“ Using Twitter instead of command-and-control ( C & C ) servers is pretty innovative for an Android botnet. ” “ Using Twitter instead of command-and-control ( C & C ) servers is pretty innovative for an Android botnet , ” says Lukáš Štefanko , the ESET malware researcher who discovered the malicious app . In the first few months of their credential phishing ventures , Scattered Canary’s sights were mostly set on Asian targets—Malaysia and Japan , in particular . Since the Bangladesh incident there have been just a few articles explaining the connection between Lazarus Group and the Bangladesh bank heist .


Malware that enslaves devices to form botnets needs to be able to receive updated instructions . In November 2015 , the group started to focus on North American users , mostly in the United States . However , from this it 's only clear that Lazarus might have attacked Polish banks .


That communication is an Achilles heel for any botnet – it may raise suspicion and , cutting the bots off is always lethal to the botnet ’ s functioning . This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills . Symantec also confirmed seeing the Lazarus wiper tool in Poland at one of their customers .


Additionally , should the command-and-control ( C & C ) servers get seized by the authorities , it would ultimately lead to disclosing information about the entire botnet . In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks . Considering that the afterhack publications by the media mentioned that the investigation stumbled upon three different attackers , it was not obvious whether Lazarus was the one responsible for the fraudulent SWIFT transactions , or if Lazarus had in fact developed its own malware to attack banks ' systems .


To make the Twitoor botnet ’ s communication more resilient , botnet designers took various steps like encrypting their messages , using complex topologies of the C & C network – or using innovative means for communication , among them the use of social networks . For over eighteen months from March 2017 until November 2018 , Scattered Canary’s frequent enterprise-focused credential phishing campaigns almost exclusively targeted businesses in the United States and Canada . We would like to add some strong facts that link some attacks on banks to Lazarus , and share some of our own findings as well as shed some light on the recent TTPs used by the attacker , including some yet unpublished details from the attack in Europe in 2017 .


“ These communication channels are hard to discover and even harder to block entirely . In July 2018 , following a trend we have observed across the entire BEC threat landscape , Scattered Canary changed their preferred cash out mechanism from wire transfers to gift cards . Lazarus attacks are not a local problem and clearly the group 's operations span across the whole world .


On the other hand , it ’ s extremely easy for the crooks to re-direct communications to another freshly created account , ” explains Štefanko . Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials . Lazarus was previously known to conduct cyberespionage and cybersabotage activities , such as attacks on Sony Pictures Entertainment with volumes of internal data leaked , and many system harddrives in the company wiped .


In the Windows space , Twitter , founded in 2006 , was first used to control botnets as early as in 2009 . Using personal information obtained from various sources , Scattered Canary started perpetrating fraud against US federal and state government agencies . We believe that Lazarus Group is very large and works mainly on infiltration and espionage operations , while a substantially smaller units within the group , which we have dubbed Bluenoroff , is responsible for financial profit .


Android bots have also already been found being controlled via other non-traditional means – blogs or some of the many cloud messaging systems like Google ’ s or Baidu ’ s – but Twitoor is the first Twitter-based bot malware , according to Štefanko . In total , 35 actors have been tied to Scattered Canary’s operations since the group emerged in 2008 . Lazarus regrouped and rushed into new countries , selecting mostly poorer and less developed locations , hitting smaller banks because they are , apparently , easy prey .


“ In the future , we can expect that the bad guys will try to make use of Facebook statuses or deploy LinkedIn and other social networks ” , states ESET ’ s researcher . Just as with romance scams , actors make use of scripts and templates they can copy-and-paste without having to create something on their own . To date , the Lazarus group has been one of the most successful in launching large scale operations against the financial industry .


Currently , the Twitoor trojan has been downloading several versions of mobile banking malware . When it comes to engaging targets , Scattered Canary frequently maximized efficiencies through the use of scripts , or as some members of the group call them , formats.” These formats are templated text documents that can contain several layers of phishing messages to send to potential victims . We believe that Lazarus will remain one of the biggest threats to the banking sector , finance , and trading companies , as well as casinos for the next few years .


However , the botnet operators can start distributing other malware , including ransomware , at any time warns Štefanko . Recently , we unveiled the existence of a UEFI rootkit , called LoJax , which we attribute to the Sednit group . We believe Lazarus started this watering hole attack at the end of 2016 after their other operation was interrupted in South East Asia .


“ Twitoor serves as another example of how cybercriminals keep on innovating their business , ” Stefanko continues . If Scattered Canary can be seen as a microcosm for the rapidly evolving organizations behind today’s most pernicious email scams , this report demonstrates that a much more holistic approach—one based on threat actor identity rather than type of fraudulent activity—is required to detect email fraud and protect organizations . We believe they started this watering hole campaign at the end of 2016 after their other operation was interrupted in South East Asia .


“ The takeaway ? This is a first for an APT group , and shows Sednit has access to very sophisticated tools to conduct its espionage operations . A rudimentary but somewhat clever design , KiloAlfa provides keylogging capability for the Lazarus Group 's collection of malicious tools .


Internet users should keep on securing their activities with good security solutions for both computers and mobile devices. ” Hashes : E5212D4416486AF42E7ED1F58A526AEF77BE89BE A9891222232145581FE8D0D483EDB4B18836BCFC AFF9F39A6CA5D68C599B30012D79DA29E2672C6E Insidious Android malware gives up all malicious features but one to gain stealth ESET researchers detect a new way of misusing Accessibility Three years ago , the Sednit group unleashed new components targeting victims in various countries in the Middle East and Central Asia . The design of KiloAlfa is broken down into two basic components : the persistence functionality and the keylogging functionality .


Service , the Achilles ’ heel of Android security 22 May 2020 - 03:00PM ESET researchers have analyzed an extremely dangerous Android app that can perform a host of nefarious actions , notably wiping out the victim ’ s bank account or cryptocurrency wallet and taking over their email or social media accounts . In the past , Sednit used a similar technique for credential phishing . The persistence functionality of KiloAlfa allows the malware to self-install on a victim 's machine when activated ( described below ) .


Called “ DEFENSOR ID ” , the banking trojan was available on Google Play at the time of the analysis . At the end of August 2018 , the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components . Evidence suggest that the Lazarus Group uses compromised infrastructure as the public-facing touchpoint for the majority of their malware samples .


The app is fitted with standard information-stealing capabilities ; however , this banker is exceptionally insidious in that after installation it requires a single action from the victim – enable Android ’ s Accessibility Service – to fully unleash the app ’ s malicious functionality . As we explained in our most recent blogpost about Zebrocy , the configuration of the backdoor is stored in in the resource section and is split into four different hex-encoded , encrypted blobs . PapaAlfa is believed to be one of the proxy malware components that the Lazarus Group uses to hide the true command and control server for operations .


The DEFENSOR ID app made it onto the heavily guarded Google Play store thanks to its extreme stealth . The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability . Rather , PapaAlfa could be considered a smart proxy due in part to the fact that the Lazarus can easily switch the backend destination address and PROT without having to reestablish control over the infected machine hosting the PapaAlfa malware .


Its creators reduced the app ’ s malicious surface to the bare minimum by removing all potentially malicious functionalities but one : abusing Accessibility Service . It used GitHub and Slack as tools for communication between the malware and its controller . In terms of form factor , PapaAlfa comes in two flavors : service DLL and standalone executable .


Accessibility Service is long known to be the Achilles ’ heel of the Android operating system . On July 9 , we discovered a new version of SLUB delivered via another unique watering hole website . The IndiaBravo-PapaAlfa installer is responsible for installing the service DLL variant .


Security solutions can detect it in countless combinations with other suspicious permissions and functions , or malicious functionalities – but when faced with no additional functionality nor permission , all failed to trigger any alarm on DEFENSOR ID . This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April . While the tools profiled in this report are not inherently malicious , their capabilities are nonetheless integral to the Lazarus Group 's cyber operations , both espionage and destructive in nature , making them inherently dangerous to potential victims .


By “ all ” we mean all security mechanisms guarding the official Android app store ( including the detection engines of the members of the App Defense Alliance ) and all security vendors participating in the VirusTotal program ( see Figure 1 ) . Since we published out last report on SLUB , the backdoor has been updated and several improvements were implemented . These tools often lay the groundwork for further malicious activity , such as the targeting of antivirus capabilities and the disabling of firewalls , both of which are very fundamental defensive measures .


DEFENSOR ID was released on Feb 3 , 2020 and last updated to v1.4 on May 6 , 2020 . The SLUB malware was delivered through watering hole websites that were injected with exploits for CVE-2018-8174 or CVE-2019-0752 . Furthermore , like many other identified Lazarus Group families , these tools showcase the group 's creative solutions , such as the PapaAlfa , which makes it difficult to immediately identify potentially malicious activity on a compromised network .


The latest version is analyzed here ; we weren ’ t able to determine if the earlier versions were also malicious . During this attack , we found that the SLUB malware used two Slack teams sales-yww9809” and marketing-pwx7789 . The first class , colloquially known as " wipers " , are a class of malware has the primary intent of destroying data on a victim 's machine .


According to its profile at Google Play ( see Figure 2 ) the app reached a mere 10+ downloads . SWEED remains consistent across most of their campaigns in their use of spear-phishing emails with malicious attachments . DDoS malware floods a target 's network-connected service with an excessive number of request at once in order to overload the capacity of the server .


