) Calculate the difference between this pointer and the User32 base address . While the recent paper from Trend Micro and ClearSky ( ' The Spy Kittens Are Back : Rocket Kitten 2 ' ) does extensively cover the campaign 's narrative , we aimed to seek confirmation that our analyzed attack was positively connected to the same campaign and set out to provide additional value and insight . After resolving the APIs , the shellcode will decrypt the launcher binary and load it to the memory . None After initial access via this new exploit method , the threat actor leveraged maintain access , and performed anti - forensics techniques on the Microsoft Exchange server in an attempt to hide their activity .


Copy the stage 5 DLL into winlogon.exe Allocate a chunk of memory in winlogon.exe process and copy the same APC routine seen previously Read and save the original pointer of the __fnDWORD internal User32 routine ( located at offset +0x10 of the KernelCallbackTable ) and replace this pointer with the address of the APC stub routine After this function pointer hijacking , when winlogon.exe makes any graphical call ( GDI ) , the malicious code can execute without using CreateRemoteThread or As the Rocket Kitten group 's behavior was well characterized in previous publications ( see the recent report from Trend Micro and ClearSky ) . MZ header , PE header , as well as each section and their header , are decrypted separately using RC4 algorithm and a hardcoded key . UNC2529 has also used weaponized Microsoft Excel documents as a first stage downloader .


similar triggers that are easily detectable . Magic Hound will often find simpler ways for effective compromise , such as creative phishing and simple custom malware . Once all sections are loaded , the relocations get fixed and the MZ/PE headers are zeroed out in memory . It is entirely possible that these threat actors will go as far as compromising close contacts of their targets .


After execution it takes care of restoring the original KernelCallbackTable . We present the connection between Behzad Mesri , an Iranian national recently indicted for his involvement in hacking HBO , and Charming Kitten . The shellcode then proceeds to execute the payload DLL’s entry point . It also reveals direct links to secure[.]66[.]to and zhu[.]vn , both of which also belong to Hack520 and contains his personal blog .


Stage 5 : The final loader takes control The stage 5 malware is needed only to provide one more layer of obfuscation , through the VM , of the final malware payload and to set up a special Structured Exception Hander routine , which is inserted as Wow64PrepareForException in Ntdll . Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as Oilrig1 and CopyKittens2 . The Internal name of this DLL is a randomly looking CLSID and it only exports one function called DllEntry . When exploiting these flaws , the threat actor almost always deploys a tunneling tool , the most common of which are Fast Reverse Proxy Client FRPC and Plink .


This special exception handler is needed to manage some memory buffers protection and special exceptions that are used to provide more stealthy execution . A case of these obscure lines can be found in a blogpost published in coordination and parallel to this report - " Flying Kitten to Rocket Kitten , A Case of Ambiguity and Shared Code " 3 by Collin Anderson and Claudio Guarnieri . Upon execution , the launcher will attempt to hook legitimate wininet.dll library by overwriting its entry point in memory with the address of a malicious routine . During the course of researching the Winnti group , we came across previously unreported malware samples that we attributed to the group based on the malware arsenal and the use of registered domains as attack infrastructure .


After the VM code has checked again the user environment , it proceeds to extract and execute the final un-obfuscated payload sample directly into winlogon.exe ( alternatively , into explorer.exe ) process . FireEye 's publication of " Operation Saffron Rose " report , which described Flying Kitten 's operations against aviation firms , led to the dismantling of Flying Kitten 's infrastructure and the apparent end of its activities . If successful , every time the system loads wininet.dll , the entry point of the subsequently dropped backdoor DLL will be executed before the original wininet entry point . They have employed many unique capabilities , including gaining initial access through a software supply chain vulnerability .


After the payload is extracted , decrypted , and mapped in the process memory , the malware calls the new DLL entry point , and then the RunDll exported function . To sum up , the HBO hacker - Behzad Mesri is a member of Turk Black Hat along with ArYaIeIrAn , who provides infrastructure for Charming Kitten activity via PersianDNS / Mahanserver together with Mohammad Rasoul Akbari , who is a Facebook friend of Behzad Mesri 's . There is no proper DLL injection routine – the payload is just decompressed to the memory as-is – so the malware needs to fix all the pointers in the decompressed code , which is done on a one-by-one basis using hardcoded values and offsets . The output is then executed using and the return value is checked to determine the functions return value , if it is 0 , return 0 if not , it will call twice


The latter implements the entire spyware program . Charming kitten regularly target international media outlets with Persian-language services . This part takes 90% of the whole launcher code and includes over 11 , 000 modifications . The second , CVE-2022 - 41080 , has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022 - 41040 used in the ProxyNotShell exploit chain , and it has been marked “ exploitation more likely . ”


Stage 6 : The payload is a modular spyware framework for further analysis Our journey to deobfuscating FinFisher has allowed us to uncover the complex anti-analysis techniques used by this malware , as well as to use this intel to protect our customers , which is our top priority . It was a decoy to make visitor download a " Flash Player " , which was in fact DownPaper malware , analyzed later in this report . The launcher then calls the backdoor DLL’s entry point . Mandiant assesses that DPRK ’s


Analysis of the additional spyware modules is future work . In addition to using PlugX and Poison Ivy ( PIVY ) , both known to be used by the group , they also used a new Trojan called " ChChes " by the Japan Computer Emergency Response Team Coordination Center ( JPCERT ) . The routine that reads configuration from resources and decompresses the C2 communication library is then called by temporarily replacing the pointer to CComCriticalSection function with the pointer to that routine . Another detection opportunity identified by Mandiant was source IP addresses that access multiple user accounts in a short period of time recorded in the ns.log files or forwarded logs via syslog .


It is evident that the ultimate goal of this program is to steal information . Wapack labs also observed a similar sample targeting Japan in November . Such an obfuscation method makes it difficult to spot it in the code . Additional protections with context to your specific environment and threat data are available from the Firewall Management Center .


The malware architecture is modular , which means that it can execute plugins . MenuPass spoofed several sender email addresses to send spear phishing emails , most notably public addresses associated with the Sasakawa Peace Foundation and The White House . The launcher loads configuration from resources and uses an export from the backdoor DLL to initialize config values in memory . The executable within this not only played a very funny video , but dropped and ran another CozyDuke executable .


The plugins are stored in its resource section and can be protected by the same VM . menuPass typically makes use of a mix of DDNS and actor-registered domains in their attack campaigns . Resource P1/1 contains config values , including port number and a registry path . This includes hosting C&C domains that were used by Winnti such as mtrue.com , shenqi[.]kr and zhu[.]kr .


The sample we analyzed in October , for example , contains a plugin that is able to spy on internet connections , and can even divert some SSL connections and steal data from encrypted traffic . There is not much public information about the APT campaign called menuPass ( also known as Stone Panda and APT10 ) . After the content of resource 0xC8 is decompressed , another function from the backdoor DLL is used to load the C2 communication module to the memory and call its " CreateInstance " export . The group , which was primarily motivated by profit , is noted for utilizing self - developed technically - proficient tools for their attacks .


Some FinFisher variants incorporate an MBR rootkit , the exact purpose of which is not clear . A paper from FireEye in 2013 on several campaigns using PIVY included menuPass as one of them . Finally , the launcher passes control to the main backdoor routine . Iranian APT group Siamesekitten PDF was identified as responsible for a supply chain attack campaign that targeted IT and communication companies in Israel .


Quite possibly , this routine targets older platforms like Windows 7 and machines not taking advantage of hardware protections like UEFI and SecureBoot , available on Windows 10 . Believed to have started activity in 2009 and to originate from China , the group initially was known for targeting US and overseas defense contractors but broadened their targeting as time passed . OceanLotus : 0 4 name is read from resource P1/0x64 . Symantecs Threat Hunter Team , part of Broadcom , has seen it used in a single attack by a ransomware affiliate that attempted to deploy LockBit on a targets network and then switched to 3AM when LockBit was blocked .


Describing this additional piece of code in detail is outside the scope of this analysis and may require a new dedicated blog post . menuPass has targeted individuals and organizations in Japan since at least 2014 , and as the same organizations and academics were largely targeted each month in these attacks , it further shows menuPass is persistent in attempts to compromise their targets . OceanLotus : {12C044FA-A4AB-433B-88A2-32C3451476CE} memory pointer 4 points to a function that spawns another copy of malicious process . Disrupting supply chains , destroying centrifuges and other attacks can be classified as WarDefense driven .


Defense against FinFisher Exposing as much of FinFisher ’ s riddles as possible during this painstaking analysis has allowed us to ensure our customers are protected against this advanced piece of malware . menuPass also heavily favors spear phishing , and so takes steps to socially engineer their spear phishes for maximum appearance of legitimacy . OceanLotus : {9E3BD021-B5AD-49DEAE93-F178329EE0FE} C&C URLs varies content is read from resource P1/2 . Part of this can be explained by the fact that 8BASE disproportionately attacked Brazil with 11 attacks last month , while PLAY focused on Switzerland ( 5 ) .


Windows 10 S devices are naturally protected against FinFisher and other threats thanks to the strong code integrity policies that don ’ t allow unknown unsigned binaries to run ( thus stopping FinFisher ’ s PE installer ) or loaded ( blocking FinFisher ’ s DLL persistence ) . menuPass is an ongoing APT campaign with a broad range of targets and will likely continue to target Japan in the future . OceanLotus : 0 config varies content is read from resource P1/1 . In one of our previous blog entries , we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming , pharmaceutical , and telecommunications companies .


On Windows 10 , similar code integrity policies can be configured using Windows Defender Application Control . ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints . OceanLotus : {B578B063-93FB-4A5F-82B4-4E6C5EBD393B} ? 4 0 ( config+0x486 ) . The second path ( /Library / Fonts / ArialUnicode.ttf.md5.1 ) may be used to store logging information related to monitor activity that is described as follows .


