89eecd91dff4bf42bebbf3aa85aa512ddf661d3e9de4c91196c98f4fc325a018 9edee3f3d539e3ade61ac2956a6900d93ba3b535b6a76b3a9ee81e2251e25c61 0e48e5dbc3a60910c1460b382d28e087a580f38f57d3f82d4564309346069bd1 c113cdd2a5e164dcba157fc4e6026495a1cfbcb0b1a8bf3e38e7eddbb316e01f This Naikon report will be complemented by a follow-on report that will examine the Naikon TTP and the incredible volume of attack activity around the South China Sea that has been going on since at least 2010 . Rancor : CC081FFEA6F4769733AF9D0BAE0308CA0AE63667FA225E7965DF0884E96E2D2A . These observations leave open the possibility that COSMICENERGY was developed with malicious intent , and at a minimum that it can be used to support targeted threat activity in the wild .


1819d2546d9c9580193827c0d2f5aad7e7f2856f7d5e6d40fd739b6cecdb1e9e b213c1de737b72f8dd7185186a246277951b651c64812692da0b9fdf1be5bf15 453e7827e943cdda9121948f3f4a68d6289d09777538f92389ca56f6e6de03f0 0246dd4acd9f64ff1508131c57a7b29e995e102c74477d5624e1271700ecb0e2 The attackers appeared to be Chinese-speaking and targeted mainly top-level government agencies and civil and military organizations in countries such as the Philippines , Malaysia , Cambodia , Indonesia , Vietnam , Myanmar , Singapore , Nepal . Rancor : BC1C3E754BE9F2175B718ABA62174A550CDC3D98AB9C36671A58073140381659 . Although this wave did not use any zero day exploits , it relied on steganography and NTFS alternate data streams to complicate detection .


88034e0eddfdb6297670d28ed810aef87679e9492e9b3e782cc14d9d1a55db84 e08f08f4fa75609731c6dd597dc55c8f95dbdd5725a6a90a9f80134832a07f2e 01c5b637f283697350ca361f241416303ab6123da4c6726a6555ac36cb654b5c 1fb06666befd581019af509951320c7e8535e5b38ad058069f4979e9a21c7e1c This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . Rancor : 83d1d181a6d583bca2f03c3c4e517757a766da5f4c1299fbbe514b3e2abd9e0d . Second , as COSMICENERGY was potentially developed as part of a red team , this discovery suggests that the barriers to entry are lowering for offensive OT threat activity since we normally observe these types of capabilities limited to well resourced or state sponsored actors .


6bdfb79f813448b7f1b4f4dbe6a45d1938f3039c93ecf80318cedd1090f7e341 ADDITIONAL INFORMATION Packages monitored pin.secret.access com.chase.sig.android com.morganstanley.clientmobile.prod com.wf.wellsfargomobile com.citi.citimobile com.konylabs.capitalone com.infonow.bofa com.htsu.hsbcpersonalbanking com.usaa.mobile.android.usaa In the Naikon scheme , a C&C server can be specialized XSControl software running on the host machine . Rancor : cswksfwq.kfesv.xyz . An adversary could potentially instruct a control systems device to perform an action that will cause an Impact


com.schwab.mobile com.americanexpress.android.acctsvcs.us com.pnc.ecommerce.mobile com.regions.mobbanking com.clairmail.fth com.grppl.android.shell.BOS com.tdbank com.huntington.m com.citizensbank.androidapp com.usbank.mobilebanking com.ally.MobileBanking com.key.android com.unionbank.ecommerce.mobile.android com.mfoundry.mb.android.mb_BMOH071025661 It was during operator X 's network monitoring that the attackers placed Naikon proxies within the countries ' borders , to cloak and support real-time outbound connections and data exfiltration from high-profile victim organizations . Rancor : Connect.bafunpda.xyz . The archive contained a RAR SFX which installed the malware and showed an empty PDF decoy .


com.bbt.cmol com.sovereign.santander com.mtb.mbanking.sc.retail.prod com.fi9293.godough com.commbank.netbank org.westpac.bank org.stgeorge.bank au.com.nab.mobile au.com.bankwest.mobile au.com.ingdirect.android org.banksa.bank com.anz.android com.anz.android.gomoney com.citibank.mobile.au org.bom.bank com.latuabancaperandroid In addition to stealing keystrokes , Naikon also intercepted network traffic . Rancor : 199.247.6.253 . Note : The default log rotation configuration on NetScaler allows 25 files per log type ( e.g. , ns.log ) and 100 Kilobytes per log , therefore recording 2.5 megabytes in total .


com.comarch.mobile com.jpm.sig.android com.konylabs.cbplpat by.belinvestbank no.apps.dnbnor com.arkea.phonegap com.alseda.bpssberbank com.belveb.belvebmobile com.finanteq.finance.ca pl.eurobank pl.eurobank2 pl.noblebank.mobile com.getingroup.mobilebanking hr.asseco.android.mtoken.getin pl.getinleasing.mobile com.icp.ikasa.getinon Operator X also took advantage of cultural idiosyncrasies in its target countries , for example , the regular and widely accepted use of personal Gmail accounts for work . Cyberwarfare : A deep dive into the latest Gamaredon Espionage Campaign . The memory dump file can be processed offline by the threat actor to extract credentials .


eu.eleader.mobilebanking.pekao softax.pekao.powerpay softax.pekao.mpos dk.jyskebank.mobilbank com.starfinanz.smob.android.bwmobilbanking eu.newfrontier.iBanking.mobile.SOG.Retail com.accessbank.accessbankapp com.sbi.SBIFreedomPlus com.zenithBank.eazymoney net.cts.android.centralbank com.f1soft.nmbmobilebanking.activities.main com.lb.smartpay com.mbmobile In the spring of 2014 , we noticed an increase in the volume of attack activity by the Naikon APT . Gamaredon Group is a Cyber Espionage persistent operation attributed to Russians FSB ( Federal Security Service ) in a long-term military and geo-political confrontation against the Ukrainian government and more in general against the Ukrainian military power . Siamesekitten has been active since 2018 and has in the past targeted oil , gas , and telecom companies .


com.db.mobilebanking com.botw.mobilebanking com.fg.wallet com.sbi.SBISecure com.icsfs.safwa com.interswitchng.www com.dhanlaxmi.dhansmart.mtc com.icomvision.bsc.tbc hr.asseco.android.jimba.cecro com.vanso.gtbankapp com.fss.pnbpsp com.mfino.sterling cy.com.netinfo.netteller.boc ge.mobility.basisbank com.snapwork.IDBI In particular , we noticed that the Naikon group was spear-phished by an actor we now call " Hellsing " . Gamaredon has been active since 2014 , and during this time , the modus operandi has remained almost the same . The lure contains a payment instruction form containing VBA code , which appears to have been sent from the State Treasury Service of Ukraine .


com.lcode.apgvb com.fact.jib mn.egolomt.bank com.pnbrewardz com.firstbank.firstmobile wit.android.bcpBankingApp.millenniumPL com.grppl.android.shell.halifax com.revolut.revolut de.commerzbanking.mobil uk.co.santander.santanderUK se.nordea.mobilebank com.snapwork.hdfc com.csam.icici.bank.imobile com.msf.kbank.mobile More details about the cloak and dagger games between Naikon and Hellsing can be found in our blogpost : " The Chronicles of the Hellsing APT : The Empire Strikes Back " . The most used malware implant is dubbed Pteranodon or Pterodo and consists of a multistage backdoor designed to collect sensitive information or maintaining access on compromised machines . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


com.bmm.mobilebankingapp net.bnpparibas.mescomptes fr.banquepopulaire.cyberplus com.caisseepargne.android.mobilebanking com.palatine.android.mobilebanking.prod com.ocito.cdn.activity.creditdunord com.fullsix.android.labanquepostale.accountaccess mobi.societegenerale.mobile.lappli com.db.businessline.cardapp com.skh.android.mbanking com.ifs.banking.fiid1491 Truvasys has been involved in several attack campaigns , where it has masqueraded as one of server common computer utilities , including WinUtils , TrueCrypt , WinRAR , or SanDisk . It is distributed in a spear phishing campaign with a weaponized ofﬁce document that appears to be designed to lure military personnel . The injected code calls out a first domain ( seen above encoded in Base64 ) and generates a Base64 response : Decoding it reveals a URL pointing to the actual skimming code , which is heavily obfuscated ( likely via obfuscator.io ): The data exfiltration is also done differently as seen in the image below .


de.dkb.portalapp pl.pkobp.ipkobiznes pl.com.suntech.mobileconnect eu.eleader.mobilebanking.pekao.firm pl.mbank pl.upaid.nfcwallet.mbank eu.eleader.mobilebanking.bre pl.asseco.mpromak.android.app.bre pl.asseco.mpromak.android.app.bre.hd pl.mbank.mnews eu.eleader.mobilebanking.raiffeisen pl.raiffeisen.nfc hr.asseco.android.jimba.rmb PROMETHIUM is an activity group that has been active as early as 2012 . In the recent months , Ukrainian CERT ( CERT-UA ) reported an intensiﬁcation of Gamaredon B-ACT S-APT Cyberattacks against military targets . The Aclip backdoor uses the Slack API to send system data , files , and screenshots to the C2 while receiving PowerShell commands at the same time .


com.advantage.RaiffeisenBank pl.bzwbk.ibiznes24 pl.bzwbk.bzwbk24 pl.bzwbk.mobile.tab.bzwbk24 com.comarch.mobile.investment com.android.vending com.snapchat.android jp.naver.line.android com.viber.voip com.gettaxi.android com.whatsapp com.tencent.mm com.skype.raider com.ubercab com.paypal.android.p2pmobile The group primarily uses Truvasys , a first-stage malware that has been in circulation for several years . The new wave dates back to the end of November 2019 and was ﬁrst analyzed by Vitali Kremez . The contents found in secure[.]66[.]to often lead to zhu[.]vn , which is Hack520 ’s domain for hosting his own private blog .


