cfd77ddc5c1ebb8498c899a68ea75d2616c1c92a0e618113d7c9e5fcc650094b Flash Player com.gzhlubw.pmevdiexmn 3f2ed928789c200e21fd0c2095619a346f75d84f76f1e54a8b3153385850ea63 Target list The actual observed list of mobile apps targeted by Cerberus contains a total of 30 unique applications . The SectorJ04 group has shown a pattern of hacking activities that have changed from targeted attacks to a large-scale distribution of spam . Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data Exfiltration and to provide remote access to infected machines .


This list is expected to expand : Package name Application name com.android.vending Play Market com.boursorama.android.clients Boursorama Banque com.caisseepargne.android.mobilebanking Banque com.chase.sig.android Chase Mobile com.clairmail.fth Fifth Third Mobile Banking com.connectivityapps.hotmail Connect for Hotmail com.google.android.gm Gmail com.imo.android.imoim imo free video calls and chat com.infonow.bofa Bank of America This allows them to expand their range of targets of hacking activities for financial profit , and in this regard , SectorJ04 group has been found to have hacked into a company’s internal network by using a spear phishing email targeting executives and employees of certain South Korean companies around February 2019 . Symantec discovered the most recent wave of Tick attacks in July 2015 , when BRONZE BUTLER compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


Mobile Banking com.IngDirectAndroid ING com.instagram.android Instagram com.konylabs.capitalone Capital One® Mobile com.mail.mobile.android.mail mail.com mail com.microsoft.office.outlook Microsoft Outlook com.snapchat.android Snapchat com.tencent.mm WeChat com.twitter.android Twitter com.ubercab Uber com.usaa.mobile.android.usaa USAA Mobile com.usbank.mobilebanking U.S. Bank - Inspired by customers com.viber.voip Viber com.wf.wellsfargomobile SectorJ04 group carried out intensive hacking on various industrial sectors , including South Korea’s media , manufacturing and universities , around February and March 2019 . In some cases , the attackers used the Society for Worldwide Interbank Financial Telecommunication ( SWIFT ) network to transfer money to their accounts .


Wells Fargo Mobile com.whatsapp WhatsApp com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email fr.banquepopulaire.cyberplus Banque Populaire fr.creditagricole.androidapp Ma Banque jp.co.rakuten_bank.rakutenbank 楽天銀行 -個人のお客様向けアプリ mobi.societegenerale.mobile.lappli L ’ Appli Société Générale net.bnpparibas.mescomptes Mes Comptes BNP Paribas org.telegram.messenger Telegram Triout - Spyware Framework SectorJ04 used the spear phishing email to spread malicious Excel or malicious Word files , and downloaded the MSI files from the attacker’s server when the malicious documents were run . Carbanak is a backdoor used by the attackers to compromise the victim .


for Android with Extensive Surveillance Capabilities August 20 , 2018 No operating system is safe from malware , as cyber criminals will always want to steal , spy or tamper with your data . SectorJ04 group conducted hacking activities targeting financial institutions located in India and Hong Kong around April 2019 . If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation .


The proliferation of Android devices – from smartphones to tablets and smart TVs – has opened up new possibilities for malware developers , as all these devices pack microphones , cameras and location-tracking hardware they can turn into the perfect spy tools . SectorJ04 group carried out hacking activities targeting financial institutions located in Italy and other countries around May 2019 . To enable connections to the infected computer using the Remote Desktop Protocol ( RDP ) , Carbanak sets Termservice service execution mode to Auto .


Bitdefender researchers have identified a new Android spyware , dubbed Triout , which appears to act as a framework for building extensive surveillance capabilities into seemingly benign applications . In late July , SectorJ04 group used FlawedAmmy RAT to carry out hacking attacks on companies and universities in sectors such as education , job openings , real estate and semiconductors in South Korea . Carbanak is also aware of the IFOBS banking application and can , on command , substitute the details of payment documents in the IFOBS system .


Found bundled with a repackaged app , the spyware ’ s surveillance capabilities involve hiding its presence on the device , recording phone calls , logging incoming text messages , recoding videos , taking pictures and collecting GPS coordinates , then broadcasting all of that to an attacker-controlled C & C ( command and control ) server . In early August , the SectorJ04 group carried out extensive hacking activities targeting the users around the world , including South Korea , India , Britain , the United States , Germany , Canada , Argentina , Bangladesh and Hong Kong . Sensitive bank documents have be found on the servers that were controlling Carbanak .


It ’ s interesting that Triout , which is detected by Bitdefender ’ s machine learning algorithms , was first submitted from Russia , and most scans/reports came from Israel . Spam emails targeting email accounts used in the integrated mail service of public officials were also found in the hacking activity . Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa .


The sample ’ s first appearance seems to be May 15 , 2018 , when it was uploaded to VirusTotal , but it ’ s unclear how the tainted sample is disseminated . They are one of the most active cyber crime groups in 2019 , and they often modify and tweak their hacking methods and perform periodic hacking activities . FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015 .


Third-party marketplaces or some other attacker-controlled domains are likely used to host the sample . Now , Silence is one of the most active threat actors targeting the financial sector . As with previous campaigns , and as highlighted in our annual M-Trends 2017 report , FIN7 is calling stores at targeted organizations to ensure they received the email and attempting to walk them through the infection process .


A subsequent investigation revealed that the spyware has the following capabilities : Records every phone call ( literally the conversation as a media file ) , then sends it together with the caller id to the C & C ( incall3.php and outcall3.php ) Logs every incoming SMS message ( SMS body and SMS sender ) to C & C ( script3.php ) Has capability to hide self Can send all call logs ( “ content : //call_log/calls ” , info : callname , callnum , calldate , calltype , callduration Since we released our original report , Silence: Moving into the darkside , the confirmed damage from Silence's operations has increased fivefold compared to the figures in Group-IB's initial report . We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers .


) to C & C ( calllog.php ) Whenever the user snaps a picture , either with the front or rear camera , it gets sent to the C & C ( uppc.php , fi npic.php orreqpic.php ) Can send GPS coordinates to C & C ( gps3.php ) The C & C server to which the application seems to be sending collected data appears to be operational , as of this writing , and running since May 2018 . Silence started by targeting organizations in Russia , gradually shifting their focus to former Soviet countries , and then the world . While FIN7 has embedded VBE as OLE objects for over a year , they continue to update their script launching mechanisms .


January 23 , 2017 SpyNote RAT posing as Netflix app As users have become more attached to their mobile devices , they want everything on those devices . Silence also started using Ivoke , a fileless loader , and EDA agent , both written in PowerShell . This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies .


There ’ s an app for just about any facet of one ’ s personal and professional life , from booking travel and managing projects , to buying groceries and binge-watching the latest Netflix series . Silence 2.0: Going Global is an extension of our original report: Silence: Moving into the Darkside which remains the most significant contribution to the research on the group and is the first such report to reveal Silence’s activity . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


The iOS and Android apps for Netflix are enormously popular , effectively turning a mobile device into a television with which users can stream full movies and TV programs anytime , anywhere . Since the report’s release in September 2018 , Group-IB’s Threat Intelligence team has detected 16 campaigns targeting banks launched by Silence . The group has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp .


But the apps , with their many millions of users , have captured the attention of the bad actors , too , who are exploiting the popularity of Netflix to spread malware . Like the majority of APT groups , Silence uses phishing as their infection vector . From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space .


Recently , the ThreatLabZ research team came across a fake Netflix app , which turned out to be a new variant of SpyNote RAT ( Remote Access Trojan ) . In the last successful attack described in Silence: Moving into the darkside , dated April 2018 , the hackers siphoned off about $150 , 000 through ATMs in a single night . Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems .


SpyNote RAT is capable of performing a variety of alarming functions that includes : Activating the device ’ s microphone and listening to live conversations Executing commands on the device Copying files from the device to a Command & Control ( C & C ) center Recording screen captures Viewing contacts Reading SMS messages The screenshot below shows part of the sandbox ’ s report on the SpyNote RAT ’ s signature and detected functions : The fake Netflix app we are analyzing in this blog appears to be built using an updated version of SpyNote RAT builder , Prior to April 2018 , as described in Group-IB’s Silence: Moving into the darkside report , Silence’s target interests were primarily limited to former Soviet and Eastern European countries including Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan . The first successful bank robbery was committed by this group in January 2013 .


which was leaked last year . In 2018 , Silence conducted test campaigns to update their database of current targets and expand their attack geography . To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer .


Technical details Please note that our research is not about the legitimate Netflix app on Google Play . The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users . We have no evidence of compromises against banks in Western Europe or United States , but it should be noted that the attackers methods could be utilized against banks outside of Russia as well .


The spyware in this analysis was portraying itself as the Netflix app . Silence has conducted at least three campaigns using recon emails , followed by malicious mail sent to an updated recipient list . Additionally the reports on Carbanak show a different picture , where banks targeted outside of Russia , specifically Europe , USA and Japan are mentioned , which does not match our research .