Office 365 Advanced Threat Protection secures mailboxes from email campaigns that use zero-day exploits to deliver threats like FinFisher . PyCommands , meanwhile , are Python scripts that automate tasks for Immunity Debugger , a popular tool for reverse-engineering malware binaries . OceanLotus : {5035383A-F7B0-424A-9C9A-CA667416BA6F} port number 4 0x1BB ( 443 ) ( config+0x46C ) . The new exploit method bypasses URL rewrite mitigations for the endpoint provided by Microsoft in response to •


Office 365 ATP blocks unsafe attachments , malicious links , and linked-to files using time-of-click protection . Poison Ivy is a remote access tool that is freely available for download from its official web site at www.poisonivy-rat.com . OceanLotus : {68DDB1F1-E31F-42A9-A35D-984B99ECBAAD} registry path varies SOFTWARE\Classes\CLSID\{57C3E2E2-C18F-4ABF-BAAA-9D17879AB029} . Mandiant is investigating intrusions across multiple verticals , including legal and professional services , technology , and government organizations .


Using intel from this research , we have made Office 365 ATP more resistant to FinFisher ’ s anti-sandbox checks . First released in 2005 , the tool has gone unchanged since 2008 with v ersion 2.3.2 . The backdoor DLL is stored in the .rdata section of the launcher , compressed with LZMA , and encrypted with RC4 . However , given the lack of conclusive evidence , we consider it also possible that a different actor - either with or without permission - reused code associated with the cyber range to develop this malware .


Generic detections , advanced behavioral analytics , and machine learning technologies in Windows Defender Advanced Threat Protection detect FinFisher ’ s malicious behavior throughout the attack kill chain and alert SecOps personnel . Poison Ivy includes features common to most Windows-based RATs , including key logging , screen capturing , video capturing , file transfers , system administration , password theft , and traffic relaying . The binary is heavily obfuscated with overlapping blocks of garbage code enclosed in pushf/popf instructions . nbtscan.exe


Windows Defender ATP also integrates with the Windows protection stack so that protections from Windows Defender AV and Windows Defender Exploit Guard are reported in Windows Defender ATP portal , enabling SecOps personnel to centrally manage security , and as well as promptly investigate and respond to hostile activity in the network . APT40 was previously reported as TEMP.Periscope and TEMP.Jumper . The DllMain function replaces the pointer to GetModuleHandleA API with a pointer to hook routine that will return the base of the backdoor DLL when called with NULL as parameter ( instead of returing the handle to the launcher DLL ) . This fact was apparently unknown to Biderman and other Ashley Madison executives more than a year later when their July 2015 hack was first revealed .


We hope that this writeup of our journey through all the multiple layers of protection , obfuscation , and anti-analysis techniques of FinFisher will be useful to other researchers studying this malware . They move laterally and escalate system privileges to extract sensitive information — whenever the attacker wants to do so.4 ,5 Because some RATs used in targeted attacks are widely available , determining whether an attack is part of a broader APT campaign can be difficult . The backdoor also contains an export that loads the C2 communication module reflectively to the memory from resource passed as parameter and then calls its " CreateInstance " export . The availability of such builders allows novice actors to generate their own customized ransomware variants .


We believe that an industry-wide collaboration and information-sharing is important in defending customers against this complex piece of malware . In 2011 , three years after the most recent release of PIVY , attackers used the RAT to compromise security firm RSA and steal data about its SecureID authentication system . While we are still in the process of analyzing this backdoor’s full functionality , it seems to be similar to the Remy backdoor described in our previous whitepaper on OceanLotus malware . The group behind the Winnti malware ( which we will call the Winnti group for brevity ) sprung up as a band of traditional cyber crooks , comprising black hats whose technical skills were employed to perpetrate financial fraud .


TUESDAY , APRIL 9 , 2019 Gustuff banking botnet targets Australia EXECUTIVE SUMMARY Cisco Talos has uncovered a new Android-based campaign targeting Australian financial institutions . PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 . This DLL is stored in the launcher’s resources and compressed with LZMA . Does your organization support the U.S. Military An example would be supply chain management or manufacturing of parts that could be used by the military WarDefense


As the investigation progressed , Talos came to understand that this campaign was associated with the " ChristinaMorrow '' text message spam scam previously spotted in Australia . Just recently , PIVY was the payload of a zero-day exploit in Internet Explorer used in what is known as a " strategic web compromise " attack against visitors to a U.S. government website and a variety of others . It’s also heavily obfuscated , but in a slightly different way than the backdoor . Commands to the remote system , and often the results of those commands , will be embedded within the protocol traffic between the client and server .


Although this malware 's credential-harvest mechanism is not particularly sophisticated , it does have an advanced self-preservation mechanism . The Poison Ivy builder kit allows attackers to customize and build their own PIVY server , which is delivered as mobile code to a target that has been compromised , typically using social engineering . Although it doesn’t contain an internal name , we believe it’s a variant of HttpProv library , as described in the ESET white paper on OceanLotus . We also found a live service selling VPS hosting at secure[.]66[.]to .


Even though this is not a traditional remote access tool ( RAT ) , this campaign seems to target mainly private users . Attackers can point and click their way through a compromised network and exfiltrate data . This module is used by the backdoor during HTTP/HTTPS communication with the C2 server and has a proxy bypass functionality . In the case of ProxyNotShell , the targeted backend service is the Remote PowerShell service .


Aside from the credential stealing , this malware also includes features like the theft of users ' contact list , collecting phone numbers associated names , and files and photos on the device . Commodity RATs also complicate efforts by security professionals to correlate a threat actor 's activity over time—attackers can hide in the sea of malicious activity that also uses Poison Ivy-based malware . OceanLotus : ae1b6f50b166024f960ac792697cd688be9288601f423c15abbc755c66b6daa4 Loader #1 . A Microsoft Exchange server is composed of two major components : the frontend , also known as the Client Access Service , and the backend .


But that does n't mean companies and organizations are out of the woods . This report is an initial public release of research PwC UK and BAE Systems have conducted into new , sustained global campaigns by an established threat actor against managed IT service providers and their clients as well as several directly targeted organisations in Japan . OceanLotus : 0ee693e714be91fd947954daee85d2cd8d3602e9d8a840d520a2b17f7c80d999 Loader #1 . None PIEHOP is a disruption tool written in Python and packaged with PyInstaller that is capable of connecting to a user - supplied remote MSSQL server for uploading files and issuing remote commands to a RTU .


They should still be on the lookout for these kinds of trojans , as the attackers could target corporate accounts that contain large amounts of money . Since late 2016 , PwC UK and BAE Systems have been assisting victims of a new cyber espionage campaign conducted by APT10 . OceanLotus : a2719f203c3e8dcdcc714dd3c1b60a4cbb5f7d7296dbb88b2a756d85bf0e9c1e Loader #1 . KillNet Appears to Increase Capabilities


The information collected by the malware and the control over the victim 's mobile device allows their operators to perform more complex social engineering attacks . The campaign , which we refer to as Operation Cloud Hopper , has targeted managed IT service providers ( MSPs ) , allowing APT10 unprecedented potential access to the intellectual property and sensitive data of those MSPs and their clients globally . OceanLotus : 4c02b13441264bf18cc63603b767c3d804a545a60c66ca60512ee59abba28d4d Loader #2 . It is possible that the malware was used to support exercises such as the ones hosted by Rostelecom - Solar in 2021 in collaboration with the Russian Ministry of Energy or in 2022 for the ( SPIEF ) .


A motivated attacker can use this trojan to harvest usernames and passwords and then reuse them to login into the organization 's system where the victim works . APT10 ceased its use of the Poison Ivy malware family after a 2013 FireEye report , which comprehensively detailed the malware 's functionality and features , and its use by several China-based threat actors , including APT10 . OceanLotus : e0fc83e57fbbb81cbd07444a61e56e0400f7c54f80242289779853e38beb341e Loader #2 . The Budworm advanced persistent threat APT group continues to actively develop its toolset .


This is a good example where two-factor authentication based on SMS would fail since the attacker can read the SMS . APT10 primarily used PlugX malware from 2014 to 2016 , progressively improving and deploying newer versions , while simultaneously standardising their command and control function . OceanLotus : cd67415dd634fd202fa1f05aa26233c74dc85332f70e11469e02b370f3943b1d Loader #2 . Additionally , by using leaked source code , threat actors can confuse or mislead investigators , as security professionals may be more likely to misattribute the activity to the wrong actor .


Corporations can protect themselves from these side-channel attacks by deploying client-based two-factor authentication , such as Duo Security . PwC UK and BAE Systems assess it is highly likely that APT10 is a China-based threat actor with a focus on espionage and wide ranging information collection . OceanLotus : 9112f23e15fdcf14a58afa424d527f124a4170f57bd7411c82a8cdc716f6e934 Loader #2 . Some researchers believe that it is linked to TA570 because of the similarity of delivering method between it and trojan .


One of the most impressive features of this malware is its resilience . APT10 is known to have exfiltrated a high volume of data from multiple victims , exploiting compromised MSP networks , and those of their customers , to stealthily move this data around the world . OceanLotus : ecaeb1b321472f89b6b3c5fb87ec3df3d43a10894d18b575d98287b81363626f Loader #2 . The adversary may drop or create malware , tools , or other non - native files on a target system to accomplish this , potentially leaving behind traces of malicious activities .


If the command and control ( C2 ) server is taken down , the malicious operator can still recover the malware control by sending SMS messages directly to the infected devices . APT10 , a name originally coined by FireEye , is also referred to as Red Apollo by PwC UK , CVNX by BAE Systems , Stone Panda by CrowdStrike , and menuPass Team more broadly in the public domain . OceanLotus : 478cc5faadd99051a5ab48012c494a807c7782132ba4f33b9ad9229a696f6382 Loader #2 . Rhysida , a new ransomware gang claiming to be a " cybersecurity team , " has been in operation since May 17 , 2023 , making headlines for their high - profile attack against the Chilean Army .