com.circle.android com.coinbase.android com.walmart.android com.bestbuy.android com.ebay.gumtree.au com.ebay.mobile com.westernunion.android.mtapp com.moneybookers.skrillpayments com.gyft.android com.amazon.mShop.android.shopping com.comarch.mobile.banking.bgzbnpparibas.biznes pl.bnpbgzparibas.firmapp com.finanteq.finance.bgz pl.upaid.bgzbnpp NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird . Starting from those ﬁndings , Cybaze-Yoroi ZLab team decided to deep dive into a technical analysis of the latest Pterodo implant . In addition , Hack520 ’s tweets always show photos of the same animal , which is likely his pet pig .


de.postbank.finanzassistent pl.bph de.comdirect.android com.starfinanz.smob.android.sfinanzstatus de.sdvrz.ihb.mobile.app pl.ing.mojeing com.ing.mobile pl.ing.ingksiegowosc com.comarch.security.mobilebanking com.comarch.mobile.investment.ing com.ingcb.mobile.cbportal de.buhl.finanzblick pl.pkobp.iko pl.ipko.mobile pl.inteligo.mobile de.number26.android PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched . The complex infection chain begins with a weaponized Ofﬁce document named “ f.doc ” . Schools , colleges , and universities must somehow reconcile tight budgets with the need to deploy a sophisticated enough detection and response capability to find and evict stealthy adversaries like Vice Society .


pl.millennium.corpApp eu.transfer24.app pl.aliorbank.aib pl.corelogic.mtoken alior.bankingapp.android com.ferratumbank.mobilebank com.swmind.vcc.android.bzwbk_mobile.app de.schildbach.wallet piuk.blockchain.android com.bitcoin.mwallet com.btcontract.wallet com.bitpay.wallet com.bitpay.copay btc.org.freewallet.app org.electrum.electrum Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks . Hash : 76ea98e1861c1264b340cf3748c3ec74473b04d042cd6bfda9ce51d086cb5a1a That piece explored how Biderman — who is Jewish — had become the target of concerted harassment campaigns by anti - Semitic and far - right groups online in the months leading up to the hack .


com.xapo com.airbitz com.kibou.bitcoin com.qcan.mobile.bitcoin.wallet me.cryptopay.android com.bitcoin.wallet lt.spectrofinance.spectrocoin.android.wallet com.kryptokit.jaxx com.wirex bcn.org.freewallet.app com.hashengineering.bitcoincash.wallet bcc.org.freewallet.app com.coinspace.app btg.org.freewallet.app net.bither In early May 2016 , both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe . Threat : Gamaredon Pteranodon weaponized document . The threat actor cleared Windows Event Logs on affected backend Exchange servers so further information was not available regarding the PowerShell commands leveraged by the threat actors .


co.edgesecure.app com.arcbit.arcbit distributedlab.wallet de.schildbach.wallet_test com.aegiswallet com.plutus.wallet com.coincorner.app.crypt eth.org.freewallet.app secret.access secret.pattern RuMMS : The Latest Family of Android Malware Attacking Users in Russia Via SMS Phishing April 26 , 2016 Introduction Recently we observed an Android malware family being used to attack users in Russia . Meanwhile , NEODYMIUM used well-tailored spear-phishing emails with attachments that delivered the exploit code , ultimately leading to Wingbird 's installation on victim computers . Brief Description : Doc ﬁle weaponized with Exploit . Although Mandiant has no data on the objectives of this threat actor , their broad targeting across industries and geographies is consistent with a targeting calculus most commonly seen among financially motivated groups .


The malware samples were mainly distributed through a series of malicious subdomains registered under a legitimate domain belonging to a well-known shared hosting service provider in Russia . PROMETHIUM and NEODYMIUM both used a zero-day exploit that executed code to download a malicious payload . Ssdeep : 768:u0foGtYZKQ5QZJQ6hKVsEEIHNDxpy3TI3dU4DKfLX9Eir : uG1aKQ5OwCrItq3TgGfLt9r . It now appears those attacks were perpetrated by Harrison , who sent emails from different accounts at the free email service Vistomail pretending to be Bradshaw , his then - girlfriend and their friends .


Because all the URLs used in this campaign have the form of hxxp : //yyyyyyyy [ . Wingbird , the advanced malware used by NEODYMIUM , has several behaviors that trigger alerts in Windows Defender ATP . The decoy document is written using the ukrainian language mixed to many special chars aimed to lure the target to click on it . A month later , GReAT discovered two more previously unknown infection mechanisms for MiniDuke , which relied on Java and Internet Explorer vulnerabilities to infect the victim ’s PC .


] XXXX.ru/mms.apk ( where XXXX.ru represents the hosting provider ’ s domain ) , we named this malware family RuMMS . This volume chronicles two activity groups , code-named PROMETHIUM and NEODYMIUM , both of which target individuals in a specific area of Europe . The document leverages the common exploit aka template injection and tries to download a second stage from “ http://win-apu.ddns.net/apu.dot ” . In one of our previous blog entries , we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming , pharmaceutical , and telecommunications companies .


To lure the victims to download the malware , threat actors use SMS phishing – sending a short SMS message containing a malicious URL to the potential victims . Although most malware today either seeks monetary gain or conducts espionage for economic advantage , both of these activity groups appear to seek information about specific individuals . Thanks to this exploit ( Remote Code Execution exploit ) the user interaction is not required , in fact the “ enable macro ” button is not shown . Criminals are also using malvertising via search engines to lure potential victims in .


Unwary users who click the seemingly innocuous link will have their device infected with RuMMS malware . In May 2016 , both PROMETHIUM and NEODYMIUM were observed to launch attack campaigns . The downloaded document has a “ .dot ” extension , used by Microsoft Ofﬁce to save templates for different documents with similar formats . The attackers are known for their targeting of highvalue victims , often focusing on organizations in the government , technology , and defense sectors .


Figure 1 describes this infection process and the main behaviors of RuMMS . NEODYMIUM is an activity group that , like PROMETHIUM , conducted an attack campaign in early May 2016 . Basic Information on the “ .dot ” ﬁle are provided : The ransom note also makes reference to 3AM


On April 3 , 2016 , we still observed new RuMMS samples emerging in the wild . Data about Wingbird activity indicates that it is typically used to attack individuals and individual computers instead of networks . Hash : e2cb06e0a5c14b4c5f58d0e56a1dc10b6a1007cf56c77ae6cb07946c3dfe82d8 . While COSMICENERGY ’s capabilities are not significantly different from previous OT malware families ’ , its discovery highlights several notable developments in the OT threat landscape .


The earliest identified sample , however , can be traced back to Jan. 18 , 2016 . NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used , prior to public knowledge of the vulnerability 's existence . Threat : Gamaredon Pteranodon loader dot ﬁle . This type of vulnerability is known as a server - side request forgery ( SSRF ) .


Within this time period , we identified close to 300 samples belonging to this family ( all sample hashes are listed in the Appendix ) . NEODYMIUM used a backdoor detected by Windows Defender as Wingbird , whose characteristics closely match FinFisher , a government-grade commercial surveillance package . Brief Description : Dot ﬁle enabling the infection of the Gamaredon Pteranodon . Ashley Madison ’s parent company — Toronto - based Avid Life Media — filed a trademark infringement complaint in 2010 that succeeded in revealing a man named Dennis Bradshaw as the owner .


After landing on the victim ’ s phone , the RuMMS apps will request device administrator privileges , remove their icons to hide themselves from users , and remain running in the background to perform a series of malicious behaviors . In May 2016 , two apparently unrelated activity groups , PROMETHIUM and NEODYMIUM , conducted attack campaigns in Europe that used the same zeroday exploit while the vulnerability was publicly unknown . Ssdeep : 768:5KCB8tnh7oferuHpC0xw+hnF4J7EyKfJ : oI8XoWruHpp/P4 . COSMICENERGY accomplishes this via its two derivative components , which we track as PIEHOP and LIGHTWORK ( see appendices for technical analyses ) .


So far we have identified the following behaviors : Sending device information to a remote command and control ( C2 ) server . The Middle Eastern hacker group in this case is codenamed " BlackOasis " Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . If we decide to open the document , we see that the document is empty , but it requires the enabling of the macro . Spyware can even be used to track the device 's physical location and record from the camera or microphone .


Contacting the C2 server for instructions . FinSpy , a final-stage payload that allows for an attacker to covertly learn what a target is talking about and who they are communicating with , is associated with Gamma Group — which goes by other names , including FinFisher and Lench IT Solutions . The body of the macro can be logically divided into two distinct parts : The Monti ransomware collective has restarted their operations , focusing on institutions in the legal and governmental fields .


Sending SMS messages to financial institutions to query account balances . In the past , BlackOasis messages were designed to appear like news articles from 2016 about political relations between Angola and China . The ﬁrst one is the setting of the registry key “ HKEY_CURRENT_USER\Software\Microsoft\Ofﬁce\ ” & Application.Version & _ ” \Word\Security\ ” and the declaration of some other variables , such as the dropurl “ geticons.ddns.net ” . In November 2016 , Volexity documented new Dukes - related activity involving spear phishing with links to a ZIP archive containing a malicious LNK file , which would run PowerShell commands to install a new custom backdoor called PowerDuke .


Uploading any incoming SMS messages ( including the balance inquiry results ) to the remote C2 server . BlackOasis in recent months sent a wave of phishing emails . The second one is the setting of the persistence mechanism through the writing of the vbs code in the Startup folder with name “ templates.vbs ” . When Bradshaw refused to sell the domain , he and his then - girlfriend were subject to an unrelenting campaign of online harassment and blackmail .


Sending C2-specified SMS messages to phone numbers in the victim ’ s contacts . PROMETHIUM uses a unique set of tools and methods to perform actions like lateral movement and data exfiltration . This vbs is properly the macro executed by the macro engine of word . Threat actors are always looking to expand the strategies they use , thus security practices and solutions that work for less organized cybercriminals might not work for determined groups who are willing to spend time , resources and manpower to accomplish their goals .


