It uses different topics that include the unique device identifier , which side is sending the message , and whether it is information message or command . From mid-2016 through early 2017 , APT33 compromised a U.S. organization in the aerospace sector and targeted a business conglomerate located in Saudi Arabia with aviation holdings . They most likely used the Qt Creator IDE in a Windows . The email address admin@93[.]gd is linked to IP addresses owned by a certain user with the nickname “ PIG GOD”—another


HTTP Communication In addition to the MQTT communication , the app also uses plain text HTTP communication in order to download the .dex file and upload collected data . From mid-2016 through early 2017 , APT33 compromised organizations located in Saudi Arabia and U.S. in the aerospace sector . The malware utilizes several persistence mechanisms including scheduled tasks, Userinit and Run registry keys in the HKLM . Composition of the KillNet Collective


All of the files that are being uploaded or downloaded are zip files encrypted by AES with ECB mode . During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals . XOR and RC4 encryption is used with quite long unique keys for different . By creating awareness and using the right solutions , both individuals and organizations can take the steps needed to defend against the malicious tactics used by threat actors like the Winnti group .


The key for each file is generated randomly and stored in the encrypted file with a fixed offset . More recently , in May 2017 , APT33 appeared to target a Saudi organization and a South Korean business conglomerate using a malicious file that attempted to entice victims with job vacancies for a Saudi Arabian petrochemical company . Among all these random keys once the word “salamati” was also used, which means “health” in Farsi . It appears the activity by the group may have been stopped early in the attack chain as the only malicious activity seen on infected machines is credential harvesting .


In order to upload the file , the app uses a basic REST communication with the server , checking if the file exists and uploading it if it isn ’ t . More recently , in May 2017 , APT33 appeared to target organizations in Saudi and South Korea using a malicious file that attempted to entice victims with job vacancies . Kaspersky Lab products detect the malware described in this report as Trojan.Win32.Remexi and Trojan.Win32.Agent . The chain of evidence suggests that the threat actor ’s motives are financially driven .


The path that is used for the uploads is : http : // /apps/d/p/op.php The communication looks like this : First Phase The first phase of the app ’ s attack flow collects device information and a list of apps installed on the device . We assess the targeting of multiple companies with aviation-related partnerships to Saudi Arabia indicates that APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia . This blogpost is based in our original report shared with our APT Intelligence Reporting customers last November 2018 . That 's because a new ransomware called BlackSuit had appeared which shared 98 percent of its code with the infamous Royal ransomware .


These are then uploaded to the C & C HTTP server . APT33 may possibly be looking to gain insights on Saudi Arabia 's military aviation capabilities to enhance Iran 's domestic aviation capabilities or to support Iran 's military and strategic decision making vis a vis Saudi Arabia . The main tool used in this campaign is an updated version of the Remexi malware, publicly reported by Symantec back in 2015 . They work to bypass traditional security barriers on the Android operating system and provide a variety of information stealing , surveillance and remote access capabilities .


The collection of basic device information . The generalized targeting of organizations involved in energy and petrochemicals mirrors previously observed targeting by other suspected Iranian threat groups , indicating a common interest in the sectors across Iranian actors . The newest module’s compilation timestamp is March 2018 . Budworm aka LuckyMouse , Emissary Panda , APT27 deployed a previously unseen variant of its SysUpdate backdoor SysUpdate DLL inicore_v2.3.30.dll .


The collection of basic device information . APT33 sent spear phishing emails to employees whose jobs related to the aviation industry . The developers used GCC compiler on Windows in the MinGW . Commercial spyware can be seen as having legitimate reasons to exist , especially in instances of crime and terrorism ( as long as it is highly regulated ) .


In addition , at this stage the app can process one of these commands : • Collect device info • Install app • Is online ? APT33 registered multiple domains that masquerade as Saudi Arabian aviation companies and Western organizations that together have partnerships to provide training , maintenance and support for Saudi 's military and commercial fleet . Inside the binaries the compiler left references to the names of the C source file modules used: operation_reg.c , thread_command.c and thread_upload.c . What makes COSMICENERGY unique is that based on our analysis , a contractor may have developed it as a red teaming tool for simulated power disruption exercises hosted by Rostelecom - Solar , a Russian cyber security company .


• Change server domain Out of these , the most interesting command is the “ install app ” command that downloads an encrypted zip file containing the second phase dex file , unpacks and loads it . We identified APT33 malware tied to an Iranian persona who may have been employed by the Iranian government to conduct cyber threat activity against its adversaries . Like mentioned in modules file names the malware consists of several working threads dedicated to different tasks, including C2 command parsing and data . Among the IP addresses owned by Hack520 is a whole/22 IP Range which we dubbed as the “ PIG RANGE ” .


Second Phase The second phase dex file contains 3 main services that are being used : • ConnManager - handles connections to the C & C • ReceiverManager - waits for incoming calls / app installations • TaskManager - manages the data collection tasks The C & C server address is different than the one that is used by the first phase , so the app reconnects to the new server as well as starts the periodic data collector tasks . APT33 's targeting of organizations involved in aerospace and energy most closely aligns with nation-state interests , implying that the threat actor is most likely government sponsored . For both the receiving of C2 commands and exfiltration, Remexi uses the Microsoft Background Intelligent Transfer Service (BITS ) mechanism to communicate with the C2 over . Notably , the main function contains logic flaws that cause it to only be able to connect to an MSSQL server and upload ( LIGHTWORK ) to it , before immediately attempting to clean itself up .


By analyzing the TaskManager class we can see the new commands that are supported at this stage : As can be seen in the code snippet above , there are quite a lot of data collection tasks that are now available : Collect device info Track location Upload contacts information Upload sent and received SMS messages Upload images Upload video files Send recursive dirlist of the external storage Upload specific files Record audio using the microphone Record calls Use the camera to capture bursts of snapshots Those tasks can either run periodically , on event ( such as incoming call ) or when getting APT33 leverages popular Iranian hacker tools and DNS servers used by other suspected Iranian threat groups . So far, our telemetry hasn’t provided any concrete evidence that shows us how the Remexi malware . The result is that Vice Society is the most prolific attacker of education institutions in the two most attacked countries in the world : the USA and the UK .


a command from the C & C server . This coupled with the timing of operations – which coincides with Iranian working hours – and the use of multiple Iranian hacker tools and name servers bolsters our assessment that APT33 may have operated on behalf of the Iranian government . However, we think it’s worth mentioning that for one victim we found a correlation between the execution of Remexi´s main module and the execution of an AutoIt script compiled as PE , which we believe may have dropped the . The hijacking is achieved by adding the threat actor 's e - mail address to the Facebook Business account with Admin and Finance editor roles .


Mitigations Stay protected from mobile malware by taking these precautions : Do not download apps from unfamiliar sites Only install apps from trusted sources Pay close attention to the permissions requested by apps Install a suitable mobile security app , such as SEP Mobile or Norton , to protect your device and data Keep your operating system up to date Make frequent backups of important data Indicators of Compromise ( IoCs ) Package names : anew.football.cup.world.com.worldcup com.coder.glancelove com.winkchat APK SHA2 : 166f3a863bb2b66bda9c76dccf9529d5237f6394721f46635b053870eb2fcc5a The publicly available backdoors and tools utilized by APT33 – including NANOCORE , NETWIRE , and ALFA Shell – are all available on Iranian hacking websites , associated with Iranian hackers , and used by other suspected Iranian threat groups . This dropper used an FTP with hardcoded credentials to receive its . It is therefore likely that they will try many things to compromise your mobile phone , including using zero - day attacks or unknown vulnerabilities .


b45defca452a640b303288131eb64c485f442aae0682a3c56489d24d59439b47 d9601735d674a9e55546fde0bffde235bc5f2546504b31799d874e8c31d5b6e9 2ce54d93510126fca83031f9521e40cd8460ae564d3d927e17bd63fb4cb20edc 67b1a1e7b505ac510322b9d4f4fc1e8a569d6d644582b588faccfeeaa4922cb7 APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making . FTP server was not accessible any more at the time of our . “ It appears to be the email address Will used for his profiles , ” the IT director replied .


1664cb343ee830fa94725fed143b119f7e2351307ed0ce04724b23469b9002f2 Loaded DEX SHA2 : afaf446a337bf93301b1d72855ccdd76112595f6e4369d977bea6f9721edf37e Domain/IP : goldncup [ . Specifically , the targeting of organizations in the aerospace and energy sectors indicates that the APT33 is likely in search of strategic intelligence capable of benefitting a government or military sponsor . Remexi boasts features that allow it to gather keystrokes, take screenshots of Windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote . Since 2021 , there have been multiple leaks of ransomware source code and builders components that are essential to creating and modifying ransomware .


] com glancelove [ . APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military aviation capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making . Encryption consists of XOR with a hardcoded key for its configuration and RC4 with a predefined password for encrypting the victim’s . The file collected system information , and then invoked a WMI instance in the rootsecuritycenter namespace to identify security products installed on the system before dropping more data collection malware .


