Much like the observers watching the shadows of objects cast upon the wall of the cave , these two definitions ( XENOTIME and TEMP.Veles , both presumably referring to “ the TRITON actor ” ) describe the same phenomena , yet at the same time appear different .


This question of perception and accuracy rests upon the underlying epistemic framework and the goal conceived for that framework in defining an adversary : FireEye ’s methodology follows a deductive approach requiring the collection of significant evidence over time to yield a conclusion that will be necessary given the premises ( the totality of evidence suggests APTxx ) ; the Dragos approach instead seeks an inductive approach , where premises may all be true but the conclusion need not necessarily follow from them given changes in premises over time or other observations not contained within the set ( thus , identified behaviors strongly suggests an activity group , defined as X ) .


From an external analysts ’ point of view , the wonder is , which is superior to the other .


And my answer for this is : neither is perfect , but both are useful – depending upon your goals and objectives .


But rather than trying to pursue some comparison between the two for identification of superiority ( an approach that will result in unproductive argument and social media warring ) , the point of this post is to highlight the distinctions between these approaches and how – in the case of “ the TRITON actor ” – they result in noticeably different conclusions from similar datasets .


One reason for the distinction may be differences in evidence , as FireEye ’s public reporting notes two distinct events of which they are aware of and have responded to related to “ the TRITON actor ” while Dragos has been engaged several instances – thus , Dragos would possess more evidence to cement the definition of an activity group , while FireEye ’s data collection-centric approach would require far more observations to yield an “ APT ” .


Yet irrespective of this , it is confusing why the previously-declared “ TEMP ” category was walked back as this has led to not small amount of confusion – in both technical and non-technical audiences – as to just what FireEye ’s blog post refers .


Thus respected journalists ( at least by me ) conflate the “ TRITON actor is active at another site ” with “ TRITON malware was identified at another site ” .


In this case , we ’re seeing a definite problem with the overly-conservative naming approach used as it engenders confusion in a significant subset of the intended audience .


While some may dismiss adversary or activity naming as so much marketing , having a distinct label for something allows for clearer communication and more accurate discussion .


Furthermore , conflating adversaries with tools , since tools can be repurposed or used by other entities than those first observed deploying them , leads to further potential confusion as the “ X actor ” is quickly compressed in the minds of some to refer to any and all instantiations of tool “ X ” .


Overall , the discussion above may appear so much splitting of hairs or determining how many angels can dance on the head of a pin – yet given the communicative impacts behind different naming and labeling conventions , this exploration seems not merely useful but necessary .


Understanding the “ how ” and “ why ” behind different entity classifications of similar ( or even the same ) activity allows us to move beyond the dismissive approach of “ everyone has their names for marketing purposes ” to a more productive mindset that grasps the fundamental methodologies that ( should ) drive these decisions .


TRITON Attribution : Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers .


In a previous blog post we detailed the TRITON intrusion that impacted industrial control systems ( ICS ) at a critical infrastructure facility .


We now track this activity set as TEMP.Veles .


In this blog post we provide additional information linking TEMP.Veles and their activity surrounding the TRITON intrusion to a Russian government-owned research institute .


FireEye Intelligence assesses with high confidence that intrusion activity that led to deployment of TRITON was supported by the Central Scientific Research Institute of Chemistry and Mechanics ( CNIIHM ; a.k.a. ЦНИИХМ ) , a Russian government-owned technical research institution located in Moscow .


The following factors supporting this assessment are further detailed in this post .


We present as much public information as possible to support this assessment , but withheld sensitive information that further contributes to our high confidence assessment .


FireEye uncovered malware development activity that is very likely supporting TEMP.Veles activity .


This includes testing multiple versions of malicious software , some of which were used by TEMP.Veles during the TRITON intrusion .


Investigation of this testing activity reveals multiple independent ties to Russia , CNIIHM , and a specific person in Moscow .


This person ’s online activity shows significant links to CNIIHM .


An IP address registered to CNIIHM has been employed by TEMP.Veles for multiple purposes , including monitoring open-source coverage of TRITON , network reconnaissance , and malicious activity in support of the TRITON intrusion .


Behavior patterns observed in TEMP.Veles activity are consistent with the Moscow time zone , where CNIIHM is located .


We judge that CNIIHM likely possesses the necessary institutional knowledge and personnel to assist in the orchestration and development of TRITON and TEMP.Veles operations .


While we cannot rule out the possibility that one or more CNIIHM employees could have conducted TEMP.Veles activity without their employer ’s approval , the details shared in this post demonstrate that this explanation is less plausible than TEMP.Veles operating with the support of the institute .


During our investigation of TEMP.Veles activity , we found multiple unique tools that the group deployed in the target environment .


Some of these same tools , identified by hash , were evaluated in a malware testing environment by a single user .


Malware Testing Environment Tied to TEMP.Veles .


We identified a malware testing environment that we assess with high confidence was used to refine some TEMP.Veles tools .


At times , the use of this malware testing environment correlates to in-network activities of TEMP.Veles , demonstrating direct operational support for intrusion activity .


Four files tested in 2014 are based on the open-source project , cryptcat .


Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates .


One of these files was deployed in a TEMP.Veles target ’s network .


The compiled version with the least detections was later re-tested in 2017 and deployed less than a week later during TEMP.Veles activities in the target environment .


TEMP.Veles ’ lateral movement activities used a publicly-available PowerShell based tool , WMImplant .


On multiple dates in 2017 , TEMP.Veles struggled to execute this utility on multiple victim systems , potentially due to AV detection .


Soon after , the customized utility was again evaluated in the malware testing environment .


The following day , TEMP.Veles again tried the utility on a compromised system .


The user has been active in the malware testing environment since at least 2013 , testing customized versions of multiple open-source frameworks , including Metasploit , Cobalt Strike , PowerSploit , and other projects .


The user ’s development patterns appear to pay particular attention to AV evasion and alternative code execution techniques .


Custom payloads utilized by TEMP.Veles in investigations conducted by Mandiant are typically weaponized versions of legitimate open-source software , retrofitted with code used for command and control .


Testing , Malware Artifacts , and Malicious Activity Suggests Tie to CNIIHM .


Multiple factors suggest that this activity is Russian in origin and associated with CNIIHM .


A PDB path contained in a tested file contained a string that appears to be a unique handle or user name .


This moniker is linked to a Russia based person active in Russian information security communities since at least 2011 .


The handle has been credited with vulnerability research contributions to the Russian version of Hacker Magazine ( хакер ) .


According to a now-defunct social media profile , the same individual was a professor at CNIIHM , which is located near Nagatinskaya Street in the Nagatino-Sadovniki district of Moscow .


Another profile using the handle on a Russian social network currently shows multiple photos of the user in proximity to Moscow for the entire history of the profile .


Suspected TEMP.Veles incidents include malicious activity originating from 87.245.143.140 , which is registered to CNIIHM .


This IP address has been used to monitor open-source coverage of TRITON , heightening the probability of an interest by unknown subjects , originating from this network , in TEMP.Veles related activities .


It also has engaged in network reconnaissance against targets of interest to TEMP.Veles .


The IP address has been tied to additional malicious activity in support of the TRITON intrusion .


Multiple files have Cyrillic names and artifacts .


Adversary behavioral artifacts further suggest the TEMP.Veles operators are based in Moscow , lending some further support to the scenario that CNIIHM , a Russian research organization in Moscow , has been involved in TEMP.Veles activity .


We identified file creation times for numerous files that TEMP.Veles created during lateral movement on a target ’s network .


These file creation times conform to a work schedule typical of an actor operating within a UTC+3 time zone supporting a proximity to Moscow .


Additional language artifacts recovered from TEMP.Veles toolsets are also consistent with such a regional nexus .


A ZIP archive recovered during our investigations , schtasks.zip , contained an installer and uninstaller of CATRUNNER that includes two versions of an XML scheduled task definitions for a masquerading service ‘ ProgramDataUpdater . ’ The malicious installation version has a task name and description in English , and the clean uninstall version has a task name and description in Cyrillic .


The timeline of modification dates within the ZIP also suggest the actor changed the Russian version to English in sequential order , heightening the possibility of a deliberate effort to mask its origins .


While we know that TEMP.Veles deployed the TRITON attack framework , we do not have specific evidence to prove that CNIIHM did ( or did not ) develop the tool .


We infer that CNIIHM likely maintains the institutional expertise needed to develop and prototype TRITON based on the institute ’s self-described mission and other public information .


CNIIHM has at least two research divisions that are experienced in critical infrastructure , enterprise safety , and the development of weapons/military equipment :


The Center for Applied Research creates means and methods for protecting critical infrastructure from destructive information and technological impacts .


The Center for Experimental Mechanical Engineering develops weapons as well as military and special equipment .


It also researches methods for enabling enterprise safety in emergency situations .


CNIIHM officially collaborates with other national technology and development organizations , including :


The Moscow Institute of Physics and Technology ( PsyTech ) , which specializes in applied physics , computing science , chemistry , and biology .


The Association of State Scientific Centers “ Nauka , ” which coordinates 43 Scientific Centers of the Russian Federation ( SSC RF ) .


Some of its main areas of interest include nuclear physics , computer science and instrumentation , robotics and engineering , and electrical engineering , among others .


The Federal Service for Technical and Export Control ( FTEC ) which is responsible for export control , intellectual property , and protecting confidential information .


The Russian Academy of Missile and Artillery Sciences ( PAPAH ) which specializes in research and development for strengthening Russia ’s defense industrial complex .


Information from a Russian recruitment website , linked to CNIIHM ’s official domain , indicates that CNIIHM is also dedicated to the development of intelligent systems for computer-aided design and control , and the creation of new information technologies .


Some possibility remains that one or more CNIIHM employees could have conducted the activity linking TEMP.Veles to CNIIHM without their employer ’s approval .


However , this scenario is highly unlikely .