This makes the taking down and recovery of the network much harder and poses a considerable challenge for defenders . The threat actor has previously been the subject of a range of open source reporting , including most notably a report by FireEye comprehensively detailing the threat actor 's use of the Poison Ivy malware family and blog posts by Trend Micro3 similarly detailing the use of EvilGrab malware . OceanLotus : 72441fe221c6a25b3792d18f491c68254e965b0401a845829a292a1d70b2e49a Payload PNG ( loader #1 ) . Mandiant Intelligence assesses with high confidence that operations for which the pro - Russia hacktivist collective KillNet has claimed responsibility consistently mirror Russian strategic objectives , although we have not yet uncovered direct evidence of the collective ’s collaboration with or direction from Russian security services .


THE CAMPAIGN The malware 's primary infection vector is SMS . The threat actor has previously been the subject of a range of open source reporting , including most notably a report by FireEye comprehensively detailing the threat actor 's use of the Poison Ivy malware family and blog posts by Trend Micro similarly detailing the use of EvilGrab malware . OceanLotus : 11b4c284b3c8b12e83da0b85f59a589e8e46894fa749b847873ed6bab2029c0f Payload PNG ( loader #2 ) . Threat actors are always looking to expand the strategies they use , thus security practices and solutions that work for less organized cybercriminals might not work for determined groups who are willing to spend time , resources and manpower to accomplish their goals .


Just like the old-school mail worms that used the victim 's address book to select the next victims , this banking trojan 's activation cycle includes the exfiltration of the victim 's address book . APT10 has been in operation since at least 2009 , and has evolved its targeting from an early focus on the US defence industrial base ( DIB )1 and the technology and telecommunications sector , to a widespread compromise of multiple industries and sectors across the globe , most recently with a focus on MSPs . OceanLotus : d78a83e9bf4511c33eaab9a33ebf7ccc16e104301a7567dd77ac3294474efced Payload PNG ( loader #2 ) . TeamTNT has used an IRC bot for C2 communications.[13 ] Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level .


The trojan will receive instructions from the C2 to spread . The research and ongoing tracking of APT10 by both PwC UK and BAE . OceanLotus : E:\ProjectGit\SHELL\BrokenSheild\BrokenShieldPrj\Bin\x86\Release\DllExportx86.pdb Loader #1 . AdFind A publicly available tool that is used to query Active Directory .


Spread command from C2 The victim receives the command sendSMSMass . APT10 has been in operation since at least 2009 , and has evolved its targeting from an early focus on the US defence industrial base ( DIB ) and the technology and telecommunications sector , to a widespread compromise of multiple industries and sectors across the globe , most recently with a focus on MSPs . OceanLotus : C:\Users\Meister\Documents\Projects\BrokenShield\Bin\x86\Release\BrokenShield.pdb Loader #2 . We believe this is a different campaign and threat actor altogether .


Usually , this message targets four or five people at a time . PwC UK has been engaged in supporting investigations linked to APT10 compromises . OceanLotus : kermacrescen.com 7244 . Not only can email accounts contain access to sensitive data , they can provide an even more convincing persona that is used to execute BEC campaigns impersonating other users to further collect credentials and potentially gain access to other systems .


The body contains a message and URL . As a result of our analysis of APT10 's activities , we believe that it almost certainly benefits from significant staffing and logistical resources , which have increased over the last three years , with a significant step-change in 2016 . OceanLotus : stellefaff.com 7244 . While COSMICENERGY ’s capabilities are not significantly different from previous OT malware families ’ , its discovery highlights several notable developments in the OT threat landscape .


Again , the concept is that new victims are more likely to install the malware if the SMS comes from someone they know . Due to the scale of the threat actor 's operations throughout 2016 and 2017 , we similarly assess it currently comprises multiple teams , each responsible for a different section of the day-to-day operations , namely domain registration , infrastructure management , malware development , target operations , and analysis . OceanLotus : manongrover.com 7244 . The arrest makes him the third LockBit affiliate charged in the US since November .


When a victim tries to access the URL in the SMS body , the C2 will check if the mobile device meets the criteria to receive the malware ( see infrastructure section ) . APT10 withdrew from direct targeting using Poison Ivy in 2013 and conducted its first known retooling operation , upgrading its capabilities and replatforming to use PlugX . OceanLotus : background.ristians.com:8888 11b4 . They contain some invalid URLs and IPs .


If the device does not meet the criteria , it wo n't receive any data , otherwise , it will be redirected to a second server to receive a copy of the malware to install on their device . It is highly likely that this is due to the release of the 2013 FireEye report . OceanLotus : enum.arkoorr.com:8531 11b4 . Open Babel allows users to “ search , convert , analyze , or store data from molecular modeling , chemistry , solid - state materials , biochemistry , or related areas , ” according to its website , and is used in other popular pieces of software in the science field .


The domain on this campaign was registered on Jan. 19 , 2019 . Our report will detail the most recent campaigns conducted by APT10 , including the sustained targeting of MSPs , which we have named Operation Cloud Hopper , and the targeting of a number of Japanese institutions . OceanLotus : worker.baraeme.com:8888 11b4 . The Platform can look for indicators across file attachments , embedded links , and more and provides inplatform scoring .


However , Talos has identified that was used at least since November 2018 . MSPs therefore represent a high-payoff target for espionagefocused threat actors such as APT10 . OceanLotus : enum.arkoorr.com:8888 11b4 . The leaked Biderman emails show that Harrison made good on his threats , and that in the months that followed Harrison began targeting Biderman and other Ashley Madison executives with menacing anonymous emails and spoofed phone calls laced with profanity and anti - Semitic language .


During the investigation , Talos was also able to determine that the same infrastructure has been used to deploy similar campaigns using different versions of the malware . Given the level of client network access MSPs have , once APT10 has gained access to a MSP , it is likely to be relatively straightforward to exploit this and move laterally onto the networks of potentially thousands of other victims . OceanLotus : worker.baraeme.com:8531 11b4 . The UK ’s National Cyber Security Centre ( NCSC ) assesses that the Russian Military Intelligence was almost certainly involved in the 13 January defacements of Ukrainian government websites and the deployment of Whispergate destructive malware .


Distribution of victims . This , in turn , would provide access to a larger amount of intellectual property and sensitive data . OceanLotus : plan.evillese.com:8531 11b4 . Seven of the vulnerabilities included in today ’s Vulnerability Roundup have a CVSS severity score of 9.8 out of a possible 10 .


Talos assess with high confidence that this campaign is targeting Australian financial institutions based on several factors . APT10 has been observed to exfiltrate stolen intellectual property via the MSPs , hence evading local network defences . OceanLotus : background.ristians.com:8531 11b4 . Copies of the site at archive.org show it was the work of someone calling themselves “ The Chaos Creator . ”


Our Umbrella telemetry shows that the majority of the request comes from Australia and the majority of the phone numbers infected have the international indicative for Australia . The command and control ( C2 ) infrastructure chosen by APT10 for Operation Cloud Hopper is predominantly referenced using dynamic-DNS domains . OceanLotus : plan.evillese.com:8888 11b4 . The dump files will start ' NSPPE- ' .


Finally , the specific overlays are designed for Australian financial institutions , and Australia is one of the geographic regions that is accepted by the C2 . Several of these provide enterprise services or cloud hosting , supporting our assessment that APT10 are almost certainly targeting MSPs . OceanLotus : SOFTWARE\Classes\CLSID\{E3517E26-8E93-458D-A6DF-8030BC80528B} 7244 . As for who was hit the hardest , around 16 percent of ransomware incidents affecting State , Local , Tribal , and Tribunal ( SLTT ) governments were from LockBit , says the MS - ISAC .


DNS queries distribution over time The campaign does n't seem to be growing at a fast pace . The 13th FYP was released in March 2016 and the sectors and organisations known to be targeted by APT10 are broadly in line with the strategic aims documented in this plan . OceanLotus : SOFTWARE\App\AppX06c7130ad61f4f60b50394b8cba3d35f\Applicationz 7244 . Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns ( e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s ) ) .


Our data shows , on average , about three requests per hour to the drop host . These aims outlined in the FYP will largely dictate the growth of businesses in China and are , therefore , likely to also form part of Chinese companies ' business strategies . OceanLotus : SOFTWARE\Classes\CLSID\{57C3E2E2-C18F-4ABF-BAAA-9D17879AB029} 11b4 . In the UK , Vice Society accounts for a staggering proportion of known ransomware attacks on education — almost 70 % .


This request is only made upon installation , but there is no guarantee that it will be installed . APT10 has , in the past , primarily been known for its targeting of government and US defence industrial base organisations , with the earliest known date of its activity being in December 2009 . Operation ShadowHammer . At this time , it is unknown how Sandworm gained initial access to the victim .


This data , when analyzed with the number of commands to send SMSs that Talos received during the investigation , lead us to conclude that the malicious operator is aggressively spreading the malware , but that does n't seem to result in the same number of new infections . Observed APT10 targeting is in line with many of the historic compromises we have outlined previously as originating from China . Earlier today , Motherboard published a story by Kim Zetter on Operation ShadowHammer , a newly discovered supply chain attack that leveraged ASUS Live Update software . Although COSMICENERGY does not directly overlap with any previously observed malware families , its capabilities are comparable to those employed in previous incidents and malware .


Examples of the overlays available to the malware Above , you can see examples of the injections that distributed to the malware as part of this specific campaign . In line with commonly used APT actor methodologies , the threat actor aligns its decoy documents to a topic of interest relevant to the recipient . While the investigation is still in progress and full results and technical paper will be published during SAS 2019 conference in Singapore , we would like to share some important details about the attack . In several cases , the threat actor used 7 - zip to create an encrypted segmented archive to compress the reconnaissance results .


