In the latest version , a layer of obfuscation was added , perhaps taking the malware one step closer to being fully operational . Japan is no stranger to banking malware . Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East ( including targets inside Iran itself ) , as well as across Europe and in the United States .


SUSPECTED DETECTION TESTS BY THE THREAT ACTOR In searching for EventBot , we ’ ve identified multiple submissions from the same submitter hash , 22b3c7b0 : EventBot 22b3c7b0 submitter hash The 22b3c7b0 submitter hash that submitted most of the EventBot samples to VirusTotal . Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware . The May 2014 ' Operation Saffron Rose ' publication identifies an Iranian hacking group formerly named ' Ajax Security ' ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


This submitter has thousands of other submissions in VirusTotal , however , it is the only one that continues to submit EventBot samples via the VirusTotal API . This post was our first analysis of the first Panda Banker campaign that we’ve seen to target financial institutions in Japan . An Iranian hacking group formerly named Ajax Security ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


Also , the botnet IDs increment over time as they are submitted . We believe the iOS malware gets installed on already compromised systems , and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems . The report specifies the Magic Hound targeted political , military and defense industry in the US , UK and Israel .


Given this , and the naming convention of the submissions ( .virus ) , the submitter hash most likely belongs to an AV vendor or sandboxing environment that automatically submits samples to online malware databases . One is called XAgent detected as IOS_XAGENT.A and the other one uses the name of a legitimate iOS game , MadCap detected as IOS_ XAGENT.B . ClearSky 's September 2014 blog post first described active attacks using a piece of malware they dubbed ' Gholee ' ( as appears in a malicious payload export function , potentially named after a popular Iranian singer9 ) .


It may be that these submissions are made from the author ’ s machine , or that they submit it to a detection service that in turn submits to online malware databases . Madcap” is similar to the XAgent malware , but the former is focused on recording audio . The Rocket Kitten attacker group 's main attack vector is spear-phishing .


EVENTBOT THREAT ACTORS As a part of this investigation , the Cybereason Nocturnus team has attempted to identify the threat actors behind the development of EventBot . This full-blown spying framework consists of two packages named ‘Tokyo’ and ‘Yokohama’ . After learning of an active attack incident from the Rocket Kitten group on a customer network , Check Point researchers decided to actively join the investigation .


The evidence above suggests that EventBot is still in the development stage , and as such , is not likely to have been used for large attack campaigns thus far . Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue . As described in previous publications , the Rocket Kitten attackers make extensive use of various phishing schemes .


The Cybereason Nocturnus team is monitoring multiple underground platforms in an attempt to identify chatter relating to EventBot . The first confirmed date when TajMahal samples were seen on a victim’s machine is August 2014 . While the recent paper from Trend Micro and ClearSky ( ' The Spy Kittens Are Back : Rocket Kitten 2 ' ) does extensively cover the campaign 's narrative , we aimed to seek confirmation that our analyzed attack was positively connected to the same campaign and set out to provide additional value and insight .


New malware is often introduced to underground communities by being promoted and sold or offered as a giveaway . More details about TajMahal are available to customers of the Kaspersky Intelligence Reporting service (contact intelreports@kaspersky.com) . As the Rocket Kitten group 's behavior was well characterized in previous publications ( see the recent report from Trend Micro and ClearSky ) .


However , at the time of writing , we were unable to identify relevant conversations about the EventBot malware . The delivery of KopiLuwak in this instance is currently unknown as the MSIL dropper has only been observed by Proofpoint researchers on a public malware repository . Magic Hound will often find simpler ACTs for effective compromise , such as creative phishing and simple custom malware .


This strengthens our suspicion that this malware is still undergoing development and has not been officially marketed or released yet . The earliest step in any possible attack(s) involving this variant of KopiLuwak of which Proofpoint researchers are currently aware begin with the MSIL dropper . We present the connection between Behzad Mesri , an Iranian national recently indicted for his involvement in hacking HBO , and Charming Kitten .


EVENTBOT INFRASTRUCTURE By mapping the C2 servers , a clear , repeated pattern emerges based on the specific URL gate_cb8a5aea1ab302f0_c . The basic chain of events upon execution of the MSIL dropper include dropping and executing both a PDF decoy and a Javascript (JS) dropper . Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as Oilrig1 and CopyKittens2 .


As of this writing , all the domains were registered recently and some are already offline . As explained in further detail below , the JS dropper ultimately installs a JS decryptor onto an infected machine that will then finally decrypt and execute the actual KopiLuwak backdoor in memory only . A case of these obscure lines can be found in a blogpost published in coordination and parallel to this report - " Flying Kitten to Rocket Kitten , A Case of Ambiguity and Shared Code " 3 by Collin Anderson and Claudio Guarnieri .


URL Status IP Domain registration date http : //ora.studiolegalebasili [ . As Proofpoint has not yet observed this attack in the wild it is likely that there is an additional component that leads to the execution of the MSIL payload . FireEye 's publication of " Operation Saffron Rose " report , which described Flying Kitten 's operations against aviation firms , led to the dismantling of Flying Kitten 's infrastructure and the apparent end of its activities .


] com/gate_cb8a5aea1ab302f0_c offline 31.214.157 [ . The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine . To sum up , the HBO hacker - Behzad Mesri is a member of Turk Black Hat along with ArYaIeIrAn , who provides infrastructure for Charming Kitten activity via PersianDNS / Mahanserver together with Mohammad Rasoul Akbari , who is a Facebook friend of Behzad Mesri 's .


] 6 2020-02-29 http : //themoil [ . We didn’t choose to name it after a vegetable; the .NET malware developers named it Topinambour themselves . Charming kitten regularly target international media outlets with Persian-language services .


] site/gate_cb8a5aea1ab302f0_c online 208.91.197 [ . The role of the .NET module is to deliver the known KopiLuwak JavaScript Trojan . It was a decoy to make visitor download a " Flash Player " , which was in fact DownPaper malware , analyzed later in this report .


] 91 2020-03-04 http : //ora.carlaarrabitoarchitetto [ . RocketMan!” (probably a reference to Donald Trump’s nickname for Kim Jong Un) and MiamiBeach” serve as the first beacon messages from the victim to the control server . In addition to using PlugX and Poison Ivy ( PIVY ) , both known to be used by the group , they also used a new Trojan called " ChChes " by the Japan Computer Emergency Response Team Coordination Center ( JPCERT ) .


] com/gate_cb8a5aea1ab302f0_c offline 31.214.157 [ . These could be tools to circumvent internet censorship , such as Softether VPN 4.12” and psiphon3” , or Microsoft Office activators” . Wapack labs also observed a similar sample targeting Japan in November .


] 6 2020-03-26 http : //rxc.rxcoordinator [ . These campaign-related VPSs are located in South Africa . MenuPass spoofed several sender email addresses to send spear phishing emails , most notably public addresses associated with the Sasakawa Peace Foundation and The White House .


] com/gate_cb8a5aea1ab302f0_c online 185.158.248 [ . The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems . menuPass typically makes use of a mix of DDNS and actor-registered domains in their attack campaigns .


] 102 2020-03-29 http : //ora.blindsidefantasy [ . The PowerShell version of the Trojan also has the ability to get screenshots . There is not much public information about the APT campaign called menuPass ( also known as Stone Panda and APT10 ) .


] com/gate_cb8a5aea1ab302f0_c online 185.158.248 [ . The Trojan is quite similar to the .NET RocketMan Trojan and can handle the same commands; additionally , it includes the #screen” command to take a screenshot . A paper from FireEye in 2013 on several campaigns using PIVY included menuPass as one of them .