Once installed , it displayed the icon found in the actual Netflix app on Google Play . Group-IB has also detected recon emails sent out to New Zealand . Without any insight into the evidence Kaspersky has obtained , we can only repeat our view that Anunak has targeted only banks in Russia and we have no concrete reports of compromised banks outside of Russia directly related to this criminal group .


As soon as the user clicks the spyware ’ s icon for the first time , nothing seems to happen and the icon disappears from the home screen . Since our last public report , Silence has sent out more than 170 , 000 recon emails to banks in Russia , the former Soviet Union , Asia and Europe . Charming Kitten is an Iranian cyberespionage group operating since approximately 2014 .


This is a common trick played by malware developers , making the user think the app may have been removed . In November 2018 , Silence tried their hand at targeting the Asian market for the first time in their history . These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider .


But , behind the scenes , the malware has not been removed ; instead it starts preparing its onslaught of attacks . In total , Silence sent out about 80 , 000 emails , with more than half of them targeting Taiwan , Malaysia , and South Korea . The Charming Kitten' focus appears to be individuals of interest to Iran in the fields of academic research .


For contacting C & C , the spyware was found to be using free DNS services , as shown in the screenshot below : SpyNote RAT uses an unusual trick to make sure that it remains up and running and that the spying does not stop . Prior to April 2018 , as described in Group-IB’s Silence: Moving into the darkside report , Silence’s target interests were primarily limited to former Soviet and Eastern European countries including Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan . Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as OilRig and CopyKittens .


It does so using the Services , Broadcast Receivers , and Activities components of the Android platform . From 16 October 2018 to 1 January 2019 , Silence sent out about 84 , 000 emails in Russia alone to update their address database . Flying Kitten ( which is another name given by the security industry to Charming Kitten ) was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of the IRI ( Islamic Republic of Iran ) government and foreign espionage targets .


Services can perform long-running operations in the background and does not need a user interface . As part of their phishing campaigns , silence still uses Microsoft Office documents with macros or exploits , CHM files , and .LNK shortcuts as malicious attachments . Flying Kitten was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of government and foreign espionage targets .


Broadcast Receivers are Android components that can register themselves for particular events . In the former Soviet Union , Silence targeted banks in Kyrgyzstan , Kazakhstan , and Ukraine . At certain times , Mesri has been a member of an Iran-based hacking group called the Turk Black Hat security team " .


Activities are key building blocks , central to an app ’ s navigation , for example . In 2019 , Group-IB also observed the use of a new fileless PowerShell loader called Ivoke . During intense intelligence gathering over the last 24 months , we observed the technical capabilities of the Operation Cleaver team rapidly evolve faster than any previously observed Iranian effort .


The SpyNote RAT registers a service called AutoStartup and a broadcast receiver named BootComplete . The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer . TinyZBot is a bot written in C# and developed by the Cleaver team .


MainActivity registers BootComplete with a boot event , so that whenever the device is booted , BootComplete gets triggered . As the CnC server , Silence use CnC-3 server running Windows , from which they send commands to download additional modules . Some of the teams publicly known today include Iranian Cyber Army , Ashiyane , Islamic Cyber Resistance Group , Izz ad-Din al-Qassam Cyber Fighters , Parastoo , Shabgard , Iran Black Hats and many others 9 .


BootComplete starts the AutoStartup service and the AutoStartup service makes sure that MainActivity is always running . To control ATMs , the group uses the Atmosphere Trojan , which is unique to Silence , or a program called xfs-disp.exe . However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team .


What follows are some of the features exhibited by SpyNote RAT . In addition , Silence downloads the reverse proxy programs Silence.ProxyBot and Silence. ProxyBot.NET , which are described in detail in the report Silence: moving into the darkside . The Cobalt group 's traditional " stomping grounds " are the Eastern Europe , Central Asia , and Southeast Asia .


Command execution Command execution can create havoc for victim if the malware developer decides to execute commands in the victim ’ s device . Analysis of the emails has shown that the attachment contains an exploit for the CVE-2017-11882 vulnerability . Against targets in the CIS countries , the Cobalt also used their own infrastructure , which included rented dedicated servers .


Leveraging this feature , the malware developer can root the device using a range of vulnerabilities , well-known or zero-day . Group-IB specialists tracked a massive mailout of emails containing a malicious Microsoft Word attachment titled Договор.doc” [Contract.doc] . In several cases , the Cobalt compromised company infrastructure and employee accounts in order to send phishing messages to partner companies in North and South America , Europe , CIS countries , and Central and Southeast Asia .


The following screenshot shows the command execution functionality in action : The paramString parameter shown in the above screenshot can be any command received from C & C . Silence sent out emails to Russian banks . To ensure remote access to the workstation of an employee at a target organization , the Cobalt group ( as in previous years ) uses Beacon , a Trojan available as part of commercial penetration testing software .


Screen capture and audio recording SpyNote RAT was able to take screen captures and , using the device ’ s microphone , listen to audio conversations . The exploit installs Silence’s loader , designed to download backdoors and other malicious programs . Artifacts indicated the involvement of the Cobalt that , according to Positive Technologies information , from August to October had performed similar successful attacks in Eastern Europe , and it 's likely that this group may will soon become active in the West .


This capability was confirmed when the Android permission , called android.permission.RECORD_AUDIO , was being requested along with code found in the app . Silence conducted a massive phishing campaign posing as the Central Bank of the Russian Federation . In a recent spear-phishing campaign , the Cobalt Hacking Group used a remote code execution vulnerability in Microsoft Office software to connect to its command and control server via Cobalt Strike .


SpyNote RAT captured the device ’ s screen activities along with audio using the MediaProjectionCallback functionality ( available with Lollipop , the Android 5.0 release , and later ) and saved the output in a file named " video.mp4 '' as shown in the following screenshot SMS stealing SpyNote RAT was also observed stealing SMS messages from the affected devices , as shown in screenshot below : Stealing contacts The ability to steal contacts is a favorite feature for spyware developers , as the stolen contacts can be used to further spread the spyware Group-IB specialists have established that the aim of the attack was to deliver and launch the second stage of Silence’s Trojan , known as Silence.MainModule . The basic principles of targeted attacks on financial institutions have not changed since 2013 when the Anunak , Corkow , Buhtrap , and Lurk groups began conducting the first attacks on Russian banks .


. Silence attacked financial organisations in the UK . In a recent spear-phishing campaign , the Cobalt Group used a known CVE to connect to its C&C server via Cobalt Strike , but ended up revealing all targets .


The following screenshot shows the contacts being stolen and written in a local array , which is then sent to C & C : Uninstalling apps Uninstalling apps is another function favored by developers of Android spyware and malware . Silence conducted the first stage of their Asian campaign , organising a massive phishing attack aimed at receiving an up-to-date list of current recipients in different countries for further targeted attacks delivering their malicious software . This isn't the first time we've seen Cobalt makes this error—back in March , an attack focussing on 1,880 targets across financial institutions in Kazakhstan had the same flaw .


They tend to target any antivirus protections on the device and uninstall them , which increases the possibility of their malware persisting on the device . The attackers used the server deployed on 6 June 2019 to control compromised workstations in these banks . The Carbanak attacks targeting over a 100 financial institutions worldwide .


Following screenshot shows this functionality in action : Other functions In addition to the functionalities we ’ ve described , the SpyNote RAT was exhibiting many other behaviors that make it more robust than most off-the-shelf malware . On 24 March 2019 , Silence.ProxyBot (MD5 2fe01a04d6beef14555b2cf9a717615c) was uploaded to VirusTotal from an IP address in Sri Lanka . The leader of the crime gang behind the Carbanak and Cobalt malware attacks targeting over a 100 financial institutions worldwide has been arrested in Alicante , Spain , after a complex investigation conducted by the Spanish National Police .


SpyNote RAT was designed to function only over Wi-Fi , which is the preferable mode for Android malware to send files to C & C . On October 18th , 2018 , the group sent out emails to British financial companies as part of their preparatory campaign . Since 2013 , the Cobalt have attempted to attack banks and financial institutions using pieces of malware they designed .


The screenshot below shows SpyNote RAT scanning for Wi-Fi and enabling it if a known channel is found : Additional features - SpyNote RAT could click photos using the device 's camera , based on commands from C & C . Group-IB experts established that the server 185.20.187.89 started functioning no later than 28 January 2019 . Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt .


- There were two interesting sub-classes found inside Main Activity : Receiver and Sender . According to local media reports , in 2019 Silence successfully withdrew money from the Bangladeshi bank twice within 2 months . The organised crime group started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world .


Receiver was involved in receiving commands from the Server and the main functionality of Sender was to send all the data collected to the C & C over Wi-Fi . To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank . One of the Cobalt Group 's latest campaigns , an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor , was investigated and presented by the Talos research team .


