We believe that these industries have also been targeted as part of a larger supply-chain attack in order for Orangeworm to get access to their intended victims related to healthcare . From September 2016 through late November 2016 , a threat actor group used both the Trochilus RAT and a newly idenfied RAT we've named MoonWind to target organizations in Thailand , including a utility organization .


Orangeworm 's secondary targets include Manufacturing , Information Technology , Agriculture , and Logistics . We chose the name ' MoonWind ' based on debugging strings we saw within the samples , as well as the compiler used to generate the samples .


While these industries may appear to be unrelated , we found them to have multiple links to healthcare , such as large manufacturers that produce medical imaging devices sold directly into healthcare firms , IT organizations that provide support services to medical clinics , and logistical organizations that deliver healthcare products . The attackers compromised two legitimate Thai websites to host the malware , which is a tactic this group has used in the past .


Once Orangeworm has infiltrated a victim 's network , they deploy Trojan.Kwampirs , a backdoor Trojan that provides the attackers with remote access to the compromised computer . Both the Trochilus and MoonWind RATs were hosted on the same compromised sites and used to target the same organization at the same time .


Patchwork targets were chosen worldwide with a focus on personnel working on military and political assignments , and specifically those working on issues relating to Southeast Asia and the South China Sea . The attackers used different command and control servers ( C2s ) for each malware family , a tactic we believe was meant to thwart attempts to tie the attacks together using infrastructure alone .


Kwampirs uses a fairly aggressive means to propagate itself once inside a victim 's network by copying itself over network shares . Further research led us to additional MoonWind samples using the same C2 ( dns.webswindows.com ) but hosted on a different compromised but legitimate website .


In mid-August , the OilRig threat group sent what appeared to be a highly targeted phishing email to a high-ranking office in a Middle Eastern nation . The attacks in that case took place in late September to early October 2016 and the attackers stored the MoonWind samples as RAR files , while in the November attacks the RATs were stored as executables .


Patchwork 's attack was detected as part of a spear phishing against a government organization in Europe in late May 2016 . We were not able to find additional tools , but the attackers again compromised a legitimate Thai website to host their malware , in this case the student portal for a Thai University .


The attack was detected as part of a spear phishing against a government organization in Europe in late May 2016 . Trochilus was first reported by Arbor Networks in their Seven Pointed Dagger report tying its use to other targeted Southeast Asia activity .


The Patchwork attack group has been targeting more than just government-associated organizations . The activity dates to at least 2013 and has ties to multiple reports by other researchers .


Symantec has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks . It is highly likely MoonWind is yet another new tool being used by the group or groups responsible for that activity , indicating they are not only still active but continuing to evolve their playbook .


Two security companies , Cymmetria and Kaspersky , each recently released reports on the campaign , most of which are in line with our observations . The samples provided were alleged to be targeting Tibetan and Chinese Pro-Democracy Activists .


Symantec Security Response has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks . On June 7 , 2013 , Rapid7 released an analysis of malware dubbed ' KeyBoy ' , also exploiting unknown vulnerabilities in Microsoft Office , similarly patched by MS12-060 , but allegedly targeting interests in Vietnam and India .


While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec , we have seen infections in multiple countries due to the nature of the victims operating large international corporations . As we have seen in some previous targeted malware attacks , the attackers in this incident are taking advantage of services like .


Although approximately half of the attacks focus on the US , other targeted regions include China , Japan , Southeast Asia , and the United Kingdom . com to establish free subdomains in their infrastructure .


While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec telemetry , we have seen infections in multiple countries due to the nature of the victims operating large international corporations . Blending in with legitimate traffic is a common tactic used by attackers to help fly under the radar .


Our first observation of an attempted attack related to this campaign dates back to November 2015 , although Symantec telemetry data indicates that the campaign may have already existed in early 2015 or perhaps even earlier . Subdomains at phmail.us have been linked to malicious activity dating back as far as December 2011 .


Should a user enable this content , Gallmaker is then able to use the DDE protocol to remotely execute commands in memory on the victima 's system . Based on the patterns of subdomain registration over time in DNS , TRAC believes this is an example where the attackers registered their own second-level domain .


While both back door Trojans wait for commands from the threat actor , they can search for files and upload them to the specified server once activated . In this blog post we'll analyze two specific incidents apparently targeting victims in Vietnam and in India and we'll describe the capabilities of the custom backdoor being used that for convenience ( and to our knowledge , for a lack of an existing name ) we call KeyBoy , due to a string present in one of the samples .


Patchwork ( also known as Dropping Elephant ) is a cyberespionage group whose targets included diplomatic and government agencies as well as businesses . We encountered the first document exploit called " THAM luan - GD - NCKH2.doc " a few days ago , which appears to be leveraging some vulnerabilities patched with MS12-060 .


Patchwork is known for rehashing off-therack tools and malware for its own campaigns . This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics .


They also included Dynamic Data Exchange ( DDE ) and Windows Script Component ( SCT ) abuse to their tactics , as well as started exploiting recently reported vulnerabilities . For the sake of this analysis we'll take the Vietnamese backdoor as an example ; the one found in the Indian attack operates in the exact same ACT .


These socially engineered emails contain web links of weaponized documents containing exploits or macros . In the second set they are making use of a dynamic DNS service by .


It contains an additional meta tag at the end of the web page source code , " refreshing " ( redirecting ) the site visitor to the weaponized document . com .


It 's probable that Patchwork uses this package to facilitate server installation when using a Windows environment . The Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information .


In March and April 2018 , Volexity identified multiple spear phishing campaigns attributed to Patchwork , an Indian APT group also known as Dropping Elephant . he Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information .


This increase in threat activity was consistent with other observations documented over the last few months in blogs by 360 Threat Intelligence Center analyzing attacks on Chinese organizations and Trend Micro noting targets in South Asia . They are often targeted simultaneously with other ethnic minorities and religious groups in China .


Volexity has also found that , in addition to sending malware lures , the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups .


The newsletter includes a link to the attacker 's website , which has content focusing on topics related to China to draw the target 's interest . More recently in 2016 , Arbor Networks reported on connected malware operations continuing to target these same groups , which the Communist Party of China perceives as a threat to its power .


Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) . There is the exploit code and malware used to gain access to systems , the infrastructure that provides command and control to the malware operator , and the human elements – developers who create the malware , operators who deploy it , and analysts who extract value from the stolen information .


The threat actors appear to have leveraged publicly available exploit code that can be found on Github at the URL : https://github.com/rxwx/CVE-2017-8570 . For example , we have observed frequent reuse of older ( patched ) exploits in malware operations against the Tibetan community .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools . These operations involved highly targeted email lures with repurposed content and attachments that contained an updated version of KeyBoy .


At this point , the attackers know the user has opened the document and send another spear-phishing email , this time containing an MS Word document with an embedded executable . In August and October 2016 we observed a malware operation targeting members of the Tibetan Parliament ( the highest legislative organ of the Tibetan government in exile , formally known as Central Tibetan Administration ) .


The Word document usually exploits CVE-2012-0158 . The Arbor report describes the ongoing use of these four vulnerabilities in a series of espionage campaigns against not only Tibetan groups , but also others related to Hong Kong , Taiwan , and Uyghur interests .


Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 . The malware samples deployed in both of these operations are updated versions of the KeyBoy backdoor first discussed in 2013 by Rapid7 .


Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 . This behavioural tactic was previously mentioned in relation to KeyBoy in a 2013 blog post by Cisco .


From the attacks observed by Volexity , what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks . These versions of KeyBoy differed from the one first described by Rapid7 in several ACTs , many of which will be described in the sections to follow .


Once started , it downloads additional malware from the C2 and also uploads some basic system information , stealing , among other things , the user 's Google Chrome credentials . These samples were contained in exploit documents containing distinct lure content , one having a Tibetan nexus , the other an Indian nexus .


It repeatedly attempts to iterate through directories and to collect files with the following extensions : doc , docx , ppt , pptx , pps , ppsx , xls , xlsx , and pdf . We believe the 2013 , 2015 , and 2016 KeyBoy samples provide evidence of a development effort focused on changing components that would be used by researchers to develop detection signatures .