While doing our investigation we were able to identify other malware packages with different names . This section details changes made to APT10 tools , techniques and procedures ( TTPs ) post-2014 , following its shift from Poison Ivy to PlugX . In January 2019 , we discovered a sophisticated supply chain attack involving the ASUS Live Update Utility . The backdoor ’s primary functionality involves retrieving and executing additional modules .


Some of these might have been used on old campaigns or were already prepared for new campaigns . We have observed that in cases where APT10 has infiltrated a target via an MSP , it continues to use the MSPs credentials . The attack took place between June and November 2018 and according to our telemetry , it affected a large number of users . – Consistent with KillNet activity in 2022 , the majority of claimed attacks in 2023 targeted entities in the U.S. and Europe .


MALWARE TECHNICAL DETAILS During our investigation , researchers uncovered a malware known as " Gustuff. '' . In order to gain any further credentials , APT10 will usually deploy credential theft tools such as mimikatz or PwDump , sometimes using DLL load order hijacking , to use against a domain controller , explained further in Annex B . ASUS Live Update is an utility that is pre-installed on most ASUS computers and is used to automatically update certain components such as BIOS , UEFI , drivers and applications . The contents found in secure[.]66[.]to often lead to zhu[.]vn , which is Hack520 ’s domain for hosting his own private blog .


Given the lack of indicators of compromise , we decided to check to see if this was the same malware we had been researching . APT10 achieves persistence on its targets primarily by using scheduled tasks or Windows services in order to ensure the malware remains active regardless of system reboots . According to Gartner , ASUS is the world’s 5th-largest PC vendor by 2017 unit sales . Over the last decade , Iran has waged a number of disruptive and destructive cyber campaigns against government entities and companies alike , becoming infamous for its deployment of wiper malware as well as its retaliatory attack strategy .


Our Threat Intelligence and Interdiction team found the Gustuff malware being advertised in the Exploit.in forum as a botnet for rent . For example , in addition to compromising high value domain controllers and security servers , the threat actor has also been observed identifying and subsequently installing malware on low profile systems that provide non-critical support functions to the business , and are thus less likely to draw the attention of system administrators . This makes it an extremely attractive target for APT groups that might want to take advantage of their userbase . Organizations must do better to safeguard their sensitive data and combat the growing ransomware threats by leveraging key prevention , detection and response components .


The seller , known as " bestoffer , '' was , at some point , expelled from the forum . In the majority of instances APT10 used either a reverse shell or RDP connection to install its malware ; the actor also uses these methods to propagate across the network . Based on our statistics , over 57 , 000 Kaspersky users have downloaded and installed the backdoored version of ASUS Live Update at some point in time . The connection to the Lazarus group was obvious by inspecting the tools , strategies , and methods already linked to the North Korean actor .


Gustuff advertising screenshot The companies advertised in the image above were from Australia , which matches up with the campaign we researched . The tactical malware , historically EvilGrab , and now ChChes ( and likely also RedLeaves ) , is designed to be lightweight and disposable , often being delivered through spear phishing . We are not able to calculate the total count of affected users based only on our data ; however , we estimate that the real scale of the problem is much bigger and is possibly affecting over a million users worldwide . Network traffic and process related telemetry to / from host(s ) operating the MicroSCADA software .


The screenshots provided by the author align with the advertised features and the features that we discovered while doing our analysis . Once executed , tactical malware contains the capability to profile the network and manoeuvre through it to identify a key system of interest . The goal of the attack was to surgically target an unknown pool of users , which were identified by their network adapters’ MAC addresses . It is a challenge for any organisation to fight off a determined ransomware gang like Vice Society , but schools face the added pressure of doing so in a notoriously tight budgetary environment .


Admin panel The administration panel shows the application configuration , which matches the commands from the C2 . We have also observed APT10 use DLL search order hijacking and sideloading , to execute some modified versions of open-source tools . To achieve this , the attackers had hardcoded a list of MAC addresses in the trojanized samples and this list was used to identify the actual intended targets of this massive operation . For the latest protection updates , please visit the Symantec Protection Bulletin .


Country selection The administration console screenshots also show the ability to filter the results by country . For example , PwC UK has observed APT10 compiling DLLs out of tools , such as Mimikatz and PwDump6 , and using legitimate , signed software , such as Windows Defender to load the malicious payloads . We were able to extract more than 600 unique MAC addresses from over 200 samples used in this attack . COSMICENERGY ’s capabilities and overall attack strategy appear reminiscent of the , which issued IEC-104 ON / OFF commands to interact with RTUs and , according to one , may have made use of an MSSQL server as a conduit system to access OT .


In this case , " AU '' is the code shown , which is Australia . During our analysis of victim networks , we were able to observe APT10 once again initiate a retooling cycle in late 2016 . Of course , there might be other samples out there with different MAC addresses in their list . Monitor and analyze traffic patterns and packet inspection associated to protocol(s ) , leveraging SSL / TLS inspection for encrypted traffic , that do not follow the expected protocol standards and traffic flows ( e.g extraneous packets that do not belong to established flows , gratuitous or anomalous traffic patterns , anomalous syntax , or structure ) .


Based on this information , Talos assesses with high confidence that the malware is the same and this is , in fact , the Gustuff malware . We observed the deployment and testing of multiple versions of Quasar malware , and the introduction of the bespoke malware families ChChes and RedLeaves . We believe this to be a very sophisticated supply chain attack , which matches or even surpasses the Shadowpad and the CCleaner incidents in complexity and techniques . Simultaneously , a new variant of Monti , based on the Linux platform , has surfaced , demonstrating notable differences from its previous Linux - based versions .


Design In the manifest , the malware requests a large number of permissions . APT10 is a constantly evolving , highly persistent China-based threat actor that has an ambitious and unprecedented collection programme against a broad spectrum of sectors , enabled by its strategic targeting . The reason that it stayed undetected for so long is partly due to the fact that the trojanized updaters were signed with legitimate certificates ( eg : “ ASUSTeK Computer Inc. ” ) . Each data item fills its location by calling function so , it will become like the following but with the victim collected data .


However , it does n't request permissions like BIND_ADMIN . Since exposure of its operations in 2013 , APT10 has made a number of significant changes intended to thwart detection of its campaigns . The malicious updaters were hosted on the official liveupdate01s.asus.com and liveupdate01.asus.com ASUS update servers . Given the widespread adoption of Citrix in enterprises globally , we suspect the number of impacted organizations is far greater and in several sectors .


To perform some of its activities , the malware does not need high privileges inside the device , as we will explain ahead . PwC UK and BAE Systems , working closely with industry and government , have uncovered a new , unparallelled campaign which we refer to as Operation Cloud Hopper . We have contacted ASUS and informed them about the attack on Jan 31 , 2019 , supporting their investigation with IOCs and descriptions of the malware . • None consisting of CVE-2022 - 41080 and CVE-2022 - 41082 to achieve remote code execution ( RCE ) through Outlook Web Access ( OWA ) .


Permissions in the manifest This malware is designed to avoid detection and analysis . This operation has targeted managed IT service providers , the compromise of which provides APT10 with potential access to thousands of further victims . Although precise attribution is not available at the moment , certain evidence we have collected allows us to link this attack to the ShadowPad incident from 2017 . Most fraudsters create one - time email addresses or use stolen email addresses , both of which are easy to create or obtain .


It has several protections in place , both in the C2 and the malware 's code . An additional campaign has also been observed targeting Japanese entities . The actor behind the ShadowPad incident has been publicly identified by Microsoft in court documents as BARIUM . Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns ( e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s ) ) .


The code is not only obfuscated but also packed . APT10 's malware toolbox shows a clear evolution from malware commonly associated with China-based threat actors towards bespoke in-house malware that has been used in more recent campaigns ; this is indicative of APT10 's increasing sophistication , which is highly likely to continue . BARIUM is an APT actor known to be using the Winnti backdoor . Its wellknown that ransomware can be delivered via unremediated vulnerabilities , but many security teams are overwhelmed by the sheer number they are facing .


The packer , besides making the static analysis more complex , will break the standard debugger . The threat actor 's known working hours align to Chinese Standard Time ( CST ) and its targeting corresponds to that of other known China-based threat actors , which supports our assessment that these campaigns are conducted by APT10 . Recently , our colleagues from ESET wrote about another supply chain attack in which BARIUM was also involved , that we believe is connected to this case as well . CrowdStrike Falcon will detect the OWASSRF exploit method described in this blog , and will block the method if the prevention setting for • None Monitor Exchange servers for signs of exploitation visible in IIS and Remote PowerShell logs using this script developed by CrowdStrike Services • None Consider application - level controls such as web application firewalls .


Manifest activity declaration Class list inside the dex file The main malware classes are packed , to a point where the class defined in the manifest has a handler for the MAIN category that does not exist in the DEX file . APT10 ( MenuPass Group ) is a Chinese cyber espionage group that FireEye has tracked since 2009 . It should be noted that the numbers are also highly influenced by the distribution of Kaspersky users around the world . The U.S. government is taking additional measures to fight against ransomware attacks through methods such as hacking cybercriminals back .


Error when trying to debug the malware using the Android Studio IDE . Its targets include the military organizations and governments of countries with national interests in the South China Sea , including some within the U.S. defense industrial base . In principle , the distribution of victims should match the distribution of ASUS users around the world . The UK has already sanctioned the GRU after their appalling actions in Salisbury , and has frozen more than £ 940 billion worth of bank assets and £ 117 billion in personal net worth from oligarchs and their family members who fund Putin ’s war machine .


One of the side effects of this packer is the inability of Android Studio IDE to debug the code . Moafee may have chosen its targets based on the rich resources of South China Sea region – the world 's second business sea-lane , according to Wikipedia – including rare earth metals , crude oil , and natural gas . We’ve also created a tool which can be run to determine if your computer has been one of the surgically selected targets of this attack . Regardless of the cause , these leaks are having a significant effect on the threat landscape , making it easier for novice or unskilled actors to develop their own ransomware variants without much effort or knowledge .