In this scenario , one or more persons – likely including at least one CNIIHM employee , based on the moniker discussed above – would have had to conduct extensive , high-risk malware development and intrusion activity from CNIIHM ’s address space without CNIIHM ’s knowledge and approval over multiple years .


CNIIHM ’s characteristics are consistent with what we might expect of an organization responsible for TEMP.Veles activity .


TRITON is a highly specialized framework whose development would be within the capability of a low percentage of intrusion operators .


Xenotime .


Release_Time : unknown


Report_URL : https://dragos.com/resource/xenotime/


XENOTIME is easily the most dangerous threat activity publicly known .


It is the only activity group intentionally compromising and disrupting industrial safety instrumented systems , which can lead to scenarios involving loss of life and environmental damage .


Dragos identified several compromises of ICS vendors and manufacturers in 2018 by activity associated with XENOTIME , providing potential supply chain threat opportunities and vendor-enabled access to asset owner and operator ICS networks .


XENOTIME rose to prominence in December 2017 when Dragos and FireEye jointly published details of TRISIS destructive malware targeting Schneider Electric ’s Triconex safety instrumented system .


The multi-step malware framework caused industrial systems in a Middle Eastern industrial facility to shut down .


The incident represented a shift in the capabilities and consequences of ICS malware .


TRISIS was an escalation of the type of attacks historically targeting ICS systems .


Targeting a safety system indicates significant damage and loss of human life were either intentional or acceptable goals of the attack , a consequence not seen in previous disruptive attacks such as the 2016 CRASHOVERRIDE malware that caused a power loss in Ukraine .


Note : Industrial safety instrumented systems comprise part of a multi-layer engineered process control framework to protect life and environment .


Industrial safety systems are highly redundant and separate controls which override and manage industrial processes if they approach unsafe conditions such as over-pressurization , overspeed , or over-heating .


They enable engineers and operators to safely control and possibly shutdown processes before a major incident occurs .


They ’re a critical component of many dangerous industrial environments such as electric power generation and oil and gas processing .


XENOTIME configured TRISIS based on the specifics and functions of the Triconex system within the industrial control ( ICS ) environment .


XENOTIME used credential capture and replay to move between networks , Windows commands , standard command-line tools such as PSExec , and proprietary tools for operations on victim hosts . ( Full reports detailing XENOTIME ’s tool techniques , and procedures are available to Dragos WorldView customers . ) Because the TRISIS malware framework was highly tailored , it would have required specific knowledge of the Triconex ’s infrastructure and processes within a specific plant .


This means it ’s not easy to scale—however , the malware provides a blueprint of how to target safety instrumented systems .


This tradecraft is thus scalable and available to others even if the malware itself changes .


Dragos ’ data indicates XENOTIME remains active .


Furthermore , Dragos ’ analysis of the TRISIS event continues as we recover additional data surrounding the incident .


Dragos assesses with moderate confidence that XENOTIME intends to establish required access and capability to cause a potential , future disruptive—or even destructive—event .


Compromising safety systems provides little value outside of disrupting operations .


The group created a custom malware framework and tailormade credential gathering tools , but an apparent misconfiguration prevented the attack from executing properly .


As XENOTIME matures , it is less likely that the group will make this mistake in the future .


XENOTIME operates globally , impacting regions far outside of the Middle East , their initial target .


Intelligence suggests the group has been active since at least 2014 and is presently operating in multiple facilities targeting safety systems beyond Triconex .


This group has no known associations to other activity groups .


Dragos threat intelligence leverages the Dragos Platform , our threat operations center , and other sources to provide comprehensive insight into threats affecting industrial control security and safety worldwide .


Dragos does not corroborate nor conduct political attribution to threat activity .


Dragos instead focuses on threat behaviors and appropriate detection and response .


Read more about Dragos ’ approach to categorizing threat activity and attribution .


Dragos does not publicly describe ICS activity group technical details except in extraordinary circumstances in order to limit tradecraft proliferation .


However , full details on XENOTIME and other group tools , techniques , procedures , and infrastructure is available to network defenders via Dragos WorldView .


Threat Group 3390 Cyberespionage .


Dell SecureWorks Counter Threat Unit (TM ) ( CTU ) researchers investigated activities associated with Threat Group-3390 ( TG-3390 ) .


Analysis of TG-3390 's operations , targeting , and tools led CTU researchers to assess with moderate confidence the group is located in the People's Republic of China .


The threat actors target a wide range of organizations : CTU researchers have observed TG-3390 actors obtaining confidential data on defense manufacturing projects , but also targeting other industry verticals and attacking organizations involved in international relations .


The group extensively uses long-running strategic web compromises ( SWCs ) , and relies on whitelists to deliver payloads to select victims .


In comparison to other threat groups , TG-3390 is notable for its tendency to compromise Microsoft Exchange servers using a custom backdoor and credential logger .


CTU researchers divided the threat intelligence about TG-3390 into two sections : strategic and tactical .


Strategic threat intelligence includes an assessment of the ongoing threat posed by the threat group .


Executives can use this assessment to determine how to reduce risk to their organization's mission and critical assets .


Tactical threat intelligence is based on incident response investigations and research , and is mapped to the kill chain .


Computer network defenders can use this information to reduce the time and effort associated with responding to TG-3390 .


CTU researchers assess with moderate confidence that TG-3390 is based in the People's Republic of China .


CTU researchers have evidence that the threat group compromised U.S. and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations .


Based on analysis of the group's SWCs , TG-3390 operations likely affect organizations in other countries and verticals .


TG-3390 operates a broad and long-running campaign of SWCs and has compromised approximately 100 websites as of this publication .


Through an IP address whitelisting process , the threat group selectively targets visitors to these websites .


After the initial compromise , TG-3390 delivers the HttpBrowser backdoor to its victims .


The threat actors then move quickly to compromise Microsoft Exchange servers and to gain complete control of the target environment .


The threat actors are adept at identifying key data stores and selectively exfiltrating all of the high-value information associated with their goal .


CTU researchers recommend the following practices to prevent or detect TG-3390 intrusions :


Search web log files for evidence of web server scanning using the URIs listed in the Exploitation section and evidence of Exfiltration using the User-Agent in the Actions on objective section .


Require two-factor authentication for all remote access solutions , including OWA .


Audit ISAPI filters and search for web shells on Microsoft Exchange servers .


CTU researchers infer intent by aggregating observations , analyzing a threat group's activity , and placing the information in a wider context .


Like many threat groups , TG-3390 conducts strategic web compromises ( SWCs ) , also known as watering hole attacks , on websites associated with the target organization's vertical or demographic to increase the likelihood of finding victims with relevant information .


CTU researchers assess with high confidence that TG-3390 uses information gathered from prior reconnaissance activities to selectively compromise users who visit websites under its control .


Most websites compromised by TG-3390 actors are affiliated with five types of organizations around the world :


large manufacturing companies , particularly those supplying defense organizations , energy companies , embassies in Washington , DC representing countries in the Middle East , Europe , and Asia , likely to target U.S. based users involved in international relations , non-governmental organizations ( NGOs ) , particularly those focused on international relations and defense , government organizations .


Based on this information , CTU researchers assess that TG-3390 aims to collect defense technology and capability intelligence , other industrial intelligence , and political intelligence from governments and NGOs .


To assess attribution , CTU researchers analyze observed activity , third-party reporting , and contextual intelligence .


For the following reasons , CTU researchers assess with moderate confidence that TG-3390 has a Chinese nexus :


The SWC of a Uyghur cultural website suggests intent to target the Uyghur ethnic group , a Muslim minority group primarily found in the Xinjiang region of China .


Threat groups outside of China are unlikely to target the Uyghur people .


TG-3390 uses the PlugX remote access tool .


The menus for PlugX 's server-side component are written exclusively in Standard Chinese ( Mandarin ) , suggesting that PlugX operators are familiar with this language .


CTU researchers have observed TG-3390 activity between 04:00 and 09:00 UTC , which is 12:00 to 17:00 local time in China ( UTC +8 ) .


The timeframe maps to the second half of the workday in China .


The threat actors have used the Baidu search engine , which is only available in Chinese , to conduct reconnaissance activities .


CTU researchers have observed the threat group obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both .


CTU researchers recognize that the evidence supporting this attribution is circumstantial .


It is possible that TG-3390 is false-flag operation by a threat group outside of China that is deliberately planting indications of a Chinese origin .


TG-3390 has access to proprietary tools , some of which are used exclusively by TG-3390 and others that are shared among a few Chinese threat groups .


The complexity and continual development of these tools indicates a mature development process .


TG-3390 can quickly leverage compromised network infrastructure during an operation and can conduct simultaneous intrusions into multiple environments .


This ability is further demonstrated by analysis of interactions between TG-3390 operators and a target environment .


CTU researchers found no evidence of multiple operators working simultaneously against a single organization .


This efficiency of operation ( a 1:1 ratio of operator to observed activity ) suggests that TG-3390 can scale to conduct the maximum number of simultaneous operations .


These characteristics suggest that the threat group is well resourced and has access to a tools development team and a team focused on SWCs .


TG-3390 's obfuscation techniques in SWCs complicate detection of malicious web traffic redirects .


Malware used by the threat group can be configured to bypass network-based detection ; however , the threat actors rarely modify host-based configuration settings when deploying payloads .


CTU researchers have observed the threat actors installing a credential logger and backdoor on Microsoft Exchange servers , which requires a technical grasp of Internet Information Services ( IIS ) .


TG-3390 uses older exploits to compromise targets , and CTU researchers have not observed the threat actors using zero-day exploits as of this publication .


The threat actors demonstrated the ability to adapt when reentering a network after an eviction , overcoming technical barriers constructed by network defenders .


In addition to using SWCs to target specific types of organizations , TG-3390 uses spearphishing emails to target specific victims .