] com autoandroidup [ . We expect APT33 activity will continue to cover a broad scope of targeted entities , and may spread into other regions and sectors as Iranian interests dictate . Remexi includes different modules that it deploys in its working directory, including configuration decryption and parsing, launching victim activity logging in a separate module, and seven threads for various espionage and auxiliary . Some hackers are motivated by the sense of achievement that comes with cracking open a major system .


] website mobilestoreupdate [ . The Elfin espionage group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries . The Remexi developers seem to rely on legitimate Microsoft utilities, which we enumerate in the table below： extract.exe Deploys modules from the .cab file into the working Event Cache directory, bitsadmin.exe Fetches files from the C2 server to parse and execute . However , even though the employees work for you they may feel the companys property belongs to them , not the business , and may feel justified in theft .


] website updatemobapp [ . On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " ( referred to as GroupB in this blog post ) to APT33 , operating at the behest of the Iranian government . Send exfiltrated data, taskkill.exe Ends working cycle of . Dubbing the threat actor TunnelVision , whose TTPs overlap with those of Charming Kitten and Phosphorus , the researchers observed that the group is characterized by the wide exploitation of oneday vulnerabilities in specific regions .


] website 107 [ . The Elfin group ( aka APT33 ) has remained highly active over the past three years , attacking at least 50 organizations in Saudi Arabia , the United States , and a range of other countries . Persistence modules are based on scheduled tasks and system . The request header is included in the binary as follows


] 175 [ . On May 16 , 2019 FireEye 's Advanced Practices team attributed the remaining " suspected APT33 activity " to APT33 , operating at the behest of the Iranian government . Mechanisms vary for different OS . How to locate where stack strings are decoded Every Block of stack strings ends with followed by a .


] 144 [ . APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea . In the case of old Windows versions like XP , main module events.exe runs an edited XPTask.vbs Microsoft sample script to create a weekly scheduled task for . The duration of manipulation may be temporary or longer sustained , depending on operator detection .


] 26 192 [ . In 2017 , APT37 expanded its targeting beyond the Korean peninsula to include Japan , Vietnam and the Middle East , and to a wider range of industry verticals , including chemicals , electronics , manufacturing , aerospace , automotive and healthcare entities . For newer operating systems, events.exe creates task.xml . We have not observed indications that the group claiming to be REvil that took part in the attack on the EIB was connected to the widely known ransomware group .


] 64 [ . In 2017 , APT37 targeted a company in Middle East that entered into a joint venture with the North Korean government to provide telecommunications service to the country . To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every . Additionally , different attackers may have different motivations .


] 114 [ . While not conclusive by itself , the use of publicly available Iranian hacking tools and popular Iranian hosting companies may be a result of APT33 's familiarity with them and lends support to the assessment that APT33 may be based in Iran . RC4 file encryption relies on the Windows 32 CryptoAPI , using the provided value’s MD5 hash as an initial . Open Babel allows users to “ search , convert , analyze , or store data from molecular modeling , chemistry , solid - state materials , biochemistry , or related areas , ” according to its website , and is used in other popular pieces of software in the science field .


] 147 Red Alert 2.0 : Android Trojan targets security-seekers A malicious , counterfeit version of a VPN client for mobile devices targets security-minded victims with a RAT . North Korean defector and human rights-related targeting provides further evidence that APT37 conducts operations aligned with the interests of North Korea . Among all these random keys once the word “salamati” was also used, which means “health” in . It has legitimate uses but is widely used by attackers to help map a network .


Written by Jagadeesh Chandraiah JULY 23 , 2018 SophosLabs has uncovered a mobile malware distribution campaign that uses advertising placement to distribute the Red Alert Trojan , linking counterfeit branding of well-known apps to Web pages that deliver an updated , 2.0 version of this bank credential thief . In 2017 , APT37 targeted a Middle Eastern company that entered into a joint venture with the North Korean government to provide telecommunications service to the country ( read on for a case study ) . Config.ini is the file where the malware stores its encrypted configuration data.List of files to send to C2 using bitsadmin.exe from the dedicated thread: upLog.txt , upSCRLog.txt , upSpecial.txt , upFile.txt , upMSLog.txt . http://108.61.189.174 control server HTTP . The primary motivation of a hacker is money , and getting it can be done with a variety of methods .


The group distributing this family of malware decorates it in the branding and logos of well-known social media or media player apps , system update patches , or ( in its most recent campaign ) VPN client apps in an attempt to lure users into downloading , installing , and elevating the privileges of a Trojanized app hosted on a site not affiliated with any reputable app market or store . APT37 targeted a research fellow , advisory member , and journalist associated with different North Korean human rights issues and strategic organizations . KtJvOXulgibfiHk is the password for uploaded zip . Masked Downloads A malware download , and installation , may be masked by renaming a legitimate Windows system framework such as Powershell.exe to hide from monitoring tools .


Aside from the inescapable irony of disguising a security-reducing Trojan as an ostensibly security-enhancing app , and the righteous affront to the whole concept of a VPN ’ s purpose a Trojan so disguised inspires , this represents an escalation in the variety of app types targeted by this campaign of bankbots in disguise . APT37 distributed SLOWDRIFT malware using a lure referencing the Korea Global Forum against academic and strategic institutions located in South Korea . One of the malware threads checks in an infinite loop if the mouse button was pressed and then also increments the integer iterator . This article is based on research by Marcelo Rivero , Malwarebytes ' ransomware specialist , who monitors information published by ransomware gangs on their Dark Web sites .


Red Alert Plays Dress-Up In the wild , we found Web pages designed to ( vaguely ) resemble legitimate app market pages , hosting files for download that have been disguised as a legitimate mobile application of moderately broad appeal , such as a media player or social media app . We believe a organization located in Middle East was targeted by APT37 because it had been involved with a North Korean company and a business deal went bad . If the mouse hooking function registers a button hit, it lets the screenshotting thread know about it through a global . KillNet previously claimed various links to REvil and Conti , which we were unable to verify , including :


But the categories targeted by this group seem to be broadening with the inclusion of VPN software . In one instance , APT37 weaponized a video downloader application with KARAE malware that was indiscriminately distributed to South Korean victims through torrent websites . After that, it checks if the iterator divided by (captureScreenTimeOut/captureActiveWindowTimeOut) has a remainder of . We propose to reach an agreement and conclude a deal .


The Web page shown here on the left is hosted on a domain that seems apt : free-vpn [ . FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . In that case, it takes a . The United States is joining with allies and partners to condemn Russia ’s destructive cyber activities against Ukraine .


] download . FireEye iSIGHT Intelligence confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . events.exe : b1fa803c19aa9f193b67232c9893ea57574a2055791b3de9f836411ce000ce31 , c981273c32b581de824e1fd66a19a281 , GCC compiler in MinGW environment version 2.24, I386 Windows GUI EXE . Camouflaging itself as legitimate software , the executable is exceptionally large at 56 MB an unusual size for malware samples that may allow it to avoid detection as vendors typically avoid large file sizes .


Investigation of this domain led to additional domains that appear to have been registered for use with the campaign , but are not in use yet . In April 2017 , APT37 targeted South Korean military and government organizations with the DOGCALL backdoor and RUHAPPY wiper malware . After checking that the malware is not already installed , it unpacks HCK.cab using the Microsoft standard utility expand.exe . Who is the Winnti group ?


( You can find additional IoCs at the end of this article ) As you can see , the Web page uses a similar colour scheme as , and the icon design from , a legitimate VPN application ( VPN Proxy Master ) found on the Google Play store . It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations . Splitter.exe : a77f9e441415dbc8a20ad66d4d00ae606faab370ffaee5604e93ed484983d3ff , 1ff40e79d673461cd33bd8b68f8bb5b8 , 2017.08.06 11:32:36 (GMT), I386 Windows Console EXE . We highly suspect the “ Pig network ” to have also been used as a bulletproof hosting service for cybercriminals who are unrelated to the Winnti group .


The fake doesn ’ t quite nail the app name . We assess with high confidence that APT37 acts in support of the North Korean government and is primarily based in North Korea . Exfiltration is done through the bitsadmin.exe . “ And his access was never shut off until today ? , ” asked the company ’s general counsel Mike Dacks .


In addition to “ Free VPN Master Android , ” we ’ ve observed Red Alert 2.0 Trojans in the wild disguising themselves using names like : Flash Player or Update Flash Player Android Update or Android Antivirus Chrome Update or Google Update Update Google Market WhatsApp Viber OneCoin Wallet Pornhub Tactic FlashLight or PROFlashLight Finanzonline The vast majority of in-the-wild Red Alert 2.0 samples falsely present themselves as Adobe Flash player for Android , a utility that Adobe stopped supporting years ago . The compilation times of APT37 malware is consistent with a developer operating in the North Korea time zone ( UTC +8:30 ) and follows what is believed to be a typical North Korean workday . The BITS mechanism has existed since Windows XP up to the current Windows 10 versions and was developed to create download/upload jobs, mostly to update the OS . They will usually have found your email address via a data breach of a third party .