- SpyNote RAT was also collecting the device ’ s location to identify the exact location of the victim . As we described in Silence: Moving into the darkside report , Silence has experience with theft using compromised card processing systems . The Cobalt started its high-tech criminal activities in late 2013 by launching the Anunak malware campaign that targeted financial transfers and ATM networks of financial institutions around the world .


SpyNote RAT builder The SpyNote Remote Access Trojan ( RAT ) builder is gaining popularity in the hacking community , so we decided to study its pervasiveness . In February 2019 , Russian media7 reported a Silence attack on IT Bank in the city of Omsk . The Cobalt group misused Cobalt Strike , for instance , to perpetrate ATM cyber heists and target financial institutions across Europe , and interestingly , Russia .


What we found were several other fake apps developed using the SpyNote builder , which should come as a warning to Android users . On 16 January 2019 , Silence sent out phishing emails with malicious attachments disguised as invitations to the International Financial Forum iFin-2019 (see section ‘Attack timeline’) . The hacking group misused Cobalt Strike , for instance , to perpetrate ATM cyber heists and target financial institutions across Europe , and interestingly , Russia .


Some of the targeted apps were : Whatsapp YouTube Video Downloader Google Update Instagram Hack Wifi AirDroid WifiHacker Facebook Photoshop SkyTV Hotstar Trump Dash PokemonGo With many more to come . Group-IB specialists determined that the email addresses of IT bank employees were among the recipients of these emails . If successful , Cobalt goes on to attack financial institutions outside the country .


Furthermore , we found that in just the first two weeks of 2017 , there have been more than 120 such spyware variants already built using the same SpyNote Trojan builder as SpyNote RAT and roaming in the wild . The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine . The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled .


A complete list of sample hashes is available here . Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server . As part of our monitoring of Iranian threat agents activities , we have detected that since October 2016 and until the end of January 2017 , the Jerusalem Post , as well as multiple other Israeli websites and one website in the Palestinian Authority were compromised by Iranian threat agent CopyKittens .


Conclusion The days when one needed in-depth coding knowledge to develop malware are long gone . Since at least 2011 , these hackers have been using malware to spy on corporate networks . CopyKittens use several self-developed malware and hacking tools that have not been publicly reported to date , and are analyzed in this report : TDTESS backdoor ; Vminst , a lateral movement tool ; NetSrv , a Cobalt Strike loader ; and ZPP , a files compression console program .


Nowadays , script kiddies can build a piece of malware that can create real havoc . Hackers are targeting high-tech companies as well as chemical and pharmaceutical companies . CopyKittens often uses the trial version of Cobalt Strike , a publicly available commercial software for " Adversary Simulations and Red Team Operations " .


Moreover , there are many toolkits like the SpyNote Trojan builder that enable users to build malware with ease and few clicks . The hackers will map a company’s network and look for strategically favorable locations for placing their malware . Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent .


In particular , avoid side-loading apps from third-party app stores and avoid the temptation to play games that are not yet available on Android . The corporation conrms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions.” Henkel claims that a very small portion” of its worldwide IT systems had been aected — the systems in Germany . The group , which we have given the name Gallmaker , has been operating since at least December 2017 , with its most recent activity observed in June 2018 .


Yes , we are talking about SuperMarioRun , which was recently launched by Nintendo only for iOS users . A BASF spokeswoman tells us in an email that in July 2015 , hackers had successfully overcome the rst levels” of defense . Rather , the Gallmaker 's attack activity we observed is carried out exclusively using LotL tactics and publicly available hack tools .


Recent blogs by the Zscaler research team explain how some variants of Android malware are exploiting the popularity of this game and tricking Android users into downloading a fake version . The tool was written by sta of Thyssenkrupp , because the industrial giant—company number eleven—had been spied on by Winnti . Gallmaker used lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange ( DDE ) protocol in order to gain access to victim machines .


( Have a look here and here . Hackers are charged with spying on a manufacturer of gas turbines . Should a user enable this content , the attackers are then able to use the DDE protocol to remotely execute commands in memory on the victim 's system .


) You should also avoid the temptation to play games from sources other than legitimate app stores ; such games are not safe and may bring harm to your reputation and your bank account . The Hong Kong government was spied on by the Winnti hackers . Back in 2013 , CopyKittens used several Facebook profiles to spread links to a website impersonating Haaretz news , an Israeli newspaper .


FakeSpy Masquerades as Postal Service Apps Around the World July 1 , 2020 KEY FINDINGS The Cybereason Nocturnus team is investigating a new campaign involving FakeSpy , an Android mobile malware that emerged around October 2017 . Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX . Gallmaker 's activity appears to be highly targeted , with its victims all related to government , military , or defense sectors .


FakeSpy is an information stealer used to steal SMS messages , send SMS messages , steal financial data , read account information and contact lists , steal application data , and do much more . While OceanLotus’ targets are global , their operations are mostly active within the APAC region which encompasses targeting private sectors across multiple industries , foreign governments , activists , and dissidents connected to Vietnam . Gallmaker 's targets are embassies of an Eastern European country .


FakeSpy first targeted South Korean and Japanese speakers . NewsBeef attacks against Saudi Arabian organizations and individuals (as well as targets in the European Union) are likely to continue . There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors .


However , it has begun to target users all around the world , especially users in countries like China , Taiwan , France , Switzerland , Germany , United Kingdom , United States , and others . Rapid7 discovered that additional data was placed into the Dropbox accounts under control of the APT10 during the compromise and was able to attribute data that was placed into it as being owned by Visma . The group has carried out attacks most months since December 2017 .


FakeSpy masquerades as legitimate postal service apps and transportation services in order to gain the users ' trust . Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe . Its activity subsequently increased in the second quarter of 2018 , with a particular spike in April 2018 .


Once installed , the application requests permissions so that it may control SMS messages and steal sensitive data on the device , as well as proliferate to other devices in the target device ’ s contact list . These RAT families are discussed in Novetta’s other report on the Lazarus Group’s RAT and Staging capabilities . The fact that Gallmaker appears to rely exclusively on LotL tactics and publicly available hack tools makes its activities extremely hard to detect .


Cybereason 's investigation shows that the threat actor behind the FakeSpy campaign is a Chinese-speaking group dubbed " Roaming Mantis '' , a group that has led similar campaigns . Magic Hound has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia . The Gamaredon Group primarily makes use of compromised domains , dynamic DNS providers , Russian and Ukrainian country code top-level domains ( ccTLDs ) , and Russian hosting providers to distribute their custom-built malware .


FakeSpy has been in the wild since 2017 ; this latest campaign indicates that it has become more powerful . Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations . Gallmaker may well have continued to avoid detection were it not for Symantec 's technology .


Code improvements , new capabilities , anti-emulation techniques , and new , global targets all suggest that this malware is well-maintained by its authors and continues to evolve . CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash . In this instance , Symantec identified the specific PowerShell commands used by Gallmaker as being suspicious , leading to the discovery of this new campaign .


TABLE OF CONTENTS Key Findings Introduction Threat Analysis Fakespy Code Analysis Dynamic Library Loading Stealing Sensitive Information Anti-Emulator Techniques Under Active Development Who is Behind Fakespy 's Smishing Campaigns ? CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering . Without Symantec 's advanced AI-based capabilities , Gallmaker 's activities may well have remained undetected .


Conclusions Cybereason Mobile Detects and Stops FakeSpy Indicators of Compromise INTRODUCTION For the past several weeks , Cybereason has been investigating a new version of Android malware dubbed FakeSpy , which was first identified in October 2017 and reported again in October 2018 . Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East (including targets inside Iran itself) , as well as across Europe and in the United States . Previously , LookingGlass reported on a campaign they named " Operation Armageddon " , targeting individuals involved in the Ukrainian military and national security establishment .


A new campaign is up and running using newly improved , significantly more powerful malware as compared to previous versions . These malware families have a rich history of being used in many targeted attacks against government and private organizations . The earliest discovered sample ( based on compile times and sandbox submission times ) distributed by this threat group resembles the descriptions of Gamaredon provided by Symantec and Trend Micro .


FakeSpy is under active development and is evolving rapidly ; new versions are released every week with additional evasion techniques and capabilities . The activity surfaced in Southeast Asia , a region where APT10 frequently operates . The scripts would also use wget to send POST requests to command and control ( C2 ) servers that would contain information about the compromised system .


Our analysis shows that the threat actor behind the FakeSpy malware is a Chinese-speaking group , commonly referred to as " Roaming Mantis '' , a group that is known to have launched similar campaigns in the past . The samples we analyzed originated from the Philippines . These VNC exectuables would either be included in the SFX file or downloaded by the batch script .


FakeSpy is an information stealer that exfiltrates and sends SMS messages , steals financial and application data , reads account information and contact lists , and more . APT10 frequently targets the Southeast Asia region . The batch script would then attempt to have the VNC program connect to a command and control ( C2 ) server to enable the server to control the compromised system .


