Super Mario Run Malware # 2 – DroidJack RAT Gamers love Mario and Pokemon , but so do malware authors . The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors . From April 19-24 , 2017 , a politically-motivated , targeted campaign was carried out against numerous Israeli organizations . The new exploit method bypasses URL rewrite mitigations for the endpoint provided by Microsoft in response to •


A few days back , we wrote about an Android Marcher trojan variant posing as the Super Mario Run game for Android . The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China . Morphisec researchers began investigating the attacks on April 24 and continue to uncover more details . As we commonly see in the ransomware space , this threat is delivered through a variety of mechanisms which can include phishing and being dropped as secondary payloads from command and control ( C2 ) frameworks like Cobalt Strike .


We have found another instance of malware posing as the Super Mario Run Android app , and this time it has taken the form of DroidJack RAT ( remote access trojan ) . Multiple China-based cyber threat groups have targeted international media organizations in the past . Initial reports of the attacks , published April 26 ( in Hebrew ) by the Israel National Cyber Event Readiness Team ( CERT-IL ) and The Marker , confirm that the attack was delivered through compromised email accounts at Ben-Gurion University and sent to multiple targets across Israel . Indicators can be automatically sent to your security tools , like secure email gateway and firewalls , to respond and block threats in realtime .


Proofpoint wrote about the DroidJack RAT side-loaded with the Pokemon GO app back in July 2016 ; the difference here is that there is no game included in the malicious package . The admin@338 has targeted international media organizations in the past . Ironically , Ben-Gurion University is home to Israel ’s Cyber Security Research Center . So , if you get a bunch of messages from strangers , do n't click on the links , and do n’t click on any attachments .


The authors are trying to latch onto the popularity of the Super Mario Run game to target eagerly waiting Android users . In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television . Investigators put the origin of the attack as Iranian ; Morphisec ’s research supports this conclusion and attributes the attacks to the same infamous hacker group responsible for the OilRig malware campaigns . This sample works in tandem with PIEHOP , which sets up the execution .


Details : Name : Super Mario Run Package Name : net.droidjack.server MD5 : 69b4b32e4636f1981841cbbe3b927560 Technical Analysis : The malicious package claims to be the Super Mario Run game , as shown in the permissions screenshot below , but in reality this is a malicious RAT called DroidJack ( also known as SandroRAT ) that is getting installed . In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television . The fileless attack was delivered via Microsoft Word documents that exploited a former zero-day vulnerability in Word , CVE-2017-0199 , to install a fileless attack variant of the Helminth Trojan agent . For more information , contact : intelreports@kaspersky.comPowerShell event logs for the creation of an arbitrary process from PowerShell .


Once installed , the RAT registers the infected device as shown below . In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations . Microsoft released the patch for the vulnerability on April 11 , but many organizations have not yet deployed the update . Our initial investigation on the domains registered by Hack520 revealed that similar domains ( listed below ) were registered by another profile .


DroidJack RAT starts capturing sensitive information like call data , SMS data , videos , photos , etc . The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences . The attackers actually based their attack on an existing Proof-of-Concept method that was published by researchers after the patch release . In the case of the exploit method described here as OWASSRF , the endpoint is not used , in lieu , and the request will not be dropped .


Observe below the code routine for call recording . Once the LOWBALL malware calls back to the Dropbox account , the admin@338 will create a file called upload.bat which contains commands to be executed on the compromised computer . By hunting through known malware repositories , Morphisec identified matching samples uploaded by Israeli high-tech development companies , medical organizations and education organizations , indicating that they were victims of the attack . The vulnerability , which could allow attackers to gain escalated privileges and unauthorized access to an environment , was first disclosed on May 31st in a security bulletin released by Progress .


This RAT records all the calls and stores the recording to an “ .amr ” file . We observed the admin@338 upload a second stage malware , known as BUBBLEWRAP ( also known as Backdoor.APT.FakeWinHTTPHelper ) to their Dropbox account along with the following command . For security purposes , Morphisec is not revealing these names . We have seen this algorithm deployed by other groups before , either as a standalone encryption algorithm or as part of a more custom approach .


The following is the code routine for video capturing . We have previously observed the admin@338 group use BUBBLEWRAP . Upon deeper investigation into the installed Helminth fileless agent , we identified a near perfect match to the OilRig campaign executed by an Iranian hacker group against 140 financial institutions in the Middle East last year , as analyzed by FireEye , Palo Alto Networks and Logrhythm . In late 2022 , Mandiant responded to a disruptive cyber physical incident in which the Russia - linked threat actor Sandworm targeted a Ukrainian critical infrastructure organization .


Here , the RAT stores all the captured videos in a “ video.3gp ” file . The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets . This group has become one of the most active threat actors , with noteworthy abilities , resources and infrastructure ; speculations indicate the hacking organization to be sponsored by the Iranian government . The code hunted for several security products to evade – including Kaspersky .


It also harvests call details and SMS logs as shown below . The admin@338 linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong . In other recent attacks ( January 2017 ) , the group used a fake Juniper Networks VPN portal and fake University of Oxford websites to deliver malware as described by ClearSky . UNC2452 is a sophisticated group that has targeted government and private sector entities worldwide .


Upon further inspection , we have observed that this RAT extracts WhatsApp data too . An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong . Name SHA256 . If more groups start adopting CL0P 's zero - day exploitation techniques , the ransomware landscape could tilt from service - oriented attacks to a more aggressive , vulnerability - focused model — a move that could skyrocket the impact of attacks .


The RAT stores all the data in a database ( DB ) in order to send it to the Command & Control ( C & C ) server . The group targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy . 13.doc : a9bbbf5e4797d90d579b2cf6f9d61443dff82ead9d9ffd10f3c31b686ccf81ab . We mentioned Akamai 's blog but it was also documented by Recorded Future .


The following are the DBs created and maintained by the RAT . The agroup targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy . 558.doc , 2.doc: 2869664d456034a611b90500f0503d7d6a64abf62d9f9dd432a8659fa6659a84 . CrowdStrike researchers replicated the exploit method attack on Exchange systems that had not received the November 8 , 2022 patch KB5019758 , but could not replicate the attack on systems that had received that patch .


We saw the following hardcoded C & C server location in the RAT package : Conclusion : The DroidJack RAT is another example of a growing trend in which malware authors seek to exploit public interest as a way to spread malware . The admin@338 , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors . 1.doc : 832cc791aad6462687e42e40fd9b261f3d2fbe91c5256241264309a5d437e4d8 . Mandiant is not aware of any configuration change that can be made to force request logging for these endpoints .


In this case , like others before , the event of a popular game release became an opportunity to trick unsuspecting users into downloading the RAT . The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors . 3.doc : d4eb4035e11da04841087a181c48cd85f75c620a84832375925e6b03973d8e48 . The second , CVE-2022 - 41080 , has not been publicly detailed but its CVSS score of 8.8 is the same as CVE-2022 - 41040 used in the ProxyNotShell exploit chain , and it has been marked “ exploitation more likely . ”


As a reminder , it is always a good practice to download apps only from trusted app stores such as Google Play . In August 2013 , FireEye reported that admin@338 had been using the Poison Ivy RAT in its operations . The most notable difference from last year ’s OilRig campaign is the way the attack was delivered . During the investigation , Mandiant observed the threat actor target four ( 4 ) OSX Ventura systems running either versions 13.3 or 13.4.1 .


This practice can be enforced by unchecking the " Unknown Sources '' option under the " Security '' settings of your device . In March 2014 , the admin@338 leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank . In the previous campaign , the Iranian group sent specially crafted Excel and Word files , which contained macros that targeted individuals were convinced to enable . However , over time , it becomes tedious for fraudsters to constantly change information when registering new domains .


XLoader Disguises as Android Apps , Has FakeSpy Links This new XLoader variant poses as a security app for Android devices , and uses a malicious iOS profile to affect iPhone and iPad devices . In March 2014 , the group leveraged the disappearance of Malaysia Airlines Flight MH370 to target a government in the Asia-Pacific region and a US-based think tank . Name Delivery Server . COSMICENERGY is the latest example of specialized OT malware capable of causing cyber physical impacts , which are rarely discovered or disclosed .


By : Hara Hiroaki , Lilang Wu , Lorin Wu April 02 , 2019 In previous attacks , XLoader posed as Facebook , Chrome and other legitimate applications to trick users into downloading its malicious app . According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . test4.hta http://comonscar.in ( 82.145.40.46 ) . PIEHOP expects its main function to be called via another Python file , supplying either the argument or .


Trend Micro researchers found a new variant that uses a different way to lure users . According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . test5.hta 80.82.67.42 . Would you click on the links in the email , even if it came from an address you did nt recognize If you have old vacation pictures on Facebook , a determined hacker could use them to write such an email , and cyber criminals are starting to use that kind of information to craft targets specifically for their victims .


This new XLoader variant poses as a security app for Android devices , and uses a malicious iOS profile to affect iPhone and iPad devices . The admin@338 's Dropbox accounts have also been found to contain a different backdoor dubbed BUBBLEWRAP . test1.hta reserved . By selecting these links , you will be leaving NIST webspace .


Aside from a change in its deployment techniques , a few changes in its code set it apart from its previous versions . Researchers have pointed out that it is not uncommon for China-based threat groups to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement . SHA256: 5ac61ea5142d53412a251eb77f2961e3334a00c83da9087d355a49618220ac43 . The IP range for “ PIG GOD ” is 43[.]255[.]188.0/22 , which appears to be hosted in Hong Kong as seen in the information we found : The domain 66[.]to leads to another website that shows Hack520 ’s pet pig .