Forward incoming phone calls to intercept voice-based two-factor authentication . Last year , Microsoft researchers described Neodymium 's behavior as unusual : " unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals . Analyzing the content of “ templates.vbs ” it is possible to notice that it deﬁne a variable containing a URL like “ http://geticons.ddns.net/ADMIN-PC_E42CAF54//autoindex . ]php ” obtained from “ hxp://get-icons.ddns . ]net/ ” & NlnQCJG & “ _ ” & uRDEJCn & “ //autoindex . ]php ” , where “ NlnQCJG ” is the name that identiﬁes the computer on the network and “ uRDEJCn ” is the serial number of drive in hexadecimal encoding . In October , U.S. Senator Elizabeth Warren and Representative Deborah Ross introduced the Ransom Disclosure Act , with the goal of better understanding how cybercriminals are operating .


Each of these behaviors is under the control of the remote C2 server . The discovery by Kaspersky marks at least the fifth zero-day exploit used by BlackOasis and exposed by security researchers since June 2015 . From this URL it tries to download another stage then storing it into “ C:\Users\admin\AppData\Roaming\ ” path with random name . NjRAT is an open - source remote access trojan ( RAT ) whose source code is freely available and is used by commodity actors and APTs , making the process of attribution more difficult .


In other words , the C2 server can specify the message contents to be sent , the time period in which to forward the voice call , and the recipients of outgoing messages . Victims of BlackOasis have been observed in the following countries : Russia , Iraq , Afghanistan , Nigeria , Libya , Jordan , Tunisia , Saudi Arabia , Iran , Netherlands , Bahrain , United Kingdom and Angola . At the end , “ templates.vbs ” script will force the machine to reboot . PBI Research Services also reported a data breach that exposed information for 4.75 million people .


As part of our investigation into this malware , we emulated an infected Android device in order to communicate with the RuMMS C2 server . Unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals . The dropped sample is an SFX archive , like the tradition of Gamaredon implants . Last month , NoEscape posted 7 victims on their leak site .


During one session , the C2 server commanded our emulated device to send four different SMS messages to four different phone numbers , all of which were associated with Russian financial institutions . A cursory review of BlackOasis ' espionage campaign suggests there is some overlap between the group 's actions and Saudi Arabia 's geopolitical interests . Hash : c1524a4573bc6acbe59e559c2596975c657ae6bbc0b64f943fffca663b98a95f . HHS HC3 pointed out that some emails included a subject line Victim Organization Date Business Review and gave the user the impression they were opening a secure email from their organization .


At least three of the messages were intended to check a user ’ s account balance at the institution ( we could not confirm the purpose of the fourth ) .Through additional research , we identified several forum posts where victims complained of funds ( up to 600 rubles ) were transferred out of their accounts after RuMMS infected their phones . Kaspersky 's research notes that BlackOasis hacked into computers based in Saudi Arabia . Threat : Gamaredon Pteranodon implant SFX archive . COSMICENERGY Possibly Associated With Russian Government - Funded Power Disruption and Emergency Response Exercises During our analysis of COSMICENERGY , we identified a comment in the code that indicated the sample uses a module associated with a project named “ Solar Polygon ” ( Figure 2 ) .


We do not know exactly how many people have been infected with RuMMS malware . All 13 countries where Kaspersky reportedly observed BlackOasis activity are connected to Saudi Arabia in one of three ways : economically ; from a national security perspective ; or due to established policy agreements . Brief Description : SFX Archive First Stage . In particular , we managed to gather details on an individual using the handle Hack520 , who we believe is connected to Winnti .


However , our data suggests that there have been at least 2,729 infections between January 2016 and early April 2016 , with a peak in March of more than 1,100 infections . The Operation Aurora , named by McAfee and announced in January 2010 , and the WikiLeaks document disclosures of 2010 have highlighted the fact that external and internal threats are nearly impossible to prevent . Ssdeep : 24576:zXwOrRsTQlIIIIwIEuCRqKlF8kmh/ZGg4kAL/WUKN7UMOtcv : zgwR/lIIIIwI6RqoukmhxGgZ+WUKZUMv . Mandiant has tracked KillNet activity back to January 2022 , despite a claim by the collective ’s alleged founder that it began operations in 2021 .


Smishing : The Major Way To Distribute RuMMS We have not observed any instances of RuMMS on Google Play or other online app stores . These attacks have involved social engineering , spearphishing attacks , exploitation of Microsoft Windows operating systems vulnerabilities , Microsoft Active Directory compromises , and the use of remote administration tools ( RATs ) in targeting and harvesting sensitive competitive proprietary operations and project-financing information with regard to oil and gas field bids and operations . By simply opening the SFX archive , it is possible to notice two different ﬁles that are shown below and named respectively “ 8957.cmd ” and “ 28847 ” . In one particular forum post , Hack520 mentions that he was previously jailed for a period of 10 months in a blog post dated May 31 , 2009 .


Smishing ( SMS phishing ) is currently the primary way threat actors are distributing the malware . Night Dragon 's attacks have involved social engineering , spearphishing attacks , exploitation of Microsoft Windows operating systems vulnerabilities , Microsoft Active Directory compromises , and the use of remote administration tools ( RATs ) in targeting and harvesting sensitive competitive proprietary operations and project-financing information with regard to oil and gas field bids and operations . When executed , the SFX archive will be extracted and the “ 8957.cmd ” will be run . CrowdStrike Falcon will detect the OWASSRF exploit method described in this blog , and will block the method if the prevention setting for • None Monitor Exchange servers for signs of exploitation visible in IIS and Remote PowerShell logs using this script developed by CrowdStrike Services • None Consider application - level controls such as web application firewalls .


The process starts when an SMS phishing message arrives at a user ’ s phone . We have identified the tools , techniques , and network activities used in these continuing attacks—which we have dubbed Night Dragon—as originating primarily in China . At this point , the batch script renames the “ 28847 ” ﬁle in “ 28847.exe ” , opens it using “ pﬂjk ,fkbcerbgblfhs ” as password and the ﬁle contained inside the “ 28847.exe ” ﬁle will be renamed in “ WuaucltIC.exe ” . Instead , it appeared that corresponding requests were made directly through the Outlook Web Application ( OWA ) endpoint , indicating a previously undisclosed exploit method for Exchange .


An example SMS message is shown in Figure 1 . Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information . Finally , it will be run using “ post.php ” as argument . But while it was clear earlier on that attackers were actively exploiting CVE-2023 - 34362 , it was only a few days later that it became clear that Cl0p was behind the attacks .


The message translates roughly to “ You got a photo in MMS format : hxxp : //yyyyyyyy.XXXX.ru/mms.apk. ” So far we identified seven different URLs being used to spread RuMMS in the wild . Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information . The fact that the “ 28847.exe ” ﬁle can be opened makes us understand that the “ 28847 ” ﬁle is another SFX ﬁle . LotLBin techniques also make it difficult for defenders to detect threat activity as they need to not only remain vigilant for new files introduced to their environments , but also for modifications to files already present within their installed OT applications and services .


All of the URLs reference the file “ mms.apk ” and all use the domain “ XXXX.ru ” , which belongs to a top five shared hosting platform in Russia ( the domain itself has been obfuscated to anonymize the provider ) . The primary operational technique used by Night Dragon comprised a variety of hacker tools , including privately developed and customized RAT tools that provided complete remote administration capabilities to the attacker . Some static information about SFX are : New variants based on leaked code are becoming more common We have continued seeing various malicious campaigns since the start of 2023 , where the threat actors have used new ransomware variants based on leaked source code or builders .


The threat actors registered at least seven subdomains through the hosting provider , each consisting of eight random-looking characters ( asdfgjcr , cacama18 , cacamadf , konkonq2 , mmsmtsh5 , riveroer , and sdfkjhl2 . While Night Dragon attacks focused specifically on the energy sector , the tools and techniques of this kind can be highly successful when targeting any industry . Hash : 3dfadf9f23b4c5d17a0c5f5e89715d239c832dbe78551da67815e41e2000fdf1 . Bundles of Data in the Wrong Place "


) As of this writing , no files were hosted at any of the links . In addition , the attackers employed hacking tools of Chinese origin and that are prevalent on Chinese underground hacking forums . Threat : Gamaredon Pteranodon implant SFX archive . Adversaries may utilize command - line interfaces ( CLIs ) to interact with systems and execute commands .


The threat actors seem to have abandoned these URLs and might be looking into other ways to reach more victims . We have been presented with a rare opportunity to see some development activities from the actors associated with the OilRig attack campaign , a campaign Unit 42 has been following since May 2016 . Brief Description : SFX Archive Second Stage . Simultaneously , a new variant of Monti , based on the Linux platform , has surfaced , demonstrating notable differences from its previous Linux - based versions .


Use of a shared hosting service to distribute malware is highly flexible and low cost for the threat actors . Recently we were able to observe these actors making modifications to their Clayslide delivery documents in an attempt to evade antivirus detection . Ssdeep : 24576:vmoO8itbaZiW+qJnmCcpv5lKbbJAiUqKXM : OoZwxVvfoaPu . The vulnerabilities Talos disclosed to the operators of Open Babel can all be triggered by tricking a user into opening a specially crafted , malformed file .


It is also much harder for network defenders or researchers to track a campaign where the infrastructure is a moving target . We collected two sets of Clayslide samples that appear to be created during the OilRig actor 's development phase of their attack lifecycle . Exploring it , it is possible to see several ﬁles inside of it , as well as the 6323 ﬁle . However , if the adversary exploits a ZeroDay vulnerability and develops a new virus to infiltrate the system , traditional signaturebased network security tools will fail to defend against the attack .


Many top providers in Russia offer cheap prices for their shared hosting services , and some even provide free 30-day trial periods . On November 15 , 2016 , an actor related to the OilRig campaign began testing the Clayslide delivery documents . In this case , the SFX archive contains 8 ﬁles : ﬁve of them are legit DLLs used by the “ 6323 ” executable to interoperate with the OLE format deﬁned and used by Microsoft Ofﬁce . The group 's 91 attacks come not long after their extensive GoAnywhere campaign in March , when they hit over 100 organizations using a nasty zero - day .


