the command and control server of the GRIFFON implant last year . Any Greatness affiliates do n’t need a specific set of skills .


Bouncing Golf ’ s operators also try to cover their tracks . Adobe on Thursday patched a zero-day vulnerability in Flash Player that has been used in targeted attacks carried out by a new APT group operating primarily against high-profile victims in Russia and Asia . In order to trick blue teams and other DFIR analysts , the operators created fake HTTP 302 redirection to various Google services on their C2s servers . All they need to do is deploy and configure the provided phishing kit with an API key .


The registrant contact details of the C & C domains used in the campaign , for instance , were masked . Researchers at Kaspersky Lab privately disclosed the flaw to Adobe after exploits against the zero-day were used in March by the ScarCruft APT gang in what Kaspersky Lab is calling Operation Daybreak . This error allowed us to follow the infrastructure week by week , until an individual pushed on Twitter the heuristic to track their C2 at the end of December 2018 . If used successfully , the attacker can set up a proxy Microsoft 365 authentication system and steal a victim ’s authentication credentials or cookies with a “ man - in - the - middle " attack .


The C & C server IP addresses used also appear to be disparate , as they were located in many European countries like Russia , France , Holland , and Germany . Kaspersky speculates that ScarCruft could also be behind another zero-day , CVE-2016-0147 , a vulnerability in Microsoft XML Core Services that was patched in April . A few days after the tweet , in January 2019 , the operators changed their landing page in order to prevent this type of tracking against their infrastructure . Greatness is specifically designed to work in a standardized way so that the experience is the same for each customer who buys into the service , potentially allowing anyone with a moderate amount of technical ability to carry out advanced , convincing phishing attacks .


It ’ s not a definite correlation , but Bouncing Golf also seems to have a connection with Domestic Kitten due to similarities we found in their code . Attacks start with spear-phishing emails that include a link to a website hosting an exploit kit associated with ScarCruft and used in other attacks . During the investigation related to the GRIFFON infrastructure , we found a strange overlap between the WHOIS record of an old GRIFFON C2 and the website of a fake company . Since as - a - service or commodity malware can include all types of malware , it can be tough to provide specific advice for detection and prevention .


For example , the Android malware that both deploy share the same strings of code for their decoding algorithm . Another set of attacks called Operation Erebus leverages another Flash exploit , CVE-2016-4117 , and relies on watering hole attacks as a means of propagation . According to the website , that domain supposedly belongs to a legitimate security company “ fully owned by the Russian Government ” ( sic . ) and having offices in “ Moscow , Saint Petersburg and Yekaterinburg ” , but the address says the company is located in Trump Tower , in New York . For Greatness specifically , anyone implementing multi - factor authentication should opt for code - based authentication through their MFA app of choice , such as Cisco Duo , rather than the easier - to - break method of a simple “ yes ” or “ no ” push notification .


The data that Domestic Kitten steals follows a similar format with Bouncing Golf ’ s , with each type of data having a unique identifying character . Thursday 's Flash Player update patched 36 vulnerabilities in total including the zero day CVE-2016-4171 . Given FIN7 ’s previous use of false security companies , we decided to look deeper into this one . Adversaries may attempt to hide artifacts associated with their behaviors to evade detection .


It ’ s also worth noting that both campaigns repackage apps that are commonly used in their target ’ s countries , such as Telegram , Kik , and Plus messaging apps . The ongoing operation likely began as early as January 2017 and has continued through the first quarter of 2019 . As we were looking at the content of the website , it became evident that almost all of the text used was lifted from legitimate security-company websites . Operating systems may have features to hide various artifacts , such as important system files and administrative task execution , to avoid disrupting user work environments and prevent users from changing files or features on the system .