We reported it to Google on May 16 , 2020 and since May 19 , 2020 the app has no longer been available on Google Play . In April 2018 , SWEED began making use of a previously disclosed Office exploit . For example , DeltaAlfa specifies a DDoS bot family identified as Alfa .


The developer name used , GAS Brazil , suggests the criminals behind the app targeted Brazilian users . In May 2018 , campaigns being conducted by SWEED began leveraging another vulnerability in Microsoft Office: CVE-2017-11882 , a remote code execution bug in Microsoft Office that is commonly observed being leveraged in malicious documents used in commodity malware distribution . The naming scheme used by Novetta for the malware identified during Operation Blockbuster consists of at least two identifiers which each identifier coming from the International Civil Aviation Organization ( ICAO ) 's phonetic alphabet ,2 commonly referred to as the NATO phonetic alphabet .


Apart from including the country ’ s name , the app ’ s name is probably intended to imply a relationship with the antifraud solution named GAS Tecnologia . We found them targeting countries in the Middle East such as United Arab Emirates and Saudi Arabia , as well as other countries such as India , Japan , Argentina , the Philippines , and South Korea . Loaders are typically responsible for loading a DLL component into memory given that a DLL cannot operate in a standalone mode such as an executable .


That security software is commonly installed on computers in Brazil as several banks require it to log into their online banking . Similar to previous campaigns , the JAR was directly attached to emails and used file names such as Order_2018.jar . This report will explore the various installers , uninstallers and loaders Novetta has observed the Lazarus Group using .


However , there is also an English version of the DEFENSOR ID app ( see Figure 3 ) besides the Portuguese one , and that app has neither geographical nor language restrictions . Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework . This reverse engineering report looks at the RATs and staging malware found within the Lazarus Group 's collection .


Playing further off the suggested GAS Tecnologia link , the app promises better security for its users . TA505 is also using FlowerPippi (Backdoor.Win32.FLOWERPIPPI.A) , a new backdoor that we found them using in their campaigns against targets in Japan , India , and Argentina . Regardless of their sophistication or refinement , the malware families within the Lazarus Group 's India and Lima classes perform at a reasonable level for their designed purpose : the introduction and persistence of malware from the Lazarus Group on a victim 's infrastructure .


The description in Portuguese promises more protection for the user ’ s applications , including end-to-end encryption . TA505 targeted Middle Eastern countries in a June 11 campaign that delivered more than 90% of the total spam emails to the UAE , Saudi Arabia , and Morroco . While the capabilities for the installers , loaders , and uninstallers in this report are relatively straight forward and single-focused , analysis of these malware families provide further insight into the capabilities of the Lazarus Group .


Deceptively , the app was listed in the Education section . It fetches the same FlawedAmmyy downloader .msi file , then downloads the FlawedAmmyy payload . The Lazarus Group employs a variety of RATs that operate in both client mode and server mode .


Functionality After starting , DEFENSOR ID requests the following permissions : allow modify system settings permit drawing over other apps , and activate accessibility services . TA505 used Wizard (.wiz) files in this campaign , with FlawedAmmyy RAT as the final payload . The most common communication mode for a RAT is to act as a client to a remote server .


If an unsuspecting user grants these permissions ( see Figure 4 ) , the trojan can read any text displayed in any app the user may launch – and send it to the attackers . On June 14 , we saw TA505’s campaign still targeting UAE with similar tactics and techniques , but this time , some of the spam emails were delivered via the Amadey botnet . The Lazarus Group employs a variety of RATs and staging malware to conduct cyber operations , many of which contain significant code overlap that points to at least a shared development environment .


This means the attackers can steal the victim ’ s credentials for logging into apps , SMS and email messages , displayed cryptocurrency private keys , and even software-generated 2FA codes . It later delivered an information stealer named EmailStealer , ” which stolesimple mail transfer protocol (SMTP) credentials and email addresses in the victim’s machine . While some members within the Romeo and Sierra groups may not implement sound authentication strategies , shift their design focus in abrupt and unusual manners , and fail to understand the pitfalls of distributed command networks , on the whole the families within the Lazarus Group 's collection of RATs and staging malware perform their tasks with surprising effectiveness .


The fact the trojan can steal both the victim ’ s credentials and also can control their SMS messages and generated 2FA codes means DEFENSOR ID ’ s operators can bypass two-factor authentication . On June 18 , the majority of the campaign’s spam emails were sent with the subject , Your RAKBANK Tax Invoice / Tax Credit Note” or Confirmation . This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets Bitcoin users and global financial organizations .


This opens the door to , for example , fully controlling the victim ’ s bank account . This campaign used the abovementioned .html file , malicious Excel/Word document VBA macro , the FlawedAmmyy payload , and Amadey . This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets financial organizations .


To make sure the trojan survives a device restart , it abuses already activated accessibility services that will launch the trojan right after start . On June 24 , we found another campaign targeting Lebanon with the ServHelper malware . McAfee Advanced Threat Research analysts have discovered an aggressive Bitcoin-stealing phishing campaign by the international cybercrime group Lazarus that uses sophisticated malware with long-term impact .


Our analysis shows the DEFENSOR ID trojan can execute 17 commands received from the attacker-controlled server such as uninstalling an app , launching an app and then performing any click/tap action controlled remotely by the attacker ( see Figure 5 ) . On June 17 , we observed the campaign’s spam emails delivering malware-embedded Excel files directly as an attachment . McAfee Advanced Threat Research ( ATR ) analysts have discovered an aggressive Bitcoin-stealing phishing campaign by the international cybercrime group Lazarus that uses sophisticated malware with long-term impact .


In 2018 , we saw similar behavior , but all the click actions were hardcoded and suited only for the app of the attacker ’ s choice . On June 20 , we spotted the campaign’s spam emails delivering .doc and .xls files . Beginning in 2017 , the Lazarus group heavily targeted individuals with spear phishing emails impersonating job recruiters which contained malicious documents .


In this case , the attacker can get the list of all installed apps and then remotely launch the victim ’ s app of their choice to either steal credentials or perform malicious actions ( e.g . Nonetheless , these spam emails were not delivered to the UAE or Arabic-speaking users , but to banks in Asian countries such as India , Indonesia , and the Philippines . The use of decoy documents also reveals some of the potential targets of the Lazarus group 's malicious activity , specifically the use spear phishing attacks observed targeting South Korean government and aerospace organizations .


send funds via a wire transfer ) . After our analysis , we found that Proofpoint reported this malware as AndroMut as well . The campaign lasted from April to October and used job descriptions relevant to target organizations , in both English and Korean language .


We believe that this is the reason the DEFENSOR ID trojan requests the user to allow “ Modify system settings ” . In the campaign that targeted Japan , Philippines , and Argentina on June 20 , we found what seems to be a new , undisclosed malware , which we named Gelup . The Lazarus Group 's objective was to gain access to the target 's environment and obtain key military program insight or steal money .


Subsequently , the malware will change the screen off time-out to 10 minutes . Another new malware we found that TA505 is using in their campaigns last June 20 against targets in Japan , the Philippines , and Argentina is FlowerPippi . In this latest discovery by McAfee , despite a short pause in similar operations , the Lazarus group targets financial organizations .


This means that , unless victims lock their devices via the hardware button , the timer provides plenty of time for the malware to remotely perform malicious , in-app operations . The malicious email contains a highly suspicious sample which triggered the ZLAB team to investigate its capabilities and its possible attribution , discovering a potential expansion of the TA505 operation . This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans .


If the device gets locked , the malware can ’ t unlock it . The attack , as stated by CyberInt , leveraged a command and control server located in Germany related to the TA505 actor: a very active group involved in cyber-criminal operation all around the world , threatening a wide range of high profile companies , active since 2014 . This Malware Analysis Report ( MAR ) is the result of analytic efforts between the Department of Homeland Security ( DHS ) and the Federal Bureau of Investigation ( FBI ) .


Malware data leak When we analyzed the sample , we realized that the malware operators left the remote database with some of the victims ’ data freely accessible , without any authentication . The comparison of the infection chains reveals in both cases TA505 used a couple of SFX stages to deploy the RMS” software: a legitimate remote administration tool produced by the Russian company TektonIT . When victims open malicious documents attached to the emails , the malware scans for Bitcoin activity and then establishes an implant for long-term data-gathering .


The database contained the last activity performed on around 60 compromised devices . The TA505 group is one of the most active threat groups operating since 2014 , it has traditionally targeted Banking and Retail industries , as we recently documented during the analysis of the Stealthy Email Stealer” part of their arsenal . According to trusted third-party reporting , HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace , telecommunications , and finance industries .


We found no other information stolen from the victims to be accessible . Also , some code pieces are directly re-used in the analyzed campaigns , such as the i.cmd and exit.exe files , and , at the same time , some new components have been introduced , for instance the rtegre.exe” and the veter1605_MAPS_10cr0.exe file . The malware is a fully functional RAT with multiple commands that the actors can issue from a command and control ( C2 ) server to a victim 's system via dual proxies .


Thanks to this data leak , we were able to confirm that the malware really worked as designed : the attacker had access to the victims ’ entered credentials , displayed or written emails and messages , etc . In 2018 , Kaspersky Labs published a report that analyzed a Turla PowerShell loader that was based on the open-source project Posh-SecMod . FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware or as a file downloaded unknowingly by users when visiting sites compromised by HIDDEN COBRA actors .


