Password generation for compressed files takes place client-side with each device using a unique key in most scenarios . Citrix told Threatpost that this is indeed the same password-spraying attack it announced itself last week – but it wouldn't confirm the other details in Resecurity 's post , including the attribution . APT1 also used more generic names referencing topics like software : Most do n’t even do much besides Since the most common allowed domain is google-analytics.com ( 17 K websites )


Key information consists of an MD5 hash of the device 's Android ID , the device manufacturer , and the device model with each separated by an underscore . In wake of these events , a security firm Resecurity reached out to NBC news and claimed that they had reasons to believe that the attacks were carried out by Iranian-linked group known as IRIDIUM . globalowa.com gmailboxes.com hugesoft.org idirectech.com ifexcel.com infosupports.com livemymsn.com mcafeepaying.com microsoft-update-info.com micyuisyahooapis.com msnhome.org pcclubddk.net progammerli.com softsolutionbox.net symanteconline.net webservicesupdate.com . We took google - analytics as an example , but other services can also be used .


Visually , this can be represented as follows : Android ID When combined with our analysis of indexed directories on C2 infrastructure , we were able to easily automate the generation of the password used by each device and , in turn , successfully decompress all exfiltrated content from compromised devices . Resecurity says that IRIDIUM " has hit more than 200 government agencies , oil and gas companies , and technology companies including Citrix . Finally , some zones used by APT1 reflect a business theme . As an example , we took the twitter login page , which implemented the following CSP rule ( which contains ): The following short JS code inserted into the site will send the credentials to google - analytics console controlled by us : The UA-#######- # parameter is the tag ID owner that Google Analytics uses to connect the data to a specific account .


Indexed directories on C2 infrastructure While exfiltrated content is encrypted , information used to generate the password is plainly visible in the top level directories for each device . Resecurity claims that IRIDIUM breached Citrix 's network during December 2018 . The names suggest websites that professionals might visit : Instead of using twitter ’s google - analytic account , we used an account we control .


Taking this information from directory listings , like the one shown above , allowed for the decryption of all content . Infy engaged in malware spearphishing against the same targets as Flying Kitten from the outset of its campaign ; Operation Cleaver has registered several resources related to development agencies that have been the subject of intrusion attempts by others since February 2014 . advanbusiness.com businessconsults.net businessformars.com companyinfosite.com conferencesinfo.com copporationnews.com . Unfortunately , the CSP policy ca n’t discriminate based on the Tag ID .


In this case , FrozenCell has primarily netted the actors behind it with recorded outbound calls followed closely by images and recorded incoming calls . The malicious samples we found are the early stage malware most often delivered by spear-phishing e-mails . APT1 intruders often use the FQDNs that are associated with legitimate websites hosted by their hop points . Though Google meant to have this parameter be used to mention the page the user visited , we used it to exfiltrate the user name and password data encoded in base64 .


FrozenCell is part of a very successful , multi-platform surveillance campaign . This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample . We consider these domains to be “ hijacked ” because they were registered by someone for a legitimate reason , but have been leveraged by APT1 for malicious purposes . In our Google Analytics platform , we will see the data as : In our demo the DP will result in page view of Which will be decoded from base64 as : The source of the problem is that the CSP rule system is n’t granular enough .


Attackers are growing smarter , targeting individuals through the devices and the services they use most . At this stage , the malware gathers information about the infected computer . APT1 uses hijacked FQDNs for two main purposes . Recognizing and stopping the above malicious JavaScript request requires advanced visibility solutions that can detect the access and exfiltration of sensitive user data ( in this case the user ’s email address and password ) .


Government agencies and enterprises should plan to be hit from all angles - cloud services , mobile devices , laptops - in order to build comprehensive security strategies that work . Hancom Office is widely used in South Korea . First , they place malware ( usually in ZIP files ) on the legitimate websites hosted on the hop point and then send spear phishing emails with a link that includes the legitimate FQDN . One might think we could have updated the CSP to only allow specific TIDs : .


TUESDAY , MAY 19 , 2020 The wolf is back ... NEWS SUMMARY Thai Android devices and users are being targeted by a modified version of DenDroid we are calling " WolfRAT , '' now targeting messaging apps like WhatsApp , Facebook Messenger and Line . Perhaps it also points to the suspected North Korean origin of attack . APT12 . The problem is that CSP does n't support query strings ( See Spec ):


We assess with high confidence that this modified version is operated by the infamous Wolf Research . The attacker is from North Korea . This research paper will delve into another prominent group of attackers referred to as “ IXESHE ” ( pronounced “ i-sushi ” ) , based on one of the more common detection names security companies use for the malware they utilize . Having such a gap with the most commonly used domain allowed with CSP is a major risk indicator of the threats that can come from other domains that are used to serve multiple accounts .


This actor has shown a surprising level of amateur actions , including code overlaps , open-source project copy/paste , classes never being instanced , unstable packages and unsecured panels . All of them lie in ranges of the Jilin Province Network and Liaoning Province Network , in China . This campaign is notable for targeting East Asian governments , electronics manufacturers , and a telecommunications company . A possible solution would come from adaptive URLs , adding the ID as part of the URL or subdomain to allow admins to set CSP rules that restrict data exfiltration to other accounts .


EXECUTIVE SUMMARY Cisco Talos has discovered a new Android malware based on a leak of the DenDroid malware family . Finally , this geo-location supports the likely theory that the attackers behind Kimsuky are based in North Korea . The IXESHE campaign makes use of targeted emails with malicious attachments to compromise victims ’ systems . A more granular future direction for strengthening CSP direction to consider as part of the CSP standard is XHR proxy enforcement .


We named this malware " WolfRAT '' due to strong links between this malware ( and the command and control ( C2 ) infrastructure ) and Wolf Research , an infamous organization that developed interception and espionage-based malware and was publicly described by CSIS during Virus Bulletin 2018 . In this blog , we look at the Winnti malware implant as used by two known activity groups BARIUM and LEAD . The emails are often tailored for specific victims and contain malicious attachments that are almost always “ weaponized ” .PDF files with known exploits that drop malware executables onto targeted systems . This will essentially create a client - side WAF that can enforce a policy on where specific data field are allowed to be transmitted .


We identified infrastructure overlaps and string references to previous Wolf Research work . According to the German press , the intruders used the Winnti family of malware as their main implant , giving them persistent access to the conglomerate 's network as early as February 2016 . In addition , the IXESHE attackers conducted two specific attacks that leveraged zero-day exploits—one in 2009 and another in 2011 . In addition to the complexity of managing CSP rules , this vulnerability shows how widely used services such as Google Analytics can be subverted to bypass this protection .


The organization appears to be shut down , but the threat actors are still very active . In the case of this malware , the activity groups strongly associated with Winnti are BARIUM and LEAD . The IXESHE attackers almost always make use of compromised servers as command-and-control ( C&C ) servers . Over 5 years ago , we began tracking a new campaign that we called FakeUpdates ( also known as SocGholish ) that used compromised websites to trick users into running a fake browser update .


We identified campaigns targeting Thai users and their devices . But even though they share the use of Winnti , the BARIUM and LEAD activity groups are involved in very different intrusion scenarios . In some cases , the compromised servers are hosted on target organizations ’ networks after successful infiltration so the attackers can increase their control of the victims ’ infrastructure . Instead , victims would end up infecting their computers with the NetSupport RAT , allowing threat actors to gain remote access and deliver additional payloads .


Some of the C2 servers are located in Thailand . To show how this breach and similar breaches can be mitigated , we look at how Windows Defender ATP flags activities associated with BARIUM , LEAD , and other known activity groups and how it provides extensive threat intelligence about these groups . Using this approach , the attackers amassed at least 60 C&C servers over time . As we have seen over the years , SocGholish is an established player that has managed to compromise countless victims and deliver ransomware after facilitating the installation of tools like Cobalt Strike or Mimikatz .


The panels also contain Thai JavaScript comments and the domain names also contain references to Thai food , a tactic commonly employed to entice users to click/visit these C2 panels without much disruption . BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms . This technique also allows the attackers to cover their tracks , as having the C&C server in the victims ’ corporate networks means very little C&C traffic leaves them . The new campaign , which we call FakeSG , also relies on hacked WordPress websites to display a custom landing page mimicking the victim 's browser .


We identified a notable lack of sophistication in this investigation such as copy/paste , unstable code , dead code and panels that are freely open . During these intrusions , LEAD 's objective was to steal sensitive data , including research materials , process documents , and project plans . The attackers ’ deliberate use of compromised machines and dynamic Domain Name System ( DNS ) services allows them to hide traces of their presence by confusing their activities with data belonging to legitimate individuals . The threat actors are distributing NetSupport RAT either as a zipped download or via an Internet shortcut .


What 's new ? Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles , collaborative document editing sites , and blogs for C&C . Looking at threat intelligence derived from tracking APT campaigns over time primarily based on the network traffic generated by the malware used , we were able to develop indicators of compromise for the IXESHE campaign . While FakeSG appears to be a newcomer , it uses different layers of obfuscation and delivery techniques that make it a threat to take seriously and which could potentially rival with SocGholish .


WolfRAT is based on a previously leaked malware named DenDroid . Once BARIUM has established rapport , they spear-phish the victim using a variety of unsophisticated malware installation vectors , including malicious shortcut ( .lnk ) files with hidden payloads , compiled HTML help ( .chm ) files , or Microsoft Office documents containing macros or exploits . The malware samples used in this campaign were not very complicated by nature but do give the attackers almost complete control over their targets ’ compromised systems . We first heard of this new campaign thanks to a Mastodon post by Randy McEoin .