This newest variant has been labeled XLoader version 6.0 ( detected as AndroidOS_XLoader.HRXD ) , following the last version discussed in a previous research on the malware family . Researchers have pointed out that it is not uncommon for admin@338 to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement . Name SHA256 . " The server was used to distribute and infect victims with an upgraded version of Rising Sun with SSL capabilities , " informs a report shared with BleepingComputer .


Infection chain The threat actors behind this version used several fake websites as their host — copying that of a Japanese mobile phone operator ’ s website in particular — to trick users into downloading the fake security Android application package ( APK ) . This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose . 0011.ps1 042F60714E9347DB422E1A3A471DC0301D205FFBD053A4015D2B509DB92029D1 . If the main function is called with only , it will only perform its cleanup routine and immediately terminate .


Monitoring efforts on this new variant revealed that the malicious websites are spread through smishing . The attackers used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials . 1.vbs BE7F1D411CC4160BB221C7181DA4370972B6C867AF110C12850CAD77981976ED . None Organizations should apply the November 8 , 2022 patches for Exchange to prevent exploitation since the URL rewrite mitigations for ProxyNotShell are not effective against this exploit method .


The infection has not spread very widely at the time of writing , but we ’ ve seen that many users have already received its SMS content . The admin@338 used the popular Poison Ivy RAT and WinHTTPHelper malware to compromise the computers of government officials . A Glimpse into Glimpse For the second blog post in our series, the IronNet Threat Research Team examines the Glimpse malware that is written in PowerShell and has been associated with OilRig S-APT/APT34 . Instead , it ’s likely that Royal is simply testing a new encryptor — especially considering that BlackSuit was used in just two attacks last month — and that this lull can be explained as more or less of a research period for them .


In the past , XLoader showed the ability to mine cryptocurrency on PCs and perform account phishing on iOS devices . FireEye analysts documented the admin@338 group 's activities in a previous paper titled Poison Ivy : Assessing Damage and Extracting Intelligence paper . Our first post about analyzing malware with DNS tunneling capabilities focuses on how the PoisonFrog malware uses DNS tunneling to send and receive victim information and commands . If this is a potential threat vector for the organization , dual controls need to be put in place .


This new wave also presents unique attack vectors based on the kind of device it has accessed . The spear-phishing campaign against Asian entities isn't isolated , the admin@338 also started another attack against the US-based think tank on 14th March . Glimpse : 6e86c57385d26a59c0df1580454b9967 . In terms of the fallout , it ’s tough to overstate the havoc Cl0p was able to wreck thanks to the zero - day .


In the case of Android devices , accessing the malicious website or pressing any of the buttons will prompt the download of the APK . Our analysis has led us to conclude that APT1 is likely government-sponsored and one of the most persistent of China 's cyber threat actors . Glimpse is a PowerShell script that is executed silently by Visual Basic . The victims in this campaign a government in Asia and a telecommunications company in the Middle East do align with the kinds of victims we often see Budworm targeting .


However , successfully installing this malicious APK requires that the user has allowed the installation of such apps as controlled in the Unknown Sources settings . FireEye said it has tracked admin@338 's activity since 2013 and the group has largely targeted organizations involved in financial , economic and trade policy . Based on the code, it is unclear what initiates the Visual Basic script . On April 21 , 2022 , KillNet also stated that " REVIL is back in the ranks . "


If users allow such apps to be installed , then it can be actively installed on the victim ’ s device . The simplest conclusion based on these facts is that APT1 is operating in China , and most likely in Shanghai . However, a variety of typical persistence mechanisms, such as a scheduled task, could serve that . CrowdStrike researchers replicated the exploit method attack on Exchange systems that had not received the November 8 , 2022 patch KB5019758 , but could not replicate the attack on systems that had received that patch .


The infection chain is slightly more roundabout in the case of Apple devices . These data sets show that APT1 is either operating in China during normal Chinese business hours or that APT1 is intentionally going to painstaking lengths to look like they are . After Glimpse starts, it checks for the existence of a directory and lock . Ego


Accessing the same malicious site would redirect its user to another malicious website ( hxxp : //apple-icloud [ . APT1 has used and steadily modified BISCUIT since as early as 2007 and continues to use it presently . If no directory or lock file is found, Glimpse creates . While a top attack vector for Cuba is the exploitation of known vulnerabilities , the actors techniques also include phishing campaigns , compromised credentials , and remote desktop protocol exploits .


] qwq-japan [ . While APT1 intruders occasionally use publicly available backdoors such as Poison Ivy and Gh0st RAT . Alternatively, if these do exist and the lock file is older than 10 minutes, the lock file is deleted and the previously running Glimpse script is . The script contained instructions to download and execute a second stage payload .


] com or hxxp : //apple-icloud [ . Given the mission , resourcing , and location of PLA Unit 61398 , we conclude that PLA Unit 61398 is APT1 . After the initial checks described above, Glimpse creates a hidden file that contains an agent ID, which is a simple concatenation of a random number 10-99 and the first 8 characters of a GUID without . Apropos of my retrospective report , Bullock found that a great many messages in Biderman ’s inbox were belligerent and anti - Semitic screeds from a former Ashley Madison employee named William Brewster Harrison .


] zqo-japan [ . APT1 were a highly prolific cyber-attack group operating out of China . The methods employed by Glimpse to perform DNS communications are determined by the mode in which it is operating (i.e., text mode or ping ) . Although this wave did not use any zero day exploits , it relied on steganography and NTFS alternate data streams to complicate detection .


] com ) that prompts the user to install a malicious iOS configuration profile to solve a network issue preventing the site to load . APT1 is a China-based cyber-espionage group , active since mid-2006 . In text mode, Glimpse manually builds a DNS query to be transmitted over a UDP socket . The CozyDuke malware utilizes a backdoor and dropper , and exfiltrates data to a C2 server .


If the user installs the profile , the malicious website will open , revealing it to be an Apple phishing site , as seen in figure 2 . APT12 's targets are consistent with larger People 's Republic of China ( PRC ) goals . In ping mode, Glimpse uses a .NET . Figure 8 : Scilc.exe usage example


Technical analysis Most of this new attack ’ s routines are similar to those of the previous XLoader versions . Since the release of the Arbor blog post , FireEye has observed APT12 use a modified backdoor that we call HIGHTIDE . The table below describes the operational mode, record types used, and the method used to send the . According to a recent V3.co.uk article , 95 percent of companies have already fallen victim to attacks from advanced malware and suffer from an average of 643 successful infections per week .


However , as mentioned earlier , an analysis of this new variant showed some changes in its code in line with its new deployment method . However , the malware shared several traits with the RIPTIDE and HIGHTIDE backdoor that we have attributed to APT12 . The first DNS query by Glimpse requests the mode to be used in future communications with the controller (i.e., ping mode or text ) . The Twitter handle used by Hack520 indicates also an “ est ” portion .


We discuss these changes and its effect on Android and Apple devices . From October 2012 to May 2014 , FireEye observed APT12 utilizing RIPTIDE , that communicates via HTTP to a hard-coded command and control ( C2 ) server . Prior to making any query, a function called AdrGen is used to build a query . Although we can not verify that the service disruptions occurred directly as a result of KillNet operations , the data below illustrates claims that overlap temporally with verified service disruptions .


Malicious APK Like its previous versions , XLoader 6.0 abuses social media user profiles to hide its real C & C addresses , but this time its threat actors chose the social media platform Twitter , which was never used in previous attacks . Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 . This function takes several parameters, most of which are represented in the subdomain label(s) of the query . In addition , Hack520 ’s tweets always show photos of the same animal , which is likely his pet pig .


The real C & C address is encoded in the Twitter names , and can only be revealed once decoded . FireEye believes the change from RIPTIDE to HIGHTIDE represents a temporary tool shift to decrease malware detection while APT12 developed a completely new malware toolset . Below is a list of AdrGen . Mandiant used these signatures to search the XPdb for additional attacker payloads that were deleted by the threat actor or otherwise unable to be identified through other forms of analysis .


This adds an extra layer against detection . They have largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors . As mentioned above, one of the parameters passed to the AdrGen function is the action . The attacks used a multistage infection chain initiated with malicious Microsoft Office documents , most commonly using Microsoft Excel and PowerPoint file formats .


The code for this characteristic and the corresponding Twitter accounts can be seen in figures 3 and 4 respectively . A China-based cyber threat group , which FireEye tracks as an uncategorized advanced persistent threat ( APT ) group and other researchers refer to as admin@338 , may have conducted the activity . Table 5: Glimpse action parameters values for the AdrGen function below contains the possible parameters, a brief description, and return values applicable to the action . Adversaries may manipulate physical process control within the industrial environment .


Version 6.0 also adds a command called “ getPhoneState ” , which collects unique identifiers of mobile devices such as IMSI , ICCID , Android ID , and device serial number . The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences . The query to set the receive mode expects an A resource record response from the . Leveraging this access , an attacker can send remote commands to affect the actuation of power line switches and circuit breakers to cause power disruption .


This addition is seen in Figure 5 . About four months after The New York Times publicized an attack on its network , the APT12 behind the intrusion deployed updated versions of their Backdoor.APT.Aumlib and Backdoor.APT.Ixeshe malware families . The controller will respond with one of two responses: 99.250.250.199 will set the receive mode to . Another new actor we discovered , seemingly of Vietnamese origin , uses a Yashma ransomware variant to target victims in Bulgaria , China , Vietnam and other countries .