Threat actors can register subdomains through the hosting provider and use the provider ’ s services for a short-period campaign . The actor then made subtle modifications to the file and uploaded the newly created file to the same popular antivirus testing website in order to determine how to evade detection . The “ ExcelMyMacros.txt ” and “ wordMacros.txt ” ﬁles contain further macro script , described next . k 32 Base64 characters , referred to as Access key in the ransom note


A few days later they can cancel the trial and do not need to pay a penny . In addition to making changes to the Excel worksheets that contain the decoy content , the actor also made changes to the worksheet that is initially displayed to the user . So , static analysis on the “ 6323 ” ﬁle shown as its nature : it is written using Microsoft Visual Studio .NET , therefore easily to reverse . These observations leave open the possibility that COSMICENERGY was developed with malicious intent , and at a minimum that it can be used to support targeted threat activity in the wild .


In addition , these out-of-the-box hosting services usually provide better infrastructure than the attackers could manage to construct ( or compromise ) themselves . Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system . Before reversing the executable , it is possible to clean it allowing the size reduction and the junk instruction reduction inside the code . Researchers have linked the group with low confidence to APT33 and APT34 .


RuMMS Code Analysis All RuMMS samples share the same behaviors , major parts of which are shown in Figure 1 . This realization suggests that the OilRig threat group will continue to use their delivery documents for extended periods with subtle modifications to remain effective . The below image shows the information about the sample before and after the cleaning . The challenge of investigating a vulnerable appliance for the exploitation CVE-2023 - 4966 is that the webserver running on the appliance does not record requests ( or errors ) to the vulnerable endpoint .


However , the underlying code can be quite different in that various obfuscation mechanisms were adopted to evade detection by anti-virus tools . Iranian threat agent OilRig has been targeting multiple organisations in Israel and other countries in the Middle East since the end of 2015 . The ﬁrst check performed is on the arguments : if the arguments length is equal to zero , the malware terminates the execution . Cl0p 's precipitous rise to the top of the charts this month , on the other hand , can be explained by their exploitation of a zero - day in MOVEit Transfer , a widely used file transfer software .


We used a sample app named “ org.starsizew ” with an MD5 of d8caad151e07025fdbf5f3c26e3ceaff to analyze RuMMS ’ s code . In recent attacks they set up a fake VPN Web Portal and targeted at least five Israeli IT vendors , several financial institutes , and the Israeli Post Office . After that , the malware checks if the existence of the ﬁles “ ExcelMyMacros.txt ” and “ wordMacros.txt ” in the same path where it is executed : if true then it reads their contents otherwise it will exit . None The discovery was part of recent CrowdStrike Services investigations into several Play ransomware intrusions where the common entry vector was confirmed to be Microsoft Exchange .


Several of the main components of RuMMS are shown in Figure 2 . In these websites they hosted malware that was digitally signed with a valid , likely stolen code signing certificate . As visible in the previous ﬁgure , the only difference between the ﬁles are in the variable , registry key and path used by Word rather than by Excel . All of these things point to threat actors and groups like Winnti will continue to try different methods of attack .


The activity class “ org.starsizew.MainActivity ” executes when the app is started . In December 2015 , Symantec published a post about " two Iran-based attack groups that appear to be connected , Cadelle and Chafer " that " have been using Backdoor.Cadelspy and Backdoor.Remexi to spy on Iranian individuals and Middle Eastern organizations " . Finally the macros are executed using the Ofﬁce engine . If the main function is called with only , it will take the path that is intended for connect to the MSSQL server and , upload • None are supplied to the main function , it will immediately fail due to attempting to utilize command line arguments that were not parsed yet .


It first starts another activity defined in “ org.starsizew.Aa ” to request device administrator privileges , and then calls the following API of “ android.content.pm.PackageManager ” ( the Android package manager to remove its own icon on the home screen in order to conceal the existence of RuMMS from the user : At the same time , ” org.starsizew.MainActivity ” will start the main service as defined in “ org.starsizew.Tb ” , and use a few mechanisms to keep the main service running continuously In May 2016 , Unit 42 observed attacks of OilRig primarily focused on financial institutions and technology organizations within Saudi Arabia . So let ’s start to dissect the macros . Unlike a number of past cases of Iranian statesponsored social media phishing that have focused on Irans neighbors , this latest campaign appears to have largely targeted Americans and to a lesser extent British and European victims .


in the background . In recent OilRig attacks , the threat actors purport to be legitimate service providers offering service and technical troubleshooting as a social engineering theme in their spear-phishing attacks . For a better comprehension we will be considering only one macro and in the speciﬁc case we will analyze “ wordMacros.txt ” ones . After encryption , the malware attempts to run the following command to delete volume shadow backup copies "


The class “ org.starsizew.Ac ” is designed for this purpose ; its only task is to check if the main service is running , and restart the main service if the answer is no . The campaign appears highly targeted and delivers a backdoor we have called ' Helminth ' . First of all the macro will set the registry key “ HKEY_CURRENT_USER\Software\Microsoft\Ofﬁce\ ” & Application.Version & _ ” \Word\Security\ ” and then will set up two scheduled tasks that will start respectively every 12 and 15 minutes : the ﬁrst one will run a “ IndexOfﬁce.vbs ” in the path “ %APPDATA%\Microsoft\Ofﬁce\ ” and the second one will run “ IndexOfﬁce.exe ” in the same path . " If you ve read about recent cyber attacks in the news , you might be wondering why cyber criminals try to hack into other systems and what motivates them .


The class “ org.starsizew.Tb ” also has a self-monitoring mechanism to restart itself when its own onDestroy API is triggered . Artifacts identified within the malware samples related to these attacks also suggest the targeting of the defense industry in Saudi Arabia , which appears to be related to an earlier wave of attacks carried out in the fall of 2015 . Finally , the malware will write the “ IndexOfﬁce.txt ” ﬁle in the “ %APPDATA%\Microsoft\Ofﬁce\ ” path . In early 2020 , new versions of Foudre a malware associated with the APT Advanced Persistent Threat Infy discussed in detail below emerged with new and improved elements from previous versions .


Other than that , its major functionality is to collect private device information , upload it to a remote C2 server , and handle any commands as requested by the C2 server . In May 2016 , Unit 42 began researching attacks that used spear-phishing emails with attachments , specifically malicious Excel spreadsheets sent to financial organizations within Saudi Arabia . The script will check the presence of the “ IndexOfﬁce.exe ” artifact : if true then it will delete it and it will download a new ﬁle/script from “ http://masseffect.space/<PC_Name>_<Hex_Drive_SN>/post.php ” . To date , the ransomware has only been used in a limited fashion .


All those functions are implemented in asynchronous tasks by “ org.starsizew.i ” . Over the course of the attack campaign , we have observed two different variations of the Helminth backdoor , one written in VBScript and PowerShell that was delivered via a macro within Excel spreadsheets and the other a standalone Windows executable . The malware tries to save the C2 response and encoding it using Encode function . Cisco Secure Network / Cloud Analytics ( Stealthwatch / Stealthwatch Cloud ) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device .


The class “ org.starsizew.Ma ” is registered to intercept incoming SMS messages , the arrival of which will trigger the Android system to call its “ onReceive ” API . FireEye also reported on these attacks in a May 22 blog post . This function accepts three parameters : the input ﬁle , the output ﬁle and the arrKey ; arrKey is calculated thanks to GetKey function that accepts as input the Hexadecimal value of the Driver SN installed on the machine and returns the key as results . The group appears to commonly deploy double extortion of the victims that have been listed on the leak site , several of them have had some portion of their exfiltrated data exposed .


Its major functionality is also implemented through the call of the asynchronous task ( “ org.starsizew.i ” ) , including uploading the incoming SMS messages to the remote C2 server and executing any commands as instructed by the remote attacker . The executable variant of Helminth is installed with a dropper Trojan that we are tracking as the HerHer Trojan . Gamaredon cyberwarfare operations against Ukraine are still active . However , the self - proclaimed hacktivist group Anonymous Sudan appears to have increased KillNet ’s capabilities and the group has become the collective ’s most prolific affiliate in 2023 , conducting a majority of claimed DDoS attacks .


C2 Communication The C2 communication includes two parts : sending information to the remote HTTP server and parsing the server ’ s response to execute any commands as instructed by the remote attackers . The Helminth executable variant is very similar in functionality to its script-based counterpart , as it also communicates with its C2 server using both HTTP and DNS queries . This technical analysis reveals that the modus operandi of the Group has remained almost identical over the years . As for who was hit the hardest , around 16 percent of ransomware incidents affecting State , Local , Tribal , and Tribunal ( SLTT ) governments were from LockBit , says the MS - ISAC .


The functionality for these two parts is implemented by doInBackground and onPostExecute respectively , two API methods of “ android.os.AsyncTask ” as extended by class “ org.starsizew.i ” . Helminth executable samples send artifacts within network beacons to its C2 server that the Trojan refers to as a ' Group ' and ' Name ' . The massive use of weaponized Ofﬁce documents , Ofﬁce S-TOOL template injection , sfx archives , wmi and some VBA macro stages S-TOOL that dinamically changes , make the Pterodon attack chain very malleable and adaptive . This is further advanced in the National Institute of Standards and Technology NIST 80037 Risk Management Framework when it says


Figure 3 . It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries . However , the introduction of a .Net component is a novelty compared to previous Pterodon samples . • Unauthorized network connections to MSSQL servers ( TCP/1433 ) and irregular or unauthorized authentication .


Method doInBackground : to send information to remote C2 server As seen from the major code body of method doInBackground shown in Figure 3 ( some of the original classes and methods are renamed for easier understanding ) , there are three calls to HttpPost with different contents as parameters . It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries . Gamaredon : 76ea98e1861c1264b340cf3748c3ec74473b04d042cd6bfda9ce51d086cb5a1a . The term has been around since the 1990s , and the first spyware to be identified was developed by criminals to steal passwords or financial information from devices .