In this case , a small group reusing exploit code , some powershell-based malware and mostly social engineering has been able to steal sensitive documents and data from victims since at least November 2015 . In another modification , first observed in the most recent October 11 Parliamentarian operation ( version agewkassif ) , the developer (s ) of KeyBoy began using a string obfuscation routine in order to hide many of the critical values referenced within the malware .


In the past few months , Unit 42 has observed the Patchwork group , alternatively known as Dropping Elephant and Monsoon , conducting campaigns against targets located in the Indian subcontinent . Trend Micro specifically noted that the 2013 versions of KeyBoy used the same algorithm for encoding their configuration files as was observed in the Operation Tropic Trooper malware .


The malicious documents seen in recent activity refer to a number of topics , including recent military promotions within the Pakistan Army , information related to the Pakistan Atomic Energy Commission , as well as Pakistan 's Ministry of the Interior . This sample was also found to be deployed using the CVE-2012-0158 vulnerability .


The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . The operation against the Tibetan Parliamentarians illustrates the continued use of malicious attachments in the form of documents bearing exploits .


Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability . Chances are about even , though , that Mofang is a relevant threat actor to any organization that invests in Myanmar or is otherwise politically involved .


The Patchwork group continues to plague victims located within the Indian subcontinent . In addition to the campaign in Myanmar , Mofang has been observed to attack targets across multiple sectors ( government , military , critical infrastructure and the automotive and weapon industries ) in multiple countries .


The overarching campaign appears to target both Chinese nationals within different industries and government agencies in Southern Asia . This threat report gives insight into some of the information that Fox-IT has about a threat actor that it follows , called Mofang .


It appears to have started in December 2015 and is still ongoing as of July 2016 . The name Mofang is based on the Mandarin verb , which means to imitate .


The use of weaponized legitimate documents is a longstanding operational standard of Patchwork . It is highly likely that the Mofang group is a group that operates out of China and is probably government-affiliated .


It is dropped by at least one of the weaponised documents17 used in the MONSOON campaign where it is embedded inside another executable . Chapter 7 explains the working of Mofang 's preferred tools : ShimRat and SimRatReporter .


The majority of the code for TINYTYPHON is taken from the MyDoom worm and has been repurposed to find and exfiltrate documents . The Mofang group has been active in relation to the Kyaukphyu sez .


The targeting of Chinese nationals may also be related to this campaign , but equally may be part of a separate campaign by the adversary or even as part of them selling Surveillance-As-A-Service in a similar manner previously seen with the HANGOVER group . KeyBoy provides basic backdoor functionality , allowing the operators to select from various capabilities used to surveil and steal information from the victim machine .


The use of weaponized legitimate documents is a longstanding operational standard of this group . The first attack started in early July with a ShimRatReporter payload .


We decided to spend some time to investigate around this malware and found out that it was used exclusively by a single group of attackers . Myanmar has been the target of Mofang 's attacks for years before the campaign related to the sez .


The newsnstat.com domain was used earlier in 2015 for previous HANGOVER campaigns , and was then repurposed in December 2015 for the MONSOON campaign . In late September 2015 Mofang used the website of Myanmar 's national airline hosted at www.flymna.com for an attack against an organization in Myanmar .


Our researches around the malware family revealed the " Pitty Tiger " group has been active since 2011 , yet we found traces which makes us believe the group is active since 2010 . In December 2012 Mofang started a campaign against a new target , called ' seg ' for the purpose of this report .


The group exploits known vulnerabilities in Microsoft Office products to infect their targets with malware . From the configuration it can be determined that the company was running F-Secure Antivirus and Mofang registered the domain to not appear suspicious .


Pitty Tiger group is sometimes using stolen material as spear phishing content to target other persons . In September 2015 Mofang launched another attack .


PittyTiger has also been seen using Heartbleed vulnerability in order to directly get valid credentials . A new version of ShimRat was built on the 7th of September , uploaded to the server and only days later used in a new campaign .


They have also been seen using Heartbleed vulnerability in order to directly get valid credentials . MoneyTaker has primarily been targeting card processing systems , including the AWS CBR ( Russian Interbank System ) and purportedly SWIFT ( US ) .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . Given the wide usage of STAR in LATAM , financial institutions in LATAM could have particular exposure to a potential interest from the MoneyTaker group .


PittyTiger could also use CVE-2014-1761 , which is more recent . In addition to banks , the MoneyTaker group has attacked law firms and also financial software vendors .


" PittyTiger " is a mutex used by the malware . Since that time , the group attacked companies in California , Utah , Oklahoma , Colorado , Illinois , Missouri , South Carolina , North Carolina , Virginia and Florida .


This RAT is the origin of the attackers ' group name . The first attack in the US that Group-IB attributes to MoneyTaker was conducted in the spring of 2016 : money was stolen from the bank by gaining access to First Data 's " STAR " network operator portal .


Paladin RAT is another remote administration tool used by the Pitty Tiger group . The first attack in the US that Group-IB attributes to this group was conducted in the spring of 2016 : money was stolen from the bank by gaining access to First Data 's " STAR " network operator portal .


Pitty Tiger , like other APT attackers , often use anti-virus " familiar names " when registering domains or creating subdomains . In 2017 , the number of MoneyTaker 's attacks has remained the same with 8 US banks , 1 law firm and 1 bank in Russia being targeted .


" Pitty Tiger " is also a string transmitted in the network communications of the RAT . In 2017 , the number of attacks has remained the same with 8 US banks , 1 law firm and 1 bank in Russia being targeted .


A recent report documents a group of attackers known as " PittyTiger " that appears to have been active since at least 2011 ; however , they may have been operating as far back as 2008 . By analyzing the attack infrastructure , Group-IB identified that MoneyTaker group continuously exfiltrates internal banking documentation to learn about bank operations in preparation for future attacks .


We have been monitoring the activities of this group and believe they are operating from China . Group-IB reports that MoneyTaker uses both borrowed and their own self-written tools .


This threat group uses a first-stage malware known as Backdoor.APT.Pgift ( aka Troj/ReRol.A ) , which is dropped via malicious documents and connects back to a C2 server . Group-IB has provided Europol and Interpol with detailed information about the MoneyTaker group for further investigative activities as part of our cooperation in fighting cybercrime .


By integrating the findings with prior research , it was possible to connect MONSOON directly with infrastructure used by the HANGOVER group via a series of strong connections . In late September 2015 Mofang used the website of Myanmara 's national airline hosted at www.flymna.com for an attack against an organization in Myanmar .


Backdoor.APT.PittyTiger – This malware is the classic " PittyTiger " malware ( PittyTigerV1.0 ) that was heavily used by this group in 2012 - 2013 . To control the full operation , MoneyTaker uses a Pentest framework Server .


Backdoor.APT.PittyTiger1.3 ( aka CT RAT ) – This malware is likely used as a second-stage backdoor . On it , MoneyTaker install a legitimate tool for penetration testing – Metasploit .


It also appears the attackers use this as second-stage malware . At the end of June 2015 Mofang started its campaign to gather information of a specific target in relation to the sezs : the cpg Corporation .


We have observed the Enfal malware in use since 2011 and in conjunction with Backdoor.APT.Pgift as the payload of a malicious document used in spearphishing attacks . MoneyTaker uses ' fileless ' malware only existing in RAM and is destroyed after reboot .


The Pitty Tiger group mostly uses spear phishing in order to gain an initial foothold within the targeted environment . To ensure persistence in the system MoneyTaker relies on PowerShell and VBS scripts - they are both difficult to detect by antivirus and easy to modify .


PittyTiger leverages social engineering to deliver spearphishing emails , in a variety of languages including English , French and Chinese , and email phishing pages to their targets . After successfully infecting one of the computers and gaining initial access to the system , the attackers perform reconnaissance of the local network in order to gain domain administrator privileges and eventually consolidate control over the network .


PLATINUM has been targeting its victims since at least as early as 2009 , and may have been active for several years prior . MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs .


This section describes the history , behavior , and tactics of a newly discovered targeted activity group , which Microsoft has code-named PLATINUM . This newly observed activity uses a series of redirections and fileless , malicious implementations of legitimate tools to gain access to the targeted systems .