Considering the other malicious behaviors of XLoader , this added operation could be very dangerous as threat actors can use it to perform targeted attacks . With this in mind , this week we are providing some indicators for a China based adversary who we crypt as " NUMBERED PANDA " Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc . Any other IP address will set the receive mode to ping, although the server-side software suggests 199.250.250.99 will be . RDP and phishing are two of the most popular initial ransomware attack vectors , and cybercriminals approach in leveraging these techniques has not changed much over the years .


Malicious iOS profile In the case of Apple devices , the downloaded malicious iOS profile gathers the following : Unique device identifier ( UDID ) International Mobile Equipment Identity ( IMEI ) Integrated Circuit Card ID ( ICCID ) Mobile equipment identifier ( MEID ) Version number Product number The profile installations differ depending on the iOS . Numbered Panda has a long list of high-profile victims and is known by a number of names including : DYNCALC , IXESHE , JOY RAT , APT-12 , etc . When set in text receive mode, the malware uses the AdrGen function to create another query string with the r (receiver) flag and a W (wait) action . At Talos , we pride ourselves on the quality of the intelligence we publish .


For versions 11.0 and 11.4 , the installation is straightforward . The new campaigns mark the first significant stirrings from the APT12 since it went silent in January in the wake of a detailed expose of the group and its exploits — and a retooling of what security researchers believe is a massive spying operation based in China . The expected TXT record response has the following structure: . For these reasons , OT defenders and asset owners should take mitigating actions against COSMICENERGY to preempt in the wild deployment and to better understand common features and capabilities that are frequently deployed in OT malware .


If a user visits the profile host website and allows the installer to download , the iOS system will go directly to the “ Install Profile ” page ( which shows a verified safety certificate ) , and then request the users ’ passcode for the last step of installation . Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries . In our sample traffic, the TXT resource record returned contained: . The constant integers are obfuscated using structures and loops to get the right offset .


On later versions , specifically iOS 12.1.1 and iOS 12.2 , the process is different . Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries . This response tells the malware to set a variable for the file name to receivebox\rcvd10100 and set the next query action to D in order to request the next chunk of . The site also claimed to include the names , addresses and phone numbers of top CEOs .


After the profile is downloaded , the iOS system will first ask users to review the profile in their settings if they want to install it . On November 26 , 2015 , a suspected China-based APT16 sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies . The malware sends another TXT query with the receiver . The new year is almost upon us , and 2022 has been a game of ransomware hardball .


Users can see a “ Profile Downloaded ” added in their settings ( this feature is in iOS 12.2 , but not on iOS 12.1.1 ) . On November 26 , 2015 , a suspected China-based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies . This query is depicted below: 39e9D60005eca60000BCC64T.sample-domain.evil In the case of our sample traffic, the server responded with the following TXT resource record data: . Although KillMilk claims the activity was by their own group , the previous operations of Universal Dark Service targeted the Russian government and were critical of its actions .


This gives users a chance to see details and better understand any changes made . While attribution of the first two spear phishing attacks is still uncertain , we attribute the second December phishing campaign to the China-based APT group that we refer to as APT16 . The controller provided the malware with base64-encoded data to be . Who is The Chaos Creator , and what else transpired between Harrison and Ashley Madison prior to his death ?


After the review , the process is the same as above . APT16 actors sent spear phishing emails to two Taiwanese media organizations . The data will eventually be written to disk and the malware sets the next query action to D in order to request the next chunk of . “ It appears to be the email address Will used for his profiles , ” the IT director replied .


After the profile is installed , the user will then be redirected to another Apple phishing site . On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website . The decoded data shows a command to be executed whoami&ipconfig /all on the victim . SysUpdate is exclusively used by Budworm .


The phishing site uses the gathered information as its GET parameter , allowing the attacker to access the stolen information . It is possible , although not confirmed , that APT16 was also responsible for targeting this government agency , given both the timeframe and the use of the same n-day to eventually deploy the ELMER backdoor . The malware sends another TXT query with the receiver structure, as depicted . Attackers could exploit these vulnerabilities to carry out a variety of attacks , in some cases gaining the ability to execute remote code on the targeted machine .


Ongoing activity While monitoring this particular threat , we found another XLoader variant posing as a pornography app aimed at South Korean users . Despite the differing sponsorship , penetration of Hong Kong and Taiwan-based media organizations continues to be a priority for China-based APT16 . Note the request number parameter is now 0001: 39e965e000caD60001679C79T.sample-domain.evil . The ransomware is a 64bit executable written in Rust and it recognises the following commandline parameters


The " porn kr sex '' APK connects to a malicious website that runs XLoader in the background . The suspected APT16 targeting of the Taiwanese government agency – in addition to the Taiwanese media organizations – further supports this possibility . The TXT record returned contained data: E0000>0 . Ransomware source code is a malicious program that contains the instructions and algorithms that define the ransomware ’s behavior .


The website uses a different fixed twitter account ( https : //twitter.com/fdgoer343 ) . APT17 was embedding the encoded CnC IP address for the BLACKCOFFEE malware in legitimate Microsoft TechNet profiles pages and forum threads , a method some in the information security community call a " dead drop resolver " . The controller issued the command to write the base64-decoded and modified data to the file name set earlier in the exchange . Talos eventually uncovered additional campaigns , including the two previously mentioned by Ukraine ’s Computer Emergency Response Team ( CERT - UA ) and FortiGuard Labs researchers .


This attack , however , seems exclusive to Android users , as it does not have the code to attack iOS devices . APT17 , also known as DeputyDog , is a China-based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations . After the file is written, the malware moves on to process operations . There is evidence to suggest that in 2010 Harrison was directed to harass the owner of Ashleymadisonsucks.com into closing the site or selling the domain to Ashley Madison .


Succeeding monitoring efforts revealed a newer variant that exploits the social media platforms Instagram and Tumblr instead of Twitter to hide its C & C address . FireEye has monitored APT17 's use of BLACKCOFFEE variants since 2013 to masquerade malicious communication as normal web traffic by disguising the CnC communication as queries to web search engines . Glimpse can be set to use ping mode in several ways while performing receive operations . An exhaustive analysis of domains registered to the various Vistomail pseudonyms used by Harrison shows he also ran Bash - a - Business[.]com , which Harrison dedicated to “ all those sorry ass corporate executives out there profiting from your hard work , organs , lives , ideas , intelligence , and wallets . ”


We labeled this new variant XLoader version 7.0 , because of the different deployment method and its use of the native code to load the payload and hide in Instagram and Tumblr profiles . The use of BLACKCOFFEE demonstrates APT17 's evolving use of public websites to hide in plain sight . If a query with the M action returns an IP address that is not 99.250.250.199 , the malware will use ping mode . In mid - June 2023 , KillNet announced that the collective and actors claiming to be from the Russian ransomware group REvil were collaborating in a joint operation targeting Western financial systems .


These more recent developments indicate that XLoader is still evolving . TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology . It is worth noting that the IP response observed to set ping mode was the reverse of the IP used to set text mode (i.e., 199.250.250.99 ) . The new documentary , The Ashley Madison Affair , begins airing today on Hulu in the United States and on Disney+ in the United Kingdom .


Adding connections to FakeSpy We have been seeing activity from XLoader since 2018 , and have since followed up our initial findings with a detailed research revealing a wealth of activity dating back to as early as January 2015 , which outlined a major discovery—its connection to FakeSpy . The APT18 then installed the hcdLoader RAT , which installs as a Windows service and provides command line access to the compromised system . Ping mode will also be set if exceptions occur more than three times during text . It is accessed using a path confusion exploit , CVE-2022 - 41040 , allowing the attacker to reach the backend for arbitrary URLs .


The emergence of XLoader 6.0 does not only indicate that the threat actors behind it remain active ; it also holds fresh evidence of its connection to FakeSpy . The malware used by the Wekby group has ties to the HTTPBrowser malware family , and uses DNS requests as a command and control mechanism . In the latter case, the P action is passed as one of the parameters to AdrGen and the query is made for an A resource record using the [System.Net.Dns]::GetHostAddresses . The campaigns contain malicious web links and attachments that infect users machines with malware when opened .


One such immediately apparent connection was the similar deployment technique used by both XLoader 6.0 and FakeSpy . These URIs result in the download of an installer , which creates a PE of the malware typically known as HTTPBrowser , but called Token Control by the Wekby group themselves ( based upon the PDB strings found within many of the samples ) . If performing receive operations in ping mode, Glimpse makes a query with the 0 action to contact the controller for . Adversaries may utilize command - line interfaces ( CLIs ) to interact with systems and execute commands .


It had again cloned a different legitimate Japanese website to host its malicious app , similar to what FakeSpy had also done before . APT19 seemed to be going after defense sector firms , Chinese dissident groups and political , financial , pharmaceutical and energy sectors that could benefit the Chinese economy . This query uses a receive structure similar to an M action; it is worth noting all of the receiver operation queries made in ping mode use the [System.Net.Dns]::GetHostAddresses . We assess " pack\scil\s1.txt " is likely a file containing SCIL commands the attackers executed in MicroSCADA .


Their similarity is made more apparent by looking at their naming method for downloadable files , domain structure of fake websites and other details of their deployment techniques , exemplified in figure 10 . APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy . In our sample, after the malware sent the 0 action, the controller responded with an A record containing 24.125.10.140 . Future cybercriminal campaigns on social network platforms may not be so gentle .