The new malware appears to be linked to the infamous Wolf Research organization and targets Android devices located in Thailand . Instead , the group often simply emails a Winnti installer to potential victims , relying on basic social engineering tactics to convince recipients to run the attached malware . Most of the IP addresses of IXESHE ’s victims are linked to DSL networks , which made it difficult to determine their identities . The tactics , techniques and procedures ( TTPs ) are very similar to those of SocGholish and it would be easy to think the two are related .


How did it work ? Microsoft Analytics shows that Winnti has been used in intrusions carried out throughout Asia , Europe , Oceania , the Middle East , and the United States in the last six months ( Figure 1 ) . Careful research , however , allowed the identification of some of the attackers ’ victims : East Asian governments , Taiwanese electronics manufacturers , A telecommunications company . In fact , this chain also leads to NetSupport RAT .


The malware mimics legit services such as Google service , GooglePlay or Flash update . Instead , Lead often simply emails a Winnti installer to potential victims , relying on basic social engineering tactics to convince recipients to run the attached malware . Campaign victims were identified by using Whois records and open source research . As a result , we decided to call this variant FakeSG .


The malware is not really advanced and is based on a lot of copy/paste from public sources available on the Internet . In some other cases , LEAD gains access to a target by brute-forcing remote access login credentials , performing SQL injection , or exploiting unpatched web servers , and then they copy the Winnti installer directly to compromised machines . Trend Micro generally notifies customers that are believed to have been specifically targeted by APT campaigns . 2023 - 07 - 19 Update : On June 5 , @SecurityAura described an unknown campaign using .hta payloads disguised as driver updates .


The C2 infrastructure contains a lack of sophistication such as open panels , reuse of old servers publicly tagged as malicious… So what ? This was the case in two known intrusions in 2015 , where attackers named the implant DLL " ASPNET_FILTER.DLL " to disguise it as the DLL for the ASP.NET ISAPI Filter . The IXESHE attackers have been actively launching highly targeted attacks since at least July 2009 . On June 22 , @AnFam17 spotted the same fake browser update leveraging URL shortcuts .


After being publicly denounced by CSIS Group — a threat intelligence company in Denmark — Wolf Research was closed and a new organization named LokD was created . Windows Defender ATP helps network security professionals deal with intrusions from activity groups like LEAD and BARIUM in several ways . Available data on the IXESHE campaign indicates that targeted emails with malicious .PDF file attachments were the attackers ’ vector of choice . Both of these campaigns use a similar structure with compromised WordPress sites hosting the lure shortcuts and a WebDav server that loads NetSupport RAT .


This new organization seems to work on securing Android devices . The following examples were developed using a Winnti installer that was used in attacks in December 2016 . In most cases , the attacks involved Adobe Acrobat , Reader , and Flash Player exploits such as : CVE-2009-4324 , CVE-2009-0927 , CVE-2011-0609 , CVE-2011-0611 . RussianPanda ( @AnFam17 ) named the URL shortcut campaign RogueRaticate .


However , thanks to the infrastructure sharing and forgotten panel names , we assess with high confidence that this actor is still active , it is still developing malware and has been using it from mid-June to today . The Windows 10 Creators Update will bring several enhancements to Windows Defender ATP that will provide SOC personnel with options for immediate mitigation of a detected threat . It should also be noted that this campaign used CVE-2009-4324 and CVE-2011-0609 exploits when these were still unpatched or considered zero-day vulnerabilities . FakeSG has different browser templates depending on which browser the victim is running .


On the C2 panel , we found a potential link between Wolf Research and another Cyprus organization named Coralco Tech . LEAD and BARIUM are not known for large-scale spear-phishing , so it is unlikely that SOC personnel would have to deal with multiple machines having been compromised by these groups at the same time . The IXESHE attackers also used an exploit that affected Microsoft Excel — CVE-2009-3129 . The themed " updates " look very professional and are more up to date than its SocGholish counterpart .


This organization is also working on interception technology . And , finally , with the upcoming Creators Update , Windows Defender ATP will provide additional capabilities for detecting threats such as Winnti , as well as centralized response options , such as machine isolation and file blocking , that will enable fast containment of known attack jump off points . Every IXESHE case we examined revealed that the original infection vector was a targeted email with a PDF exploit as attachment . Compromised websites ( WordPress appears to be the top target ) are injected with a code snippet that replaces the current webpage with the aforementioned fake updates templates .


LINKS TO WOLF INTELLIGENCE During the Virus Bulletin conference in 2018 , CSIS researchers Benoît Ancel and Aleksejs Kuprins did a presentation on Wolf Research and the offensive arsenal developed by the organization . The police suspected Lurk of stealing nearly three billion rubles , using malicious software to systematically withdraw large sums of money from the accounts of commercial organizations , including banks . Older versions also used an XLS exploit . The source code is loaded from one of several domains impersonating Google ( google - analytiks[.]com ) or Adobe ( updateadobeflash[.]website ): That code contains all the web elements ( images , fonts , text ) needed to render the fake browser update page .


They mentioned an Android , iOS and Windows remote access tool ( RAT ) . When we first encountered Lurk , in 2011 , it was a nameless Trojan . Opening the .PDF file drops and executes a malware in a victim ’s system . We should note that SocGholish used to retrieve media files from separate web requests until more recently when it started using self - contained Base64 encoded images .


Their findings showed that Wolf is headquartered in Germany with offices in Cyprus , Bulgaria , Romania , India and ( possibly ) the U.S . While the machine is in isolation , SOC personnel can direct the infected machine to collect live investigation data , such as the DNS cache or security event logs , which they can use to verify alerts , assess the state of the intrusion , and support follow-up actions . The malware displays a blank .PDF file or a decoy document related to the targeted attack . There are different installation flows for this campaign , but we will focus on the one that uses a URL shortcut .


The organization was closed after the CSIS presentation . This article is an attempt to share this experience with other experts , particularly the IT security specialists in companies and financial institutions that increasingly find themselves the targets of cyber-attacks . The emails normally come from compromised personal accounts or are entirely spoofed . This shorcut uses the WebDav HTTP protocol extension to retrieve the file launcher-upd.hta from a remote server : This heavily obfuscated script is responsible for the execution of PowerShell that downloads the final malware payload ( NetSupport RAT ) .


However , the director created a new organization in Cyprus named LokD . In most cases , the attackers only had to infect the computer on which the RBS software was installed in order to start stealing the cash . emails from spoofed senders were usually sent via mail servers in the United States and China . Malwarebytes 's EDR shows the full attack chain ( please click to enlarge ): The NetSupport RAT files are hosted on the same compromised WordPress site used earlier to download the Internet shortcut .


This new organization proposed the creation of a more secure Android phone . We were soon able to help investigate another incident involving Lurk . The malware also sets the executable file ’s attributes to “ Hidden. ” Some of the file names the attackers used include : winhlps.exe , acrotry.exe , AcroRd32.exe , Updater.exe . The RAT 's main binary is launched from " C:\Users\%username%\AppData\Roaming\BranScale\client32.exe " .


Based on the organization website , it also proposes services and developed zero-day vulnerabilities to test their own products : Zero-day research from lokd.com We can see that the organization owner still has an interest in Android devices . This event significantly affected the Russian cybercriminal world as the gang had stolen hundreds of millions of rubles during a few years of activity , and was considered a " leader " among cybercriminals . In order for the malware to survive rebooting , it normally creates the following registry run key : HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run . Fake browser updates are a very common decoy used by malware authors .


Based on infrastructure overlaps and leaked information , we assess with high confidence that the malware we identified and present in this paper is linked to Wolf Research . In Russia , there were several relatively large cybercriminal groups engaged in financial theft via attacks on RBS . The registry run key , in turn , points to the malware that has been dropped . In addition to SocGholish , the Domen toolkit was a well - built framework that emerged in 2019 while another campaign known as sczriptzzbn dropped SolarMarker leading to the NetSupport RAT in both cases .


One of the samples ( e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 ) uses the C2 server svcws [ . In April 2013 , a year after we found the " bodiless " Lurk module , the Russian cybercriminal underground exploited several families of malicious software that specialized in attacks on banking software . The value name of this entry varies from sample to sample . Initial access brokers use tools like NetSupport RAT to gather information and perform additional actions on victims of interest .


] ponethus [ . Through the information exchanges used by people in the security industry , we learned that several Russian banks were struggling with malicious programs created specifically to attack a particular type of legal banking software . Some of the names the attackers used for it include : Adobe Assistant , Migrated . Stolen credentials can be resold to other threat actors tied to ransomware gangs .


] com . If it did , the malware downloaded additional modules , including ones allowing for the automatic creation of unauthorized payment orders , changing details in legal payment orders , etc . Upon installation , the malware starts communicating with one of its C&C servers . We will continue to monitor these campaigns and in particular SocGholish to see if the web delivery landscape changes .


Based on our research and Benoît Ancel 's tracker , this C2 was used by Wolf Intelligence : Additionally , we identified two empty panels on a C2 server . As far as we can judge from the data we have , in 2014 the criminal group behind Lurk seriously reduced its activity and " lived from hand to mouth " , attacking anyone they could , including ordinary users . Most of the samples appeared to have at least three C&C servers hard coded for redundancy . Malwarebytes customers are protected as we detect the infrastructure and final payload used in these attacks .


The new one with the title " Coralco Archimedes , '' and an older version with the title " Wolf Intelligence : '' New panel Old panel The new panel name contains " Coralco '' in its name . In February 2015 , Kaspersky Lab 's Global Research and Analysis Team ( GReAT ) released its research into the Carbanak campaign targeting financial institutions . Some samples alternatively use an FGKD.jsp or an FPK.jsp file . Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected .


Coralco Tech is an organization located in Cyprus and providing interception tools . Since 2011 , the robbers had allegedly been stealing money directly from bank accounts in Russia and other countries of the Commonwealth of Independent States ( CIS ) by using a Trojan called Lurk . The Base64 blob is of particular interest . The HyperText Transfer Protocol ( HTTP ) redirect status response code indicates that the resource requested has been temporarily moved to the URL given by the header .


We can not say for sure if Wolf Research and Coralco Tech are linked , but this panel name , their offerings and the panel layout would suggest it should be considered suspiciously linked . which they launched targeted attacks against Russian banks , businesses and media companies . It makes use of a custom Base64 alphabet . A browser redirects to this page but search engines do n't update their links to the resource ( in ' SEO - speak ' , it is said that the ' link - juice ' is not sent to the new URL ) .


Coralco Tech 's services description . Lurk uses a form of steganography : that's where one file is hidden away inside another file of a completely different sort , such as an image , audio , or video file . Once decoded , this blob reveals a standardized structure of the information sent to the registered C&C server , which includes the following details : Computer name , Local IP address , Proxy server IP and port , Malware ID . It is therefore recommended to set the code only as a response for or methods and to use instead , as the method change is explicitly prohibited in that case .


VICTIMOLOGY ON THE IDENTIFIED CAMPAIGNS The campaigns we analyzed targeted Android devices in Thailand . The latest version of Madi also has the ability to monitor the Russian social network Vkontakte ( VK ) along with the Jabber messaging platform to look for users who visit websites that contain words like " USA " , " Skype " , and " gov " . To date , we have seen several custom Base64 alphabets , including : +NO5RZaGHviIjhYq8b4ndQ=p012ySTcCDrs/xPgUz67FM3wemKfkJLBo9VtWXlEuA , HZa4vjIiGndQ=p012y+NO5RST/xPgUz67FMhYq8b3wemKfkJLBocCDrs9VtWXlEu , j4vpGZaHnIdQ=i012y+N/zPgUO5RSTx67FMhYb8q3we mKckJLBofCDrs9VtWXlEu , p12kJLBofCDrs9VtWXlEuainyj4vd+=H0GZIQNO5RST/ zPgUx67FMhYb8q3wemKc , aZHGviIj4ndQ=p012y+NO5RST/xPgUz67FMhYq8b3wemKfkJLBocCDrs9VtWXlEu , ZvQIajHi4ndG=p012y+NO5RST/xPgUz67FMhYq8b3wemKfkJLBocCDrs9VtWXlEu . CSP can define a list of domains that the browser should be allowed to interact with for the visited URL .


The C2 server domain is linked to Thai food : Nampriknum [ . Madi was found capturing computer screens , recording audio and stealing screenshots , keystrokes , documents and e-mail correspondence from " Middle Eastern critical infrastructure engineering firms , government agencies , financial houses and academia . Some similarities exist across different versions of the Base64 alphabet , which indicates that these are most likely not completely randomly generated . Designed to guard against XSS attacks , CSP helps control which domains can be accessed as part of a page and therefore restricts which domains to share data with .


] net : Nam Phrik Num Somtum [ . A timeline of new activity can be scoped out for the group , with the greatest number of related downloaders created by the developers in December 2011 , Feb and March of 2012 , followed by June of 2012 . Instead , the attackers manually cut and pasted older versions after altering some parts . These restrictions are specified by a list of allowed URIs .


] today : Som Tum We also identified comments in Thai on the C2 infrastructure mentioned in the previous chapter : MALWARE DenDroid The Android malware is based on the DenDroid Android malware . it reports to was created on August 10 , 2011 . The malware ID seems to be a campaign code with a different IP address for each attack . By analyzing field data we see a gap in the implementation of CSP , and even for sites that do use it correctly , this creates an open window to exfiltrate data .


Several analysis reports were published on this malware in 2014 and , finally , the source code was leaked in 2015 . Since at least 2008 , The Lamberts have used multiple sophisticated attack tools against high-profile victims . Some of the campaign codes we have seen include : CRML_0505 , CRML_MIL , Firebox4 , JUST_0525 , ML0628 , MW0629 , OM222 . Our demonstration shows how using the Google Analytics API , a web skimmer can send data to be collected in his own account instance .


The original leak is no longer available on github.com , but a copy can be found here . Longhorn , which we internally refer to as " The Lamberts " , first came to the attention of the ITSec community in 2014 , when our colleagues from FireEye discovered an attack using a zero day vulnerability ( CVE-2014-4148 ) . The IXESHE campaign has been successfully executing targeted attacks since 2009 . As Google Analytics is allowed in the CSP configuration of many major sites , this demo shows how an attacker can bypass this security protection and steal data .


The table below shows the commands available to the operator for tasking on infected devices . The attack leveraged malware we called ' BlackLambert ' , which was used to target a high profile organization in Europe . The attackers primarily use malicious .PDF files that exploit vulnerabilities in Adobe Reader , Acrobat , and Flash Player , including the use of two zero-day exploits—one in 2009 and another in 2011 . Our gathered field data shows the following statistics on CSP usage across the Internet ( based on HTTPArchive March 2020 scan ):


This malware is simplistic in comparison to some modern-day Android malware . Their arsenal includes network-driven backdoors , several generations of modular backdoors , harvesting tools , and wipers . While the attackers primarily targeted East Asian governments in the past , they have also started targeting a telecommunications company and electronics manufacturers . We took google - analytics as an example , but other services can also be used .


The best example of that is that it does n't take advantage of the accessibility framework , collecting information on non-rooted devices . The first time the Lambert family malware was uncovered publicly was in October 2014 , when FireEye posted a blog about a zero day exploit ( CVE-2014-4148 ) used in the wild . They kept track of their targeted attacks by embedding a “ campaign tag ” in the malware that appears to describe when each attack was launched and , in some cases , the nature of its target . As an example , we took the twitter login page , which implemented the following CSP rule ( which contains ): The following short JS code inserted into the site will send the credentials to google - analytics console controlled by us : The UA-#######- # parameter is the tag ID owner that Google Analytics uses to connect the data to a specific account .


The commands are self-explanatory and show the features included in the malware . Interestingly , while most Blue Lambert variants have version numbers in the range of 2.x , Green Lambert is mostly in 3.x versions . We found more than 40 of these campaign tags . Though Google meant to have this parameter be used to mention the page the user visited , we used it to exfiltrate the user name and password data encoded in base64 .


Some of them like takephoto , takevideo , recordaudio , getsentsms and uploadpictures are focused on espionage activities . While investigating one of these infections involving White Lambert ( network-driven implant ) and Blue Lambert ( active implant ) , we found yet another family of tools that appear to be related . The IXESHE attackers are notable for their use of compromised machines within a target ’s internal network as C&C servers . In our Google Analytics platform , we will see the data as : In our demo the DP will result in page view of Which will be decoded from base64 as : The source of the problem is that the CSP rule system is n’t granular enough .


Others like transferbot , promptupdate and promptuninstall are meant to help the operator manage the malware . Versions of this particular orchestrator were found on other victims , together with White Lambert samples , indicating a close relationship between the White and Pink Lambert malware families . This helped disguise their activities . Recognizing and stopping the above malicious JavaScript request requires advanced visibility solutions that can detect the access and exfiltration of sensitive user data ( in this case the user ’s email address and password ) .


Version # 1 : June 2019 — Domain : databit [ . While in most cases the infection vector remains unknown , the high profile attack from 2014 used a very complex Windows TTF zero-day exploit ( CVE-2014-4148 ) . In addition , the attackers ’ use of the proxy tool , HTran , also helped mask their true location . The problem is that CSP does n't support query strings ( See Spec ):


] today During our investigation , we identified at least four major releases of the RAT . This migration activity was last observed in October 2016 . While their identities remain unknown , the attackers behind the IXESHE campaign demonstrated that they were both determined and capable . Having such a gap with the most commonly used domain allowed with CSP is a major risk indicator of the threats that can come from other domains that are used to serve multiple accounts .


The permissions on the first version of the malware lay out the foundations of a spying trojan . Most of the Blue and Green Lambert samples have two C&C servers hardcoded in their configuration block : a hostname and an IP address . While the malware used in the attacks were not very complicated by nature , these proved very effective . A possible solution would come from adaptive URLs , adding the ID as part of the URL or subdomain to allow admins to set CSP rules that restrict data exfiltration to other accounts .


Permissions The package name follows the original style name used on DenDroid . Some of the known filenames for Gray Lambert are mwapi32.dll and poolstr.dll – it should be pointed though that the filenames used by the Lamberts are generally unique and have never been used twice . APT12 . In addition to the complexity of managing CSP rules , this vulnerability shows how widely used services such as Google Analytics can be subverted to bypass this protection .


The code is obfuscated but not packed . Black Lambert was seen only briefly and we assume it was " retired " from the arsenal after being discovered by FireEye in 2014 . The attackers referred to as APT12 ( also known as IXESHE , DynCalc , and DNSCALC ) recently started a new campaign targeting organizations in Japan and Taiwan . Adversaries may communicate using a protocol and port pairing that are typically not associated .


This malware also contains a screen recorder . The Lamberts toolkit spans across several years , with most activity occurring in 2013 and 2014 . APT12 is believed to be a cyber espionage group thought to have links to the Chinese People's Liberation Army . For example , HTTPS over port 8088[1 ] or port 587[2 ] as opposed to the traditional port 443 .