This happens because the IDE executes the code from the Android debug bridge ( ADB ) by calling the activity declared in the manifest by name . DragonOK appears to operate out of China 's Jiangsu Province . To check this , it compares MAC addresses of all adapters to a list of predefined values hardcoded in the malware and alerts if a match was found . COSMICENERGY is the latest example of specialized OT malware capable of causing cyber physical impacts , which are rarely discovered or disclosed .


Since the class does not exist at startup , the application does not run on the debugger . Moafee and DragonOK both use a well-known proxy tool – HUC Packet Transmit Tool ( HTRAN ) – to disguise their geographical locations . Download an archive with the tool ( .exe ) . 8.15 Logging & 8.16 Monitoring activities – determining the system information to log , store and query allows malicious behavior to be uncovered , if threat intelligence is applied to understand how threats may manifest themselves within log data .


Although Talos analyzed the unpacked version of the code , the packer analysis is beyond the scope of this post . However , FireEye researchers do not have enough insight to reliably report a definitive connection to the Moafee and DragonOK groups . Also , you may check MAC addresses online . StrifeWater is used to create a foothold in victim and environments , and it has various functions , including executing system commands , screen capturing , establishing persistence , listing system files , and downloading updates and additional modules .


Check code for emulators As part of its defense , the malware payload first checks for emulators to prevent analysis on sandboxes . Both Moafee and DragonOK favor spear-phishing emails as an attack vector , often employing a decoy to deceive the victim . If you discover that you have been targeted by this operation , please e-mail us at : shadowhammer@kaspersky.com . Instead , it ’s likely that Royal is simply testing a new encryptor — especially considering that BlackSuit was used in just two attacks last month — and that this lull can be explained as more or less of a research period for them .


It checks for different kinds of emulators , including QEMU , Genymotion , BlueStacks and Bignox . Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document . Kaspersky Lab verdicts for the malware used in this and related attacks . None After initial access via this new exploit method , the threat actor leveraged maintain access , and performed anti - forensics techniques on the Microsoft Exchange server in an attempt to hide their activity .


If the malware determines that is not running on an emulator , it then performs additional checks to ensure that it wo n't be detected . We observed Moafee running HTRAN proxies on their multiple Command and Control ( C2 ) servers – all operated on CHINANET , and hosted in Guangdong Province . ShadowHammer : HEUR : Trojan.Win32.ShadowHammer.gen . The first step is the previously unknown OWA exploit technique .


Code to check the existence of SafetyNet Google API It also checks if the Android SafetyNet is active and reporting back to the C2 . Like the Moafee group , we observed DragonOK running HTRAN to proxy their C2 servers , which are also operated on CHINANET but are hosted in the Jiangsu Province . ShadowHammer : asushotfix.com . We expect KillNet and its affiliates to continue conducting distributed denial - of - service ( DDoS ) and hack - and - leak operations intended to disrupt government and critical infrastructure functions in countries providing financial , economic , diplomatic or military support to Ukraine .


This helps the C2 define what actions it can do before being detected on the mobile device . Primarily focused on governments and military operations of countries with interests in the South China Sea , Moafee likely chooses its targets based on region 's rich natural resources . ShadowHammer : 141.105.71.116 . The first , CVE-2022 - 41123 , has been revealed by ZDI to be DLL hijacking3 due to the loading of a non - existent component by a privileged executed command .


List of anti-virus packages that are checked The payload goes a long way to protect itself and checks for anti-virus software installed on the mobile device . By targeting high-tech and manufacturing operations in Japan and Taiwan , DragonOK may be acquiring trade secrets for a competitive economic advantage . ShadowHammer : http://liveupdate01.asus.com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER365.zip . The size of the industry has been expanding in the US and globally , with significant revenue increases making it an appealing target for ransoms .


The trojan uses the Android Accessibility API to intercept all interactions between the user and the mobile device . Security researchers subsequently linked these attacks to a broader , yearlong campaign that targeted not just Israelis but Palestinians as well . ShadowHammer : https://liveupdate01s.asus.com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER362.zip . Threat actors typically register and use several domains in order to discretely lead their malware to their Command and Control ( C&C ) servers .


The Android developer documentation describes the accessibility event class as a class that " represents accessibility events that are seen by the system when something notable happens in the user interface . and as discovered later , even the U.S. and UK governments . ShadowHammer : https://liveupdate01s.asus.com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER360.zip . Because phishing often leverages the impersonation of trusted associates from highlevel executives to legitimate vendors and partner organizations and includes personal details skimmed from social media or other publicly available information , its tempting to call them sophisticated .


For example , when a button is clicked , a view is focused , etc . The second group , known as DragonOK , targets high-tech and manufacturing companies in Japan and Taiwan . ShadowHammer : https://liveupdate01s.asus.com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER359.zip . Umbrella , Cisco ’s secure internet gateway ( SIG ) , blocks users from connecting to malicious domains , IPs and URLs , whether users are on or off the corporate network .


'' For each interaction , the malware will check if the generator is a package that belongs to the anti-virus list , the malware will abuse another feature of the Accessibility API . In 2012 , the Molerats attacks appeared to rely heavily on the XtremeRAT , a freely available tool that is popular with attackers based in the Middle East . ShadowHammer : Liveupdate_Test_VER365.zip . In the UK , education has suffered a significant drop in funding in the last decade , according to the non - partisan Education Policy Institute .


There is a function called " performGlobalAction '' with the description below . But the group has also used Poison Ivy ( PIVY ) , a RAT more commonly associated with threat actors in China — so much so that PIVY has , inaccurately , become synonymous with all APT attacks linked to China . ShadowHammer : aa15eb28292321b586c27d8401703494 . In a recent survey , respondents indicated that 57 of all observed vulnerabilities are more than two years old , with as many as 17 being more than five years old .


Android documentation describes that function as " a global action . This blog post analyzes several recent Molerats attacks that deployed PIVY against targets in the Middle East and in the U.S. We also examine additional PIVY attacks that leverage Arabic-language content related to the ongoing crisis in Egypt and the wider Middle East to lure targets into opening malicious files . Rancor : Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia . The ransom note is also used to generate a message in the form of the background wallpaper typically located at “ C:/Users / Public / bg.jpg ” .


Such an action can be performed at any moment , regardless of the current application or user location in that application . We do not know whether using PIVY is an attempt by those behind the Molerats campaign to frame China-based threat actors for their attacks or simply evidence that they have added another effective , publicly-available RAT to its arsenal . In late June 2018 , Unit 42 revealed a previously unknown cyber espionage group we dubbed Rancor , which conducted targeted attacks in Southeast Asia E-LOC throughout 2017 and 2018 . The session takeovers bypassed password and multi - factor authentication .


For example , going back , going home , opening recents , etc . We observed several attacks in June and July 2013 against targets in the Middle East and the U.S. that dropped a PIVY payload that connected to command-and-control ( CnC ) infrastructure used by the Molerats attackers . In recent attacks , the group has persistently targeted at least one government organization in Cambodia B-LOC E-IDTY from December 2018 through January 2019 . These victims are not criminals or terrorists , but instead , they are associated with activism .


'' The trojan calls this function with the action GLOBAL_ACTION_BACK , which equals the pressing of the back button on the device , thus canceling the opening of the anti-virus application . The archive contains an .exe file , sometimes disguised as a Microsoft Word file , a video , or another file format , using the corresponding icon . While researching these attacks , we discovered an undocumented , custom malware family – which we ’ve named Dudell . Adversaries may perform data destruction over the course of an operation .


The same event interception is used to place the webview overlay when the user tries to access the targeted applications , allowing it to display its overlay , thus intercepting the credentials . In addition to DustySky , the attackers use publicly available tools such as the following Remote Administration Tools ( RAT ) : Poison Ivy , Nano Core , XtremeRAT , DarkComet and Spy-Net . In addition , we discovered the group using Derusbi , which is a malware family believed to be unique to a small subset of Chinese cyber espionage groups . A month later , GReAT discovered two more previously unknown infection mechanisms for MiniDuke , which relied on Java and Internet Explorer vulnerabilities to infect the victim ’s PC .


The beaconing only starts after the application is installed and removed from the running tasks . DustySky ( called " NeD Worm " by its developer ) is a multi-stage malware in use since May 2015 . Between early December 2018 and the end of January 2019 , Rancor conducted at least two rounds of attacks intending to install Derusbi or KHRat malware S-MALon S-MALvictim systems . Ashley Madison ’s long - suspected army of fake female accounts came to the fore in August 2012 after the former sex worker turned activist and blogger Maggie McNeill published screenshots apparently taken from Ashley Madison ’s internal systems suggesting that a large percentage of the female accounts on the service were computer - operated bots .


Beaconing information The ID is generated for each installation of the malware , while the token remains unique . It is in use by the Molerats ( aka Gaza cybergang ) , a politically motivated group whose main objective , we believe , is intelligence gathering . January 2019 sent via 149.28.156.61 to deliver either Derusbi or KHRat samples with either cswksfwq.kfesv.xyz or connect.bafunpda.xyz as C2 . LIGHTWORK utilizes positional command line arguments for target device , port , and IEC-104 command .


Some of the checks performed previously are immediately sent to the C2 , like the safetyNet , admin and defaultSMSApp . Operating since 2012 , the Molerats group 's activity has been reported by Norman , Kaspersky , FireEye , and PwC . DUDELL : SHA256 : 0d61d9baab9927bb484f3e60384fdb6a3709ca74bc6175ab16b220a68f2b349e . The vulnerability , which could allow attackers to gain escalated privileges and unauthorized access to an environment , was first disclosed on May 31st in a security bulletin released by Progress .