XLoader 6.0 also mirrors the way FakeSpy hides its real C & C server . FANCY BEAR ( also known as Sofacy or APT 28 ) is a separate Russian-based threat actor , which has been active since mid 2000s , and has been responsible for targeted intrusion campaigns against the Aerospace , Defense , Energy , Government and Media sectors . This response tells the malware to: Set the file name for the data that will follow to 10140, Set the part number to 0, Parse response data, Set a 1 action for the next . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


When before it had used several different social media platforms , it now uses the Twitter platform , something FakeSpy has done in its past attacks . APT28 malware , in particular the family of modular backdoors that we call CHOPSTICK , indicates a formal code development environment . Query: 00039e9650eca66C06T.sample-domain.evil , Response: 24.125.10.140 , File name: 10140, Query: 139e965e000ca6D2C80T.sample-domain.evil , Response: 110.101.116.0 , Query: 00339e965e1ca6EF4C07T.sample-domain.evil , Response: 32.117.115.3 , Query: 30069e 1965eca6FE8C13T.sample-domain.evil, Response: 101.114.32.6 , Query: 391 e960095eca63570BC62T.sample-domain.evil , Response: 1.2.3.0 . The arrest makes him the third LockBit affiliate charged in the US since November .


Analysis of the malicious iOS profile also revealed further connections , as the profile can also be downloaded from a website that FakeSpy deployed early this year . However , three themes in APT28 's targeting clearly reflects areas of specific interest to an Eastern European government , most likely the Russian government . In this case, the content net user is written to . The core module has a lot of functionality that gives the attacker full control of the victim machine .


Conclusion and security recommendations The continued monitoring of XLoader showed how its operators continuously changed its features , such as its attack vector deployment infrastructure and deployment techniques . We identified three themes in APT28 's lures and registered domains , which together are particularly relevant to the Russian government . After writing the data to disk, receiver operations are complete and processor operations . Sandworm is a full - spectrum threat actor that has carried out espionage , influence and attack operations in support of Russia 's Main Intelligence Directorate ( GRU ) since at least 2009 .


This newest entry seems to indicate that these changes won ’ t be stopping soon . Georgian military security issues , particularly with regard to U.S. cooperation and NATO , provide a strong incentive for Russian state-sponsored threat actors to steal information that sheds light on these topics . After writing the data received from the controller, a function is called to process the received . The UK , on the other hand , emerged as the second - largest ransomware target , enduring close to 200 ransomware attacks .


Being aware of this fact can help create defensive strategies , as well as prepare for upcoming attacks . Instead , we observed the two Russian espionage groups compromise the same systems and engage separately in the theft of identical credentials . The processor function builds a list of files from the files with content that match rcvd* in the receivebox . Vice Society ’s targeting of education is undoubtedly deliberate and has likely allowed the gang to develop domain - specific techniques and expertise .


In addition , just as uncovering new characteristics is important , finding ones we ’ ve also seen in a different malware family like FakeSpy also provides valuable insight . APT28 's malware settings suggest that the developers have done the majority of their work in a Russian language build environment during Russian business hours , which suggests that the Russian government is APT28 's sponsor . Similar to PoisonFrog , the last digit of the received file name determines how the content of the file is . Imagine you got an email that looked like it was from a friend .


Links between XLoader and FakeSpy can give clues to the much broader inner workings of the threat actors behind them . We believe that APT28 's targeting of the MOD aligns with Russian threat perceptions . In our sample traffic, after executing the commands sent via cmd.exe , Glimpse writes the output of the commands in the sendbox directory to the appropriate file names (e.g., 10100 or 10140) prepended with proc (e.g., ) . Although COSMICENERGY does not directly overlap with any previously observed malware families , its capabilities are comparable to those employed in previous incidents and malware .


Perhaps more information on XLoader will be known in the future . We assess that APT28 is most likely sponsored by the Russian government . Once written, the send operations . As confirmed by our own research data , CISA also found LockBit took the top spot as the biggest global ransomware threat in 2022 .


For now , users can make the best of the knowledge they have now to significantly reduce the effectivity of such malware . Given the available data , we assess that APT28 's work is sponsored by the Russian government . Similar to text mode receiver, after AdrGen builds the string, a function to manually build and send the DNS query packet is . Suspicious Login Patterns on NetScaler


Users of iOS can remove the malicious profile using the Apple Configurator 2 , Apple ’ s official iOS helper app for managing Apple devices . The targets were similar to a 2015 TG-4127 campaign — individuals in Russia and the former Soviet states , current and former military and government personnel in the U.S. and Europe , individuals working in the defense and government supply chain , and authors and journalists — but also included email accounts linked to the November 2016 United States presidential election . The text mode sender uses the same hardcoded transaction ID 0xa4a3; however, instead of sending queries for TXT resource records, the malware uses A resource . Rhysida will enumerate through directories and files in directories starting from “ A : ” to “ Z : ” drives , ensure they ’re missing from the “ exclude list ” and then “ process , ” i.e. , encrypt the files .


Following simple best practices , like strictly downloading applications or any files from trusted sources and being wary of unsolicited messages , can also prevent similar attacks from compromising devices . The targets of TG-4127 include military , government and defense sectors . As with the text mode receiver, the query is made with a direct connection to the controller IP address as opposed to allowing the query to propagate the native DNS . Earlier campaigns used an executable downloader , while the later ones used DLLs for the next stage .


Indicators of Compromise SHA256 Package App label 332e68d865009d627343b89a5744843e3fde4ae870193f36b82980363439a425 ufD.wykyx.vlhvh SEX kr porn 403401aa71df1830d294b78de0e5e867ee3738568369c48ffafe1b15f3145588 ufD.wyjyx.vahvh 佐川急便 466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b Some of APT28 's more commonly used tools are the SOURFACE downloader , its second stage backdoor EVILTOSS , and a modular family of implants that we call CHOPSTICK . If the send function is being invoked in ping mode, the process described above is followed; however, instead of manually building and transmitting the DNS query, the [System.Net.Dns]::GetHostAddresses method is . In the months leading up to and after Russia ’s illegal further invasion began , Ukraine experienced a series of disruptive cyber operations , including website defacements , distributed denial - of - service ( DDoS ) attacks , and cyber attacks to delete data from computers belonging to government and private entities – all part of the Russian playbook .


com.dhp.ozqh Facebook 5022495104c280286e65184e3164f3f248356d065ad76acef48ee2ce244ffdc8 ufD.wyjyx.vahvh Anshin Scan a0f3df39d20c4eaa410a61a527507dbc6b17c7f974f76e13181e98225bda0511 com.aqyh.xolo 佐川急便 cb412b9a26c1e51ece7a0e6f98f085e1c27aa0251172bf0a361eb5d1165307f7 While TG-4127 continues to primarily threaten organizations and individuals operating in Russia and former Soviet states , this campaign illustrates its willingness to expand its scope to other targets that have intelligence of interest to the Russian government . With that method, the malware’s query will traverse the native DNS architecture as opposed to the victim making a direct connection to the . Kaspersky ’s Global Research and Analysis Team ( GReAT ) has observed signs of its attacks in several countries including Germany , South Korea and Uzbekistan , as well as the US .


jp.co.sagawa.SagawaOfficialApp 佐川急便 Malicious URLs : hxxp : //38 [ . CTU researchers assess with moderate confidence that the group is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government . The send function uses several counters to maintain various pieces of information used to control the flow of . shellcode Download a shellcode and run by injecting it in a target process .


] 27 [ . This intelligence has been critical to protecting and informing our clients , exposing this threat , and strengthening our confidence in attributing APT28 to the Russian Government . An exception counter is used to track the number of exceptions and will exit the send loop if a threshold is . In one exchange on Aug. 16 , 2012 , Ashley Madison ’s director of IT was asked to produce a list of all company employees with all - powerful administrator access .


] 99 [ . Our visibility into the operations of APT28 - a group we believe the Russian Government sponsors - has given us insight into some of the government 's targets , as well as its objectives and the activities designed to further them . The send counter is used to track the number of chunks sent to the . Given Sandworm ’s global threat activity and novel OT capabilties , we urge OT asset owners to take action to mitigate this threat .


] 11/xvideo/ hxxp : //apple-icloud [ . Since at least 2007 , APT28 has engaged in extensive operations in support of Russian strategic interests . An additional counter exists to handle cases where the file being sent is larger than 250 . The purpose of these attacks and their focus on IT and communication companies is believed to be to facilitate supply chain attacks on their clients .


] qwe-japan [ . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government . The send counter is initialized to 0 and read from the fourth octet of the A record returned by the . The series features interviews with security experts and journalists , Ashley Madison executives , victims of the breach and jilted spouses .


] com hxxp : //apple-icloud [ . APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government . The send counter is also passed to the AdrGen function as the part number parameter and is visible in the query string as depicted below: Query: 239e965ec000a60000B6C90T.COCTab33333233332222222222222222210100A3280AAAAAAAAAAAAAAAAA.33333210100A.sample-domain.evil , Response: 39.2.3.1 , Query: 230019e965eca60000A16DC20T.EBB466767667256666772556776662FBFD932F3F64079E4F730B65239FE0.33333210100A.sample-domain.evil , Response: 39.2.3.2 , Query: 392e002965eca60000C6D18C42T.33232333332333500262233332466710E0E18362E239DDA839020190D932.33333210100A.sample-domain.evil . Attacks start with VBA code to decode the next malware stage All campaigns start with Microsoft Office documents , which are possibly sent to the targets as email attachments .