Figure 8 . Cisco Talos assess with high confidence that these operations are distinctly different and independent from the operations performed by DNSpionage , which we reported on in November 2018 . Phrases and sentences were borrowed from at least the following companies/sites : DKSec – www.dksec.com , OKIOK – www.okiok.com/services/tailored-solutions , MainNerve – www.mainnerve.com , Datics – www.datatics.com/cyber-security , Perspective Risk – www.perspectiverisk.com , Synack – https://www.synack.com/company , FireEye – https://www.fireeye.com/services/penetration-testing.html . Adversaries may abuse these features to hide artifacts such as files , directories , user accounts , or other system activity to evade detection.[1][2][3 ]


Code snippets showing : the decoding algorithm shared by both Bouncing Golf and Domestic Kitten ( top ) , the format of data that Domestic Kitten ’ s malware targets to steal ( center ) , and how both Bouncing Golf ( bottom left ) and Domestic Kitten ( bottom right ) use " " as a separator in their command strings . We assess with high confidence that these operations are distinctly different and independent from the operations performed by DNSpionage , which we reported on in November 2018 . This company seems to have been used by the FIN7 threat actor to hire new people as translators , developers and pentesters . Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation , such as through the use of virtualization technology.[4 ] Bundlore uses the mktemp utility to make unique file and directory names for payloads , such as TMP_DIR=`mktemp


As we ’ ve seen in last year ’ s mobile threat landscape , we expect more cyberespionage campaigns targeting the mobile platform given its ubiquity , employing tried-and-tested techniques to lure unwitting users . The common use of the Enfal Trojan suggests that Shadow Network may be exchanging tools and techniques . During our research , we found various job advertisements associated with the company on freelance and remote-work websites . DarkTortilla has used % HiddenReg%


The extent of information that these kinds of threats can steal is also significant , as it lets attackers virtually take over a compromised device . While Silence had previously targeted Russian banks , Group-IB experts also have discovered evidence of the group 's activity in more than 25 countries worldwide . While tracking numerous threat actors on a daily basis during the final days of 2018 and at the beginning of 2019 , we discovered various activity clusters sharing certain TTPs associated with the FIN7 intrusion set . and % HiddenKey% as part of its persistence via the Windows registry.[6 ] OSX / Shlayer has used the mktemp utility to make random and unique filenames for payloads , such as export tmpDir="$(mktemp -d /tmp / XXXXXXXXXXXX ) " or mktemp -t Installer .


Users should adopt best practices , while organizations should ensure that they balance the need for mobility and the importance of security . In August 2017 , the National Bank of Ukraine warned state-owned and private banks across the country about a large-scale phishing attack . The link between these threat actors and FIN7 is still weak , but we decided to disclose a few hints regarding these in this blog post . Tarrask is able to create " hidden " scheduled tasks by deleting the Security Descriptor ( SD ) registry value.[9 ] WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it 's attempts to elevate privileges through IFileOperation .


End users and enterprises can also benefit from multilayered mobile security solutions such as Trend Micro™ Mobile Security™ . The threat actor used an exploit from the arsenal of the state-sponsored hacker group APT28 . In his history , FIN7 has overlapped several times with Cobalt S-MAL/EmpireMonkey in terms of TTPs . This type of attack technique can not be easily mitigated with preventive controls since it is based on the abuse of system features .


Trend Micro™ Mobile Security for Enterprise provides device , compliance and application management , data protection , and configuration provisioning , as well as protects devices from attacks that exploit vulnerabilities , preventing unauthorized access to apps , and detecting and blocking malware and fraudulent websites . The new threat actor group was eventually named Silence . This activity cluster , which Kaspersky Lab has followed for a few years , uses various implants for targeting mainly banks , and developers of banking and money processing software solutions . for third - party application logging , messaging , and/or other artifacts that may attempt to hide artifacts associated with their behaviors to evade detection .


Trend Micro ’ s Mobile App Reputation Service ( MARS ) covers Android and iOS threats using leading sandbox and machine learning technologies , protecting devices against malware , zero-day and known exploits , privacy leaks , and application vulnerabilities . Silence is a group of Russian-speaking hackers , based on their commands language , the location of infrastructure they used , and the geography of their targets ( Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan ) . At the end of 2018 , the cluster started to use not only CobaltStrike but also Powershell Empire in order to gain a foothold on the victims’ networks . Monitor executed commands and arguments that may attempt to hide artifacts associated with their behaviors to evade detection .