Like many such groups , PLATINUM seeks to steal sensitive intellectual property related to government interests , but its range of preferred targets is consistently limited to specific governmental organizations , defense institutes , intelligence agencies , diplomatic institutions , and telecommunication providers in South and Southeast Asia . Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . Since that time , MoneyTaker attacked companies in California , Utah , Oklahoma , Colorado , Illinois , Missouri , South Carolina , North Carolina , Virginia and Florida .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy .


LATINUM makes a concerted effort to hide their infection tracks , by self-deleting malicious components , or by using server side logic in ' one shot mode ' where remotely hosted malicious components are only allowed to load once . Our analysis shows that actors attempted to exploit CVE-2012-0158 to install NetTraveler Trojan .


PLATINUM often spear phishes its targets at their non-official or private email accounts , to use as a stepping stone into the intended organization 's network . Unit 42 's analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan .


PLATINUM uses custom-developed malicious tools and has the resources to update these applications often to avoid being detected . Our analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan .


PLATINUM primarily targets its intended victims using spear phishing . In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker , 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks .


PLATINUM configures its backdoor malware to restrict its activities to victims ' working hours , in an attempt to disguise post-infection network activity within normal user traffic . If KeyBoy is a single component of a larger espionage toolkit , the developers may have realized that this older , static-key based , configuration encoding algorithm was inadvertently providing a link between disparate components of their malware suite .


PLATINUM does not conduct its espionage activity to engage in direct financial gain , but instead uses stolen information for indirect economic advantages . In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker ; 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks .


PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts . The NetTraveler trojan has been known to be used in targeted cyber espionage attacks for more than a decade by nation state threat actors and continues to be used to target its victims and exfiltrate data .


For the initial infection , PLATINUM typically sends malicious documents that contain exploits for vulnerabilities in various software programs , with links or remotely loaded components ( images or scripts or templates ) that are delivered to targets only once . The exploit document carrying this alternate KeyBoy configuration also used a decoy document which was displayed to the user after the exploit launched .


PLATINUM 's approach toward exploiting vulnerabilities varies between campaigns . Only one incident involving a Russian bank was promptly identified and prevented that is known to Group-IB .


The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components . This program is designed to capture keystrokes , take screenshots of the user 's desktop and get contents from the clipboard .


When the document was opened in Word , PLATINUM exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer . To conduct targeted attacks , MoneyTaker use a distributed infrastructure that is difficult to track .


n one case from 2013 , the target was sent a malicious document through a spear phishing email message . This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files .


The DLL exploited another previously unknown vulnerability ( designated CVE-2015-2546 ) in the Windows kernel , which enabled it to elevate privileges for the Word executable and subsequently install a backdoor through the application . Hackers use Metasploit to conduct all these activities : network reconnaissance , search for vulnerable applications , exploit vulnerabilities , escalate systems privileges , and collect information .


When the document was opened in Word , it exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer . Over the years they've used application components from Norman , McAfee and Norton .


In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves . Recently , Falcon Intelligence observed new activity from MUSTANG PANDA , using a unique infection chain to target likely Mongolia-based victims .


Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015 . Throughout the years , the Mofang group has compromised countless servers belonging to government or other Myanmar related organizations , in order to stage attacks .


In both these campaigns the activity group included remote triggers to deactivate exploitation , with an attempt to conceal the vulnerability , and prevent analysis of the attack . This file requires the target to attempt to open the .lnk file , which redirects the user to a Windows Scripting Component ( .wsc ) file , hosted on an adversary-controlled microblogging page .


After gaining access to a victim 's computer , PLATINUM installs its own custom-built malware to communicate with the compromised system , issue commands , and move laterally through the network . A report published by Kaspersky Labs in 2011 on NetTraveler also mentions the C2 servers were being hosted by Krypt Technolgies .


PLATINUM uses a number of different custom-developed backdoors to communicate with infected computers . Obviously , the developers behind NetTraveler have taken steps to try to hide the malware 's configuration .


This section describes some of the tools used by the group . In this report , we'll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan .


The lack of any significant evidence of shared code between any of these backdoor families is another clue as to the scope of the resources on which the activity group is able to draw , and the precautions the group is willing and able to take in order to avoid losing its ability to conduct its espionage operations . In this report , we'll review how NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan .


In addition to Dipsind and its variants , PLATINUM uses a few other families of custom-built backdoors within its attack toolset . In this report , we'll review how the NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan .


The PLATINUM group has written a few different versions of keyloggers that perform their functions in different ways , most likely to take advantage of different weaknesses in victims ' computing environments . Upon successful exploitation , the attachment will install the Trojan known as NetTraveler using a DLL side-loading attack technique .


While one family relies on a small number of supported commands and simple shells , the other delves into more convoluted methods of injections , checks , and supported feature sets . NetTraveler has been used to target diplomats , embassies and government institutions for over a decade , and remains the tool of choice by the adversaries behind these cyber espionage campaigns .


Both groups can set permissions on specific files to Everyone , and work in tandem with the PLATINUM backdoors . WildFire correctly classifies NetTraveler as malicious .


In particular , this second group also has the capability of dumping users ' credentials using the same technique employed by Mimikatz . The NetTraveler group has infected victims across multiple establishments in both the public and private sector including government institutions , embassies , the oil and gas industry , research centers , military contractors and activists .


In addition to using several publicly known injection methods to perform this task , it also takes advantage of an obscure operating system feature known as hot patching . Today Kaspersky Lab 's team of experts published a new research report about NetTraveler , which is a family of malicious programs used by APT actors to successfully compromise more than 350 high-profile victims in 40 countries .


One of PLATINUM 's most recent and interesting tools is meant to inject code into processes using a variety of injection techniques . According to Kaspersky Lab 's report , this threat actor has been active since as early as 2004 ; however , the highest volume of activity occurred from 2010 – 2013 .


At a high level , hot patching can transparently apply patches to executables and DLLs in actively running processes , which does not happen with traditional methods of code injection such as CreateRemoteThread or WriteProcessMemory . Most recently , the NetTraveler group 's main domains of interest for cyberespionage activities include space exploration , nanotechnology , energy production , nuclear power , lasers , medicine and communications .


Hot patching is an operating system-supported feature for installing updates without having to reboot or restart a process . In addition , the NetTraveler toolkit was able to install additional info-stealing malware as a backdoor , and it could be customized to steal other types of sensitive information such as configuration details for an application or computer-aided design files .


Multiple Dipsind variants have been identified , all of which are believed to be used exclusively by PLATINUM . During Kaspersky Lab 's analysis of NetTraveler , the company 's experts identified six victims that had been infected by both NetTraveler and Red October , which was another cyberespionage operation analyzed by Kaspersky Lab in January 2013 .


The group 's most frequently used backdoors belong to a malware family that Microsoft has designated Dipsind , although some variants are detected under different names . Kaspersky Lab 's products detect and neutralize the malicious programs and its variants used by the NetTraveler Toolkit , including Trojan-Spy.Win32.TravNet and Downloader.Win32.NetTraveler .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 Administrator permissions are required for hot patching , and the technique used by PLATINUM does not attempt to evade this requirement through exploitation . Based on Kaspersky Lab 's analysis of NetTraveler 's C&C data , there were a total of 350 victims in 40 countries across including the United States , Canada , United Kingdom , Russia , Chile , Morocco , Greece , Belgium , Austria , Ukraine , Lithuania , Belarus , Australia , Hong Kong , Japan , China , Mongolia , Iran , Turkey , India , Pakistan , South Korea , Thailand , Qatar , Kazakhstan , and Jordan .


PLATINUM has used several zero-day exploits against their victims . Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit.MSWord.CVE-2010-333 , Exploit.Win32.CVE-2012-0158 .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 . In this case , it was a group commonly referred to as " Nitro " , which was coined by Symantec in its 2011 whitepaper .


PLATINUM has consistently targeted victims within a small set of countries in South and Southeast Asia . Historically , Nitro is known for targeted spear phishing campaigns and using Poison Ivy malware , which was not seen in these attacks .


PLATINUM has developed or commissioned a number of custom tools to provide the group with access to victim resources . Since at least 2013 , Nitro appears to have somewhat modified their malware and delivery methods to include Spindest and legitimate compromised websites , as reported by Cyber Squared 's TCIRT .


Some of the tools used by PLATINUM , such as the port-knocking backdoor , show signs of organized thinking . In July , Nitro compromised a South Korean clothing and accessories manufacturer 's website to serve malware commonly referred to as " Spindest " . Of all the samples we've tied to this activity so far noted in this blog , this is the only one configured to connect directly to an IP address for Command and Control ( C2 ) .


Take advantage of native mitigations built into Windows 10 . The next sample was another Spindest variant and had the same timestamp as the aforementioned PcClient sample .


For example , the summer 2015 attack that used the unusual ' resume ' would not have been successful on Windows 10 as-is because of the presence of the Supervisor Mode Execution Prevention ( SMEP ) mitigation , even without the latest security updates installed . As this post and previous cited research show , APT groups such as Nitro will continue to evolve their techniques within the kill chain to avoid detection .


Even if CVE-2015-2546 affected Windows 10 , the exploitation would have required much more technical prowess to succeed ; ultimately , SMEP makes it more difficult for attackers . attacks on the chemical industry are merely their latest attack wave .


For example , one zero-day vulnerability exploit ( CVE-2015-2545 ) used by PLATINUM was addressed immediately in September 2015 . The goal of the attackers appears to be to collect intellectual property such as design documents , formulas , and manufacturing processes .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel® Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication . The attack wave started in late July 2011 and continued into midSeptember 2011 .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication . The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage .


Until this incident , no malware had been discovered misusing the AMT SOL feature for communication . They then moved on to the motor industry in late May .


We confirmed that the tool did not expose vulnerabilities in the management technology itself , but rather misused AMT SOL within target networks that have already been compromised to keep communication stealthy and evade security applications . From late April to early May , the attackers focused on human rights related NGOs .


In either case , PLATINUM would need to have gained administrative privileges on targeted systems prior to the feature 's misuse . Attackers then moved on to the motor industry in late May .


The updated tool has only been seen in a handful of victim computers within organizational networks in Southeast Asia—PLATINUM is known to customize tools based on the network architecture of targeted organizations . At this point , the current attack campaign against the chemical industry began .


One possibility is that PLATINUM might have obtained compromised credentials from victim networks . The attackers first researched desired targets and then sent an email specifically to the target .


Another possibility is that the targeted systems did not have AMT provisioned and PLATINUM , once they've obtained administrative privileges on the system , proceeded to provision AMT . First , when a specific recipient was targeted , the mails often purported to be meeting invitations from established business partners .


During the provisioning process , PLATINUM could select whichever username and password they wish . While the attackers used different pretexts when sending these malicious emails , two methodologies stood out .


The new SOL protocol within the PLATINUM file-transfer tool makes use of the AMT Technology SDK 's Redirection Library API ( imrsdk.dll ) . Secondly , when the emails were being sent to a broad set of recipients , the mails purported to be a necessary security update .


The PLATINUM tool is , to our knowledge , the first malware sample observed to misuse chipset features in this way . The attacks were traced back to a computer system that was a virtual private server ( VPS ) located in the United States .


Microsoft reiterates that the PLATINUM tool does not expose flaws in Intel® Active Management Technology ( AMT ) , but uses the technology within an already compromised network to evade security monitoring tools . Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor.Sogu .


The discovery of this new PLATINUM technique and the development of detection capabilities highlight the work the Windows Defender ATP team does to provide customers greater visibility into suspicious activities transpiring on their networks . This particular threat was also used by hackers to compromise a Korean social network site to steal records of 35 million users .


It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks . The Sogu gang use a custom developed threat – Backdoor.Sogu , whereas the group described in this document use an off the shelf threat – Poison Ivy .


This signals just how long ago the Poseidon threat actor was already working on its offensive framework . The Sogu gang , in contrast , use PDF and DOC files in very tailored , targeted emails .


However , Poseidon 's practice of being a ' custom-tailored malware implants boutique ' kept security researchers from connecting different campaigns under the umbrella of a single threat actor . These attacks are primarily targeting private industry in search of key intellectual property for competitive advantage , military institutions , and governmental organizations often in search of documents related to current political events and human rights organizations .


Poseidon Group is dedicated to running targeted attacks campaigns to aggressively collect information from company networks through the use of spear-phishing packaged with embedded , executable elements inside office documents and extensive lateral movement tools . Nitro 's campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes .


The Poseidon Group is a long-running team operating on all domains : land , air , and sea . This attack campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes .


The Poseidon Group has been active , using custom code and evolving their toolkit since at least 2005 . These have been highly active in the Middle East region and unveiled ongoing targeted attacks in multiple regions .


Poseidon has maintained a consistently evolving toolkit since the mid-2000s . The attackers try to lure targets through spear phishing emails that include compressed executables .


The Poseidon Group actively targets this sort of corporate environment for the theft of intellectual property and commercial information , occasionally focusing on personal information on executives . We found that the group behind this campaign targeted mainly industrial , engineering and manufacturing organizations in more than 30 countries .


PROMETHIUM is an activity group that has been active as early as 2012 . Using the Kaspersky Security Network ( KSN ) and artifacts from malware files and attack sites , we were able to trace the attacks back to March 2015 .


This malware family is known as " PittyTiger " by the anti-virus community . Operation Ghoul is one of the many attacks in the wild targeting industrial , manufacturing and engineering organizations , Kaspersky Lab recommends users to be extra cautious while checking and opening emails and attachments .


NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird . The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People 's Republics .


The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies . The attacks appear to be geopolitically motivated and target high profile organizations .


PROMETHIUM distributed links through instant messengers , pointing recipients to malicious documents that invoked the exploit code to launch Truvasys on victim computers . The objective of the attacks is clearly espionage – they involve gaining access to top legislative , executive and judicial bodies around the world .


PROMETHIUM is an activity group that has been active since at least 2012 . The attackers have targeted a large number of organizations globally since early 2017 , with the main focus on the Middle East and North Africa ( MENA ) , especially Palestine .


In 2016 , an attack campaign by this group was recorded in early May that made use of an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player , which at the time was both unknown and unpatched . The attacks were initially discovered while investigating a phishing attack that targeted political figures in the MENA region .


Truvasys is a collection of modules written in the Delphi programming language , a variant of Pascal . Like BlackEnergy ( a.k.a. Sandworm , Quedagh ) , Potao is an example of targeted espionage ( APT ) malware detected mostly in Ukraine and a number of other CIS countries , including Russia , Georgia and Belarus .


While studying Truvasys , Microsoft uncovered a previously undocumented piece of malware known as Myntor that is a completely separate malware family . The main reason for the increase in Potao detections in 2014 and 2015 were infections through USB drives .


Unit 61486 is the 12th Bureau of the PLA 's 3rd General Staff Department ( GSD ) and is headquartered in Shanghai , China . The first Potao campaign that we examined took place in August 2011 .


The CrowdStrike has been tracking this particular unit since 2012 , under the codename PUTTER PANDA , and has documented activity dating back to 2007 . In March 2014 , the gang behind Potao started using a new infection vector .


The CrowdStrike Intelligence team has been tracking this particular unit since 2012 , under the codename PUTTER PANDA , and has documented activity dating back to 2007 . Since March 2015 , ESET has detected Potao binaries at several high-value Ukrainian targets that include government and military entities and one of the major Ukrainian news agencies .


This particular unit is believed to hack into victim companies throughout the world in order to steal corporate trade secrets , primarily relating to the satellite , aerospace and communication industries . As confirmation that the malware writers are still very active even at the time of this writing , ESET detected a new Potao sample compiled on July 20 , 2015 .


Parts of the PUTTER PANDA toolset and tradecraft have been previously documented , both by CrowdStrike , and in open source , where they are referred to as the MSUpdater group . In the previous pages we have presented our findings based on ESET detection telemetry and our analysis of Win32/Potao and Win32/FakeTC samples .


PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries . Potao is another example of targeted espionage malware , a so-called APT , to use the popular buzzword , although technically the malware is not particularly advanced or sophisticated .


According to the hacking collective , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks . Examples of notable Potao dissemination techniques , some of which were previously unseen , or at least relatively uncommon , include the use of highly-targeted spear-phishing SMS messages to drive potential victims to malware download sites and USB worm functionality that tricked the user into ' willingly ' executing the Trojan .


The folders seem to contain information about the company 's development documentation , artificial intelligence model , web security software , and antivirus software base code . The PassCV group continues to be one of the most successful and active threat groups that leverage a wide array of stolen Authenticode-signing certificates .


Targeting antivirus companies appears to have been the primary goal of Fxmps' latest network intrusions . The PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) .


This period started with their seeming disappearance in October 2018 and concluded with their return in April 2019 . he PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) .


The hacker 's name is Gnosticplayers , and since February 11 the hacker has put up for sale data for 32 companies in three rounds [stories on Round 1 , Round 2 , and Round 3] on Dream Market , a dark web marketplace . PassCV continues to maintain a heavy reliance on obfuscated and signed versions of older RATs like ZxShell and Ghost RAT , which have remained a favorite of the wider Chinese criminal community since their initial public release .


But according to Gnosticplayers , his foray into a public marketplace like Dream has two goals --besides the first and obvious one being money . SPEAR identified recent PassCV samples which implemented another commercial off-the-shelf ( COTS ) RAT called Netwire .


Data collected by Secureworks incident response ( IR ) analysts and analyzed by CTU researchers indicates that GOLD LOWELL extorts money from victims using the custom SamSam ransomware . SPEAR identified recent PassCV samples which implemented another commercial off-the-shelf ( COTS ) RAT called Netwire .


Some sources claimed that GOLD LOWELL operations specifically targeted the healthcare vertical following public SamSam incidents in 2016 and 2018 . The first new connection SPEAR identified was derived from an email address listed in Blue Coat Systems' original report on PassCV .


However , CTU analysis indicates that GOLD LOWELL is motivated by financial gain , and there is no evidence of the threat actors using network access for espionage or data theft . Syncopate is a well-known Russian company that is best known as the developer and operator of the ' GameNet ' platform .


In January 2017 , GOLD LOWELL began targeting legitimate RDP account credentials , in some cases discovering and compromising accounts using brute-force techniques . The PassCV group continues to be extremely effective in compromising both small and large game companies and surreptitiously using their code-signing certificates to infect an even larger swath of organizations .


In 2015 and 2016 , GOLD LOWELL frequently exploited JBoss enterprise applications using several versions of this open-source JBoss exploitation tool . Since the last report , PassCV has significantly expanded its targets to include victims in the United States , Taiwan , China and Russia .


In 2017 and early 2018 , the group used PowerShell commands to call Mimikatz from an online PowerSploit repository , which is a collection of publicly available PowerShell modules for penetration testing . Based on data collected from Palo Alto Networks AutoFocus threat intelligence , we discovered continued operations of activity very similar to the Roaming Tiger attack campaign that began in the August 2015 timeframe , with a concentration of attacks in late October and continuing into December .


Gold Lowell responded by modifying a registry entry to disable the endpoint tool 's scanning functionality . The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems .


Gold Lowell then provide a download link to a unique XML executable file and corresponding RSA private key to decrypt the files . BBSRAT is typically packaged within a portable executable file , although in a few of the observed instances , a raw DLL was discovered to contain BBSRAT .


This methodology , known as " big game hunting " , signals a shift in operations for WIZARD SPIDER , a criminal enterprise of which GRIM SPIDER appears to be a cell . WildFire properly classifies BBSRAT malware samples as malicious .


The WIZARD SPIDER threat group , known as the Russia-based operator of the TrickBot banking malware , had focused primarily on wire fraud in the past . This week we will discuss another Chinese nexus adversary we call Samurai Panda .


Similar to Samas and BitPaymer , Ryuk is specifically used to target enterprise environments . Samurai Panda is interesting in that their target selection tends to focus on Asia Pacific victims in Japan , the Republic of Korea , and other democratic Asian victims .


Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release . Next , in an effort to demonstrate it wasn't relegated to China , CrowdStrike exposed Clever Kitten , an actor we track out of Iran who leverages some very distinct TTPs when viewed next to a more visible adversary .


Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors . Next , in an effort to demonstrate it wasn't relegated to China , we exposed Clever Kitten , an actor we track out of Iran who leverages some very distinct TTPs when viewed next to a more visible adversary .


However , Ryuk is only used by GRIM SPIDER and , unlike Hermes , Ryuk has only been used to target enterprise environments . Beginning in 2009 , we've observed this actor conduct more than 40 unique campaigns that we've identified in the malware configurations' campaign codes .


Since Ryuk 's appearance in August , the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD . These codes are often leveraged in the malware used by coordinated targeted attackers to differentiate victims that were successfully compromised from different target sets .


Hermes ransomware , the predecessor to Ryuk , was first distributed in February 2017 . When conducting programmatic espionage activity , it can presumably become quite confusing if the attacker targets a heavy industry company , an avionics program , and seven other unique targets as to which infected host you will collect what information from .


In mid-August 2018 , a modified version of Hermes , dubbed Ryuk , started appearing in a public malware repository . These rules detect the malware " beaconing " to the command-and-control server , the initial malware check-in , and an attempt to download a backdoor module .


Ryuk was tailored to target enterprise environments and some of the modifications include removing anti-analysis checks . Earlier this month , Securelist 's technology caught another zero-day Adobe Flash Player exploits deployed in targeted attacks .


As mentioned in the Hermes to Ryuk section , Ryuk uses a combination of symmetric ( AES ) and asymmetric ( RSA ) encryption to encrypt files . Securelist believe the attacks are launched by an APT Group we track under the codename " ScarCruft " .


For each mounted drive , Ryuk calls GetDriveTypeW to determine the drive 's type . ScarCruft is a relatively new APT group ; victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania .


To retrieve IP addresses that have ARP entries , Ryuk calls GetIpNetTable . ScarCruft has several ongoing operations , utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer .


Open-source reporting has claimed that the Hermes ransomware was developed by the North Korean group STARDUST CHOLLIMA ( activities of which have been public reported as part of the " Lazarus Group " ) , because Hermes was executed on a host during the SWIFT compromise of FEIB in October 2017 . ScarCruft is a relatively new APT group ; victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania .


The two executables related to Hermes are bitsran.exe and RSW7B37.tmp . Operation Daybreak appears to have been launched by ScarCruft in March 2016 and employs a previously unknown ( 0-day ) Adobe Flash Player exploit .


Falcon Intelligence has medium-high confidence that the GRIM SPIDER threat actors are operating out of Russia . Adobe Flash Player exploit .


Based on these factors , there is considerably more evidence supporting the hypothesis that the GRIM SPIDER threat actors are Russian speakers and not North Korean . It is also possible that ScarCruft deployed another zero day exploit , CVE-2016-0147 , which was patched in April .


The hackers also started tweeting a few samples of internal emails from the company . Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks .


From a process and file perspective , Hermes and Ryuk target files in a similar fashion . ScarCruft 's Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks .


Claudio Guarnieri , a security researcher who has investigated Hacking Team along with others at the Citizen Lab , was quick to point this out . Nevertheless , resourceful threat actors such as ScarCruft will probably continue to deploy zero-day exploits against their high profile targets .


The breach on Hacking Team comes almost a year after another surveillance tech company , the competing FinFisher , was hacked in a similar way , with a hacker leaking 40 Gb of internal files . After publishing our initial series of blogposts back in 2016 , Kaspersky have continued to track the ScarCruft threat actor .


Their software , once surreptitiously installed on a target 's cell phone or computer , can be used to monitor the target 's communications , such as phone calls , text messages , Skype calls , or emails . After publishing our initial series of blogposts back in 2016 , we have continued to track the ScarCruft threat actor .


In 2015 and 2016 , Dridex was one of the most prolific eCrime banking trojans on the market and , since 2014 , those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits . ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula .


In August 2017 , a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K. 's National Health Service ( NHS ) , with a high ransom demand of 53 BTC ( approximately $200,000 USD ) . The ScarCruft group uses common malware delivery techniques such as spear phishing and Strategic Web Compromises ( SWC ) .


The targeting of an organization rather than individuals , and the high ransom demands , made BitPaymer stand out from other contemporary ransomware at the time . ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula .


Though the encryption and ransom functionality of BitPaymer was not technically sophisticated , the malware contained multiple anti-analysis features that overlapped with Dridex . ScarCruft uses a multi-stage binary infection scheme .


Later technical analysis of BitPaymer indicated that it had been developed by INDRIK SPIDER , suggesting the group had expanded its criminal operation to include ransomware as a monetization strategy . One of the most notable functions of the initial dropper is to bypass Windows UAC ( User Account Control ) in order to execute the next payload with higher privileges .


The beginning of 2017 also brought a turning point in INDRIK SPIDER 's operation of Dridex . This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams .


CrowdStrike® Falcon® Intelligence™ also observed a strong correlation between Dridex infections and BitPaymer ransomware . Afterwards , the installer malware creates a downloader and a configuration file from its resource and executes it .


During incidents that involved BitPaymer , Dridex was installed on the victim network prior to the deployment of the BitPaymer malware . The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload .


Also unusual was the observation that both Dridex and BitPaymer were spread through the victim network using lateral movement techniques traditionally associated with nation-state actors and penetration testing . The ScarCruft group keeps expanding its Exfiltration targets to steal further information from infected hosts and continues to create tools for additional data Exfiltration .


The information gathered from these engagements , combined with information from prior Dridex IR engagements , provides insight into how INDRIK SPIDER deploys and operates both Dridex and BitPaymer . We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester .


In recent BitPaymer IR engagements , Falcon Intelligence linked the initial infection vector to fake updates for a FlashPlayer plugin and the Chrome web browser . We believe they may have some links to North Korea , which may explain why ScarCruft decided to closely monitor them .


With the move to targeting select victims for high-value payouts , the INDRIK SPIDER adversary group is no longer forced to scale its operations , and now has the capacity to tailor its tooling to the victim 's environment and play a more active role in the compromise with " hands on keyboard " activity . ScarCruft also attacked a diplomatic agency in Hong Kong , and another diplomatic agency in North Korea .


This web hosting service provider continues to be the hosting provider of choice for the threat actors behind NetTraveler . It appears ScarCruft is primarily targeting intelligence for political and diplomatic purposes .


These new tactics of selectively targeting organizations for high ransomware payouts have signaled a shift in INDRIK SPIDER 's operation with a new focus on targeted , low-volume , high-return criminal activity : a type of cybercrime operation we refer to as big game hunting . ScarCruft infected this victim on September 21 , 2018 .


Later , in January 2018 , a report was released that identified similarities between the BitPaymer ransomware and Dridex malware . But before the ScarCruft infection , however , another APT group also targeted this victim with the host being infected with GreezeBackdoor on March 26 , 2018 .


The report authors renamed the malware " FriedEx " . ScarCruft has a keen interest in North Korean affairs , attacking those in the business sector who may have any connection to North Korea , as well as diplomatic agencies around the globe .


Falcon Intelligence has analyzed this malware and can confirm the overlap between BitPaymer/FriedEx and Dridex malware . Earlier this month , we caught another zero-day Adobe Flash Player exploits deployed in targeted attacks .


Though there is no functionality to collect this information in the ransomware itself , the ransomware is deployed by INDRIK SPIDER in parallel with Dridex malware , and the Dridex malware contains modules that may be used to collect information from infected hosts . ScarCruft is a relatively new APT group ; victims have been observed in several countries , including Russia , Nepal , South Korea , China , India , Kuwait and Romania .


Falcon Intelligence has acquired multiple decryption tools related to BitPaymer , which confirm the theory that a unique key is used for each infection . Currently , the group is engaged in two major operations : Operation Daybreak and Operation Erebus .


Unlike many ransomware operations , which usually just require victims to make the payment and subsequently download a decryptor , INDRIK SPIDER requires the victim to engage in communication with an operator . The other one , ScarCruft 's Operation Erebus employs an older exploit , for CVE-2016-4117 and leverages watering holes .


Falcon Intelligence has had unique insight into the email dialogue between a victim and an INDRIK SPIDER operator . The other one , " Operation Erebus " employs an older exploit , for CVE-2016-4117 and leverages watering holes .


Initial victim communication with the INDRIK SPIDER operator , using one of the email addresses provided , results in the operator providing key pieces of information up front , such as the BTC address and the ransom amount . We will publish more details about the attack once Adobe patches the vulnerability , which should be on June 16 .


It was made clear during communications that INDRIK SPIDER is not willing to negotiate on the ransom amount , explicitly stating that the victim can use multiple Bitcoin exchanges to obtain the number of BTC required , and the exchange rate should be calculated based on the rate posted on the cryptocurrency exchange Bittrex . The ScarCruft APT gang has made use of a Flash zero day patched Thursday by Adobe to attack more than two dozen high-profile targets in Russia and Asia primarily .


Of note , INDRIK SPIDER specifies the geographical location of where the victim should seek help , confirming that they know key information about the victim . Adobe on Thursday patched a zero-day vulnerability in Flash Player that has been used in targeted attacks carried out by a new APT group operating primarily against high-profile victims in Russia and Asia .


INDRIK SPIDER uses file sharing platforms to distribute the BitPaymer decryptor . Researchers at Kaspersky Lab privately disclosed the flaw to Adobe after exploits against the zero-day were used in March by the ScarCruft APT gang in what Kaspersky Lab is calling Operation Daybreak .


In an extensive email to the victim , the INDRIK SPIDER operator provides a decryptor download link , decryptor deletion link ( to be used following decryptor download ) and a password . Kaspersky speculates that ScarCruft could also be behind another zero-day , CVE-2016-0147 , a vulnerability in Microsoft XML Core Services that was patched in April .


The recommendations provided are not only good advice , but also provide indications of how INDRIK SPIDER breaches organizations and moves laterally until domain controller access is gained . attacks start with spear-phishing emails that include a link to a website hosting an exploit kit associated with ScarCruft and used in other attacks .


Ransom demands have varied significantly , suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization . Another set of attacks called Operation Erebus leverages another flash exploit , CVE-2016-4117 , and relies on watering hole attacks as a means of propagation .


INDRIK SPIDER consists of experienced malware developers and operators who have likely been part of the group since the early days of Dridex operations , beginning in June 2014 . Thursday 's Flash Player update patched 36 vulnerabilities in total including the zero day CVE-2016-4171 .


The formation of the group and the modus operandi changed significantly in early 2017 . The ongoing operation likely began as early as January 2017 and has continued through the first quarter of 2019 .


Dridex operations became more targeted , resulting in less distribution and Dridex sub-botnets in operation , and BitPaymer ransomware operations began in July 2017 . Cisco Talos assess with high confidence that these operations are distinctly different and independent from the operations performed by DNSpionage , which we reported on in November 2018 .


There is no doubt that BitPaymer ransomware operations are proving successful for Indrik Spider , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan . We assess with high confidence that these operations are distinctly different and independent from the operations performed by DNSpionage , which we reported on in November 2018 .


There is no doubt that BitPaymer ransomware operations are proving successful for this criminal group , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan . The common use of the Enfal Trojan suggests that Shadow Network may be exchanging tools and techniques .


Though Dridex is still bringing in criminal revenue for the actor after almost four years of operation , targeted wire fraud operations likely require lengthy planning . While Silence had previously targeted Russian banks , Group-IB experts also have discovered evidence of the group 's activity in more than 25 countries worldwide .


In scenarios where wire fraud is not as lucrative an option , INDRIK SPIDER might use ransomware to monetize the compromise instead . In August 2017 , the National Bank of Ukraine warned state-owned and private banks across the country about a large-scale phishing attack .


INDRIK SPIDER isn't the only criminal actor running big game hunting operations ; The first ransomware to stake a claim for big game hunting was Samas ( aka SamSam ) , which is developed and operated by BOSS SPIDER . The threat actor used an exploit from the arsenal of the state-sponsored hacker group APT28 .


Since they were first identified in January 2-16 , this adversary has consistently targeted large organizations for high ransom demands . The new threat actor group was eventually named Silence .