] qwq-japan [ . Over the past two years , Russia appears to have increasingly leveraged APT28 to conduct information operations commensurate with broader strategic military doctrine . When the send loop has fewer than 60 bytes to send (e.g., a small file or the last part of a file), the send function transmits the remaining bytes with a shorter data . Typically , they steal information , including intellectual property , personally identifying information , and money to fund or further espionage and exploitation causes .


] com/ hxxp : //apple-icloud [ . After compromising a victim organization , APT28 will steal internal data that is then leaked to further political narratives aligned with Russian interests . When there are no more bytes to send, a hardcoded file end marker COCTabCOCT is sent in the data section and the send loop will be . Leveraging this access , an attacker can send remote commands to affect the actuation of power line switches and circuit breakers to cause power disruption .


] zqo-japan [ . After compromising a political organization , APT28 will steal internal data . The controller responds with the 253.25.42.87 A record . CrowdStrike incident responders found that renamed Plink and AnyDesk executable creation timestamps on affected backend Exchange servers were closely correlated with PowerShell execution events in the Remote PowerShell logs , indicating the threat actor leveraged the newly discovered exploit chain to drop other tooling for persistent access to the affected Exchange servers .


] com/ hxxp : //files.spamo [ . On December 29 , 2016 , the Department of Homeland Security ( DHS ) and Federal Bureau of Investigation ( FBI ) released a Joint Analysis Report confirming FireEye 's long held public assessment that the Russian Government sponsors APT28 . Query: 239055e965eca60000CC30T.66654667676673003300C93CC92212953EDACEDA.33333210100A.sample-domain.evil , Response: 39.2.3.56 , Query: 05639e9652eca6000057C06T.COCTabCOCT33333210100A.sample-domain.evil , Response: 253.25.42.87 . Additionally , while KillNet has targeted NATO countries and organizations since early to mid-2022 , it declared a focused operation against NATO in early 2023 and created a Telegram channel in April 2023 dedicated to this operation .


] jp/佐川急便.apk hxxp : //mailsa-qae [ . In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations , and characterized APT28 's activity as aligning with the Russian Government 's strategic intelligence requirements . Once an A record response is received by the malware containing 253.25.42.87 , several variables are set in preparation to exit the send . Currently , Mandiant can neither validate claims related to Zarya ’s hacking capabilities , nor those related to the group ’s potential links to the FSB .


] com hxxp : //mailsa-qaf [ . In October 2014 , FireEye released APT28 : A Window into Russia 's Cyber Espionage Operations' , and characterized APT28 's activity as aligning with the Russian Government 's strategic intelligence requirements . After the send operation is complete, the lock file for the current run is deleted and the script . In addition , Hack520 ’s tweets always show photos of the same animal , which is likely his pet pig .


] com hxxp : //mailsa-qau [ . APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails . Many of the capabilities discovered in Glimpse were also present in the malware analyzed in part one of this . It seems that the legitimate macro code is used to calculate some values in the spreadsheets , but the legitimate functions are changed to call the function that starts the infection process .


] com hxxp : //mailsa-qaw [ . Our investigation of APT28 's compromise of WADA 's network , and our observations of the surrounding events reveal how Russia sought to counteract a damaging narrative and delegitimize the institutions leveling criticism . Glimpse added the ability to use an alternate DNS resource record type (TXT) as opposed to solely relying on A resource records for DNS . None Deploy advanced endpoint detection and response ( EDR ) tools to all endpoints to detect web services spawning PowerShell or command line processes .


] com hxxp : //mailsa-wqe [ . Since releasing our 2014 report , we continue to assess that APT28 is sponsored by the Russian Government . Using TXT resource records enabled the actors to provide tasking in fewer transactions due to the amount of data that can be transmitted in a TXT . Another new actor we discovered , seemingly of Vietnamese origin , uses a Yashma ransomware variant to target victims in Bulgaria , China , Vietnam and other countries .


] com hxxp : //mailsa-wqo [ . In our 2014 report , we identified APT28 as a suspected Russian government-sponsored espionage actor . To support this capability, the adversaries chose to manually craft the DNS queries and communicate directly with the controller as opposed to using existing .NET DNS . Whoever hacked Ashley Madison had access to all employee emails , but they only released Biderman ’s messages — three years worth .


] com hxxp : //mailsa-wqp [ . For full details , please reference our 2014 report , APT28 : A Window into Russia 's Cyber Espionage Operations . The differences between PoisonFrog and Glimpse highlight the ease at which adversaries can modify their tools to meet their end . The Winnti group diversified its targets to include enterprises such as those in pharmaceutics and telecommunications .


] com hxxp : //mailsa-wqq [ . The espionage group , which according to the U.S. Department of Homeland Security ( DHS ) and the Federal Bureau of Investigation ( FBI ) is linked to the Russian government , returned to low-key intelligence-gathering operations during 2017 and into 2018 , targeting a range of military and government targets in Europe and South America . With regard to detection, several methods can be used to identify this type of C2 . During the course of researching the Winnti group , we came across previously unreported malware samples that we attributed to the group based on the malware arsenal and the use of registered domains as attack infrastructure .


] com hxxp : //mailsa-wqu [ . The APT28 , which is linked to the Russian government , returned to low-key intelligence-gathering operations during 2017 and into 2018 , targeting a range of military and government targets in Europe and South America . Performing entropy calculations on subdomain labels can help highlight the amount of randomness in a label, but this is just one of many possible data analysis points, since a standalone feature may not be enough to determine whether traffic is . More information TunnelVision has been observed exploiting Fortinet FortiOS CVE201813379 , Microsoft Exchange ProxyShell and the recent Log4Shell vulnerabilities .


] com hxxp : //mailsa-wqw [ . Another attack group , Earworm ( aka Zebrocy ) , has been active since at least May 2016 and is involved in what appears to be intelligence gathering operations against military targets in Europe , Central Asia , and Eastern Asia . The IronDefense Network Traffic Analysis platform combines several behavioral detection methods alongside historical network information to detect the C2 techniques used by Glimpse and other . Adversaries may also use CLIs to install and run new software , including malicious tools that may be installed over the course of an operation .


] com hxxp : //nttdocomo-qae [ . Several sources consider APT28 a group of CyberMercs based in Russia . Carbon Black TAU ThreatSight Analysis GandCrab and Ursnif . Bullock had spent many hours poring over the hundreds of thousands of emails that the Ashley Madison hackers stole from Biderman and published online in 2015 .


] com hxxp : //nttdocomo-qaq [ . The primary targets of APT28 are potential victims in several countries such as Ukraine , Spain , Russia , Romania , the United States and Canada . The Carbon Black ThreatSight team observed an interesting campaign over the last month . One initiative in the European Union has helped more than 1.5 million ransomware victims .


] com hxxp : //nttdocomo-qaq [ . We have reasons to believe that the operators of the APT28 network are either Russian citizens or citizens of a neighboring country that speak Russian . ThreatSight worked with the Threat Analysis Unit ( TAU ) to research the campaign . Beyond basic cybersecurity hygiene , including auditing current IT environments for vulnerabilities , implementing needed patches and regularly employing backups , its imperative to have multifactor authentication as a minimum on any externalfacing RDP , whilst preferably removing externalfacing RDP altogether .


] com/aa hxxp : //nttdocomo-qar [ . Previous work published by security vendor FireEye in October 2014 suggests the group might be of Russian origin . This report is being released to help researchers and security practitioners combat this campaign as new samples are being discovered in the wild daily . They choses the appropriate DLL by passing a flag in the first Argument .


] com hxxp : //nttdocomo-qat [ . Finally , the use of recent domestic events and a prominent US military exercise focused on deterring Russian aggression highlight APT28 's ability and interest in exploiting geopolitical events for their operations . This attack , if successful , can infect a compromised system with both Ursnif malware and GandCrab ransomware . Create NSPPE core dump files on NetScaler ( instructions from vendor ) .


] com hxxp : //nttdocomo-qaw [ . In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM , JHUHUGIT , AZZY and a few others . The overall attack leverages several different approaches , which are popular techniques amongst red teamers , espionage focused adversaries , and large scale criminal campaigns . Adversaries may utilize many different protocols , including those used for web browsing , transferring files , electronic mail , or DNS .


] com hxxp : //sagawa-reg [ . In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM ( aka Xagent , aka CHOPSTICK ) , JHUHUGIT ( which is built with code from the Carberp sources ) , AZZY ( aka ADVSTORESHELL , NETUI , EVILTOSS , and spans across 4-5 generations ) and a few others . This campaign originally came in via phishing emails that contained an attached Word document with embedded macros , Carbon Black located roughly 180 variants in the wild . Problems also arise when organizations turn a blind eye to the usage of commercial spyware .


] com/ hxxp : //www [ . The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . The macro would call an encoded PowerShell script and then use a series of techniques to download and execute both a Ursnif and GandCrab variant . The URLs provided access to the C2s , along with commands and encrypted transfers of additional backdoors onto the system via GIF files .


] 711231 [ . APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . This campaign has been discussed at a high level by other researchers publicly . None LIGHTWORK is a disruption tool written in C++ that implements the IEC-104 protocol to modify the state of RTUs over TCP .


] com hxxp : //www [ . The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . Carbon Black product specific content can be located in the User Exchange . certutil.exe


] 759383 [ . Their evolving and modified SPLM , CHOPSTICK , XAgent code is a long-standing part of Sofacy activity , however much of it is changing . In this campaign the attackers used a MS Word document ( .doc format ) to deliver the initial stages . None Use of open source libraries for protocol implementation : The availability of open source projects that implement OT protocols can lower the barrier of entry for actors attempting to interact with OT devices .