Several weeks ago , Check Point Mobile Threat Prevention detected and quarantined the Android device of an unsuspecting customer employee who downloaded and installed a 0day mobile ransomware from Google Play dubbed “ Charger. ” This incident demonstrates how malware can be a dangerous threat to your business , and how advanced behavioral detection fills mobile security gaps attackers use to penetrate entire networks . Although Silence 's phishing emails were also sent to bank employees in Central and Western Europe , Africa , and Asia ) . After a successful penetration , it uses its own backdoors and the CobaltStrike framework or Powershell Empire components to hop to interesting parts of the network , where it can monetize its access . Monitor for newly constructed files that may attempt to hide artifacts associated with their behaviors to evade detection .


Charger was found embedded in an app called EnergyRescue . Silence also used Russian-language web hosting services . FIN7 ’s last campaigns were targeting banks in Europe and Central America . Monitor for contextual data about a file , which may include information such as name , the content ( ex : signature , headers , or data / media ) , user / ower , permissions that may attempt to hide artifacts associated with their behaviors to evade detection .


The infected app steals contacts and SMS messages from the user ’ s device and asks for admin permissions . Financially motivated APT groups which focus efforts on targeted attacks on the financial sector such as — Anunak , Corkow , Buhtrap — usually managed botnets using developed or modified banking Trojans . This threat actor stole suspected of stealing €13 million from Bank of Valetta , Malta earlier this year . Monitor for changes made to files that may attempt to hide artifacts associated with their behaviors to evade detection .


If granted , the ransomware locks the device and displays a message demanding payment : You need to pay for us , otherwise we will sell portion of your personal information on black market every 30 minutes . They tried new techniques to steal from banking systems , including AWS CBR ( the Russian Central Bank 's Automated Workstation Client ) , ATMs , and card processing . A few interesting overlaps in recent FIN7 campaigns : Both used macros to copy wscript.exe to another file , which began with “ ms ” ( mses.exe – FIN7 , msutil.exe – EmpireMonkey ) . Monitor for changes made to firewall rules for unexpected modifications to allow / block specific network traffic that may attempt to hide artifacts associated with their behaviors to evade detection .


WE GIVE 100 % GUARANTEE THAT ALL FILES WILL RESTORE AFTER WE RECEIVE PAYMENT . Group-IB researchers were tracking Silence throughout this period and conducting response following incidents in the financial sector . Both executed a JScript file named “ error ” in %TEMP% ( Errors.txt in the case of FIN7 , Errors.bat for EmpireMonkey ) . Monitor for API calls that may attempt to hide artifacts associated with their behaviors to evade detection .


WE WILL UNLOCK THE MOBILE DEVICE AND DELETE ALL YOUR DATA FROM OUR SERVER ! Group-IB detected the first incidents relating to Silence in June 2016 . Both used DocuSign decoy documents with different macros . Monitor newly executed processes that may attempt to hide artifacts associated with their behaviors to evade detection .


TURNING OFF YOUR PHONE IS MEANINGLESS , ALL YOUR DATA IS ALREADY STORED ON OUR SERVERS ! One of Silence 's first targets was a Russian bank , when they tried to attack AWS CBR . The macros popped the same “ Document decryption error ” error message—even if macro code remain totally different . Monitor for any attempts to enable scripts running on a system would be considered suspicious .


WE STILL CAN SELLING IT FOR SPAM , FAKE , BANK CRIME etc… We collect and download all of your personal data . They are selective in their attacks and wait for about three months between incidents , which is approximately three times longer than other financially motivated APT groups , like MoneyTaker , Anunak ( Carbanak ) , Buhtrap or Cobalt . We have a high level of confidence in a historic association between FIN7 and Cobalt , even though we believe that these two clusters of activity are operated by different teams . If scripts are not commonly used on a system , but enabled , scripts running out of cycle from patching or other administrator functions are suspicious .


All information about your social networks , Bank accounts , Credit Cards . Silence try to apply new techniques and ways of stealing from various banking systems , including AWS CBR , ATMs , and card processing . AveMaria is a new botnet , whose first version we found in September 2018 , right after the arrests of the FIN7 members . Scripts should be captured from the file system when possible to determine their actions and intent .


We collect all data about your friends and family . Silence 's successful attacks currently have been limited to the CIS and Eastern European countries . We have medium confidence that this botnet falls under the FIN7 umbrella . Monitor for newly constructed services / daemons that may attempt to hide artifacts associated with their behaviors to evade detection .