This feature is implemented using another open-source software package that can be found here . To further exemplify the proficiency of the attackers leveraging the Lamberts toolkit , deployment of Black Lambert included a rather sophisticated TTF zero day exploit , CVE-2014-4148 . APT12 's targets are consistent with larger People's Republic of China ( PRC ) goals . Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis / parsing of network data .


The service is implemented in the class com.serenegiant.service.ScreenRecorderService which is declared in the package manifest . Taking that into account , we classify the Lamberts as the same level of complexity as Regin , ProjectSauron , Equation and Duqu2 , which makes them one of the most sophisticated cyber espionage toolkits we have ever analysed . Intrusions and campaigns conducted by this group are in-line with PRC goals and self-interest in Taiwan . Adversaries may also make changes to victim systems to abuse non - standard ports .


During our analysis of this sample , we did notice that the class itself is never called or used by the malware . Taking that into account , we classify the Lamberts as the same level of complexity as Regin , ProjectSauron , Equation and Duqu2 , which makes them one of the most sophisticated cyber espionage toolkits we have ever analysed . Additionally , the new campaigns we uncovered further highlight the correlation between APT groups ceasing and retooling operations after media exposure , as APT12 used the same strategy after compromising the New York Times in Oct 2012 . For example , Registry keys and other configuration settings can be used to modify protocol and port pairings.[3 ] APT - C-36 has used port 4050 for C2 communications.[4 ]


It remains available within the source code but no method of use takes place . On January 15 , Confiant exposed the activity of the Zirconium group , spreading malicious ads via a network of fake ad agencies through 2017 , in what amounted to the largest malvertising campaign of recent times . Much like Darwin ’s theory of biological evolution , APT12 been forced to evolve and adapt in order to maintain its mission . An APT32 backdoor can use HTTP over a non - standard TCP port ( e.g 14146 ) which is specified in the backdoor configuration.[5 ]


Version # 2 : June - Aug. 2019 — Domain : somtum [ . Cadelle , uses Backdoor.Cadelspy . FireEye researchers discovered two possibly related campaigns utilizing two other backdoors known as THREEBYTE and WATERSPOUT . APT33 has used HTTP over TCP ports 808 and 880 for command and control.[1 ]


] today This is the first version that shows the code organization evolution that will continue to be used on all other functions throughout this malware . Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014 , however , it's likely that activity began well before this date . Both backdoors were dropped from malicious documents built utilizing the “ Tran Duy Linh ” exploit kit , which exploited CVE-2012-0158 . BADCALL communicates on ports 443 and 8000 with a FakeTLS method.[6 ] Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.[7 ] BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.[8 ]


Code structure Obviously , this code is not obfuscated when compared with the previous version it becomes clear that this is the same code base . Chafer , uses Backdoor.Remexi . These documents were also emailed to organizations in Japan and Taiwan . During C0018 , the threat actors opened a variety of ports , including ports 28035 , 32467 , 41578 , and 46892 , to establish RDP connections.[9 ]


One of the first changes that stands out is that the screen recording feature mentioned in the previous sample has been removed . Cadelle 's threats are capable of opening a back door and stealing information from victims' computers . While APT12 has previously used THREEBYTE , it is unclear if APT12 was responsible for the recently discovered campaign utilizing THREEBYTE . Cyclops Blink can use non - standard ports for C2 not typically associated with HTTP or HTTPS traffic.[10 ] DarkVishnya used ports 5190 and 7900 for shellcode listeners , and 4444 , 4445 , 31337 for shellcode C2.[11 ]


A new class was added called com.utils.RestClient . Chafer , uses Backdoor.Remexi.B . Similarly , WATERSPOUT is a newly discovered backdoor and the threat actors behind the campaign have not been positively identified . Derusbi has used unencrypted HTTP on port 443 for C2.[12 ]


This class is based on public code belonging to the package praeda.muzikmekan , which can be found here among other places . registrant information points to activity possibly as early as 2011 . However , the WATERSPOUT campaign shared several traits with the RIPTIDE and HIGHTIDE campaign that we have attributed to APT12 . Emotet has used HTTP over ports such as 20 , 22 , 7080 , and 50000 , in addition to using ports commonly associated with HTTP / S.[13 ] FIN7 has used port - protocol mismatches on ports such as 53 , 80 , 443 , and 8080 during C2.[14 ]


Just like in previous examples , the malware author does not use this package . These threats are capable of opening a back door and stealing information from victims' computers . From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE , a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control ( C2 ) server . GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic , 9002 for C2 requests , 33666 as a WebSocket , and 8090 to download files.[15 ] GravityRAT has used HTTP over a non - standard port , such as TCP port 46769.[16 ] HARDRAIN binds and listens on port 443 with a FakeTLS method.[17 ] HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.[18 ] Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic , creating port - protocol mismatches.[19][20 ] MacMa has used TCP port 5633 for C2 Communication.[21 ]


Missing permissions The lack of the READ_FRAME_BUFFER permission can be justified by the removal of the screen record feature . executable compilation times suggest early 2012 . RIPTIDE ’s first communication with its C2 server fetches an encryption key , and the RC4 encryption key is used to encrypt all further communication . Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.[22][23 ]


The ACCESS_SUPERUSER may have been removed because it was deprecated upon the release of Android 5.0 Lollipop which happened in 2014 . It's unclear how Cadelle infects its targets with Backdoor.Cadelspy . In June 2014, Arbor Networks published an article describing the RIPTIDE backdoor and its C2 infrastructure in great depth . Metamorfo has communicated with hosts over raw TCP on port 9999.[24 ]


The reality is that the RAT permissions can be implemented just with the permissions declared on the manifest , thus there is no need for higher permissions . The affected organizations we were able to identify are mostly based in the Middle East . The blog highlighted that the backdoor was utilized in campaigns from March 2011 till May 2014 . MoonWind communicates over ports 80 , 443 , 53 , and 8080 via raw sockets instead of the protocols usually associated with the ports.[25 ] njRAT has used port 1177 for HTTP C2 communications.[26 ] During Operation Wocao , the threat actors used uncommon high ports for its backdoor C2 , including ports 25667 and 47000.[27 ]


Version # 3 : Sept. - Dec. 2019 — Domain : ponethus [ . one organization is located in the US . Following the release of the article , FireEye observed a distinct change in RIPTIDE ’s protocols and strings . PingPull can use HTTPS over port 8080 for C2.[28 ]


] com Given that there is some overlap in the previous two versions , it came as no surprise to us that we finally identified a sample which is an evolution based on both previous versions . There are a number of factors in these groups' campaigns that suggests that the attackers may be based in Iran . We suspect this change was a direct result of the Arbor blog post in order to decrease detection of RIPTIDE by security vendors . PoetRAT used TLS to encrypt communications over port 143 QuasarRAT can use port 4782 on the compromised host for TCP callbacks .


This sample is clearly a mix between the two . Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands . The changes to RIPTIDE were significant enough to circumvent existing RIPTIDE detection rules . RedLeaves can use HTTP over non - standard ports , such as 995 , for C2.Rocke 's miner connects to a C2 server using port 51640.[32 ]


This is also the first version where the package name changes into something that a less aware user may be tricked by , com.android.playup . Their primary interest appears to be gathering intelligence . FireEye dubbed this new malware family HIGHTIDE . RTM used Port 44443 for its VNC module .


This version brings back the ACCESS_SUPERUSER and READ_FRAME_BUFFER permissions . This stands in opposition to the data gathered from export timestamps and C&C domain activity that points to Green Lambert being considerably older than the Blue variant . On Sunday August 24, 2014 we observed a spear phish email sent to a Taiwanese government ministry . Sandworm Team has used port 6789 to accept connections on the group 's SSH server.[34 ] Silence has used port 444 when sending data about the system from the client to the server.[35 ] StrongPity has used HTTPS over port 1402 in C2 communication.[36 ] SUGARUSH has used port 4585 for a TCP connection to its C2 .


However , this time , the permission is actually used . security policy in the Eastern Europe and South Caucasus regions . Attached to this email was a malicious Microsoft Word document ( MD5: f6fafb7c30b1114befc93f39d0698560 ) that exploited CVE-2012-0158 . TEMP.Veles has used port - protocol mismatches on ports such as 443 , 4444 , 8531 , and 50501 during C2 .


WhatsApp message capture The service com.serenegiant.service.ScreenRecorderService , is invoked by the ScreenRecorderActivity . Callisto Group via credential phishingThese spear phishing emails were crafted to appear highly convincing , including being sent from legitimate email accounts suspected to have been previously compromised by the Callisto Group via credential phishing . It is worth noting that this email appeared to have been sent from another Taiwanese Government employee , implying that the email was sent from a valid but compromised account . Some TrickBot samples have used HTTP over ports 447 and 8082 for C2 .


Upon creation , this activity launches a thread that will loop on a 50-second interval . In early 2016 the Callisto Group began sending highly targeted spear phishing emails with malicious attachments that contained , as their final payload , the " Scout " malware tool from the HackingTeam RCS Galileo platform . HIGHTIDE : 6e59861931fa2796ee107dc27bfdd480 . Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443 .


In the first iteration , the screen recording is started and will only stop when the RAT determines that WhatsApp is not running . These spear phishing emails were crafted to appear highly convincing , including being sent from legitimate email accounts suspected to have been previously compromised by the Callisto Group via credential phishing . The HIGHTIDE backdoor connected directly to 141.108.2.157 . [ 42 ] TYPEFRAME has used ports 443 , 8080 , and 8443 with a FakeTLS method .


It 's restarted in the next cycle independently based on if WhatsApp is running . Callisto Group appears to be intelligence gathering related to European foreign and security policy . If you compare the HTTP GET request from the RIPTIDE samples to the HTTP GET request from the HIGHTIDE samples you can see the malware author changed the following items : User Agent , Format and structure of the HTTP Uniform Resource Identifier ( URI ) . WellMail has been observed using TCP port 25 , without using SMTP , to leverage an open port for secure command and control communications .