CTU researchers assess with high confidence that the threat actors follow an established playbook during an intrusion .


They quickly move away from their initial access vector to hide their entry point and then target Exchange servers as a new access vector .


As of this publication , CTU researchers have not discovered how TG-3390 keeps track of the details associated with its compromised assets and credentials .


However , the threat actors' ability to reuse these assets and credentials , sometimes weeks or months after the initial compromise , indicates the group is disciplined and well organized .


After gaining access to a target network in one intrusion analyzed by CTU researchers , TG-3390 actors identified and exfiltrated data for specific projects run by the target organization , indicating that they successfully obtained the information they sought .


TG-3390 : american.blackcmd.com .


TG-3390 : api.apigmail.com .


TG-3390 : apigmail.com .


TG-3390 : backup.darkhero.org .


TG-3390 : bel.updatawindows.com .


TG-3390 : binary.update-onlines.org .


TG-3390 : blackcmd.com .


TG-3390 : castle.blackcmd.com .


TG-3390 : ctcb.blackcmd.com .


TG-3390 : darkhero.org .


TG-3390 : 208.115.242.36 .


TG-3390 : 208.115.242.37 .


TG-3390 : 208.115.242.38 .


TG-3390 : 66.63.178.142 .


TG-3390 : 72.11.148.220 .


TG-3390 : 72.11.141.133 .


TG-3390 : 74.63.195.236 .


TG-3390 : 74.63.195.237 . 1cb4b74e9d030afbb18accf6ee2bfca1 MD5 hash HttpBrowser RAT dropper . b333b5d541a0488f4e710ae97c46d9c2 MD5 hash HttpBrowser RAT dropper . 86a05dcffe87caf7099dda44d9ec6b48 MD5 hash HttpBrowser RAT dropper . 93e40da0bd78bebe5e1b98c6324e9b5b MD5 hash HttpBrowser RAT dropper . f43d9c3e17e8480a36a62ef869212419 MD5 hash HttpBrowser RAT dropper . 57e85fc30502a925ffed16082718ec6c MD5 hash HttpBrowser RAT dropper . 4251aaf38a485b08d5562c6066370f09 MD5 hash HttpBrowser RAT dropper . bbfd1e703f55ce779b536b5646a0cdc1 MD5 hash HttpBrowser RAT dropper . 12a522cb96700c82dc964197adb57ddf MD5 hash HttpBrowser RAT dropper . 728e5700a401498d91fb83159beec834 MD5 hash HttpBrowser RAT dropper . 2bec1860499aae1dbcc92f48b276f998 MD5 hash HttpBrowser RAT dropper . 014122d7851fa8bf4070a8fc2acd5dc5 MD5 hash HttpBrowser RAT . 0ae996b31a2c3ed3f0bc14c7a96bea38 MD5 hash HttpBrowser RAT . 1a76681986f99b216d5c0f17ccff2a12 MD5 hash HttpBrowser RAT . 380c02b1fd93eb22028862117a2f19e3 MD5 hash HttpBrowser RAT . 40a9a22da928cbb70df48d5a3106d887 MD5 hash HttpBrowser RAT . 46cf2f9b4a4c35b62a32f28ac847c575 MD5 hash HttpBrowser RAT . 5436c3469cb1d87ea404e8989b28758d MD5 hash HttpBrowser RAT . 692cecc94ac440ec673dc69f37bc0409 MD5 hash HttpBrowser RAT .


Living Off the Land .


Release_Time : 2015-05-28


Report_URL : https://www.secureworks.com/blog/living-off-the-land


In over half of the targeted threat response engagements performed by the Dell SecureWorks Counter Threat Unit Special Operations ( CTU-SO ) team in the past year , the threat actors accessed the target environment using compromised credentials and the companies' own virtual private network ( VPN ) or other remote access solutions .


Detecting threat actors who are " living off the land , " using credentials , systems , and tools they collect along the way instead of backdoors , can be challenging for organizations that focus their instrumentation and controls primarily on the detection of malware and indicators such as command and control IP addresses , domains , and protocols .


With their gaps in visibility , these organizations can have a very difficult time distinguishing adversary activity from that of legitimate users , pushing detection times out to weeks , months , or even years .


Recently , CTU researchers responded to an intrusion perpetrated by Threat Group-1314 ( TG-1314 ) , one of numerous threat groups that employ the " living off the land " technique to conduct their intrusions .


In this case , the threat actors used compromised credentials to log into an Internet-facing Citrix server to gain access to the network .


CTU researchers discovered evidence that the threat actors were not only leveraging the company 's remote access infrastructure , but were also using the company 's endpoint management platform , Altiris , to move laterally through the network .


Memory collection and analysis can be an extremely valuable component of an incident response plan and in this case proved crucial in identifying TG-1314 's actions on objective .


Memory collected from systems involved in the intrusion was analyzed using the Volatility framework .


First , Volatility 's pstree plugin , which lists running processes in a tree view , was executed .


The result immediately revealed signs of a suspicious cmd.exe process running as a child of the ACLIENT.EXE process .


CTU researchers immediately recognized suspicious commands , such as changing the working directory to recycler and executing commands from that location , that were unlikely to have been connected to legitimate system administrator operations .


The results also revealed indications that PsExec , a popular system administration tool for executing commands on remote systems , was run against several target hosts to spawn shells on them .


To better understand how the adversary was operating and what other actions they had performed , CTU researchers examined cmd.exe and its supporting processes to uncover additional command line artifacts .


While cmd.exe is a console application , it still requires GUI like functionality and other support to interact with the operating system .


On the Windows XP platform , this support is provided by the csrss.exe process .


Because commands run from cmd.exe are acted on by csrss.exe , additional evidence of command history and responses sent to the cmd console window are often discoverable by analyzing the csrss.exe process 's memory .


The output in Figure 3 shows the Process ID ( PID ) of the csrss.exe process to be 716 .


Running Volatility 's vaddump plugin on this process allowed CTU researchers to obtain the Virtual Address Descriptor ( VAD ) sections .


The relevant strings inside the VAD sections were UTF-16 encoded and revealed additional insights once extracted .


TG-1314 was mapping network drives using a compromised Altiris account to connect to additional systems .


After identifying compromised credentials and executed commands , CTU researchers shifted focus to determine how the threat actors were obtaining the shell and executing their commands on the compromised host .


This exploration required a look at the suspect cmd.exe 's parent process , shown earlier in the investigation to be ACLIENT.EXE .


Volatility 's procdump command was used to dump the executable from memory .


Running the strings utility against the dumped ACLIENT.EXE binary revealed evidence that the file was the Altiris agent .


These results indicated that the threat actors leveraged the Altiris management platform installed at the client site , along with compromised domain credentials associated with the Altiris system , to move laterally within the compromised environment .


Threat groups often follow a path of least resistance to achieve their objective .


They will leverage legitimate remote access solutions for entry and valid system administrator tools for lateral movement , if possible .


To help disrupt this tactic , it is important that organizations implement two-factor authentication for all remote access solutions and consider doing the same for internal , high-value assets like their internal system management consoles .


CTU researchers assess with high confidence that threat groups like TG-1314 will continue to live off of the land to avoid detection and conduct their operations .


APT Targets Financial Analysts with CVE-2017-0199 .


On April 20 , Proofpoint observed a targeted campaign focused on financial analysts working at top global financial firms operating in Russia and neighboring countries .


These analysts were linked by their coverage of the telecommunications industry , making this targeting very similar to , and likely a continuation of , activity described in our “ In Pursuit of Optical Fibers and Troop Intel ” blog .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) .


Proofpoint is tracking this attacker , believed to operate out of China , as TA459 .


The actor typically targets Central Asian countries , Russia , Belarus , Mongolia , and others .


TA549 possesses a diverse malware arsenal including PlugX , NetTraveler , and ZeroT .


In this blog , we also document other 2017 activity so far by this attack group , including their distribution of ZeroT malware and secondary payloads PCrat S-VULNAME/Gh0st .


In this campaign , attackers used a Microsoft Word document called 0721.doc , which exploits CVE-2017-0199 .


This vulnerability was disclosed and patched days prior to this attack .


The document uses the logic flaw to first download the file power.rtf from http://122.9.52.215/news/power.rtf .


The payload is actually an HTML Application ( HTA ) file , not an RTF document .


The HTA ’s VBScript changes the window size and location and then uses PowerShell to download yet another script : power.ps1 .


This is a PowerShell script that downloads and runs the ZeroT payload cgi.exe .


The attack group has made incremental changes to ZeroT since our last analysis .


While they still use RAR SFX format for the initial payloads , ZeroT now uses a the legitimate McAfee utility ( SHA256 3124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe ) named mcut.exe instead of the Norman Safeground AS for sideloading as they have in the past .


The encrypted ZeroT payload , named Mctl.mui , is decoded in memory revealing a similarly tampered PE header and only slightly modified code when compared to ZeroT payloads we analyzed previously .


Once ZeroT is running , we observed that the fake User-Agent used in the requests changed from “ Mozilla/6.0 ( compatible ; MSIE 10.0 ; Windows NT 6.2 ; Tzcdrnt/6.0 ) ” to “ Mozilla/6.0 ( compatible ; MSIE 11.0 ; Windows NT 6.2 ) ” , thus removing the “ Tzcdrnt ” typo observed in previous versions .


The initial beacon to index.php changed to index.txt but ZeroT still expects an RC4 encrypted response using a static key : “ (*^GF (9042&* ” .


Next , ZeroT uses HTTP beacons to transmit information about the infected system to the command and control ( C&C ) .


All posts are encrypted , unlike the last time we analyzed a sample from this actor , when the first POST was accidentally not encrypted .


After that , stage 2 payloads are still retrieved as Bitmap ( BMP ) images that use Least Significant Bit ( LSB ) Steganography to hide the real payloads .


These images appear normal in image viewers .