Our logs show a number of simultaneous Red Alert 2.0 campaigns in operation , many ( but not all ) hosted on dynamic DNS domains . The majority of APT37 activity continues to target South Korea , North Korean defectors , and organizations and individuals involved in Korean Peninsula reunification efforts . The vast majority of the users targeted by this new variant of Remexi appear to have Iranian IP . The infection starts with a malicious email containing a link that downloads a JS file that used to download DLL .


The Red Alert Payload Once installed , the malware requests Device Administrator privileges . Similarly , APT37 targeting of a company located in Middle East in 2017 is also consistent with North Korean objectives given the entity 's extensive relationships inside North Korea . Some of these appear to be foreign diplomatic entities based in the . They once attacked a game server to illicitly farm in - game currency ( “ gaming gold ” , which also has real - world value ) and stole source codes of online game projects .


If the malware obtains device administrator rights , it will be able to lock the screen by itself , expire the password , and resist being uninstalled through normal methods . Similarly , APT37 targeting of a Middle Eastern company in 2017 is also consistent with North Korean objectives given the entity 's extensive relationships inside North Korea . The Remexi malware has been associated with an APT actor called Chafer by Symantec . As more actors enter this space , Cisco Talos is seeing an increasing number of ransomware variants emerge , leading to more frequent attacks and new challenges for cybersecurity professionals , particularly regarding actor attribution .


Device admin request from app that says it is WhatsApp The app then stays in the background listening to commands from the cybercrooks . In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company . One of the human-readable encryption keys used is . Fast forward to 2021 , we ve seen several notable attacks spanning critical infrastructures to the private sector , such as the attack on the information technology firm Kaseya , which affected up to 1,500 businesses and attempted to extort Kaseya for 70 million .


Within some of the first of those commands , the bot typically receives a list of banks it will target . Though they have primarily tapped other tracked suspected North Korean teams to carry out the most aggressive actions , APT37 is an additional tool available to the regime , perhaps even desirable for its relative obscurity . This is probably the Latin spelling for the word “health” in Farsi . Forbes Technology Council is an invitationonly community for worldclass CIOs , CTOs and technology executives .


The Trojan works by creating an overlay whenever the user launches the banking application . ScarCruft is a relatively new APT group , victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania . Among the artifacts related to malware authors, we found in the binaries a .pdb path containing the Windows user name “Mohamadreza . The discovery of COSMICENERGY illustrates that the barriers to entry for developing offensive OT capabilities are lowering as actors leverage knowledge from prior attacks to develop new malware .


Currently Running Applications Banking Trojans that rely on the overlay mechanism to steal information need to know what application is in the foreground . Certain details , such as using the same infrastructure and targeting , make us believe that Operation Daybreak is being done by the ScarCruft APT group . Interestingly, the FBI website for wanted cybercriminals includes two Iranians called Mohammad Reza, although this could be a common name or even a false . Among the IP addresses owned by Hack520 is a whole/22 IP Range which we dubbed as the “ PIG RANGE ” .


They do this not only to identify whether the use of a particular app may permit them to harvest another credential , but also because each targeted app needs to have an overlay mapped to its design , so the Trojan can intercept and steal user data . Prior to the discovery of Operation Daybreak , we observed the ScarCruft APT launching a series of attacks in Operation Erebus . Activity of the Chafer APT group has been observed since at least 2015 , but based on things like compilation timestamps and C&C registration, it’s possible they have been active for even . McAfee researchers will present their findings at this year 's RSA security conference in San Francisco .


This quest to determine the currently running application is a hallmark of overlay malware , so we thought we ’ d take a closer look at how it ’ s done . Operation Daybreak appears to have been launched by unknown attackers to infect high profile targets through spear-phishing e-mails . Defeating Compiler-Level Obfuscations Used in APT10 Malware . The group , which was primarily motivated by profit , is noted for utilizing self - developed technically - proficient tools for their attacks .


To prevent this , Android ’ s engineers regularly release updates that contain bug fixes designed to prevent apps from getting the list of currently running apps without explicit permission . Operation Daybreak appears to have been launched by APT37 to infect high profile targets through spear-phishing e-mails . The Carbon Black Threat Analysis Unit ( TAU ) An attacker could exploit these issues by tricking a user into opening a specially crafted PDF document or , if the user has the browser extension enabled , by visiting a malicious web page :


With every Android update , the malware authors are forced to come up with new tricks . On occasion the APT37 directly included the ROKRAT payload in the malicious document and during other campaigns the attackers leveraged multi-stage infection processes . recently analyzed a series of malware samples that utilized compiler-level obfuscations . We prefer to keep it secret , we have no goal to destroy your business .


This particular case is not an exception . In the early part of 2017 , Group123 started the " Evil New Year " campaign . For example , The Regin malware platform supports many standard protocols , including SMB.[10 ] Rocke issued wget requests from infected systems to the C2.[11 ] Siloscape connects to an IRC server for C2.[12 ]


The author ( s ) of this malware wrote separate subroutines that identify the operating system version and fire off methods to obtain a list of currently running applications known to work on that particular version of Android . In November 2017 , Talos observed the latest Group123 campaign of the year , which included a new version of ROKRAT being used in the latest wave of attacks . opaque predicates were applied to Turla mosquito and APT10 ANEL . In each case , CrowdStrike reviewed the relevant logs and determined there was no evidence of exploitation of CVE-2022 - 41040 for initial access .


First , they use the built-in toolbox commands to determine what apps are running . Group123 is constantly evolving as the new fileless capability that was added to ROKRAT demonstrates . Another obfuscation , This article is based on research by Marcelo Rivero , Malwarebytes ' ransomware specialist , who monitors information published by ransomware gangs on their Dark Web sites .


If that doesn ’ t work , they try to use queryUsageStats : When the malware invokes queryUsageStats , it asks for the list of applications that ran in the last 1 million milliseconds ( 16 minutes and 40 seconds ) . In this campaign , the Group123 used a classical HWP document in order to download and execute a previously unknown malware : NavRAT . control flow flattening , COSMICENERGY lacks discovery capabilities , which implies that to successfully execute an attack the malware operator would need to perform some internal reconnaissance to obtain environment information , such as MSSQL server IP addresses , MSSQL credentials , and target IEC-104 device IP addresses .


String Resources Used to Store App Data Red Alert 2.0 stores its data in an atypical location ( inside the Strings.xml file embedded in the app ) to fetch its critical data , such as the C2 address . However , we asses with medium confidence that NavRAT is linked to Group123 . was applied to APT10 ANEL and Dharma ransomware packer . Another area where we may want to consider this motivation is the human factor .


The com.dsufabunfzs.dowiflubs strings in the screenshot above refer to the internal name this particular malware was given , which in this case was randomized into alphabet salad . APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world 's largest cyber heists . ANEL ( also referred to as UpperCut ) an internal user may have fallen prey to a spear phishing attack ,


It ’ s been SophosLabs ’ observation that Red Alert Trojans usually have a randomized internal name like this . APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions , as well as some of the world . is a RAT program used by APT10 and observed in Japan uniquely . This is a form of cyber attack used to gain an advantage over a competing organization .


The strings section of the app contains embedded command-and-control IP addresses , ports , and domain names in plaintext . APT38 is believed to operate more similarly to an espionage operation , carefully conducting reconnaissance within compromised financial institutions and balancing financially motivated objectives with learning about internal systems . According to SecureWorks , That piece explored how Biderman — who is Jewish — had become the target of concerted harassment campaigns by anti - Semitic and far - right groups online in the months leading up to the hack .


It is an invaluable source of intelligence about a given campaign .. The following snippet shows the location within the Trojan where it uses SQLite database commands to store and recall command-and-control addresses : Backdoor Commands The Red Alert code also contains an embedded list of commands the botmaster can send to the bot . The group has compromised more than 16 organizations in at least 13 different countries , sometimes simultaneously , since at least 2014 . all ANEL samples whose version is 5.3.0 or later are obfuscated with opaque predicates and control flow flattening . The first it Uses and APIs To test for a Debugger attached or Sandbox environment by making a call to with Flag specified , then call to retrieve the addresses of the allocated pages that has been written to since the allocation or the writetrack state has been reset .


The malware can execute a variety of arbitrary commands , including ( for example ) intercepting or sending text messages without the user ’ s knowledge , obtaining a copy of the victim ’ s Address Book , or call or text message logs , or sending phone network feature codes ( also known as USSD codes ) . APT38 shares malware code and other development resources with TEMP.Hermit North Korean cyber espionage activity , although we consider APT38 . Opaque predicate is a programming term that refers to decision making where there is actually only one path . Compromise usually refers to insider threats .


C2 and Targeted Banks As described earlier , the C2 domain is kept in the app ’ s resources . We consider APT38 's operations more global and highly specialized for targeting the financial sector . For example , The code hunted for several security products to evade – including Kaspersky .