] 102 2020-04-02 http : //marta.martatovaglieri [ . Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations . Believed to have started activity in 2009 and to originate from China , the group initially was known for targeting US and overseas defense contractors but broadened their targeting as time passed .


] it/gate_cb8a5aea1ab302f0_c online 185.158.248 [ . BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e , possibly en masse . menuPass has targeted individuals and organizations in Japan since at least 2014 , and as the same organizations and academics were largely targeted each month in these attacks , it further shows menuPass is persistent in attempts to compromise their targets .


] 102 2020-04-14 http : //pub.douglasshome [ . Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina . menuPass also heavily favors spear phishing , and so takes steps to socially engineer their spear phishes for maximum appearance of legitimacy .


] com/gate_cb8a5aea1ab302f0_c online 185.158.249 [ . In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 . menuPass is an ongoing APT campaign with a broad range of targets and will likely continue to target Japan in the future .


] 141 2020-04-26 In the course of the investigation , the team discovered a potential link to an additional Android infostealer . The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience . ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints .


The IP address of both ora.carlaarrabitoarchitetto [ . The main part of the BalkanRAT malware is a copy of the Remote Utilities software for remote access . PyCommands , meanwhile , are Python scripts that automate tasks for Immunity Debugger , a popular tool for reverse-engineering malware binaries .


] com and ora.studiolegalebasili [ . China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool . Poison Ivy is a remote access tool that is freely available for download from its official web site at www.poisonivy-rat.com .


] com , 31.214.157 [ . China Chopper contains a remote shell (Virtual Terminal) function that has a first suggested command of netstat an|find ESTABLISHED . First released in 2005 , the tool has gone unchanged since 2008 with v ersion 2.3.2 .


] 6 , was previously hosting the domain next.nextuptravel [ . They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword.exe . Poison Ivy includes features common to most Windows-based RATs , including key logging , screen capturing , video capturing , file transfers , system administration , password theft , and traffic relaying .


] com . The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords . APT40 was previously reported as TEMP.Periscope and TEMP.Jumper .


This was the C2 for an Android infostealer responsible for several attacks in Italy back in late 2019 . The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server . They move laterally and escalate system privileges to extract sensitive information — whenever the attacker wants to do so.4 ,5 Because some RATs used in targeted attacks are widely available , determining whether an attack is part of a broader APT campaign can be difficult .


EventBot VirusTotal search for the malicious IP address VirusTotal search for the malicious IP address . The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . In 2011 , three years after the most recent release of PIVY , attackers used the RAT to compromise security firm RSA and steal data about its SecureID authentication system .


IMPACT EventBot is a mobile malware banking trojan that steals financial information , is able to hijack transactions . Let’s take a closer look at ITG08’s TTPs that are relevant to the campaign we investigated , starting with its spear phishing and intrusion tactics and covering information on its use of the More_eggs backdoor . PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 .


Once this malware has successfully installed , it will collect personal data , passwords , keystrokes , banking information , and more . Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe . Just recently , PIVY was the payload of a zero-day exploit in Internet Explorer used in what is known as a " strategic web compromise " attack against visitors to a U.S. government website and a variety of others .


This information can give the attacker access to personal and business bank accounts , personal and business data , and more . X-Force IRIS determined that the More_eggs backdoor later downloaded additional files , including a signed binary shellcode loader and a signed Dynamic Link Library (DLL) , as described below , to create a reverse shell and connect to a remote host . The Poison Ivy builder kit allows attackers to customize and build their own PIVY server , which is delivered as mobile code to a target that has been compromised , typically using social engineering .


Letting an attacker get access to this kind of data can have severe consequences . The document exploited CVE-2012-0158 and will decode and write an executable to disk upon infection . Attackers can point and click their ACT through a compromised network and exfiltrate data .


60 % of devices containing or accessing enterprise data are mobile . iSiGHT Partners has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 . Commodity RATs also complicate efforts by security professionals to correlate a threat actor 's activity over time—attackers can hide in the sea of malicious activity that also uses Poison Ivy-based malware .


Giving an attacker access to a mobile device can have severe business consequences , especially if the end user is using their mobile device to discuss sensitive business topics or access enterprise financial information . In July of 2015 , we identified a full e-mail uploaded to an antivirus scanning service that carried a Scarlet Mimic exploit document . This report is an initial public release of research PwC UK and BAE Systems have conducted into new , sustained global campaigns by an established threat actor against managed IT service providers and their clients as well as several directly targeted organisations in Japan .


This can result in brand degradation , loss of individual reputation , or loss of consumer trust . The group uses legitimate administration tools to fly under the radar in their post-exploitation phase , which makes detection of malicious activity , as well as attribution more complicated . Since late 2016 , PwC UK and BAE Systems have been assisting victims of a new cyber espionage campaign conducted by APT10 .


Much like we have seen in recent months , anyone can be impacted by a mobile device attack . Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download . The campaign , which we refer to as Operation Cloud Hopper , has targeted managed IT service providers ( MSPs ) , allowing APT10 unprecedented potential access to the intellectual property and sensitive data of those MSPs and their clients globally .


These attacks are only becoming more common , with one third of all malware now targeting mobile endpoints . In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 . APT10 ceased its use of the Poison Ivy malware family after a 2013 FireEye report , which comprehensively detailed the malware 's functionality and features , and its use by several China-based threat actors , including APT10 .


Care and concern both for using a mobile device and for securing a mobile device is critical , especially for those organizations that allow bring-your-own-devices . As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware . APT10 primarily used PlugX malware from 2014 to 2016 , progressively improving and deploying newer versions , while simultaneously standardising their command and control function .


CYBEREASON MOBILE Cybereason Mobile detects EventBot and immediately takes remediation actions to protect the end user . FireEye believes that two actors – Turla and an unknown financially motivated actor – were using the first EPS zero-day CVE-2017-0261 , and APT28 was using the second EPS zero-day CVE-2017-0262 along with a new Escalation of Privilege (EOP) zero-day CVE-2017-0263 . PwC UK and BAE Systems assess it is highly likely that APT10 is a China-based threat actor with a focus on espionage and wide ranging information collection .


With Cybereason Mobile , analysts can address mobile threats in the same platform as traditional endpoint threats , all as part of one incident . The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . APT10 is known to have exfiltrated a high volume of data from multiple victims , exploiting compromised MSP networks , and those of their customers , to stealthily move this data around the world .


Without mobile threat detection , this attack would not be detected , leaving end users and organizations at risk . This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . APT10 , a name originally coined by FireEye , is also referred to as Red Apollo by PwC UK , CVNX by BAE Systems , Stone Panda by CrowdStrike , and menuPass Team more broadly in the public domain .


Cybereason Mobile detects EventBot and provides the user with immediate actions . It is possible that CVE-2017-8759 was being used by additional actors . The threat actor has previously been the subject of a range of open source reporting , including most notably a report by FireEye comprehensively detailing the threat actor 's use of the Poison Ivy malware family and blog posts by Trend Micro3 similarly detailing the use of EvilGrab malware .


CONCLUSION In this research , the Nocturnus team has dissected a rapidly evolving Android malware in the making . The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities . The threat actor has previously been the subject of a range of open source reporting , including most notably a report by FireEye comprehensively detailing the threat actor 's use of the Poison Ivy malware family and blog posts by Trend Micro similarly detailing the use of EvilGrab malware .


This malware abuses the Android accessibility feature to steal user information and is able to update its code and release new features every few days . The Magnitude EK landing page consisted of CVE-2016-0189 , which was first reported by FireEye as being used in Neutrino Exploit Kit after it was patched . APT10 has been in operation since at least 2009 , and has evolved its targeting from an early focus on the US defence industrial base ( DIB )1 and the technology and telecommunications sector , to a widespread compromise of multiple industries and sectors across the globe , most recently with a focus on MSPs .