The stage 2 payload was PlugX that beaconed to C&C servers www.icefirebest.com and www.icekkk.net .


Throughout 2017 we observed this threat actor actively attempting to compromise victims with various malware payloads .


ZeroT remained the primary stage 1 payload , but the stage 2 payloads varied .


One such interesting example was “ ПЛАН_РЕАЛИЗАЦИИ_ПРОЕКТА.rar ” ( SHA256 b5c208e4fb8ba255883f771d384ca85566c7be8adcf5c87114a62efb53b73fda ) .


Translated from Russian , this file is named “ PROJECT_REALIZATION_PLAN.rar ” and contains a compressed .scr executable .


This ZeroT executable communicated with the C&C domain www.kz-info.net and downloaded PlugX as well as an additional PCRat S-VULNAME/Gh0st Trojan which communicated with the www.ruvim.net C&C server .


PCRat S-VULNAME/Gh0st is a payload that we do not see this group using frequently .


Another interesting ZeroT sample ( SHA256 bc2246813d7267608e1a80a04dac32da9115a15b1550b0c4842b9d6e2e7de374 ) contained the executable 0228.exe and a decoy document 0228.doc in the RAR SFX archive .


Bundling decoy documents is a common tactic by this group .


RAR SFX directives are used to display the decoy while the malicious payload is executed .


We suspect that this specific lure was copied from the news article http://www.cis.minsk.by/news.php?id=7557 .


TA459 is well-known for targeting organizations in Russia and neighboring countries .


However , their strategy , tactics , techniques , and procedures in this particular attack emphasize the importance of rigorous patching regimens for all organizations .


Even as software vulnerabilities often take a back seat to human exploits and social engineering , robust defenses must include protection at the email gateway , proactive patch management , and thoughtful end user education .


Paying attention to the details of past attacks is also an important means of preparing for future attacks .


Noting who is targeted , with what malware , and with what types of lures provide clues with which organizations can improve their security posture .


At the same time , multinational organizations like the financial services firms targeted here must be acutely aware of the threats from state-sponsored actors working with sophisticated malware to compromise users and networks .


Ongoing activity from attack groups like TA459 who consistently target individuals specializing in particular areas of research and expertise further complicate an already difficult security situation for organizations dealing with more traditional malware threats , phishing campaigns , and socially engineered threats every day .


Suckfly : Revealing the secret life of your code signing certificates .


Release_Time : 2016-03-15 Report_URL : https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=62e325ae-f551-4855-b9cf-28a7d52d1534&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments


In late 2015 , Symantec identified suspicious activity involving a hacking tool used in a malicious manner against one of our customers .


Normally , this is considered a low-level alert easily defeated by security software .


In this case , however , the hacktool had an unusual characteristic not typically seen with this type of file ; it was signed with a valid code-signing certificate .


Many hacktools are made for less than ethical purposes and are freely available , so this was an initial red flag , which led us to investigate further .


As our investigation continued , we soon realized this was much larger than a few hacktools .


We discovered Suckfly , an advanced threat group , conducting targeted attacks using multiple stolen certificates , as well as hacktools and custom malware .


The group had obtained the certificates through pre-attack operations before commencing targeted attacks against a number of government and commercial organizations spread across multiple continents over a two-year period .


This type of activity and the malicious use of stolen certificates emphasizes the importance of safeguarding certificates to prevent them from being used maliciously .


Suckfly has a number of hacktools and malware varieties at its disposal : Back door , Keylogger , Port scanner , Misc. tool , Exploit , Credential dumper , Privilage escalation .


The first signed hacktool we identified in late 2015 was a digitally signed brute-force server message block ( SMB ) scanner .


The organization associated with this certificate is a South Korean mobile software developer .


While we became initially curious because the hacktool was signed , we became more suspicious when we realized a mobile software developer had signed it , since this is not the type of software typically associated with a mobile application .


Based on this discovery , we began to look for other binaries signed with the South Korean mobile software developer's certificate .


This led to the discovery of three additional hacktools also signed using this certificate .


In addition to being signed with a stolen certificate , the identified hacktools had been used in suspicious activity against a US based health provider operating in India .


This evidence indicates that the certificate ’s rightful owner either misused it or it had been stolen from them .


Symantec worked with the certificate owner to confirm that the hacktool was not associated with them .


Following the trail further , we traced malicious traffic back to where it originated from and looked for additional evidence to indicate that the attacker persistently used the same infrastructure .


We discovered the activity originated from three separate IP addresses , all located in Chengdu , China .


In addition to the traffic originating from Chengdu , we identified a selection of hacktools and malware signed using nine stolen certificates .


The nine stolen certificates originated from nine different companies who are physically located close together around the central districts of Seoul , South Korea .


We don't know the exact date Suckfly stole the certificates from the South Korean organizations .


However , by analyzing the dates when we first saw the certificates paired with hacktools or malware , we can gain insight into when the certificates may have been stolen .


Figure 4 details how many times each stolen certificate was used in a given month .


The first sighting of three of the nine stolen certificates being used maliciously occurred in early 2014 .


Those three certificates were the only ones used in 2014 , making it likely that the other six were not compromised until 2015 .


All nine certificates were used maliciously in 2015 .


As noted earlier , the stolen certificates Symantec identified in this investigation were used to sign both hacking tools and malware .


Further analysis of the malware identified what looks like a custom back door .


We believe Suckfly specifically developed the back door for use in cyberespionage campaigns .


Symantec detects this threat as Backdoor.Nidiran .


Analysis of Nidiran samples determined that the back door had been updated three times since early 2014 , which fits the timeline outlined in Figure 4 .


The modifications were minor and likely performed to add capabilities and avoid detection .


While the malware is custom , it only provides the attackers with standard back door capabilities .


Suckfly delivered Nidiran through a strategic web compromise .


Specifically , the threat group used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows .


This exploit is triggered when a potential victim browses to a malicious page using Internet Explorer , which can allow the attacker to execute code with the same privileges as the currently logged-in user .


Once exploit has been achieved , Nidiran is delivered through a self-extracting executable that extracts the components to a .tmp folder after it has been executed .


The threat then executes “ svchost.exe ” , a PE file , which is actually a clean tool known as OLEVIEW.EXE .


The executable will then load iviewers.dll , which is normally a clean , legitimate file .


Attackers have been known to distribute malicious files masquerading as the legitimate iviewers.dll file and then use DLL load hijacking to execute the malicious code and infect the computer .


This technique is associated with the Korplug S-MAL/Plug-x malware and is frequently used in China based cyberespionage activity .


Suckfly isn’t the only attack group to use certificates to sign malware but they may be the most prolific collectors of them .


After all , Stuxnet , widely regarded as the world ’s first known cyberweapon , was signed using stolen certificates from companies based in Taiwan with dates much earlier than Suckfly .


Other cyberespionage groups , including Black Vine and Hidden Lynx , have also used stolen certificates in their campaigns .


In April 2013 , a third-party vendor published a report about a cyberespionage group using custom malware and stolen certificates in their operations .


The report documented an advanced threat group they attributed to China .


Symantec tracks the group behind this activity as Blackfly and detects the malware they use as Backdoor.Winnti .


The Blackfly attacks share some similarities with the more recent Suckfly attacks .


Blackfly began with a campaign to steal certificates , which were later used to sign malware used in targeted attacks .


The certificates Blackfly stole were also from South Korean companies , primarily in the video game and software development industry .


Another similarity is that Suckfly stole a certificate from Company D ( see Figure 4 ) less than two years after Blackfly had stolen a certificate from the same company .


While the stolen certificates were different , and stolen in separate instances , they were both used with custom malware in targeted attacks originating from China .


Signing malware with code-signing certificates is becoming more common , as seen in this investigation and the other attacks we have discussed .


Attackers are taking the time and effort to steal certificates because it is becoming necessary to gain a foothold on a targeted computer .


Attempts to sign malware with code-signing certificates have become more common as the Internet and security systems have moved towards a more trust and reputation oriented model .


This means that untrusted software may not be allowed to run unless it is signed .


As we noted in our previous research on the Apple threat landscape , some operating systems , such as Mac OS X , are configured by default to only allow applications to run if they have been signed with a valid certificate , meaning they are trusted .


However , using valid code-signing certificates stolen from organizations with a positive reputation can allow attackers to piggyback on that company ’s trust , making it easier to slip by these defenses and gain access to targeted computers .


Suckfly paints a stark picture of where cyberattack groups and cybercriminals are focusing their attentions .


Our investigation shines a light on an often unknown and seedier secret life of code-signing certificates , which is completely unknown to their owners .


The implications of this study shows that certificate owners need to keep a careful eye on them to prevent them from falling into the wrong hands .


It is important to give certificates the protection they need so they can't be used maliciously .


The certificates are only as secure as the safeguards that organizations put around them .


Once a certificate has been compromised , so has the reputation of the organization who signed it .


An organization whose certificate has been stolen and used to sign malware will always be associated with that activity .


Symantec monitors for this type of activity to help prevent organizations from being tied to malicious actions undertaken with their stolen certificates .


During the course of this investigation , we ensured that all certificates compromised by Suckfly were revoked and the affected companies notified .


Over the past few years , we have seen a number of advanced threats and cybercrime groups who have stolen code-signing certificates .


In all of the cases involving an advanced threat , the certificates were used to disguise malware as a legitimate file or application .


File hashes :


05edd53508c55b9dd64129e944662c0d 1cf5ce3e3ea310b0f7ce72a94659ff54 352eede25c74775e6102a095fb49da8c 3b595d3e63537da654de29dd01793059 4709395fb143c212891138b98460e958 50f4464d0fc20d1932a12484a1db4342 96c317b0b1b14aadfb5a20a03771f85f ba7b1392b799c8761349e7728c2656dd de5057e579be9e3c53e50f97a9b1832b e7d92039ffc2f07496fe7657d982c80f e864f32151d6afd0a3491f432c2bb7a2 .