The beaconing is sent to the URL http : // /api/v2/get.php with an interval of 60 seconds . DustySky has been developed and used since May 2015 by Molerats ( aka " Gaza cybergang " ) , a terrorist group whose main objective in this campaign is intelligence gathering . DUDELL : File Type :M icrosoft Excel 97 – I-TOO 2 E-IDTY003 Document . By monitoring for indicators of compromise , organizations can detect attacks and act quickly to prevent breaches from occurring or limit damages by stopping attacks in earlier stages .


Answer from the C2 The C2 will check the country field , if it 's empty or if the country is not targeted , it will reply with a " Unauthorized '' answer . Most targets are from the Middle East : Israel , Egypt , Saudi Arabia , United Arab Emirates and Iraq . DUDELL : File Name :E quipment Purchase List 2018-2020 (Final ).xls . p - macos-55554944c2a6eb29a7bc3c73acdaa3e0a7a8d8c7


Otherwise , it will return a JSON encoded " OK , '' and if that is the case , the command to be executed . The United States and countries in Europe are targeted as well . The DUDELL sample is a weaponized Microsoft Excel B-IDTY I-TOOL document that contains a malicious macro E-TOOL that runs on the victim ’s machine . Subscribing to the Talos weekly newsletter provides information about the most prevalent malware .


List of available commands The command names are self-explanatory . The sample analyzed is f589827c4cf94662544066b80bfda6ab from late August 2015 . It shares the same malicious behavior reported by Checkpoint in Rancor : The Year of The Phish E-MAL SHA-1 c829f5f9ff89210c888c1559bb085ec6e65232de . There are two types of logs identified that can be useful in identifying historical evidence of session hijacking after the successful exploitation of CVE-2023 - 4966 .


The command will be issued as an answer to the beaconing , and the result will be returned to the URL http : // /api/v2/set_state.php Example of the command " changeServer '' The commands are issued in a JSON format , and the obfuscation is part of the malware code and not added by the packer . The MuddyWater attacks are primarily against Middle Eastern nations . In Check Point ’s blog , the sample is from December 2018 while this sample is from April 2018 . What is Cisco doing to take action against the growth of commercial spyware ?


It is a custom obfuscation partly based on base85 encoding , which is in itself unusual , in malware . However , we have also observed attacks against surrounding nations and beyond , including targets in India and the USA . The macro in this document gets executed when the user views the document and clicks Enable Content , at which point the macro locates and executes the data located under the Company field in the document ’s properties . All downloaders attempt to download an image file from a URL .


Base85 encoding is usually used on pdf and postscript documentsThe configuration of the malware is stored in custom preferences files , using the same obfuscation scheme . Targeted sectors of Molerats include governmental and diplomatic institutions , including embassies ; companies from the aerospace and defence Industries ; financial institutions ; journalists ; software developers . The C2 server 199.247.6.253 is known to be used by the Rancor group . The first path ( /Library / Fonts / ArialUnicode.ttf.md5 ) stores the backdoor ’s full configuration , including its C2 servers .


Activation cycle As we have explained above , the malware has several defence mechanisms . The Palo Alto Networks Unit 42 research team recently came across a series of malicious files which were almost identical to those targeting the Saudi Arabian government previously discussed by MalwareBytes . The script is downloading a second stage payload via the Microsoft tool msiexec . YARA Rules


Beside the obfuscation and the environment checks , the malware also has some interesting anti-sandbox mechanisms . MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call " POWERSTATS " . Unfortunately at the time of discovery , the hosted file is unavailable . An example of these log entries can be found below : By correlating the user , IP address and GUID from the Remote PowerShell HTTP logs to the Exchange frontend , CrowdStrike found a request using the mailbox to the following OWA URL , , corresponding to the IIS log entry below : The backend request for the new exploitation chain is similar to the example shown below : This request seemed to show a novel , previously undocumented , way to reach the PowerShell remoting service through the OWA frontend endpoint , instead of leveraging the endpoint .


After installation , the user needs to run the application . When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East , we were somewhat confused as the previous public reporting had attributed these attacks to FIN7 . Our systems were able to record the hash of file tmp.vbs , but the contents of the file are no longer available . The code is obfuscated , using an obfuscator script , based on the fact that some comments the actor did n’t strip are also obfuscated when the words written in the comments are not recognized as a part of the VBA syntax .


The user needs to press the " close '' button to finish the installation . FIN7 is a threat actor group that is financially motivated with targets in the restaurant , services and financial sectors . Pivoting off the filename and directory , we discovered a similar VBS script used by the Rancor actors that might give us some clues on what the contents of tmp.vbs would resemble . To say ransomware gangs have been unkind to the US in the past year is an understatement .


However , this wo n't close the application , it will send it to the background , instead . Following the trail of existing public reporting , the tie to FIN7 is essentially made based on a download observed from a MuddyWater C2 , of a non-public tool " DNSMessenger " . File office.vbs ( SHA256 : 4b0b319b58c2c0980390e24379a2e2a0a1e1a91d17a9d3e26be6f4a39a7afad2 ) was discovered in directory c:\Windows\System32\spool\drivers\color . The second , CVE-2022 - 41080 , has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022 - 41040 used in the ProxyNotShell exploit chain , and it has been marked “ exploitation more likely . ”


While the application is in the background , although the service is already running , the beaconing will not start . There was a mistake in the original Morphisec analysis which linked these attacks to FIN7 . Hashes for tmp.vbs :b 958e481c90939962081b9fb85451a2fb28f705d5b5060f5d9d5aebfb390f8 . Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader , one of the most popular PDF reader alternatives to Adobe Acrobat .


The beaconing will only start after the application is removed from the background , ultimately stopping it . The DNSMessenger malware is a shared tool , used by FIN7 , MuddyWater and perhaps other groups . If the file tmp.vbs does in fact contain similar content as that of office.vbs , then it could be another method for downloading payloads onto the target . The Malware contains some other commands to do but not all of them are implemented yet .


This will be the trigger for the service to start the beaconing . In September 2018 , we found evidence of Seedworm and the espionage group APT28 ( aka Swallowtail , Fancy Bear ) , on a computer within the Brazil-based embassy of an oil-producing nation . DDKONG Plugin : SHA256 : 0EB1D6541688B5C87F620E76219EC5DB8A6F05732E028A9EC36195D7B4F5E707 . There is high turnover of staff , especially in entrylevel positions , which makes it difficult to ensure all staff have cybersecurity training .


As mentioned previously , the beaconing is done every 60 seconds . We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded . DDKONG Plugin : Compile Date and Time : 2017-02-17 08:33:45 AM . Therefore , having access to such code allows threat actors with minimum programming knowledge to modify and compile their own ransomware variants .


However , no command is received from the C2 until the inactiveTime field ( see beaconing information image above ) has at least the value of 2000000 . Seedworm likely functions as a cyber espionage group to secure actionable intelligence that could benefit their sponsor 's interests . DDKONG Plugin : File Type : PE32 executable ( DLL ) Intel 80386, for MS Windows . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


This time resets every time the user performs some activity . During the operations , the group used tools consistent with those leveraged during past intrusions including Powermud , a custom tool used by the Seedworm group , and customized PowerShell , LaZagne , and Crackmapexec scripts . DDKONG Plugin : File Name : H istory.nls . Mandiant identified the historical execution of malicious binaries across multiple systems using cdhash values stored in the XPdb .


After the checks , the malware becomes active , but first , it goes through seven steps , each one calling a different command : uploadPhoneNumbers : Exfiltrates all phone numbers that are in the contact list . The Seedworm group controls its Powermud backdoor from behind a proxy network to hide the ultimate command-and-control ( C&C ) location . The DllInstall export function is responsible for the core behavior of the malware , as just loading it does nothing . For this reason , the particular actions intended by the actor are unclear without further knowledge about the targeted assets .


Aside from the natural value of phone numbers associated with the names of their owners . After compromising a system , typically by installing Powermud or Powemuddy , Seedworm first runs a tool that steals passwords saved in users ' web browsers and email , demonstrating that access to the victim 's email , social media , and chat accounts is one of their likely goals . Once this export is called , it checks for a hidden window with a caption of Hello Google ! Based upon analysis and gathered data , we have determined that the operation is conducted by a Vietnamese threat actor .


Using the SMS has an initial infection vector is another possibility for the exfiltration . Seedworm then uses open-source tools such as LaZagne and Crackmapexec to obtain Windows authorization credentials . . Understand how the most dangerous Android threat could upend your entire business and how a devious cybercrime campaign on Windows involves in - depth reconnaissance to deliver the damaging malware to your network .


One of the purposes of the exfiltration of the contact list is to use them to attack other victims using SMS as an initial vector . The group , which we call Seedworm ( aka MuddyWater ) , has been operating since at least 2017 , with its most recent activity observed in December 2018 . This check is performed to ensure that only one instance of the malware is running at a time . A typical log entry showing access to the PowerShell backend is detailed in the Remote PowerShell HTTP logs , located in , such as in the example below : CrowdStrike incident responders discovered Remote PowerShell logs similar to log entries for ProxyNotShell exploitation to gain initial access , suggesting the attacker leveraged Remote PowerShell .


checkApps : Asks the malware to see if the packages sent as parameters are installed . The Seedworm group is the only group known to use the Powermud backdoor . The hidden window created by the malware filters on any user input ( e.g . keyboard or mouse activity ) . According to Kaspersky telemetry , targeted organizations included think tanks and individuals working in various areas related to security and geopolitics .


The malware contains a list of 209 packages hardcoded in its source code . Additionally , the group compromised organizations in Europe and North America that have ties to the Middle East . This could be an attempt to evade sandbox analysis as mouse and keyboard movement is typically not performed . However , given the lack of conclusive evidence , we consider it also possible that a different actor - either with or without permission - reused code associated with the cyber range to develop this malware .