With each new version , the malware adds new features like dynamic library loading , encryption , and adjustments to different locales and manufacturers . The malware leverages an exploit , codenamed EternalBlue” , that was released by the Shadow Brokers on April 14 , 2017 . The research and ongoing tracking of APT10 by both PwC UK and BAE .


EventBot appears to be a completely new malware in the early stages of development , giving us an interesting view into how attackers create and test their malware . Some hackers even went onto use the Cisco exploits in the wild . APT10 has been in operation since at least 2009 , and has evolved its targeting from an early focus on the US defence industrial base ( DIB ) and the technology and telecommunications sector , to a widespread compromise of multiple industries and sectors across the globe , most recently with a focus on MSPs .


Cybereason classifies EventBot as a mobile banking trojan and infostealer based on the stealing features discussed in this research . DanderSpritz is the framework for controlling infected machines , different from FuZZbuNch as the latter provides a limited toolkit for the post-exploitation stage with specific functions such as DisableSecurity and EnableSecurity for DarkPulsar . PwC UK has been engaged in supporting investigations linked to APT10 compromises .


It leverages webinjects and SMS reading capabilities to bypass two-factor authentication , and is clearly targeting financial applications . In their latest leak , they have released the UNITEDRAKE NSA exploit , which is a remote access and control tool that can remotely target Windows-based systems to capture desired information and transfer it to a server . As a result of our analysis of APT10 's activities , we believe that it almost certainly benefits from significant staffing and logistical resources , which have increased over the last three years , with a significant step-change in 2016 .


Although the threat actor responsible for the development of EventBot is still unknown and the malware does not appear to be involved in major attacks , it is interesting to follow the early stages of mobile malware development . On the other hand , ShadowBrokers group made headlines in 2016 when it claimed to have robbed various exploitation tools used by the NSA including the notorious ETERNALBLUE that was a vital component in the WannaCry ransomware campaign causing damages to systems worldwide . Due to the scale of the threat actor 's operations throughout 2016 and 2017 , we similarly assess it currently comprises multiple teams , each responsible for a different section of the day-to-day operations , namely domain registration , infrastructure management , malware development , target operations , and analysis .


The Cybereason Nocturnus team will continue to monitor EventBot ’ s development . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . APT10 withdrew from direct targeting using Poison Ivy in 2013 and conducted its first known retooling operation , upgrading its capabilities and replatforming to use PlugX .


In recent years , online activity has gradually been shifting from personal computers to mobile devices . Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word . It is highly likely that this is due to the release of the 2013 FireEye report .


Naturally , this resulted in the introduction of malware for mobile platforms , especially Android devices , including Cerberus , Xhelper and the Anubis Banking Trojan . According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . Our report will detail the most recent campaigns conducted by APT10 , including the sustained targeting of MSPs , which we have named Operation Cloud Hopper , and the targeting of a number of Japanese institutions .


As many people use their mobile devices for online shopping and even to manage their bank accounts , the mobile arena became increasingly profitable for cyber criminals . In order to carry out this operation , it uses publicly available tools , including Mimikatz ( Hacktool.Mimikatz ) and an open-source tool that exploits a known Windows privilege escalation vulnerability ( CVE-2016-0051 ) on unpatched computers . MSPs therefore represent a high-payoff target for espionagefocused threat actors such as APT10 .


This is why we recently released Cybereason Mobile , a new offering that strengthens the Cybereason Defense Platform by bringing prevention , detection , and response capabilities to mobile devices . Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) . Given the level of client network access MSPs have , once APT10 has gained access to a MSP , it is likely to be relatively straightforward to exploit this and move laterally onto the networks of potentially thousands of other victims .


With Cybereason Mobile , our customers can protect against modern threats across traditional and mobile endpoints , all within a single console . The Word document usually exploits CVE-2012-0158 . This , in turn , would provide access to a larger amount of intellectual property and sensitive data .


Check Point Mobile Threat Prevention has detected two instances of a mobile malware variant infecting multiple devices within the Check Point customer base . Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 . APT10 has been observed to exfiltrate stolen intellectual property via the MSPs , hence evading local network defences .


The malware , packaged within an Android game app called BrainTest , had been published to Google Play twice . Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 . The command and control ( C2 ) infrastructure chosen by APT10 for Operation Cloud Hopper is predominantly referenced using dynamic-DNS domains .


Each instance had between 100,000 and 500,000 downloads according to Google Play statistics , reaching an aggregated infection rate of between 200,000 and 1 million users . The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . Several of these provide enterprise services or cloud hosting , supporting our assessment that APT10 are almost certainly targeting MSPs .


Check Point reached out to Google on September 10 , 2015 , and the app containing the malware was removed from Google Play on September 15 , 2015 . One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . The 13th FYP was released in March 2016 and the sectors and organisations known to be targeted by APT10 are broadly in line with the strategic aims documented in this plan . These aims outlined in the FYP will largely dictate the growth of businesses in China and are , therefore , likely to also form part of Chinese companies ' business strategies .


Overview The malware was first detected on a Nexus 5 smartphone , and although the user attempted to remove the infected app , the malware reappeared on the same device shortly thereafter . The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components . APT10 has , in the past , primarily been known for its targeting of government and US defence industrial base organisations , with the earliest known date of its activity being in December 2009 .


Our analysis of the malware shows it uses multiple , advanced techniques to avoid Google Play malware detection and to maintain persistency on target devices . The document files exploit at least three known vulnerabilities in Microsoft Office , which we discuss in the Infection Techniques section . Observed APT10 targeting is in line with many of the historic compromises we have outlined previously as originating from China .


Once this malware was detected on a device , Mobile Threat Prevention adjusted security policies on the Mobile Device Management solution ( MobileIron ) managing the affected devices automatically , thereby blocking enterprise access from the infected devices . In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . In line with commonly used APT actor methodologies , the threat actor aligns its decoy documents to a topic of interest relevant to the recipient .


While the malware is capable of facilitating various cyber-criminal goals , our team confirmed it ’ s currently installing additional apps on infected devices . According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . This section details changes made to APT10 tools , techniques and procedures ( TTPs ) post-2014 , following its shift from Poison Ivy to PlugX .


Disturbingly , the malware establishes a rootkit on the device , allowing it to download and execute any code a cybercriminal would want to run on a device . PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . We have observed that in cases where APT10 has infiltrated a target via an MSP , it continues to use the MSPs credentials .


For example , it could be used to display unwanted and annoying advertisements on a device , or potentially , to download and deploy a payload that steals credentials from an infected device . The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . In order to gain any further credentials , APT10 will usually deploy credential theft tools such as mimikatz or PwDump , sometimes using DLL load order hijacking , to use against a domain controller , explained further in Annex B .


Highlights Samples of the malicious code found in BrainTest have been found on Google Play , and its creator has used multiple methods to evade detection by Google including Bypassing Google Bouncer by detecting if the malware is being run from an IP or domain mapped to Google Bouncer and , if so , it will not perform its intended malicious activities . We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . APT10 achieves persistence on its targets primarily by using scheduled tasks or Windows services in order to ensure the malware remains active regardless of system reboots .


Combining timebombs , dynamic code loading , and use of reflection to complicate reverse engineering of the malware . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . For example , in addition to compromising high value domain controllers and security servers , the threat actor has also been observed identifying and subsequently installing malware on low profile systems that provide non-critical support functions to the business , and are thus less likely to draw the attention of system administrators .


Using off-the-shelf obfuscation ( packer ) from Baidu to re-introduce the malware to Google Play after the first instance was removed on Aug 24th . However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . In the majority of instances APT10 used either a reverse shell or RDP connection to install its malware ; the actor also uses these methods to propagate across the network .


