Upon receiving the command GUIFXB , the spyware launches a fake Facebook login page . Development of Bemstour has continued into 2019 . Their main targets reside in Russia , Ukraine , Belarus , Azerbaijan , Poland and Kazakhstan .


As soon as the victim tries to log in , it stores the victim 's credentials in /storage/0/DCIM/.fdat Facebook Login Figure 7 : Fake Facebook login The second command is IODBSSUEEZ , which further sends stolen credentials to the C & C server , as seen in Figure 8 . Unlike earlier attacks when Bemstour was delivered using Buckeye's Pirpi backdoor , in this attack Bemstour was delivered to the victim by a different backdoor Trojan (Backdoor.Filensfer) . They compromised various banking systems , including the Russian Central Bank 's Automated Workstation Client , ATMs , and card processing .


Stolen Data Figure 8 : Sending data to the attacker . The most recent sample of Bemstour seen by Symantec appears to have been compiled on March 23 , 2019 , eleven days after the zero-day vulnerability was patched by Microsoft . Threat Group-1314 : TG-1314 .


This functionality can be easily further extended to steal other information , such as bank credentials , although we did not see any banks being targeted in this attack . Filensfer is a family of malware that has been used in targeted attacks since at least 2013 . Threat Group-1314 is an unattributed threat group that has used


Calling functionality Command PHOCAs7 initiates calling functionality . The zero-day vulnerability found and reported by Symantec (CVE-2019-0703) occurs due to the way the Windows SMB Server handles certain requests . compromised credentials to log into a victim ’s remote access infrastructure .


The number to call is received along with the command , as seen in Figure 9 . While Symantec has never observed the use of Filensfer alongside any known Buckeye tools , information shared privately by another vendor included evidence of Filensfer being used in conjunction with known Buckeye malware (Backdoor.Pirpi) . Threat Group-3390 : TG-3390 ,Emissary Panda , BRONZE UNION , APT27 , Iron Tiger , LuckyMouse .


Call Command Figure 9 : The calling functionality . CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 . Threat Group-3390 is a Chinese threat group that extensively used strategic Web compromises to target victims .


The phone number is fetched from a response from the C & C server and is stored in str3 variable , which further is utilized using the tel : function . Buckeye's exploit tool , EternalRomance , as well as EternalSynergy , can exploit the CVE-2017-0143 message type confusion vulnerability to perform memory corruption on unpatched victim computers . The group has been active since at least 2010 and has targeted organizations in the aerospace , government , defense , technology energy , and manufacturing sectors .


Stealing SMS The Gxextsxms command is responsible for fetching all the SMS messages from the victim 's device and sending it over to the C & C server . In the case of the Buckeye exploit tool , the attackers exploited their own zero-day vulnerability (CVE-2019-0703) . Thrip is an espionage group that has targeted satellite communications ,telecoms ,and defense contractor companies in the U.S. and Southeast Asia .


Stealing SMS Figure 10 : Stealing SMS messages . It is noteworthy that the attackers never used the FuzzBunch framework in its attacks . The group uses custom malware as well as “ living off the land ” techniques .


Similarly , there are many crucial commands that further allow this spyware to perform additional functionality , such as executing commands sent by the C & C , clicking photos , capturing screenshots , stealing location information , and more . FuzzBunch is a framework designed to manage DoublePulsar and other Equation Group tools and was leaked by the Shadow Brokers in 2017 . NEODYMIUM is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims .


Further analysis Upon further research , we found this spyware to be developed by a framework similar to Spynote and Spymax , meaning this could be an updated version of these Trojan builders , which allow anyone , even with limited knowledge , to develop full-fledged spyware . There are multiple possibilities as to how Buckeye obtained Equation Group tools before the Shadow Brokers leak . The group has demonstrated similarity to another activity group called PROMETHIUM due to overlapping victim and campaign characteristics .


Many of the functionalities seen in this spyware are similar to Spynote and Spymax based on the samples we analyzed with some modifications . However , aside from the continued use of the tools , Symantec has found no other evidence suggesting Buckeye has retooled . NEODYMIUM is reportedly associated closely with BlackOasis operations , but evidence that the group names are aliases has not been identified .


This spyware sample communicates over dynamic DNS . this RTF exploits again the CVE-2017_1882 on eqnedt32.exe . Night Dragon is a campaign name for activity involving a threat group that has conducted activity originating primarily in China .


By doing so , attackers can easily set up the Trojan to communicate back to them without any need for high-end servers . And the dropper execute the iassvcs.exe to make a side loading and make the persistence . OilRig : IRN2 , HELIX KITTEN , APT34 .


Other common functionalities include executing commands received from the attacker , taking screenshots of the victim 's device , fetching locations , stealing SMS messages and most common features that every spyware may poses . This IP is very interesting because it connects with tele.zyns.com and old infrastructures used by chinese APT or DDOS Chinese team against the ancient soviet republics . OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014 .


Stealing Facebook credentials using fake Facebook activity is something we did n't observe in Spynote/Spymax versions but was seen in this spyware . Over the past three years , Filensfer has been deployed against organizations in Luxembourg , Sweden , Italy , the UK , and the U.S . The group has targeted a variety of industries , including financial , government , energy , chemical , and telecommunications , and has largely focused its operations within the Middle East .


This framework allows anyone to develop a malicious app with the desired icon and communication address . All zero-day exploits known , or suspected , to have been used by this group are for vulnerabilities in Internet Explorer and Flash . It appears the group carries out supply chain attacks , leveraging the trust relationship between organizations to attack their primary targets .


Some of the icons used can be seen below . According to reports , the Philippines is the most exposed country in ASEAN to the cyberattacks known as advanced persistent threats , or APTs . FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran , use of Iranian infrastructure , and targeting that aligns with nation-state interests .


We found 280 such apps in the past three months . Our analysis of this malware shows that it belongs to Hussarini , also known as Sarhust , a backdoor family that has been used actively in APT attacks targeting countries in the ASEAN region since 2014 . This group was previously tracked under two distinct groups , APT34 and OilRig , but was combined due to additional reporting giving higher confidence about the overlap of the activity .


A complete list of hashes can be found here . OutExtra.exe is a signed legitimate application from Microsoft named finder.exe . APT16 is a China based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations .


icons Figure 11 : Icons used to pose as famous apps . In addition to file-based protection , customers of the DeepSight Intelligence Managed Adversary and Threat Intelligence (MATI) service have received reports on Buckeye , which detail methods of detecting and thwarting activities of this group . APT17 : Deputy Dog .


All of these apps are developed by the same framework and hence have the same package name and certificate information as seen in Figure 12. certificate Figure 12 : Package name and certificate information . However , in this attack , this file is used to load the Hussarini backdoor via DLL hijacking . APT17 is a China based threat group that has conducted network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations .


Conclusion Due to the ubiquitous nature of mobile devices and the widespread use of Android , it is very easy for attackers to victimize Android users . Today , this malware is still actively being used against the Philippines . APT18 : TG-0416 , Dynamite Panda , Threat Group-0416 .


In such situations , mobile users should always take the utmost precautions while downloading any applications from the internet . Hussarini was first mentioned in APT campaigns targeting the Philippines and Thailand in 2014 . APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries , including , manufacturing , human rights , government , and .


It is very easy to trick victims to fall for such attacks . Further analysis showed that the Iron cybercrime group used two main functions from HackingTeam's source in both IronStealer and Iron ransomware . Group5 is a threat group with a suspected Iranian nexus , though this attribution is not definite .


Users looking forward to using the TikTok app amidst the ban might look for alternative methods to download the app . Xagent is the original filename Xagent.exe whereas seems to be the version of the worm . The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes , normally using Syrian and Iranian themes .


In doing so , users can mistakenly install malicious apps , such as the spyware mentioned in this blog . Xagent – A variant of JbossMiner Mining Worm” – a worm written in Python and compiled using PyInstaller for both Windows and Linux platforms . Group5 has used two commonly available remote access tools ( RATs ) , njRAT S-MAL and NanoCore , as well as an Android RAT , DroidJack .


The precautions you take online have been covered extensively in almost all of our blogs ; even so , we believe this information bears repeating . Its activities were traced back to 2010 in FireEye's 2013 report on operation Ke3chang – a cyberespionage campaign directed at diplomatic organizations in Europe . Honeybee is a campaign led by an unknown actor that targets humanitarian aid organizations and has been active in Vietnam , Singapore , Argentina , Japan , Indonesia , and Canada .


Please follow these basic precautions during the current crisis—and at all times : Install apps only from official stores , such as Google Play . We have been tracking the malicious activities related to this threat actor and discovered a previously undocumented malware family with strong links to the Ke3chang group – a backdoor we named Okrum . It has been an active operation since August of 2017 and as recently as February 2018 .


Never click on unknown links received through ads , SMS messages , emails , or the like . Furthermore , from 2015 to 2019 , we detected new versions of known malware families attributed to the Ke3chang group – BS2005 backdoors from operation Ke3chang and the RoyalDNS malware , reported by NCC Group in 2018 . Group7 : APT15 , Mirage , Vixen Panda , GREF , Playful Dragon , RoyalAPT .


Always keep the " Unknown Sources '' option disabled in the Android device . Ke3chang behind the attacks seemed to have a particular interest in Slovakia , where a big portion of the discovered malware samples was detected; Croatia , the Czech Republic and other countries were also affected . Ke3chang is a threat group attributed to actors operating out of China .