Infrastructure :


usv0503.iqservs-jp.com aux.robertstockdill.com fli.fedora-dns-update.com bss.pvtcdn.com ssl.microsoft-security-center.com ssl.2upgrades.com 133.242.134.121 fli.fedora-dns-update.com .


Indian organizations targeted in Suckfly attacks .


In March 2016 , Symantec published a blog on Suckfly , an advanced cyberespionage group that conducted attacks against a number of South Korean organizations to steal digital certificates .


Since then we have identified a number of attacks over a two-year period , beginning in April 2014 , which we attribute to Suckfly .


The attacks targeted high-profile targets , including government and commercial organizations .


These attacks occurred in several different countries , but our investigation revealed that the primary targets were individuals and organizations primarily located in India .


While there have been several Suckfly campaigns that infected organizations with the group ’s custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions .


This suggests that these attacks were part of a planned operation against specific targets in India .


The first known Suckfly campaign began in April of 2014 .


During our investigation of the campaign , we identified a number of global targets across several industries who were attacked in 2015 .


Many of the targets we identified were well known commercial organizations located in India .


These organizations included :


One of India 's largest financial organizations A large e-commerce company The e-commerce company 's primary shipping vendor One of India 's top five IT firms A United States healthcare provider 's Indian business unit Two government organizations .


Suckfly spent more time attacking the government networks compared to all but one of the commercial targets .


Additionally , one of the two government organizations had the highest infection rate of the Indian targets .


Figure 1 shows the infection rate for each of the targets .


Indian government org #2 is responsible for implementing network software for different ministries and departments within India 's central government .


The high infection rate for this target is likely because of its access to technology and information related to other Indian government organizations .


Suckfly 's attacks on government organizations that provide information technology services to other government branches is not limited to India .


It has conducted attacks on similar organizations in Saudi Arabia , likely because of the access that those organizations have .


Suckfly 's targets are displayed in figure 2 by their industry , which provides a clearer view of the group ’s operations .


Most of the group 's attacks are focused on government or technology related companies and organizations .


One of the attacks we investigated provided detailed insight into how Suckfly conducts its operations .


In 2015 , Suckfly conducted a multistage attack between April 22 and May 4 against an e-commerce organization based in India .


Similar to its other attacks , Suckfly used the Nidiran back door along with a number of hacktools to infect the victim 's internal hosts .


The tools and malware used in this breach were also signed with stolen digital certificates .


Suckfly 's first step was to identify a user to target so the attackers could attempt their initial breach into the e-commerce company 's internal network .


We don't have hard evidence of how Suckfly obtained information on the targeted user , but we did find a large open-source presence on the initial target .


The target 's job function , corporate email address , information on work related projects , and publicly accessible personal blog could all be freely found online .


On April 22 , 2015 , Suckfly exploited a vulnerability on the targeted employee 's operating system ( Windows ) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack .


While we know the attackers used a custom dropper to install the back door , we do not know the delivery vector .


Based on the amount of open-source information available on the target , it is feasible that a spear-phishing email may have been used .


After the attackers successfully exploited the employee ’s system , they gained access to the e-commerce company 's internal network .


We found evidence that Suckfly used hacktools to move latterly and escalate privileges .


To do this the attackers used a signed credential-dumping tool to obtain the victim 's account credentials .


With the account credentials , the attackers were able to access the victim 's account and navigate the internal corporate network as though they were the employee .


On April 27 , the attackers scanned the corporate internal network for hosts with ports 8080 , 5900 , and 40 open .


Ports 8080 and 5900 are common ports used with legitimate protocols , but can be abused by attackers when they are not secured .


It isn't clear why the attackers scanned for hosts with port 40 open because there isn't a common protocol assigned to this port .


Based on Suckfly scanning for common ports , it ’s clear that the group was looking to expand its foothold on the e-commerce company 's internal network .


The attackers ’ final step was to exfiltrate data off the victim ’s network and onto Suckfly ’s infrastructure .


While we know that the attackers used the Nidiran back door to steal information about the compromised organization , we do not know if Suckfly was successful in stealing other information .


These steps were taken over a 13-day period , but only on specific days .


While tracking what days of the week Suckfly used its hacktools , we discovered that the group was only active Monday through Friday .


There was no activity from the group on weekends .


We were able to determine this because the attackers ’ hacktools are command line driven and can provide insight into when the operators are behind keyboards actively working .


Figure 4 shows the attackers ’ activity levels throughout the week .


Suckfly made its malware difficult to analyze to prevent their operations from being detected .


However , we were able to successfully analyze Suckfly malware samples and extract some of the communications between the Nidiran back door and the Suckfly command and control ( C&C ) domains .


We analyzed the dropper , which is an executable that contains the following three files :


dllhost.exe : The main host for the .dll file . iviewers.dll : Used to load encrypted payloads and then decrypt them . msfled : The encrypted payload .


All three files are required for the malware to run correctly .


Once the malware has been executed , it checks to see if it has a connection to the internet before running .


If the connection test is successful , the malware runs and attempts to communicate with the C&C domain over ports 443 and 8443 .


In the samples we analyzed we found the port and C&C information encrypted and hardcoded into the Nidiran malware itself .


The key for the RC4 encryption in this sample is the hardcoded string “ h0le ” .


Once the cookie data is decoded , Suckfly has the network name , hostname , IP address , and the victim 's operating system information .


Information about the C&C infrastructure identified in our analysis of Suckfly activity can be seen in Table 1 .


Domain Registration IP address Registration date


aux.robertstockdill.com kumar.pari@yandex.com Unknown April 1 , 2014 . ssl.2upgrades.com kumar.pari@yandex.com 176.58.96.234 July 5 , 2014 . bss.pvtcdn.com registrar@mail.zgsj.com 106.184.1.38 May 19 , 2015 .


ssl.microsoft-security-center.com Whoisguard Unknown July 20 , 2015 E-TIME.usv0503.iqservs-jp.com Domain@quicca.com 133.242.134.121 August 18 , 2014 .


fli.fedora-dns-update.com Whoisguard Unknown Unknown .


Suckfly targeted one of India ’s largest e-commerce companies , a major Indian shipping company , one of India ’s largest financial organizations , and an IT firm that provides support for India ’s largest stock exchange .


All of these targets are large corporations that play a major role in India ’s economy .


By targeting all of these organizations together , Suckfly could have had a much larger impact on India and its economy .


While we don't know the motivations behind the attacks , the targeted commercial organizations , along with the targeted government organizations , may point in this direction .


Suckfly has the resources to develop malware , purchase infrastructure , and conduct targeted attacks for years while staying off the radar of security organizations .


During this time they were able to steal digital certificates from South Korean companies and launch attacks against Indian and Saudi Arabian government organizations .


There is no evidence that Suckfly gained any benefits from attacking the government organizations , but someone else may have benefited from these attacks .


The nature of the Suckfly attacks suggests that it is unlikely that the threat group orchestrated these attacks on their own .


We believe that Suckfly will continue to target organizations in India and similar organizations in other countries in order to provide economic insight to the organization behind Suckfly 's operations .


THE DUKES 7 YEARS OF RUSSIAN CYBERESPIONAGE .


TOOLS AND TECHNIQUES OF THE DUKES .


PINCHDUKE : First known activity November 2008 , Most recent known activity Summer 2010 , C&C communication methods HTTP(S) , Known toolset components Multiple loaders , Information stealer .


The PinchDuke toolset consists of multiple loaders and a core information stealer Trojan .


The loaders associated with the PinchDuke toolset have also been observed being used with CosmicDuke .


The PinchDuke information stealer gathers system configuration information , steals user credentials , and collects user files from the compromised host transferring these via HTTP (S ) to a C&C server .


We believe PinchDuke ’s credential stealing functionality is based on the source code of the Pinch credential stealing malware ( also known as LdPinch ) that was developed in the early 2000s and has later been openly distributed on underground forums .


Credentials targeted by PinchDuke include ones associated with the following software or services : The Bat! , Yahoo! , Mail.ru , Passport.Net , Google Talk , Netscape Navigator , Mozilla Firefox , Mozilla Thunderbird , Internet Explorer , Microsoft Outlook , WinInet Credential Cache , Lightweight Directory Access Protocol ( LDAP ) .


PinchDuke will also search for files that have been created within a predefined timeframe and whose file extension is present in a predefined list .


As a curiosity , most PinchDuke samples contain a Russian language error message : “ There is an error in the module ’s name ! The length of the data section name must be 4 bytes ” .


GEMINIDUKE : First known activity January 2009 , Most recent known activity December 2012 , C&C communication methods HTTP(S) , Known toolset components Loader , Information stealer , Multiple persistence components .


The GeminiDuke toolset consists of a core information stealer , a loader and multiple persistencerelated components .


Unlike CosmicDuke and PinchDuke , GeminiDuke primarily collects information on the victim computer ’s configuration .


The collected details include : Local user accounts , Network settings , Internet proxy settings , Installed drivers , Running processes , Programs previously executed by users , Programs and services configured to automatically run at startup , Values of environment variables , Files and folders present in any users home folder , Files and folders present in any users My Documents , Programs installed to the Program Files folder , Recently accessed files , folders and programs .


As is common for malware , the GeminiDuke infostealer uses a mutex to ensure that only one instance of itself is running at a time .


What is less common is that the name used for the mutex is often a timestamp .


We believe these timestamps to be generated during the compilation of GeminiDuke from the local time of the computer being used .


Comparing the GeminiDuke compilation timestamps , which always reference the time in the UTC+0 timezone , with the local time timestamps used as mutex names , and adjusting for the presumed timezone difference , we note that all of the mutex names reference a time and date that is within seconds of the respective sample ’s compilation timestamp .