However , the C2 can send an updated list . MuddyWater is an Iranian high-profile threat actor that 's been seen active since 2017 . The malware then proceeds to beacon to a configured remote server of cswksfwq.kfesv.xyz on TCP port 8080 . When Bradshaw refused to sell the domain , he and his then - girlfriend were subject to an unrelenting campaign of online harassment and blackmail .


List of packages received from the C2 adminNumber : Setup of the admin phone number . Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn't possible for us to verify this link . Upon successful connection , the malware transmits victim information such as : hostname , IP address , Language Pack along with other operating system information . • None consisting of CVE-2022 - 41080 and CVE-2022 - 41082 to achieve remote code execution ( RCE ) through Outlook Web Access ( OWA ) .


In our case , the administrator phone number belongs to a mobile network in Australia . Over the past year , we've seen the group extensively targeting a wide gamut of entities in various sectors , including Governments , Academy , Crypto-Currency , Telecommunications and the Oil sectors . The data transmitted are XOR encoded . The first 6 Variables numbered lines were nt used anywhere in the code .


Phone number for administration changeServer : At this point , the malware changes the C2 to a new host , even though the API and communication protocol continues to be the same . Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn't possible for us to verify this link . The malware supports the following capabilities : Terminate specific process、Enumerate processes、Upload file、Download file、Delete file、List folder contents、Enumerate storage volumes、Execute a command、Reverse shell、Take a screenshot . Conducted for commercial or financial purposes , corporate espionage involves


Change server request The URL 's for the new server is obfuscated , preventing easy network identification . Depending on each sample , the content of document is either a fake resume application , or a letter from the Ministry of Justice in Lebanon or Saudi Arabia . KHRAT : SHA256 : aaebf987b8d80d71313c3c0f2c16d60874ffecbdda3bb6b44d6cba6d380 . A month later , GReAT discovered two more previously unknown infection mechanisms for MiniDuke , which relied on Java and Internet Explorer vulnerabilities to infect the victim ’s PC .


changeActivity : This command will set up the webview to overlay any of the target activities . Analysts in our DeepSight Managed Adversary and Threat Intelligence ( MATI ) team have found a new backdoor , Backdoor.Powemuddy , new variants of Seedworm 's Powermud backdoor ( aka POWERSTATS ) , a GitHub repository used by the group to store their scripts , as well as several post-compromise tools the group uses to exploit victims once they have established a foothold in their network . KHRAT : Compile Date and Time : 2018-05-02 05:22:23 PM . It now appears those attacks were perpetrated by Harrison , who sent emails from different accounts at the free email service Vistomail pretending to be Bradshaw , his then - girlfriend and their friends .


changeActivity command The webview injects are not hosted on the C2 , they are hosted on a completely different server . From January 2018 to March 2018 , through FireEye 's Dynamic Threat Intelligence , we observed attackers leveraging the latest code execution and persistence techniques to distribute malicious macro-based documents to individuals in Asia and the Middle East . KHRAT : File Type : PE32 executable ( DLL ) Intel 80386, for MS Windows . It crafts configurable IEC-104 ASDU messages , to change the state of RTU IOAs to ON or OFF .


params : This command allows the malicious operator to change configuration parameters in the malware . MuddyWater has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia . KHRAT : File Name : 8081.dll . The usage of the h and m parameters and its values local and net are very similar to arguments used by Conti .


During this stage of the activation cycle , the malware increases the beaconing time to avoid detection . This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia . Rmcmd : In April , Talos discovered a new ransomware actor , RA Group , conducting double extortion attacks using their ransomware variant based on leaked Babuk source code .


Command to change the beaconing changeArchive : The final command of the activation cycle is the download of an archive . When successfully executed , the malicious documents install a backdoor we track as POWERSTATS . When the DLL is initially loaded , it dynamically resolves and imports additional modules ( DLLs ’ ) needed . The most significant similarities we identified are with INDUSTROYER and INDUSTROYER.V2 , which were both malware variants deployed in the past to impact electricity transmission and distribution .


This archive is stored in the same host has the webviews . The group is known for espionage campaigns in the Middle East . Once loaded and the export entry of Rmcmd is called , it creates a Windows B-TOOL S-OS mutex named gkdflbmdfk . By understanding the TTPs of the leaked source codes , defenders will gain invaluable insights that are helpful in identifying and mitigating any existing security weakness in their environment and improving their security defense against these attack vectors .


The archive is a ZIP containing several files , which is protected with a password . The threat group in this recently observed campaign – TEMP.Zagros – weaponized their malware using the following techniques . This ensures that only one copy of the malware is running at a time . The standard states that the purpose of threat intelligence should be to “ provide awareness of the organization 's threat environment so that the appropriate mitigation actions can be taken . ”


Change archive command After this activation cycle , the malware will start the collection of information activities and dissemination . The MuddyWater campaign was first sighted in 2017 when it targeted the Saudi government using an attack involving PowerShell scripts deployed via Microsoft Office Word macro . It then begins to beacon to a configured domain of connect.bafunpda.xyz on TCP port 8081 . There are currently five behavioral - based rules defined by Apple .


Malicious activity Once the activation cycle ends , the trojan will start its malicious activities . The threat group in this recently observed campaign a TEMP.Zagros a weaponized their malware using the following techniques . The malware collects and transmits data from the host , such as hostname and is XOR encoded with the first byte of the network traffic being the key . The SCIL - API interface in MicroSCADA has been disabled - by - default since the release of MicroSCADA 9.4 in 2014 .


These activities depend on the device configuration . Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload . Reverse Shell : The sample of PIEHOP we obtained contains programming logic errors that prevent it from successfully performing its IEC-104 control capabilities , but we believe these errors can be easily corrected .


Depending if the victim has any of the targeted applications , the anti-virus installed or geographic location , the malware can harvest credentials from the targeted applications , exfiltrate all personal information or simply use the victim 's device to send SMS to spread the trojan The malware deploys overlaying webviews to trick the user and eventually steal their login credentials . MuddyWater is a relatively new APT that surfaced in 2017 . The malware behavior and code share similarities with an older KHRAT sample from May 2018 . Otherwise , your data will be sold to DarkNetDarkWeb .


These are adapted to the information the malicious operator wants to retrieve . We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro as MuddyWater ) , an Iran-nexus actor that has been active since at least May 2017 . Sample ( SHA256 : bc1c3e754be9f2175b718aba62174a550cdc3d98ab9c36671a58073140381659 ) has the same export entry name and is also a reverse shell . An adversary may also destroy data backups that are vital to recovery after an incident .


The first webview overlay is created on step 6 of the activation cycle . We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro ) , an Iran-nexus actor that has been active since at least May 2017 . The newer sample appears to be a re-write for optimization purposes with the underlying behavior remaining the same , reverse shell . First , the endpoint , used for informing clients about services offered by the remote Microsoft Exchange server , is accessed using an authenticated request to the frontend .


Pin request overlay This overlay asks the user to provide their PIN to unlock the mobile device , which is immediately exfiltrated to the C2 . Entities in these sectors are often " enabling victims " as telecommunications providers or IT services agencies and vendors could provide Seedworm actors with further victims to compromise . Derusbi : SHA256 : 83d1d181a6d583bca2f03c3c4e517757a766da5f4c1299fbbe514b3e2ab . These individuals are targeting companies due to a difference in values .


The last step of the activation cycle is the download of a password-protected ZIP file . The group mainly targets the telecommunications and IT services sectors . Derusbi : Compile Date and Time : 2012-09-14 09:20:12 AM . But then , following an upsurge in attacks in the second half of 2014 , GReAT characterized MiniDuke , CosmicDuke and the actor ’s Nemesis Gemina project - targeting government , diplomatic , energy , military and telecom operators - as ‘ one of the world ’s most unusual APT operations ’ due to : • Its use of a customized backdoor written in Assembler using ‘ old school ’ virus writing techniques and habits • Stealthy transfer of updates as executables hidden inside GIF files ( a form of steganography )


This file contains all HTML , CSS and PNG files necessary to create overlays . However , the group behind MuddyWater has been known to target other countries in the Middle East , Europe and the US . Derusbi : File Type :P E32 executable ( DLL ) Intel 80386, for MS Windows . UNC2639 was first identified exploiting multiple zero - day vulnerabilities in Microsoft Exchange in early March 2021 .


Talos found 189 logos from banks to cryptocurrency exchanges inside the archive , all of which could be targeted . The group has focused mainly on governmental targets in Iraq and Saudi Arabia , according to past telemetry . Derusbi : File Name : 32.dll . We have observed TANKTRAP being used with other disruptive tools including NEARMISS , SDELETE , PARTYTICKET , and CADDYWIPER .


The archive also contained all the necessary codes to target Australian financial institutions . The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros . Derusbi is a backdoor B-MAL S-MAL Trojan E-MAL believed to be used among a small group of attackers , which includes the Rancor group . Open - source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org .


The overlays are activated by the malicious operator using the command changeActivity , as seen on step 5 of the activation cycle . MuddyWater has recently been targeting victims likely from Lebanon and Oman , while leveraging compromised domains , one of which is owned by an Israeli web developer . This particular sample is a loader that loads an encrypted payload for its functionality . The government even offered a reward of up to $ 10 million for information on Cl0p after several federal agencies in the US fell victim to the gang .


In this case , we can see that the HTML code of the overlay is stored in the C2 infrastructure . As MuddyWater has consistently been using POWERSTATS as its main tool , they are relatively easy to distinguish from other actors . This DLL requires the loading executable to include a 32-byte key on the command line to be able to decrypt the embedded payload , which unfortunately we do not have . Sandworm later conducted a second disruptive event by deploying a new variant of CADDYWIPER in the victim ’s IT environment .