During the app execution , the malware contacts C2 domain for further instructions . APT38 is a financially motivated group linked to North Korean cyber espionage operators , renown for attempting to steal hundreds of millions of dollars from financial institutions and their brazen use of destructive malware . this can be seen as calculating a value that will always return True . We also reveal what ransomware gangs are now experimenting with to break into your company — including their offers to “ recruit ” employees as insider threats .


Most of the network traffic we ’ ve observed is HTTP . Because APT38 is backed by ( and acts on behalf of ) the North Korean regime , we opted to categorize the group as an " APT " instead of a " FIN " . Control flow flattening is an obfuscation method where programs do not cleanly flow from beginning to end . None LIGHTWORK is a disruption tool written in C++ that implements the IEC-104 protocol to modify the state of RTUs over TCP .


The C2 address , as stored in samples we ’ ve seen , comprise both an IP address and port number ; So far , all the samples we ’ ve tested attempted to contact an IP address on port 7878/tcp . Over time these malware similarities diverged , as did targeting , intended outcomes , and TTPs , almost certainly indicating that TEMP.Hermit activity is made up of multiple operational groups primarily linked together with shared malware development resources and North Korean state sponsorship . Instead , If you followed Cybersecurity and Infrastructure Security Agency CISA alerts on ransomware for the year , you would have noted malicious activity attributed to many ransomware variants .


If the main C2 domain is not responsive , the bot fetches a backup C2 domain from a Twitter account . Based on observed activity , we judge that APT38 's primary mission is targeting financial institutions and manipulating inter-bank financial systems to raise large sums of money for the North Korean regime . a switch statement is called in an infinite loop having multiple code blocks each performing operations . Monitor systems with access to OT resources for the creation of legitimate temporary folders , files , artifacts , and external libraries required as evidence of the execution of packaged Python scripts .


Static analysis of the code reveals that the malware downloads the overlay template to use against any of the bank ( s ) it is targeting . Since 2015 , APT38 has attempted to steal hundreds of millions of dollars from financial institutions . The obfuscations looked similar to the ones explained in Hex-Rays blog , These disruptive cyber operations began in January 2022 , prior to Russia ’s illegal further invasion of Ukraine and have continued throughout the war .


The malware also sends regular telemetry back to its C2 server about the infected device in the form of an HTTP POST to its C2 server . APT38 has pursued their main objective of targeting banks and financial entities since at least 2014 . but the introduced IDA Pro plugin HexRaysDeob didn’t work for one of the obfuscated ANEL samples because the tool was made for another variant of the obfuscation . Mandiant observed log entries in jcagent.log that indicated a directive named “ Runworkflow ” triggered execution on the system :


It uses the base Dalvik User-Agent string for the device it ’ s running on . We surmise that the targeting of banks , media , and government agencies is conducted in support of APT38 's primary mission . TAU investigated the ANEL obfuscation algorithms then modified the HexRaysDeob code to defeat the obfuscations . Further analyses of these similarities are available via Mandiant Advantage .


The content of the HTTP POST data is telemetry data in a json format about the device the malware is running on . The APT38 targeted news outlets known for their business and financial sector reporting , probably in support of efforts to identify and compromise additional financial institutions . After the modification , Depending on the platform and on how the code is compiled , these vulnerabilities could lead to arbitrary code execution : Talos is disclosing these vulnerabilities despite no official fix from Open Babel .


The list of banks targeted by Red Alert 2.0 includes NatWest , Barclays , Westpac , and Citibank . APT38 also targeted financial transaction exchange companies likely because of their proximity to banks . TAU was able to recover the original code . Adversaries may perform data destruction over the course of an operation .


Red Alert 2.0 is a banking bot that is currently very active online , and presents a risk to Android devices . Given the lapse in time between the spear-phishing and the heist activity in the above example , we suggest two separate but related groups under the North Korean regime were responsible for carrying out missions ; one associated with reconnaissance ( TEMP.Hermit or a related group ) and another for the heists ( APT38 ) . HexRaysDeob is an IDA Pro plugin written by Rolf Rolles to address obfuscation seen in binaries . Simultaneously , a threat researcher outside of CrowdStrike discovered an attacker ’s tooling via an open repository , downloaded all of the tools , and made them available through a MegaUpload link in a Twitter post.2


We expect to see more diversification in the social engineering lures this threat group employs as time goes on . APT38 , in particular , is strongly distinguishable because of its specific focus on financial institutions and operations that attempt to use SWIFT fraud to steal millions of dollars at a time . In order to perform the deobfuscation , Facebook has spotted that same malware being used in this most recent campaign , but this operation has a far broader set of infection techniques and targets outside of the Middle East .


So far , legitimate app stores appear to be this malware ’ s Achilles heel ; disabling the installation of third-party apps has been an effective prevention measure . We can confirm that the APT38 operator activity is linked to the North Korean regime , but maintains a set of common characteristics , including motivation , malware , targeting , and TTPs that set it apart from other statesponsored operations . the plugin manipulates the IDA intermediate language called microcode . PIEHOP utilizes LIGHTWORK to issue the IEC-104 commands " ON " or " OFF " to the remote system and then immediately deletes the executable after issuing the command .


Stick to Google Play and use VPN software from reputable vendors . As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions to raise money for the North Korean regime . If you aren’t familiar with those structures ( e.g , The sample of PIEHOP we obtained contains programming logic errors that prevent it from successfully performing its IEC-104 control capabilities , but we believe these errors can be easily corrected .


Sophos detects all the samples of this Trojan family as Andr/Banker-GWC and Andr/Spybot-A . As previously mentioned , we assess with high confidence that APT38 's mission is focused on targeting financial institutions and financial systems to raise money for the North Korean regime . microcode data structures , I Enabled PowerShell Logging and Transcript logging that get the full PowerShell session with the output .


In the wild , these are only distributed as a direct download from unofficial Web pages ( “ third-party ” app ) and not through legitimate app stores . Although the APT38 's primary targets appear to be Financial Exchange banks and other financial organizations , they have also Financial Exchange targeted countries ' media organizations with a focus on the financial sector . maturity level , There are more unused URLs in the script .


Red Alert 2.0 IoCs list C2 addresses 103.239.30.126:7878 146.185.241.29:7878 146.185.241.42:7878 185.126.200.3:7878 185.126.200.12:7878 185.126.200.15:7878 185.126.200.18:7878 185.165.28.15:7878 185.243.243.241:7878 185.243.243.244:7878 185.243.243.245:7878 Domains Malware source Web hosts Since at least the beginning of 2014 , APT38 operations have focused almost exclusively on developing and conducting financially motivated campaigns targeting international entities , whereas TEMP.Hermit is generally linked to operations focused on South Korea and the United States . Microcode Explorer and so on ) The most recent attack on communications company Viasat in Ukraine had a wider impact across the continent , disrupting wind farms and internet users in central Europe .


on 167.99.176.61 : free-androidvpn.date free-androidvpn.download free-androidvpn.online free-vpn.date free-vpn.download free-vpn.online Hashes 22fcfce096392f085218c3a78dd0fa4be9e67ed725bce42b965a27725f671cf 55292a4dde8727faad1c40c914cf1be9dfdcf4e67b515aa593bcd8d86e824372 TEMP.Hermit is generally linked to operations focused on South Korea and the United States . , n.bat n.bat Unknown Likely runs native scilc.exe utility s1.txt


be92a751e5abbcd24151b509dbb4feb98ea46f367a99d6f86ed4a7c162461e31 5c4d666cef84abc2a1ffd3b1060ef28fa3c6c3bb4fad1fa26db99350b41bea4c 06081ab7faa729e33b9397a0e47548e75cbec3d43c50e6368e81d737552150a5 753999cb19a4346042f973e30cf1158c44f2335ab65859d3bfa16bca4098e2ef While North Korean cyber operations against specific countries may have been driven by diplomatic factors and perceived insults against Pyongyang , the application of increasingly restrictive and numerous financial sanctions against North Korea probably contributed to the formation of APT38 . you should read his blog post . Continual education for employees to spot phishing attacks is also a key , basic measure with todays threat landscape .


As a result of a lot of hard work done by our security research teams , we revealed today a new and alarming malware campaign . APT38 's operations began in February 2014 and were likely influenced by financial sanctions enacted in March 2013 that blocked bulk cash transfers and restricted North Korea 's access to international banking systems . Rolles also provides an overview of each obfuscation technique in the same post . Hildegard has used an IRC channel for C2 communications.[6 ]


The attack campaign , named Gooligan , breached the security of over one million Google accounts . APT37 ( Reaper ) , another North Korean state-sponsored group , targeted a Middle Eastern financial company , but there was no evidence of financial fraud . HexRaysDeob installs two callbacks when loading : It trick users into connecting their wallet with the goal of initiating transactions to drain their account .


The number continues to rise at an additional 13,000 breached devices each day . APT37 , another North Korean state-sponsored group , targeted a Middle Eastern financial company , but there was no evidence of financial fraud . optinsn_t for defeating opaque predicates ( defined as ObfCompilerOptimizer ) Depending on the platform and on how the code is compiled , these vulnerabilities could lead to arbitrary code execution : Talos is disclosing these vulnerabilities despite no official fix from Open Babel .