In this version , the developer added more classes from the same package . some indications of loosely linked activity dating back to at least 2013 . Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 . WIRTE has used HTTPS over ports 2083 and 2087 for C2.ZxShell can use ports 1985 and 1986 in HTTP / S communication.[47 ] Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level .


Even though we could not find indications of being in use , two stand out . In October 2015 , the Callisto Group was observed sending targeted credential phishing emails . FireEye observed APT12 deliver these exploit documents via phishing emails in multiple cases . Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment .


Bluetooth — which allows the interaction with the Bluetooth interface , and net/deacon — which implements a beaconing system based on UDP . In early 2016 , the Callisto Group was observed sending targeted spear phishing emails . Based on past APT12 activity , we expect the threat group to continue to utilize phishing as a malware delivery method . 0824.1.doc : f6fafb7c30b1114befc93f39d0698560 , CVE-2012-0158 . Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used .


Android shell A new package was added that allows the execution of commands in the Android shell . The malicious attachments purported to be invitations or drafts of the agenda for the conference . Jason_invitation.doc : 00a95fb30be2d6271c491545f6c6a707 , CVE-2012-0158 . Monitor network data flows for unexpected patterns and metadata that may be indicative of a mismatch between protocol and utilized port .


Again , this package source code is publicly available and can be found here . Based on our analysis of Callisto Group 's usage of RCS Galileo , we believe the Callisto Group did not utilize the leaked RCS Galileo source code , but rather used the leaked readymade installers to set up their own installation of the RCS Galileo platform . When the file is opened , it drops HIGHTIDE in the form of an executable file onto the infected system . Additional Email Delegate Permissions APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with ApplicationImpersonation rights to start collecting emails from targeted mailboxe .


One of the uses the malware gives to this package is the execution of the command " dumpsys '' to determine if certain activities are running . In the known spear phishing attacks by the Callisto Group , they employed the " Scout " malware tool from the RCS Galileo platform . RIPTIDE and HIGHTIDE differ on several points : executable file location , image base address , the User-Agent within the GET requests , and the format of the URI . During the SolarWinds Compromise , APT29 added their own devices as allowed IDs for active sync using Set - CASMailbox , allowing it to obtain copies of victim mailboxes .


Check if chat apps are running In the above example , the malware is searching for Line , Facebook Messenger and WhatsApp activities . We are confident the Callisto Group used this type of access to a target 's email account for the purposes of sending spear phishing to other targets . The RIPTIDE exploit document drops its executable file into the C:\Documents and Settings\{user}\Application Data\Location folder while the HIGHTIDE exploit document drops its executable file into the C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\ folder . Device Registration APT29 has enrolled a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account .


This is part of a class called CaptureService , which already existed in the previous version but it was not duly implemented . If a target of the spear phishing described in " Phase 2 : malware deployment " opened the email attachment and , crucially , clicked on the icon in the attachment , this would lead to the target 's computer becoming infected with the " Scout " malware tool from the RCS Galileo platform . All but one sample that we identified were written to this folder as word.exe . During the SolarWinds Compromise , APT29 registered devices in order to enable mailbox syncing via the Set - CASMailbox command . .006


Previous version The capture service class implements the chat applications interception . Callisto Group and related infrastructure contain links to at least Russia , Ukraine , and China . The one outlier was written as winword.exe . Acquire Infrastructure : Web Services APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware , such as HAMMERTOSS .


Upon creation the class will start to take screenshots that will be stopped and uploaded to the C2 once the service ca n't find the targeted applications running . they have been last known to employ malware in February 2016 . Research into this HIGHTIDE campaign revealed APT12 targeted multiple Taiwanese Government organizations between August 22 and 28 . APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations .


The core of this functionality is also based on an open-source project that can be found here . RCS Galileo platform . On Monday August 25, 2014 we observed a different spear phish email sent from lilywang823@gmail.com to a technology company located in Taiwan . Cloud Administration Command APT29 has used Azure Run Command and Azure Admin - on - Behalf - of ( AOBO ) to execute code on virtual machines .


Another novelty is a VPN-related package , which is based on OrbotVPN . The spear phishing emails used in the known attacks by the Callisto Group were so convincing that even skilled and alert users would likely have attempted to open the malicious attachment . This spear phish contained a malicious Word document that exploited CVE-2012-0158 . Cloud API APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments .


Once again , it does n't seem to actually be in use . In October 2015 the Callisto Group targeted a handful of individuals with phishing emails that attempted to obtain the target 's webmail credentials . The MD5 of the exploit document was e009b95ff7b69cbbebc538b2c5728b11 . They have also utilized AADInternals PowerShell Modules to access the API .003 Compromise Accounts : Cloud Accounts APT29 has used residential proxies , including Azure Virtual Machines , to obfuscate their access to victim environments .


The same happens with the package squareup.otto , which is an open-source bus implementation focused on Android implementation . The Callisto Group has been active at least since late 2015 and continues to be so , including continuing to set up new phishing infrastructure every week . Similar to the newly discovered HIGHTIDE samples documented above , this malicious document dropped a backdoor to C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe . Enterprise T1482 Domain Trust Discovery During the SolarWinds Compromise , APT29 used the Get - AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell .


Both sources can be found here and here . Called Greenbug , this group is believed to be instrumental in helping Shamoon steal user credentials of targets ahead of Shamoon 's destructive attacks . THREEBYTE : 16e627dbe730488b1c3d448bfc9096e2 . They also used AdFind to enumerate domains and to discover trust between federated domains .


Version # 4 : April 2020 — Domain : nampriknum.net Following the same pattern , this version has some added features and others , which were not in use , removed . On Tuesday , Arbor Networks said that it has new leads on a credential stealing remote access Trojan ( RAT ) called Ismdoor , possibly used by Greenbug to steal credentials on Shamoon 's behalf . This backdoor sent the following callback traffic to video.csmcpr.com . Dynamic Resolution During the SolarWinds Compromise , APT29 used dynamic DNS resolution to construct and resolve to randomly - generated subdomains for C2.[12 ]


First of all the new package name is com.google.services , which can easily be confused with a legitimate Google service . " With our latest research we now see how Greenbug has shifted away from HTTP-based C2 communication with Ismdoor . The THREEBYTE spear phishing incident ( while not yet attributed ) shared the following characteristics with the above HIGHTIDE campaign attributed to APT12 : The THREEBYTE backdoor was compiled two days after the HIGHTIDE backdoors ; Encrypted Channel APT29 has used multiple layers of encryption within malware to protect C2 communication .


The VPN package is no longer present , further reinforcing our conclusion that it was not in use . It's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost . Both the THREEBYTE and HIGHTIDE backdoors were used in attacks targeting organizations in Taiwan ; Hybrid Identity APT29 has edited the Microsoft.IdentityServer.Servicehost.exe.config file to load a malicious DLL into the AD FS process , thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name .


WolfRAT application screen The Google GMS and Firebase service has been added , however , no configuration has been found , even though services seem to be referenced in the of a new class . t's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost . Both the THREEBYTE and HIGHTIDE backdoors were written to the same filepath of C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe ; Spearphishing Attachment APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.002 Phishing : Spearphishing Link APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.003 Phishing : Spearphishing via Service APT29 has used the legitimate mailing service Constant Contact to send phishing e - mails .003


The new class is called NotificationListener and extends the NotificationListenerService class . By relying on a native PDF command to navigate to a new URL , Zirconium successfully circumvented Chrome 's anti-redirect protection . APT12 has previously used the THREEBYTE backdoor . Proxy : Multi - hop Proxy A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 ( RDP ) , 139 ( Netbios ) , and 445 ( SMB ) enabling full remote access from outside the network and has also used TOR .004


This would allow the RAT to receive system notifications . In the context of the Ismdoor RAT , the DNS attack technique is used primarily by Greenbug for stealing credentials . On August 25, 2014, we observed another round of spear phishing emails targeting a high-technology company in Japan . Proxy : Domain Fronting APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.007 Remote Services : Cloud Services APT29 has leveraged compromised high - privileged on - premises accounts synced to Office 365 to move laterally into a cloud environment , including through the use of Azure AD PowerShell .


Notification handling method The class is only implemented in debug mode , pushing all captured information into the log . To do this , it employs a number of specific commands via DNSMessenger . Attached to this email was another malicious document that was designed to exploit CVE-2012-0158 . Scheduled Task / Job : Scheduled Task APT29 has used named and hijacked scheduled tasks to establish persistence .


The usage of the PlusShare API in 2020 denotes some unprofessional development , since this is the API to access Google+ . Iranian Threat Agent Greenbug has been registering domains similar to those of Israeli High-Tech and Cyber Security Companies . This malicious Word document had an MD5 of 499bec15ac83f2c8998f03917b63652e and dropped a backdoor to C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe . During the SolarWinds Compromise , APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement .


This service , along with the API , was fully decommissioned in March 2019 . By pivoting off the registration details and servers data of the two domains we discovered others registered by the threat agent . The backdoor had the following properties : They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration .


This version adds one significant class — it requests DEVICE_ADMIN privileges . Named Trochilus , this new RAT was part of Group 27 's malware portfolio that included six other malware strains , all served together or in different combinations , based on the data that needed to be stolen from each victim . WATERSPOUT : APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted .


Device admin policies Looking at the policy 's definition , we can see that it lists all the available policies even if most of them are deprecated on Android 10.0 and their usage results in a security exception . According to the security experts , this collection of malware was discovered after their first initial report was published , meaning that Group 27 ignored the fact they were unmasked and continued to infect their targets regardless , through the same entry point , the Myanmar Union Election Commission ( UEC ) website . f9cfda6062a8ac9e332186a7ec0e706a . Enterprise T1649 Steal or Forge Authentication Certificates APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates .


The code implementation again seems that it has been added for testing purposes only . Trochilus RAT activity was discovered during both months of October and November 2015 . The backdoor connects to a command and control server at icc.ignorelist.com . Enterprise T1082 System Information Discovery During the SolarWinds Compromise , APT29 used fsutil to check available free space before executing actions that might create large files on disk .


Versions overview The DenDroid code base was kept to such an extent that even the original base64-encoded password was kept . From September 2016 through late November 2016 , a threat actor group used both the Trochilus RAT and a newly idenfied RAT we've named MoonWind to target organizations in Thailand , including a utility organization . Similar to RIPTIDE and HIGHTIDE , the WATERSPOUT backdoor is an HTTP based backdoor that communicates with its C2 server . Enterprise T1199 Trusted Relationship APT29 has compromised IT , cloud services , and managed services providers to gain broad access to multiple customers for subsequent operations .


Original password The main service follows the same structure as the first version , the anti-analysis features are primitive , only checking the emulator environment without any kind of packing or obfuscation . We chose the name ' MoonWind ' based on debugging strings we saw within the samples , as well as the compiler used to generate the samples . Although there are no current infrastructure ties to link this backdoor to APT12 , there are several data points that show a possible tie to the same actors : During the SolarWinds Compromise , APT29 gained access through compromised accounts at cloud solution partners , and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems .


The malware will start the main service if all the requested permissions and the device admin privileges are granted . The attackers compromised two legitimate Thai websites to host the malware , which is a tactic this group has used in the past . Same initial delivery method ( spear phishing email ) with a Microsoft Word Document exploiting CVE-2012-0158 . User Execution : Malicious Link APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link .002 User Execution : Malicious File APT29 has used various forms of spearphishing attempting to get a user to open attachments , including , but not limited to , malicious Microsoft Word documents , .pdf , and .lnk files .


Otherwise , it will launch an ACTION_APPLICATION_SETTINGS intent trying to trick the user to grant the permissions . Both the Trochilus and MoonWind RATs were hosted on the same compromised sites and used to target the same organization at the same time . The same “ Tran Duy Linh ” Microsoft Word Exploit Kit was used in delivery of this backdoor . Enterprise T1078 Valid Accounts APT29 has used a compromised account to access an organization 's VPN infrastructure .


Each sample contains a userId hardcoded , meaning that each sample can only be used in a victim . The attackers used different command and control servers ( C2s ) for each malware family , a tactic we believe was meant to thwart attempts to tie the attacks together using infrastructure alone . Similar Targets were observed where the threat actors utilized this backdoor : Japanese Tech Company , Taiwanese Government Organizations , Organizations in the Asia-Pacific Region that are of Interest to China . During the SolarWinds Compromise , APT29 used different compromised credentials for remote access and to move laterally .


It seems , however , if the same victim has more than one device the malware can be reused since the IMEI is sent along with each data exfiltration . Further research led us to additional MoonWind samples using the same C2 ( dns.webswindows.com ) but hosted on a different compromised but legitimate website . The WATERSPOUT backdoor was written to the same file path as the HIGHTIDE backdoors : C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe , C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\winword.exe . Over 5 years ago , we began tracking a new campaign that we called FakeUpdates ( also known as SocGholish ) that used compromised websites to trick users into running a fake browser update .


It is clear that this RAT is under intense development , however , the addition and removal of packages , along with the huge quantity of unused code and usage of deprecated and old techniques denotes an amateur development methodology . The attacks in that case took place in late September to early October 2016 and the attackers stored the MoonWind samples as RAR files , while in the November attacks the RATs were stored as executables . WATERSPOUT was compiled within two days of the last HIGHTIDE backdoor and on the same day as the THREEBYTE backdoor . Instead , victims would end up infecting their computers with the NetSupport RAT , allowing threat actors to gain remote access and deliver additional payloads .


CONCLUSION We witness actors continually using open-source platforms , code and packages to create their own software . We were not able to find additional tools , but the attackers again compromised a legitimate Thai website to host their malware , in this case the student portal for a Thai University . APT12 closely monitors online media related to its tools and operations and reacts when its tools are publicly disclosed . As we have seen over the years , SocGholish is an established player that has managed to compromise countless victims and deliver ransomware after facilitating the installation of tools like Cobalt Strike or Mimikatz .


Some are carried out well , others , like WolfRAT , are designed with an overload of functionality in mind as opposed to factoring any sensible approach to the development aspect . Trochilus was first reported by Arbor Networks in their Seven Pointed Dagger report tying its use to other targeted Southeast Asia activity . APT12 has the ability to adapt quickly to public exposures with new tools , tactics , and procedures ( TTPs ) . Now , there is a potential new competitor in the " fake updates " landscape that looks strangely familiar .


After all , a working product is often more important than a stable product . The activity dates to at least 2013 and has ties to multiple reports by other researchers . Public disclosures may result in an immediate change in APT12 ’s tools . The new campaign , which we call FakeSG , also relies on hacked WordPress websites to display a custom landing page mimicking the victim 's browser .


We watched WolfRAT evolve through various iterations which shows that the actor wanted to ensure functional improvements — perhaps they had deadlines to meet for their customers , but with no thought given to removing old code blocks , classes , etc . It is highly likely MoonWind is yet another new tool being used by the group or groups responsible for that activity , indicating they are not only still active but continuing to evolve their playbook . These changes may be temporary and FireEye believes they are aimed at decreasing detection of their tools until a more permanent and effective TTP change can be implemented ( e.g. , WATERSPOUT ) . The threat actors are distributing NetSupport RAT either as a zipped download or via an Internet shortcut .


throughout the Android package . The samples provided were alleged to be targeting Tibetan and Chinese Pro-Democracy Activists . Although these points do not definitively tie WATERSPOUT to APT12 , they do indicate a possible connection between the WATERSPOUT campaign , the THREEBYTE campaign , and the HIGHTIDE campaign attributed to APT12 . While FakeSG appears to be a newcomer , it uses different layers of obfuscation and delivery techniques that make it a threat to take seriously and which could potentially rival with SocGholish .


WolfRAT is a specifically targeted RAT which we assess to be aimed at Thai individuals and , based on previous work from Wolf Research , most likely used as an intelligence-gathering tool or interception tool . On June 7 , 2013 , Rapid7 released an analysis of malware dubbed ' KeyBoy ' , also exploiting unknown vulnerabilities in Microsoft Office , similarly patched by MS12-060 , but allegedly targeting interests in Vietnam and India . FireEye believes the change from RIPTIDE to HIGHTIDE represents a temporary tool shift to decrease malware detection while APT12 developed a completely new malware toolset . We first heard of this new campaign thanks to a Mastodon post by Randy McEoin .


This can be packaged and " sold '' in many different ways to customers . As we have seen in some previous targeted malware attacks , the attackers in this incident are taking advantage of services like changeip.com to establish free subdomains in their infrastructure . These development efforts may have resulted in the emergence of the WATERSPOUT backdoor . The tactics , techniques and procedures ( TTPs ) are very similar to those of SocGholish and it would be easy to think the two are related .


A " Tracking tool '' or an " Admin tool '' are often cited for these kinds of tools for " commercial '' or " enterprise '' usage . Blending in with legitimate traffic is a common tactic used by attackers to help fly under the radar . Though public disclosures resulted in APT12 adaptations , FireEye observed only a brief pause in APT12 activity before the threat actors returned to normal activity levels . In fact , this chain also leads to NetSupport RAT .


Wolf Research claimed to shut down their operations but we clearly see that their previous work continues under another guise . Subdomains at phmail.us have been linked to malicious activity dating back as far as December 2011 . Similarly , the public disclosure of APT12 ’s intrusion at the New York Times also led to only a brief pause in the threat group ’s activity and immediate changes in TTPs . However , the template source code is quite different and the payload delivery uses different infrastructure .


The ability to carry out these types of intelligence-gathering activities on phones represents a huge score for the operator . Based on the patterns of subdomain registration over time in DNS , TRAC believes this is an example where the attackers registered their own second-level domain . The pause and retooling by APT12 was covered in the Mandiant 2014 M-Trends report . As a result , we decided to call this variant FakeSG .


The chat details , WhatsApp records , messengers and SMSs of the world carry some sensitive information which people often forget when communicating with their devices . In this blog post we'll analyze two specific incidents apparently targeting victims in Vietnam and in India and we'll describe the capabilities of the custom backdoor being used that for convenience ( and to our knowledge , for a lack of an existing name ) we call KeyBoy , due to a string present in one of the samples . Currently , APT12 continues to target organizations and conduct cyber operations using its new tools . 2023 - 07 - 19 Update : On June 5 , @SecurityAura described an unknown campaign using .hta payloads disguised as driver updates .


We see WolfRAT specifically targeting a highly popular encrypted chat app in Asia , Line , which suggests that even a careful user with some awareness around end-to-end encryption chats would still be at the mercy of WolfRAT and it 's prying eyes . We encountered the first document exploit called " THAM luan - GD - NCKH2.doc " a few days ago , which appears to be leveraging some vulnerabilities patched with MS12-060 . Most recently , FireEye observed HIGHTIDE at multiple Taiwan-based organizations and the suspected APT12 WATERSPOUT backdoor at a Japan-based electronics company . On June 22 , @AnFam17 spotted the same fake browser update leveraging URL shortcuts .