BrainTest uses four privilege escalation exploits to gain root access on a device and to install a persistent malware as a system application . PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 . The tactical malware , historically EvilGrab , and now ChChes ( and likely also RedLeaves ) , is designed to be lightweight and disposable , often being delivered through spear phishing .


BrainTest leverages an anti-uninstall watchdog that uses two system applications to monitor the removal of one of the components and reinstall the component . Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) . Once executed , tactical malware contains the capability to profile the network and manoeuvre through it to identify a key system of interest .


After the the first instance of BrainTest was detected , Google removed the app from Google Play . The Word document usually exploits CVE-2012-0158 . We have also observed APT10 use DLL search order hijacking and sideloading , to execute some modified versions of open-source tools .


Within days , the Check Point research team detected another instance with a different package name but which uses the same code . Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 . For example , PwC UK has observed APT10 compiling DLLs out of tools , such as Mimikatz and PwDump6 , and using legitimate , signed software , such as Windows Defender to load the malicious payloads .


The malware ’ s creators had used obfuscation to upload the new piece of malware to Google Play . Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 . During our analysis of victim networks , we were able to observe APT10 once again initiate a retooling cycle in late 2016 .


Technical Analysis The malware consists of 2 applications : The Dropper : Brain Test ( Unpacked – com.mile.brain , Packed – com.zmhitlte.brain ) This is installed from Google Play and downloads an exploit pack from the server to obtain root access on a device . The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . We observed the deployment and testing of multiple versions of Quasar malware , and the introduction of the bespoke malware families ChChes and RedLeaves .


If root access is obtained , the application downloads a malicious .apk file ( The Backdoor ) from the server and installs it as system application . Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability . APT10 is a constantly evolving , highly persistent China-based threat actor that has an ambitious and unprecedented collection programme against a broad spectrum of sectors , enabled by its strategic targeting .


The Backdoor : System malware ( mcpef.apk and brother.apk ) This tries a few persistence methods by using few anti-uninstall techniques ( described below ) and downloads and executes code from server without user consent . PittyTiger has also been seen using Heartbleed vulnerability in order to directly get valid credentials . Since exposure of its operations in 2013 , APT10 has made a number of significant changes intended to thwart detection of its campaigns .


Detailed Malware Structure Malware Strucutre com.mile.brain ( SHA256 : 135d6acff3ca27e6e7997429e5f8051f88215d12351e4103f8344cd66611e0f3 ) : This is the main application found on Google Play . They have also been seen using Heartbleed vulnerability in order to directly get valid credentials . PwC UK and BAE Systems , working closely with industry and government , have uncovered a new , unparallelled campaign which we refer to as Operation Cloud Hopper .


It contains encrypted java archive “ start.ogg ” in the assets directory and dynamically loads code with dalvik.system.DexClassLoader . One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . This operation has targeted managed IT service providers , the compromise of which provides APT10 with potential access to thousands of further victims .


do.jar ( SHA256 : a711e620246d9954510d3f1c8d5c784bacc78069a5c57b9ec09c3e234bc33a8b ) : The decrypted file that was created by “ start.ogg. ” It sends a request to the server with the device ’ s configuration . PittyTiger could also use CVE-2014-1761 , which is more recent . An additional campaign has also been observed targeting Japanese entities .


The server ’ s response is a json , containing a link to a .jar file , class name and method name to be executed with reflection API . PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts . APT10 's malware toolbox shows a clear evolution from malware commonly associated with China-based threat actors towards bespoke in-house malware that has been used in more recent campaigns ; this is indicative of APT10 's increasing sophistication , which is highly likely to continue .


The application downloads the file and dynamically loads it using dalvik.system.DexClassLoader and invokes class and method specified in json . The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components . The threat actor 's known working hours align to Chinese Standard TIME ( CST ) and its targeting corresponds to that of other known China-based threat actors , which supports our assessment that these campaigns are conducted by APT10 .


jhfrte.jar : This is a java archive file downloaded from server . When the document was opened in Word , PLATINUM exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer . APT10 ( MenuPass Group ) is a Chinese cyber espionage group that FireEye has tracked since 2009 .


If a device isn ’ t rooted , it downloads from the server an exploit pack and executes it to obtain root on device . The DLL exploited another previously unknown vulnerability ( designated CVE-2015-2546 ) in the Windows kernel , which enabled it to elevate privileges for the Word executable and subsequently install a backdoor through the application . Its targets include the military organizations and governments of countries with national interests in the South China Sea , including some within the U.S. defense industrial base .


Once root is obtained , it downloads an additional APK file from the server ( mcpef.apk ) and installs it as system application ( /system directory ) . When the document was opened in Word , it exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer . Moafee may have chosen its targets based on the rich resources of South China Sea region – the world 's second business sea-lane , according to Wikipedia – including rare earth metals , crude oil , and natural gas .


r1-r4 : This is a local privilege escalation ( root ) exploit , which includes : CVE-2013-6282 , camerageroot ( http : //www.77169.org/exploits/2013/20130414031700 ) , a rooting tool for mtk6592 and addtional exploit . In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves . DragonOK appears to operate out of China 's Jiangsu Province .


nis : The su application used to execute shell commands with root privileges . PLATINUM has used several zero-day exploits against their victims . Moafee and DragonOK both use a well-known proxy tool – HUC Packet Transmit MAL ( HTRAN ) – to disguise their geographical locations .


mcpef.apk ( SHA256 : a8e7dfac00adf661d371ac52bddc03b543bd6b7aa41314b255e53d810931ceac ) : The malicious system application downloaded from server ( package name – com.android.music.helper ) . Even if CVE-2015-2546 affected Windows 10 , the exploitation would have required much more technical prowess to succeed ; ultimately , SMEP makes it more difficult for attackers . However , FireEye researchers do not have enough insight to reliably report a definitive connection to the Moafee and DragonOK groups .


This installs additional application from assets directory ( brother.apk ) and listens for PACKAGE_REMOVED events . For example , one zero-day vulnerability exploit ( CVE-2015-2545 ) used by PLATINUM was addressed immediately in September 2015 . Both Moafee and DragonOK favor spear-phishing emails as an attack vector , often employing a decoy to deceive the victim .


If brother.apk application is removed , mcpef.apk reinstalls brother.apk from assets . It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks . Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document .


brother.apk ( SHA256 : 422fec2e201600bb2ea3140951563f8c6fbd4f8279a04a164aca5e8e753c40e8 ) : The package name – com.android.system.certificate . In 2016 , an attack campaign by this group was recorded in early May that made use of an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player , which at the time was both unknown and unpatched . We observed Moafee running HTRAN proxies on their multiple Command and Control ( C2 ) servers – all operated on CHINANET , and hosted in Guangdong Province .


System application installed by mcpef.apk . To deliver the malware to the victim machines , the Rocke group exploits vulnerabilities in Apache Struts 2 , Oracle WebLogic , and Adobe ColdFusion . Like the Moafee group , we observed DragonOK running HTRAN to proxy their C2 servers , which are also operated on CHINANET but are hosted in the Jiangsu Province .


This has the same functionality as mcpef.apk . However , around a month ago , Rocke started targeting systems that run Jenkins by attempting to exploit CVE-2018-1000861 and CVE-2019-1003000 . Primarily focused on governments and military operations of countries with interests in the South China Sea , Moafee likely chooses its targets based on region 's rich natural resources .


In addition , it monitors to verify if com.android.music.helper package is removed . The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites . By targeting high-tech and manufacturing operations in Japan and Taiwan , DragonOK may be acquiring trade secrets for a competitive economic advantage .