Once we reached the non-secured database , we were able to directly observe the app ’ s malicious behavior . Turla is believed to have been operating since at least 2008 , when it successfully breached the US military . HIDDEN COBRA actors use an external tool or dropper to install the FALLCHILL malware to establish persistence .


To illustrate the level of threat the DEFENSOR ID app posed , we performed three tests . This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products . HIDDEN COBRA actors install the FALLCHILL malware to establish persistence .


First , we launched a banking app and entered the credentials there . However , it is likely the same scripts are used more globally against many traditional Turla targets in Western Europe and the Middle East . Working with U.S. government partners , DHS and FBI identified Internet Protocol ( IP ) addresses and other indicators of compromise ( IOCs ) associated with a remote administration tool ( RAT ) used by the North Korean government—commonly known as FALLCHILL .


The credentials were immediately available in the leaky database – see Figure 6 . In some samples deployed since March 2019 , Turla developers modified their PowerShell scripts in order to bypass the Antimalware Scan Interface (AMSI) . This alert 's IOC files provide HIDDEN COBRA indicators related to FALLCHILL .


Figure 6 . Based on our research , SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans . McAfee Advanced Threat Research analysts have uncovered a global data reconnaissance campaign assaulting a wide number of industries including critical infrastructure , entertainment , finance , health care , and telecommunications .


The banking app test : the credentials as entered ( left ) and as available in the database ( right ) Second , we wrote a test message in an email client . It is interesting to note that Turla operators used the free email provider GMX again , as in the Outlook Backdoor and in LightNeuron . Because of this , additional HIDDEN COBRA malware may be present on systems compromised with FALLCHILL .


We saw the message uploaded to the attackers ’ server within a second – see Figure 7 . This new research confirms our forecast and shows that the Turla group does not hesitate to use open-source pen-testing frameworks to conduct intrusion . This campaign , dubbed Operation GhostSecret , leverages multiple implants , tools , and malware variants associated with the state-sponsored cyber group HIDDEN COBRA .


Figure 7 . Neptun is installed on Microsoft Exchange servers and is designed to passively listen for commands from the attackers . From March 18 to 26 we observed the malware operating in multiple LOCs of the world .


The email message test : the message as written ( left ) and as available in the database ( right ) Third , we documented the trojan retrieving the Google Authenticator 2FA code . One attack during this campaign involved the use of infrastructure belonging to another espionage group known as Crambus aka OilRig , APT34 . Furthermore , the Advanced Threat Research team has discovered Proxysvc , which appears to be an undocumented implant .


Figure 8 . Waterbug has been using Meterpreter since at least early 2018 and , in this campaign , used a modified version of Meterpreter , which was encoded and given a .wav extension in order to disguise its true purpose . Our investigation into this campaign reveals that the actor used multiple malware implants , including an unknown implant with capabilities similar to Bankshot .


The software generated 2FA code as it appeared on the device ’ s display ( left ) and as available in the database ( right ) Along with the malicious DEFENSOR ID app , another malicious app named Defensor Digital was discovered . In all likelihood , Waterbug’s use of Crambus infrastructure appears to have been a hostile takeover . The attackers behind Operation GhostSecret used a similar infrastructure to earlier threats , including SSL certificates used by FakeTLS in implants found in the Destover backdoor variant known as Escad , which was used in the Sony Pictures attack .


Both apps shared the same C & C server , but we couldn ’ t investigate the latter as it had already been removed from the Google Play store . One of the most interesting things to occur during one of Waterbug’s recent campaigns was that during an attack against one target in the Middle East , Waterbug appeared to hijack infrastructure from the Crambus espionage group and used it to deliver malware on to the victim’s network . Based on our analysis of public and private information from submissions , along with product telemetry , it appears Proxysvc was used alongside the 2017 Destover variant and has operated undetected since mid-2017 .


Indicators of Compromise ( IoCs ) Package Name Hash ESET detection name com.secure.protect.world F17AEBC741957AA21CFE7C7D7BAEC0900E863F61 Android/Spy.BanBra.A com.brazil.android.free EA069A5C96DC1DB0715923EB68192FD325F3D3CE Android/Spy.BanBra.A MITRE ATT & CK techniques Tactic ID Name Description Initial Access T1475 Deliver Malicious App These three recent Waterbug campaigns have seen the group compromise governments and international organizations across the globe in addition to targets in the IT and education sectors . This new variant resembles parts of the Destover malware , which was used in the 2014 Sony Pictures attack .


via Authorized App Store Impersonates security app on Google Play . Curiously though , Waterbug also compromised other computers on the victim’s network using its own infrastructure . The Lazarus used a similar infrastructure to earlier threats , including the Destover backdoor variant known as Escad .


T1444 Masquerade as Legitimate Application Impersonates legitimate GAS Tecnologia application . Symantec believes that the variant of Mimikatz used in this attack is unique to Waterbug . The McAfee Advanced Threat Research team discovered a previously unknown data-gathering implant that surfaced in mid-February 2018 .


Discovery T1418 Application Discovery Sends list of installed apps on device . Aside from the attack involving Crambus infrastructure , this sample of Mimikatz has only been seen used in one other attack , against an education target in the UK in 2017 . The Advanced Threat Research team uncovered activity related to this campaign in March 2018 , when the actors targeted Turkish banks .


Impact T1516 Input Injection Can enter text and perform clicks on behalf of user . The first observed evidence of Waterbug activity came on January 11 , 2018 , when a Waterbug-linked tool (a task scheduler named msfgi.exe) was dropped on to a computer on the victim’s network . KONNI : A Malware Under The Radar For Years .


Collection T1417 Input Capture Records user input data . In the case of the attack against the Middle Eastern target , Crambus was the first group to compromise the victim’s network , with the earliest evidence of activity dating to November 2017 . Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years .


Command and Control T1437 Standard Application Layer Protocol Uses Firebase Cloud Messaging for C & C . Waterbug’s intrusions on the victim’s network continued for much of 2018 . During this time it has managed to avoid scrutiny by the security community .


Riltok mobile Trojan : A banker with global reach 25 JUN 2019 Riltok is one of numerous families of mobile banking Trojans with standard ( for such malware ) functions and distribution methods . Symantec did not observe the initial access point and the close timeframe between Waterbug observed activity on the victim’s network and its observed use of Crambus infrastructure suggests that Waterbug may have used the Crambus infrastructure as an initial access point . The current version of the malware allows the operator to steal files , keystrokes , perform screenshots , and execute arbitrary code on the infected host .


Originally intended to target the Russian audience , the banker was later adapted , with minimal modifications , for the European “ market. ” The bulk of its victims ( more than 90 % ) reside in Russia , with France in second place ( 4 % ) . It also reconfigures the Microsoft Sysinternals registry to prevent pop-ups when running the PsExec tool . Talos has named this malware KONNI .


Third place is shared by Italy , Ukraine , and the United Kingdom . Waterbug also used an older version of PowerShell , likely to avoid logging . Throughout the multiple campaigns observed over the last 3 years , the actor has used an email attachment as the initial infection vector .


We first detected members of this family back in March 2018 . In one of these campaigns , Waterbug used a USB stealer that scans removable storage devices to identify and collect files of interest . They then use additional social engineering to prompt the target to open a .scr file , display a decoy document to the users , and finally execute the malware on the victim's machine .


Like many other bankers , they were disguised as apps for popular free ad services in Russia . The malware then uses WebDAV to upload the RAR archive to a Box account . The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost .


The malware was distributed from infected devices via SMS in the form “ % USERNAME % , I ’ ll buy under a secure transaction . The DeepSight Managed Adversary and Threat Intelligence (MATI) team co-authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug (aka Turla) cyber espionage group , and methods of detecting and thwarting activities of this adversary . The malware has evolved over time .


youlabuy [ . The DeepSight MATI team authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug (aka Turla) cyber espionage group , and methods of detecting and thwarting activities of this adversary . In this article , we will analyse this evolution: at the beginning the malware was only an information stealer without remote administration , it moved from a single file malware to a dual file malware (an executable and a dynamic library ) , the malware has supported more and more features over the time , the decoy documents have become more and more advanced .


] ru/7 * * * * * 3 ” or “ % USERNAME % , accept 25,000 on Youla youla-protect [ . While reviewing a 2015 report⁵ of a Winnti intrusion at a Vietnamese gaming company , we identified a small cluster of Winnti⁶ samples designed specifically for Linux⁷ . The different versions contain copy/pasted code from previous versions .


] ru/4 * * * * * 7 ” , containing a link to download the Trojan . Following these reports , Chronicle researchers doubled down on efforts to try to unravel the various campaigns where Winnti was leveraged . Moreover the new version searches for files generated by previous versions .


Other samples were also noticed , posing as a client of a ticket-finding service or as an app store for Android . Distinct changes to Azazel by the Winnti developers include the addition of a function named ‘Decrypt2’ , which is used to decode an embedded configuration similar to the core implant . This evolution is illustrated across 4 campaigns : one in 2014 , one in 2016 and finally two in 2017 .


It was late 2018 when Riltok climbed onto the international stage . Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits . The decoy document of the 2 last campaigns suggests that the targets are public organisations .