At line 5 , local variable v4 specifies the first parameter url , which can be changed by the remote C2 server later . This suggests that the threat actors are not only focused on financial organizations , as their target set could include other industries as well . Gamaredon : e2cb06e0a5c14b4c5f58d0e56a1dc10b6a1007cf56c77ae6cb07946c3dfe82d8 . In the case of ProxyNotShell , the targeted backend service is the Remote PowerShell service .


These URLs are all in the form of “ http : // $ C2. $ SERVER. $ IP/api/ ? The email address edmundj@chmail.ir and the geolocation of Tehran , Iran , being of note . Gamaredon : def13f94cdf793df3e9b42b168550a09ee906f07f61a3f5c9d25ceca44e8068c . Although the primary target is believed to have been the Ukrainian military , other customers were affected , including personal and commercial internet users .


id= $ NUM ” . The registrant information for kernel.ws also provided a geolocation of Tehran , IR and the email provider for the address used in checkgoogle.org was the same used for mydomain1607.com , chmail.ir . Gamaredon : c1524a4573bc6acbe59e559c2596975c657ae6bbc0b64f943fffca663b98a95f . But what happens when an unidentified virus infects a victims computer Antivirus programs can only protect against threats they already know .


The second parameter is a constant string “ POST ” , and the third parameter is a series of key-value pairs to be sent , assembled at runtime . The mydomain1110.com domain did not appear to reuse any of the previously observed WHOIS data artifacts , but did still give a geolocation of Tehran in addition to the use of an email address linked to other domains thematically similar to the know command and control domains and are potentially related . Gamaredon : 86977a785f361d4f26eb3e189293c0e30871de3c93b19653c26a31dd4ed068cc . According to Kaspersky telemetry , targeted organizations included political bodies in Europe .


The value of the first item , whose key is “ method ” ( line 7 ) , indicates the type of the contents : install , info and sms . While researching the OilRig campaign , we have seen two waves of targeted attacks on Saudi Arabian organizations in which a group of threat actors delivered the Helminth Trojan as a payload . Gamaredon : http://win-apu.ddns.net/apu.dot/ . None Follow Microsoft recommendations to disable remote PowerShell for non - administrative users where possible .


The first type of content , starting with “ method=install ” , will be sent when the app is started for the first time , including the following device private information : Victim identifier Network operator Device model Device OS version Phone number Device identifier App version Country The second type of information will be sent periodically to indicate that the device is alive . The two variants of Helminth do require different delivery methods , with the script variant relying on an Excel spreadsheet for delivery , while the executable variant is more traditional in the fact that it can be installed without a delivery document . Gamaredon : http://get-icons.ddns.net/apu.dot/ . Monitor MSSQL Servers with access to OT systems and networks for evidence of : • Reconnaissance and enumeration activity of MSSQL servers and credentials .


It only has two parts , the method indicated by word “ info ” and the victim identifier . Since our first published analysis of the OilRig campaign in May 2016 , we have continued to monitor this group for new activity . Gamaredon : http://masseffect.space/ . Researchers at Cisco Talos recently wrote an ‘ On the Radar ’ article about the growth of spyware - based intelligence providers , without legal or ethical supervision .


The third type of information will be sent when RuMMS intercepts any SMS messages , including the balance inquiry results when it contacts the SMS code of a particular financial service . Additionally , the scope of organizations targeted by this group has expanded to not only include organizations within Saudi Arabia , but also a company in Qatar and government organizations in Turkey , Israel and the United States . JhoneRAT : Cloud based python RAT targeting Middle Eastern countries . The Twitter handle used by Hack520 indicates also an “ est ” portion .


Method onPostExecute parses the response from the above HTTP session and executes the commands provided by the remote attacker . The group behind the OilRig campaign continues to leverage spear-phishing emails with malicious Microsoft Excel documents to compromise victims . Today , Cisco Talos is unveiling the details of a new RAT we have identified we 're calling " JhoneRAT " . Lateral Movement to SCADA Hypervisor and OT Attack Execution


As seen from the code in Figure 5 , the commands RuMMS supports right now include : install_true : to modify app preference to indicate that the C2 server received the victim device ’ s status . In addition to these instances , multiple Qatari organizations were the subject to spear phishing attacks carrying Helminth samples earlier this year . This new RAT is dropped to the victims via malicious Microsoft Office B-IDTY I-TOOL docume S-TOOLnts . It will then attempt to wipe the physical drive partition itself .


sms_send : to send C2-specified SMS messages to C2-specified recipients . While the malware deployed is not terribly sophisticated , it uses techniques such as DNS command and control ( C2 ) that allows it to stay under the radar at many establishments . The dropper , along with the Python RAT E-TOOL , attempts to gather information on the victim 's machine and then uses multiple cloud services : Google Drive , Twitter , ImgBB and Google Forms . As well as its custom malware , Budworm also used a variety of livingofftheland and publicly available tools in these attacks .


sms_grab : to upload periodically the SMS messages in the inbox to C2 server . Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14 , 2017 , FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East . The RAT attempts to download additional payloads and upload the information gathered during the reconnaissance phase . Possible locations are “ Config ” , “ Static ” , or “ Path ” followed by a file path .


delivery : to deliver specified text to all victim ’ s contacts ( SMS worming ) . We assess this activity was carried out by a suspected Iranian cyber espionage threat group , whom we refer to as APT34 , using a custom PowerShell backdoor to achieve its objectives . This particular RAT attempts to target a very specific set of Arabic-speaking countries . Change it Up in 2023 Get Ahead of Known Vulnerabilities


call_number : to forward phone calls to intercept voice based two-factor authentication . This threat group has conducted broad targeting across a variety of industries , including financial , government , energy , chemical , and telecommunications , and has largely focused its operations within the Middle East . The filtering is performed by checking the keyboard layout of the infected systems . The VBA code in all files is similar , with minor variations , where some functions serve a legitimate purpose ( e.g. , some functions for conversion of strings into numbers in Excel ) .


new_url : to change the URL of the C2 server in the app preference . We assess that APT34 works on behalf of the Iranian government based on infrastructure details that contain references to Iran , use of Iranian infrastructure , and targeting that aligns with nation-state interests . Based on the analysed sample , JhoneRAT targets Saudi Arabia , Iraq , Egypt , Libya , Algeria , Morocco , Tunisia , Oman , Yemen , Syria , UAE , Kuwait , Bahrain and Lebanon . We urge asset owners to review and implement the following recommendations to mitigate and detect this activity .


ussd : to call a C2-specified phone number . APT34 uses a mix of public and non-public tools , often conducting spear phishing operations using compromised accounts , sometimes coupled with social engineering tactics . The campaign shows an actor that developed a homemade RAT that works in multiple layers hosted on cloud providers . There is evidence to suggest that in 2010 Harrison was directed to harass the owner of Ashleymadisonsucks.com into closing the site or selling the domain to Ashley Madison .


Figure 5 . We believe APT34 is involved in a long-term cyber espionage operation largely focused on reconnaissance efforts to benefit Iranian nation-state interests and has been operational since at least 2014 . JhoneRAT is developed in python but not based on public source code , as it is often the case for this type of malware . In that campaign , the attackers also targeted the government of a Middle Eastern country , a multinational electronics manufacturer , and a hospital in Southeast Asia .


Method onPostExecute : to handle instructions from remote C2 Figure 6 shows an example response sent back from one C2 server . In May 2016 , we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware . The attackers put great effort to carefully select the targets located in specific countries based on the victim 's keyboard layout . The actor hunts for confidential information stored in the networks of governmental organizations , political groups and think tanks , as well as various individuals involved in defense and geopolitical related research .


Note that inside this single response , there is one “ install_true ” command , one “ sms_grab ” command and four “ sms_send ” commands . In July 2017 , we observed APT34 targeting a Middle East organization using a PowerShell-based backdoor that we call POWRUNER and a downloader with domain generation algorithm functionality that we call BONDUPDATER , based on strings within the malware . Everything starts with a malicious document using a well-known vulnerability to download a malicious document hosted on the internet . It is possible that the malware was used to support exercises such as the ones hosted by Rostelecom - Solar in 2021 in collaboration with the Russian Ministry of Energy or in 2022 for the ( SPIEF ) .


With the four “ sms_send ” commands , the messages as specified in the key “ text ” will be sent immediately to the specified short numbers . APT34 loosely aligns with public reporting related to the group " OilRig " . For this campaign , the attacker chose to use a cloud provider ( Google ) with a good reputation to avoid URL blacklisting . In the USA , Vice Society is the most active among a group of gangs .


Our analysis suggests that the four short numbers are associated with Russian financial institutions , presumably where a victim would be likely to have accounts . The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 . The malware is divided into a couple of layers — each layer downloads a new payload on a cloud provider to get the final RAT developed in python and that uses additional providers such as Twitter and ImgBB . The government even offered a reward of up to $ 10 million for information on Cl0p after several federal agencies in the US fell victim to the gang .


Figure 6 . In this latest campaign , APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER . This RAT is a good example of how a highly focused attack that tries to blend its network traffic into the crowd can be highly effective . Copies of the site at archive.org show it was the work of someone calling themselves “ The Chaos Creator . ”


Example Response in JSON format In particular , short number “ +7494 ” is associated with a payment service provider in Russia . The vulnerability was patched by Microsoft on Nov 14 , 2017 . In this campaign , focusing detection of the network is not the best approach . Simultaneously , a new variant of Monti , based on the Linux platform , has surfaced , demonstrating notable differences from its previous Linux - based versions .


The provider ’ s website described how the code 7494 can be used to provide a series of payment-related capabilities . The vulnerability exists in the old Equation Editor ( EQNEDT32.EXE ) , a component of Microsoft Office that is used to insert and evaluate mathematical formulas . Instead , the detection must be based on the behaviour on the operating system . For this reason it is important to note that some organizations and systems may simply be convenient targets which enable and facilitate attackers actions .


For example , sending text “ Balance ” will trigger a response with the victim ’ s wallet balance . During the past few months , APT34 has been able to quickly incorporate exploits for at least two publicly vulnerabilities ( CVE-2017-0199 and CVE-2017-11882 ) to target organizations in the Middle East . Attackers can abuse well-known cloud providers and abuse their reputations in order to avoid detection . To boot , there was a 75 percent increase in the average number of monthly attacks in the US between the first and second half of the last 12 months .