Our research exposes how the malware roots infected devices and steals authentication tokens that can be used to access data from Google Play , Gmail , Google Photos , Google Docs , G Suite , Google Drive , and more . Early APT38 operations suggest that the group began targeting financial institutions with an intent to manipulate financial transaction systems at least as early as February 2014 , although we did not observe fraudulent transactions until 2015 . optblock_t for defeating control flow flattening ( defined as CFUnflattener ) In any case , the VBA code still runs whenever the files are executed .


Gooligan is a new variant of the Android malware campaign found by our researchers in the SnapPea app last year . We do not have evidence that the earliest targeted financial institutions were victimized by fraudulent transactions before APT38 left the compromised environments , possibly indicating that APT38 was conducting reconnaissance-only activity at that time . . It also reveals direct links to secure[.]66[.]to and zhu[.]vn , both of which also belong to Hack520 and contains his personal blog .


Check Point reached out to the Google Security team immediately with information on this campaign . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank . Before continuing , Several issues in Foxit PDF reader could lead to arbitrary code execution Foxit PDF Reader is one of the most popular PDF readers on the market , offering many similar features to Adobe Acrobat .


Our researchers are working closely with Google to investigate the source of the Gooligan campaign . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank . it is important to understand Hex-Rays maturity levels . None The bottom line is that BadBlood is not one of its kind however , for Charming Kitten , it implies a shift in target and collection priorities as they usually target dissidents , academics , diplomats , and journalists in order to further Iranian IRGC interests .


“ We ’ re appreciative of both Check Point ’ s research and their partnership as we ’ ve worked together to understand these issues , ” said Adrian Ludwig , Google ’ s director of Android security . From November 2015 through the end of 2016 , APT38 was involved in at least nine separate compromises against banks . When a binary is loaded into IDA Pro , You 'll uncover why the US has seen a significant uptick in ransomware incidents across the board , especially in sectors like education .


“ As part of our ongoing efforts to protect users from the Ghost Push family of malware , we ’ ve taken numerous steps to protect our users and improve the security of the Android ecosystem overall. ” We are very encouraged by the statement Google shared with us addressing the issue . Per the complaint , the email account watsonhenny@gmail.com was used to send LinkedIn invitations to employees of a bank later targeted by APT38 . the application will perform distinct layers of code analysis and optimization , Mandiant attributed these intrusions to UNC4899 , a Democratic People 's Republic of Korea ( DPRK)-nexus actor , with a history of targeting companies within the cryptocurrency vertical .


We have chosen to join forces to continue the investigation around Gooligan . Further , the recent DOJ complaint provides insight into initial compromise techniques conducted by North Korean operators against APT38 targets , which may have been leveraged as part of the initial compromise into the targeted organizations . referred to as maturity levels . The threat actor then used the built - in certutil utility to Base64 encode the segments .


Google also stated that they are taking numerous steps including proactively notifying affected accounts , revoking affected tokens and deploying SafetyNet improvements to protect users from these apps in the future . This is corroborated by our identification of TEMP.Hermit 's use of MACKTRUCK at a bank , preceding the APT38 operation targeting the bank 's SWIFT systems in late 2015 . One layer will detect shellcode , Ashley Madison ’s executives understood that only a handful of employees at the time would have had access to the systems needed to produce the screenshots McNeill published online .


Who is affected ? APT38 relies on DYEPACK , a SWIFT transaction-hijacking framework , to initiate transactions , steal money , and hide any evidence of the fraudulent transactions from the victimized bank . another optimizes it into blocks , The adversary may drop or create malware , tools , or other non - native files on a target system to accomplish this , potentially leaving behind traces of malicious activities .


Gooligan potentially affects devices on Android 4 ( Jelly Bean , KitKat ) and 5 ( Lollipop ) , which is over 74 % of in-market devices today . The APT38 uses DYEPACK to manipulate the SWIFT transaction records and hide evidence of the malicious transactions , so bank personnel are none the wiser when they review recent transactions . another determines global variables , Attribution to the Dukes was made partly on the LNK file structure and other TTPs , including the targets of the attack .


About 57 % of these devices are located in Asia and about 9 % are in Europe . During this heist , APT38 waited for a holiday weekend in the respective countries to increase the likelihood of hiding the transactions from banking authorities . and so forth . Further analysis of COSMICENERGY is available as part of .


In our research we identified tens of fake applications that were infected with this malware . During one reported incident , APT38 caused an outage in the bank 's essential services . The optinsn_t : :f unc callback function is called in maturity levels from MMAT_ZERO ( microcode does not exist ) Viasat has said that “ tens of thousands of terminals have been damaged , made inoperable and can not be repaired . ”


If you ’ ve downloaded one of the apps listed in Appendix A , below , you might be infected . We attribute APT38 to North Korean state-sponsored operators based on a combination of technical indicators linking the activity to Pyongyang and details released by DOJ implicating North Korean national Park Jin Hyok in a criminal conspiracy . to MMAT_GLBOPT2 ( most global optimizations completed ) However , twice this year , in March and June , LockBit 's considerable rate of attacks was vastly exceeded by CL0P , which was otherwise dormant .


You may review your application list in “ Settings - > Apps ” , if you find one of this applications , please consider downloading an antivirus product such as Check Point ZoneAlarm to check if you are indeed infected . As detailed in the DOJ complaint , a sample of WHITEOUT malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank . . A Microsoft Exchange server is composed of two major components : the frontend , also known as the Client Access Service , and the backend .


We have noticed that hundreds of the email addresses are associated with enterprise accounts worldwide . APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition . During the callback , It incorporates the capabilities of the FULLHOUSE tunneler in addition to supporting backdoor commands including shell command execution , file transfer , file management , and process injection .


How do you know if your Google account is breached ? APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition . opaque predicates pattern matching functions are called . Mandiant first observed the self - proclaimed hacktivist group calling itself " Anonymous Sudan " in January 2023 and the group soon after declared allegiance to KillNet .


You can check if your account is compromised by accessing the following web site that we created : https : //gooligan.checkpoint.com/ . APT38 's increasingly aggressive targeting against banks and other financial institutions has paralleled North Korea 's worsening financial condition . If the code pattern is matched with the definitions , Recently , concerns have grown regarding the rapid growth of commercial spyware tools , and the way in which they are being used against their intended victims .


If your account has been breached , the following steps are required : A clean installation of an operating system on your mobile device is required ( a process called “ flashing ” ) . Malware overlaps between APT38 and TEMP.Hermit highlight the shared development resources accessible by multiple operational groups linked to North Korean state-sponsored activity . it is replaced with another expression for the deobfuscation . What the team uncovered was that the former MiniDuke attackers were still active , and using extremely effective social engineering techniques involving sending malicious PDF documents to compromise their victims .


As this is a complex process , we recommend powering off your device and approaching a certified technician , or your mobile service provider , to request that your device be “ re-flashed. ” Change your Google account passwords immediately after this process . APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry . This is important to perform in each maturity level as the obfuscated code could be modified or removed as the code becomes more optimized . Both TANKTRAP GPOs deployed CADDYWIPER from a staged directory to systems as msserver.exe .


How do Android devices become infected ? This is evidence of shared motivation and intent to target the SWIFT system by the North Korean operators performing the reconnaissance and APT38 which later targeted that organization . We defined two patterns for analysis of the ANEL sample . the second with invalid handle 0 , will return 0 or should be 0 in normal systems , this could be antisandboxemulation not sure as the functions return value is not used .


We found traces of the Gooligan malware code in dozens of legitimate-looking apps on third-party Android app stores . Although APT38 is distinct from other TEMP.Hermit activity , both groups operate consistently within the interests of the North Korean state . The global variable value dword_745BB58C is either even or odd , The most significant similarities we identified are with INDUSTROYER and INDUSTROYER.V2 , which were both malware variants deployed in the past to impact electricity transmission and distribution .


These stores are an attractive alternative to Google Play because many of their apps are free , or offer free versions of paid apps . Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea . so dword_745BB58C * ( dword_745BB58C – 1 ) The leaked tooling included a Python script , , that when executed led CrowdStrike researchers to replicate the logs generated in recent Play ransomware attacks .


However , the security of these stores and the apps they sell aren ’ t always verified . As detailed in the DOJ complaint , a sample of WHITEOUT ( aka Contopee ) malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank . is always even . The executable within this not only played a very funny video , but dropped and ran another CozyDuke executable .


Gooligan-infected apps can also be installed using phishing scams where attackers broadcast links to infected apps to unsuspecting users via SMS or other messaging services . Based on details published in the DOJ complaint against North Korean programmer Park Jin Hyok , we know that APT38 and other cyber operators linked to TEMP.Hermit are associated with Lab 110 , an organization subordinate to or synonymous with the 6th Technical Bureau in North Korea 's Reconnaissance General Bureau ( RGB ) . This results in The email would start a conversation between the attackers and victims sometimes being quite lengthy to establish trust , which would include the attackers encouraging the victim to open a registration link hosted by a real website that had already been compromised by the attackers .