This disallows apps to be installed on your device from unknown sources . Our technical analysis of the malware used in these attacks showed close ties to BS2005 backdoors from operation Ke3chang , and to a related TidePool malware family discovered by Palo Alto Networks in 2016 that targeted Indian embassies across the globe . Ke3chang has targeted several industries , including oil , government , military , and more .


We would also like to mention that if you come across an app hiding it 's icon , always try to search for the app in your device settings ( by going to Settings - > Apps - > Search for icon that was hidden ) . The story continued in late 2016 , when we discovered a new , previously unknown backdoor that we named Okrum . Kimsuky : Velvet Chollima .


In the case of this spyware , search for app named TikTok Pro . The malicious actors behind the Okrum malware were focused on the same targets in Slovakia that were previously targeted by Ketrican 2015 backdoors . Kimsuky is a North Korean based threat group that has been active since at least September 2013 .


MITRE TAGS Action Tag ID App auto-start at device boot T1402 Input prompt T1411 Capture SMS messages T1412 Application discovery T1418 Capture audio T1429 Location tracking T1430 Access contact list T1432 Access call log T1433 Commonly used port T1436 Standard application layer protocol T1437 Masquerage as legitimate application T1444 Suppress application icon T1508 Capture camera T1512 Screen capture T1513 Foreground persistence T1541 DualToy : New Windows Trojan Sideloads Risky Apps to Android and iOS Devices We started connecting the dots when we discovered that the Okrum backdoor was used to drop a Ketrican backdoor , freshly compiled in 2017 . The group focuses on targeting Korean think tank as well as DPRK/nuclear-related targets .


By Claud Xiao September 13 , 2016 at 5:00 AM Over the past two years , we ’ ve observed many cases of Microsoft Windows and Apple iOS malware designed to attack mobile devices . In 2017 , the same entities that were affected by the Okrum malware and by the 2015 Ketrican backdoors again became targets of the malicious actors . The group was attributed as the actor behind the Korea Hydro & Nuclear Power Co.compromise .


This attack vector is increasingly popular with malicious actors as almost everyone on the planet carries at least one mobile device they interact with throughout any given day . This time , the attackers used new versions of the RoyalDNS malware and a Ketrican 2017 backdoor . Lazarus Group : HIDDEN COBRA , Guardians of Peace , ZINC , NICKEL ACADEMY .


Thanks to a relative lack of security controls applied to mobile devices , these devices have become very attractive targets for a broad range of malicious actors . According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 . Lazarus Group is a threat group that has been attributed to the North Korean government .


For example : WireLurker installed malicious apps on non-jailbroken iPhones Six different Trojan , Adware and HackTool families launched “ BackStab ” attacks to steal backup archives of iOS and BlackBerry devices The HackingTeam ’ s RCS delivered its Spyware from infected PCs and Macs to jailbroken iOS devices and BlackBerry phones Recently , we discovered another Windows Trojan we named “ DualToy ” which side loads malicious or risky apps to both Android and iOS devices via a USB connection . In addition to file-based protection , customers of the DeepSight has received reports on Buckeye , which detail methods of detecting and thwarting activities of this group . The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta .


When DualToy began to spread in January 2015 , it was only capable of infecting Android devices . In 2018 , we discovered a new version of the Ketrican backdoor that featured some code improvements . Malware used by Lazarus Group correlates to other reported campaigns , including Operation Flame , Operation 1Mission , Operation Troy , DarkSeoul , and Ten Days of Rain .


However , within six months the malicious actors added the capability to infect iOS devices . According to our telemetry , Okrum was used to target diplomatic missions in Slovakia , Belgium , Chile , Guatemala , and Brazil , with the attackers showing a particular interest in Slovakia . In late 2017 , Lazarus Group used KillDisk , a disk-wiping tool , in an attack against an online casino based in Central America .


DualToy is still active and we have detected over 8,000 unique samples belonging to this Trojan family to date . Indeed , we have detected various external tools being abused by Okrum , such as a keylogger , tools for dumping passwords , or enumerating network sessions . North Korean group definitions are known to have significant overlap , and the name Lazarus Group is known to encompass a broad range of activity .


It mainly targets Chinese users , but has also successfully affected people and organizations in the United States , United Kingdom , Thailand , Spain , and Ireland . The detection evasion techniques we observed in the Okrum malware include embedding the malicious payload within a legitimate PNG image , employing several anti-emulation and anti-sandbox tricks , as well as making frequent changes in implementation . Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea .


Credential phishing and an Android banking Trojan combine in Austrian mobile attacks NOVEMBER 03 , 2017 Overview Credential phishing , banking Trojans , and credit card phishing schemes are common threats that we regularly observe both at scale and in more targeted attacks . The unnamed company makes products used in the military and aerospace industries , and the hackers could have been after commercial secrets or more traditional espionage , according to ClearSky , the cybersecurity firm that exposed the operation . Some organizations track North Korean clusters or groups such as Bluenoroff , APT37 , and APT38 separately , while other organizations may track some activity associated with those group names by the name Lazarus Group .


However , Proofpoint researchers have recently observed phishing attacks that incorporate all of these elements in a single , multistep scheme involving the Marcher Android banking Trojan targeting customers of large Austrian banks . North Korean dictator Kim Jong Un has set ambitious economic goals , and some cybersecurity analysts have predicted he will unleash the Pyongyang-affiliated hackers to meet those deadlines by targeting multinational companies’ trade secrets . Leafminer : Raspite .


Attacks involving Marcher have become increasingly sophisticated , with documented cases involving multiple attack vectors and a variety of targeted financial services and communication platforms [ 1 ] [ 2 ] . According to ClearSky , the suspected Lazarus operatives looked to leverage a vulnerability in outdated WinRAR file-archiving software that hackers have been exploiting since it was disclosed last month . Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017 .


In this case , a threat actor has been targeting customers of Bank Austria , Raiffeisen Meine Bank , and Sparkasse since at least January 2017 . This new Lotus Blossom campaign delivers a malicious RTF document posing as an ASEAN Defence Minister's Meeting (ADMM) directory (decoy) that also carries an executable (payload) embedded as an OLE object , the Elise backdoor . Elderwood : Elderwood Gang , Beijing Group , Sneaky Panda .


The attacks described here begin with a banking credential phishing scheme , followed by an attempt to trick the victim into installing Marcher , and finally with attempts to steal credit card information by the banking Trojan itself . Just months after the APT32 watering hole activity against ASEAN-related websites was observed in Fall 2017 , this new activity clearly indicates the association (ASEAN) clearly remains a priority collection target in the region . Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora .


Analysis Marcher is frequently distributed via SMS , but in this case , victims are presented with a link in an email . Researchers implicated Lazarus Group because of digital clues including a malicious implant known as Rising Sun that has been attributed to the group . The group has targeted defense organizations , supply chain manufacturers , human rights and nongovernmental organizations ( NGOs ) , and IT service providers .


Oftentimes , the emailed link is a bit.ly shortened link , used to potentially evade detection . The attackers originally embedded an implant into the malicious document as a hypertext application (HTA) file , and then quickly moved to hide it in an image on a remote server and used obfuscated Visual Basic macros to launch the decoder script . Equation is a sophisticated threat group that employs multiple remote access tools .


The link leads to a phishing page that asks for banking login credentials or an account number and PIN . Lazarus used the open-source tool Invoke-PSImage , released December 20 , to embed the PowerShell script into the image file . The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives .


Figure 1 shows one such landing page using stolen branding from Bank Austria . Once the script runs , it passes the decoded script from the image file to the Windows command line in a variable $x , which uses cmd.exe to execute the obfuscated script and run it via PowerShell . FIN10 is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016 .


Figure 1 : Landing page for phishing scheme asking for the victim ’ s signatory number and PIN using stolen branding from Bank Austria Because the actor delivered phishing links using the bit.ly URL shortener , we can access delivery statistics for this particular campaign . The Department of Homeland Security (DHS) issued an alert about this activity on Jan. 24 2019 , warning that an attacker could redirect user traffic and obtain valid encryption certificates for an organization's domain names . The group uses stolen data exfiltrated from victims to extort organizations .


The link resolves to a URL designed to appear legitimate , with a canonical domain of sicher97140 [ . In the Sea Turtle campaign , Talos was able to identify two distinct groups of victims . Orangeworm is a group that has targeted organizations in the healthcare sector in the United States , Europe , and Asia since at least 2015 , likely for the purpose of corporate espionage .


] info including the “ bankaustria ” brand . The first group , we identify as primary victims , includes national security organizations , ministries of foreign affairs , and prominent energy organizations . Patchwork : Dropping Elephant , Chinastrats , MONSOON , Operation Hangover .


Figure 2 : Bit.ly statistics for a phishing landing page targeting Bank Austria customers The actor appears to have recently begun using “ .top ” top-level domains ( TLDs ) for their phishing landing pages and have implemented a consistent naming structure as shown below . The threat actors behind the Sea Turtle campaign show clear signs of being highly capable and brazen in their endeavors . Patchwork is a cyberespionage group that was first observed in December 2015 .


Earlier this year , the actor used “ .pw ” TLDs while the Bank Austria scheme highlighted above used “ .info ” . In most cases , threat actors typically stop or slow down their activities once their campaigns are publicly revealed . While the group has not been definitively attributed , circumstantial evidence suggests the group may be a pro-Indian or Indian entity .


Some recent campaigns against other bank customers also used “ .gdn ” TLDs . The threat actors behind the Sea Turtle campaign were successful in compromising entities by manipulating and falsifying DNS records at various levels in the domain name space . Patchwork has been seen targeting industries related to diplomatic and government agencies .