] com hxxp : //www [ . FireEye has moderate confidence that a campaign targeting the hospitality sector is attributed to Russian actor APT28 . It should be noted that out of the roughly 180 Word variants that were located by Carbon Black , the biggest difference in the documents was the metadata and junk data located in the malicious macros . However , we note that the wiper deployment was limited to the victim ’s IT environment and did not impact the hypervisor or the SCADA virtual machine .


] 923525 [ . APT28 is using novel techniques involving the EternalBlue exploit and the open source tool Responder to spread laterally through networks and likely target travelers . However the metadata clearly showed that the documents prepared for this campaign were initially saved on December 17 , 2018 and have continued to be updated through January 21 , 2019 . This type of vulnerability is known as a server - side request forgery ( SSRF ) .


] com hxxp : //www [ . Upon gaining access to the machines connected to corporate and guest Wi-Fi networks , APT28 deployed Responder . Several metadata fields ( specifically title , subject , author , comments , manager , and company ) appear to have been populated with different data sets . The top most targeted organizations included those from technology and social media , NATO , and the transportation sector .


] 923915 [ . Compared to other backdoor tools associated with the Sofacy group , the use of Zebrocy in attack campaigns is far more widespread . For example the subject in all the samples was a combination of a US state and a common first name ( like Utah Erick or Tennessee Dayna ) . Most fraudsters create one - time email addresses or use stolen email addresses , both of which are easy to create or obtain .


] com hxxp : //www [ . As alluded to in our previous blog regarding the Cannon tool , the Sofacy group ( AKA Fancy Bear , APT28 , STRONTIUM , Pawn Storm , Sednit ) has persistently attacked various government and private organizations around the world from mid-October 2018 through mid-November 2018 . For this post the following sample was analyzed . LockBit reportedly squeezed about $ 91 million out of US organizations with around 1,700 attacks since 2020 , according to a June report by CISA .


] 975685 [ . Russian citizens—journalists , software developers , politicians , researchers at universities , and artists are also targeted by Pawn Storm . Richard_Johnson.doc : 878e4e8677e68aba918d930f2cc67fbe 0a3f915dd071e862046949885043b3ba61100b946cbc0d84ef7c44d77a50f080 . Based on the files ’ thumbnail images – the only content visible in the Windows Explorer window – the PowerPoint files imitate Ukraine ’s Ministry of Defence and Poland ’s Ministry of National Defence .


] com Malicious Twitter accounts : https : //twitter.com/lucky88755 https : //twitter.com/lucky98745 https : //twitter.com/lucky876543 https : //twitter.com/luckyone1232 https : //twitter.com/sadwqewqeqw https : //twitter.com/gyugyu87418490 https : //twitter.com/fdgoer343 https : //twitter.com/sdfghuio342 https : //twitter.com/asdqweqweqeqw https : //twitter.com/ukenivor3 The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 . The document contained a VBS macro that once decompressed was approximately 650 lines of code . Bullock had spent many hours poring over the hundreds of thousands of emails that the Ashley Madison hackers stole from Biderman and published online in 2015 .


Malicious Instagram account : https : //www.instagram.com/freedomguidepeople1830/ Malicious Tumblr accounts : https : //mainsheetgyam.tumblr.com/ https : //hormonaljgrj.tumblr.com/ https : //globalanab.tumblr.com/ C & C addresses : 104 [ . While the JHUHUGIT ( and more recently , " JKEYSKW " ) implant used in most of the Sofacy attacks , high profile victims are being targeted with another first level implant , representing the latest evolution of their AZZY Trojan . The vast majority of that was junk code . Two days after the OT event , Sandworm deployed a new variant of CADDYWIPER in the victim ’s IT environment to cause further disruption and potentially to remove forensic artifacts .


] 160 [ . Once a foothold is established , Sofacy trys to upload more backdoors , USB stealers as well as other hacking tools such as " Mimikatz " for lateral movement . Once the junk code was removed from the VBScript , there are approximately 18 lines of relevant code , which ultimately call a shape box in the current document . This first step provides a SSRF equivalent to the technique used in ProxyNotShell exploitation .


] 191 [ . Once a foothold is established , they try to upload more backdoors , USB stealers as well as other hacking tools such as " Mimikatz " for lateral movement . The variable names themselves are not relevant , however the methods in bold below will retrieve the AlternativeText field from the specified shape , which is then executed . The operation targeted individuals from three groups Senior thinktank personnel researching the Middle East , journalists focused on the region , and academics , including senior professors .


] 190:8822 61 [ . The Sofacy threat group continues to target government organizations in the EU , US , and former Soviet states to deliver the Zebrocy tool as a payload . The alternate text can easily be observed in the body of the office document . In each case , CrowdStrike reviewed the relevant logs and determined there was no evidence of exploitation of CVE-2022 - 41040 for initial access .


] 230 [ . Of note , we also discovered the Sofacy group using a very similar delivery document to deliver a new Trojan called Cannon . The area highlighted in blue is the shape name that is being located , while the text itself is highlighted in red . If you can not apply the KB5019758 patch immediately , you should disable OWA until the patch can be applied .


] 204 [ . Komplex shares a significant amount of functionality and traits with another tool used by Sofacy – the Carberp variant that Sofacy had used in previous attack campaigns on systems running Windows . It is clear that the text is a base64 encoded command , that is then executed by the above VBScript . Mandiant has observed an increase in financially motivated operations by DPRK actors in the past year , particularly those focused on the cryptocurrency industry .


] 87:28833 61 [ . The Sofacy group created the Komplex Trojan to use in attack campaigns targeting the OS X operating system – a move that showcases their continued evolution toward multi-platform attacks . The PowerShell script will first create an instance of the .Net Webclient class and then enumerate the available methods using the GetMethods() call ( highlighted in the image in red ) . Considering that both Royal and BlackSuit were active last month , however , a rebrand probably is n’t happening any time soon .


] 230 [ . The Komplex Trojan revealed a design similar to Sofacy 's Carberp variant Trojan , which we believe may have been done in order to handle compromised Windows and OS X systems using the same C2 server application with relative ease . The enumerated methods are stored , then a for loop looks first for the method named DownloadString ( highlighted in blue ) . NoEscape is a new ransomware which been doing the rounds in underground forums since May 2023 .


] 204 [ . This whitepaper explores the tools - such as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , etc- of the Dukes , a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making . If the DownloadString method is located it will contact the hard coded C2 requesting a file , which is downloaded and then invoked ( highlighted in blue ) . Another common delivery mechanism for ransomware attacks is via phishing emails , compounding the problem for security teams already overburdened with managing an evergrowing volume of suspicious messages that require review .


] 87:28844 61 [ . The Dukes are a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making . It should be noted that because the requested resource is being stored as a string and executed , this all occurs in memory . Check that there is more than 5 GB of disk space on the NetScaler device available ( instructions from vendor ) .


] 230 [ . The Dukes are known to employ a vast arsenal of malware toolsets , which we identify as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , CloudDuke , SeaDuke , HammerDuke , PinchDuke , and GeminiDuke . Additional Analysis of the downloaded string is provided in the Gandcrab cradle section below . The “ -do ” flag specifies a SCIL program file to execute ( Figure 8) .


] 204 [ . The origins of the Duke toolset names can be traced back to when researchers at Kaspersky Labs coined the term " MiniDuke " to identify the first Duke-related malware they found . The loop then looks for the method name DownloadData , and if located will download a resource from a second C2 . On July 15th , Facebook revealed it tracked and partially disrupted a longrunning Iranian attack campaign that used accounts to pose as recruiters and draw in US targets before sending them malwareinfected files or tricking them into entering sensitive credentials to phishing sites .


] 87:28855 61 [ . As researchers continued discovering new toolsets that were created and used by the same group that had been operating MiniDuke , and thus the threat actor operating the toolsets started to be commonly referred to as " Dukes " . This request is then stored in the CommonApplicationData directory ( C:\ProgramData in Vista and later ) as the hard coded file name ( highlighted in green ) . The use of 3AM was only partially successful .


] 230 [ . Based on the campaign identifiers found in PinchDuke samples discovered from 2009 , the targets of the Dukes group during that year included organizations such as the Ministry of Defense of Georgia and the ministries of foreign affairs of Turkey and Uganda . The script will utilize the hard coded DCOM object C08AFD90-F2A1-11D1-8455-00A0C91F3880 , which is the ClassID for the ShellBrowserWindow . Although we have not identified sufficient evidence to determine the origin or purpose of COSMICENERGY , we believe that the malware was possibly developed by either Rostelecom - Solar or an associated party to recreate real attack scenarios against energy grid assets .


] 205 [ . Importantly , PinchDuke trojan samples always contain a notable text string , which we believe is used as a campaign identifier by the Dukes group to distinguish between multiple attack campaigns that are run in parallel . A previous blog post by enigma0x3 , detailed how this CLSID can be leveraged to instantiate the ShellBrowserWindow object and call the ShellExecute method , which is the same approach that was taken by the attackers . An adversary could potentially instruct a control systems device to perform an action that will cause an Impact


] 122:28833 61 [ . This neatly ties together many of the tools used by the Dukes group , as versions of this one loader have been used to load malware from three different Dukes-related toolsets CosmicDuke , PinchDuke , and MiniDuke – over the course of five years . This approach has also been used in different Empire modules . The July 2023 campaign has a slightly modified infection chain .


] 230 [ . The Dukes continued the expansion of their arsenal in 2011 with the addition of two more toolsets : MiniDuke and CozyDuke . The payloads that are downloaded in the above steps are then executed on the system . While a threat actor can choose only to access a single account from a single source IP address , Mandiant has observed that multiple accounts were accessed within hours from the same source IP address by a threat actor .


] 205 [ . As we now know , by February 2013 the Dukes group had been operating MiniDuke and other toolsets for at least 4 and a half years . The first payload that is downloaded via the DownloadString method highlighted above , is a PowerShell one-liner that uses an IF statement to evaluate the architecture of the compromised system , and then downloads a additional payload from pastebin.com . In the case of the exploit method described here as OWASSRF , the endpoint is not used , in lieu , and the request will not be dropped .


] 122:28844 61 [ . Secondly , the value the Dukes intended to gain from these MiniDuke campaigns may have been so great that they deemed it worth the risk of getting noticed . This additional payload is then executed in memory . Cisco Secure Malware Analytics ( Threat Grid ) identifies malicious binaries and builds protection into all Cisco Secure products .


] 230 [ . This is in stark contrast to some other suspected Russian threat actors ( such as Operation Pawn Storm ) who appear to have increased their targeting of Ukraine following the crisis . The image below depicts the contents of the o402ek2m.php file . The Systemd configuration file leveraged by Sandworm enabled the group to maintain persistence on systems .


] 205 [ . The Dukes actively targeted Ukraine before the crisis , at a time when Russia was still weighing her options , but once Russia moved from diplomacy to direct action , Ukraine was no longer relevant to the Dukes in the same way . It should be noted that the contents of o402ek2m.php were updated by the attackers to reference different pastebin uploads throughout this campaign . JumpCloud confirmed the commands framework was used for malicious data injections in their security incident disclosure .


] 122:28855 61 [ . In the latter case however , the Dukes group appear to have also simultaneously developed an entirely new loader , which we first observed being used in conjunction with CosmicDuke during the spring of 2015 . Also updated was the function name that is invoked , in the example below it was CJOJFNUWNQKRTLLTMCVDCKFGG , however this was dynamically changed to match the name of the function that would be present in pastebin file that was being downloaded . Evidence of malicious intent can come in many forms , here are just a few potential IoAs


] 230 [ . The Dukes could have ceased all use of CosmicDuke ( at least until they had developed a new loader ) or retired it entirely , since they still had other toolsets available . Once the raw contents of the pastebin.com post were downloaded , that data would also be executed in memory . " Iran often adopts an asymmetric warfare strategy to accomplish its political and military goals , and its development of cyberwarfare capabilities adds to this asymmetric toolkit , allowing the country a lowcost means to conduct espionage and attack stronger adversaries .


] 205 [ . For these CozyDuke campaigns however , the Dukes appear to have employed two particular later-stage toolsets , SeaDuke and HammerDuke . In the variants that were obtained during this campaign the file contained a PowerShell script that was approximately 2800 lines . The popularity of social network and media platforms remain on the rise , and we expect cybercriminals to be naturally drawn towards exploiting them however they can .


] 132:28833 61 [ . Firstly , as with the MiniDuke campaigns of February 2013 and CosmicDuke campaigns in the summer of 2014 , again the group clearly prioritized the continuation of their operations over maintaining stealth . This PowerShell script is a version of the Empire Invoke-PSInject module , with very few modifications . Figure 1 : URL vulnerable to CVE-2023 - 4966 https://<Gateway or ADC IP address>/oauth / idp/.well - known / openid - configuration


] 230 [ . In addition to the notably overt and large-scale campaigns with CozyDuke and CloudDuke , the Dukes also continued to engage in more covert , surgical campaigns using CosmicDuke . The majority if the modifications are of removing comments and renaming variables . In fact , we saw instances of compromised stores having both skimmers loaded , which means double trouble for victims as their credit card information is stolen not just once but twice .


] 205 [ . We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit . The script will take an embedded PE file that has been base64 encoded and inject that into the current PowerShell process . Mandiant identified UNC4899 targeting MacOS keychains and reconnaissance data associated with executives and internal security teams .


] 132:28844 61 [ . All of the available evidence however does in our opinion suggest that the group operates on behalf of the Russian Federation . The image below is the main function that is being called which in turns calls the function responsible for injecting the embedded PE file . This rule was designed to match the decoded URI of any incoming request with the regex , so when the decoded URI matches this regex , the request is dropped .


] 230 [ . This assertion of time zone is also supported by timestamps found in many GeminiDuke samples , which similarly suggest the group work in the Moscow Standard Time timezone , as further detailed in the section on the technical analysis of GeminiDuke . The base64 encoded PE file that can be seen in line 2760 of the image above is a GandCrab Variant . Charming Kitten members , claiming to be a senior teaching and research fellow at SOAS university in London sent targeted emails to a select number of victims from fewer than 10 organizations in the US and UK , inviting them to an online conference called The US Security Challenges in the Middle East .


] 205 [ . Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years . This variant ( the metadata for which is listed below ) is Gandcrab version . Cisco , Microsoft , and other tech companies have joined in supporting Meta 's lawsuit against the NSO Group referenced above through court filings .


] 132:28855 GoldenCup : New Cyber Threat Targeting World Cup Fans As the World Cup launches , so does a new threat Officials from the Israeli Defense Force recently uncovered an Android Spyware campaign targeting Israeli soldiers and orchestrated by " Hamas . APT29 has used The Onion Router and the TOR domain fronting plugin meek to create a hidden , encrypted network tunnel that appeared to connect to Google services over TLS . krab5.dll : 0f270db9ab9361e20058b8c6129bf30e d6c53d9341dda1252ada3861898840be4d669abae2b983ab9bf5259b84de7525 , Mon Oct 29 17:39:23 2018 UTC . krab5.text : 019bc7edf8c2896754fdbdbc2ddae4ec . krab5.rdata : d6ed79624f7af19ba90f51379b7f31e4 . krab5.data : 1ec7b57b01d0c46b628a991555fc90f0 . krab5.rsrc : 89b7e19270b2a5563c301b84b28e423f . krab5.reloc : 685c3c775f65bffceccc1598ff7c2e59 . passing this wide string to function with only one string This could lead to unexpected behavior it could raise access violation exception or just continue and only the first placeholder replaced .


'' The latest samples attributed to this campaign were discovered by security researchers from ClearSky . Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY . The second payload , downloaded via the DownloadData method , is a Ursnif executable . Additional investigation will reveal more about the goals of Charming Kitten regarding the medical sector .


In our research , we focus on the most recent sample , an application dubbed as " Golden Cup '' , launched just before the start of World Cup 2018 . Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years . In this instance it is saved to the C:\ProgramData directory with a pseudo random name . While one of his signatures uses his own blog domain , there is also a second signature which uses 93[.]gd , a domain that was found to have been actively selling VPS services in the past .


Distribution / Infection When this campaign started at the start of 2018 , the malware ( " GlanceLove '' , " WinkChat '' ) was distributed by the perpetrators mainly via fake Facebook profiles , attempting to seduce IDF soldiers to socialize on a different platform ( their malware ) . In the investigations Mandiant has conducted , it appeared that APT29 deployed POSHSPY as a secondary backdoor for use if they lost access to their primary backdoors . It should be noted that the file name was changed throughout this campaign . The attacks reportedly use social engineering to create Trojan email campaigns customdesigned for their victims , the article stated .


As this approach was not a great success , their last attempt was to quickly create a World Cup app and this time distribute it to Israeli citizens , not just soldiers . POSHSPY is an excellent example of the skill and craftiness of APT29 . Once executed the Ursnif sample will conduct the typical actions observed in Ursnif samples , like credential harvesting , gathering system and process information , and deploying additional malware samples . Other big stories in June include a suspected LockBit affiliate arrest , the Royal ransomware gang toying with a new encryptor , and a notable increase in attacks on the Manufacturing sector .


The official “ Golden Cup ” Facebook page . FireEye assesses that APT32 leverages a unique suite of fully-featured malware , in conjunction with commercially-available tools , to conduct targeted operations that are aligned with Vietnamese state interests . The information for this specific sample is listed below . Talos researchers recently discovered multiple vulnerabilities in Open Babel , an open - source software library used in a variety of chemistry and research settings .


The short URL redirects to the application page at Google Play . In addition to focused targeting of the private sector with ties to Vietnam , APT32 has also targeted foreign governments , as well as Vietnamese dissidents and journalists since at least 2013 . However , numerous Ursnif variants were hosted on the bevendbrec.com site during this campaign . Now , consider a cyber threat detection system that takes a comprehensive and holistic approach to analyzing user behavior and computing interactions .


The official “ Golden Cup ” Facebook page . From 2016 through 2017 , two subsidiaries of U.S. and Philippine consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations . Carbon Black was able to discover approximately 120 different Ursnif variants that were being hosted from the domains iscondisth.com and bevendbrec.com . irongreen.exe : 404d25e3a18bda19a238f77270837198 c064f6f047a4e39014a29c8c95526c3fe90d7bcea5ef0b8f21ea306c27713d1f , Sun Dec 18 11:04:31 2011 UTC . irongreen.text : 85aa9117c381eae3d181ab63daab335e . irongreen.rdata : 3e1c774bc4e0ffc2271075e621aa3f3d . irongreen.data : 6c389e5e301564f65dcad4811dbded8b . irongreen.rsrc : efba623cc62ffd0ccbf7f3fbf6264905 . irongreen.reloc : 6cf46599a57a6cbc5d18fbb2883620ce . The fact that this activity occurred as recently as August 2023 suggests that the group is currently active , and that those organizations that may be of interest to Budworm should be aware of this activity and the groups current toolset .