Additionally , the apparent timezone of the timestamps in all of the GeminiDuke samples compiled during the winter is UTC+3 , while for samples compiled during the summer , it is UTC+4 .


The observed timezones correspond to the pre-2011 definition of Moscow Standard Time ( MSK ) , which was UTC+3 during the winter and UTC+4 during the summer .


In 2011 MSK stopped following Daylight Saving Time ( DST ) and was set to UTC+4 year-round , then reset to UTC +3 yearround in 2014 .


Some of the observed GeminiDuke samples that used timestamps as mutex names were compiled while MSK still respected DST and for these samples , the timestamps perfectly align with MSK as it was defined at the time .


However , GeminiDuke samples compiled after MSK was altered still vary the timezone between UTC+3 in the winter and UTC+4 during the summer .


While computers using Microsoft Windows automatically adjust for DST , changes in timezone definitions require that an update to Windows be installed .


We therefore believe that the Dukes group simply failed to update the computer they were using to compile GeminiDuke samples , so that the timestamps seen in later samples still appear to follow the old definition of Moscow Standard Time .


The GeminiDuke infostealer has occasionally been wrapped with a loader that appears to be unique to GeminiDuke and has never been observed being used with any of the other Duke toolsets .


GeminiDuke also occasionally embeds additional executables that attempt to achieve persistence on the victim computer .


These persistence components appear to be uniquely customized for use with GeminiDuke , but they use many of the same techniques as CosmicDuke persistence components .


COSMICDUKE : First known activity January 2010 , Most recent known activity Summer 2015 , Other names Tinybaron , BotgenStudios , NemesisGemina , C&C communication methods HTTP(S) , FTP , WebDav , Known toolset components Information stealer , Multiple loaders , Privilege escalation component , Multiple persistence components .


The CosmicDuke toolset is designed around a main information stealer component .


This information stealer is augmented by a variety of components that the toolset operators may selectively include with the main component to provide additional functionalities , such as multiple methods of establishing persistence , as well as modules that attempt to exploit privilege escalation vulnerabilities in order to execute CosmicDuke with higher privileges .


CosmicDuke ’s information stealing functionality includes : Keylogging , Taking screenshots , Stealing clipboard contents , Stealing user files with file extensions that match a predefined list , Exporting the users cryptographic certificates including private keys , Collecting user credentials , including passwords , for a variety of popular chat and email programs as well as from web browsers CosmicDuke may use HTTP , HTTPS , FTP or WebDav to exfiltrate the collected data to a hardcoded C&C server .


While we believe CosmicDuke to be an entirely custom- written toolset with no direct sharing of code with other Duke toolsets , the high-level ways in which many of its features have been implemented appear to be shared with other members of the Duke arsenal .


Specifically , the techniques CosmicDuke uses to extract user credentials from targeted software and to detect the presence of analysis tools appear to be based on the techniques used by PinchDuke .


Likewise , many of CosmicDuke ’s persistence components use techniques also used by components associated with GeminiDuke and CozyDuke .


In all of these cases , the techniques are the same , but the code itself has been altered to work with the toolset in question , leading to small differences in the final implementation .


A few of the CosmicDuke samples we discovered also included components that attempt to exploit either of the publicly known CVE-2010-0232 or CVE-2010- 4398 privilege escalation vulnerabilities .


In the case of CVE-2010-0232 , the exploit appears to be based directly on the proof of concept code published by security researcher Tavis Ormandy when he disclosed the vulnerability .


We believe that the exploit for CVE- 2010-4398 was also based on a publicly available proof of concept .


In addition to often embedding persistence or privilege escalation components , CosmicDuke has occasionally embedded PinchDuke , GeminiDuke , or MiniDuke components .


It should be noted that CosmicDuke does not interoperate with the second , embedded malware in any way other than by writing the malware to disk and executing it .


After that , CosmicDuke and the second malware operate entirely independently of each other , including separately contacting their C&C servers .


Sometimes , both malware have used the same C&C server , but in other cases , even the servers have been different .


Finally , it is worth noting that while most of the compilation timestamps for CosmicDuke samples appear to be authentic , we are aware of a few cases of them being forged .


One such case was detailed on page 10 as an apparent evasion attempt .


Another is a loader variant seen during the spring of 2010 in conjunction with both CosmicDuke and PinchDuke .


These loader samples all had compilation timestamps purporting to be from the 24th or the 25th of September , 2001 .


However , many of these loader samples embed CosmicDuke variants that exploit the CVE-2010- 0232 privilege escalation vulnerability thus making it impossible for the compilation timestamps to be authentic .


MINIDUKE : First known activity Loader July 2010 , Backdoor May 2011 Most recent known activity Loader : Spring 2015 , Backdoor : Summer 2014 C&C communication methods HTTP(S) , Twitter , Known toolset components Downloader , Backdoor , Loader .


The MiniDuke toolset consists of multiple downloader and backdoor components , which are commonly referred to as the MiniDuke “ stage 1 ” , “ stage 2 ” , and “ stage 3 ” components as per Kaspersky ’s original MiniDuke whitepaper .


Additionally , a specific loader is often associated with the MiniDuke toolset and is referred to as the “ MiniDuke loader ” .


While the loader has often been used together with other MiniDuke components , it has also commonly been used in conjunction with CosmicDuke and PinchDuke .


In fact , the oldest samples of the loader that we have found were used with PinchDuke .


To avoid confusion however , we have decided to continue referring to the loader as the “ MiniDuke loader ” .


Two details about MiniDuke components are worth noting .


Firstly , some of the MiniDuke components were written in Assembly language .


While many malware were written in Assembly during the ‘ old days ‘ of curiosity-driven virus writing , it has since become a rarity .


Secondly , some of the MiniDuke components do not contain a hardcoded C&C server address , but instead obtain the address of a current C&C server via Twitter .


The use of Twitter either to initially obtain the address of a C&C server ( or as a backup if no hardcoded primary C&C server responds ) is a feature also found in OnionDuke , CozyDuke , and HammerDuke .


COZYDUKE : First known activity January 2010 , Most recent known activity : Spring 2015 , Other names CozyBear , CozyCar , Cozer , EuroAPT , C&C communication methods HTTP(S) , Twitter ( backup ) , Known toolset components Dropper , Modular backdoor , Multiple persistence components , Information gathering module , Screenshot module , Password stealing module , Password hash stealing module .


CozyDuke is not simply a malware toolset ; rather , it is a modular malware platform formed around a core backdoor component .


This component can be instructed by the C&C server to download and execute arbitrary modules , and it is these modules that provide CozyDuke with its vast array of functionality .


Known CozyDuke modules include : Command execution module for executing arbitrary Windows Command Prompt commands , Password stealer module , NT LAN Manager ( NTLM ) hash stealer module , System information gathering module , Screenshot module .


In addition to modules , CozyDuke can also be instructed to download and execute other , independent executables .


In some observed cases , these executables were self-extracting archive files containing common hacking tools , such as PSExec and Mimikatz , combined with script files that execute these tools .


In other cases , CozyDuke has been observed downloading and executing tools from other toolsets used by the Dukes such as OnionDuke , SeaDuke , and HammerDuke .


ONIONDUKE : First known activity February 2013 , Most recent known activity Spring 2015 , C&C communication methods HTTP(S) , Twitter ( backup ) , Known toolset components Dropper , Loader , Multiple modular core components , Information stealer , Distributed Denial of Service ( DDoS ) module , Password stealing module , Information gathering module , Social network spamming module .


The OnionDuke toolset includes at least a dropper , a loader , an information stealer Trojan and multiple modular variants with associated modules .


OnionDuke first caught our attention because it was being spread via a malicious Tor exit node .


The Tor node would intercept any unencrypted executable files being downloaded and modify those executables by adding a malicious wrapper contained an embedded OnionDuke .


Once the victim finished downloading the file and executed it , the wrapper would infect the victim ’s computer with OnionDuke before executing the original legitimate executable .


The same wrapper has also been used to wrap legitimate executable files , which were then made available for users to download from torrent sites .


Again , if a victim downloaded a torrent containing a wrapped executable , they would get infected with OnionDuke .


Finally , we have also observed victims being infected with OnionDuke after they were already infected with CozyDuke .


In these cases , CozyDuke was instructed by its C&C server to download and execute OnionDuke toolset .


SEADUKE : First known activity October 2014 , Most recent known activity Spring 2015 , Other names SeaDaddy , SeaDask , C&C communication methods HTTP(S) , Known toolset components Backdoor .


SeaDuke is a simple backdoor that focuses on executing commands retrieved from its C&C server , such as uploading and downloading files , executing system commands and evaluating additional Python code .


SeaDuke is made interesting by the fact that it is written in Python and designed to be cross-platform so that it works on both Windows and Linux .


The only known infection vector for SeaDuke is via an existing CozyDuke infection , wherein CozyDuke downloads and executes the SeaDuke toolset .


Like HammerDuke , SeaDuke appears to be used by the Dukes group primarily as a secondary backdoor left on CozyDuke victims after that toolset has completed the initial infection and stolen any readily available information from them .


HAMMERDUKE : First known activity January 2015 , Most recent known activity Summer 2015 , Other names HAMMERTOSS , Netduke , C&C communication methods HTTP(S) , Twitter , Known toolset components Backdoor .


HammerDuke is a simple backdoor that is apparently designed for similar use cases as SeaDuke .


Specifically , the only known infection vector for HammerDuke is to be downloaded and executed by CozyDuke onto a victim that has already been compromised by that toolset .


This , together with HammerDuke ’s simplistic backdoor functionality , suggests that it is primarily used by the Dukes group as a secondary backdoor left on CozyDuke victims after CozyDuke performed the initial infection and stole any readily available information from them .


HammerDuke is however interesting because it is written in .NET , and even more so because of its occasional use of Twitter as a C&C communication channel .