Other attacks on Bank Austria customers that we observed resolved to the following .top domains : Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817062 [ . If an attacker was able to compromise an organization's network administrator credentials , the attacker would be able to change that particular organization's DNS records at will . Much of the code used by this group was copied and pasted from online forums .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817461 [ . If the attackers were able to obtain one of these EPP keys , they would be able to modify any DNS records that were managed by that particular registrar . Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018 .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817465 [ . Captured legitimate user credentials when users interacted with these actor - controlled servers . PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817466 [ . The diagram below illustrates how we believe the actors behind the Sea Turtle campaign used DNS hijacking to achieve their end goals . Unknown .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817469 [ . As of early 2019 , the only evidence of the spear-phishing threat vector came from a compromised organization's public disclosure . Release_Time : unknow Report_URL : https://attack.mitre.org/groups/ APT19 ： Codoso , C0d0so0 , Codoso Team , Sunshop Group .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58712 [ . On January 4 , Packet Clearing House , which is not an Internet exchange point but rather is an NGO which provides support to Internet exchange points and the core of the domain name system , provided confirmation of this aspect of the actors’ tactics when it publicly revealed its internal DNS had been briefly hijacked as a consequence of the compromise at its domain registrar . APT19 is a Chinese-based threat group that has targeted a variety of industries , including defense , finance , energy , pharmaceutical , telecommunications , high tech , education , manufacturing , and legal services .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58717 [ . During a typical incident , the actor would modify the NS records for the targeted organization , pointing users to a malicious DNS server that provided actor-controlled responses to all DNS queries . In 2017 , a phishing campaign was used to target seven law and investment firms .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58729 [ . The next step for the actor was to build MitM servers that impersonated legitimate services to capture user credentials . Some analysts track APT19 S-APT and Deep Panda as the same group , but it is unclear from open source information if the groups are the same .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58729 [ . In addition to the MitM server IP addresses published in previous reports , Talos identified 16 additional servers leveraged by the actor during the observed attacks . APT28 : SNAKEMACKEREL , Swallowtail , Group 74 , Sednit , Sofacy , Pawn Storm , Fancy Bear , STRONTIUM , Tsar Team , Threat Group-4127 , TG-4127 .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id87721 [ . The attackers would then use the certificate on actor-controlled servers to perform additional MitM operations to harvest additional credentials . APT28 is a threat group that has been attributed to Russia's Main Intelligence Directorate of the Russian General Staff by a July 2018 U.S. Department of Justice indictment .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id87726 [ . In some cases , the victims were redirected to these actor-controlled servers displaying the stolen certificate . This group reportedly compromised the Hillary Clinton campaign , the Democratic National Committee , and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election .


] top/ These permutations of TLDs and canonical domains incorporating the legitimate domain expected by the targeted banking customers exemplifies recent trends in social engineering by threat actors . One notable aspect of the campaign was the actors' ability to impersonate VPN applications , such as Cisco Adaptive Security Appliance (ASA) products , to perform MitM attacks . APT28 has been active since at least 2004 .


Just as threat actors may use stolen branding in their email lures to trick potential victims , they reproduce a legitimate domain name in a fraudulent domain that is not controlled by the bank . At this time , we do not believe that the attackers found a new ASA exploit . APT29 : YTTRIUM , The Dukes , Cozy Bear , CozyDuke .


Once the victim enters their account information on the landing page , the phishing attack then requests that the user log in with their email address and phone number . Rather , they likely abused the trust relationship associated with the ASA's SSL certificate to harvest VPN credentials to gain remote access to the victim's network . APT29 is threat group that has been attributed to the Russian government and has operated since at least 2008 .


Figure 3 : Step two of the credential phish asking for the victim ’ s email address and phone number Having stolen the victim ’ s account and personal information , the scammer introduces a social engineering scheme , informing users that they currently do not have the “ Bank Austria Security App ” installed on their smartphone and must download it to proceed . As an example , DNS records indicate that a targeted domain resolved to an actor-controlled MitM server . This group reportedly compromised the Democratic National Committee starting in the summer of 2015 .


Figure 4 shows the download prompt for this fake app ; an English translation follows . In another case , the attackers were able to compromise NetNod , a non-profit , independent internet infrastructure organization based in Sweden . PLATINUM is an activity group that has targeted victims since at least 2009 .


Figure 4 : Alert prompting the victim to download an Android banking app ( English translation below ) , with stolen branding and fraudulent copy * * * Translation * * * Dear Customer , The system has detected that the Bank Austria Security App is not installed on your smartphone . Using this access , the threat actors were able to manipulate the DNS records for sa1[.]dnsnode[.]net . The group has focused on targets associated with governments and related organizations in South and Southeast Asia .


Due to new EU money laundering guidelines , the new Bank Austria security app is mandatory for all customers who have a mobile phone number in our system . This redirection allowed the attackers to harvest credentials of administrators who manage domains with the TLD of Saudi Arabia (.sa) . Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005 .


Please install the app immediately to avoid blocking your account . In one of the more recent campaigns on March 27 , 2019 , the threat actors targeted the Sweden-based consulting firm Cafax . The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm .


Follow the instructions at the bottom of this page . We assess with high confidence that Sea Turtle was targeted in an attempt to re-establish access to the NetNod network , which was previously compromised by this threat actor . PROMETHIUM is an activity group that has been active since at least 2012 .


Why you need the Bank Austria Security App : Due to outdated technology of the mobile network important data such as mTan SMS and online banking connections are transmitted unencrypted . Obtaining access to this ccTLD registrars would have allowed attackers to hijack any domain that used those ccTLDs . The group conducted a campaign in May 2016 and has heavily targeted Turkish victims .


Our security app allows us to transmit this sensitive data encrypted to you , thus increasing the security that you will not suffer any financial loss . These actors perform DNS hijacking through the use of actor-controlled name servers . PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics .


Step 1 : Download Bank Austria Security App Download the Bank Austria security app to your Android device . Sea Turtle have been more aggressive in their pursuit targeting DNS registries and a number of registrars , including those that manage ccTLDs . APT33 Elfin APT33 is a suspected Iranian threat group that has carried out operations since at least 2013 .


To do this , open the displayed link on your mobile phone by typing in the URL field of your browser or scan the displayed QR code . These actors use Let's Encrypts , Comodo , Sectigo , and self-signed certificates in their MitM servers to gain the initial round of credentials . The group has targeted organizations across multiple industries in the United States , Saudi Arabia , and South Korea , with a particular interest in the aviation and energy sectors .


* * * End translation * * * The phishing template then presents additional instructions for installing the fake security application ( Figure 5 ) : Figure 5 : Additional instructions telling the victim to give the app the requested permissions ( English translation below ) , with stolen branding and fraudulent copy * * * Translation * * * Step 2 : Allow installation Open your device 's settings , select Security or Applications ( depending on the device ) , and check Unknown sources . These actors have been more aggressive in their pursuit targeting DNS registries and a number of registrars , including those that manage ccTLDs . APT37 ScarCruft , Reaper , Group123 , TEMP.Reaper APT37 is a suspected North Korean cyber espionage group that has been active since at least 2012 .


Step 3 : Run installation Start the Bank Austria security app from the notifications or your download folder , tap Install . Once they have access to the network , they steal the organization's legitimate SSL certificate and use it on actor-controlled servers . The group has targeted victims primarily in South Korea , but also in Japan , Vietnam , Russia , Nepal , China , India , Romania , Kuwait , and other parts of the Middle East .


After successful installation , tap Open and enable the device administrator . We believe that the Sea Turtle campaign continues to be highly successful for several reasons . APT37 has also been linked to following campaigns between 2016-2018 : Operation Daybreak , Operation Erebus , Golden Time , Evil New Year , Are you Happy? , FreeMilk , Northern Korean Human Rights , and Evil New Year 2018 .


Finished ! Had more ccTLDs implemented security features such as registrar locks , attackers would be unable to redirect the targeted domains . APT38 APT38 is a financially-motivated threat group that is backed by the North Korean regime .


* * * End translation * * * Referring again to bit.ly , we can see click statistics for this campaign ( Figure 6 ) . The attackers stole organizations' SSL certificates associated with security appliances such as ASA to obtain VPN credentials , allowing the actors to gain access to the targeted network . The group mainly targets banks and financial institutions and has targeted more than 16 organizations in at least 13 countries since at least 2014 . APT3 : Gothic Panda , Pirpi , UPS Team , Buckeye , Threat Group-0110 , TG-0110 .


Figure 6 : bit.ly statistics for the fake Bank Austria Android app download link From this small sample , we see that 7 % of visitors clicked through to download the application , which is actually a version of the Marcher banking Trojan named “ BankAustria.apk ” , continuing the fraudulent use of the bank ’ s branding to fool potential victims . The threat actors were able to maintain long term persistent access to many of these networks by utilizing compromised credentials . APT3 is a China based threat group that researchers have attributed to China's Ministry of StateSecurity .


This sample is similar to those presented in other recent Marcher analyses [ 1 ] [ 2 ] . Cisco Talos will continue to monitor Sea Turtle and work with our partners to understand the threat as it continues to evolve to ensure that our customers remain protected and the public is informed . This group is responsible for the campaigns known as Operation Clandestine Fox , Operation Clandestine Wolf , and Operation Double Tap .


This particular application is signed with a fake certificate : Owner : CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Issuer CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Serial : 1c9157d7 Validity : 11/02/2017 00:16:46 03/20/2045 00:16:46 MD5 Hash : A8:55:46:32:15 If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file . As of June 2015 , the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong .


: A9 : D5:95 : A9:91 : C2:91:77:5D:30 : F6 SHA1 Hash : 32:17 : E9:7E:06 : FE:5D:84 : BE:7C:14:0C : C6:2B:12:85 : E7:03:9A:5F The app requests extensive permissions during installation that enable a range of activities supported by the malware . Create a link file in the startup folder for AutoHotkeyU32.exe , allowing the attack to persist even after a system restart . MITRE has also developed an APT3 Adversary Emulation Plan .


Those permission shown in bold below are the most problematic : Allows an application to write to external storage . More importantly , one of these files also enables the download of TeamViewer , a remote access tool that gives threat actors remote control over the system . APT30 is a threat group suspected to be associated with the Chinese government .


Allows an application to read from external storage . Such attacks highlight the need for caution before downloading files from unknown sources and enabling macro for files from unknown sources . While Naikon shares some characteristics with APT30 , the two groups do not appear to be exact matches .


Allows an application to use SIP service . The agency's hacking division freed it from having to disclose its often controversial operations to the NSA (its primary bureaucratic rival) in order to draw on the NSA's hacking capacities . APT32 : SeaLotus , OceanLotus , APT-C-00 .


Allows an application to collect battery statistics Allows an app to access precise location . By the end of 2016 , the CIA's hacking division , which formally falls under the agency's Center for Cyber Intelligence (CCI) , had over 5000 registered users and had produced more than a thousand hacking systems , trojans , viruses , and other weaponized malware . APT32 is a threat group that has been active since at least 2014 .


Allows an application to receive SMS messages . Such is the scale of the CIA's undertaking that by 2016 , its hackers had utilized more code than that used to run Facebook . The group has targeted multiple private sector industries as well as with foreign governments , dissidents , and journalists with a strong focus on Southeast Asian countries like Vietnam , the Philippines , Laos , and Cambodia .


Allows an application to send SMS messages . Wikileaks has carefully reviewed the Year Zero disclosure and published substantive CIA documentation while avoiding the distribution of 'armed' cyberweapons until a consensus emerges on the technical and political nature of the CIA's program and how such 'weapons' should analyzed , disarmed and published . They have extensively used strategic web compromises to compromise victims .


Allows an application to read SMS messages . These redactions include ten of thousands of CIA targets and attack machines throughout Latin America , Europe and the United States . The group is believed to be Vietnam based .


Allows an application to write SMS messages . The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell's 1984 , but Weeping Angel , developed by the CIA's Embedded Devices Branch (EDB) , which infests smart TVs , transforming them into covert microphones , is surely its most emblematic realization . FIN7 : Carbanak Group .


Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call . After infestation , Weeping Angel places the target TV in a 'Fake-Off' mode , so that the owner falsely believes the TV is off when it is on . FIN7 is a financially-motivated threat group that has primarily targeted the U.S. retail , restaurant , and hospitality sectors since mid-2015 .


Allows applications to access information about networks . As of October 2014 the CIA was also looking at infecting the vehicle control systems used by modern cars and trucks . They often use point-of-sale malware .


Allows applications to open network sockets . The CIA's Mobile Devices Branch (MDB) developed numerous attacks to remotely hack and control popular smart phones . A portion of FIN7 was run out of a front company called Combi Security .


Allows an application to read the user 's contacts data . Despite iPhone's minority share (14.5%) of the global smart phone market in 2016 , a specialized unit in the CIA's Mobile Development Branch produces malware to infest , control and exfiltrate data from iPhones and other Apple products running iOS , such as iPads . FIN7 is sometimes referred to as Carbanak Group , but these appear to be two groups using the same Carbanak malware and are therefore tracked separately .


Allows an application to read or write the system settings . The attack against Samsung smart TVs was developed in cooperation with the United Kingdom's MI5/BTSS . FIN8 is a financially motivated threat group known to launch tailored spearphishing campaigns targeting the retail , restaurant , and hospitality industries .


Allows an application to force the device to lock Allows applications to access information about Wi-Fi networks . CIA's arsenal includes numerous local and remote zero days developed by CIA or obtained from GCHQ , NSA , FBI or purchased from cyber arms contractors such as Baitshop . Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017 .


Allows applications to change Wi-Fi connectivity state . These techniques permit the CIA to bypass the encryption of WhatsApp , Signal , Telegram , Wiebo , Confide and Cloackman by hacking the smart phones that they run on and collecting audio and message traffic before encryption is applied . The group has mainly targeted victims in the defense , military , and government sectors .


Allows applications to change network connectivity state . The CIA also runs a very substantial effort to infect and control Microsoft Windows users with its malware . DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016 .


Analysis of the malware shows that it uses the common string obfuscation of character replacement ( Figure 7 ) : Figure 7 : Encoded Marcher Strings Figure 8 : Decoded Marcher Strings As noted , the application requests extensive permissions during installation ; Figure 9 shows the request to act as device administrator , a particular permission that should very rarely be granted to an app . CIA's malware includes multiple local and remote weaponized zero days , air gap jumping viruses such as Hammer Drill which infects software distributed on CD/DVDs , infectors for removable media such as USBs , systems to hide data in images or in covert disk areas Brutal Kangaroo and to keep its malware infestations going . The group heavily leverages open-source tools and custom payloads for carrying out attacks .


Figure 9 : Prompt for application permissions upon installation Figures 10 and 11 show the other permission screens for the app : Figure 10 Figure 10 : Part 1 of the permission screen for the app Figure 11 : Part 2 of the permission screen for the app Once installed the app will place a legitimate looking icon on the phone ’ s home screen , again using branding stolen from the bank . Many of these infection efforts are pulled together by the CIA's Automated Implant Branch (AIB) , which has developed several attack systems for automated infestation and control of CIA malware , such as Assassin and Medusa . Deep Panda : Shell Crew , WebMasters , KungFu Kittens , PinkPanther , Black Vine .


Figure 12 : Fake Bank Austria Security application icon In addition to operating as a banking Trojan , overlaying a legitimate banking app with an indistinguishable credential theft page , the malware also asks for credit card information from the user when they open applications such as the Google Play store . The CIA has developed automated multi-platform malware attack and control systems covering Windows , Mac OS X , Solaris , Linux and more , such as EDB's HIVE and the related Cutthroat and Swindle tools , which are described in the examples section below . Deep Panda is a suspected Chinese threat group known to target many industries , including government , defense , financial , and telecommunications .


Figure 13 : Popup asking for a credit card number The application also supports stealing credit card verification information ( Figures 14 and 15 ) . By hiding these security flaws from manufacturers like Apple and Google the CIA ensures that it can hack everyone &mdsh; at the expense of leaving everyone hackable . The intrusion into healthcare company Anthem has been attributed to Deep Panda .


Figure 14 : Information theft via fake credit card verification using stolen branding Figure 15 : Information theft via fake credit card verification using stolen branding Some of the campaigns appear to have a wider reach based on bit.ly statistics like this one from October 13 , 2017 : Figure 16 : bit.ly statistics for an October 13 , 2017 campaign Over several days during the last three months , Proofpoint researchers observed campaigns using similar techniques targeting the banking customers of Raffeisen and Sparkasse . Once in Frankfurt CIA hackers can travel without further border checks to the 25 European countries that are part of the Shengen open border area — including France , Italy and Switzerland . This group is also known as Shell Crew , WebMasters , KungFu Kittens , and PinkPanther .


A review of the bit.ly statistics for these campaigns shows that they were at least as effective in driving end-user clicks as the Bank Austria campaign analyzed above . A number of the CIA's electronic attack methods are designed for physical proximity . Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion .


Conclusion As our computing increasingly crosses multiple screens , we should expect to see threats extending across mobile and desktop environments . The attacker is provided with a USB containing malware developed for the CIA for this purpose , which is inserted into the targeted computer . Some analysts track Deep Panda and APT19 as the same group , but it is unclear from open source information if the groups are the same .


Moreover , as we use mobile devices to access the web and phishing templates extend to mobile environments , we should expect to see a greater variety of integrated threats like the scheme we detail here . The attacker then infects and exfiltrates data to removable media . Dragonfly : Energetic Bear .


As on the desktop , mobile users need to be wary of installing applications from outside of legitimate app stores and sources and be on the lookout for bogus banking sites that ask for more information than users would normally provide on legitimate sites . As an example , specific CIA malware revealed in Year Zero is able to penetrate , infest and control both the Android phone and iPhone software that runs or has run presidential Twitter accounts . Dragonfly is a cyber espionage group that has been active since at least 2011 .


Unusual domains , the use of URL shorteners , and solicitations that do not come from verifiable sources are also red flags for potential phishing and malware . For example , the CIA attack system Fine Dining , provides 24 decoy applications for CIA spies to use . They initially targeted defense and aviation companies but shifted to focus on the energy sector in early 2013 .


Ginp - A malware patchwork borrowing from Anubis November 2019 Intro ThreatFabric analysts have recently investigated an interesting new strain of banking malware . For example , Comodo was defeated by CIA malware placing itself in the Window's Recycle Bin . They have also targeted companies related to industrial control systems .


The malware was first spotted by Tatyana Shishkova from Kaspersky by end October 2019 , but actually dates back to June 2019 . CIA hackers discussed what the NSA's Equation Group hackers did wrong and how the CIA's malware makers could avoid similar exposure . A similar group emerged in 2015 and was identified by Symantec as Dragonfly 2.0 .


It is still under active development , with at least 5 different versions of the Trojan released within the last 5 months ( June - November 2019 ) . The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques 'stolen' from malware produced in other states including the Russian Federation . There is debate over the extent of the overlap between Dragonfly and Dragonfly 2.0 , but there is sufficient evidence to lead to these being tracked as two separate groups .


What makes Ginp stand out is that it was built from scratch being expanded through regular updates , the last of which including code copied from the infamous Anubis banking Trojan , indicating that its author is cherry-picking the most relevant functionality for its malware . This information is used by the CIA's 'JQJIMPROVISE' software (see below) to configure a set of CIA malware suited to the specific needs of an operation . Dragonfly 2.0 : Berserk Bear .


In addition , its original target list is extremely narrow and seems to be focused on Spanish banks . Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies . Dragonfly 2.0 is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least March 2016 .


Last but not least , all the overlay screens ( injects ) for the banks include two steps ; first stealing the victim ’ s login credentials , then their credit card details . HIVE is a multi-platform CIA malware suite and its associated control software . There is debate over the extent of overlap between Dragonfly 2.0 and Dragonfly , but there is sufficient evidence to lead to these being tracked as two separate groups .


Although multi-step overlays are not something new , their usage is generally limited to avoid raising suspicion . A series of standards lay out CIA malware infestation patterns which are likely to assist forensic crime scene investigators as well as Apple , Microsoft , Google , Samsung , Nokia , Blackberry , Siemens and anti-virus companies attribute and defend against attacks . DragonOK is a threat group that has targeted Japanese organizations with phishing emails .


Evolution The initial version of the malware dates back to early June 2019 , masquerading as a “ Google Play Verificator ” app . In April 2013 , Kaspersky Lab reported that a popular game was altered to include a backdoor in 2011 . Due to overlapping TTPs , including similar custom tools , DragonOK is thought to have a direct or indirect relationship with the threat group Moafee .


At that time , Ginp was a simple SMS stealer whose purpose was only to send a copy of incoming and outgoing SMS messages to the C2 server . Yet again , new supply-chain attacks recently caught the attention of ESET Researchers . It is known to use a variety of malware , including Sysget / HelloBridge , PlugX , PoisonIvy , FormerFirstRat , NFlog , and NewCT .


A couple of months later , in August 2019 , a new version was released with additional banking-specific features . Given that these attacks were mostly targeted against Asia and the gaming industry , it shouldn’t be surprising they are the work of the group described in Kaspersky’s Winnti – More than just a game” . Dust Storm is a threat group that has targeted multiple industries in Japan , South Korea , the United States , Europe , and several Southeast Asian countries .


This and following versions were masquerading as fake “ Adobe Flash Player ” apps . The OSB functions as the interface between CIA operational staff and the relevant technical support staff . CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013 .


The malware was able to perform overlay attacks and become the default SMS app through the abuse of the Accessibility Service . A sustained cyberespionage campaign targeting at least three companies in the United States and Europe was uncovered by Recorded Future and Rapid7 between November 2017 and September 2018 . It has targeted countries including Israel , Saudi Arabia , Turkey , the U.S. , Jordan , and Germany .


The overlay consisted of a generic credit card grabber targeting social and utility apps , such as Google Play , Facebook , WhatsApp , Chrome , Skype , Instagram and Twitter . The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant . Tick Group Continues Attacks .


Although early versions had some basic code and string obfuscation , protection of the third version of the malware was enhanced with the use of payload obfuscation . The attackers then enumerated access and conducted privilege escalation on the victim networks , utilizing DLL sideloading techniques documented in a US-CERT alert on APT10 to deliver malware . The " Tick " group has conducted cyber espionage attacks against organizations in the Republic of Korea and Japan for several years .


The capabilities remained unchanged , but a new endpoint was added to the Trojan C2 allowing it to handle the generic card grabber overlay and specific target overlays ( banking apps ) separately . On the two other victim networks , the attackers deployed a unique version of the UPPERCUT (ANEL) backdoor , known to have only been used by APT10 . The group focuses on companies that have intellectual property or sensitive information like those in the Defense and High-Tech industries .


In addition , the credit card grabber target list was expanded with Snapchat and Viber . APT10 actors then compressed proprietary data from Visma using WinRAR (deployed by the attackers) and exfiltrated to a Dropbox account using the cURL for Windows command-line tool . The group is known to use custom malware called Daserf , but also employs multiple commodity and custom tools , exploit vulnerabilities , and use social engineering techniques .


In the third version spotted in the wild , the author introduced parts of the source code of the infamous Anubis Trojan ( which was leaked earlier in 2019 ) . UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques . With multiple tools and anonymous infrastructure , they are running longstanding and persistent attack campaigns .


This change came hand in hand with a new overlay target list , no longer targeting social apps , but focusing on banking instead . we assess with high confidence that these incidents were conducted by APT10 also known as Stone Panda , menuPass , CVNX in an effort to gain access to networks and steal valuable intellectual property or gain commercial advantage . We have observed that the adversary has repeatedly attacked a high-profile target in Japan using multiple malware families for the last three years .


A remarkable fact is that all the targeted apps relate to Spanish banks , including targets never seen before in any other Android banking Trojan . On top of the breadth , volume , and targets of attacks that APT10 has conducted since at least 2016 , we now know that these operations are being run by the Chinese intelligence agency , the Ministry of State Security (MSS) . Symantec was first to publicly report on Tick , followed by LAC in 2016 .


The 24 target apps belong to 7 different Spanish banks : Caixa bank , Bankinter , Bankia , BBVA , EVO Banco , Kutxabank and Santander . Utilizing actors working for shell companies such as Huaying Haitai Science and Technology Development Co Ltd , the MSS has conducted an unprecedented campaign , dubbed Operation Cloud Hopper , ” against managed IT service providers (MSPs) designed to steal intellectual property and enable secondary attacks against their clients . These reports discussed the group ’s malware , Daserf ( a.k.a Muirim or Nioupale ) and some additional downloader programs .


The specific apps can be found in the target list in the appendix . We assess that APT10 likely compromised Visma with the primary goal of enabling secondary intrusions onto their client networks , and not of stealing Visma intellectual property . Though Daserf wasn’t a popular attack tool at the time of publishing the two reports , it dates back to at least 2011 .


The most recent version of Ginp ( at the time of writing ) was detected at the end of November 2019 . In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage . Using AutoFocus , we were able to identify the link among Daserf and two other threats , 9002 and Invader .


This version has some small modifications which seems to be unused , as the malware behaviour is the same as the previous version . The backdoor was deployed using the Notepad++ updater and sideloading malicious DLL , as noted in APT10’s targeting of Japanese corporations in July 2018 . These threats shared infrastructure between July 2012 and April 2013 .


The author has introduced the capability to grant the app the device admin permission . That attack was attributed to perpetrators Kaspersky called the Winnti Group . Invader ( a.k.a Kickesgo ) is a backdoor that injects its main code into a legitimate process , such as explorer.exe , and has following functions :


Additionally new endpoint was added that seems related to downloading a module for the malware , probably with new features or configuration . APT10 is a threat actor that has been active since at least 2009 . Logs keystrokes and mouse movement Captures screenshots Opens cmd.exe shell Enumerates processes Executes programs Removes itself Enumerates all opening TCP and UDP ports .


How it works When the malware is first started on the device it will begin by removing its icon from the app drawer , hiding from the end user . APT10 has historically targeted healthcare , defense , aerospace , government , heavy industry and mining , and MSPs and IT services , as well as other sectors , for probable intellectual property theft . 9002 is the infamous RAT frequently seen in targeted attacks reported by various security vendors , including Palo Alto Networks .


In the second step it asks the victim for the Accessibility Service privilege as visible in following screenshot : Ginp Accessibility request Once the user grants the requested Accessibility Service privilege , Ginp starts by granting itself additional permissions , such as ( dynamic ) permissions required in order to be able to send messages and make calls , without requiring any further action from the victim . We believe APT10 is the most significant Chinese state-sponsored cyber threat to global corporations known to date . Interestingly , the C2 servers linking 9002 to Daserf were described in the report of an Adobe Flash Zero-day attack from FireEye in 2013 .


When done , the bot is functional and ready to receive commands and perform overlay attacks . In the blog , Intrusion Truth identified APT10 as having utilized several Tianjin-based companies , including Huaying Haitai Science and Technology Development Co Ltd and Laoying Baichen Instruments Equipment Co Ltd . These domains were registered through the privacy protection services in 2008 and 2011 .


The commands supported by the most recent version of the bot are listed below . Based on the technical data uncovered , and in light of recent disclosures by the U.S. Department of Justice on the ongoing activities of Chinese state-sponsored threat actors . krjregh.sacreeflame.com lywja.healthsvsolu.com .


As can be observed , the possibilities offered by the bot are pretty common . Our research from 2017 concluded that Guangdong ITSEC (and therefore the MSS) directed the activities of a company named Boyusec , which was identified as a shell company for APT3 . Though we don’t know the targets of these malware samples at the time of writing this article , we suspect the same group is behind these threats for a number of reasons .