The short URL redirects to the application page at Google Play . From 2016 through 2017 , two consumer products corporations , located inside Vietnam , were the target of APT32 intrusion operations . While researching this campaign approximately 180 variants were located in the wild . As MuddyWater is assessed to be primarily focused on cyberespionage , it is very likely that data theft is the primary objective behind the Earth Vetala campaign .


We assume it was rushed because , unlike GlanceLove , it lacked any real obfuscation . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia . Using the VirusTotal Graph functionality these variants could be organized into several groups that were commonly associated by either metadata or document structures like macros or embedded image files ( depicted in the image below ) . None on the CrowdStrike Falcon ® console and of the market - leading CrowdStrike Falcon ® platform in action .


Even the C & C server side was mostly exposed with the file listing available for everyone to traverse through it . In 2015 and 2016 , two Vietnamese media outlets were targeted with malware that FireEye assesses to be unique to APT32 . The image below highlights the nodes associated with the samples analyzed in this report . The group , which has some loose ties and similarities to other Iranian APTs like APT34 and Charming Kitten , first came to light in 2019 .


It contained approximately 8GB of stolen data . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " . The graph can also be viewed in the VTGraph Console for additional exploration . Also , the names he used are not randomized and begin with .


A recent whois of “ goldncup.com ” . Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam 's manufacturing , consumer products , and hospitality sectors . The graph highlights the at least 3 different variants of Ursnif that were being hosted on the bevendbrec.com site . The fact the attackers were attempting to connect in realtime with victims over phones and video conferences for conversations rather than just engaging over email is also unusual , suggesting confidence in the attackers skills in English and in impersonation although it is not clear if any conversations ended up taking place .


Creation date is a week before the start of the tournament . APT32 operations are characterized through deployment of signature malware payloads including WINDSHIELD , KOMPROGO , SOUNDBITE , and PHOREAL . The Ursnif variants were primarily grouped by C2 infrastructure . Companies conducing a risk analysis would be well served to consider such motivations when evaluating their exposure .


A recent whois of “ goldncup.com ” . In 2017 , social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines . The large grouping on the right of the diagram are direct variants of the sample referenced in this write up . One interesting detail about Hack520 is his apparent love for pigs , as seen in his use of the word in his email addresses .


Creation date is a week before the start of the tournament . APT32 often deploys these backdoors along with the commercially-available Cobalt Strike BEACON backdoor . Samples in this grouping were all hosted on sites that were called by the second stage . We can compare many successful RDP attacks to the equivalent of leaving a window or back door unlocked at our homes , giving the criminal a low barrier to entry .


How it Works In order to get into the Google Play Store , the malware uses a phased approach which is quite a common practice for malware authors these days . APT32 often deploys these backdoors along with the commercially-available Cobalt Strike backdoor . The samples had minor changes , and were presumably changed by the attackers to avoid detection by hash . Threat actors like the Winnti group rarely ever stay static in terms of both tools and tactics .


The original app looks innocent , with most of its code aimed at implementing the real features that the app claims to provide . Based on incident response investigations , product detections , and intelligence observations along with additional publications on the same operators , FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests . Word Dropper Variant cc5a14ff026ee593d7d25f213715b73833e6b9cf71091317121a009d5ad7fc36 7ce3d9fc86396fac9865607594395e94 Word Dropper Variant 28a8d6b8a0cdcb25d098e403cc8b6dcb855cb591f0b54c2e3363b5c580d92b28 74c7aed44680100e984251ce2cdbdbc6 Word Dropper Variant facbc2cb089668197ca3968a3433b6f4826430c13f7d1c75b44667307c67dfe3 10f308d78adda567d4589803ce18cc9b Word Dropper Variant e714a5147335245c386b105bb7494a8b190b6a737ba28f029561efe48105cd11 f279d0f04874327b85221697d99de321 Word Dropper Variant 56c46ef3d5bd544fa35f6e336d3be93cf36e72d0273fa1dbc915979f2d883e9d bc1b322e7efc19417ab0d0524ccb9ff2 . Mandiant has observed overlap amongst multiple North Korean groups that fall under the RGB .


In addition , it collects identifiers and some data from the device . OceanLotus , also known as APT32 , is believed to be a Vietnam-based APT group that has become increasingly sophisticated in its attack tactics , techniques , and procedures ( TTPs ) . Ursnif Variant 446ffd272c79554a19b5f4299327fb74b8ff457681d10571caa6eea51ec406b0 ea7e1650031c92b7377788f05926034e Ursnif Variant 42636f3185c9e398958aad272d983c8b8b1409df4ce93f1f8f608e190290f56d 377cd85d8d68fc58976a123aa151c5e0 Ursnif Variant 24b2141c1134ef14f33a38c58342b6573940c5460d03a2945fafac36e32e6889 b73cbffea8094cfa18b067d9568c53e7 Ursnif Variant e53b0a60c238c45019089bdf7f16d5f47b7ba15ca2c918e385c41f0c2076eb52 24fe5a6196e32749cd030ab51824cabe Ursnif Variant 4c8de1713f830819e8354b653fd19a5cafd0bc8fa3145eedf555f24261c874de 589734cb60aa515599c687539c520049 . Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader , one of the most popular PDF reader alternatives to Adobe Acrobat .


After getting a command from the C & C , the app is able to download a malicious payload in the form of a .dex file that is being dynamically loaded adding the additional malicious capabilities . While Volexity does not typically engage in attempting attribution of any threat actor , Volexity does agree with previously reported assessments that OceanLotus is likely operating out of Vietnam . GandCrab Variant d6c53d9341dda1252ada3861898840be4d669abae2b983ab9bf5259b84de7525 ce1ee671fe5246a9c40b624ef97e4de1 GandCrab Variant aca0b96126c813b0d29d6fbff9175f8ca62ff2ec6eed83bff76a73ae717cfcb8 07f955796a252771861c8e0db06b1f01 GandCrab Variant 8cd45f8c8f2ed0109db6a64f9945f3dcb8a780f65c76aedded7b8af95e6dc7ec 4fcd0d13ea669a83a749ae5bfb098ca2 GandCrab Variant 933210a9d19b25e0711ae88eece1ba06bb035a01ab2880cc707ff55bdd3b8dd0 8ec87fd3ea777fa8d5160dc957e6683e GandCrab Variant e564e87958b3e76bc9bfeb5bed773b7a17f3a82f84872acdbb609aa43a9cd776 c7d5077960882259b85c01fd41c49ffd . Then it calls with invalid value 69 .


In this way , the malware authors can submit their app and add the malicious capabilities only after their app is live on the Play Store . During that phase , the APT32 operated a fileless PowerShell-based infrastructure , using customized PowerShell payloads taken from known offensive frameworks such as Cobalt Strike , PowerSploit and Nishang . Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities Throughout the autumn of 2018 we analyzed a long-standing (and still active at that time) cyber-espionage campaign that was primarily targeting foreign diplomatic entities based in Iran . STRATOFEAR ( com.google.kservice , us.zoom . ZoomService )


Communication with the C & C In order to communicate with its C & C , the app uses the MQTT ( Message Queuing Telemetry Transport ) protocol , which is transported over TCP port 1883 . However , over the past few years , we have been tracking a separate , less widely known suspected Iranian group with potential destructive capabilities , whom we call APT33 . The attackers were using an improved version of Remexi in what the victimology suggests might be a domestic cyber-espionage . Once the malware is dropped and executed through the lure documents , the Foudre backdoor connects to the HTTP commandandcontrol C2 server and downloads a selfextracting archive with fullfeatured Tonnerre malware .


Initiating the MQTT client . Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 . This malware has previously been associated with an APT actor that Symantec calls Chafer . In todays world of evolving malware , there are likely a lot of threats antivirus does nt know about .


Initiating the MQTT client . We assess APT33 works at the behest of the Iranian government . The malware can exfiltrate keystrokes, screenshots, browser-related data like cookies and history, decrypted when . One of the problems with relying entirely on one security solution is that the cyber threat landscape changes rapidly .


Initiating the MQTT client . APT33 has targeted organizations – spanning multiple industries – headquartered in the United States , Saudi Arabia and South Korea . The attackers rely heavily on Microsoft technologies on both the client and server sides: the Trojan uses standard Windows utilities like Microsoft Background Intelligent Transfer Service (BITS ) bitsadmin.exe to receive commands and exfiltrate . Germany retained its place as the fourth most attacked country in the world , and the most attacked country outside of the anglosphere .


The app connects to the MQTT broker with hardcoded username and password and a unique device identifier generated for each device . Cybereason also attributes the recently reported Backdoor.Win32.Denis to the OceanLotus Group , which at the time of this report 's writing , had not been officially linked to this threat actor . Its C2 is based on IIS using .asp technology to handle the victims’ HTTP . This “ est ” reference could refer to a hacking group with its own message board on which hack520 also posts regularly .


The MQTT connection to broker The MQTT connection to broker The MQTT communication is used primarily to update the device state and get commands from the C & C . APT33 has shown particular interest in organizations in the aviation sector , as well as organizations in the energy sector with ties to petrochemical production . Remexi developers use the C programming language and GCC compiler on Windows in the MinGW . Cisco Duo provides multi - factor authentication for users to ensure only those authorized are accessing your network .