If mcpef.apk is removed , brother.apk reinstalls it from a META-INF/brother file boy , post.sh : The shell scripts u sed for application persistency . In April , 2018 , the 360 Core Security takes the lead in capturing the APT-C-06 group’s new APT attack using 0-day vulnerabilities (CVE-2018-8174) in the wild . Security researchers subsequently linked these attacks to a broader , yearlong campaign that targeted not just Israelis but Palestinians as well .


Application lifecycle Application Lifecycle Google Bouncer Bypass On start , the application checks if it is executed on one of the Google servers : IP ranges 209.85.128.0-209.85.255.255 , 216.58.192.0-216.58.223.255 , 173.194.0.0-173.194.255.255 , 74.125.0.0-74.125.255.255 or if it is executed on IP hosted domain that contains the following strings : “ google ” , ” android ” , ” 1e100 ” . The group has demonstrated access to zero-day vulnerabilities (CVE-2018-0802) , and the ability to incorporate them into operations . and as discovered later , even the U.S. and UK governments .


If any of these conditions is true , the application does not continue to execute the malicious flow . FireEye observed a high volume of activity associated with the exploitation of CVE-2017-10271 following the public posting of proof of concept code in December 2017 . The second group , known as DragonOK , targets high-tech and manufacturing companies in Japan and Taiwan .


This method is design to bypass the automatic Google Play protection mechanism called Bouncer . If the lateral movement with credentials fails , then the malware uses PingCastle MS17-010 scanner (PingCastle is a French Active Directory security tool) to scan that particular host to determine if its vulnerable to EternalBlue , and uses it to spread to that host . In 2012 , the Molerats attacks appeared to rely heavily on the XtremeRAT , a freely available tool that is popular with attackers based in the Middle East .


Timebombs , Dynamic Code Loading and Reflection If Google Bouncer was not detected , the application starts a time bomb which initiates the malicious flow only after 20 seconds and will run every 2 hours . Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() . But the group has also used Poison Ivy ( PIVY ) , a RAT more commonly associated with threat actors in China — so much so that PIVY has , inaccurately , become synonymous with all APT attacks linked to China .


The time bomb triggers unpacker thread . We assess that the actors employing this latest Flash zero-day are a suspected North Korean group we track as TEMP.Reaper . This blog post analyzes several recent Molerats attacks that deployed PIVY against targets in the Middle East and in the U.S. We also examine additional PIVY attacks that leverage Arabic-language content related to the ongoing crisis in Egypt and the wider Middle East to lure targets into opening malicious files .


Unpacker thread decrypt java archive from assets directory “ start.ogg ” , and dynamically loads it and calls the method “ a.a.a.b ” from this archive . Figure 2: Zyklon attack flowInfection Techniques CVE-2017-8759 . We do not know whether using PIVY is an attempt by those behind the Molerats campaign to frame China-based threat actors for their attacks or simply evidence that they have added another effective , publicly-available RAT to its arsenal .


This method checks if eight hours have passed from the first run of application , and if so , request containing the device ’ s data to the server . This vulnerability was discovered by FireEye in September 2017 , and it is a vulnerability we have observed being exploited in the wild . We observed several attacks in June and July 2013 against targets in the Middle East and the U.S. that dropped a PIVY payload that connected to command-and-control ( CnC ) infrastructure used by the Molerats attackers .


The server sends back encoded json containing URL , class name and method name . Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly , we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office . The archive contains an .exe file , sometimes disguised as a Microsoft Word file , a video , or another file format , using the corresponding icon .


Then the application downloads java archive from the URL specified in json , dynamically loads it with class loader API . The other overlapping files are tools used by the adversary to locate other systems on the network etool.exe , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 checker1.exe and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) . In addition to DustySky , the attackers use publicly available tools such as the following Remote Administration Tools ( RAT ) : Poison Ivy , Nano Core , XtremeRAT , DarkComet and Spy-Net .


Once archive is loaded , the application uses reflection api to call methods from the class names specified in the json . The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell . DustySky ( called " NeD Worm " by its developer ) is a multi-stage malware in use since May 2015 .


Rooting and Ad Network Presentation The reflection loaded methods check if the device is rooted . We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 . It is in use by the Molerats ( aka Gaza cybergang ) , a politically motivated group whose main objective , we believe , is intelligence gathering .


If not , the application downloads a pack of exploits from the server and runs them one-by-one up until root is achieved . Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework . Operating since 2012 , the Molerats group 's activity has been reported by Norman , Kaspersky , FireEye , and PwC .


As root , the application copies su binary to /system/bin directory and silently downloads apk file from the server . According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . DustySky has been developed and used since May 2015 by Molerats ( aka " Gaza cybergang " ) , a terrorist group whose main objective in this campaign is intelligence gathering .


Then , the APK is installed as system application and registers listener on USER_PRESENT event . According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . Most targets are from the Middle East : Israel , Egypt , Saudi Arabia , United Arab Emirates and Iraq .


This event triggers archive downloading thread . Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 . The United States and countries in Europe are targeted as well .


Once the event is triggered , it registers a timer . The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . The sample analyzed is f589827c4cf94662544066b80bfda6ab from late August 2015 .


The timer triggers additional thread which makes a request to the server . APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . The MuddyWater attacks are primarily against Middle Eastern nations .


It expects a json with url , class and method name . The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . However , we have also observed attacks against surrounding nations and beyond , including targets in India and the USA .


It downloads one more archive and dynamically loads code from it . APT28 is using novel techniques involving the EternalBlue exploit and the open source tool Responder to spread laterally through networks and likely target travelers . Targeted sectors of Molerats include governmental and diplomatic institutions , including embassies ; companies from the aerospace and defence Industries ; financial institutions ; journalists ; software developers .


The final APK is downloaded from a different URL that is currently down , we assume that the apk purpose is overlaying ads on the screen , we assume this based on the research we have done on the API we found which returns URL of random APK file containing different advertising networks . The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 . The Palo Alto Networks Unit 42 research team recently came across a series of malicious files which were almost identical to those targeting the Saudi Arabian government previously discussed by MalwareBytes .


Persistency Watch-Dog The application contains protection against its own removal . We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit . MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call " POWERSTATS " .


As outlined in the diagram above , It installs an additional application with the same functionality and these two applications monitor the removal of each other . FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East , we were somewhat confused as the previous public reporting had attributed these attacks to FIN7 .


If one of the applications is deleted , the second application downloads and re-installs the removed one . FireEye iSIGHT Intelligence confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . FIN7 is a threat actor group that is financially motivated with targets in the restaurant , services and financial sectors .


Network activity BrainTest communicates with five servers : APK files provider ( http : //psserviceonline [ . A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . Following the trail of existing public reporting , the tie to FIN7 is essentially made based on a download observed from a MuddyWater C2 , of a non-public tool " DNSMessenger " .


] com/ ) : This server provides APK files with advertising network . A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . There was a mistake in the original Morphisec analysis which linked these attacks to FIN7 .


We found two functions : The first function is http : //s.psserviceonline [ . Kaspersky found the BlackOasis group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . The DNSMessenger malware is a shared tool , used by FIN7 , MuddyWater and perhaps other groups .


] com/api/s2s/tracks/ and is used for activation . Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . In September 2018 , we found evidence of Seedworm and the espionage group APT28 ( aka Swallowtail , Fancy Bear ) , on a computer within the Brazil-based embassy of an oil-producing nation .


The second function is http : //s.psserviceonline [ . BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded .


] com/api/ads/ which is used for obtaining a link to APK file . The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . Seedworm likely functions as a cyber espionage group to secure actionable intelligence that could benefit their sponsor 's interests .