Command Description SEND_SMS Send an SMS from the bot to a specific number NEW_URL Update the C2 URL KILL Disable the bot PING_DELAY Update interval between each ping request CLEAN_IGNORE_PKG Empty list of overlayed apps WRITE_INJECTS Update target list READ_INJECTS Get current target list START_ADMIN Request Device Admin privileges ALL_SMS Get all SMS messages DISABLE_ACCESSIBILITY Stop preventing user from disabling the accessibility service ENABLE_ACCESSIBILITY Prevent user from disabling Access to the networks of these third-party service providers grants the MSS the ability to potentially access the networks of hundreds , if not thousands , of corporations around the world . The samples of Daserf that shared infrastructure were submitted to VirusTotal only from Japan multiple times in 2013 .


the accessibility service ENABLE_HIDDEN_SMS Set malware as default SMS app DISABLE_HIDDEN_SMS Remove malware as default SMS app ENABLE_EXTENDED_INJECT Enable overlay attacks DISABLE_EXTENDED_INJECT Disable overlay attacks ENABLE_CC_GRABBER Enable the Google Play overlay DISABLE_CC_GRABBER Disable the Google Play overlay START_DEBUG Enable debugging GET_LOGCAT Get logs from the device STOP_DEBUG Disable debugging GET_APPS The December APT10 indictment noted that the group’s malicious activities breached at least 45 companies and managed service providers in 12 countries , including Brazil , Canada , Finland , France , Germany , India , Japan , Sweden , Switzerland , the United Arab Emirates , the United Kingdom , and the United States . As noted in a later section , another Invader sample shared different C2 servers with Daserf .


Get installed applications GET_CONTACTS Get contacts SEND_BULK_SMS Send SMS to multiple numbers UPDATE_APK Not implemented INJECT_PACKAGE Add new overlay target CALL_FORWARD Enable/disable call forwarding START_PERMISSIONS Starts request for additional permissions ( Accessibility privileges , battery optimizations bypass , dynamic permissions ) Features The most recent version of Ginp has the same capabilities as most other Android banking Trojans , such as the use of overlay attacks , SMS control and contact In all three incidents , APT10 gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials . Symantec reported that Tick exploited additional Adobe Flash and Microsoft Office vulnerabilities .


list harvesting . In all three incidents , the attackers gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials . SecureWorks said the adversary group is abusing a previously undisclosed vulnerability in Japanese Software Asset Management system on endpoints .


Overall , it has a fairly common feature list , but it is expected to expand in future updates . In all three incidents , APT10 actors used previously acquired legitimate credentials , possibly gained via a third-party supply chain compromise in order to gain initial access to the law firm and the apparel company . Therefore , Tick or their digital quartermaster is capable of deploying new and unique exploits .


Since Ginp is already using some code from the Anubis Trojan , it is quite likely that other , more advanced features from Anubis or other malware , such as a back-connect proxy , screen-streaming and RAT will also be added in the future . In early 2017 , APT10 began conducting attacks against global managed IT service providers (MSPs) that granted them unprecedented access to MSPs and their customers’ networks . In July 2016 , we identified a compromised website in Japan that was hosting a Daserf variant .


Ginp embeds the following set of features , allowing it to remain under the radar and successfully perform attacks : Overlaying : Dynamic ( local overlays obtained from the C2 ) SMS harvesting : SMS listing SMS harvesting : SMS forwarding Contact list collection Application listing Overlaying : Targets list update SMS : Sending Calls : Call forwarding C2 Resilience : Auxiliary C2 list Self-protection : Hiding the App icon Self-protection : Preventing removal Self-protection : Emulation-detection Update 'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS (JukeBox) and Linux (DanceFloor) . The web server was also a C2 server for another threat , Minzen ( a.k.a , XXMM , Wali , or ShadowWali ) .


10/03/2020 At the end of February the actors behind Ginp added screen capture capabilities to their Trojan . During this operation (dubbed ‘Cloud Hopper” because of the group’s use of popular western cloud-based services) , APT10 utilized both new malware (Quasar RAT , Trochilus , RedLeaves , ChChes as well as some familiar old tools . The threat often uses compromised web servers in Japan and the Republic of Korea .


Like previously added functionality , the code is borrowed from the leaked Anubis Trojan source code . Most recently , on December 20 , 2018 , the U.S. Department of Justice charged two hackers associated with the Chinese Ministry of State Security (MSS) with global computer intrusion campaigns targeting intellectual property . As Kaspersky and Cybereason recently posted , Minzen is a modular malware that has both 32-bit and 64-bit components in its resource section or configuration data in its body .


It enables the bot to stream screenshots and send them to the C2 so that actors can see what is happening on the screen of the infected device . This indictment attributed the intrusions to APT10 , a group that had been conducting the malicious activities for over a decade on behalf of the MSS , China’s civilian human intelligence agency . One of the Minzen samples ( SHA256 : 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 ) found in the Republic of Korea in December 2016 installs simple backdoor module as a final payload on a compromised computer .


Overlay attack Ginp uses the Accessibility Service to check which application runs is the foreground . The Visma group operates across the entire Nordic region along with Benelux , Central , and Eastern Europe . It opens a TCP port and receives commands from a remote attacker .


If the package name of the foreground app is included in the target list , an overlay is shown . Recorded Future has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 . According to the debug path in the body , the author of the tool called it “ NamelessHdoor , ” and its internal version is identified as “ V1.5. ”


The WebView-based overlay is loading an HTML page provided by the C2 in response to the package name provided by the bot . We were particularly interested in identifying whether any customers of the targeted MSPs were subsequently compromised by APT10 , given their potential access through compromised MSP networks . The payload is based on “ Nameless Backdoor ” which has been publicly available for more than ten years .


Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps , first stealing the victim ’ s login credentials , then stealing the credit card details ( to “ validate ” the user identity ) , as shown in the screenshots hereafter : The following code snippet shows that after the second overlay is filled-in and validated , it disappears and the targeted application is added to the list of packages names to be ignored for future overlays attacks . Recorded Future’s Insikt Group has actively tracked APT10 for several years , focusing specifically on the group’s targeting of MSPs and global internet infrastructure providers since the Operation Cloud Hopper report in 2017 . The oldest code we could identify was hosted on a famous Chinese source code sharing site since 2005 .


Targets The initial version of Ginp had a generic credit card grabber overlay screen used for all targeted applications . In September 2018 , one of our clients (and a supplier as well) , Visma , reached out to us for assistance in investigating an incident uncovered on their network following a breach notification by Rapid7 . The author of the NamelessHdoor appears to have created additional versions of the Nameless Backdoor by removing unnecessary functions , and added open-source DLL injection code from ReflectiveDLLLoader .


Still included in the last versions , this screen is only used to overlay the official Google Play Store app . This was followed by an initial exploitation , network enumeration , and malicious tool deployment on various Visma endpoints within two weeks of initial access . There is minimal public information regarding the Nameless Backdoor , except for the interesting report from Cyphort in 2015 .


More apps could be added to the grabber target list in the future , such as the ones that were targeted in older versions : Facebook WhatsApp Skype Twitter Chrome Instagram Snapchat Viber The following screenshot shows the generic card grabber overlay screen : Ginp generic grabber The current active target list is available in the appendix , containing a total of 24 unique targets . On August 30 , 2018 , APT10 deployed their first modified version of Trochilus that had its C2 communications encrypted using Salsa20 and RC4 ciphers instead of the more common RC4-encrypted Trochilus variant seen in the wild . The researcher of the company analyzed multiple threats , including Invader , Nioupale (Daserf ) and Hdoor found in an attack against an Asian financial institution .


The following screenshots show what type of information is collected in both steps of the overlay attack : Ginp overlaysGinp overlaysGinp overlaysGinp overlays Based on Anubis Once the Anubis bot code got leaked , it was just a matter of time before new banking Trojans based on Anubis would surface . This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 . We examined the sample described in the report as Hdoor and found it ’s a previous version of the NamelessHdoor we discovered in the Minzen sample , but without support for DLL injection .


When analyzing the Ginp ’ s recent samples , ThreatFabric analysts found some similarities with the famous Android banking Trojan . The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process . It turned out that the DLL files we found are a custom variant of Gh0st RAT , and the EXE files download the RAT .


Based on the evolution of Ginp it is clear that it isn ’ t based on Anubis , but rather reuses some of its code . APT10 also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API . Since the source code is publicly available , Gh0st RAT has been used by multiple actors for years .


Below are some of the elements showing the relation . In order to exfiltrate the compromised data , APT10 employed custom malware that used Dropbox as its C2 . The domain , softfix.co.kr was registered in 2014 .


The names used for Android components are similar : Similarities with AnubisSimilarities with Anubis When analyzing these components , similarities were found in the code of both malware families : Similarities with Anubis Another major change that indicated that the actor copied code from the Anubis Trojan is the way of handling configuration values . They also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API . One of subdomains , news.softfix.co.kr was the C2 server of Daserf ( 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423 ) .


Previous versions were storing config values within the variables of a class , while the latest version is using SharedPreferences with some of the keys being identical to those used by Anubis : isAccessibility time_work time_start_permission url_inj Conclusion Ginp is a simple but rather efficient banking Trojan providing the basic functionality to be able to trick victims into delivering personal information . Our research partner Rapid7 investigated the Dropbox use and found that the attackers had used the same account to store exfiltrated data from a global apparel company . Another subdomain , bbs.softfix.co.kr was hosted on same IP address as bbs.gokickes.com , which was reported as the C2 server of Invader by Cyphort .


In a 5-month timespan , actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging , back-connect proxy or RAT capabilities . They also identified broadly similar TTPs being used in the attack against a U.S law firm specializing in intellectual property law . We also identified www.gokickes.com was the C2 of another Invader variant ( 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb ) .


Ginp ’ s unusual target selection is not just about its focus on Spanish banks but also the wide selection of targeted apps per bank . Rapid7’s investigation revealed the law firm was first targeted in late 2017 , followed by the apparel company a few months later , and finally , the Visma attack in August 2018 . In addition to the infrastructure , the attacker also shared code .


The fact that the overlay screens are almost identical to the legitimate banking apps suggests that the actors might be very familiar with the Spanish banking applications and might even be accustomed to the language . In one of the attacks , Rapid7 identified the attackers escaping a Citrix application in order to run the payload script on the victim desktop . The Gh0st downloaders employ simple substitution ciphers for hiding strings .


Although the current target list is limited to Spanish apps , it seems that the actor is taking into account that the bot should also be able to target other countries , seeing that the path used in the inject requests contains the country code of the targeted institution . Additionally , the same DLL sideloading technique observed in the Visma attack was used , and many of the tools deployed by the APT10 shared naming similarities as well 1.bat , cu.exe , ss.rar , r.exe , pd.exe . We also identified another malware family , HomamDownloader , sharing some servers with Daserf .


This could indicate that actor already has plans in expanding the targets to applications from different countries and regions . Most interestingly , Rapid7 observed the use of the Notepad++ updater gup.exe as a legitimate executable to sideload a malicious DLL (libcurl.dll) in order to deploy a variant of the UPPERCUT backdoor also known as ANEL . An overview of the connections among these threats is discussed in below .


Appendix Samples Some of the latest Ginp samples found in the wild : App name Package name SHA-256 hash Google Play Verificator sing.guide.false 0ee075219a2dfde018f17561467272633821d19420c08cba14322cc3b93bb5d5 Google Play Verificator park.rather.dance 087a3beea46f3d45649b7506073ef51c784036629ca78601a4593759b253d1b7 Adobe Flash Player ethics.unknown.during APT10 used this approach to deploy UPPERCUT when targeting Japanese corporations in July 2018 . HomamDownloader is a small downloader program with minimal interesting characteristics from a technical point of view .


5ac6901b232c629bc246227b783867a0122f62f9e087ceb86d83d991e92dba2f Adobe Flash Player solution.rail.forward 7eb239cc86e80e6e1866e2b3a132b5af94a13d0d24f92068a6d2e66cfe5c2cea Adobe Flash Player com.pubhny.hekzhgjty 14a1b1dce69b742f7e258805594f07e0c5148b6963c12a8429d6e15ace3a503c APT10 actors gained initial access to the Visma network around August 17 , 2018 . HomamDownloader was discovered to be delivered by Tick via a spearphishing email .


Adobe Flash Player sentence.fancy.humble 78557094dbabecdc17fb0edb4e3a94bae184e97b1b92801e4f8eb0f0626d6212 Target list The current list of apps observed to be targeted by Ginp contains a total of 24 unique applications as seen below . While we are confident that APT10 actors gained access to the Visma network in August using stolen employee Citrix remote desktop credentials , it is not clear how or when these credentials were initially compromised . The adversary crafted credible email and attachment after understanding the targets and their behavior .


This list is expected to grow in the future . Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials . The email below was sent from a personal email account with a subject line of “ New Year Wishes on January 1st ” .


Why Did Chinese Spyware Linger in U.S . After almost two weeks , on August 30 , 2018 , APT10 attackers used their access to the network to move laterally and made their first deployment of an RC4- and Salsa20-encrypted variant of the Trochilus malware using a previously associated DLL sideloading techniquE . The message asked the recipient to rename the attachment extension from “ ._X_ ” to “ .exe ” and opening it with the password specified in the email to view the Happy New Year eCard in the correct and polite language .


Phones ? This means that APT10 actors had two separate access points into the Visma network . In addition to the social engineering email technique , the attacker also employs a trick to the attachment .


November 16 , 2016 In what 's being chalked up as an apparent mistake , more than 120,000 Android phones sold in the U.S. were shipped with spying code that sent text messages , call logs and other sensitive data to a server in Shanghai . This slight delay may point to the handing over of active exploitation duties to other operator(s) in a multi-team APT10 effort within the Ministry of State Security for the attack . The actor embedded malicious code to a resource section of the legitimate SFX file created by a file encryption tool , and modified the entry point of the program for jumping to the malicious code soon after the SFX program starts .


The New York Times reported on Nov. 15 that Kryptowire , a mobile enterprise security company , discovered the code on a lower-end smartphone made by BLU Products of Doral , Fla . Other examples of malicious infrastructure registered with internet.bs include domains for APT28’s VPNFilter malware campaign and the registration of the cyber-berkut . The malicious code drops HomamDownloader , then jumps back to the regular flow in the CODE section , which in turn asks the user the password and decrypts the file .


The phones are sold at Best Buy and Amazon.com , among other retail outlets . org domain that was affiliated with the pro-Russian and potentially Russian state-linked threat actor CyberBerkut . Therefore , once a user executes the attachment and sees the password dialog on SFX , the downloader dropped by the malicious code starts working even if the user chooses the Cancel on the password window .


Kryptowire says the code , which it found on a BLU R1 HD devices , transmitted fine-grained location information and allowed for the remote installation of other apps . KHRAT is a backdoor trojan purported to be used with the China-linked cyberespionage group DragonOK . Should the user become aware of the infection later , it may be difficult to find the cause due to the fact that the original embedded file contained within the SFX is benign .


Text message and call logs were transmitted every 72 hours to the Shanghai server , and once a day for other personally identifiable data , the company says . In early 2018 , Rapid7 identified that APT10 compromised an apparel company , based upon detections and intelligence gathered from the U.S.-based law firm breach . Tick was spotted last year , but they are actively and silently attacking various organizations in South Korea and Japan for a number of years .


It turns out , however , that other security researchers noticed suspicious and faulty code on BLU devices as early as March 2015 , and it has taken nearly that long to remove it from the company 's devices . The attacker gained access to the victim’s internet-accessible Citrix systems and authenticated to them from networks associated with low-cost VPN providers owned by VPN Consumer Network . While some of the group ’s tools , tactics , and procedures ( TTPs ) have been covered within this article , it is likely there is much that still remains uncovered .


The finding , in part , shows the risk that can come in opting for less expensive smartphones , whose manufacturers may not diligently fix security vulnerabilities . Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe The attackers used identical TTPs for executing malware and Mimikatz as observed before , by using DLL sideloading with known good binaries that had DLL search order path issues . Daserf : 04080fbab754dbf0c7529f8bbe661afef9c2cba74e3797428538ed5c243d705a .


It 's also raising eyebrows because of the connection with China , which has frequently sparred with the U.S. over cyber espionage . Rapid7 reviewed malware discovered in the victim’s environment and found implants that used Dropbox as the C2 . Daserf : f8458a0711653071bf59a3153293771a6fb5d1de9af7ea814de58f473cba9d06 .


BLU Products has now updated its phones to remove the spying code , which most likely would have never been detected by regular users . The attackers used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script . Daserf : e8edde4519763bb6669ba99e33b4803a7655805b8c3475b49af0a49913577e51 .


The code never informed phone users that it was collecting that data , a behavior uniformly viewed by many as a serious security concern . APT10 used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script . Daserf : 21111136d523970e27833dd2db15d7c50803d8f6f4f377d4d9602ba9fbd355cd .


The developer of the code , Shanghai Adups Technology Co. , has apologized , contending that the code was intended for another one of its clients who requested better blocking of junk text messages and marketing calls . For exfiltration of stolen data , APT10 used WinRAR and renamed rar.exe to r.exe to create archives , upload them with curl.exe (renamed to c.exe , and again , use the cloud storage provider Dropbox . Daserf : 9c7a34390e92d4551c26a3feb5b181757b3309995acd1f92e0f63f888aa89423 .


Vulnerabilities Reported BLU Products , founded in 2009 , makes lower-end Android-powered smartphones that sell for as little as $ 50 on Amazon . Rapid7 discovered that additional data was placed into the Dropbox accounts under control of the attacker during the compromise and was able to attribute data that was placed into it as being owned by Visma . Invader : 0df20ccd074b722d5fe1358b329c7bdebcd7e3902a1ca4ca8d5a98cc5ce4c287 .


Like many original equipment manufacturers , it uses software components from other developers . Once on the Visma network , APT10 attackers used the Microsoft BITSAdmin CLI tool to copy malicious tools from a suspected attacker-controlled C2 hosted on 173.254.236[.]158 to the \ProgramData\temp\ directory on the infected host . Invader : e9574627349aeb7dd7f5b9f9c5ede7faa06511d7fdf98804526ca1b2e7ce127e .


The company uses a type of software from Adups that 's nicknamed FOTA , short for firmware over-the-air . Rapid7 then provided a breach notification to Visma to alert them to this compromise in September 2018 . Invader : 57e1d3122e6dc88d9eb2989f081de88a0e6864e767281d509ff58834928895fb . 9002 S-MAL:933d66b43b3ce9a572ee3127b255b4baf69d6fdd7cb24da609b52ee277baa76e . 9002 S-MAL:2bec20540d200758a223a7e8f7b2f98cd4949e106c1907d3f194216208c5b2fe . 9002 S-MAL:055fe8002de293401852310ae76cb730c570f2037c3c832a52a79b70e2cb7831 .


The software manages the delivery of firmware updates over-the-air , the term used for transmission via a mobile network . We believe APT10 is the most significant known Chinese state-sponsored cyber threat to global corporations . Minzen : 797d9c00022eaa2f86ddc9374f60d7ad92128ca07204b3e2fe791c08da9ce2b1 .


Firmware is low-level code deep in an operating system that often has high access privileges , so it 's critical that it 's verified and contains no software vulnerabilities . APT10's unprecedented campaign against MSPs , alleged to have included some of the largest MSPs in the world , in order to conduct secondary attacks against their clients , grants the Chinese state the ability to potentially access the networks of hundreds (if not thousands) of corporations around the world . Minzen : 9374040a9e2f47f7037edaac19f21ff1ef6a999ff98c306504f89a37196074a2 .