However , since the archive that is downloaded into the device has all the necessary information and the malicious actor has access to the device via SMS , the malicious operator can keep its activity even without the C2 infrastructure . In March 2018 , Trend Micro provided a detailed analysis of another campaign that bore the hallmarks of MuddyWater . Even though we don’t have the decryption key or loader , we have uncovered some interesting artifacts . Those desiring to steal payment card data typically install malware on point of sale systems POS with the intent of stealing magnetic stripe data .


Infrastructure The infrastructure supporting this malware is rather complex . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign . If the module that loads the sample is named myapp.exe the module will exit Once loaded , it sleeps for six seconds . The adversary may drop or create malware , tools , or other non - native files on a target system to accomplish this , potentially leaving behind traces of malicious activities .


It is clear that on all stages there are at least two layers . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign . Looks for a Windows pipe named \\.\pipe\_kernel32.dll.ntdll.dll.user32.dll . The new documentary , The Ashley Madison Affair , begins airing today on Hulu in the United States and on Disney+ in the United Kingdom .


The infrastructure has several layers , although not being very dynamic , still has several layers each one providing some level of protection . Given the use of lure documents designed with social engineering in mind , it is likely that MuddyWater use phishing or spam to target users who are unaware of these documents ' malicious nature . Looks for a Windows device named \Device\acpi_010221 . n July 2019 , we discovered an interesting VBScript named Chrome.vbs ( SHA256 : 0C3D4DFA566F3064A8A408D3E1097C454662860BCACFB6675D2B72739CE449C2 ) associated with the Rancor group . Following a three - month lull of activity , Cl0p returned with a vengeance in June and beat out LockBit as the month ’s most active ransomware gang .


All the IP addresses belong to the same company Hetzner , an IP-hosting firm in Germany . We recently noticed the group behind MuddyWater that appear to be targeting government bodies , military entities , telcos and educational institutions in Jordan , Turkey , Azerbaijan and Pakistan , in addition to the continuous targeting of Iraq and Saudi Arabia , other victims were also detected in Mali , Austria , Russia , Iran and Bahrain. . This particular VBScript payload beacons to domain bafunpda.xyz , which is also used by the KHRAT S-MAL Trojan E-MAL listed above in Table 2 . COSMICENERGY Possibly Associated With Russian Government - Funded Power Disruption and Emergency Response Exercises During our analysis of COSMICENERGY , we identified a comment in the code that indicated the sample uses a module associated with a project named “ Solar Polygon ” ( Figure 2 ) .


COVERAGE Cisco Cloud Web Security ( CWS ) or Web Security Appliance ( WSA ) web scanning prevents access to malicious websites and detects malware used in these attacks . Observed Seedworm victims were located primarily in Pakistan and Turkey , but also in Russia , Saudi Arabia , Afghanistan , Jordan , and elsewhere . This VBScript is obfuscated and contains packed data that is used to infect a target with multiple chained persistent artifacts . This third - stage backdoor is tracked as DOUBLEBACK .


Email Security can block malicious emails sent by threat actors as part of their campaign . The MuddyWaters group has carried out a large number of attacks and demonstrated advanced social engineering , in addition to the active development of attacks , infrastructure and the use of new methods and techniques . The MOF file created by the VBScript is used as a persistence mechanism via Windows B-TOOL S-OS Management Instrumentation ( WMI ) Event Subscriptions . This CVE is in CISA 's Known Exploited Vulnerabilities Catalog Reference CISA 's BOD 22 - 01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements .


Network Security appliances such as Next-Generation Firewall ( NGFW ) , Next-Generation Intrusion Prevention System ( NGIPS ) , and Meraki MX can detect malicious activity associated with this threat . Cisco Talos assesses with moderate confidence that a campaign we recently discovered called " BlackWater " is associated with suspected persistent threat actor MuddyWater . MOF files are compiled scripts that describe Common Information Model ( CIM ) classes , which are compiled into the WMI repository . Given that threat actors use red team tools and public exploitation frameworks for targeted threat activity in the wild , we believe COSMICENERGY poses a plausible threat to affected electric grid assets .


AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products . In this latest activity , BlackWater first added an obfuscated Visual Basic for Applications ( VBA ) script to establish persistence as a registry key . The technique is described by MITRE S-SECTEAM ATT&CK IDT1084 . The actors appear to target victims in Kuwait , as the ransom note demands payment in Kuwaiti dinar before translating that sum to its U.S. dollar equivalent in Bitcoin .


Umbrella , our secure internet gateway ( SIG ) , blocks users from connecting to malicious domains , IPs , and URLs , whether users are on or off the corporate network . Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater . This particular MOF file creates a timer event that is triggered every five seconds . The adversary may drop or create malware , tools , or other non - native files on a target system to accomplish this , potentially leaving behind traces of malicious activities .


Open Source SNORTⓇ Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org . MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East . The DLL located in the Media registry key is a variant of the KHRAT Troja S-MALn E-MAL . None After initial access via this new exploit method , the threat actor leveraged maintain access , and performed anti - forensics techniques on the Microsoft Exchange server in an attempt to hide their activity .


INDICATORS OF COMPROMISE ( IOCS ) Domains Facebook-photos-au.su Homevideo2-12l.ml videohosting1-5j.gq URLs hxxp : //88.99.227 [ . Between February and March 2019 , probable MuddyWater-associated samples indicated that BlackWater established persistence on the compromised host , at used PowerShell commands to enumerate the victim 's machine and contained the IP address of the actor 's command and control ( C2 ) . It beacons to domain connect.bafunpda.xyz and attempts to connect to TCP port 4433 . They once attacked a game server to illicitly farm in - game currency ( “ gaming gold ” , which also has real - world value ) and stole source codes of online game projects .


] 26/html2/2018/GrafKey/new-inj-135-3-dark.html hxxp : //88.99.227 [ . Despite last month 's report on aspects of the MuddyWater campaign , the group is undeterred and continues to perform operations . This is the same domain used by the KHRAT S-MAL Trojan E-MAL . Adversaries may manipulate control systems devices or possibly leverage their own , to communicate with and command physical control processes .


] 26/html2/arc92/au483x.zip hxxp : //94.130.106 [ . Based on these observations , as well as MuddyWater 's history of targeting Turkey-based entities , we assess with moderate confidence that this campaign is associated with the MuddyWater threat actor group . Rancor , a cyber espionage group active since at least 2017 , continues to conduct targeted attacks in Southeast Asia E-LOC and has been found using an undocumented , custom malware family – which we ’ve dubbed Dudell – to download a second stage payload once its malicious macro is executed . Based on these findings , CrowdStrike assesses it is highly likely that the OWA technique employed is in fact tied to CVE-2022 - 41080 .


] 117:8080/api/v1/report/records.php hxxp : //88.99.227 [ . Our recent report , " The Chronicles of the Hellsing APT : the Empire Strikes Back " began with an introduction to the Naikon APT , describing it as " One of the most active APTs in Asia , especially around the South China Sea " . Additionally , Rancor is also using the Derusbi malware family to load a secondary payload once it infiltrates a target . PBI Research Services also reported a data breach that exposed information for 4.75 million people .


] 26/html2/new-inj-135-3-white.html hxxp : //facebook-photos-au [ . It came in the form of a " Tran Duy Linh " CVE-2012-0158 exploit kit document MD5 : de8a242af3794a8be921df0cfa51885f61 and was observed on April 10 , 2014 . Rancor : 0EB1D6541688B5C87F620E76219EC5DB8A6F05732E028A9EC36195D7B4F5E707 . SecretsDump A publicly available tool that can perform various techniques to dump secrets from the remote machine without executing any agent .


] su/ChristinaMorrow hxxp : //homevideo2-12l [ . Considering the volume of Naikon activity observed and its relentless , repeated attack attempts , such a confrontation was worth looking into , so we did . Rancor : AAEBF987B8D80D71313C3C0F2C16D60874FFECBDDA3BB6B44D6CBA6D38031609 . Ashley Madison ’s parent company — Toronto - based Avid Life Media — filed a trademark infringement complaint in 2010 that succeeded in revealing a man named Dennis Bradshaw as the owner .


] ml/mms3/download_3.php IP addresses 78.46.201.36 88.99.170.84 88.99.227.26 94.130.106.117 88.99.174.200 88.99.189.31 Hash 369fcf48c1eb982088c22f86672add10cae967af82613bee6fb8a3669603dc48 b2d4fcf03c7a8bf135fbd3073bea450e2e6661ad8ef2ab2058a3c04f81fc3f3e The attackers appeared to be Chinese-speaking and targeted mainly top-level government agencies and civil and military organizations in countries such as the Philippines , Malaysia , Cambodia , Indonesia , Vietnam , Myanmar , Singapore , Nepal , Thailand , Laos and China . Rancor : 0D61D9BAAB9927BB484F3E60384FDB6A3709CA74BC6175AB16B220A68F2B349E . The 2015 and 2016 Ukraine blackout events each featured several discrete disruptive events against the OT environment ( e.g. , disabling UPS systems , bricking serial - to - ethernet converters , conducting a DoS attack against a SIPROTEC relay , wiping OT systems , etc . ) .


8f5d5d8419a4832d175a6028c9e7d445f1e99fdc12170db257df79831c69ae4e a5ebcdaf5fd10ec9de85d62e48cc97a4e08c699a7ebdeab0351b86ab1370557d 84578b9b2c3cc1c7bbfcf4038a6c76ae91dfc82eef5e4c6815627eaf6b4ae6f6 The oil and gas infrastructure nexus observed in connection with greensky27.vicp.net and other Unit 78020 ( Naikon ) infrastructure suggests targeting patterns supportive of the PRC 's strategic interests over energy resources within the South China Sea and Southeast Asia . Rancor : DB982B256843D8B6429AF24F766636BB0BF781B471922902D8DCF08D0C58511E . Then , it is called passing reused allocated memory and not a pointer to structure .