Some HammerDuke variants only contain a hardcoded C&C server address from which they will retrieve commands , but other HammerDuke variants will first use a custom algorithm to generate a Twitter account name based on the current date .


If the account exists , HammerDuke will then search for tweets from that account with links to image files that contain embedded commands for the toolset to execute .


HammerDuke ’s use of Twitter and crafted image files is reminiscent of other Duke toolsets .


Both OnionDuke and MiniDuke also use date-based algorithms to generate Twitter account names and then searched for any tweets from those accounts that linked to image files .


In contrast however , for OnionDuke and MiniDuke the linked image files contain embedded malware to be downloaded and executed , rather than instructions .


Similarly , GeminiDuke may also download image files , but these would contain embedded additional configuration information for the toolset itself .


Unlike HammerDuke however , the URLs for the images downloaded by GeminiDuke are hardcoded in its initial configuration , rather than retrieved from Twitter .


CLOUDDUKE : First known activity June 2015 , Most recent known activity Summer 2015 , Other names MiniDionis , CloudLook , C&C communication methods HTTP(S) , Microsoft OneDrive , Known toolset components Downloader , Loader , Two backdoor variants .


CloudDuke is a malware toolset known to consist of , at least , a downloader , a loader and two backdoor variants .


The CloudDuke downloader will download and execute additional malware from a preconfigured location .


Interestingly , that location may be either a web address or a Microsoft OneDrive account .


Both CloudDuke backdoor variants support simple backdoor functionality , similar to SeaDuke .


While one variant will use a preconfigured C&C server over HTTP or HTTPS , the other variant will use a Microsoft OneDrive account to exchange commands and stolen data with its operators .


THE DUKES 7 YEARS OF RUSSIAN CYBER ESPIONAGE .


The Dukes primarily use spear-phishing emails when attempting to infect victims with their malware .


These spear-phishing emails range from ones purposely designed to look like spam messages used to spread common crimeware and addressed to large numbers of people , to highly targeted emails addressed to only a few recipients ( or even just one person ) and with content that is highly relevant for the intended recipient .


In some cases , the Dukes appear to have used previously compromised victims to send new spear-phishing emails to other targets .


The spear-phishing emails used by the Dukes may contain either specially-crafted malicious attachments or links to URLs hosting the malware .


When malicious attachments are used , they may either be designed to exploit a vulnerability in a popular software assumed to be installed on the victim ’s machine , such as Microsoft Word or Adobe Reader , or the attachment itself may have its icon and filename obfuscated in such a way that the file does not appear to be an executable .


The only instances which we are aware of where the Dukes did not use spear-phishing as the initial infection vector is with certain OnionDuke variants .


These were instead spread using either a malicious Tor node that would trojanize legitimate applications on-the-fly with the OnionDuke toolset , or via torrent files containing previously trojanized versions of legitimate applications .


Finally , it is worth noting that the Dukes are known to sometimes re-infect a victim of one of their malware tools with another one of their tools .


Examples include CozyDuke infecting its victims with SeaDuke , HammerDuke ,or OnionDuke ; and CosmicDuke infecting its victims with PinchDuke ,GeminiDuke or MiniDuke .


The Dukes have employed exploits both in their infection vectors as well as in their malware .


We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit .


In all known cases where exploits were employed , we believe the Dukes did not themselves discover the vulnerabilities or design the original exploits ; for the exploited zero-day , we believe the Dukes purchased the exploit .


In all other cases , we believe the group simply repurposed publicly available exploits or proofs of concept .


Attribution is always a difficult question , but attempting to answer it is important in understanding these types of threats and how to defend against them .


This paper has already stated that we believe the Dukes to be a Russian state-sponsored cyberespionage operation .


To reach this conclusion , we began by analyzing the apparent objectives and motivations of the group .


Based on what we currently know about the targets chosen by the Dukes over the past 7 years , they appear to have consistently targeted entities that deal with foreign policy and security policy matters .


These targets have included organizations such as ministries of foreign affairs , embassies , senates , parliaments , ministries of defense , defense contractors , and think tanks .


In one of their more intriguing cases , the Dukes have appeared to also target entities involved in the trafficking of illegal drugs .


Even such targets however appear to be consistent with the overarching theme , given the drug trade ’s relevance to security policy .


Based on this , we are confident in our conclusion that the Dukes ’ primary mission is the collection of intelligence to support foreign and security policy decision-making .


Based on the length of the Dukes ’ activity , our estimate of the amount of resources invested in the operation and the fact that their activity only appears to be increasing , we believe the group to have significant and most critically , stable financial backing .


The Dukes have consistently operated large-scale campaigns against high-profile targets while concurrently engaging in smaller , more targeted campaigns with apparent coordination and no evidence of unintentional overlap or operational clashes .


We therefore believe the Dukes to be a single , large , wellcoordinated organization with clear separation of responsibilities and targets .


The Dukes appear to prioritize the continuation of their operations over stealth .


Their 2015 CozyDuke and CloudDuke campaigns take this to the extreme by apparently opting for speed and quantity over stealth and quality .


In the most extreme case , the Dukes continued with their July 2015 CloudDuke campaign even after their activity had been outed by multiple security vendors .


We therefore believe the Dukes ’ primary mission to be so valuable to their benefactors that its continuation outweighs everything else .


This apparent disregard for publicity suggests , in our opinion , that the benefactors of the Dukes is so powerful and so tightly connected to the group that the Dukes are able to operate with no apparent fear of repercussions on getting caught .


We believe the only benefactor with the power to offer such comprehensive protection would be the government of the nation from which the group operates .


We therefore believe the Dukes to work either within or directly for a government , thus ruling out the possibility of a criminal gang or another third party .


Kaspersky Labs has previously noted the presence of Russian-language artefacts in some of the Duke malware samples .


We have also found a Russian-language error message in many PinchDuke samples which translates as , “ There is an error in the module ’s name ! The length of the data section name must be 4 bytes! ” Additionally , Kaspersky noted that based on the compilation timestamps , the authors of the Duke malware appear to primarily work from Monday to Friday between the times of 6am and 4pm UTC+0 .


This corresponds to working hours between 9am and 7pm in the UTC+3 time zone , also known as Moscow Standard Time , which covers , among others , much of western Russia , including Moscow and St. Petersburg .


The Kaspersky Labs analysis of the Duke malware authors ’ working times is supported by our own analysis , as well as that performed by FireEye .


This assertion of time zone is also supported by timestamps found in many GeminiDuke samples , which similarly suggest the group work in the Moscow Standard Time timezone , as further detailed in the section on the technical analysis of GeminiDuke .


Finally , the known targets of the Dukes - Eastern European foreign ministries , western think tanks and governmental organizations , even Russian-speaking drug dealers - conform to publiclyknown Russian foreign policy and security policy interests .


Even though the Dukes appear to have targeted governments all over the world , we are unaware of them ever targeting the Russian government .


While absence of evidence is not evidence of absence , it is an interesting detail to note .


Threat Actor Profile : TA505 , From Dridex to GlobeImposter .


Proofpoint researchers track a wide range of threat actors involved in both financially motivated cybercrime and state-sponsored actions .


One of the more prolific actors that we track - referred to as TA505 - is responsible for the largest malicious spam campaigns we have ever observed , distributing instances of the Dridex banking Trojan , Locky ransomware , Jaff ransomware , The Trick banking Trojan , and several others in very high volumes .


Because TA505 is such a significant part of the email threat landscape , this blog provides a retrospective on the shifting malware , payloads , and campaigns associated with this actor .


We examine their use malware such as Jaff , Bart , and Rockloader that appear to be exclusive to this group as well as more widely distributed malware like Dridex and Pony .


Where possible , we detail the affiliate models with which they are involved and outline the current state of TA505 campaigns .


The infographic in Figure 1 traces the earliest known dates on which TA505 began distributing particular malware strains , beginning with Dridex in 2014 and most recently when they elevated GlobeImposter and Philadelphia from small , regionally targeted ransomware variants to global threats .


Of note is TA505 ’s use of the Necurs botnet to drive their massive spam campaigns .


As we saw in both 2016 and 2017 , disruptions to Necurs went hand-in-hand with quiet periods from TA505 .


When the botnet came back online , TA505 campaigns quickly returned , usually at even greater scale than before the disruption .


The following is a more detailed description of the malware and notable campaign attributes associated with TA505 .


The now infamous Dridex banking Trojan can trace much of its DNA to Cridex and Bugat .


Dridex itself appeared shortly after the Zeus banking Trojan was taken down .


It was originally documented on July 25 , 2014 ( or June 22 , 2014 , according to Kaspersky ) and the first campaign we observed in which TA505 distributed Dridex occurred three days later on July 28 .


Although a number of actors have distributed Dridex , TA505 operates multiple affiliate IDs , including what appears to be the earliest recorded affiliate , botnet ID 125 .


These early campaigns were distributed via the Lerspeng downloader while later campaigns occasionally used Pony or Andromeda as intermediate loaders to distribute various instances of Dridex .


Although TA505 initially distributed Dridex botnet ID 125 , they were observed using botnet ID 220 in March 2015 and botnet ID 223 in December of that year .


Later , they were also associated with botnet IDs 7200 and 7500 .


These botnets generally target the following regions :


125: UK , US , and Canada 220: UK and Australia 223: Germany 7200: UK 7500: Australia .


TA505 continued distributing Dridex through early June 2017 using a range of email attachments .


Most recently these included PDF attachments with embedded Microsoft Word documents bearing malicious macros that call PowerShell commands that install Dridex .


However , because of the length of time for which the group has been distributing Dridex , distribution mechanisms trace the state of the art for the last two years of email campaigns with techniques ranging from straight macro documents to a variety of zipped scripts .


In October 2015 , we observed several campaigns in which TA505 targeted Japanese and UK organizations with the Shifu banking Trojan .


Shifu is relatively common in Japan but was a new addition to TA505 ’s toolbox .