Regardless of the parameters , it returns a json containing a link for APK file . BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . During the operations , the group used tools consistent with those leveraged during past intrusions including Powermud , a custom tool used by the Seedworm group , and customized PowerShell , LaZagne , and Crackmapexec scripts .


File Server ( http : //www.psservicedl [ . The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . The Seedworm group controls its Powermud backdoor from behind a proxy network to hide the ultimate command-and-control ( C&C ) location .


] com ) : Contains android packages , java archives and zip archives with exploits Archive Link domains : Three domains with the same functionality , but the application chooses one of them to send request for archive link . While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization . After compromising a system , typically by installing Powermud or Powemuddy , Seedworm first runs a tool that steals passwords saved in users ' web browsers and email , demonstrating that access to the victim 's email , social media , and chat accounts is one of their likely goals .


http : //www.himobilephone [ . While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization . Seedworm then uses open-source tools such as LaZagne and Crackmapexec to obtain Windows authorization credentials .


] com http : //www.adsuperiorstore [ . Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data exfiltration and to provide remote access to infected machines . The group , which we call Seedworm ( aka MuddyWater ) , has been operating since at least 2017 , with its most recent activity observed in December 2018 .


] com http : //www.i4vip [ . If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation . The Seedworm group is the only group known to use the Powermud backdoor .


] com Counter Measures Use an up to date anti-malware software that is capable of identifying this threat . To enable connections to the infected computer using the Remote Desktop Protocol ( RDP ) , Carbanak sets Termservice service execution mode to Auto . Additionally , the group compromised organizations in Europe and North America that have ties to the Middle East .


If the threat reappears on the device after the first installation , it means that the malware managed to install the persistency module in the System directory . Carbanak is also aware of the IFOBS banking application and can , on command , substitute the details of payment documents in the IFOBS system . MuddyWater is an Iranian high-profile threat actor that 's been seen active since 2017 .


In this case , the device should be re-flashed with an official ROM . Sensitive bank documents have be found on the servers that were controlling Carbanak . Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn't possible for us to verify this link .


Lookout Discovers Phishing Sites Distributing New IOS And Android Surveillanceware April 8 , 2019 For the past year , Lookout researchers have been tracking Android and iOS surveillanceware , that can exfiltrate contacts , audio recordings , photos , location , and more from devices . Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa . Over the past year , we've seen the group extensively targeting a wide gamut of entities in various sectors , including Governments , Academy , Crypto-Currency , Telecommunications and the Oil sectors .


As has been previously reported , some versions of the Android malware were present in the Google Play Store . We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn't possible for us to verify this link .


The iOS versions were available outside the app store , through phishing sites , and abused the Apple Developer Enterprise program . This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies . Depending on each sample , the content of document is either a fake resume application , or a letter from the Ministry of Justice in Lebanon or Saudi Arabia .


Background : Android surveillanceware Early last year , Lookout discovered a sophisticated Android surveillanceware agent that appears to have been created for the lawful intercept market . Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . Analysts in our DeepSight Managed Adversary and Threat Intelligence ( MATI ) team have found a new backdoor , Backdoor.Powemuddy , new variants of Seedworm 's Powermud backdoor ( aka POWERSTATS ) , a GitHub repository used by the group to store their scripts , as well as several post-compromise tools the group uses to exploit victims once they have established a foothold in their network .


The agent appears to have been under development for at least five years and consists of three stages . From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space . From January 2018 to March 2018 , through FireEye 's Dynamic Threat Intelligence , we observed attackers leveraging the latest code execution and persistence techniques to distribute malicious macro-based documents to individuals in Asia and the Middle East .


First , there is a small dropper , then a large second stage payload that contains multiple binaries ( where most of the surveillance functionality is implemented ) , and finally a third stage which typically uses the DirtyCOW exploit ( CVE-2016-5195 ) to obtain root . Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems . MuddyWater has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia .


Security Without Borders has recently published an analysis of this family , independently , through their blog . To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer . This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia .


Several technical details indicated that the software was likely the product of a well-funded development effort and aimed at the lawful intercept market . Additionally the reports on Carbanak show a different picture , where banks targeted outside of Russia , specifically Europe , USA and Japan are mentioned , which does not match our research . When successfully executed , the malicious documents install a backdoor we track as POWERSTATS .


These included the use of certificate pinning and public key encryption for C2 communications , geo-restrictions imposed by the C2 when delivering the second stage , and the comprehensive and well implemented suite of surveillance features . These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider . The group is known for espionage campaigns in the Middle East .


Early versions of the Android application used infrastructure which belonged to a company named Connexxa S.R.L . The leader of the crime gang behind the Carbanak and Cobalt malware attacks targeting over a 100 financial institutions worldwide has been arrested in Alicante , Spain , after a complex investigation conducted by the Spanish National Police . The threat group in this recently observed campaign – TEMP.Zagros – weaponized their malware using the following techniques .


and were signed using the name of an engineer who appears to hold equity in Connexxa . Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt . The MuddyWater campaign was first sighted in 2017 when it targeted the Saudi government using an attack involving PowerShell scripts deployed via Microsoft Office Word macro .


This engineer ’ s name is also associated with a company called eSurv S.R.L . Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent . The threat group in this recently observed campaign a TEMP.Zagros a weaponized their malware using the following techniques .


eSurv ’ s public marketing is centered around video surveillance software and image recognition systems , but there are a number of individuals claiming to be mobile security researchers working at the company , including one who has publically made claims to be developing a mobile surveillance agent . Just a few months later , in February 2015 , we announced the discovery of Carbanak , a cyber-criminal gang that used custom malware and APT techniques to steal millions of dollars while infecting hundreds of financial institutions in at least 30 countries . Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload .


Moreover , eSurv was a business unit of Connexxa and was leased to eSurv S.R.L in 2014 . However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . MuddyWater is a relatively new APT that surfaced in 2017 .


This business unit and the eSurv software and brand was sold from Connexxa S.R.L . In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company . We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro as MuddyWater ) , an Iran-nexus actor that has been active since at least May 2017 .


to eSurv S.R.L . This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 . We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro ) , an Iran-nexus actor that has been active since at least May 2017 .


on Feb 28 , 2016 . Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . Entities in these sectors are often " enabling victims " as telecommunications providers or IT services agencies and vendors could provide Seedworm actors with further victims to compromise .


Lookout notified Google of the potential threat shortly after it was discovered . While the URL acts similarly to how eye-watch.in : 443 delivers payloads , we also saw the URL leveraging and exploiting security flaws in Flash : CVE-2015-8651 , CVE-2016-1019 , and CVE-2016-4117 . The group mainly targets the telecommunications and IT services sectors .


Together , during the latter half of 2018 , we worked to remove the apps from the Play store while it was being deployed in the wild . The exploit , which takes advantage of CVE-2018-4878 , allows an attacker to execute arbitrary code such as an implant . However , the group behind MuddyWater has been known to target other countries in the Middle East , Europe and the US .


iOS development Analysis of these Android samples led to the discovery of infrastructure that contained several samples of an iOS port . Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal . The group has focused mainly on governmental targets in Iraq and Saudi Arabia , according to past telemetry .


So far , this software ( along with the Android version ) has been made available through phishing sites that imitated Italian and Turkmenistani mobile carriers . WannaCry utilizes EternalBlue by crafting a custom SMB session request with hard-coded values based on the target system . The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros .


Wind Tre SpA - an Italian telecom operator TMCell - the state owned mobile operator in Turkmenistan Deployment to users outside Apple ’ s app store was made possible through abuse of Apple ’ s enterprise provisioning system . WannaCry leverages an exploit , codenamed " EternalBlue " , that was released by the Shadow Brokers on April 14 , 2017 . MuddyWater has recently been targeting victims likely from Lebanon and Oman , while leveraging compromised domains , one of which is owned by an Israeli web developer .