Sending text “ confirm 1 ” will include proof of payment . The OilRig group ( AKA APT34 , Helix Kitten ) is an adversary motivated by espionage primarily operating in the Middle East region . The fact that this attacker decided to leverage cloud services and four different services — and not their own infrastructure — is smart from an opsec point of view . Monitor and analyze traffic flows that do not follow the expected protocol standards and traffic flows ( e.g extraneous packets that do not belong to established flows , or gratuitous or anomalous traffic patterns ) .


Sending text “ call on ” will activate the USSD payment confirmation service . We expect APT34 will continue to evolve their malware and tactics as they continue to pursue access to entities in the Middle East region . It is hard for the targets to identify legitimate and malicious traffic to cloud provider infrastructure . Mandiant has observed UNC2970 , APT43 , and UNC4899 all utilize similar infrastructure .


During our investigation , we observed the C2 server sending multiple “ balance ” commands to different institutions , presumably to query the victim ’ s financial account balances . The OilRig group ( AKA APT34 , Helix Kitten ) is an adversary motivated by espionage primarily operating in the Middle East region . Moreover , this kind of infrastructure uses HTTPS and the flow is encrypted that makes man-in-the-middle interception more complicated for the defender . Indicators of attack are similar to IOCs , but rather than focusing on forensic analysis of a compromise that has already taken place , indicators of attack focus on identifying attacker activity while an attack is in process .


RuMMS can upload responses to the balance inquiries ( received via SMS message ) to the remote C2 server , which can send back additional commands to be sent from the victim to the provider ’ s payment service . We first discovered this group in mid-2016 , although it is possible their operations extends earlier than that time frame . It is not the first time an attacker used only cloud providers . Since 2021 , there have been multiple leaks of ransomware source code and builders components that are essential to creating and modifying ransomware .


These could include resetting the user ’ s PIN , enabling or disabling various alerts and confirmations , and confirming the user ’ s identity . Between May and June 2018 , Unit 42 observed multiple attacks by the OilRig group appearing to originate from a government agency in the Middle East . Even while using these services , the authors of this JhoneRAT went further and used different user-agent strings depending on the request , and even on the downloaders the authors used other user-agent strings . Monitor MSSQL Servers with access to OT systems and networks for evidence of : • Reconnaissance and enumeration activity of MSSQL servers and credentials .


RuMMS Samples , C2 , Hosting Sites , Infections and Timeline In total we captured 297 RuMMS samples , all of which attempt to contact an initial C2 server that we extracted from the app package . The use of script-based backdoors is a common technique used by the OilRig group as we have previously documented . We already published a couple of articles about ROKRAT ( here , here , here and here ) where another unrelated actor , Group123 , made the same choice but with different providers . Other interesting anomalies in June include 47 attacks on the Manufacturing industry ( which usually averages around 20 attacks a month ) and notable increases in attacks on Switzerland ( 14 ) and Brazil ( 13 ) , both of which are normally attacked only two or three times a month .


Figure 7 lists the IP addresses of these C2 servers , the number of RuMMS apps that connect to each of them , and the example URL used as the first parameter of the HttpPost operation ( used in the code of Figure 3 ) . The attacks delivered a PowerShell backdoor called QUADAGENT , a tool attributed to the OilRig group by both ClearSky Cyber Security and FireEye . The attacker implemented filtering based on the keyboard 's layout . We 'll delve into the recent four - month spike in attacks against the UK , the unsettling uptick in attacks on France 's government sector , and how Germany retained its spot as the fourth most targeted country in the world .


This indicates that multiple C2 servers were used in this campaign , but one ( 37.1.207.31 ) was the most heavily used . A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation . The malware is executed only for the following layout , the country is based on the Microsoft website : Cyberattacks can leave companies wondering how could this happen to us so , when these situations arise , it can help to know what might be motivating these attackers .


Figure 7 . All three waves involved a single spear phishing email that appeared to originate from a government agency based in the Middle East . ' 0401 ' : Saudi Arabia . ' 0801 ' : Iraq . ' 0c01 ' : Egypt . ' 1001 ' : Libya . ' 1401 ' : Algeria . ' 1801 ' : Morocco . ' 1c01 ' : Tunisia . ' 2001 ' : Oman . ' 2401 ' : Yemen . ' 2801 ' : Syria . ' 3801 ' : UAE . ' 3401 ' : Kuwait . ' 3c01 ' : Bahrain . ' 3001 ' : Lebanon . But , IOCs are not always easy to detect they can be as simple as metadata elements or incredibly complex malicious code and content samples .


RuMMS samples and C2 servers Figure 8 shows how these samples , C2 servers and hosting websites are related to each other , including when they were compiled or observed . This latest attack consisted of three waves between May and June 2018 . We identified three malicious Microsoft Office B-IDTY I-TOOL documents that download and load an additional Office document with a Macro . “ And his access was never shut off until today ? , ” asked the company ’s general counsel Mike Dacks .


In the quadrant , the smaller boxes in blue-gray represent particular apps in the RuMMS family , while the bigger boxes in deep-blue represent C2 servers used by some RuMMS apps . The OilRig group continues to be a persistent adversary group in the Middle East region . The oldest one from November 2019 , named " Urgent.docx " . Mandiant has identified zero - day exploitation of this vulnerability in the wild beginning in late August 2023 as well as n - day exploitation after Citrix ’s publication .


The dotted arrows represent the use of a particular C2 server by a specific app to send information and fetch instructions . APT34 are involved in long-term cyber espionage operations largely focused on the Middle East . The author of the document asks to enable editing in English and in Arabic . Such non - native files and other data may be removed over the course of an intrusion to maintain a small footprint or as a standard part of the post - intrusion cleanup process .


In this figure we have 11 RuMMS samples , all of which were hosted on the website as shown in the “ y ” axis . This threat group has conducted broad targeting across a variety of industries , including financial , government , energy , chemical , and telecommunications . The second document from the beginning of January is named " fb.docx " and contains usernames and passwords from an alleged " Facebook " leak . This rule was designed to match the decoded URI of any incoming request with the regex , so when the decoded URI matches this regex , the request is dropped .


The dates on the “ x ” axis show the dates when we first saw these apps in the wild . Recent investigations by FireEye 's Mandiant incident response consultants combined with FireEye iSIGHT Threat Intelligence analysis have given us a more complete picture of a suspected Iranian threat group , that we believe has been operating since at least 2014 . The more recent document is from mid-January and alleged to be from a United Arab Emirate organization . Babuk , a Russian ransomware group that emerged in 2021 , has conducted a series of high - profile ransomware attacks across various industries , including government , healthcare , logistics , and professional services .


This figure demonstrates the following interesting information : The time range when threat actors distributed RuMMS on those shared-hosting websites is from January 2016 to March 2016 . Join us in a live webinar as we discuss this threat group whom we assess to be working on behalf of the Iranian Government , with a mission that would benefit nation-state geopolitical and economic needs . The author blurred the content and asks the user to enable editing to see the content . Legacy Task Name QcWBX Command to Run C:\Windows\msserver.exe


Threat actors used different websites to host different payloads at different times . On January 8 , 2018 , Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East . In the three documents , an additional Office document containing a Macro is downloaded and executed . Based on these findings , CrowdStrike assesses it is highly likely that the OWA technique employed is in fact tied to CVE-2022 - 41080 .


This kind of “ moving target ” behavior made it harder to track their actions . APT34 uses a mix of public and non-public tools , often conducting spear phishing operations using compromised accounts from trusted third parties , sometimes coupled with social engineering tactics . The documents are located on Google Drive . Malwarebytes found that a total of 48 separate ransomware groups attacked the US in the observed period .


The same websites have hosted different RuMMS samples at different dates . Just over a week later , on January 16 , 2018 , we observed an attack on a Middle Eastern financial institution . The template located on Google Drive contains a macro . On multiple systems , XPdb entries for the malware contained the parent process of the JumpCloud agent , further evidence that the threat actor leveraged JumpCloud to gain initial access to victim environments .


C2 servers are shared by multiple samples . The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 . The macro contains a virtual machine detection technique based on the serial number of the disks available in the victim environment . This is consistent with the group ’s prior activity scanning and exploiting internet facing servers for initial access .


This matches our observations of C2 servers as shown in Figure 7 . However , the attack on January 16 did not involve ThreeDollars at all . Indeed , some VMs do not have serial numbers and the macro is executed only if a serial number exists . Ashley Madison ’s parent company — Toronto - based Avid Life Media — filed a trademark infringement complaint in 2010 that succeeded in revealing a man named Dennis Bradshaw as the owner .


Figure 8 . Interestingly , the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017 . A WMIC command is executed to get this information on the targeted system . Mandiant identified sh3.exe as a utility suspected to run the Mimikatz LSADUMP command .


RuMMS samples , hosting sites , C2 servers from Jan. 2016 to Mar . Instead , OilRig 's attack involved delivering the OopsIE Trojan directly to the victim , most likely using a link in a spear phishing email . If a serial number exists , the rest of the code is executed . CrowdStrike security researchers were working to develop proof - of - concept ( POC ) code for an exploit method indicative of the logging present after recent Play ransomware attacks .


2016 We do not know exactly how many people have been infected with RuMMS malware ; however , our data suggests that there are at least 2,729 infections with RuMMS samples from January 2016 to early April 2016 . In the January 16 , 2018 attack , we observed OilRig attacking an organization it previously targeted in January 2017 . The purpose is to download an image from a new Google Drive link . These types of threat actors will be attempting to cause the most embarrassment andor pain to prove the company can not function without them .


Figure 9 shows the number of RuMMS infections recorded in the last four months . On January 8 , 2018 , the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East . It is interesting to note that the filename of the downloaded image is randomly generated based on a dictionary : Array ("cartoon" , "img" ,"photo") . To prevent ProxyNotShell exploitation on older Microsoft Exchange servers , Microsoft released a blog4 advocating for a custom inside the Microsoft IIS server supporting Exchange .