Long before Kryptowire 's announcement , Tim Strazzere , a mobile security researcher with RedNaga Security , contacted BLU Products in March 2015 after he found two vulnerabilities that could be traced to Adup 's code . This campaign brings to light further evidence supporting the assertions made by the Five Eyes nations , led by the U.S Department of Justice indictment against APT10 actors outlining the unprecedented scale of economic cyberespionage being conducted by the Chinese Ministry of State Security . Minzen : 26727d139b593486237b975e7bdf93a8148c52d5fb48d5fe540a634a16a6ba82 .


Those vulnerabilities could have enabled someone to gain broad access to an Android device . This report , alongside the plethora of other reporting on APT10 operations , acutely highlights the vulnerability of organizational supply chains . NamelessHdoor : dfc8a6da93481e9dab767c8b42e2ffbcd08fb813123c91b723a6e6d70196636f .


Strazzere 's colleague , Jon Sawyer , suggested on Twitter that the vulnerabilities might have not been there by mistake , but rather included as intentionally coded backdoors . We believe the groups moved to use CVE-2018-0798 instead of the other Microsoft Equation Editor Remote Code Execution (RCE) vulnerabilities because the former is more reliable as it works on all known versions of Equation Editor . Gh0stRAt Downloader : ce47e7827da145823a6f2b755975d1d2f5eda045b4c542c9b9d05544f3a9b974 .


He posted a tweet to The New York Times report , sarcastically writing , " If only two people had called this company out for their backdoors several times over the last few years . The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 . Gh0stRAt Downloader : e34f4a9c598ad3bb243cb39969fb9509427ff9c08e63e8811ad26b72af046f0c .


'' Strazzere 's experience in trying to contact both vendors last year is typical of the frustrations frequently faced by security researchers . After further analysis , it was discovered that the RTF files were exploiting the CVE-2018-0798 vulnerability in Microsoft’s Equation Editor (EQNEDT32) . Custom Gh0st : 8e5a0a5f733f62712b840e7f5051a2bd68508ea207e582a190c8947a06e26f40 .


" I tried reaching out to Adups and never heard back , '' Strazzere tells Information Security Media Group . Anomali Researchers were able to identify multiple samples of malicious RTF documents ITW using the same exploit for CVE-2018-0798 . Datper : 7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849 .


" BLU said they had no security department when I emailed them . The earliest use of the exploit ITW we were able to identify and confirm is a sample (e228045ef57fb8cc1226b62ada7eee9b) dating back to October 2018 (VirusTotal submission of 2018-10-29) with the RTF creation time 2018-10-23 . HomamDownloader : a624d2cd6dee3b6150df3ca61ee0f992e2d6b08b3107f5b00f8bf8bcfe07ebe7 .


'' Strazzere says he also failed to reach MediaTek , a Taiwanese fabless semiconductor manufacturer whose chipsets that powered BLU phones also contained Adups software . CVE-2018-0798 is an RCE vulnerability , a stack buffer overflow that can be exploited by a threat actor to perform stack corruption . C2 : lywjrea.gmarketshop.net .


To their credit , both Google and Amazon appear to have put pressure on device manufacturers to fix their devices when flaws are found , Strazzere says . As observed previously with CVE-2017-11882 and CVE-2018-0802 , the weaponizer was used exclusively by Chinese cyber espionage actors for approximately one year December 2017 through December 2018 , after which cybercrime actors began to incorporate it in their malicious activity . C2 : krjregh.sacreeflame.com .


For Google , Android security issues - even if not in the core operating code - are a reputation threat , and for Amazon , a product quality issue . Upon decrypting and executing , it drops two additional files wsc_proxy.exe (legitimate Avast executable) and a malicious DLL wsc.dll in the %TEMP% folder . C2 : psfir.sacreeflame.com .


But devices sold outside of Amazon " might not have ever seen fixes , '' he says . However , Beginning on 25 June 2019 , we started observing multiple commodity campaigns Mostly dropping AsyncRAT using the updated RTF weaponizer with the same exploit (CVE-2018-0798) . C2 : lywja.healthsvsolu.com .


Officials at BLU could n't be immediately reached for comment . Analysis of the Royal Road weaponizer has resulted in the discovery that multiple Chinese threat groups started utilizing CVE-2018-0798 in their RTF weaponizer . C2 : phot.healthsvsolu.com .


Attitude Change The disinterest in the issues appears to have changed with The New York Times report , which lit a fire underneath Adups and BLU . These findings also suggest that the threat groups have robust exploit developing capabilities because CVE-2018-0798 is not widely reported on and it is typically not incorporated into publicly available weaponizers . C2 : blog.softfix.co.kr .


Adups addressed the issue in a Nov. 16 news release , writing that some products made by BLU were updated in June with a version of its FOTA that had actually been intended for other clients who had requested an ability to stop text spam . In addition , a current ANY.RUN playback of our observed Elise infection is also available . C2 : news.softfix.co.kr .


That version flags messages " containing certain language associated with junk texts and flags numbers associated with junk calls and not in a user 's contacts , '' the company says . Upon opening of the MS Word document , our embedded file exploits CVE-2017-11882 to drop a malicious fake Norton Security Shell Extension module , 'NavShExt.dll' , which is then injected into iexplore.exe to install the backdoor , begin collection , and activate command and control . C2 : www.gokickes.com .


Manufacturers should be keeping close tabs on what software ends up on their devices . Moving through the infection process , NetWitness Endpoint detects the initial exploit CVE-2017-1182 in action as the Microsoft Equation Editor , EQNEDT32.exe , scores high for potentially malicious activity . C2 : log.gokickes.com .


But it would appear that BLU only took action after Kryptowire notified it along with Google , Adups and Amazon . Most recently though , a new campaign , targeting Belarus , Turkey and Ukraine , has emerged that caught the attention of Check Point researchers . The group is responsible for the campaign known as Operation Wilted Tulip .


" When BLU raised objections , Adups took immediate measures to disable that functionality on BLU phones , '' Adups says . The well-crafted and socially engineered malicious documents then become the ﬁrst stage of a long and mainly ﬁleless infection chain that eventually delivers POWERSTATS , a signature PowerShell backdoor of this threat group . Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security ( GDGS ) and has operated since at least 2012 .


The greater worry is that these situations may sometimes not be simple mistakes . This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more . Darkhotel is a threat group that has been active since at least 2004 .


Security experts have long warned of the ability of advanced adversaries to subvert hardware and software supply chains . If the macros in SPK KANUN DEĞİŞİKLİĞİ GİB GÖRÜŞÜ.doc” are enabled , an embedded payload is decoded and saved in the %APPDATA% directory with the name CiscoAny.exe . The group has conducted activity on hotel and business center Wi‑Fi and physical connections as well as peer-to-peer and file sharing networks .


Also , the software vulnerabilities pointed out in the FOTA software by Strazzere in 2015 could have been taken advantage of by cybercriminals looking to steal bank account details or execute other frauds . INF ﬁles have been used in the past by MuddyWater , although they were launched using Advpack.dll and not IEAdvpack.dll . The actors have also conducted spearphishing .


Strazzere advises that consumers should look at the pedigree of mobile manufacturers and take a close look at their security track record before making a decision on what device to buy . In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document . Unknown .


" In the end , the consumer needs to vote with their wallet , '' he says . Although it has focused most of its efforts on the Middle East region , the political afﬁliations , motives and purposes behind MuddyWater’s attacks are not very well- deﬁned , thus earning it its name . Charming Kitten is an Iranian cyber espionage group that has been active since approximately 2014 .


Skygofree : Following in the footsteps of HackingTeam 16 JAN 2018 At the beginning of October 2017 , we discovered new Android spyware with several features previously unseen in the wild . In the past , countries such as Saudi Arabia , the UAE and Turkey have been a MuddyWater's main target , but the campaigns have also reached a much wider audience , making their way to victims in countries such as Belarus and Ukraine . They appear to focus on targeting individuals of interest to Iran who work in academic research , human rights , and media , with most victims having been located in Iran , the US , Israel , and the UK .


In the course of further research , we found a number of related samples that point to a long-term development process . MuddyWater target groups across Middle East and Central Asia , primarily using spear phishing emails with malicious attachments . Charming Kitten usually tries to access private email and Facebook accounts , and sometimes establishes a foothold on victim computers as a secondary objective .


We believe the initial versions of this malware were created at least three years ago – at the end of 2014 . Most recently MuddyWater were connected to a campaign in March that targeted organizations in Turkey , Pakistan , and Tajikistan . The group 's TTPs overlap extensively with another group , Magic Hound , resulting in reporting that may not distinguish between the two groups' activities .


Since then , the implant ’ s functionality has been improving and remarkable new features implemented , such as the ability to record audio surroundings via the microphone when an infected device is in a specified location ; the stealing of WhatsApp messages via Accessibility Services ; and the ability to connect an infected device to Wi-Fi networks controlled by cybercriminals . The group has been quite visible since the initial 2017 Malwarebytes report on their elaborate espionage attack against the Saudi Arabian government . Cleaver : Threat Group 2889 , TG-2889 .


We observed many web landing pages that mimic the sites of mobile operators and which are used to spread the Android implants . Our analysis revealed that they drop a new backdoor , which is written in PowerShell as MuddyWater’s known POWERSTATS backdoor . Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver .


These domains have been registered by the attackers since 2015 . We assume that RunPow stands for run PowerShell , ” and triggers the PowerShell code embedded inside the .dll file . Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 ( TG-2889 ) .