The Apple Developer Enterprise program is intended to allow organizations to distribute proprietary , in-house apps to their employees without needing to use the iOS App Store . Microsoft addressed the SMBv1 vulnerabilities in March 2017 with Security Bulletin MS17-010 . As MuddyWater has consistently been using POWERSTATS as its main tool , they are relatively easy to distinguish from other actors .


A business can obtain access to this program only provided they meet requirements set out by Apple . The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April . In March 2018 , Trend Micro provided a detailed analysis of another campaign that bore the hallmarks of MuddyWater .


It is not common to use this program to distribute malware , although there have been past cases where malware authors have done so . If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign .


Each of the phishing sites contained links to a distribution manifest , which contained metadata such as the application name , version , icon , and a URL for the IPA file . Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign .


To be distributed outside the app store , an IPA package must contain a mobile provisioning profile with an enterprise ’ s certificate . The EternalBlue exploit from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 . Given the use of lure documents designed with social engineering in mind , it is likely that MuddyWater use phishing or spam to target users who are unaware of these documents ' malicious nature .


All these packages used provisioning profiles with distribution certificates associated with the company Connexxa S.R.L . The Leafminer operators use EternalBlue to attempt lateral movement within target networks from compromised staging servers . We recently noticed the group behind MuddyWater that appear to be targeting government bodies , military entities , telcos and educational institutions in Jordan , Turkey , Azerbaijan and Pakistan , in addition to the continuous targeting of Iraq and Saudi Arabia , other victims were also detected in Mali , Austria , Russia , Iran and Bahrain. .


Certificate Used The apps themselves pretended to be carrier assistance apps which instructed the user to “ keep the app installed on your device and stay under Wi-Fi coverage to be contacted by one of our operators ” . Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address . Observed Seedworm victims were located primarily in Pakistan and Turkey , but also in Russia , Saudi Arabia , Afghanistan , Jordan , and elsewhere .


One of the packages after initial launch The iOS variant is not as sophisticated as the Android version , and contained a subset of the functionality the Android releases offered . The attachments exploited CVE-2017-8759 which was discovered and documented only five days prior to the campaign . The MuddyWaters group has carried out a large number of attacks and demonstrated advanced social engineering , in addition to the active development of attacks , infrastructure and the use of new methods and techniques .


In particular , these packages have not been observed to contain or to download exploits which would be required to perform certain types of activities on iOS devices . Some of the documents exploited CVE-2017-0199 to deliver the payload . Cisco Talos assesses with moderate confidence that a campaign we recently discovered called " BlackWater " is associated with suspected persistent threat actor MuddyWater .


Even without capabilities to exploit a device , the packages were able to exfiltrate the following types of data using documented APIs : Contacts Audio recordings Photos Videos GPS location Device information In addition , the packages offered a feature to perform remote audio recording . The group 's capabilities are more than the much discussed CVE-2012-0158 exploits over the past few years . In this latest activity , BlackWater first added an obfuscated Visual Basic for Applications ( VBA ) script to establish persistence as a registry key .


Though different versions of the app vary in structure , malicious code was initialized at application launch without the user ’ s knowledge , and a number of timers were setup to gather and upload data periodically . Instead , the Spring Dragon group is known to have employed spearphish exploits , strategic web compromises , and watering holes attack . Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater .


Upload data was queued and transmitted via HTTP PUT requests to an endpoint on the C2 . The group 's spearphish toolset includes PDF exploits , Adobe Flash Player exploits , and the common CVE-2012-0158 Word exploits including those generated from the infamous " Tran Duy Linh " kit . MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East .


The iOS apps leverage the same C2 infrastructure as the Android version and use similar communications protocols . While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past , Spring Dragon employs more involved and creative intrusive activity as well . Between February and March 2019 , probable MuddyWater-associated samples indicated that BlackWater established persistence on the compromised host , at used PowerShell commands to enumerate the victim 's machine and contained the IP address of the actor 's command and control ( C2 ) .


Push notifications were also used to control audio recording . To mitigate the threat of the described campaign , security teams can consider blocking access to the C2 server 103.236.150.14 and , where applicable , ensure that the Microsoft Security Update KB2553204 is installed in order to patch the CVE-2017-11882 vulnerability . Despite last month 's report on aspects of the MuddyWater campaign , the group is undeterred and continues to perform operations .


Lookout has shared information about this family with Apple , and they have revoked the affected certificates . The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign . Based on these observations , as well as MuddyWater 's history of targeting Turkey-based entities , we assess with moderate confidence that this campaign is associated with the MuddyWater threat actor group .


As a result , no new instances of this app can be installed on iOS devices and existing installations can no longer be run . Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 . Our recent report , " The Chronicles of the Hellsing APT : the Empire Strikes Back " began with an introduction to the Naikon APT , describing it as " One of the most active APTs in Asia , especially around the South China Sea " .


Lookout customers are also protected from this threat on both Android and iOS . Lotus Blossom attempted to exploit CVE-2014-6332 using the POC code available in the wild . It came in the form of a " Tran Duy Linh " CVE-2012-0158 exploit kit document MD5 : de8a242af3794a8be921df0cfa51885f61 and was observed on April 10 , 2014 .


Android Trojan Found in Targeted Attack 26 MAR 2013 In the past , we ’ ve seen targeted attacks against Tibetan and Uyghur activists on Windows and Mac OS X platforms . Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 . Considering the volume of Naikon activity observed and its relentless , repeated attack attempts , such a confrontation was worth looking into , so we did .


We ’ ve documented several interesting attacks ( A Gift for Dalai Lamas Birthday and Cyber Attacks Against Uyghur Mac OS X Users Intensify ) which used ZIP files as well as DOC , XLS and PDF documents rigged with exploits . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . The attackers appeared to be Chinese-speaking and targeted mainly top-level government agencies and civil and military organizations in countries such as the Philippines , Malaysia , Cambodia , Indonesia , Vietnam , Myanmar , Singapore , Nepal , Thailand , Laos and China .


Several days ago , the e-mail account of a high-profile Tibetan activist was hacked and used to send targeted attacks to other activists and human rights advocates . In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch . The oil and gas infrastructure nexus observed in connection with greensky27.vicp.net and other Unit 78020 ( Naikon ) infrastructure suggests targeting patterns supportive of the PRC 's strategic interests over energy resources within the South China Sea and Southeast Asia .


Perhaps the most interesting part is that the attack e-mails had an APK attachment – a malicious program for Android . PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 . This Naikon report will be complemented by a follow-on report that will examine the Naikon TTP and the incredible volume of attack activity around the South China Sea that has been going on since at least 2010 .


The attack On March 24th , 2013 , the e-mail account of a high-profile Tibetan activist was hacked and used to send spear phishing e-mails to their contact list . Just recently , PIVY was the payload of a zero-day exploit in Internet Explorer used in what is known as a " strategic web compromise " attack against visitors to a U.S. government website and a variety of others . The attackers appeared to be Chinese-speaking and targeted mainly top-level government agencies and civil and military organizations in countries such as the Philippines , Malaysia , Cambodia , Indonesia , Vietnam , Myanmar , Singapore , Nepal .


This is what the spear phishing e-mail looked like : In regards to the message text above , multiple activist groups have recently organized a human rights conference event in Geneva . It came in the form of a " Tran Duy Linh " CVE-2012-0158 exploit kit document MD5 : de8a242af3794a8be921df0cfa51885f61 and was observed on April 10 , 2014 . This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent .


We ’ ve noticed an increase in the number of attacks using this event as a lure . This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . In the Naikon scheme , a C&C server can be specialized XSControl software running on the host machine .