The cybercriminals behind it kept the same masking and distribution methods , using names and icons imitating those of popular free ad services . We will see more from Zebrocy into 2019 on government and military related organizations . Both documents contained email addresses , phone numbers and contacts of members of official organizations such as United Nations , UNICEF , and Embassies linked to North Korea .


In November 2018 , a version of the Trojan for the English market appeared in the shape of Gumtree.apk . The PowerShell script will look at the architecture of the system to check which malicious DLL files should be downloaded . In this campaign , the dropper filename was beauty.scr .


The SMS message with a link to a banker looked as follows : “ % USERNAME % , i send you prepayment gumtree [ . In the same year , Silence conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans . Based on the compilation date of the two binaries , this campaign took place in September 2014 .


] cc/3 * * * * * 1 ” . The FBI issued a rare bulletin admitting that a group named APT6 hacked into US government computer systems as far back as 2011 and for years stole sensitive data . Once executed , two files were dropped on the targeted system : a decoy document (a picture) and a fake svchost.exe binary .


Italian ( Subito.apk ) and French ( Leboncoin.apk ) versions appeared shortly afterwards in January 2019 . FireEye iSIGHT Intelligence believes that APT37 is aligned with the activity publicly reported as Scarcruft and Group123 . Both files were stored in "C:\Windows" .


The messages looked as follows : “ % USERNAME % , ti ho inviato il soldi sul subito subito-a [ . Trend Micro attributes this activity to MuddyWater , an Iran-nexus actor that has been active since at least May 2017 . The fake svchost binary is the KONNI malware .


] pw/6 * * * * * 5 ” ( It . FireEye assess that the actors employing this latest Flash zero-day are a suspected North Korean group we track as TEMP.Reaper . The first task of the malware is to generate an ID to identify the infected system .


) “ % USERNAME % , ti ho inviato il pagamento subitop [ . FireEye has observed other suspected North Korean threat groups such as TEMP.Hermit employ wiper malware in disruptive attacks . This ID is generated based on the installation date of the system .


] pw/4 * * * * * 7 ” ( It . On Nov14 , 2017 , FireEye observed APT34 using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East . The second task of malware is to ping the CC and get orders .


) “ % USERNAME % , je vous ai envoyé un prepaiement m-leboncoin [ . Kaspersky reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 . The malware includes 2 domains: phpschboy.prohosts.org , jams481.site.bz .


] top/7 * * * * * 3 ” ( Fr . APT33 is the only group that Kaspersky has observed use the DROPSHOT dropper . The developer used the Microsoft Winsocks API to handle the network connection .


) “ % USERNAME % , j ’ ai fait l ’ avance ( suivi d ’ un lien ) : leboncoin-le [ . The cyber espionage group APT32 heavily obfuscates their backdoors and scripts , and Mandiant consultants observed APT32 implement additional command argument obfuscation in April 2017 . Surprisingly , this isn't the easiest or the most efficient technical choice for HTTP connection .


] com/8 * * * * * 9 ” ( Fr . In all Mandiant investigations to date where the CARBANAK backdoor has been discovered , the activity has been attributed to the FIN7 threat group . The malware samples we analysed connected to only one URI: <c2-domain>/login.php .


) Let ’ s take a more detailed look at how this banking Trojan works . Kaspersky released a similar report about the same group under the name Carbanak in February 2015 . This version of KONNI is not designed to execute code on the infected system .


Infection The user receives an SMS with a malicious link pointing to a fake website simulating a popular free ad service . FireEye assesses that APT32 leverages a unique suite of fully-featured malware . The purpose is to be executed only once and steal data on the infected system , here are the main features : Keyloggers , Clipboard stealer , Firefox profiles and cookies stealer , Chrome profiles and cookies stealer , Opera profiles and cookies stealer .


There , they are prompted to download a new version of the mobile app , under which guise the Trojan is hidden . FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam’s manufacturing , consumer products , and hospitality sectors . The name of the .scr file was directly linked to tension between North Korea and USA in March 2016 more information .


To be installed , it needs the victim to allow installation of apps from unknown sources in the device settings . The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on these backdoor families based on Mandiant investigations of APT32 intrusions . Based on the compilation dates of the binaries , the campaign took place in the same period .


During installation , Riltok asks the user for permission to use special features in AccessibilityService by displaying a fake warning : If the user ignores or declines the request , the window keeps opening ad infinitum . FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests . An interesting fact : the dropped library was compiled in 2014 and appears in our telemetry in August 2015 .


After obtaining the desired rights , the Trojan sets itself as the default SMS app ( by independently clicking Yes in AccessibilityService ) , before vanishing from the device screen . In May and June 2017 , FireEye has associated this campaign with APT19 , a group that we assess is composed of freelancers , with some degree of sponsorship by the Chinese government . Indicating that this library was probably used in another campaign .


After enabling AccessibilityService , the malware sets itself as the default SMS app Now installed and having obtained the necessary permissions from the user , Riltok contacts its C & C server . APT10 is a Chinese cyber espionage group that FireEye has tracked since 2009 . The .scr file contains 2 Office documents .


In later versions , when it starts , the Trojan additionally opens a phishing site in the browser that simulates a free ad service so as to dupe the user into entering their login credentials and bank card details . In addition to the spear phishes , FireEye ISIGHT Intelligence has observed APT10 accessing victims through global service providers . The first document was in English and a second in Russian .


The entered data is forwarded to the cybercriminals . FireEye’s visibility into the operations of APT28 – a group we believe the Russian government sponsors – has given us insight into some of the government’s targets , as well as its objectives and the activities designed to further them . In the sample only the English version can be displayed to the user (that is hardcoded in the sample) .


Phishing page from the French version of the Trojan Communication with C & C Riltok actively communicates with its C & C server . FireEye has tracked and profiled APT28 group through multiple investigations , endpoint and network detections , and continuous monitoring . The Russian document is not used by the sample , we assume that the author of the malware forgot to remove the resource containing the Russia decoy document .


First off , it registers the infected device in the administrative panel by sending a GET request to the relative address gate.php ( in later versions gating.php ) with the ID ( device identifier generated by the setPsuedoID function in a pseudo-random way based on the device IMEI ) and screen ( shows if the device is active , possible values are “ on ” , “ off ” , “ none ” ) parameters . In April 2015 , FireEye uncovered the malicious efforts of APT30 , a suspected China-based threat group . The malware author changed the malware architecture , this version is divided in two binaries: conhote.dll , winnit.exe .


Then , using POST requests to the relative address report.php , it sends data about the device ( IMEI , phone number , country , mobile operator , phone model , availability of root rights , OS version ) , list of contacts , list of installed apps , incoming SMS , and other information . FireEye iSIGHT Intelligence has been tracking a pair of cybercriminals that we refer to as the Vendetta Brothers . Another difference is the directory where the files are dropped , it's no longer C:\Windows but rather the local setting of the current user (%USERPROFILE%\Local Settings\winnit\winnit.exe) .


From the server , the Trojan receives commands ( for example , to send SMS ) and changes in the configuration . Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack . Thanks to this modification , the malware can be executed with a non-administrator account .


Trojan anatomy The family was named Riltok after the librealtalk-jni.so library contained in the APK file of the Trojan . McAfee concludes that some groups—and especially the Poetry Group —have shifted tactics to use Citadel in ways other than what it was originally intended for . The .dll file is executed by the .exe file .


The library includes such operations as : Get address of cybercriminal C & C server Get configuration file with web injects from C & C , as well as default list of injects Scan for app package names that generated AccessibilityEvent events in the list of known banking/antivirus/other popular apps Set malware as default SMS app Get address of the phishing page that opens when the app runs , and others getStartWebUrl function – get address of phishing page The configuration file contains a list of injects for mobile banking apps – links to phishing pages matching the mobile McAfee Advanced Threat research determines with confidence that Lazarus is the threat group behind this attack for the following reasons:Contacts an IP address / domain that was used to host a malicious document from a Lazarus previous campaign in 2017 . In this version , a shortcut is created in order to launch winnit.exe in the following path %USERPROFILE%\Start Menu\Programs\Startup\Anti virus service.lnk .


banking app used by the user . In November 2017 , Talos observed the Group123 , which included a new version of ROKRAT being used in the latest wave of attacks . As you can see the attacker has went to great lengths to disguise his service as a legitimate Antivirus Service by using the name 'Anti virus service.lnk' .


In most so-called Western versions of the Trojan , the package names in the default configuration file are erased . In addition to TALOS investigation on KONNI , on July 18 2017 , BitDefender released a whitepaper on DarkHotel . This is of course simple but often it can be enough for a user to miss something malicious by name .


Sample configuration file of the Trojan Through AccessibilityService , the malware monitors AccessibilityEvent events . According to security 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor . As in the previous version , the ID of the infected system is generated with exactly the same method .


Depending on which app ( package name ) generated the event , Riltok can : Open a fake Google Play screen requesting bank card details Open a fake screen or phishing page in a browser ( inject ) mimicking the screen of the relevant mobile banking app and requesting user/bank card details Minimize the app ( for example , antivirus applications or device security settings ) Additionally , the Trojan can hide notifications from certain banking apps . ESET has also reported PowerShell scripts being used by Turla to provide direct , in-memory loading and execution of malware . The C2 is different and the analysed version this time only contains a single domain: dowhelsitjs.netau.net .