The malware uses smishing , or SMS phishing , to infiltrate target devices , which is a technique that relies on social engineering . Both of the loader’s variants and their various payloads that enSilo analyzed share similar Tactics , Techniques , and Procedures (TTPs) and code associated with APT10 . While the most recent samples observed still use batch scripts and SFX files , the Gamaredon Group has moved aACT from applications like wget , Remote Manipulator MAL , VNC and ChkFlsh.exe .


The attackers send fake text messages to lure the victims to click on a malicious link . Typically , APT10 tends to employ a namesquatting scheme in their domains that aims to confuse the observer by posing as a legitimate domain . The threat group using these implants has been active since at least 2014 and has been seen targeting individuals likely involved in the Ukrainian government .


The link directs them to a malicious web page , which prompts them to download an Android application package ( APK ) . Also , the certificate embedded in the Quasar sample was issued at 22.12.2018 , which correlates with the file’s compilation date . Some of the samples share delivery mechanisms and infrastructure with samples which are detected by a few antivirus vendors as Gamaredon .


This most recent FakeSpy campaign appears to target users of postal services around the world . Over the past three months , Recorded Future’s Insikt Group has observed an increase in APT33’s also known as Elfin infrastructure building and targeting activity , and on June 21 , 2019 , Yahoo . Periodically , researchers at Palo Alto Networks hunt through WildFire execution reports , using AutoFocus , to identify untagged samples ' artifacts in the hopes of identifying previously undiscovered malware families , behaviors , and campaigns .


New versions of FakeSpy masquerade as government post office apps and transportation services apps . News reported that the U.S. Cyber Command launched cyberattacks on an Iranian spy group . Just a few months later , in February 2015 , we announced the discovery of Carbanak , a cyber-criminal gang that used custom malware and APT techniques to steal millions of dollars while infecting hundreds of financial institutions in at least 30 countries .


Our analysis indicates that the threat actors are no longer limiting their campaigns to East Asian countries , but are targeting additional countries around the world . Iranian state-sponsored threat actor APT33 has been conducting cyberespionage activity since at least 2013 , predominantly targeting nations in the Middle East , but also notably targeting U.S. , South Korean , and European commercial entities across a wide variety of sectors . Today at the Security Analyst Summit ( SAS 2016 ) , Kaspersky Lab is announcing the discovery of two new gangs engaged in APT-style bank robberies – Metel and GCMAN – and the reemergence of the Carbanak group with new targets in its sights .


THREAT ANALYSIS Infection Vector : Smishing Your Device Thus far , FakeSpy campaigns are characterized by SMS phishing ( a.k.a . Our research found that APT33 , or a closely aligned threat actor , continues to conduct and prepare for widespread cyberespionage activity , with over 1 , 200 domains used since March 28 , 2019 and with a strong emphasis on using commodity malware . In 2015 , Kaspersky Lab researchers conducted Incident Response for 29 organizations located in Russia and infected by these three groups .


smishing ) . The targeting of mainly Saudi Arabian organizations across a wide variety of industries aligns with historical targeting patterns for the group , which appear undeterred following previous exposés of their activity . Kaspersky Lab is releasing crucial Indicators of Compromise ( IOCs ) and other data to help organizations search for traces of these attack groups in their corporate networks .


These SMS messages masquerade as a message from the local post office and link to the FakeSpy download . Towards the end of April 2019 , we tracked down what we believe to be new activity by APT10 , a Chinese cyber espionage group . In all , Kaspersky Lab discovered Metel in more than 30 financial institutions .


In a previous campaign reported by JPCERT , mobile users were alerted by phishy messages containing “ delivery updates ” purportedly from Sagawa Express . Almost 60% of the suspected APT33 domains that were classified to malware families related to njRAT infections , a RAT not previously associated with APT33 activity . It is highly likely that this threat is far more widespread and we urge financial institutions around the world to scan their networks for signs of the Metel malware .


Fake SMS message luring users to enter a fake website , which contains the malicious APK ( JPCERT report ) . Other commodity RAT malware families , such as AdwindRAT and RevengeRAT , were also linked to suspected APT33 domain activity . A second group , which we call GCMAN because the malware is based on code compiled on the GCC compiler , emerged recently using similar techniques to the Metel Group to infect banking institutions and attempt to transfer money to e-currency services .


Clicking the SMS link brings the user to a fake website that prompts them to download and install the FakeSpy APK , which is masquerading as a local postal service app . APT33 is an Iranian state-sponsored threat actor that has engaged in cyberespionage activities since at least 2013 . Our investigations revealed that the attackers drove around several cities in Russia , stealing money from ATMs belonging to different banks .


Targeting Postal and Transportation Services Companies One of the most significant findings is that new versions of FakeSpy target not only Korean and Japanese speakers , but also almost any postal service company around the world . Western and Saudi organizations in industries that have been historically targeted by APT33 should be monitoring geopolitical developments and increasing the scrutiny of operational security controls focusing on detection and remediation of initial unauthorized access , specifically from phishing campaigns , webshells . Once inside the network , the GCMAN group uses legitimate and penetration testing tools such as Putty , VNC , and Meterpreter for lateral movement .


Example of more recent FakeSpy campaigns targeting France . Symantec’s Elfin report denoted additional targeting of the engineering , chemical , research , finance , IT , and healthcare sectors . Our investigation revealed an attack where the GCMAN group then planted a cron script into bank 's server , sending financial transactions at the rate of $200 per minute .


New FakeSpy campaign applications leveraging fake postal services apps . We assess that the recent reporting on links between the Nasr Institute and Kavosh Security Group , as well as technical and persona analysis , overlaps among APT33 , APT35 , and MUDDYWATER , and is probably a result of the tiered structure that Iran utilizes to manage cyber operations . The GCMAN group used an MS SQL injection in commercial software running on one of bank 's public web services , and about a year and a half later , they came back to cash out .


All recent FakeSpy versions contain the same code with minor changes . Recorded Future has been monitoring APT33 activity , beginning with research published in October 2017 , which revealed new infrastructure , malware hashes , and TTPs relating to the threat actor(s) . During that time they poked 70 internal hosts , compromised 56 accounts , making their ACT from 139 attack sources ( TOR and compromised home routers ) .


The FakeSpy malware has been found to masquerade as any of the following companies : United States Postal Service - An independent agency of the executive branch of the United States federal government . FireEye also noted in their 2017 report that the online handle xman_1365_x , ” found within the PDB path in an APT33 TURNEDUP backdoor sample , belonged to an individual at the Nasr Institute . However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers .


USPS is the most well-known branch of the US government and provides a publicly funded postal service . Recorded Future’s Insikt Group has been monitoring APT33 activity , beginning with research published in October 2017 , which revealed new infrastructure , malware hashes , and TTPs relating to the threat actor(s) . Kaspersky Lab 's research team responded to three financial institutions in Russia that were infected with the GCMAN malware .


Royal Mail - British postal service and courier company . Based on this information , it is possible that upon the exposure of the Nasr Institute as a front for Iranian state-sponsored offensive cyber activity , employees transitioned over to other entities , such as Kavosh , to protect their identities and minimize further exposure . In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company .


For most of its history it operated as a government department or public corporation . Insikt Group researchers used proprietary methods , including Recorded Future Domain Analysis and Recorded Future Network Traffic Analysis , along with other common analytical approaches , to profile recently reported Iranian threat actor APT33’s domain and hosting infrastructure in an effort to identify recent activity . Recently Subaat drew our attention due to renewed targeted attack activity .


Deutsche Post - Deutsche Post DHL Group , a German multinational package delivery and supply chain management company headquartered in Bonn . Insikt Group enumerated all domains reported as being used by APT33 since January 2019 . Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec , in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking , which we are calling Gorgon Group .


La Poste - La Poste is a public limited postal service company in France . PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more . Starting in February 2018 , Palo Alto Networks identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


Japan Post - A private Japanese post , logistics and courier headquartered in Tokyo . Using data from Recorded Future Domain Analysis and combining it with data derived from Recorded Future Network Traffic Analysis , Insikt Group researchers were able to identify a small selection of likely targeted organizations impacted by suspected APT33 activity . Starting in February 2018 , Palo Alto Networks Unit 42 identified a


Yamato Transport - One of Japan 's largest door-to-door delivery service companies , also in Tokyo . Following the exposure of a wide range of their infrastructure and operations by Symantec earlier this year , we discovered that APT33 , or closely aligned actors , reacted by either parking or reassigning some of their domain infrastructure . of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


Chunghwa Post - The government-owned corporation Chunghwa is the official postal service of Taiwan . Since late March , suspected APT33 threat actors have continued to use a large swath of operational infrastructure , well in excess of 1 , 200 domains , with many observed communicating with 19 different commodity RAT implants . The GCMAN group has moved beyond banks and is now targeting the budgeting and accounting departments in any organization of interest to them , using the same APT-style tools and techniques .