How did Gooligan emerge ? APT38 . the lowest bit of the negated value becoming 1 . On 24 February , a cyber - attack against Viasat began approximately 1 hour before Russia launched its major invasion of Ukraine .


Our researchers first encountered Gooligan ’ s code in the malicious SnapPea app last year . As detailed in the DOJ complaint , a sample of WHITEOUT ( aka Contopee ) malware we attribute to APT38 was used between 2015 and 2016 against a Southeast Asian bank . Thus , In light of this , Mandiant has used the following approaches to identify potential exploitation of CVE-2023 - 4966 and subsequent session hijacking .


At the time this malware was reported by several security vendors , and attributed to different malware families like Ghostpush , MonkeyTest , and Xinyinhe . APT38 's targeting of financial institutions is most likely an effort by the North Korean government to supplement their heavily-sanctioned economy . OR by -2 ( 0xFFFFFFFE ) But as a new documentary series on Hulu reveals [ SPOILER ALERT ! ] , there was just one problem with that theory : Their top suspect had killed himself more than a year before the hackers began publishing stolen user data .


By late 2015 , the malware ’ s creators had gone mostly silent until the summer of 2016 when the malware reappeared with a more complex architecture that injects malicious code into Android system processes . We have moderate confidence APT39 operations are conducted in support of Iranian national interests based on regional targeting patterns focused in the Middle East . will always produce the value -1 . Days later , KillNet claimed to target the European Investment Bank ( EIB ) .


The change in the way the malware works today may be to help finance the campaign through fraudulent ad activity . APT39 's focus on the widespread theft of personal information sets it apart from other Iranian groups FireEye tracks , which have been linked to influence operations , disruptive attacks , and other threats . In this case , If this is the primary reason why someone might be after your companys data , simple preventative measures could be used to deter these attacks from happening .


The malware simulates clicks on app advertisements provided by legitimate ad networks and forces the app to install on a device . APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns . the pattern matching function replaces dword_745BB58C * ( dword_745BB58C – 1 ) Investigate anomalous activity and correlate findings with process telemetry .


An attacker is paid by the network when one of these apps is installed successfully . Other groups attributed to Iranian attackers , such as Rocket Kitten , have targeted Iranian individuals in the past , including anonymous proxy users , researchers , journalists , and dissidents . with 2 . Another wave of suspected Dukes attacks was identified in November 2018 by FireEye , this time again relying on Windows LNK files and deploying Cobalt Strike .


Logs collected by Check Point researchers show that every day Gooligan installs at least 30,000 apps fraudulently on breached devices or over 2 million apps since the campaign began . Remexi is a basic back door Trojan that allows Cadelle to open a remote shell on the computer and execute commands . The global variable value dword_72DBB588 is always 0 because the value is not initialized ( we can check it by is_loaded API ) This markup becomes unescaped , causing arbitrary markup to be injected into the document .


How does Gooligan work ? Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands . and has only read accesses . The goal of studying IoAs is to understand the intent of a malicious user accessing the information and network resources of the organization , even when a malicious payload is not yet delivered , and all computing interactions can be considered as legitimate and authorized .


The infection begins when a user downloads and installs a Gooligan-infected app on a vulnerable Android device . One group , which we call Cadelle , uses Backdoor.Cadelspy , while the other , which we've named Chafer , uses Backdoor.Remexi and Backdoor.Remexi.B . So the pattern matching function replaces the global variable with 0 . 3AM is socalled because it appends encrypted files with the extension .threeamtime .


Our research team has found infected apps on third-party app stores , but they could also be downloaded by Android users directly by tapping malicious links in phishing attack messages . APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol ( RDP ) , Secure Shell ( SSH ) , PsExec , RemCom , and xCmdSvc . There are some variants with this pattern ( e.g , the variable – 10 < 0 ) Given that threat actors use red team tools and public exploitation frameworks for targeted threat activity in the wild , we believe COSMICENERGY poses a plausible threat to affected electric grid assets .


After an infected app is installed , it sends data about the device to the campaign ’ s Command and Control ( C & C ) server . The APT39 were using an improved version of Remexi in what the victimology suggests might be a domestic cyber-espionage operation . , Command messages are used in ICS networks to give direct instructions to control systems devices .


Gooligan then downloads a rootkit from the C & C server that takes advantage of multiple Android 4 and 5 exploits including the well-known VROOT ( CVE-2013-6282 ) and Towelroot ( CVE-2014-3153 ) . A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . where the immediate constant can be different . PIEHOP expects its main function to be called via another Python file , supplying either the argument or .


These exploits still plague many devices today because security patches that fix them may not be available for some versions of Android , or the patches were never installed by the user . A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . We also observed a pattern that was also using an 8-bit portion of the register . Depending on the campaign , the final payload or the third intermediate stage is appended as an encrypted binary blob to the end of the image .


If rooting is successful , the attacker has full control of the device and can execute privileged commands remotely . The Middle Eastern hacker group in this case is codenamed " BlackOasis " . In the following example , US by the numbers


After achieving root access , Gooligan downloads a new , malicious module from the C & C server and installs it on the infected device . Kaspersky found the BlackOasis group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . the variable v5 in pseudocode is a register operand ( cl ) Recently , concerns have grown regarding the rapid growth of commercial spyware tools , and the way in which they are being used against their intended victims .


This module injects code into running Google Play or GMS ( Google Mobile Services ) to mimic user behavior so Gooligan can avoid detection , a technique first seen with the mobile malware HummingBad . Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . in microcode . Anonymous Sudan


The module allows Gooligan to : Steal a user ’ s Google email account and authentication token information Install apps from Google Play and rate them to raise their reputation Install adware to generate revenue Ad servers , which don ’ t know whether an app using its service is malicious or not , send Gooligan the names of the apps to download from Google Play . BlackOasis ' interests span a wide gamut of figures involved in Middle Eastern politics . We need to check if the value comes from the result of x * ( x – 1 ) Tools used by the attackers in this campaign included


After an app is installed , the ad service pays the attacker . REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japanese organizations such as government agencies ( including defense ) as well as those in biotechnology , electronics manufacturing , and industrial chemistry . . An additional field of interest in the XPdb was the exec_cdhash , which contains the cdhash , or Code Directory hash , of the executed binaries .


Then the malware leaves a positive review and a high rating on Google Play using content it receives from the C & C server . REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry . In another example , Last , it sends a single “ C_CS_NA_1 – clock synchronization command ” to the target station , which synchronizes the remote station time clock with the time clock for the device issuing the commands .


Our research team was able to identify several instances of this activity by cross-referencing data from breached devices with Google Play app reviews . In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets . the variable v2 in pseudocode is a register operand ( ecx ) WarDefense extrinsic In the 21st century it would be irresponsible to ignore the fact that nation states and even patriot hackers play in either initiating or defending against adversaries .


This is another reminder of why users shouldn ’ t rely on ratings alone to decide whether to trust an app . In fact , REDBALDKNIGHT has been zeroing in on Japanese organizations as early as 2008 — at least based on the file properties of the decoy documents they've been sending to their targets . in microcode . Evidence of compromise was observed within the JumpCloud agent log located at the file path /private / var / log / jcagent.log .


Similar to HummingBad , the malware also fakes device identification information , such as IMEI and IMSI , to download an app twice while seeming like the installation is happening on a different device , thereby doubling the potential revenue . Secureworks® incident responders and Counter Threat Unit™ ( CTU ) researchers investigated activities associated with the BRONZE BUTLER ( also known as Tick ) threat group , which likely originates in the People . We have to validate if a global variable with above-mentioned conditions is assigned to the register . While a sudden dip in attacks is n't too unusual for top ransomware gangs , it 's worth mentioning that in last month ’s review we speculated that Royal might be going through a rebrand .


What are Google authorization tokens ? Targeting data supports the belief that APT39 's key mission is to track or monitor targets of interest , collect personal information , including travel itineraries , and gather customer data from telecommunications firms . Data-flow tracking code was added to detect these use-cases . The way Hack520 signs his messages in one hacker forum provides a clue pointing to this connection .


A Google authorization token is a way to access the Google account and the related services of a user . BRONZE BUTLER has used a broad range of publicly available ( Mimikatz and gsecdump ) and proprietary ( Daserf and Datper ) tools . The added code requires that the mblock_t pointer information is passed from the argument of optinsn_t : :f unc to trace back previous instructions using the mblock_t linked list . Table 1 : Malicious OT files Filename Hash Purpose a.iso Unknown Contains attacker ’s files lun.vbs 26e2a41f26ab885bf409982cb823ffd1


It is issued by Google once a user successfully logged into this account . BRONZE BUTLER are also fluent in Japanese , crafting phishing emails in native Japanese and operating successfully within a Japanese-language environment . However , Analysis into the malware and its functionality reveals that its capabilities are comparable to those employed in previous incidents and malware , such as and , which were both malware variants deployed in the past to impact electricity transmission and distribution via IEC-104 .