List of package names of apps on events from which the Trojan opens a fake Google Play window ( for the Russian version of the Trojan ) Example of Trojan screen overlapping other apps When bank card details are entered in the fake window , Riltok performs basic validation checks : card validity period , number checksum , CVC length , whether the number is in the denylist sewn into the Trojan code : Examples of phishing pages imitating mobile banks At the time of writing , the functionality of most of the Western versions of Riltok Additionally Kaspersky identified a new backdoor that we attribute with medium confidence to Turla . In this version , the developer used a different API , the Wininet API which make more sense for Web requests .


was somewhat pared down compared to the Russian one . Researchers at Symantec suspect that Turla used the hijacked network to attack a Middle Eastern government . Moreover the C2 infrastructure evolved too , more .php files are available through the web hosting: <c2-domain>/login.php <c2-domain>/upload.php <c2-domain>/download.php .


For example , the default configuration file with injects is non-operational , and the malware contains no fake built-in windows requesting bank card details . Symantec researchers have uncovered evidence that the Waterbug APT group has conducted a hostile takeover of an attack platform . This version includes the stealer features mentioned in the previous version and additionally Remote Administration Tool features such as file uploading/download and arbitrary command execution .


Conclusion Threats are better prevented than cured , so do not follow suspicious links in SMS , and be sure to install apps only from official sources and check what permissions you are granting during installation . Researchers at the Microstep Intelligence Bureau have published a report on targeted attacks on the Ukrainian government that they attribute to the Gamaredon threat actor . The library is only used to perform keylogging and clipboard stealing .


As Riltok shows , cybercriminals can apply the same methods of infection to victims in different countries with more or less the same success . Kaspersky found an active campaign by a Chinese APT group we call SixLittleMonkeys that uses a new version of the Microcin Trojan and a RAT that we call HawkEye as a last stager . Indeed , the malware author moved this part of the code from the core of the malware to a library .


Kaspersky products detect the above-described threat with the verdict Trojan-Banker.AndroidOS.Riltok . Trend Micro has previously reported the use of this malware in targeted attacks by the BlackTech group , primarily focused on cyber-espionage in Asia . An interesting element is that the malware looks for filenames created with the previous version of KONNI .


IoCs C & C 100.51.100.00 108.62.118.131 172.81.134.165 172.86.120.207 185.212.128.152 185.212.128.192 185.61.000.108 185.61.138.108 185.61.138.37 188.209.52.101 5.206.225.57 alr992.date avito-app.pw backfround2.pw background1.xyz blacksolider93.com blass9g087.com brekelter2.com broplar3hf.xyz buy-youla.ru LuckyMouse activity detected by Palo Alto involved the attackers installing web shells on SharePoint servers to compromise government organizations in the Middle East . This implies that the malware targeted the same people as the previous version and they are designed to work together .


cd78cg210xy0.com copsoiteess.com farmatefc93.org firstclinsop.com holebrhuhh3.com holebrhuhh45.com karambga3j.net le22999a.pw leboncoin-bk.top leboncoin-buy.pw leboncoin-cz.info leboncoin-f.pw leboncoin-jp.info leboncoin-kp.top leboncoin-ny.info leboncoin-ql.top leboncoin-tr.info Talos published its analysis of the BlackWater campaign , related to MuddyWater group . The malware internally uses the following files : solhelp.ocx sultry.ocx helpsol.ocx psltre.ocx screentmp.tmp (log file of the keylogger) spadmgr.ocx apsmgrd.ocx wpg.db .


myyoula.ru sell-avito.ru sell-youla.ru sentel8ju67.com subito-li.pw subitop.pw web-gumtree.com whitehousejosh.com whitekalgoy3.com youlaprotect.ru Examples of malware 0497b6000a7a23e9e9b97472bc2d3799caf49cbbea1627ad4d87ae6e0b7e2a98 417fc112cd0610cc8c402742b0baab0a086b5c4164230009e11d34fdeee7d3fa Trend Micro also reported MuddyWater’s use of a new multi-stage PowerShell-based backdoor called POWERSTATS v3 . In this campaign , the malware author uses the following name: Pyongyang Directory Group email April 2017 RC_Office_Coordination_Associate.scr. The decoy document shown after infection is an Office document containing email addresses , phone numbers and contacts of members of official organizations such as the United Nations , UNICEF , Embassies linked to North Korea .


54594edbe9055517da2836199600f682dee07e6b405c6fe4b476627e8d184bfe 6e995d68c724f121d43ec2ff59bc4e536192360afa3beaec5646f01094f0b745 bbc268ca63eeb27e424fec1b3976bab550da304de18e29faff94d9057b1fa25a dc3dd9d75120934333496d0a4100252b419ee8fcdab5d74cf343bcb0306c9811 Regarding other groups , Kaspersky discovered new activity related to ZooPark , a cyber-espionage threat actor that has focused mainly on stealing data from Android devices . The .scr files drops two files: an executable and a library .


e3f77ff093f322e139940b33994c5a57ae010b66668668dc4945142a81bcc049 ebd0a8043434edac261cb25b94f417188a5c0d62b5dd4033f156b890d150a4c5 f51a27163cb0ddd08caa29d865b9f238848118ba2589626af711330481b352df Tracking down the developer of Android adware affecting Recorded Future published an analysis of the infrastructure built by APT33 (aka Elfin) to target Saudi organizations . As in the previous version , the persistence is achieved by a Windows shortcut (in this case adobe distillist.lnk ) .


millions of users 24 Oct 2019 - 11:30AM We detected a large adware campaign running for about a year , with the involved apps installed eight million times from Google Play alone . Early in Q2 , Kaspersky identified an interesting Lazarus attack targeting a mobile gaming company in South Korea that we believe was aimed at stealing application source code . Contrary to the previous version , the developers moved the core of malware to the library .


We identified 42 apps on Google Play as belonging to the campaign , which had been running since July 2018 . In a recent campaign , Kaspersky observed ScarCruft using a multi-stage binary to infect several victims and ultimately install a final payload known as ROKRAT – a cloud service-based backdoor . The executable performs the following tasks: If the system is a 64-bit version of Windows , it downloads and executes a specific 64-bit version of the malware thanks to a powershell script .


Of those , 21 were still available at the time of discovery . ESET recently analyzed a new Mac OS sample from the OceanLotus group that had been uploaded to VirusTotal . Loading the dropped library .


We reported the apps to the Google security team and they were swiftly removed . The threat actor behind the campaign , which Kaspersky believes to be the PLATINUM APT group , uses an elaborate , previously unseen , steganographic technique to conceal communication . The library contains the same features as the previous version as well as new ones .


However , the apps are still available in third-party app stores . FireEye defined APT40 as the Chinese state-sponsored threat actor previously reported as TEMP.Periscope , Leviathan and TEMP.Jumper . This version of KONNI is the most advanced with better coding .


ESET detects this adware , collectively , as Android/AdDisplay.Ashas . In January , Kaspersky identified new activity by the Transparent Tribe APT group aka PROJECTM and MYTHIC LEOPARD , a threat actor with interests aligned with Pakistan that has shown a persistent focus on Indian military targets . The malware configuration contains one Command and Control: pactchfilepacks.net23.net .


Figure 1 . OceanLotus was another actor active during this period , using a new downloader called KerrDown , as reported by Palo Alto . A new URI is available: <c2-domain>/uploadtm.php .


Apps of the Android/AdDisplay.Ashas family reported to Google by ESET Figure 2 . ESET recently uncovered a new addition to OceanLotus’s toolset targeting Mac OS . This URI is used with a new feature implemented in this version: the malware is able to perform screenshot (thanks to the GDI API) and uploads it thank to this URL .


The most popular member of the Android/AdDisplay.Ashas family on Google Play was “ Video downloader master ” with over five million downloads Ashas functionality All the apps provide the functionality they promise , besides working as adware . In mid-2018 , Kaspersky's report on Operation AppleJeus” highlighted the focus of the Lazarus threat actor on cryptocurrency exchanges . The malware checks if a file used on a previous version of KONNI is available on the system .


The adware functionality is the same in all the apps we analyzed . Kaspersky also observed some activity from Gaza Team and MuddyWater . Here is the complete list of files internally used by the RAT: error.tmp (the log file of the keylogger) tedsul.ocx helpsol.ocx trepsl.ocx psltred.ocx solhelp.ocx sulted.ocx .


[ Note : The analysis of the functionality below describes a single app , but applies to all apps of the Android/AdDisplay.Ashas family . Kaspersky wrote about LuckyMouse targeting national data centers in June . The handling of instructions has improved too .


] Once launched , the app starts to communicate with its C & C server ( whose IP address is base64-encoded in the app ) . Kaspersky also discovered that LuckyMouse unleashed a new wave of activity targeting Asian governmental organizations just around the time they had gathered for a summit in China . Here are the 7 actions that the infected machine can be instructed to perform: Delete a specific file .


It sends “ home ” key data about the affected device : device type , OS version , language , number of installed apps , free storage space , battery status , whether the device is rooted and Developer mode enabled , and whether Facebook and FB Messenger are installed . Kaspersky have observed similar activity in the past from groups such as Oilrig and Stonedrill , which leads us to believe the new attacks could be connected , though for now that connection is only assessed as low confidence . Upload a specific file based on a filename .


Figure 3 . In August 2019 , FireEye released the Double Dragon” report on our newest graduated threat group , APT41 . Upload a specific file based on the full path name .