In July 2017 , INDRIK SPIDER joined the movement of targeted ransomware with BitPaymer . Silence is a group of Russian-speaking hackers , based on their commands language , the location of infrastructure they used , and the geography of their targets ( Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan ) .


Most recently , the ransomware known as Ryuk came to market in August 2017 and has netted its operators , tracked by Falcon Intelligence as GRIM SPIDER , a significant ( and immediate ) profit in campaigns also targeting large organizations . Although Silence 's phishing emails were also sent to bank employees in Central and Western Europe , Africa , and Asia ) .


The WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware . Silence also used Russian-language web hosting services .


The LUNAR SPIDER threat group is the Eastern European-based operator and developer of the commodity banking malware called BokBot ( aka IcedID ) , which was first observed in April 2017 . Financially motivated APT groups which focus efforts on targeted attacks on the financial sector such as — Anunak , Corkow , Buhtrap — usually managed botnets using developed or modified banking Trojans .


The BokBot malware provides LUNAR SPIDER affiliates with a variety of capabilities to enable credential theft and wire fraud , through the use of webinjects and a malware distribution function . They tried new techniques to steal from banking systems , including AWS CBR ( the Russian Central Bank 's Automated Workstation Client ) , ATMs , and card processing .


campaigns involving both BokBot and TrickBot were first identified by CrowdStrike Intelligence in July 2017 . Group-IB researchers were tracking Silence throughout this period and conducting response following incidents in the financial sector .


These gtags have been closely associated with LUNAR SPIDER activity . Group-IB detected the first incidents relating to Silence in June 2016 .


Unit 42 followed network traces and pivoted on the information left behind by this actor , such as open directories , document metadata , and binary peculiarities , which enabled us to find a custom-made piece of malware , that we named " CapturaTela " . One of Silence 's first targets was a Russian bank , when they tried to attack AWS CBR .


Our telemetry for this campaign identified email as the primary delivery mechanism and found the first related samples were distributed in August 2018 . They are selective in their attacks and wait for about three months between incidents , which is approximately three times longer than other financially motivated APT groups , like MoneyTaker , Anunak ( Carbanak ) , Buhtrap or Cobalt .


Aside from the use of the custom trojan CapturaTela , the actor makes extensive use of several other remote access Trojans to perform its malicious activities . Silence try to apply new techniques and ACTs of stealing from various banking systems , including AWS CBR , ATMs , and card processing .


Why would OurMine want to target WikiLeaks . Silence 's successful attacks currently have been limited to the CIS and Eastern European countries .


Instead , OurMine had managed to alter WikiLeaks 's DNS records ( held by a third-party registrar ) to direct anyone who tried to visit wikileaks.org to visit a different IP address which definitely wasn't under the control of Julian Assange and his cronies . He is responsible for developing tools for conducting attacks and is also able to modify complex exploits and third party software .


We don't know how OurMine managed to access WikiLeaks 's DNS records , but past experience has shown that their typical modus operandi is simply to log in using their victim 's password . Silence 's main targets are located in Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan .


Alternatively , OurMine might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address . However , some phishing emails were sent to bank employees in more than 25 countries of Central and Western Europe , Africa and Asia including : Kyrgyzstan , Armenia , Georgia , Serbia , Germany , Latvia , Czech Republic , Romania , Kenya , Israel , Cyprus , Greece , Turkey , Taiwan , Malaysia , Switzerland , Vietnam , Austria , Uzbekistan , Great Britain , Hong Kong , and others .


Alternatively , the attackers might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address . In the same year , they conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans .


Known for hijacking prominent social media accounts , the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network . In the same year , Silence conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans .


Last year , OurMine victimized Marvel , The New York Times , and even the heads of some of the biggest technology companies in the world . In two months , the group returned to their proven method and withdrew funds again through ATMs .


Mark Zuckerberg , Jack Dorsey , Sundar Pichai , and Daniel Ek — the CEOs of Facebook , Twitter , Google and Spotify , respectively — have also fallen victim to the hackers , dispelling the notion that a career in software and technology exempts one from being compromised . In September 2017 , we discovered a new targeted attack on financial institutions .


The group is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that . In September 2017 , we discovered Silence attack on financial institutions .


OurMine is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that . The infection vector is a spear-phishing email with a malicious attachment .


The group 's primary goal is demonstrating to companies that they have weak security . An interesting point in the Silence attack is that the cybercriminals had already compromised banking infrastructure in order to send their spear-phishing emails from the addresses of real bank employees and look as unsuspicious as possible to future victims .


US intelligence agencies pinned the breach on North Korea ( one of the hacking group 's demands was that Sony pull The Interview , Seth Rogan 's comedy about a plot to assassinate Kim Jong-Un ) . The spear-phishing infection vector is still the most popular ACT to initiate targeted campaigns .


Of course , Sony ( one of Vevo 's joint owners ) fell victim to a devastating hack in 2014 after a group of hackers calling themselves the " Guardians of Peace " dumped a wealth of its confidential data online . We conclude that the actor behind the attack is Silence group , a relatively new threat actor that's been operating since mid-2016 .


The cryptominer employed by Pacha Group , labeled Linux.GreedyAntd by Intezer , was completely undetected by all leading engines , demonstrating the sophistication of this malware . A preliminary analysis caught the attention of our Threat Analysis and Intelligence team as it yielded interesting data that , among other things , shows that Silence was targeting employees from financial entities , specifically in the Russian Federation and the Republic of Belarus .


Intezer has evidence dating back to September 2018 which shows Pacha Group has been using a cryptomining malware that has gone undetected on other engines . As shown above , the threat runs several native binaries to collect useful information for its recon phase .


The new miner employed by Pacha Group , named Linux.GreedyAntd , has shown to be more sophisticated than the average Linux threat , using evasion techniques rarely seen in Linux malware . The intelligence we have collected shows that Silence is part of a more extensive operation , still focused on financial institutions operating mainly on Russian territory .


Pacha Group is believed to be of Chinese origin , and is actively delivering new campaigns , deploying a broad number of components , many of which are undetected and operating within compromised third party servers . These spearphishing attempts represent an evolution of Iranian actors based on their social engineering tactics and narrow targeting .


We have labeled the undetected Linux.Antd variants , Linux.GreedyAntd and classified the threat actor as Pacha Group . Based on file modification dates and timestamps of samples , it appears that the observed campaign was initiated in the middle of February 2016 , with the infrastructure taken offline at the start of March .


Based on our findings Linux.GreedyAntd 's operations closely resemble previous cryptojacking campaigns deployed by Pacha Group in the past . While the Sima moniker could similarly originate from software labels , it is a common female Persian name and a Persian-language Word for " visage " or " appearance " . Given its use in more advanced social engineering campaigns against women 's rights activists , the label seem particularly apt .


Among the artifacts hosted in GreedyAntd 's servers , we managed to find a single component not related to the same cryptojacking operation just previously discussed and leveraged by Pacha Group . Samples and resource names contained the family names of prominent Iranians , and several of these individuals received the malware located in their respective folder .


It was one of the few ransomware strains that were being mass-distributed via email spam and exploit kits , but also as part of targeted attacks against high-profile organizations ( a tactic known as big-game hunting ) at the same time . The Sima group also engaged in impersonation of Citizenship and Immigration Services at the Department of Homeland Security , posing as a notice about the expiration of the recipient 's Permanent Residence status .


The GandCrab author also had a spat with South Korean security vendor AhnLab last summer after the security firm released a vaccine for the GandCrab ransomware . In another case , Sima mirrored an announcement made about the broadcast of a television program on Iranian-American cultural affairs in order to impersonate the individual and engage in spearphishing within hours of the legitimate message .


Recently , Sophos Labs has observed criminal groups scanning the internet for open MySQL databases running on Windows systems , which they tried to infect with GandCrab . The server used to host these malware samples was located on the German provider Hetzner ( 148.251.55.114 ) , within a small block of IP addresses that are registered with the customer ID " HOS-156205 " .


CrowdStrike Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams . All the samples appear to be have been compiled between February 29 and March 1 2016 , shortly before our discovery , suggesting that , despite the known C&C servers having quickly gone offline shortly after , this spree of attacks might be fresh and currently undergoing .


Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February . These archives provide further indication that those entities behind the campaigns are Persian-language speakers , due to the naming of files and folders in Persian .


CrowdStrike® Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams . For the sake of narrative we are going to focus exclusively to those samples we identified being used in attacks against Iranian civil society and diaspora .


PINCHY SPIDER is the criminal group behind the development of the ransomware most commonly known as GandCrab , which has been active since January 2018 . Butterfly has attacked multi-billion dollar companies operating in the internet , IT software , pharmaceutical , and commodities sectors .


PINCHY SPIDER sells access to use GandCrab ransomware under a partnership program with a limited number of accounts . The first signs of Butterfly 's activities emerged in early 2013 when several major technology and internet firms were compromised .


The main catalyst for dedicated development by PINCHY SPIDER , however , has been an ongoing battle with cybersecurity providers that are actively developing GandCrab mitigations and decryptors . However , an investigation by Symantec has found that the group has been active since at least March 2012 and its attacks have not only continued to the present day , but have also increased in number .


In February , PINCHY SPIDER released version 5.2 of GandCrab , which is immune to the decryption tools developed for earlier versions of GandCrab and in fact , was deployed the day before the release of the latest decryptor . Symantec has to date discovered 49 different organizations in more than 20 countries that have been attacked by Butterfly .


CrowdStrike Intelligence first identified new GandCrab ransomware deployment tactics in mid-February , when a threat actor was observed performing actions on a victim host in order to install GandCrab . Aside from the four companies which have publicly acknowledged attacks , Symantec has identified five other large technology firms compromised by Butterfly , primarily headquartered in the US .


Using RDP and stolen credentials from the initially compromised host , the threat actor then proceeded to move laterally around the victim network and was able to deploy GandCrab across several other hosts . In the first attack , Butterfly gained a foothold by first attacking a small European office belonging to one firm and using this infection to then move on to its US office and European headquarters .


Near the end of February , CrowdStrike Intelligence observed another incident in which similar manual lateral movement techniques were used to deploy GandCrab across multiple hosts in an enterprise . However , technology is not the only sector the group has focused on and Symantec has found evidence that Butterfly has attacked three major European pharmaceutical firms .


Once Domain Controller access was acquired , Pinchy Spider used the enterprise 's own IT systems management software , LANDesk , to deploy a loader to hosts across the enterprise . Butterfly has also shown an interest in the commodities sector , attacking two major companies involved in gold and oil in late 2014 .


This loader , known as Phorpiex Downloader , is not specifically tied to GandCrab or PINCHY SPIDER , and it has previously been observed dropping other malware , such as Smoke Bot , Azorult , and XMRig . The company specializes in finance and natural resources specific to that region .


As reported in the CrowdStrike 2018 Global Threat Report , big game hunting was a trend that helped define the criminal threat landscape in 2018 . The latter was one of at least three law firms Butterfly has targeted over the past three years .


BOSS SPIDER used both enterprise and per-host pricing during their campaigns . In many attacks , the group has succeeded in compromising Microsoft Exchange or Lotus Domino email servers in order to intercept company emails and possibly use them to send counterfeit emails .


Both INDRIK SPIDER ( with BitPaymer ransomware ) and GRIM SPIDER ( with Ryuk ransomware ) have made headlines with their high profile victims and ransom profits , demonstrating that big game hunting is a lucrative enterprise . A powerful threat actor known as " Wild Neutron " ( also known as " Jripbot " and " Morpho " ) has been active since at least 2011 , infecting high profile companies for several years by using a combination of exploits , watering holes and multi-platform malware .


Running successful big game hunting operations results in a higher average profit per victim , allowing adversaries like PINCHY SPIDER and their partners to increase their criminal revenue quickly . Based on the profile of the victims and the type of information targeted by the attackers , Symantec believes that Butterfly is financially motivated , stealing information it can potentially profit from .


The threat actor Rocke was originally revealed by Talos in August of 2018 and many remarkable behaviors were disclosed in their blog post . Wild Neutron hit the spotlight in 2013 , when it successfully infected companies such as Apple , Facebook , Twitter and Microsoft .


The family was suspected to be developed by the Iron cybercrime group and it's also associated with the Xbash malware we reported on in September of 2018 . Wild Neutron 's attacks in 2015 uses a stolen code signing certificate belonging to Taiwanese electronics maker Acer and an unknown Flash Player exploit .


The threat actor Rocke was first reported by Cisco Talos in late July 2018 . During the 2013 attacks , the Wild Neutron actor successfully compromised and leveraged the website www.iphonedevsdk.com , which is an iPhone developers forum .


The ultimate goal of this threat is to mine Monero cryptocurrency in compromised Linux machines . Wild Neutron 's attack took advantage of a Java zero-day exploit and used hacked forums as watering holes .


To deliver the malware to the victim machines , the Rocke group exploits vulnerabilities in Apache Struts 2 , Oracle WebLogic , and Adobe ColdFusion . While the group used watering hole attacks in 2013 , it's still unclear how victims get redirected to the exploitation kits in the new 2014-2015 attacks .


Once the C2 connection is established , malware used by the Rocke group downloads shell script named as " a7 " to the victim machine . Wild Neutron 's tools include a password harvesting trojan , a reverse-shell backdoor and customized implementations of OpenSSH , WMIC and SMB .


To be more specific , the malware uninstalls cloud security products by Alibaba Cloud and Tencent Cloud . Instead of Flash exploits , older Wild Neutron exploitation and watering holes used what was a Java zero-day at the end of 2012 and the beginning of 2013 , detected by Kaspersky Lab products as Exploit.Java.CVE-2012-3213.b .


Public cloud infrastructure is one of the main targets for Rocke . The victims for the 2014-2015 versions are generally IT and real estate/investment companies and in both cases , a small number of computers have been infected throughout Wild Neutron .


FortiGuard Labs has been monitoring a Linux coin mining campaign from " Rocke " – a malware threat group specializing in cryptomining . Wild Neutron 's targeting of major IT companies , spyware developers ( FlexiSPY ) , jihadist forums ( the " Ansar Al-Mujahideen English Forum " ) and Bitcoin companies indicate a flexible yet unusual mindset and interests .


The malicious bash script components of the malware are hosted in Pastebin , with the profile name " SYSTEMTEN " , which is very similar to previous names used by the " Rocke " threat group . We continue to track the Wild Neutron group , which is still active as of June 2015 .


However , around a month ago , Rocke started targeting systems that run Jenkins by attempting to exploit CVE-2018-1000861 and CVE-2019-1003000 . A ransomware variant dubbed PyLocky was observed in September 2018 being distributed by a phishing campaign using an invoicing theme .


By utilizing a hook library , it is more complicated for users to manually detect and remove the infection from their systems , giving the threat actors more time to generate profit . PyLocky was found to be targeting entities in France and Germany .


The group also made it back into the news with the recent WannaCry ransomware that targeted computers around the globe ; it piggybacked on exploits revealed by the Shadow Brokers . Fxmsp specialize in breaching highly secure protected networks to access private corporate and government information .


A mysterious hacker or hackers going by the name " The Shadow Brokers " claims to have hacked a group linked to the NSA and dumped a bunch of its hacking tools . Fxmsp is a hacking collective that has operated in various top-tier Russian- and English-speaking underground communities since 2017 .


The Shadow Brokers claimed to have hacked the Equation Group and stolen some of its hacking tools . Throughout 2017 and 2018 , Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground .


The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites . On April 24 , 2019 , Fxmsp claimed to have secured access to three leading antivirus companies .


The Shadow Brokers , the group that publicly dumped a cache of NSA hacking tools , appears to be back and ready to sell stolen material on an individual basis . According to the Fxmsp , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks .


Wh1sks estimated that , between June and early August , the Shadow Brokers have made up to $88,000 in an alternative cryptocurrency called Monero . Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body . For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2. This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP PROT 443 . Previous reports have discussed Bisonal malware used in attacks against Japan , South Korea and Russia . This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others . If it's Cyrillic and the command to the shell is not ‘ipconfig’ , the threat converts the command result text encoding from Cyrillic to UTF-16 . Similar to the Bisonal variant targeting the Russian organization , this sample was also disguised as PDF document .