When an authorization token is stolen by a hacker , they can use this token to access all the Google services related to the user , including Google Play , Gmail , Google Docs , Google Drive , and Google Photos . BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . the callback returns NULL from the mblock_t pointer if the instruction is not a top-level one . Also in 2015 , GReAT identified the Minidionis threat ( known by Kaspersky as CloudLook ) to be another backdoor from the same APT actor – this time using a cloud drive capability to store and download malware onto infected systems using a multi - dropper scheme .


While Google implemented multiple mechanisms , like two-factor-authentication , to prevent hackers from compromising Google accounts , a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in . The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . If the setl is always sub-instruction during the optimization , These groups commonly share infrastructure to complete their actions on objectives .


Conclusion Gooligan has breached over a million Google accounts . BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . we never get the pointer . Second , as COSMICENERGY was potentially developed as part of a red team , this discovery suggests that the barriers to entry are lowering for offensive OT threat activity since we normally observe these types of capabilities limited to well resourced or state sponsored actors .


We believe that it is the largest Google account breach to date , and we are working with Google to continue the investigation . The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . To handle this type of scenario , For more information , contact : intelreports@kaspersky.comPowerShell event logs for the creation of an arbitrary process from PowerShell .


We encourage Android users to validate whether their accounts have been breached . BRONZE BUTLER uses credential theft tools such as Mimikatz and WCE to steal authentication information from the memory of compromised hosts . the code was modified to catch and pass the mblock_t of the jnz instruction to the sub-instruction . For instance , Rising Sun was observed in attacks before the discovery of ' Sharpshooter ' and shared the tactics , techniques , and procedures ( TTPs ) seen in operations attributed to Lazarus group .


Hacking Team Spying Tool Listens to Calls By : Trend Micro July 21 , 2015 Following news that iOS devices are at risk of spyware related to the Hacking Team , the saga continues into the Android sphere . While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization . The original implementation calls the optblock_t : :f unc callback function in MMAT_LOCOPT ( local optimization and graphing are complete ) Today ’s announcement comes as cyber security leaders from the 5 Eyes , EU and international allies meet at the NCSC ’s Cyber UK conference in Newport to discuss the cyber threats facing the world .


We found that among the leaked files is the code for Hacking Team ’ s open-source malware suite RCSAndroid ( Remote Control System Android ) , which was sold by the company as a tool for monitoring targets . While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization . maturity level . Additionally , by using leaked source code , threat actors can confuse or mislead investigators , as security professionals may be more likely to misattribute the activity to the wrong actor .


( Researchers have been aware of this suite as early as 2014 . Several xxmm samples analyzed by CTU researchers incorporate Mimikatz , allowing BRONZE BUTLER to issue Mimikatz commands directly from xxmm . Rolles previously explained the unflattening algorithm in a Hex-Rays blog . Then , users were prompted to download a malicious trojan .


) The RCSAndroid code can be considered one of the most professionally developed and sophisticated Android malware ever exposed . BRONZE BUTLER compromises organizations to conduct cyberespionage , primarily focusing on Japan . For brevity I will quickly cover some key points to understand the algorithm at a high level . When the victim opened an archive , a second stage dropper executed and a WAV file played like a real voicemail .


The leak of its code provides cybercriminals with a new weaponized resource for enhancing their surveillance operations . Symantec discovered the most recent wave of Tick attacks in July 2015 , when the group compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks . Normally the call flow graph ( CFG ) The generic campaigns are aimed at various civilian targets in Poland and Ukraine , such as with Excel spreadsheet lures masquerading as value - added tax ( VAT ) return forms .


Based on the leaked code , the RCSAndroid app can do the following intrusive routines to spy on targets : Capture screenshots using the “ screencap ” command and framebuffer direct reading Monitor clipboard content Collect passwords for Wi-Fi networks and online acco ; .unts , including Skype , Facebook , Twitter , Google , WhatsApp , Mail , and LinkedIn Record using the microphone Collect SMS , MMS , and Gmail messages Record location Gather device information Capture photos using the front and back cameras Collect contacts and decode Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data exfiltration and to provide remote access to infected machines . of a function obfuscated with control flow flattening has a loop structure starting with yellow-colored “ control flow dispatcher ” None Follow Microsoft recommendations to disable remote PowerShell for non - administrative users where possible .


messages from IM accounts , including Facebook Messenger , WhatsApp , Skype , Viber , Line , WeChat , Hangouts , Telegram , and BlackBerry Messenger . Symantec discovered the most recent wave of Tick attacks in July 2015 , when BRONZE BUTLER compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks . like this , The series also touches on shocking new details unearthed by KrebsOnSecurity and Jeremy Bullock , a data scientist who worked with the show ’s producers at the Warner Bros. production company Wall to Wall Media .


Capture real-time voice calls in any network or app by hooking into the “ mediaserver ” system service RCSAndroid in the Wild Our analysis reveals that this RCSAndroid ( AndroidOS_RCSAgent.HRX ) has been in the wild since 2012 . In some cases , the attackers used the Society for Worldwide Interbank Financial Telecommunication ( SWIFT ) network to transfer money to their accounts . shown after the First Block . This sample works in tandem with PIEHOP , which sets up the execution .


Traces of its previous uses in the wild were found inside the configuration file : It was configured to use a Command-and-control ( C & C ) server in the United States ; however , the server was bought from a host service provider and is now unavailable . Carbanak is a backdoor used by the attackers to compromise the victim . The original code is separated into the orange-colored “ first block ” An internal data defense strategy requires prevention , detection and response capabilities .


It was configured to activate via SMS sent from a Czech Republic number . If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation . and green-colored flattened blocks . It is only when evaluating indicators of attack in the big picture , that the patterns of data collection and attempts to access the network start resembling an adversary with malicious intent .


Attackers can send SMS with certain messages to activate the agent and trigger corresponding action . To enable connections to the infected computer using the Remote Desktop Protocol ( RDP ) , Carbanak sets Termservice service execution mode to Auto . The analyst is then required to resolve the correct next block and modify the destination accordingly . The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier .


This can also define what kind of evidences to collect . Carbanak is also aware of the IFOBS banking application and can , on command , substitute the details of payment documents in the IFOBS system . The next portion of first block and each flattened block is decided by a “ block comparison variable ” Ransomware builders usually have a user interface that allows users to choose the underlying features and customize the configurations to build a new ransomware binary executable without exposing the source code or needing a compiler installed .


Based on emails leaked in the dump , a number of Czech firms appear to be in business with the Hacking team , including a major IT partner in the Olympic Games . Sensitive bank documents have be found on the servers that were controlling Carbanak . with an immediate value . In most cases , the file is an Excel spreadsheet containing a VBA macro , but we also found four instances where a malicious PowerPoint OLE2 ( PPT ) file was used , possibly indicating the actor 's readiness to use file formats less commonly used in attacks .


Dropping Cluster Bombs RCSAndroid is a threat that works like a cluster bomb in that it deploys multiple dangerous exploits and uses various techniques to easily infect Android devices . Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa . The value of the variable is assigned to a specific register in each block then compared in a control flow dispatcher and other condition blocks . The initial payloads and second stage backdoors were removed from the system .


While analyzing the code , we found that the whole system consists of four critical components , as follows : penetration solutions , ways to get inside the device , either via SMS/email or a legitimate app low-level native code , advanced exploits and spy tools beyond Android ’ s security framework high-level Java agent – the app ’ s malicious APK command-and-control ( C & C ) servers , used to remotely send/receive malicious commands Attackers use two methods to get targets to download RCSAndroid . FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015 . If the variable registers for the comparison and assignment are different , Therefore , there are cases where these vulnerabilities are accessible via the internet .


The first method is to send a specially crafted URL to the target via SMS or email . As with previous campaigns , and as highlighted in our annual M-Trends 2017 report , FIN7 is calling stores at targeted organizations to ensure they received the email and attempting to walk them through the infection process . the assignment variable is called “ block update variable ” CrowdStrike security researchers were working to develop proof - of - concept ( POC ) code for an exploit method indicative of the logging present after recent Play ransomware attacks .


The URL will trigger exploits for arbitrary memory read ( CVE-2012-2825 ) and heap buffer overflow ( CVE-2012-2871 ) vulnerabilities in the default browsers of Android versions 4.0 Ice Cream Sandwich to 4.3 Jelly Bean , allowing another local privilege escalation exploit to execute . We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . ( which is further explained later ) The sample of PIEHOP we obtained contains programming logic errors that prevent it from successfully performing its IEC-104 control capabilities , but we believe these errors can be easily corrected .


When root privilege is gained , a shell backdoor and malicious RCSAndroid agent APK file will be installed The second method is to use a stealthy backdoor app such as ANDROIDOS_HTBENEWS.A , which was designed to bypass Google Play . While FIN7 has embedded VBE as OLE objects for over a year , they continue to update their script launching mechanisms . . A careful analysis of the domain registrations from this threat actor between 2014 and 2015 allowed us to identify one profile used to register several domains that were used as C&C servers for a particular malware family employed by the Winnti group .