When we first observed the malware in January , we recorded 380 infections . The email contained an attachment named Seminar-Invitation.doc , which is a malicious Microsoft Word document we track as ThreeDollars . The filename will be cartoon.jpg or img.jpg or photo.jpg and the image usually depicts a cartoon . The second , CVE-2022 - 41080 , has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022 - 41040 used in the ProxyNotShell exploit chain , and it has been marked “ exploitation more likely . ”


In February , we recorded 767 infections . This suggests that due to the January 2017 attack , the targeted organization may have taken actions to counter known OilRig TTPs , in this case delivering malicious macro documents , causing the OilRig operators to adopt a different delivery tactic . The image file is a real image with a base64-encoded binary appended at the end . Better yet , reach out to us , and well be pleased to share a customized demonstration of the ThreatConnect Platform .


In March , it peaked at 1,169 infections . We also identified another sample of ThreeDollars , created on January 15 , 2017 with the file name strategy preparation.dot . The malware author has a curious sense of humor . Ways our customers can detect and block this threat are listed below .


In April , at the time of writing this post , we recorded 413 RuMMS infections . The samples of ThreeDollars we collected in these attacks are structurally very similar to the first sample we analyzed in October 2017 , down to the lure image used to trick the recipient into clicking the " Enable Content " button to execute the malicious macro . The base64 data and image are separated by the " **** " string . School budgets are tight and institutions are understandably keen to direct their budgets at things that directly benefit pupils .


Although the propagation trend seems to be slowing down a bit , the figure tells us that RuMMS malware is still alive in the wild . Since May 2016 , we have continued to monitor and uncover various attacks and tools associated with the OilRig group . The decoded binary filename is also randomly generated based on a dictionary : Array("proc" , "chrome" , "winrar") . None Ensure X - Forwarded - For header is configured to log true external IP addresses for request to proxied services .


We continue to monitor its progress . ] com , which we previously identified in October 2017 to be an OilRig C2 . It can be proc.exe or chrome.exe or winrar.exe . External Server Requests Indicates an attempt to exfiltrate data to an external server .


Conclusion Smishing ( SMS phishing ) offers a unique vector to infect mobile users . Based on previously observed tactics , it is highly likely the OilRig group leveraged credential harvesting and compromised accounts to use the government agency as a launching platform for their true attacks . The decoded base64 data is an AutoIT binary . Instead , it appeared that corresponding requests were made directly through the Outlook Web Application ( OWA ) endpoint , indicating a previously undisclosed exploit method for Exchange .


The recent RuMMS campaign shows that Smishing is still a popular means for threat actors to distribute their malware . Inspecting the class C network for 185.162.235.0/24 shows us that another IP on the same network resolves to an OilRig domain , msoffice-cdn.com which we identified in August 2017 . This binary downloads a new file on Google Drive . We were able to find additional links between Hack520 ’s “ Pig network ” and the Winnti group ’s activities .


In addition , the use of shared-hosting providers adds flexibility to the threat actor ’ s campaign and makes it harder for defending parties to track these moving targets . We had previously observed this author name in use once before , in the very first ThreeDollars document we collected that we had reported on in August 2017 . The filename is also randomly generated based on a dictionary $ARRAY[5]=["prc" ,"winrar" ,"chrome" ,"sync" ,"COM surr"] . LockBit reportedly squeezed about $ 91 million out of US organizations with around 1,700 attacks since 2020 , according to a June report by CISA .


Fortunately , FireEye Mobile Threat Prevention platform can recognize the malicious SMS and networking behaviors used by these RuMMS samples , and help us quickly identify the threat . The OilRig group continues to remain a highly active adversary in the Middle East region . The final payload is a remote access tool ( RAT ) written in python . Several issues in Foxit PDF reader could lead to arbitrary code execution Foxit PDF Reader is one of the most popular PDF readers on the market , offering many similar features to Adobe Acrobat .


To protect yourself from these threats , FireEye suggests that users : Take caution before clicking any links where you are not sure about the origin . Organizations detected a compromise themselves in 62% of the cases that Mandiant worked in 2017 . We named this RAT " JhoneRAT " . When Bradshaw refused to sell the domain , he and his then - girlfriend were subject to an unrelenting campaign of online harassment and blackmail .


Don ’ t install apps outside the official app store . The group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries . The python code is wrapped into an executable using pyinstaller . The commandline parameters m and h are mutually exclusive .


Exodus : New Android Spyware Made in Italy Mar 29 Summary We identified a new Android spyware platform we named Exodus , which is composed of two stages we call Exodus One and Exodus Two . Repeated targeting of Middle Eastern financial , energy and government organizations leads FireEye to assess that those sectors are a primary concern of APT34 . It uses minimal obfuscation applied only on variables and function naming . In terms of the fallout , it ’s tough to overstate the havoc Cl0p was able to wreck thanks to the zero - day .


We have collected numerous samples spanning from 2016 to early 2019 . The use of infrastructure tied to Iranian operations , timing and alignment with the national interests of Iran also lead FireEye to assess that APT34 acts on behalf of the Iranian government . The RAT starts by launching three threads . Methods of manipulating control can include changes to set point values , tags , or other parameters .


Instances of this spyware were found on the Google Play Store , disguised as service applications from mobile operators . APT34 uses a mix of public and non-public tools ( Fig.2 ) and often uses compromised accounts to conduct spear-phishing operations . The first is responsible for checking if the system has the targeted keyboard layout — this is exclusively in Arabic-speaking countries . Our 2023 Ransomware Report unpacks the action in four zones : the US , Germany , France , and the UK .


Both the Google Play Store pages and the decoys of the malicious apps are in Italian . In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch . The second will create the persistence and , finally , the last one to be started is the main cycle for the RAT . Financial extrinsic Theft of personally identifiable information PII that is then monetized is a classic example of financial motivation of cyberattacks .


According to publicly available statistics , as well as confirmation from Google , most of these apps collected a few dozens installations each , with one case reaching over 350 . Unit 42 's ongoing research into the OilRig campaign shows that the threat actors involved in the original attack campaign continue to add new Trojans to their toolset and continue their persistent attacks in the Middle East . As we explained before , the RAT targets specific countries by checking the keyboard 's layout . We provide at - risk organizations with the following discovery methods to conduct threat hunts for tactics , techniques , and procedures ( TTPs ) implemented derived from the toolset : • Establish collection and aggregation of host - based logs for crown jewels systems such as human - machine interfaces ( HMI ) , engineering workstations ( EWS ) , and OPC client servers within their environments and review logs for the evidence of Python script or unauthorized code execution on these systems .


All of the victims are located in Italy . When we first discovered the OilRig attack campaign in May 2016 , we believed at the time it was a unique attack campaign likely operated by a known , existing threat group . In fact , this is one of the first checks it performs when it is executed . Cisco Talos is aware of the recent advisory published by the U.S. Department of Health and Human Services ( HHS ) warning the healthcare industry about Rhysida ransomware activity .


All of these Google Play Store pages have been taken down by Google . The email address is associated with the Lebanese domain of a major global financial institution . The persistence is achieved by adding an entry with the name " ChromeUpdater " to the ' Software\\Microsoft\\Windows\\CurrentVersion\\Run ' . From what we ’ve seen in Hack520 ’s blog , as well as the infrastructure deployed around it , it is quite safe to say that Hack520 is involved in aspects of the VPS service activity provided to groups like Winnti and other cybercriminals or threat actors .


We believe this spyware platform is developed by an Italian company called eSurv , which primarily operates in the business of video surveillance . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . This RAT uses three different cloud services to perform all its command and control ( C2 ) activities . The attackers only managed to deploy it to three machines on the organizations network and it was blocked on two of those three computers .


According to public records it appears that eSurv began to also develop intrusion software in 2016 . In July 2017 , we observed the OilRig group using a tool they developed called ISMAgent in a new set of targeted attacks . It checks for new commands in the tweets from the handle @jhone87438316 ( suspended by Twitter ) every 10 seconds using the BeautifulSoup HTML parser to identify new tweets . Researchers first spotted the activity in March 2021 , but the MuddyWater campaign began in October 2019 targeting an Asian airline to steal flight reservation and continued to 2021 .


Exodus is equipped with extensive collection and interception capabilities . In August 2017 , we found this threat group has developed yet another Trojan that they call ' Agent Injector ' with the specific purpose of installing the ISMAgent backdoor . These commands can be issued to a specific victim based on the UID generated on each target ( by using the disk serial and contextual information such as the hostname , the antivirus and the OS ) or to all of them . One explanation for this could be that that they used the region as a test zone ; another would be that the threat actor runs the operation from those locations , although it could also be a false flag meant to point the researchers on the wrong path .


Worryingly , some of the modifications enforced by the spyware might expose the infected devices to further compromise or data tampering . On August 23 , 2017 , we observed OilRig targeting an organization within the United Arab Emirates government . The Exfiltration , however , is done via other cloud providers . However , the problem in general with labeling every ransomware attack as sophisticated is that it excuses the organization that has nt followed the basic preventative best practices .


Disguised Spyware Uploaded on Google Play Store We identified previously unknown spyware apps being successfully uploaded on Google Play Store multiple times over the course of over two years . Based on that research and this observation , we postulate that the OilRig group gathered credentials to a legitimate user 's OWA account and logged into the user 's account to send phishing attacks to other individuals within the same , targeted organization . The screenshots are exfiltrated via the ImgBB website . The messages show that Harrison was hired in March 2010 to help promote Ashley Madison online , but the messages also reveal Harrison was heavily involved in helping to create and cultivate phony female accounts on the service .


These apps would remain available on the Play Store for months and would eventually be re-uploaded . The OilRig group continues to target organizations in the Middle East , in this instance targeting the government of the United Arab Emirates . The remaining commands send feedback by posting data into Google Forms . There are also many examples of nation - state actors leveraging contractors to develop offensive capabilities , as shown most recently in contracts between Russia ’s Ministry of Defense and NTC Vulkan .


While details would vary , all of the identified copies of this spyware shared a similar disguise . The payload embedded within the ISMInjector sample delivered in this attack is a variant of the ISMAgent backdoor that we had discussed in detail in our blog discussing a targeted attack on a Saudi Arabian technology company . Finally , the RAT is able to download files encoded in base64 on Google Drive . [ As the documentary points out , the domain AshleyMadisonSucks.com was eventually transferred to Ashley Madison , which then shrewdly used it for advertising and to help debunk theories about why its service was supposedly untrustworthy ] .


In most cases they would be crafted to appear as applications distributed by unspecified mobile operators in Italy . Initial inspection of this attack suggested this was again the OilRig campaign using their existing toolset , but further examination revealed not only new variants of the delivery document we named Clayslide , but also a different payload embedded inside it . Feature-wise , the RAT has three commands : UNC2529 displayed indications of target research based on their selection of sender email addresses and subject lines which were tailored to their intended victims .


Often the app description on the Play Store would reference some SMS messages the targets would supposedly receive leading them to the Play Store page . In July 2017 , we observed an attack on a Middle Eastern technology organization that was also targeted by the OilRig campaign in August 2016 . Take a screenshot and upload it to ImgBB . The Malwarebytes Threat Intelligence team is a highly skilled group of malware analysts .


All of the Play Store pages we identified and all of the decoys of the apps themselves are written in Italian . This technique was observed in previous Clayslide documents to access the script variant of the Helminth Trojan in earlier OilRig attacks . Download binary disguised has a picture from Google Drive and execute it . For example , the government was credited with leading a multicountry operation to hack the ransomware group REvil , forcing it offline .


According to Google , whom we have contacted to alert about our discoveries , nearly 25 variants of this spyware were uploaded on Google Play Store . In the past , we had primarily associated the OilRig campaign with using the Clayslide documents to deliver as a payload a Trojan we named Helminth ; in this instance , the payload was instead a variant of the ISMDoor Trojan with significant modifications which we are now tracking as ISMAgent . Execute a command and send the output to Google Forms . Once encryption is complete , it attempts to delete Volume Shadow VSS copies .


Google Play has removed the apps and they stated that " thanks to enhanced detection models , Google Play Protect will now be able to better detect future variants of these applications '' . The June 2017 sample of Clayslide contained the same OfficeServicesStatus.vbs file found in the ISMAgent Clayslide document , but instead of having the payload embedded in the macro as segregated base64 strings that would be concatenated , this variant obtained its payload from multiple cells within the " Incompatible " worksheet . The attacker put a couple of tricks in place to avoid execution on virtual machines ( sandbox ) . Budworm has targeted victims in many countries in Southeast Asia and the Middle East , among other locations , including the U.S. Symantecs Threat Hunter Team published a blog in October 2022 detailing how Budworm activity was seen on the network of a U.S. state legislature .


While Google did not share with us the total number of infected devices , they confirmed that one of these malicious apps collected over 350 installations through the Play Store , while other variants collected few dozens each , and that all infections were located in Italy . Clearly , OilRig incorporates a testing component within their development process , as we have previously observed OilRig performing testing activities on their delivery documents and their TwoFace webshells . The first trick is the check of the serial number of the disk . Between April 2022 and March 2023 , 39 % of the gang 's attacks hit education , compared to an average of just 4 % across all the other ransomware groups tracked by Malwarebytes .


We have directly observed multiple copies of Exodus with more than 50 installs and we can estimate the total number of infections to amount in the several hundreds , if not a thousand or more . While continuing research on the August 2018 attacks on a Middle eastern government that delivered BONDUPDATER , Unit 42 researchers observed OilRig 's testing activities and with high confidence links this testing to the creation of the weaponized delivery document used in this attack . The actor used the same technique in the macro and in the JhoneRAT . A main goal of this attack was to obtain access to email accounts .


Stage 1 : Exodus One The first stage installed by downloading the malicious apps uploaded on Google Play Store only acts as a dropper . While investigating recent attacks performed by the threat actor group OilRig using their new Bondupdater version , Unit 42 researchers searched for additional Microsoft Office documents used by OilRig hoping to locate additional malware being used in other attacks during the same time period . By default , most of the virtual machines do not have a serial number on the disk . Some groups are even exploiting zero - day vulnerabilities , allowing them to cast a wider net of victims .


Following are some examples of the decoys used by these droppers : The purpose of Exodus One seems to be to collect some basic identifying information about the device ( namely the IMEI code and the phone number ) and send it to the Command & Control server . The tester created the final test file less than 8 hours before the creation time of a delivery document , which was then delivered via a spear-phishing email 20 minutes later . The attacker used a second trick to avoid analysis of the python code . There was a massive decrease in the activity from Royal , for example , which normally dominates the monthly rankings — often cracking into the top five — with an average of roughly 30 attacks a month in that period .


This is usually done in order to validate the target of a new infection . During this testing , we saw document filenames that contain the C2 we witnessed in the targeted attack above , specifically the filenames XLS-withyourface.xls and XLS-withyourface – test.xls . The actor used the same trick that FireEye in the Flare-On 6 : Challenge 7: They removed the header of the python bytecode . Leveraging this access , an attacker can send remote commands to affect the actuation of power line switches and circuit breakers to cause power disruption .


This is further corroborated by some older and unobfuscated samples from 2016 , whose primary classes are named CheckValidTarget . These samples appeared to have been created by OilRig during their development and testing activities , all of which share many similarities with the delivery document used in the recent OilRig attack against a Middle Eastern government , N56.15.doc ( 7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00 ) that we have also included in Table 1 . It can be perfectly executed without the header , but tools such as uncompyle6 need this header : $ uncompyle6 final2 . None : While OT - oriented malware families can be purpose built for a particular target environment , malware that takes advantage of insecure by design OT protocols , such as LIGHTWORK ’s abuse of the IEC-104 protocol , can be modified and employed multiple times to target multiple victims .


During our tests the spyware was upgraded to the second stage on our test device immediately after the first check-ins . However , they later continued by making modifications to the Excel document just prior to the attack on August 26th . ImportError : Unknown magic number 227 in final2 . Therefore can be no leakage on our part .


This suggests that the operators of the Command & Control are not enforcing a validation of the targets . HELIX KITTEN is likely an Iranian-based adversary group , active since at least late 2015 , targeting organizations in the aerospace , energy , financial , government , hospitality and telecommunications business verticals . Additionally , the generated code by uncompyle6 varies depending on the version and the impact is important . Cisco Secure Malware Analytics ( formerly Threat Grid ) identifies malicious binaries and builds protection into all Cisco Secure products .


Additionally , during a period of several days , our infected test device was never remotely disinfected by the operators . Additionally , HELIX KITTEN actors have shown an affinity for creating thoroughly researched and structured spear-phishing messages relevant to the interests of targeted personnel . Based on our analysis and the behaviour of the executed malware , the correct interpretation is the first one based on the oldest version of uncompyle6 . The vendor declined to release an update within the 90 - day period as outlined in Cisco ’s vulnerability disclosure policy .


For the purpose of this report we analyze here the Exodus One sample with hash 8453ce501fee1ca8a321f16b09969c517f92a24b058ac5b54549eabd58bf1884 which communicated with the Command & Control server at 54.71.249.137 . In addition to Helminth , the ISMDoor implant is likely used by the Iran-based adversary to attack targets particularly those in the Middle East region . For this specific condition , it is important because it 's filtering on the keyboard layout to identify the targets . A careful analysis of the domain registrations from this threat actor between 2014 and 2015 allowed us to identify one profile used to register several domains that were used as C&C servers for a particular malware family employed by the Winnti group .


Other samples communicated with other servers listed at the bottom of this report . These incidents involved spear-phishing attacks , which characteristic of HELIX KITTEN , included emails containing malicious PowerShell in their macros that connects to known C2 infrastructure . This campaign shows a threat actor interested in specific Middle Eastern and Arabic-speaking countries . With regards to these similarities , we highlight the following trends which could manifest in future OT malware : •


Exodus One checks-in by sending a POST request containing the app package name , the device IMEI and an encrypted body containing additional device information . During the summer of 2018 , HELIX KITTEN actors were observed targeting entities in the Middle East — of note , targets appeared to be located in Bahrain and Kuwait . It also shows us an actor that puts effort in opsec by only using cloud providers . This technique has been used by the group for some time , with reports of INISafeWebSSO being leveraged dating as far back as 2018 .


The encrypted body is composed of various identifiers which are joined together : doFinal ( ) is called to encrypt the device information string : The user agent string is built from the package name and IMEI number : Finally the HTTP request is sent to the server at https : //54.71.249.137/eddd0317-2bdc-4140-86cb-0e8d7047b874 . ISMDoor is able to exfiltrate data , take screenshots , and execute arbitrary commands on the victim 's machine . The malicious documents , the droppers and the RAT itself are developed around cloud providers . The PDF usually named “ CriticalBreachDetected.pdf ” is generated using content embedded in the ransomware binary , including the skeleton PDF and the ransom note .


Many of the strings in the application are XOR 'd with the key Kjk1MmphFG : After some additional requests , the dropper made a POST request to https : //54.71.249.137/56e087c9-fc56-49bb-bbd0-4fafc4acd6e1 which returned a zip file containing the second stage binaries . In early November 2018 , CrowdStrike observed activity from the HELIX KITTEN adversary at a customer in the telecommunications vertical . Additionally the attackers implemented anti-VM ( and sandbox ) and anti-analysis tricks to hide the malicious activities to the analyst . Harrison signed his threatening missive with the salutation , “ We are legion , ” suggesting that whatever comeuppance he had in store for Ashley Madison would come from a variety of directions and anonymous hackers .


Stage 2 : Exodus Two The Zip archive returned by the check-in performed by Exodus One is a collection of files including the primary payload mike.jar and several compiled utilities that serve different functions . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East . For example , the VM or the sandbox must have the keyboard layout of the targeted countries and a disk serial number . While the Kritec skimmer hangs around the Google Tag Manager script , we believe it is not related to the other active campaigns .