Swiss Post - The national postal service of Switzerland , a fully state-owned limited company ( AG ) regulated by public law . While we haven’t observed a widespread targeting of commercial entities or regional adversaries like in previously documented APT33 operations , the handful of targeted organizations that we did observe were mainly located in Saudi Arabia across a range of industries , indicating ongoing targeting aligned with geopolitical aims . Starting in February 2018 , Unit 42 identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


The fake applications are built using WebView , a popular extension of Android ’ s View class that lets the developer show a webpage . The zip contained a sample of the Poison Ivy malware which is also known to be used by APT10 . APT38 's increasingly aggressive targeting against banks .


FakeSpy uses this view to redirect users to the original post office carrier webpage on launch of the application , continuing the deception . The new malware families , which we will examine later in this post , show APT34 relying on their PowerShell development capabilities , as well as trying their hand at Golang . Gorgon Group used common URL shortening services to download payloads .


This allows the application to appear legitimate , especially given these applications icons and user interface . Additionally , with the assistance of our FireEye Labs Advanced Reverse Engineering (FLARE) , Intelligence , and Advanced Practices teams , we identified three new malware families and a reappearance of PICKPOCKET , malware exclusively observed in use by APT34 . The GCMAN group has moved beyond banks and is now targeting the budgeting and accounting departments in any organization of interest to them , using the same APT-style tools and techniques .


New FakeSpy applications masquerading as post office apps . This threat group has conducted broad targeting across a variety of industries operating in the Middle East; however , we believe APT34's strongest interest is gaining access to financial , energy , and government entities . APT38 has paralleled North Korea 's worsening financial condition .


FAKESPY CODE ANALYSIS Once the user clicks on the malicious link from the SMS message , the app asks them to approve installation from unknown resources . Additionally , with the assistance of FireEye Labs , we identified three new malware families and a reappearance of PICKPOCKET , malware exclusively observed in use by APT34 . On much of the C2 infrastructure we identified several crimeware family samples .


This configuration can be toggled on by going to ‘ Settings ’ - > ‘ Security ’ - > ‘ Unknown Resources ’ . APT34 is an Iran-nexus cluster of cyber espionage activity that has been active since at least 2014 . While investigating the domains and infrastructure used by the phishing components of Gorgon Group , Unit 42 researchers witnessed several common operational security flaws with Gorgon Group 's actors throughout their many campaigns .


PackageInstaller shows the app ’ s permission access and asks for the user 's approval , which then installs the application . This CPE was created to ensure our customers are updated with new discoveries , activity and detection efforts related to this campaign , along with other recent activity from Iranian-nexus threat actors to include APT33 , which is mentioned in this updated FireEye blog post . 360 and Tuisec already identified some Gorgon Group members .


This analysis dissects FakeSpy ’ s Chunghwa Post app version , which emerged in April 2020 . On June 19 , 2019 , FireEye’s Managed Defense Security Operations Center received an exploit detection alert on one of our FireEye Endpoint Security appliances . RATs such as NjRat and infostealers like Lokibot were leveraging the same C2 infrastructure as that of the targeted attacks .


During the installation , the malware asks for the following permissions : READ_PHONE_STATE - Allows read-only access to the phone state , including the current cellular network information , the status of any ongoing calls , and a list of any PhoneAccounts registered on the device . A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests , TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution . it 's not known if the attackers physically reside in Pakistan .


READ_SMS - Allows the application to read text messages . FireEye’s Advanced Practices and Intelligence teams were able to identify additional artifacts and activity from the APT34 actors at other victim organizations . Gorgon used numerous decoy documents and phishing emails , both styles of attacks lacked overall sophistication .


RECEIVE_SMS - Allows the application to receive SMS messages . Of note , FireEye discovered two additional new malware families hosted at this domain , VALUEVAULT and LONGWATCH . While it 's not known if the attackers physically reside in Pakistan , all members of Gorgon Group purport to be in Pakistan based on their online personas .


WRITE_SMS - Allows the application to write to SMS messages stored on the device or SIM card , including y deleting messages . This tool was previously observed during a Mandiant incident response in 2018 and , to date , solely utilized by APT34 . Starting in mid-February , Unit 42 researchers have been tracking an active campaign sharing a significant portion of infrastructure leveraged by Gorgon Group for criminal and targeted attacks .


SEND_SMS - Allows the application to send SMS messages . PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file . Unit 42 researchers have been tracking Gorgon Group for criminal and targeted attacks .


INTERNET - Allows the application to open network sockets . FireEye detects this activity across our platforms , including named detection for TONEDEAF , VALUEVAULT , and LONGWATCH . As part of the investigation , Unit 42 researchers were able to identify an interesting characteristic about how the Gorgon Group crew uses shared infrastructure between cybercrime and targeted attacks .


WRITE_EXTERNAL_STORAGE - Allows the application to write to external storage . Several spear-phishing campaigns attributed to Carbanak , all occurring between March and May 2018 , were analyzed by security researchers in 2018 . The crew combines both regular crime and targeted attack objectives using the same domain infrastructure over time , rarely changing their TTPs .


READ_EXTERNAL_STORAGE - Allows the application to read from external storage . One of the most prolific APT-style cyberattacks , specifically targeting the financial sector , is known as Carbanak . One interesting note about the criminal activity of Gorgon Group is their usage of Bitly .


RECEIVE_BOOT_COMPLETED - Allows the application to receive a broadcast after the system finishes booting . Discovered in 2014 , the campaign quickly gained notoriety after compromising the security systems of 100 banks in 40 countries and stealing up to $1 billion in the process . Between April 1 , 2018 and May 30 , 2018 , we observed the domain stevemike-fireforce.info used in a Gorgon Group cybercrime campaign involving more than 2,300 emails and 19 documents in the initial attack .


GET_TASKS - Allows the application to get information about current or recently run tasks . The same group is believed to have also been using the Cobalt Strike framework to run sophisticated campaigns , plotting and performing financial heists of financial institutions . Similar to that of their targeted attacks , Gorgon Group leveraged Bitly for distribution and shortening of C2 domains .


( deprecated in API level 21 ) SYSTEM_ALERT_WINDOW - Allows the application to create windows shown on top of all other apps . Banks in countries such as Russia , the United Kingdom , the Netherlands , Spain , Romania , Belarus , Poland , Estonia , Bulgaria , Georgia , Moldova , Kyrgyzstan , Armenia , Taiwan and Malaysia have allegedly been targeted with spearphishing emails , luring victims into clicking malicious URLs and executing booby-trapped documents . Beginning in early March 2018 , Unit 42 started observing targeted attacks against Russian , Spanish and United States government agencies operating in Pakistan .


WAKE_LOCK - Allows the application to use PowerManager WakeLocks to keep the processor from sleeping or the screen from dimming . A Carbanak trademark in cyberattacks remains the use of Cobalt Strike – a powerful pentesting tool designed for exploiting and executing malicious code , simulating post-exploitation actions of advanced threat actors – which allows them to infiltrate the organization , move laterally , exfiltrate data , and deploy anti-forensic and evasion tools . Leveraging click counts for the campaign for Bitly , we were able to see Gorgon Group 's activity volume increase throughout April .


ACCESS_NETWORK_STATE - Allows the application to access information about networks . However , this action doesn’t appear to have made a dent in the cybercriminal organization , as subsequent spear-phishing campaigns seem to have been reported from March until May 2018 . As we continued to investigate , it became apparent that Gorgon Group had been consistently targeting worldwide governmental organizations operating within Pakistan .


REQUEST_IGNORE_BATTERY_OPTIMIZATIONS - Whitelists the application to allow it to ignore battery optimizations . Bitdefender’s forensics and investigation team was contacted to look into a security incident that started in May 2018 with an email received by two of the bank’s employees . Starting in mid-February .


READ_CONTACTS - Allows the application to read the user 's contacts data . The Carbanak group , which has a long track record of compromising infrastructure belonging to financial institutions , is still active . Additionally , during that time , members of Gorgon Group were also performing criminal operations against targets across the globe , often using shared infrastructure with their targeted attack operations .


FakeSpy package permissions . Its purpose remains to manipulate financial assets , such as transferring funds from bank accounts or taking over ATM infrastructures and instructing them to dispense cash at predetermined time intervals . Unit 42 researchers have been tracking an active campaign .


On opening the app , two pop-up messages appear on screen : Change SMS App : This sets permissions to intercept every SMS received on the device and send a copy of these messages to the C2 server . If the attack had succeeded , it would have given hackers control over the ATM network , while money mules would have been standing by the ATM machines at pre-set time intervals to cash them out . This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


Ignore Battery Optimization : This sets permissions to continue to operate at full capacity while the phone 's screen is turned off and the phone locked . The actors uploaded a variety of tools that they used to perform additional activities on the compromised network , such as dumping credentials , as well as locating and pivoting to additional systems on the network . Beginning in early March 2018 , Unit 42 started observing Gorgon group attacks against Russian , Spanish and United States government agencies operating in Pakistan .