The role of ANDROIDOS_HTBENEWS.A and the malicious APK mentioned in the first method is to exploit a local privilege escalation vulnerability in Android devices . This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies . The algorithm looks straightforward however some portions of the code had to be modified in order to correctly deobfuscate the code . But as a new documentary series on Hulu reveals [ SPOILER ALERT ! ] , there was just one problem with that theory : Their top suspect had killed himself more than a year before the hackers began publishing stolen user data .


Hacking Team has been known to use both CVE-2014-3153 and CVE-2013-6282 in their attacks . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . This is further detailed below . In 2009 , the Winnti group shifted to targeting gaming companies in South Korea using a self - named data- and file - stealing malware .


The said exploits will root the device and install a shell backdoor . The group has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . As previously detailed , Leveraging legitimate tools , publicly available malware , and livingofftheland tactics , MuddyWater focused on targeting Exchange Servers as part of a larger effort to deploy web shells and establish a backdoor within target networks .


The shell backdoor then installs the RCSAndroid agent . From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space . the original implementation of the code only works in MMAT_LOCOPT maturity level . Adversaries may manipulate physical process control within the industrial environment .


This agent has two core modules , the Evidence Collector and the Event Action Trigger . Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems . Rolles said this was to handle another obfuscation called “ Odd Stack Manipulations ” Russia has historically used self - proclaimed hacktivist groups as a means to obfuscate its role in operations against Western nations and it is plausible that Zarya or various pro - Russia hacktivists that have risen to prominence since Russia ’s invasion of Ukraine may either be cooperating or coordinating with , or a front for , the Russian security intelligence services .


The Evidence Collector module is responsible for the spying routines outlined above . The first successful bank robbery was committed by this group in January 2013 . , Anonymous Sudan accounted for 63 % of total identified DDoS attacks claimed by the KillNet collective in 2023 .


One of its most notable routines is capturing voice calls in real time by hooking into the “ mediaserver ” system service . To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer . referred in his blog ) None Use of open source libraries for protocol implementation : The availability of open source projects that implement OT protocols can lower the barrier of entry for actors attempting to interact with OT devices .


The basic idea is to hook the voice call process in mediaserver . We have no evidence of compromises against banks in Western Europe or United States , but it should be noted that the attackers methods could be utilized against banks outside of Russia as well . . Given the evolving state of ransomware payout demands , government regulations are already underway to help public and private companies prevent and respond to ransomware attacks .


Take voice call playback process for example . Additionally the reports on Carbanak show a different picture , where banks targeted outside of Russia , specifically Europe , USA and Japan are mentioned , which does not match our research . However the unflattening of ANEL code had to be performed in the later maturity level since the assignment of block comparison variable heavily depends on opaque predicates . The first script is the RAW data the retrieved from the JS file and the second one is the decoded one .


The mediaserver will first builds a new unique track , start to play the track , loop play all audio buffer , then finally stop the playback . Without any insight into the evidence Kaspersky has obtained , we can only repeat our view that Anunak has targeted only banks in Russia and we have no concrete reports of compromised banks outside of Russia directly related to this criminal group . As an example in the following obfuscated function , Ready to learn more about Malwarebytes for Business ?


The raw wave audio buffer frame can be dumped in the getNextBuffer ( ) function . Charming Kitten is an Iranian cyberespionage group operating since approximately 2014 . the v3 and v7 variables are assigned to the block comparison variable ( b_cmp ) Function has a couple of Anti debugging Anti Emulation checks .


With the help of the open-source Android Dynamic Binary Instrumentation Toolkit and root privilege , it is possible to intercept any function execution . These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider . . A Cl0p representative confirmed that they had been testing the vulnerability since July 2021 and that they had decided to deploy it over the Memorial Day weekend .


The Event Action Trigger module triggers malicious actions based on certain events . The Charming Kitten' focus appears to be individuals of interest to Iran in the fields of academic research . However the values are dependent on opaque predicates results . Mandiant observed UNC4899 utilize various VPN providers as a final hop , the most common being ExpressVPN , but connections to NordVPN , TorGuard and many other providers have also been observed .


These events can be based on time , charging or battery status , location , connectivity , running apps , focused app , SIM card status , SMS received with keywords , and screen turning on . Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as OilRig and CopyKittens . Once the opaque predicates are broken , Sandworm was first observed in the victim ’s environment in June 2022 , when the actor deployed the Neo - REGEORG webshell on an internet - facing server .


According to the configuration pattern , these actions are registered to certain events : Sync configuration data , upgrade modules , and download new payload ( This uses transport protocol ZProtocol encrypted by AES/CBC/PKCS5Padding algorithm to communicate with the C & C server . Flying Kitten ( which is another name given by the security industry to Charming Kitten ) was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of the IRI ( Islamic Republic of Iran ) government and foreign espionage targets . the loop code becomes simpler . What prompted the data scientist Bullock to reach out were gobs of anti - Semitic diatribes from Harrison , who had taken to labeling Biderman and others “ greedy Jew bastards . ”


) Upload and purge collected evidence Destroy device by resetting locking password Execute shell commands Send SMS with defined content or location Disable network Disable root Uninstall bot To avoid detection and removal of the agent app in the device memory , the RCSAndroid suite also detects emulators or sandboxes , obfuscates code using DexGuard , uses ELF string obfuscator , and adjusts the OOM ( out-of-memory ) value . Flying Kitten was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of government and foreign espionage targets . Unflattening the code in later maturity levels like MMAT_GLBOPT1 and MMAT_GLBOPT2 ( first and second pass of global optimization ) s determines offsets within files for encryption to control encryption speed .


Interestingly , one unused feature of the app is its ability to manipulate data in the Android package manager to add and remove permissions and components as well as hide the app icon . At certain times , Mesri has been a member of an Iran-based hacking group called the Turk Black Hat security team " . caused additional problems . While COSMICENERGY ’s capabilities are not significantly different from previous OT malware families ’ , its discovery highlights several notable developments in the OT threat landscape .


Recommendations Popular mobile platforms like Android are common targets for organized or commercialized monitoring operations . During intense intelligence gathering over the last 24 months , we observed the technical capabilities of the Operation Cleaver team rapidly evolve faster than any previously observed Iranian effort . The unflattening algorithm requires mapping information between block comparison variable and the actual block number ( mblock_t : :s erial ) In 2009 , the Winnti group shifted to targeting gaming companies in South Korea using a self - named data- and file - stealing malware .


Attackers know that rooting devices via malware exploits is an effective means to control devices and gather information from them . TinyZBot is a bot written in C# and developed by the Cleaver team . used in the microcode . While we can not validate these claims , there are indications that some of these documents are legitimate , which would demonstrate another significant increase in capability for the group .


In a root broken device , security is a fairy tale . Some of the teams publicly known today include Iranian Cyber Army , Ashiyane , Islamic Cyber Resistance Group , Izz ad-Din al-Qassam Cyber Fighters , Parastoo , Shabgard , Iran Black Hats and many others 9 . In later maturity levels , Initial access was gained by compromising JumpCloud and inserting malicious code into their commands framework .


Take note of the following best practices to prevent this threat from getting in your device : Disable app installations from unknown , third-party sources . However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team . some blocks are deleted by the optimization after defeating opaque predicates , PBI Research Services also reported a data breach that exposed information for 4.75 million people .


Constantly update your Android devices to the latest version to help prevent exploits , especially in the case of RCSAndroid which can affect only up to version 4.4.4 KitKat . The Cobalt group 's traditional " stomping grounds " are the Eastern Europe , Central Asia , and Southeast Asia . which removes the mapping information . Most of the URLs and the infrastructure were not accessible at the time of analysis , although we managed to obtain images from three campaigns to recreate the infection chain .


Note , however , that based on the leak mail from a customer inquiry , Hacking Team was in the process of developing exploits for Android 5.0 Lollipop . Against targets in the CIS countries , the Cobalt also used their own infrastructure , which included rented dedicated servers . In the example below , The hackers behind the campaign have been identified as Tortoiseshell , which is believed to work on behalf of the Iranian government .


Install a mobile security solution to secure your device from threats . In several cases , the Cobalt compromised company infrastructure and employee accounts in order to send phishing messages to partner companies in North and South America , Europe , CIS countries , and Central and Southeast Asia . the blue-highlighted immediate value 0x4624F47C is assigned to block comparison variable in the first block . In one exchange on Aug. 16 , 2012 , Ashley Madison ’s director of IT was asked to produce a list of all company employees with all - powerful administrator access .


The leaked RCSAndroid code is a commercial weapon now in the wild . To ensure remote access to the workstation of an employee at a target organization , the Cobalt group ( as in previous years ) uses Beacon , a Trojan available as part of commercial penetration testing software . The mapping can be created by checking the conditional jump instruction ( jnz ) For these reasons , OT defenders and asset owners should take mitigating actions against COSMICENERGY to preempt in the wild deployment and to better understand common features and capabilities that are frequently deployed in OT malware .