IOCS Hashes 139edb1bc033725539b117f50786f3d3362ed45845c57fe1f82e7ed72b044367 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e5f346d8f312cc1f93c2c6af611e2f50805c528934786ea173cabc6a39b14cda This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics . APT12 . Both of these campaigns use a similar structure with compromised WordPress sites hosting the lure shortcuts and a WebDav server that loads NetSupport RAT .


1849a50a6ac9b3eec51492745eeb14765fe2e78488d476b0336d8e41c2c581d4 d328fca14c4340fcd4a15e47562a436085e6b1bb5376b5ebd83d3e7218db64e7 59b9809dba857c5969f23f460a2bf0a337a71622a79671066675ec0acf89c810 120474682ea439eb0b28274c495d9610a73d892a4b8feeff268c670570db97e2 For the sake of this analysis we'll take the Vietnamese backdoor as an example ; the one found in the Indian attack operates in the exact same way . The attackers behind the breach of the New York Times ’ computer network late last year appear to be mounting fresh assaults that leverage new and improved versions of malware . RussianPanda ( @AnFam17 ) named the URL shortcut campaign RogueRaticate .


ed234e61849dcb95223676abe2312e1378d6130c0b00851d82cda545b946ec83 27410d4019251a70d38f0635277f931fb73f67ac9f2e1f3b475ce680ebfde12a 6e6c210535b414c5aa2dd9e67f5153feeb43a8ac8126d8e249e768f501323a3e 4a32ced20df7001da7d29edc31ca76e13eef0c9b355f62c44888853435e9794f In the second set they are making use of a dynamic DNS service by ChangeIP.com . The new campaigns mark the first significant stirrings from the group since it went silent in January in the wake of a detailed expose of the group and its exploits — and a retooling of what security researchers believe is a massive spying operation based in China . FakeSG has different browser templates depending on which browser the victim is running .


ac5abaebd9f516b8b389450f7d27649801d746fb14963b848f9d6dad0a505e66 3a45d7a16937d4108b5b48f44d72bb319be645cbe15f003dc9e77fd52f45c065 Domains cvcws [ . The Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information . The newest campaign uses updated versions of Aumlib and Ixeshe . The themed " updates " look very professional and are more up to date than its SocGholish counterpart .


] ponethus [ . he Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information . Aumlib , which for years has been used in targeted attacks , now encodes certain HTTP communications . Compromised websites ( WordPress appears to be the top target ) are injected with a code snippet that replaces the current webpage with the aforementioned fake updates templates .


] com svc [ . They are often targeted simultaneously with other ethnic minorities and religious groups in China . FireEye researchers spotted the malware when analyzing a recent attempted attack on an organization involved in shaping economic policy . The source code is loaded from one of several domains impersonating Google ( google - analytiks[.]com ) or Adobe ( updateadobeflash[.]website ): That code contains all the web elements ( images , fonts , text ) needed to render the fake browser update page .


] ponethus [ . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups . And a new version of Ixeshe , which has been in service since 2009 to attack targets in East Asia , uses new network traffic patterns , possibly to evade traditional network security systems . We should note that SocGholish used to retrieve media files from separate web requests until more recently when it started using self - contained Base64 encoded images .


] com www [ . More recently in 2016 , Arbor Networks reported on connected malware operations continuing to target these same groups , which the Communist Party of China perceives as a threat to its power . The updates are significant for both of the longstanding malware families ; before this year , Aumlib had not changed since at least May 2011, and Ixeshe had not evolved since at least December 2011 . There are different installation flows for this campaign , but we will focus on the one that uses a URL shortcut .


] ponethus [ . There is the exploit code and malware used to gain access to systems , the infrastructure that provides command and control to the malware operator , and the human elements – developers who create the malware , operators who deploy it , and analysts who extract value from the stolen information . Cybercriminals are constantly evolving and adapting in their attempts to bypass computer network defenses . The decoy installer ( Install%20Updater%20(V104.25.151)-stable.url ) is an Internet shortcut downloaded from another compromised WordPress site .


] com webmail [ . For example , we have observed frequent reuse of older ( patched ) exploits in malware operations against the Tibetan community . But , larger , more successful threat actors tend to evolve at a slower rate . This shorcut uses the WebDav HTTP protocol extension to retrieve the file launcher-upd.hta from a remote server : This heavily obfuscated script is responsible for the execution of PowerShell that downloads the final malware payload ( NetSupport RAT ) .


] ponethus [ . These operations involved highly targeted email lures with repurposed content and attachments that contained an updated version of KeyBoy . As long as these actors regularly achieve their objective ( stealing sensitive data ) , they are not motivated to update or rethink their techniques , tactics , or procedures ( TTPs ) . Malwarebytes 's EDR shows the full attack chain ( please click to enlarge ): The NetSupport RAT files are hosted on the same compromised WordPress site used earlier to download the Internet shortcut .


] com nampriknum [ . In August and October 2016 we observed a malware operation targeting members of the Tibetan Parliament ( the highest legislative organ of the Tibetan government in exile , formally known as Central Tibetan Administration ) . These threat actors ’ tactics follow the same principles of evolution – successful techniques propagate , and unsuccessful ones are abandoned . The RAT 's main binary is launched from " C:\Users\%username%\AppData\Roaming\BranScale\client32.exe " .


] net www [ . The Arbor report describes the ongoing use of these four vulnerabilities in a series of espionage campaigns against not only Tibetan groups , but also others related to Hong Kong , Taiwan , and Uyghur interests . Attackers do not change their approach unless an external force or environmental shift compels them to . Following a successful infection , callbacks are made to the RAT 's command and control server at 94.158.247[.]27 .


] nampriknum [ . The malware samples deployed in both of these operations are updated versions of the KeyBoy backdoor first discussed in 2013 by Rapid7 . As the old saying goes : If it ain’t broke , don’t fix it . Fake browser updates are a very common decoy used by malware authors .


] net svc [ . This behavioural tactic was previously mentioned in relation to KeyBoy in a 2013 blog post by Cisco . So when a larger , successful threat actor changes up tactics , the move always piques our attention . In addition to SocGholish , the Domen toolkit was a well - built framework that emerged in 2019 while another campaign known as sczriptzzbn dropped SolarMarker leading to the NetSupport RAT in both cases .


] nampriknum [ . These versions of KeyBoy differed from the one first described by Rapid7 in several ways , many of which will be described in the sections to follow . Naturally , our first priority is ensuring that we detect the new or altered TTPs . Initial access brokers use tools like NetSupport RAT to gather information and perform additional actions on victims of interest .


] net svcws [ . These samples were contained in exploit documents containing distinct lure content , one having a Tibetan nexus , the other an Indian nexus . But we also attempt to figure out why the adversary changed — what broke? — so that we can predict if and when they will change again in the future . Stolen credentials can be resold to other threat actors tied to ransomware gangs .


] nampriknum [ . We believe the 2013 , 2015 , and 2016 KeyBoy samples provide evidence of a development effort focused on changing components that would be used by researchers to develop detection signatures . We observed an example of this phenomenon around May . While there is a very large number of vulnerable websites , we already see some that have been injected with multiple different malicious code .


] net svc [ . In another modification , first observed in the most recent October 11 Parliamentarian operation ( version agewkassif ) , the developer (s ) of KeyBoy began using a string obfuscation routine in order to hide many of the critical values referenced within the malware . About four months after The New York Times publicized an attack on its network , the attackers behind the intrusion deployed updated versions of their Backdoor.APT.Aumlib and Backdoor.APT.Ixeshe malware families . We will continue to monitor these campaigns and in particular SocGholish to see if the web delivery landscape changes .


] somtum [ . Trend Micro specifically noted that the 2013 versions of KeyBoy used the same algorithm for encoding their configuration files as was observed in the Operation Tropic Trooper malware . The previous versions of Aumlib had not changed since at least May 2011, and Ixeshe had not evolved since at least December 2011 . Malwarebytes customers are protected as we detect the infrastructure and final payload used in these attacks .


] today svcws [ . This sample was also found to be deployed using the CVE-2012-0158 vulnerability . We cannot say for sure whether the attackers were responding to the scrutiny they received in the wake of the episode . Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected .


] somtum [ . The operation against the Tibetan Parliamentarians illustrates the continued use of malicious attachments in the form of documents bearing exploits . But we do know the change was sudden . Beginning in January 2021 , Mandiant Managed Defense observed multiple instances of abuse of Microsoft Exchange Server within at least one client environment .


] today www [ . Chances are about even , though , that Mofang is a relevant threat actor to any organization that invests in Myanmar or is otherwise politically involved . Akin to turning a battleship , retooling TTPs of large threat actors is formidable . The observed activity included creation of web shells for persistent access , remote code execution , and reconnaissance for endpoint security solutions .


] somtum [ . In addition to the campaign in Myanmar , Mofang has been observed to attack targets across multiple sectors ( government , military , critical infrastructure and the automotive and weapon industries ) in multiple countries . Such a move requires recoding malware , updating infrastructure , and possibly retraining workers on new processes . Our investigation revealed that the files created on the Exchange servers were owned by the user NT AUTHORITY\SYSTEM , a privileged local account on the Windows operating system .


] today somtum [ . This threat report gives insight into some of the information that Fox-IT has about a threat actor that it follows , called Mofang . The following sections detail the changes to Backdoor.APT.Aumlib and Backdoor.APT.Ixeshe . Furthermore , the process that created the web shell was UMWorkerProcess.exe , the process responsible for Exchange Server ’s Unified Messaging Service .


] today shop [ . The name Mofang is based on the Mandarin verb , which means to imitate . Backdoor.APT.Aumlib : In subsequent investigations , we observed malicious files created by w3wp.exe , the process responsible for the Exchange Server web front - end .


] databit [ . It is highly likely that the Mofang group is a group that operates out of China and is probably government-affiliated . A recently observed malware sample ( hash value 832f5e01be536da71d5b3f7e41938cfb ) appears to be a modified variant of Aumlib . In response to this activity , we built threat hunting campaigns designed to identify additional Exchange Server abuse .


] today svc [ . Chapter 7 explains the working of Mofang 's preferred tools : ShimRat and SimRatReporter . The sample , which was deployed against an organization involved in shaping economic policy , was downloaded from the following URL : We also utilized this data to build higher - fidelity detections of web server process chains .


] databit [ . The Mofang group has been active in relation to the Kyaukphyu sez . status.acmetoy.com /DD/ myScript.js or status.acmetoy.com /DD/ css.css . On March 2 , 2021 , Microsoft released a blog post that detailed multiple zero - day vulnerabilities used to attack on - premises versions of Microsoft Exchange Server .


] today test [ . KeyBoy provides basic backdoor functionality , allowing the operators to select from various capabilities used to surveil and steal information from the victim machine . This output reveals the following changes when compared with earlier variants : Microsoft also issued emergency Exchange Server updates for the following vulnerabilities : The activity reported by Microsoft aligns with our observations .


] databit [ . The first attack started in early July with a ShimRatReporter payload . The POST URI is changed to /bbs/ search.asp ( as mentioned , earlier Aumlib variants used a POST URI of /bbs/ info.asp . ) The POST body is now encoded . FireEye currently tracks this activity in three clusters , UNC2639 , UNC2640 , and UNC2643 .


] today www [ . Myanmar has been the target of Mofang 's attacks for years before the campaign related to the sez . These subtle changes may be enough to circumvent existing IDS signatures designed to detect older variants of the Aumlib family . We recommend following Microsoft ’s guidance and patching Exchange Server immediately to mitigate this activity .


] databit [ . In late September 2015 Mofang used the website of Myanmar 's national airline hosted at www.flymna.com for an attack against an organization in Myanmar . The sample 832f5e01be536da71d5b3f7e41938cfb shares code with an older Aumlib variant with the hash cb3dcde34fd9ff0e19381d99b02f9692 . Based on our telemetry , we have identified an array of affected victims including US - based retailers , local governments , a university , and an engineering firm .


] today admin [ .databit [ .today cendata [ . In December 2012 Mofang started a campaign against a new target , called ' seg ' for the purpose of this report . The sample cb3dcde34fd9ff0e19381d99b02f9692 connected to documents.myPicture.info and www.documents.myPicture.info and as expected generated the a POST request to /bbs/ info.asp . Related activity may also include a Southeast Asian government and Central Asian telecom .


] today svc [ . From the configuration it can be determined that the company was running F-Secure Antivirus and Mofang registered the domain to not appear suspicious . Backdoor.APT.Ixeshe : Microsoft reported the exploitation occurred together and is linked to a single group of actors tracked as “ HAFNIUM ” , a group that has previously targeted the US - based defense companies , law firms , infectious disease researchers , and think tanks .


] cendata [ . In September 2015 Mofang launched another attack . Ixeshe has been used in targeted attacks since 2009, often against entities in East Asia . As our experience with and knowledge of this threat actor grows , we will update this post or release new technical details as appropriate .


] today svcws [ . A new version of ShimRat was built on the 7th of September , uploaded to the server and only days later used in a new campaign . The network traffic is encoded with a custom Base64 alphabet . For our Managed Defense Customers , we have launched a Community Protection Event that will provide frequent updates on this threat actor and activity .


] cendata [ . MoneyTaker has primarily been targeting card processing systems , including the AWS CBR ( Russian Interbank System ) and purportedly SWIFT ( US ) . We analyzed a recent sample that appears to have targeted entities in Taiwan , a target consistent with previous Ixeshe activity . Beginning in January 2021 , Mandiant Managed Defense observed the creation of web shells on one Microsoft Exchange server file system within a customer ’s environment .


] today www [ . Given the wide usage of STAR in LATAM , financial institutions in LATAM could have particular exposure to a potential interest from the MoneyTaker group . This sample ( aa873ed803ca800ce92a39d9a683c644 ) exhibited network traffic that does not match the earlier pattern and therefore may evade existing network traffic signatures designed to detect Ixeshe related infections . The web shell , named help.aspx ( MD5 : 4b3039cf227c611c45d2242d1228a121 ) , contained code to identify the presence of ( 1 ) FireEye xAgent , ( 2 ) CarbonBlack , or ( 3 ) CrowdStrike Falcon endpoint products and write the output of discovery .


] cendata [ . In addition to banks , the MoneyTaker group has attacked law firms and also financial software vendors . APT16 . The web shell was written to the system by the UMWorkerProcess.exe process , which is associated with Microsoft Exchange Server ’s Unified Messaging service .


] today PHA Family Highlights : Zen and its cousins January 11 , 2019 Google Play Protect detects Potentially Harmful Applications ( PHAs ) which Google Play Protect defines as any mobile app that poses a potential security risk to users or to user data—commonly referred to as " malware . Since that time , the group attacked companies in California , Utah , Oklahoma , Colorado , Illinois , Missouri , South Carolina , North Carolina , Virginia and Florida . Between November 26, 2015, and December 1, 2015, known and suspected China based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries . This activity suggested exploitation of CVE-2021 - 26858 .


'' in a variety of ways , such as static analysis , dynamic analysis , and machine learning . The first attack in the US that Group-IB attributes to MoneyTaker was conducted in the spring of 2016 : money was stolen from the bank by gaining access to First Data 's " STAR " network operator portal . Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability , and the local Windows privilege escalation vulnerability CVE-2015-1701 . Approximately twenty days later , the attacker placed another web shell on a separate Microsoft Exchange Server .


While our systems are great at automatically detecting and protecting against PHAs , we believe the best security comes from the combination of automated scanning and skilled human review . The first attack in the US that Group-IB attributes to this group was conducted in the spring of 2016 : money was stolen from the bank by gaining access to First Data 's " STAR " network operator portal . The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO , or a backdoor that we refer to as ELMER . This second , partially obfuscated web shell , named iisstart.aspx ( MD5 : 0fd9bffa49c76ee12e51e3b8ae0609ac ) , was more advanced and contained functions to interact with the file system .


With this blog series we will be sharing our research analysis with the research and broader security community , starting with the PHA family , Zen . In 2017 , the number of MoneyTaker 's attacks has remained the same with 8 US banks , 1 law firm and 1 bank in Russia being targeted . On November 26, 2015, a suspected China based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies . the web shell included the ability to run arbitrary commands and upload , delete , and view the contents of files .


Zen uses root permissions on a device to automatically enable a service that creates fake Google accounts . In 2017 , the number of attacks has remained the same with 8 US banks , 1 law firm and 1 bank in Russia being targeted . As shown in Figure 1, the emails originated from the Yahoo ! email address mts03282000@yahoo.co.jp , and contained the subject “ Sending of New Year . While the use of web shells is common amongst threat actors , the parent processes , timing , and victim(s ) of these files clearly indicate activity that commenced with the abuse of Microsoft Exchange .


These accounts are created by abusing accessibility services . By analyzing the attack infrastructure , Group-IB identified that MoneyTaker group continuously exfiltrates internal banking documentation to learn about bank operations in preparation for future attacks . Foreword ” . In March 2021 , in a separate environment , we observed a threat actor utilize one or more vulnerabilities to place at least one web shell on the vulnerable Exchange Server .


Zen apps gain access to root permissions from a rooting trojan in its infection chain . Group-IB reports that MoneyTaker uses both borrowed and their own self-written tools . Each phishing message contained the same malicious Microsoft Word attachment . This was likely to establish both persistence and secondary access , as in other environments .


In this blog post , we do not differentiate between the rooting component and the component that abuses root : we refer to them interchangeably as Zen . Group-IB has provided Europol and Interpol with detailed information about the MoneyTaker group for further investigative activities as part of our cooperation in fighting cybercrime . The malicious attachment resembled an article hosted on a legitimate Japanese defense-related website , as both discussed national defense topics and carried the same byline . In this case , Mandiant observed the process w3wp.exe , ( the IIS process associated with the Exchange web front - end ) spawning cmd.exe to write a file to disk .


We also describe apps that we think are coming from the same author or a group of authors . In late September 2015 Mofang used the website of Myanmara 's national airline hosted at www.flymna.com for an attack against an organization in Myanmar . The lure documents also used the Japanese calendar , as indicated by the 27th year in the Heisei period . The file , matches signatures for the tried - and - true China Chopper .


All of the PHAs that are mentioned in this blog post were detected and removed by Google Play Protect . To control the full operation , MoneyTaker uses a Pentest framework Server . This demonstrates that the threat actors understand conventional Japanese date notation . We observed that in at least two cases , the threat actors subsequently issued the following command against the Exchange web server : This command attempts to delete the administrator user from the Exchange Organizations administrators group , beginning with the Domain Controller in the current domain .


Background Uncovering PHAs takes a lot of detective work and unraveling the mystery of how they 're possibly connected to other apps takes even more . On it , MoneyTaker install a legitimate tool for penetration testing – Metasploit . Following the exploitation of the EPS and CVE-2015-1701 vulnerabilities , the exploit payload drops either a 32-bit or 64-bit binary containing an embedded IRONHALO malware sample . If the system is in a single - system domain , it will execute on the local computer .