It appears that they introduced Shifu after high-profile law enforcement actions impacted Dridex distribution .


However , TA505 was also among the first actors to return to high-volume Dridex distribution this same month , even as they demonstrated their ability to diversify and deliver threats beyond Dridex .


As with many of their other campaigns , TA505 delivered Shifu through macro laden Microsoft Office document attachments .


TA505 introduced Locky ransomware in February 2016 .


After alternating for over four months with Dridex , Locky became the payload of choice for TA505 , eclipsing earlier campaigns in terms of volume and reach .


TA505 stopped distributing Dridex in July 2016 , relying almost exclusively on Locky through December of that year .


Like Dridex , Locky is also distributed in an affiliate model ; TA505 exclusively distributes Locky Affid=3 .


Low-volume campaigns distributed Dridex during much of 2015 Moderate volumes of Dridex appeared from the end of 2015 through February 2016 ; it is worth noting that these “ moderate volume ” campaigns were , at the time , the largest campaigns ever observed .


Alternating Dridex and Locky campaigns of varying volumes appeared through May 2016 .


A lull in June 2016 associated with a disruption in the Necurs botnet ; TA505 is heavily reliant on this massive botnet to send out high-volume malicious spam campaigns and disappearances of TA505 activity frequently accompany disruptions in Necurs .


Extremely high-volume campaigns distributing Locky exclusively in July 2016 , consistently delivering tens of millions of messages .


Another lull in November 2016 saw the complete absence of Locky and Dridex , while high-volume campaigns reappeared in December , albeit at lower volumes than during the Q3 2016 peak .


An expected break following the 2016-2017 winter holidays turned into an unexplained three-month hiatus for TA505 .


Large-scale Dridex and Locky campaigns returned in Q2 2017 , although none reached the volumes we observed in mid-2016 .


Later campaigns saw new attachment types , even as Dridex and Locky payloads remained largely unchanged .


Locky distribution ceased in June and July but returned in August with volumes rivaling the peaks of 2016 .


TA505 turned to URLs in early August 2017 to distribute Locky , finally eschewing the document or zipped script attachments that have characterized the majority of their Locky campaigns since February 2016 ; most of these URLs linked to malicious documents and scripts .


By later August , TA505 had turned back to large attachment campaigns , primarily distributing various zipped scripts that downloaded Locky .


The group continued this pattern with occasional URL campaigns and attached HTML files bearing malicious links .


TA505 first introduced Rockloader in April 2016 as an intermediate loader for Locky .


At that time , Rockloader was the initial payload downloaded by malicious attached JavaScript files .


Once Rockloader was installed , it downloaded Locky and , in some cases , Pony and Kegotip .


Pony is another loader with information stealing capabilities while Kegotip is an credential and email address harvesting malware strain that would appear in a small number of TA505 campaigns the following year as the primary payload .


Bart ransomware appeared for exactly one day on June 24 , 2016 .


It was a secondary payload downloaded by Rockloader , the initial payload in a large email campaign using zipped JavaScript attachments .


The Bart ransom screen was visually similar to Locky ’s but Bart had one important distinction : it could encrypt files without contacting a command and control server .


However , we have not seen Bart since , suggesting that this was either an experiment or that the ransomware did not function as expected for TA505 .


TA505 briefly distributed the Kegotip information stealer in April 2017 .


Across two campaigns of several million messages each , the actor used both macro laden Microsoft Word documents and zipped VBScript attachments to install the Trojan on potential victim PCs .


Kegotip is an infostealer ( credentials and email addresses ) used to facilitate other crimeware activities .


It steals credentials from various FTP clients , Outlook , and Internet Explorer .


It also will gather email addresses scraped from files stored on the computer .


This information can be used to facilitate future spam campaigns by the perpetrator or may be sold to other actors .


TA505 introduced Jaff ransomware in May 2017 .


Jaff was not dramatically different from other ransomware strains .


The payment portal was initially similar to the one used by Locky and Bart .


It was primarily notable for its high-volume campaigns and its association with TA505 , given the actor ’s propensity for massive campaigns and ability to dominate the email landscape .


Jaff appeared in multi-million message campaigns for roughly a month and then promptly disappeared as soon as a decryptor was released in mid-June 2017 .


The Trick , also known as Trickbot , is another banking Trojan that TA505 first began distributing in June of 2017 , although we have observed The Trick in the wild since fall 2016 , usually in regionally targeted campaigns .


It is generally considered a descendant of the Dyreza banking Trojan and features mutliple modules .


The main bot is responsible for persistence , the downloading of additional modules , loading affiliate payloads , and loading updates for the malware .


As with much of the malware distributed by TA505 , The Trick has appeared in frequent , high-volume campaigns .


The campaigns used a mix of attached zipped scripts ( WSF , VBS ) , malicious Microsoft Office documents ( Word , Excel ) , HTML attachments , password-protected Microsoft Word documents , links to malicious JavaScript , and other vectors .


The last TA505 campaigns featuring The Trick appeared in mid-September 2017 with payloads alternating between Locky and The Trick .


Philadelphia ransomware has been circulating since September 2016 .


It first attracted our attention in April of this year when we observed an actor customizing the malware for use in highly targeted campaigns .


In a brief stint , TA505 distributed it in one large campaign in July , but we have not seen them use it since .


GlobeImposter is another ransomware strain that saw relatively small-scale distribution until TA505 began including it in malicious spam campaigns at the end of July 2017 .


TA505 primarily distributed GlobeImposter in zipped script attachments through the beginning of September 2017 .


Again , GlobeImposter is not particularly innovative but TA505 elevated the ransomware from a regional variant to a major landscape feature during roughly six weeks of large campaigns .


TA505 is arguably one of the most significant financially motivated threat actors because of the extraordinary volumes of messages they send .


The variety of malware delivered by the group also demonstrates their deep connections to the underground malware scene .


At the time of writing , Locky ransomware remains their malware of choice , even as the group continues to experiment with a variety of additional malware .


The history of TA505 is instructive because they: Have proven to be highly adaptable , shifting techniques and malware frequently to “ follow the money ” , while largely sticking to successful strategies where possible Are flexible , using largely interchangeable components , innovating where necessary on the malware front and using off-the-shelf malware where possible Operate at massive scale , consistently driving global trends in malware distribution and message volume .


Each of these elements makes TA505 a magnifying lens through which to consider the framework employed by many modern threat actors .


Such a framework typically consists of five elements :


Actor : The attacker organization ; real humans driven by various motivations -- In the case of TA505 , the motivations are financial .


Vector : The delivery mechanism ; email via attacker-controlled or leased spam botnet -- Necurs for TA505 -- remains a dominant vector , and certainly the vector of choice for this actor .


Hoster : The sites hosting malware ; if malware is not directly attached to email , then macro enabled documents , malicious scripts , or exploit kits will pull payloads from these servers .


TA505 almost exclusively hosts malware in this way , although they vary the means of installing their final payloads on victim machines .


Payload : The malware ; software that will enable the attacker to make use of ( control , exfiltrate data from , or download more software to ) the target computer .


For TA505 , the payloads have shifted over the years and months of their activity , but their sending and hosting infrastructure make these changes relatively simple to implement .


C&C : The command and control channel that serves to relay commands between the installed malware and attackers .


TA505 operates a variety of C&C servers , allowing it to be resilient in the case of takedowns , sinkholes , and other defensive operations .


This framework enables attackers to operate in robust , horizontally segmented ecosystems , specializing in developing certain parts of the framework , and selling or leasing to others ; such frameworks are resistant to takedowns and individual component failures .


But such frameworks also increase attackers' detection surface , that is , their susceptibility to discovery .


In the case of TA505 , while most elements of the framework are well-developed , their reliance on the Necurs botnet for the sending high-volume malicious spam - a key component of the Vector element above - appears to be their Achilles heel .


A XENOTIME to Remember : Veles in the Wild .


Release_Time : 2019-12-04


Report_URL : https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/


“ When I use a word , ” Humpty Dumpty said , in rather a scornful tone , “ it means just what I choose it to mean—neither more nor less. ” – Through the Looking Glass , Lewis Carroll FireEye recently published a blog covering the tactics , techniques , and procedures ( TTPs ) for the “ TRITON actor ” when preparing to deploy the TRITON S-MAL/TRISIS malware framework in 2017 .


Overall , the post does a commendable job in making public findings previously only privately shared ( presumably by FireEye , and in several reports I authored for my employer , Dragos ) to threat intelligence customers .


As such , the blog continues to push forward the narrative of how ICS attacks are enabled through prepositioning and initial intrusion operations – an item I have discussed at length .


Yet one point of confusion in the blog comes at the very start : referring to the entity responsible for TRITON as the “ TRITON actor ” .


This seems confusing as FireEye earlier publicly declared the “ TRITON actor ” as a discrete entity , linked to a Russian research institution , and christened it as “ TEMP.Veles ” .


In the 2018 public posting announcing TEMP.Veles , FireEye researchers noted that the institute in question at least supported TEMP.Veles activity in deploying TRITON , with subsequent public presentations at Cyberwarcon and the Kaspersky Lab sponsored Security Analyst Summit essentially linking TRITON and the research institute ( and therefore TEMP.Veles ) as one in the same .


Yet the most-recent posting covering TTPs from initial access through prerequisites to enable final delivery of effects on target ( deploying TRITON S-MAL/TRISIS ) avoids the use of the TEMP.Veles term entirely .


In subsequent discussion , FireEye personnel indicate that there was not “ an avalanche of evidence to substantiate ” anything more than “ TRITON actor ” – summing matters by indicating this term “ is the best we ’ve got for the public for now ” .


Meanwhile , parallel work at Dragos ( my employer , where I have performed significant work on the activity described above ) uncovered similar conclusions concerning TTPs and behaviors , for both the 2017 event and subsequent activity in other industrial sectors .