These requests rely on the end user accepting the permission changes and points to the importance of healthy skepticism when giving applications permissions . We believe Emissary Panda exploited a recently patched vulnerability in Microsoft SharePoint tracked by CVE-2019-0604 , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell . Like all of Gorgon Group 's members , Fudpage 's online profile , infrastructure utilization and standardization , connects them back to Gorgon Group .


FakeSpy Chunghwa Post version installation process and application UI . Bitdefender’s investigation shows the attackers’ main methods remain to quietly infiltrate the infrastructure by establishing a foothold on an employee’s system , then move laterally across the infrastructure or elevate privileges to find critical systems that manage financial transactions or ATM networks . Ultimately , this lead us to the conclusion that several of Gorgon Group 's members have a nexus in Pakistan .


DYNAMIC LIBRARY LOADING Once the application has finished the installation process , the malware starts its real malicious activity . We also found the China Chopper webshell on the SharePoint servers , which has also been used by the Emissary Panda threat group . Gorgon Group isn't the first actor group we've witnessed dabble in both nation state level and criminal attacks .


The malicious application da.hao.pao.bin ( Chunghwa Post ) loads a library file libmsy.so used to execute the packed mycode.jar file . Of particular note is their use of tools to identify systems vulnerable to CVE-2017-0144 , which is the same vulnerability exploited by EternalBlue that is best known for its use in the WannaCry attacks of 2017 . Overall , in spite of the lack of sophistication in Gorgon Group 's activity , they were still relatively successful ; once again proving that simple attacks on individuals without proper protections , work .


The JAR file is the decrypted version of the file tong.luo , which is located in the assets folder . In addition to the aforementioned post-exploitation tools , the actors used these webshells to upload legitimate executables that they would use DLL sideloading to run a malicious DLL that has code overlaps with known Emissary Panda attacks . On January 15 , Advanced Threat Research discovered an operation using a new variant of the SYSCON backdoor .


Decompiled APK resources . This webshell activity took place across three SharePoint servers hosted by two different government organizations between April 1 , 2019 and April 16 , 2019 , where actors uploaded a total of 24 unique executables across the three SharePoint servers . The Korean-language Word document manual.doc appeared in Vietnam on January 17 , with the original author name of Honeybee .


By comparing the sizes of the encrypted asset file tong.luo vs the decrypted JAR file mycode.jar , it is interesting to note that it is the same file ( almost the same size ) . The timeline shows three main clusters of activity across the three webshells , with activity occurring on two separate webshells (green and orange) within a very small window of time on April 2 , 2019 and the activity involving the third webshell two weeks later on April 16 , 2019 . While Gorgon Group has been making minor changes in their methodologies , they are still actively involved in both targeted and criminal attacks .


Comparing encrypted vs decrypted asset file . In April 2019 , several national security organizations released alerts on CVE-2019-0604 exploitation , including the Saudi Arabian National Cyber Security Center and the Canadian Center for Cyber Security . This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON , which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics .


After libmsy.so decrypts the asset file tong.luo , it loads mycode.jar dynamically into FakeSpy ’ s process , as is shown from the output of the “ adb logcat ” command . Based on the functionality of the various tools uploaded to the webshells , we believe the threat actors breach the SharePoint servers to use as a beachhead , then attempt to move laterally across the network via stolen credentials and exploiting vulnerabilities . This key was also used in the Honeybee campaign and appears to have been used since August 2017 .


Logcat logs show FakeSpy uses libmsy.so to execute the malicious packed mycode.jar file . We also observed the actors uploading custom backdoors such as HyperBro which is commonly associated with Emissary Panda . Several additional documents surfaced between January 17 and February 3 .


By analyzing running processes on the infected device , it shows that the malware creates a child process of itself to perform the multi-process ptrace anti-debugging technique . Both of these alerts discussed campaigns in which actors used the CVE-2019-0604 to exploit SharePoint servers to install the China Chopper webshell . All contain the same Visual Basic macro code and author name as Honeybee .


FakeSpy uses an anti-debugging technique by creating another child process of itself . During our research into this attack campaign , Unit 42 gathered several tools that the Emissary Panda uploaded to the three webshells at the two government organizations . Some of the malicious documents were test files without the implant .


By performing a deep analysis of the malware , we were able to extract the unpacked JAR file mycode.jar and reveal some very interesting code . We also observed the actors uploading the HyperBro backdoor to one of the webshells , as well as legitimate executables that would sideload malicious DLLs that have overlapping code associated with known Emissary Panda activity . From our analysis , Honeybee submitted most of these documents from South Korea , indicating that some of the targeting was in South Korea .


STEALING SENSITIVE INFORMATION FakeSpy has multiple built in information stealing capabilities . Lastly , we saw the actor uploading a custom backdoor called HyperBro , which has been associated with Emissary Panda operations in the past . Honeybee attacked beyond the borders of South Korea to target Vietnam , Singapore , Argentina , Japan , Indonesia , and Canada .


The first function is used for contact information stealing : the function upCon steals all contacts in the contact list and their information . The other overlapping files are tools used by the adversary to locate other systems on the network etool.exe , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 checker1.exe and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket psexec.exe . Honeybee appears to target humanitarian aid and inter-Korean affairs .


Then , it sends it to the C2 server using the URL that ends with /servlet/ContactUpload . Also , the NCSC advisory mentioned that the actors used a file name stylecss.aspx for their webshell , which is the same filename we saw associated with China Chopper . McAfee Advanced Threat Research team 's analysis , we find multiple components from this operation are unique from a code perspective , even though the code is loosely based on previous versions of the SYSCON backdoor .


The stolen data fields are : Mobile - The infected device phone number and contact ’ s phone number Contacts - A headline used for the attacker to distinguish between the type of stolen information he gets Name - Contact ’ s full name ( Display name ) upCon ( upload contact ) function used for stealing contact list information . We will provide an analysis of the HyperBro tool in an upcoming section . Large-scale cyber espionage campaigns such as " GhostNet " .


For testing purposes we inserted a fake contacts list to our Android Emulator and observed resultant behavior . However , using NCC Group’s research published in May 2018 , we were able to discover code overlaps between these DLLs and a sideloaded DLL that ran the SysUpdate tool that the NCC group has associated with an Emissary Panda campaign . As the crisis in Syria escalates , FireEye researchers have discovered a cyber espionage campaign , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe .


Exfiltrated contact list data sent to the C2 server . The list also includes several hack tools , such as Mimikatz for credential dumping and several compiled python scripts used to locate and compromise other systems on the local network . As the crisis in Syria escalates , FireEye researchers have discovered a threat group , which we call " Ke3chang " , that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe .


The second stealing function is the onStartCommand , which steals infected device data and additional information . Unfortunately , we do not have access to the PYTHON33.hlp or CreateTsMediaAdm.hlp files , so we do not know the final payload loaded by either of these DLLs . We believe that the Ke3chang attackers are operating out of China and have been active since at least 2010 .


The stolen data is sent to the C2 server using the URL ending with /servlet/xx . Figure 9 shows a code comparison between the PYTHON33.dll (right) and inicore_v2.3.30.dll (left) (SHA256: 4d65d371a789aabe1beadcc10b38da1f998cd3ec87d4cc1cfbf0af014b783822) , which was sideloaded to run the SysUpdate tool in a previous Emissary Panda campaign . FireEye gained visibility into one of 23 known command-and-control ( CnC ) servers operated by the Ke3chang actor for about one week .


The stolen data fields are : Mobile - The infected device phone number Machine - The device model ( in our example : Google Pixel 2 ) Sversion - The OS version Bank - Checks if there are any banking-related or cryptocurrency trading apps Provider - The telecommunication provider ( IMSI value in device settings ) npki - Checks if the folder named NPKI ( National Public Key Infrastructure ) might contain authentication certificates related to financial transactions onStartCommand function for stealing device information and additional sensitive data . The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 . Each attack comprises a variety of phases , including reconnaissance , exploitation , command and control , lateral movement , and Exfiltration .


Exfiltrated device information and additional sensitive data sent to the C2 server . The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell . The Ke3chang attackers have been active since at least 2010 .


FakeSpy asks to be the default SMS app because it uses the function onReceive to intercept incoming SMS messages . According to Microsoft’s advisory , this vulnerability was patched on March 12 , 2019 and we first saw the webshell activity on April 1 , 2019 . traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


It saves the messages ’ metadata and content , filters the information by fields , and sends them to the C2 server using the URL /servlet/SendMassage2 . We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 . The Ke3chang have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , chemicals , manufacturing , mining sectors .


The fields it collects are : Mobile - The phone number which sent the SMS Content - The message body Sender - The contact name who sent the message Time - The time the message was received onReceive function used to intercept incoming SMS messages . Once the adversary established a foothold on the targeted network , they used China Chopper and other webshells to upload additional tools to the SharePoint server to dump credentials , perform network reconnaissance and pivot to other systems . August 2013 , FireEye gained visibility on one of 22 CnC servers used at that time by the Ke3chang attackers .