Sending information about the affected device The app receives configuration data from the C & C server , needed for displaying ads , and for stealth and resilience . Today , FireEye Intelligence is releasing a comprehensive report detailing APT41 , a prolific Chinese cyber threat group that carries out state-sponsored espionage activity in parallel with financially motivated operations . Create a screenshot and uploads it on the C2 .


Figure 4 . Group-IB experts continuously monitor the Silence’ activities . Get system information .


Configuration file received from the C & C server As for stealth and resilience , the attacker uses a number of tricks . Group-IB has uncovered a hacker group , MoneyTaker , attacking banks in the USA and Russia . Download a file from the Internet .


First , the malicious app tries to determine whether it is being tested by the Google Play security mechanism . Group-IB reveals the unknown details of attacks from one of the most notorious APT groups , Lazarus . Execute a command .


For this purpose , the app receives from the C & C server the isGoogleIp flag , which indicates whether the IP address of the affected device falls within the range of known IP addresses for Google servers . Finally , Kaspersky produced a summary report on Sofacy’s summertime activity . When the attacker wants to gather information on the infected system (action 5) , it retrieves the following information: Hostname IP address Computer name Username name Connected drive OS version Architecture Start menu programs Installed software .


If the server returns this flag as positive , the app will not trigger the adware payload . Kaspersky were also able to produce two reports on Korean speaking actors , specifically involving Scarcruft and Bluenoroff . The last identified campaign where KONNI was used was named Inter Agency List and Phonebook - April 2017 RC_Office_Coordination_Associate.scr .


Second , the app can set a custom delay between displaying ads . Analysis of the payload allowed us to confidently link this attack to an actor Kaspersky track as BlackOasis . This file drops exactly the same files than the previous campaign but the decoy document is different .


The samples we have seen had their configuration set to delay displaying the first ad by 24 minutes after the device unlocks . Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day . This document contains the name , phone number and email address of members of agencies , embassies and organizations linked to North Korea .


This delay means that a typical testing procedure , which takes less than 10 minutes , will not detect any unwanted behavior . It contains a Word document in plaintext ( written to Bienvenue_a_Sahaja_Yoga_Toulouse.doc ) , along with an executable ( Update.exe ) and DLL ( McUpdate.dll ) . The analysis shows us the evolution of KONNI over the last 3 years .


Also , the longer the delay , the lower the risk of the user associating the unwanted ads with a particular app . We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages . The last campaign was started a few days ago and is still active .


Third , based on the server response , the app can also hide its icon and create a shortcut instead . Additionally , these decoy documents are hosted on legitimate websites including a government website belonging to the Cambodia Government and in at least once case , Facebook . The infrastructure remains up and running at the time of this post .


If a typical user tries to get rid of the malicious app , chances are that only the shortcut ends up getting removed . However , the unique malware variant , BlackEnergy 3 , reemerged in Ukraine early in 2015 , where we had first found Sandworm Team . The RAT has remained under the Radar for multiple years .


The app then continues to run in the background without the user ’ s knowledge . The initial indicator of the attack was a malicious web shell that was detected on an IIS server , coming out of the w3wp.exe process . An explanation could be the fact that the campaign was very limited nature , which does not arouse suspicion .


This stealth technique has been gaining popularity among adware-related threats distributed via Google Play . We have previously detected groups we suspect are affiliated with the North Korean government compromising electric utilities in South Korea , but these compromises did not lead to a disruption of the power supply . This investigation shows that the author has evolved technically (by implementing new features) and in the quality of the decoy documents .


Figure 5 . Instead , sensitive KHNP documents were leaked by the actors as part of an effort to exaggerate the access they had and embarrass the South Korean Government , a technique we assess North Korea would turn to again in order to instill fear and/or meet domestic propaganda aims . The campaign of April 2017 used pertinent documents containing potentially sensitive data .


Time delay to postpone displaying ads implemented by the adware Once the malicious app receives its configuration data , the affected device is ready to display ads as per the attacker ’ s choice ; each ad is displayed as a full screen activity . North Korea linked hackers are among the most prolific nation-state threats , targeting not only the U.S. and South Korea but the global financial system and nations worldwide . Moreover the metadata of the Office document contains the names of people who seems to work for a public organization .


If the user wants to check which app is responsible for the ad being displayed , by hitting the “ Recent apps ” button , another trick is used : the app displays a Facebook or Google icon , as seen in Figure 6 . The malware may inject itself into browser processes and explorer.exe . We don't know if the document is a legitimate compromised document or a fake that the attacker has created in an effort to be credible .


The adware mimics these two apps to look legitimate and avoid suspicion – and thus stay on the affected device for as long as possible . In the last few weeks , FormBook was seen downloading other malware families such as NanoCore . Clearly the author has a real interest in North Korea , with 3 of the 4 campaigns are linked to North Korea .


Figure 6 . The vulnerability is bypassing most mitigations; however , as noted above , FireEye email and network products detect the malicious documents . Additional ways our customers can detect and block this threat are listed below .


The adware activity impersonates Facebook ( left ) . Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download . Advanced Malware Protection ( AMP ) is ideally suited to prevent the execution of the malware used by these threat actors .


If the user long-presses the icon , the name of the app responsible for the activity is revealed ( right ) . In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 . CWS or WSA web scanning prevents access to malicious websites and detects malware used in these attacks .


Finally , the Ashas adware family has its code hidden under the com.google.xxx package name . In their current campaign , APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros . Email Security can block malicious emails sent by threat actors as part of their campaign .


This trick – posing as a part of a legitimate Google service – may help avoid scrutiny . APT32 actors continue to deliver the malicious attachments via spear-phishing emails . The Network Security protection of IPS and NGFW have up-to-date signatures to detect malicious network activity by threat actors .


Some detection mechanisms and sandboxes may whitelist such package names , in an effort to prevent wasting resources . APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel files to deliver their initial exploits . AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products .


Figure 7 . Most of these data-stealing capabilities were present in the oldest variants of CARBANAK that we have seen and some were added over time . Umbrella , our secure internet gateway (SIG) , blocks users from connecting to malicious domains , IPs , and URLs , whether users are on or off the corporate network .


Malicious code hidden in a package named “ com.google ” Hunting down the developer Using open-source information , we tracked down the developer of the adware , who we also identified as the campaign ’ s operator and owner of the C & C server . February saw three particularly interesting publications on the topic of macOS malware: a Trojan Cocoa application that sends system information including keychain data back to the attacker , a macOS version of APT28’s Xagent malware , and a new Trojan ransomware . SHA256 : 413772d81e4532fec5119e9dce5e2bf90b7538be33066cf9a6ff796254a5225f .


In the following paragraphs , we outline our efforts to discover other applications from the same developer and protect our users from it . As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware . Filename: beauty.scr .


First , based on information that is associated with the registered C & C domain , we identified the name of the registrant , along with further data like country and email address , as seen in Figure 8 . The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . SHA256 : eb90e40fc4d91dec68e8509056c52e9c8ed4e392c4ac979518f8d87c31e2b435 .


Figure 8 . This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . Filename: C:\Windows\beauty.jpg .


Information about the C & C domain used by the Ashas adware Knowing that the information provided to a domain registrar might be fake , we continued our search . To install and register the malicious shim database on a system , FIN7 used a custom Base64 encoded PowerShell script , which ran the sdbinst.exe utility to register a custom shim database file containing a patch onto a system . File type: JPEG image data , JFIF standard 1.02 .


The email address and country information drove us to a list of students attending a class at a Vietnamese university – corroborating the existence of the person under whose name the domain was registered . During the investigations , Mandiant observed that FIN7 used a custom shim database to patch both the 32-bit and 64-bit versions of services.exe with their CARBANAK payload . SHA256 : 44150350727e2a42f66d50015e98de462d362af8a9ae33d1f5124f1703179ab9 .


Figure 9 . We have not yet identified FIN7’s ultimate goal in this campaign , as we have either blocked the delivery of the malicious emails or our FaaS team detected and contained the attack early enough in the lifecycle before we observed any data targeting or theft . Hilename: C:\Windows\svchost.exe .


A university class student list including the C & C domain registrant Due to poor privacy practices on the part of our culprit ’ s university , we now know his date of birth ( probably : he seemingly used his birth year as part of his Gmail address , as further partial confirmation ) , we know that he was a student and what university he attended . Figure 1 shows a sample phishing email used by HawkEye operators in this latest campaign . File type: PE32 executable (GUI) Intel 80386 , for MS Windows .


We were also able to confirm that the phone number he provided to the domain registrar was genuine . Many groups leverage the regsvr32.exe application whitelisting bypass , including APT19 in their 2017 campaign against law firms . phpschboy.prohosts.org .


Moreover , we retrieved his University ID ; a quick googling showed some of his exam grades . The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits , including the EternalBlue exploit used in the WannaCry attack from May 2017 . jams481.site.bz .


However , his study results are out of the scope of our research . The malware appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD (via Bitcoin) to decrypt the data . SHA256 : 94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5 .


Based on our culprit ’ s email address , we were able to find his GitHub repository . The malware then builds two DLLs in memory – they are 32 and 64-bit DLLs that have identical functionality . Filename: How can North Korean hydrogen bomb wipe out Manhattan.scr .