Here ’ s another example of such an attack hitting Windows users : Going back to the Android Package ( APK ) file was attached to the e-mail , this is pushing an Android application named “ WUC ’ s Conference.apk ” . PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched . It was during operator X 's network monitoring that the attackers placed Naikon proxies within the countries ' borders , to cloak and support real-time outbound connections and data Exfiltration from high-profile victim organizations .


This malicious APK is 334326 bytes file , MD5 : 0b8806b38b52bebfe39ff585639e2ea2 and is detected by Kaspersky Lab products as “ Backdoor.AndroidOS.Chuli.a ” . PROMETHIUM and NEODYMIUM both used a zero-day exploit that executed code to download a malicious payload . In addition to stealing keystrokes , Naikon also intercepted network traffic .


After the installation , an application named “ Conference ” appears on the desktop : If the victim launches this app , he will see text which “ enlightens ” the information about the upcoming event : The full text reads follows . NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used , prior to public knowledge of the vulnerability 's existence . Operator X also took advantage of cultural idiosyncrasies in its target countries , for example , the regular and widely accepted use of personal Gmail accounts for work .


Notice notice the use of the mistaken “ Word ” instead of “ World ” : “ On behalf of all at the Word Uyghur Congress ( WUC ) , the Unrepresented Nations and Peoples Organization ( UNPO ) and the Society for Threatened Peoples ( STP ) , Human Rights in China : Implications for East Turkestan , Tibet and Southern Mongolia In what was an unprecedented coming-together of leading Uyghur , Mongolian , Tibetan and Chinese activists , as well as other leading international experts , we were greatly humbled In May 2016 , two apparently unrelated activity groups , PROMETHIUM and NEODYMIUM , conducted attack campaigns in Europe that used the same zeroday exploit while the vulnerability was publicly unknown . In the spring of 2014 , we noticed an increase in the volume of attack activity by the Naikon APT .


by the great enthusiasm , contribution and desire from all in attendance to make this occasion something meaningful , the outcome of which produced some concrete , action-orientated solutions to our shared grievances . The Middle Eastern hacker group in this case is codenamed " BlackOasis " Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . In particular , we noticed that the Naikon group was spear-phished by an actor we now call " Hellsing " .


We are especially delighted about the platform and programme of work established in the declaration of the conference , upon which we sincerely hope will be built a strong and resolute working relationship on our shared goals for the future . The discovery by Kaspersky marks at least the fifth zero-day exploit used by BlackOasis and exposed by security researchers since June 2015 . More details about the cloak and dagger games between Naikon and Hellsing can be found in our blogpost : " The Chronicles of the Hellsing APT : The Empire Strikes Back " .


With this in mind , we thoroughly look forward to working with you on these matters . Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14 , 2017 , FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East . Truvasys has been involved in several attack campaigns , where it has masqueraded as one of server common computer utilities , including WinUtils , TrueCrypt , WinRAR , or SanDisk .


Dolkun lsa Chairman of the Executive Committee Word Uyghur Congress ” While the victim reads this fake message , the malware secretly reports the infection to a command-and-control server . The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 . PROMETHIUM is an activity group that has been active as early as 2012 .


After that , it begins to harvest information stored on the device . In this latest campaign , APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER . The group primarily uses Truvasys , a first-stage malware that has been in circulation for several years .


The stolen data includes : Contacts ( stored both on the phone and the SIM card ) . During the past few months , APT34 has been able to quickly incorporate exploits for at least two publicly vulnerabilities ( CVE-2017-0199 and CVE-2017-11882 ) to target organizations in the Middle East . NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird .


Call logs . In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch . PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched .


SMS messages . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks .


Geo-location . Specifically , Suckfly used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows . In early May 2016 , both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe .


Phone data ( phone number , OS version , phone model , SDK version ) . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . Meanwhile , NEODYMIUM used well-tailored spear-phishing emails with attachments that delivered the exploit code , ultimately leading to Wingbird 's installation on victim computers .


It is important to note that the data won ’ t be uploaded to C & C server automatically . This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . PROMETHIUM and NEODYMIUM both used a zero-day exploit that executed code to download a malicious payload .


The Trojan waits for incoming SMS messages ( the “ alarmReceiver.class ” ) and checks whether these messages contain one of the following commands : “ sms ” , “ contact ” , “ location ” , “ other ” . Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 . Wingbird , the advanced malware used by NEODYMIUM , has several behaviors that trigger alerts in Windows Defender ATP .


If one these commands is found , then the malware will encode the stolen data with Base64 and upload it to the command and control server . TG-3390 uses older exploits to compromise targets , and CTU researchers have not observed the threat actors using zero-day exploits as of this publication . This volume chronicles two activity groups , code-named PROMETHIUM and NEODYMIUM , both of which target individuals in a specific LOC of Europe .


The C2 URL is : hxxp : //64.78.161.133/ * victims ’ s_cell_phone_number * /process.php In addition to this , the malware also reports to another script , “ hxxp : //64.78.161.33/android.php ” . TG-3390 actors have used Java exploits in their SWCs . Although most malware today either seeks monetary gain or conducts espionage for economic advantage , both of these activity groups appear to seek information about specific individuals .


First , it will get the “ nativenumber ” variable from the “ telmark ” value of “ AndroidManifest.xml ” . In particular , TG-3390 has exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code . In May 2016 , both PROMETHIUM and NEODYMIUM were observed to launch attack campaigns .


This is hardcoded and equals “ phone ” . In particular , the threat actors have exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code . NEODYMIUM is an activity group that , like PROMETHIUM , conducted an attack campaign in early May 2016 .


Then , it will add the result of the public method localDate.getTime ( ) , which simply gets the current date . TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems . Data about Wingbird activity indicates that it is typically used to attack individuals and individual computers instead of networks .


An example of the string which is sent to the command-and-control would be “ phone 26.03.2013 ” . Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 ( Microsoft Office Equation Editor , widely used by Chinese-speaking actors since December 2017 ) , we can′t prove they were related to this particular attack . NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used , prior to public knowledge of the vulnerability 's existence .


It is interesting that the attackers used Java Base64 library developed by Sauron Software . LuckyMouse has been spotted using a widely used Microsoft Office vulnerability ( CVE-2017-11882 ) . NEODYMIUM used a backdoor detected by Windows Defender as Wingbird , whose characteristics closely match FinFisher , a government-grade commercial surveillance package .


This software is free and distributed under LGPL license . No zero-day vulnerabilities were used to breach targeted networks , instead " TG-3390 relied on old vulnerabilities such as CVE-2011-3544 " — a near-year-old Java security hole — " and CVE-2010-0738 to compromise their targets " , Dell SecureWorks' researchers reported . In May 2016 , two apparently unrelated activity groups , PROMETHIUM and NEODYMIUM , conducted attack campaigns in Europe that used the same zeroday exploit while the vulnerability was publicly unknown .


Also , command communications with the malware are parsed with a function named “ chuli ( ) ” prior to POSTing stolen data to the command-and-control server . Execute a command through exploits for CVE-2017-11882 . The Middle Eastern hacker group in this case is codenamed " BlackOasis " Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


It appears that the attackers are somewhat familiar with the language and mountain-trekking culture of the targets – the meaning of “ chuli ” is “ summit ” : The command-and-control server and parameters can be easily seen in the decompiled source code : Command and control server interaction code Throughout the code , the attackers log all important actions , which include various messages in Chinese . Execute a command through exploits for CVE-2018-0802 . FinSpy , a final-stage payload that allows for an attacker to covertly learn what a target is talking about and who they are communicating with , is associated with Gamma Group — which goes by other names , including FinFisher and Lench IT Solutions .