The malware uses the function sendAll to send messages that spread the malware to other devices . We also observed Emissary Panda uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before . In this report , we present the historical intelligence we have gathered on the Ke3chang campaign , as well as an in-depth assessment of the ongoing Syrian-themed attacks against these MFAs .


It sends a smishing message to the entire contact list of the infected device along with the malicious link to the FakeSpy installation page . Consequently , the Linux malware ecosystem is plagued by financial driven crypto-miners and DDoS botnet tools which mostly target vulnerable servers . Ke3chang attackers have used spear-phishing emails .


sendAll function used to spread malicious messages to the contact list . We also observed the actors uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before . Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


Another interesting feature in FakeSpy ’ s code is the collection of the device 's IMEI ( International Mobile Station Equipment Identity ) number and all installed applications using the function upAppinfos . It has been active since at least 2013 , and has targeted individuals likely involved with the Ukrainian government . Traditionally , the Ke3chang attackers have used spear-phishing emails with either a malware attachment or a link to a malicious download .


It sends all of this data to the C2 server using the URL ending with /servlet/AppInfos . The group’s implants are characterized by the employment of information stealing tools among them being screenshot and document stealers delivered via a SFX , and made to achieve persistence through a scheduled task . Over the years , the Ke3chang attackers have used three types of malware that we call : " BS2005 " , " BMW " , and " MyWeb " .


upAppinfos function used for obtaining the device IMEI and all of its installed applications . The finding shows that EvilGnome operates on an IP address that was controlled by the Gamaredon group two months ago . it is a typical first stage backdoor commonly found in APT attacks .


FakeSpy is able to check the network connectivity status by using the function isNetworkAvailable . FIN7 operations are linked to numerous intrusion attempts having targeted hundreds of companies since at least as early as 2015 . The attackers have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


What makes this function more suspicious is the two strings written in Chinese characters : ===状态=== ( ===Status=== ) - Checks whether the device is connected to a network ===类型=== ( ===Type=== ) - Checks whether the device sees available nearby Wifi networks isNetworkAvailable function used for monitoring network connectivity status . The FIN7 intrusion set continued its tailored spear phishing campaigns throughout last year . All of the CnC communications are performed over the HTTP protocol .


ANTI-EMULATOR TECHNIQUES FakeSpy appears to use multiple techniques to evade detection via the emulator . In addition , during the investigation , we discovered certain similarities to other attacker groups that seemed to share or copy the FIN7 TTPs in their own operations . The current Ke3chang campaign leverages the BS2005 malware , while older activity from 2010 - 2011 leveraged BMW , followed by the MyWeb malware sporadically used in between .


It shows that the malware can detect whether it ’ s running in an emulated environment or a real mobile device , and can change its code pattern accordingly . In 2018-2019 , researchers of Kaspersky Lab’s Global Research and Analysis Team analyzed various campaigns that used the same Tactics Tools and Procedures (TTPs) as the historic FIN7 , leading the researchers to believe that this threat actor had remained active despite the 2018 arrests . A trait common to all three malware families we analyzed is that they use the IWebBrowser2 COM interface to perform their CnC communication .


The first example of this is in the onStart function , where the malware looks for the string “ Emulator ” and a x86 processor model . One of the domains used by FIN7 in their 2018 campaign of spear phishing contained more than 130 email HackOrges , leading us to think that more than 130 companies had been targeted by the end of 2018 . Three months after the Olympics-themed attacks , FireEye observed a new BS2005 campaign labeled " newtiger " , which is possibly a reference to an older 2010 campaign labeled " tiger " .


Anti-emulator code . Interestingly , following some open-source publications about them , the FIN7 operators seems to have developed a homemade builder of malicious Office document using ideas from ThreadKit , which they employed during the summer of 2018 . Using information from the FireEye DTI cloud , FireEye observed that Ke3chang targeted a single firm .


In order to simulate this technique , we took two videos side by side of how FakeSpy ( the Royal Mail sample ) behaves differently on a physical device versus an emulator . The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation . The Ke3chang attackers used the older " MyWeb " malware family from 2010 to 2011 .


FakeSpy behavior on physical device vs emulator ( anti-emulator ) . The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method . The Ke3chang attackers used the older MyWeb malware family from 2010 to 2011 .


This simulation shows that FakeSpy behaves differently on a physical device versus an emulator . Given FIN7’s previous use of false security companies , we decided to look deeper into this one . During our period of visibility into the BS2005 " moviestar " campaign against various ministries of foreign affairs in Europe , FireEye discovered that the Ke3chang had initially tested the malware in virtual machines , prior to compromising actual targets .


When executed the second time by clicking on the app on the physical device , FakeSpy redirects to the app settings . This activity cluster , which Kaspersky Lab has followed for a few years , uses various implants for targeting mainly banks , and developers of banking and money processing software solutions . The MyWeb sample that FireEye analyzed has a compile date of 1/20/2011 .


In contrast , on the emulator , a toast message is displayed that shows “ Install completed ” , at which point FakeSpy removes its shortcut from the device 's homescreen . FIN7’s last campaigns were targeting banks in Europe and Central America . At least one of the attacks in this campaign leveraged a European security and defense-themed lure , which aligns with the targeting preferences for this group .


Another example of FakeSpy ’ s anti-emulation techniques is how it uses the getMachine function , which uses the TelephonyManager class to check for the deviceID , phone number , IMEI , and IMSI . After a successful penetration , FIN7 uses its own backdoors and the CobaltStrike framework or Powershell Empire components to hop to interesting parts of the network , where it can monetize its access . MyWeb is the second-generation malware used by Ke3chang .


Some emulators build their phone number out of the default number created in the emulator software and the port number : 5554. getMachine function using anti-emulator technique . AveMaria is a new botnet , whose first version we found in September 2018 , right after the arrests of the FIN7 members . ministries of foreign affairs in Europe have been targeted and compromised by a threat actor we call Ke3chang .


UNDER ACTIVE DEVELOPMENT An analysis of new FakeSpy samples to old ones showed code discrepancies and new features . This threat actor stole suspected of stealing €13 million from Bank of Valetta , Malta earlier this year . This attack used the crisis in Syria as a lure to deliver malware to its targets .


These artifacts indicate that FakeSpy 's campaign is still live and under development . In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger . Tracking the malicious activities of the elusive Ke3chang APT group , ESET researchers have discovered new versions of malware families linked to the group , and a previously unreported backdoor .


The newer version of FakeSpy uses new URL addresses for malicious communication with FakeSpy . They also use AutoIT droppers , password-protected EXE files and even ISO images . Furthermore , FireEye has presented evidence indicating that the Ke3chang attackers have been active since at least 2010 and have attacked targets related to G20 meetings in the past .


The function main uses a DES encryption algorithm to encode these addresses . To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT . During our brief window of visibility into one of the known 22 CnC nodes , FireEye observed the Ke3chang conducting reconnaissance and moving laterally throughout the compromised networks .


The examples below show the plaintext key “ TEST ” to decrypt encoded hexadecimal strings ( jUtils.decrypt ( ) ) . Interestingly , this actor targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center . Ke3chang attackers are operating within China .


These encoded strings contain the new URL addresses not seen in older versions of FakeSpy . At the end of 2018 , while searching for new FIN7 campaigns via telemetry , we discovered a set of activity that we temporarily called CopyPaste” from a previously unknown APT . In May 2017 , NCC Group 's Incident Response team reacted to an ongoing incident .


Comparing strings from an old FakeSpy sample to a new one . FIN7 and Cobalt used decoy 302 HTTP redirections too , FIN7 on its GRIFFON C2s before January 2018 , and Cobalt , on its staging servers , similar to CopyPaste . which provides a range of services to UK Government .


WHO IS BEHIND FAKESPY ’ S SMISHING CAMPAIGNS ? Quite recently , FIN7 threat actors typosquatted the brand Digicert” using the domain name digicert-cdn[.]com , which is used as a command and control server for their GRIFFON implants . APT15 was targeting information related to UK government departments and military technology .


The Cybereason Nocturnus team suspects that the malware operators and authors are Chinese speakers . The first of them is the well-known FIN7 , which specializes in attacking various companies to get access to financial data or PoS infrastructure . backdoors that now appear to be part of APT15 's toolset .


Our findings , along with previous research , indicates that the threat actor behind these recent campaigns is likely a Chinese group dubbed “ Roaming Mantis ” . The second one is CobaltGoblin Carbanak EmpireMonkey , which uses the same toolkit , techniques and similar infrastructure but targets only financial institutions and associated software/services providers . This report demonstrates that Ke3chang is able to successfully penetrate government targets using exploits for vulnerabilities that have already been patched and despite the fact that these ministries have defenses in place .


Roaming Mantis is believed to be a Chinese threat actor group first discovered in April 2018 that has continuously evolved . We observe , with various level of confidence , that there are several interconnected groups using very similar toolkits and the same infrastructure to conduct their cyberattacks . RoyalDNS - required APT15 .


In the beginning , this threat group mainly targeted Asian countries . The last piece is the newly discovered CopyPaste group , who targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center . The Ke3chang group also used keyloggers and their own .NET tool to enumerate folders and dump data from Microsoft Exchange mailboxes .


Now , they are expanding their activity to audiences all around the world . At the end of 2018 , the cluster started to use not only CobaltStrike but also Powershell Empire in order to gain a foothold on the victims’ networks . APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets .


As part of their activities , they are known for hijacking DNS settings on Japanese routers that redirect users to malicious IP addresses , creating disguised malicious Android apps that appear as popular apps , stealing Apple ID credentials by creating Apple phishing pages , as well as performing web crypto mining on browsers . FIN7 thus continues to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework . This time , APT15 opted for a DNS based backdoor : RoyalDNS .


CONNECTION TO CHINA Chinese server infrastructure : FakeSpy applications send stolen information to C2 domains with .club TLDs and URLs ending with /servlet/ [ C2 Command ] ( mentioned above in the “ Stealing Sensitive Information ” section ) . MuddyWater is widely regarded as a long-lived APT group in the Middle East . APT15 then used a tool known as RemoteExec .


All of these domains are registered to ‘ Li Jun Biao ’ on Bizcn , Inc , a Chinese Internet application service provider . From February to April 2019 , MuddyWater launched a series of spear-phishing attacks against governments , educational institutions , financial , telecommunications and defense companies in Turkey , Iran , Afghanistan , Iraq , Tajikistan and Azerbaijan . APT15 then used a tool known as RemoteExec ( similar to Microsoft .


Chinese language traces in the code : During the investigation , the Cybereason Nocturnus team discovered code artifacts that may indicate Chinese threat actors . FIN7 thus continue to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework . Coincidentally , following the recent hack of a US Navy contractor and theft of highly sensitive data on submarine warfare , we have found evidence of very recent activity by a group referred to as APT15 , known for committing cyber espionage which is believed to be affiliated with the Chinese government .


For example , we found several suspicious strings written in the Chinese language in a function called isNetworkAvailable , previously discussed in this blog : An almost identical function is mentioned in an earlier research , that ties FakeSpy and other malware to the Roaming Mantis group . We also unearthed and detailed our other findings on MuddyWater , such as its connection to four Android malware variants and its use of false flag techniques , among others , in our report New MuddyWater Activities Uncovered: Threat Actors Used Multi-Stage Backdoors , False Flags , Android Malware , and More . APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more .


Chinese APK names : Some of FakeSpy ’ s APK package names contain anglicized Chinese ( Mandarin ) words that might be related to Chinese songs and lyrics , food , provinces , etc . Instead , the campaign used compromised legitimate accounts to trick victims into installing malware . Other names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon .


CONCLUSIONS FakeSpy was first seen in October 2017 and until recently mainly targeted East Asian countries . Notably , the group’s use of email as infection vector seems to yield success for their campaigns . ther names for the group are Vixen Panda , Ke3chang , Royal APT , and Playful Dragon .


Our research shows fresh developments in the malware ’ s code and sophistication , as well as an expansion to target Europe and North America . We also observed MuddyWater’s use of multiple open source post-exploitation tools , which they deployed after successfully compromising a target . There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group .


This mobile malware masquerades as legitimate , trusted postal service applications so that it can gain the users trust . The attacker also connected to the compromised servers from IP addresses that were linked to dynamic domain names used as C&Cs by the delivered payloads . There are many articles and researches online about APT15 and their activities , the most recent one by NCC Group ; although posted in March 2018 , it refers to a campaign in 2017 .


Once it has been installed , it requests permissions from the user so that it can steal sensitive data , manipulate SMS messages , and potentially infect contacts of the user . The main payload is usually Imminent Monitor RAT; however , at the beginning of 2018 , we also observed the use of LuminosityLink RAT , NetWire RAT , and NjRAT . both attributed to Chinese government affiliated groups .


The malware now targets more countries all over the world by masquerading as official post office and transportation services apps . In a case in June 2019 , we also noticed Warzone RAT being used . DLL hijacking techniques have been seen in the past with the APT15 group .


These apps appear legitimate due to their app logo , UI appearance , and redirects to the carrier webpage -- all luring end users to believe it ’ s the original one . Xpert RAT reportedly first appeared in 2011 . cyber actors of the North Korean to target the media , aerospace , financial , and critical infrastructure sectors in the United States and globally .


In this blog , we showed that the threat actor behind the recent FakeSpy campaign is a Chinese-speaking group called “ Roaming Mantis ” known to operate mainly in Asia . The first version of Proyecto RAT” was published at the end of 2010 . The U.S. Government refers to the malicious cyber activity by the North Korean government as HIDDEN COBRA .


It is interesting to see that the group has expanded their operation to other regions , such as the United States and Europe . But with the West African gang we’ve named Scattered Canary , we have a deeper look at how business email compromise is connected to the rest of the cybercrime . Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets , keyloggers , remote access tools ( RATs ) , and wiper malware .


The malware authors seem to be putting a lot of effort into improving this malware , bundling it with numerous new upgrades that make it more sophisticated , evasive , and well-equipped . In a recent report , the FBI’s Internet Crime Complaint Center (IC3) reported that more than 20 , 000 businesses lost nearly $1.3 billion to BEC attacks in 2018 . Variants of malware and tools used by HIDDEN COBRA actors include Destover and Hangman .


These improvements render FakeSpy one of the most powerful information stealers on the market . This investigation by the Agari Cyber Intelligence Division into the cybercriminal group we’ve named Scattered Canary offers unprecedented visibility into eleven years of fraud and criminal activities , and the growth of a 419 startup into a fully operational BEC business . DHS has previously released Alert TA14-353A .


We anticipate this malware to continue to evolve with additional new features ; the only question now is when we will see the next wave . While this criminal organization’s activities now center around BEC , and extend to romance scams , credit card fraud , check fraud , fake job listings , credential harvesting , tax schemes , and more , these actors came from much humbler beginnings , starting with basic Craigslist scams in 2008 . The DeltaCharlie DDoS bot was originally reported by Novetta in their 2016 Operation Blockbuster Malware Report .


First Twitter‑controlled Android botnet discovered Detected by ESET as Android/Twitoor , this malware is unique because of its resilience mechanism . On November 29 , 2018 , Scattered Canary sent an attack email to Agari CFO Raymond Lim , enquiring as to his availability to send out a domestic wire transfer . Our analysis shows that the cybercriminals behind the attack against an online casino in Central America , and several other targets in late-2017 , were most likely the infamous Lazarus hacking group .


Instead of being controlled by a traditional command-and-control server , it receives instructions via tweets . Many feel that they have a home team advantage living in Nigeria , where they are free to pay off law enforcement to look the other way . The Lazarus Group was first identified in Novetta 's report Operation Blockbuster in February 2016 .


24 Aug 2016 - 02:05PM Android/Twitoor is a backdoor capable of downloading other malware onto an infected device . Scattered Canary’s fraudulent history can be traced as far back as October 2008 , when the group first arrived on the cybercriminal circuit . cyberattacks against high-value targets in Ukraine in December 2015 and December 2016 .


It has been active for around one month . By March 2016 , one of Scattered Canary’s members had built enough trust with a romance victim—who we’ll call Jane—that she became a frequent source of new mule accounts for the group . In all of these incidents , the Lazarus utilized similar toolsets , including KillDisk that was executed on compromised machines .


This malicious app , detected by ESET as a variant of Android/Twitoor.A , can ’ t be found on any official Android app store – it probably spreads by SMS or via malicious URLs . Alpha’s early role was fairly simple: engage with individuals , who he chose based on the goods they were selling , and then provide personal shipping addresses back to Omega . We are confident this KillDisk malware was deployed by Lazarus , rather than by another , unrelated attacker .


It impersonates a porn player app or MMS application but without having their functionality . By all accounts , late 2015 was the beginning of BEC for Scattered Canary . This recent attack against an online casino in Central America suggests that hacking tools from the Lazarus toolset are recompiled with every attack ( we didn't see these exact samples anywhere else ) .


After launching , it hides its presence on the system and checks the defined Twitter account at regular intervals for commands . The first type of attack Scattered Canary pivoted to was credential phishing . Utilizing KillDisk in the attack scenario most likely served one of two purposes : the attackers covering their tracks after an espionage operation , or it was used directly for extortion or cyber-sabotage .


Based on received commands , it can either download malicious apps or switch the C & C Twitter account to another one . Between July 2015 and February 2016 , Scattered Canary’s primary focus seemed to be mass harvesting general credentials using a Google Docs phishing page . Today we'd like to share some of our findings , and add something new to what 's currently common knowledge about Lazarus Group activities , and their connection to the much talked about February 2016 incident , when an unknown attacker attempted to steal up to $851M USD from Bangladesh Central Bank .