His repository proves that he is indeed an Android developer , but it contained no publicly available code of the Ashas adware at the time of writing of this blogpost . The malware continues by creating a service named mssecsvc2.0 with a binary path pointing to the running module with the arguments -m security . SHA256 : 56f159cde3a55ae6e9270d95791ef2f6859aa119ad516c9471010302e1fb5634 .


However , a simple Google search for the adware package name returned a “ TestDelete ” project that had been available in his repository at some point The malicious developer also has apps in Apple ’ s App Store . The malware then writes the R resource data to the file C:\WINDOWS\tasksche.exe . Filename: conhote.dll .


Some of them are iOS versions of the ones removed from Google Play , but none contain adware functionality . The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . SHA256 : 553a475f72819b295927e469c7bf9aef774783f3ae8c34c794f35702023317cc .


Figure 10 . The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . Filename: winnit.exe .


The malicious developer ’ s apps published on the App Store which don ’ t contain the Ashas adware Searching further for the malicious developer ’ s activities , we also discovered his Youtube channel propagating the Ashas adware and his other projects . The usefulness of flare-qdb can be seen in cases such as loops dealing with strings . SHA256 : 92600679bb183c1897e7e1e6446082111491a42aa65a3a48bd0fceae0db7244f .


As for the Ashas family , one of the associated promotional videos , “ Head Soccer World Champion 2018 – Android , ios ” was viewed almost three million times and two others reached hundreds of thousands of views , as seen in Figure 11 . Attaching with IDA Pro via WinDbg as in Figure 11 shows that the program counter points to the infinite loop written in memory allocated by flare-qdb . Filename: Anti virus service.lnk . dowhelsitjs.netau.net .


Figure 11 . We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations . SHA256 : 69a9d7aa0cb964c091ca128735b6e60fa7ce028a2ba41d99023dd57c06600fe0 .


YouTube channel of the malicious developer His YouTube channel provided us with another valuable piece of information : he himself features in a video tutorial for one of his other projects . Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server . Filename: Pyongyang Directory Group email April 2017.RC_Office_Coordination_Associate.scr .


Thanks to that project , we were able to extract his Facebook profile – which lists his studies at the aforementioned university . The attachment in these emails is a weaponized Microsoft Office document containing a malicious macro that – when enabled – leads to the download of Hancitor . SHA256 : 4585584fe7e14838858b24c18a792b105d18f87d2711c060f09e62d89fc3085b .


Figure 12 . After the executable is executed , it downloads Pony and Vawtrak malware variants to steal data . Filename: adobe distillist.lnk .


Facebook profile of the C & C domain registrar ( cover picture and profile picture edited out ) Linked on the malicious developer ’ s Facebook profile , we discovered a Facebook page , Minigameshouse , and an associated domain , minigameshouse [ . Upon execution , it will communicate with an attacker-controller website to download a variant of the Pony malware , pm.dll” along with a standard Vawtrak trojan . SHA256 : 39bc918f0080603ac80fe1ec2edfd3099a88dc04322106735bc08188838b2635 .


] net . In this blog , FireEye Labs dissects this new ATM malware that we have dubbed RIPPER (due to the project name ATMRIPPER” identified in the sample) and documents indicators that strongly suggest this piece of malware is the one used to steal from the ATMs at banks in Thailand . Filename: winload.exe .


This domain is similar to the one the malware author used for his adware C & C communication , minigameshouse [ . RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism . SHA256 : dd730cc8fcbb979eb366915397b8535ce3b6cfdb01be2235797d9783661fc84d .


] us . RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself . Filename: winload.dll .


Checking this Minigameshouse page further indicates that this person is indeed the owner of the minigameshouse [ . This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices . Pactchfilepacks.net23.net . checkmail.phpnet.us .


] us domain : the phone number registered with this domain is the same as the phone number appearing on the Facebook page . From our trend analysis seen in Figure 3 , Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August . Lazarus used watering hole attacks to compromise legitimate and trusted websites frequently visited by their targets .


Figure 13 . Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before . Malefactors used watering hole attacks to compromise legitimate and trusted websites frequently visited by their targets .


Facebook page managed by the C & C domain registrant uses the same base domain name ( minigameshouse ) and phone number as the registered malicious C & C used by the Ashas adware Of interest is that on the Minigameshouse Facebook page , the malicious developer promotes a slew of games beyond the Ashas family for download on both Google Play and the App Store . FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform . Feedback from our Smart Protection Network revealed that apart from attacks in North America ( mainly the U.S. ) , Europe , and South America , the campaign also noticeably affected enterprises in Taiwan , Hong Kong , China , and Bahrain .


However , all of those have been removed from Google Play – despite the fact that some of them didn ’ t contain any adware functionality . The samples we identified target the ATM vendor Diebold . On February 28 , the McAfee discovered that the cybercrime group HIDDEN COBRA continues to target cryptocurrency and financial organizations .


On top of all this , one of the malicious developer ’ s YouTube videos – a tutorial on developing an “ Instant Game ” for Facebook – serves as an example of operational security completely ignored . This blog covers the changes , improvements , and Indicators of Compromise (IOC) of Ploutus-D in order to help financial organizations identify and defend against this threat . On February 28 , the McAfee Advanced Threat Research team discovered that the cybercrime group HIDDEN COBRA continues to target cryptocurrency and financial organizations .


We were able to see that his recently visited web sites were Google Play pages belonging to apps containing the Ashas adware . Ploutus-D also allows the attackers to enter the amount to withdraw (billUnits – 4 digits) and the number of cycles (billCount – 2 digits) to repeat the dispensing operation (see Figure 10) . While the URL acts similarly to how eye-watch.in : 443 delivers payloads , we also saw the URL leveraging and exploiting security flaws in Flash : CVE-2015-8651 , CVE-2016-1019 , and CVE-2016-4117 .


He also used his email account to log into various services in the video , which identifies him as the adware domain owner , beyond any doubt . Ploutus-D will load KXCashDispenserLib” library implemented by Kalignite Platform (K3A.Platform.dll) to interact with the XFS Manager and control the Dispenser (see Figure 13) . In this analysis , we observed the return of HIDDEN COBRA 's Bankshot malware implant surfacing in the Turkish financial system .


Thanks to the video , we were even able to identify three further apps that contained adware functionality and were available on Google Play . Since Ploutus-D interacts with the Kalignite Platform , only minor modifications to the Ploutus-D code may be required to target different ATM vendors worldwide . In this new , aggressive campaign we see a return of the Bankshot implant , which last appeared in 2017 .


Figure 14 . The threat actors used two publicly available techniques , an AppLocker whitelisting bypass and a script to inject shellcode into the userinit.exe process . This attack resembles previous attacks by HIDDEN COBRA conducted against the SWIFT .


Screenshots from this developer ’ s YouTube video shows history of checking Ashas adware on Google Play ESET telemetry Figure 15 . The regsvr32.exe executable can be used to download a Windows Script Component file (SCT file) by passing the URL of the SCT file as an argument . The exploit , which takes advantage of CVE-2018-4878 , allows an attacker to execute arbitrary code such as an implant .


ESET detections of Android/AdDisplay.Ashas on Android devices by country Is adware harmful ? We observed implementation of this bypass in the macro code to invoke regsvr32.exe , along with a URL passed to it which was hosting a malicious SCT file . These implants are variations of earlier forms of Bankshot , a remote access tool that gives an attacker full capability on a victim 's system .


Because the real nature of apps containing adware is usually hidden to the user , these apps and their developers should be considered untrustworthy . There was code to download a decoy document from the Internet and open it in a second winword.exe process using the Start-Process cmdlet . Bankshot was first reported by the Department of Homeland Security on December 13 , 2017 , and has only recently resurfaced in newly compiled variants .


When installed on a device , apps containing adware may , among other things : Annoy users with intrusive advertisements , including scam ads Waste the device ’ s battery resources Generate increased network traffic Gather users ’ personal information Hide their presence on the affected device to achieve persistence Generate revenue for their operator without any user interaction Conclusion Based solely on open source intelligence , we were able to trace the developer of the Ashas adware and establish his identity and discover additional related adware-infected apps . Ordnance will be able to immediately generate shellcode after users provide the IP and Port that the shellcode should connect to or listen on . We have found what may be an early data-gathering stage for future possible heists from financial organizations in Turkey ( and possibly other countries ) .


Seeing that the developer did not take any measures to protect his identity , it seems likely that his intentions weren ’ t dishonest at first – and this is also supported by the fact that not all his published apps contained unwanted ads . DarkPulsar is a very interesting administrative module for controlling a passive backdoor named ' sipauth32.tsp ' that provides remote control , belonging to this category . Documents with the flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


At some point in his Google Play “ career ” , he apparently decided to increase his ad revenue by implementing adware functionality in his apps ’ code . One of them – ipv4.dll – has been placed by the APT with what is , in fact , a downloader for other malicious components . This malware report contains analysis of one 32-bit Windows executable file , identified as a Remote Access Trojan ( RAT ) .


The various stealth and resilience techniques implemented in the adware show us that the culprit was aware of the malicious nature of the added functionality and attempted to keep it hidden . Written in pure C language , Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions , and carries out integrity control of various system components to avoid debugging and security detection . This malware is capable of accessing device configuration data , downloading additional files , executing commands , modifying the registry , capturing screen shots , and exfiltrating data .


Sneaking unwanted or harmful functionality into popular , benign apps is a common practice among “ bad ” developers , and we are committed to tracking down such apps . First observed in mid-2014 , this malware shared code with the Bugat ( aka Feodo ) banking Trojan . Volgmer is a backdoor Trojan designed to provide covert access to a compromised system .


We report them to Google and take other steps to disrupt malicious campaigns we discover . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . It is suspected that spear phishing is the primary delivery mechanism for Volgmer infections ; however , HIDDEN COBRA actors use a suite of custom tools , some of which could also be used to initially compromise a system .


Last but not least , we publish our findings to help Android users protect themselves . Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word . Since at least 2013 , HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government , financial , automotive , and media industries .


MITRE ATT & CK techniques Tactic ID Name Description Initial Access T1475 Deliver Malicious App via Authorized App Store The malware impersonates legitimate services on Google Play Persistence T1402 App Auto-Start at Device Boot An Android application can listen for the BOOT_COMPLETED broadcast , ensuring that the app 's functionality will be activated every time the device starts Impact T1472 Generate Fraudulent Advertising Revenue Generates revenue by automatically displaying ads The Rotexy mobile Trojan – banker and ransomware 22 NOV 2018 On Whitefly first infects its victims using a dropper in the form of a malicious.exe or .dll file that is disguised as a document or image . Therefore , it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer .


the back of a surge in Trojan activity , we decided to carry out an in-depth analysis and track the evolution of some other popular malware families besides Asacub . CraP2P has frequently been used to distribute other malware such as Locky and Dridex , but also supported large scale spam campaigns for dating advertisement and pump-and-dump scams after the demise of Kelihos . As a backdoor Trojan , Volgmer has several capabilities including : gathering system information , updating service registry keys , downloading and uploading files , executing commands , terminating processes , and listing directories .


One of the most interesting and active specimens to date was a mobile Trojan from the Rotexy family . Once the LOWBALL malware calls back to the Dropbox account , the admin@338 will create a file called upload.bat which contains commands to be executed on the compromised computer . In one of the samples received for analysis , the US-CERT Code Analysis Team observed botnet controller functionality .


In a three-month period from August to October 2018 , it launched over 70,000 attacks against users located primarily in Russia . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia . Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library ( .dll )


An interesting feature of this family of banking Trojans is the simultaneous use of three command sources : Google Cloud Messaging ( GCM ) service – used to send small messages in JSON format to a mobile device via Google servers ; malicious C & C server ; incoming SMS messages . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " . Lazarus actors commonly maintain persistence on a victim 's system by installing the malware-as-a-service .


This ‘ versatility ’ was present in the first version of Rotexy and has been a feature of all the family ’ s subsequent representatives . More recently , in May 2017 , APT33 appeared to target a Saudi organization and a South Korean business conglomerate using a malicious file that attempted to entice victims with job vacancies for a Saudi Arabian petrochemical company . Working with U.S. Government partners , DHS and FBI identified Trojan malware variants used by the North Korean government - referred to by the U.S. Government as BADCALL .


During our research we also arrived at the conclusion that this Trojan evolved from an SMS spyware Trojan that was first spotted in October 2014 . More recently , in May 2017 , APT33 appeared to target organizations in Saudi and South Korea using a malicious file that attempted to entice victims with job vacancies . The malware uses a custom binary protocol to beacon back to the command and control ( C2 ) server , often via TCP PROT 8080 or 8088 , with some payloads implementing Secure Socket Layer ( SSL ) encryption to obfuscate communications .


Back then it was detected as Trojan-Spy.AndroidOS.SmsThief , but later versions were assigned to another family – Trojan-Banker.AndroidOS.Rotexy . In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets . DHS and FBI are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity .


The modern version of Rotexy combines the functions of a banking Trojan and ransomware . In fact , REDBALDKNIGHT has been zeroing in on Japanese organizations as early as 2008 — at least based on the file properties of the decoy documents they've been sending to their targets . The malware known as RATANKBA is just one of the weapons in Lazarus ' arsenal .


It spreads under the name AvitoPay.apk ( or similar ) and downloads from websites with names like youla9d6h.tk , prodam8n9.tk , prodamfkz.ml , avitoe0ys.tk , etc . Carbanak is a backdoor used by the attackers to compromise the victim . We analyzed a new RATANKBA variant ( BKDR_RATANKBA.ZAEL–A ) , discovered in June 2017 , that uses a PowerShell script instead of its more traditional PE executable form—a version that other researchers also recently identified .


These website names are generated according to a clear algorithm : the first few letters are suggestive of popular classified ad services , followed by a random string of characters , followed by a two-letter top-level domain . This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 . Around 55% of the victims of Lazarus were located in India and neighboring countries .


But before we go into the details of what the latest version of Rotexy can do and why it ’ s distinctive , we would like to give a summary of the path the Trojan has taken since 2014 up to the present day . The Korean-language Word document manual.doc appeared in Vietnam on January 17 , with the original author name of Honeybee . Lazarus group could have been active since late 2016 , was used in a recent campaign targeting financial institutions using watering hole attacks .


Evolution of Rotexy 2014–2015 Since the malicious program was detected in 2014 , its main functions and propagation method have not changed : Rotexy spreads via links sent in phishing SMSs that prompt the user to install an app . This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON , which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics . Since they first emerged back in 2007 with a series of cyberespionage attacks against the South Korean government , these threat actors have successfully managed to pull off some of the most notable and devastating targeted attacks—such as the widely-reported 2014 Sony hack and the 2016 attack on a Bangladeshi bank—in recent history .


As it launches , it requests device administrator rights , and then starts communicating with its C & C server . Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . It 's possible that Lazarus is using RATANKBA to target larger organizations .


Until mid-2015 , Rotexy used a plain-text JSON format to communicate with its C & C . For example , DeltaAlfa specifies a DDoS bot family identified as Alfa . RATANKBA is delivered to its victims using a variety of lure documents , including Microsoft Office documents , malicious CHM files , and different script downloaders .


The C & C address was specified in the code and was also unencrypted : In some versions , a dynamically generated low-level domain was used as an address : In its first communication , the Trojan sent the infected device ’ s IMEI to the C & C , and in return it received a set of rules for processing incoming SMSs ( phone numbers , keywords and regular expressions ) – these applied mainly to messages from banks , payment systems and mobile network operators . This alert 's IOC files provide HIDDEN COBRA indicators related to FALLCHILL . Overall , an organization will need multilayered security strategies , as Lazarus and other similar groups are experienced cybercriminals who employ different strategies to get past organizational defenses .


For instance , the Trojan could automatically reply to an SMS and immediately delete it . The McAfee Advanced Threat Research team discovered a previously unknown data-gathering implant that surfaced in mid-February 2018 . simultaneous use of the detected Win32/KillDisk.NBO variants .


Rotexy then sent information about the smartphone to the C & C , including the phone model , number , name of the mobile network operator , versions of the operating system and IMEI . This alert 's IOC files provide HIDDEN COBRA indicators related to FALLCHILL . Working with U.S. Government partners , DHS and FBI identified Trojan malware variants used by the North Korean government – commonly known as HARDRAIN .


With each subsequent request , a new subdomain was generated . The McAfee Advanced Threat Research team discovered a previously unknown data-gathering implant that surfaced in mid-February 2018 . These files have the capability to download and install malware , install proxy and Remote Access Trojans ( RATs ) , connect to command and control ( C2 ) servers to receive additional instructions , and modify the victim 's firewall to allow incoming connections .


The algorithm for generating the lowest-level domain name was hardwired in the Trojan ’ s code . Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal . The cybercriminal group Lazarus has a history of attacking financial organizations in Asia and Latin America .


The Trojan also registered in Google Cloud Messaging ( GCM ) , meaning it could then receive commands via that service . This malware report contains analysis of one 32-bit Windows executable file , identified as a Remote Access Trojan ( RAT ) . We also recently discovered that Lazarus successfully planted their backdoor ( detected by Trend Micro as BKDR_BINLODR.ZNFJ-A ) into several machines of financial institutions across Latin America .


The Trojan ’ s list of possible commands has remained practically unchanged throughout its life , and will be described below in detail . In one of the samples received for analysis , the US-CERT Code Analysis Team observed botnet controller functionality . We determined that these backdoors were installed on the targets ' machines on September 19 2018 , based mainly on the service creation time of the loader component .


The Trojan ’ s assets folder contained the file data.db with a list of possible values for the User-Agent field for the PAGE command ( which downloads the specified webpage ) . Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library ( .dll ) Just last week Lazarus were found stealing millions from ATMs across Asia and Africa .


If the value of this field failed to arrive from the C & C , it was selected from the file data.db using a pseudo-random algorithm . Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs . These and other tools used by the Lazarus group can be mitigated by routinely scanning the network for any malicious activity to help prevent the malware from entering and spreading through an organization .


2015–2016 Starting from mid-2015 , the Trojan began using the AES algorithm to encrypt data communicated between the infected device and the C & C : Also starting with the same version , data is sent in a POST request to the relative address with the format “ / [ number ] ” ( a pseudo-randomly generated number in the range 0–9999 ) . WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data . The backdoors Lazarus are deploying are difficult to detect and a significant threat to the privacy and security of enterprises , allowing attackers to steal information , delete files , install malware , and more .


In some samples , starting from January 2016 , an algorithm has been implemented for unpacking the encrypted executable DEX file from the assets folder . Some of the documents exploited CVE-2017-0199 to deliver the payload . Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs .