With the capability to open market applications , such as Google Play and 9Apps , with a specific keyword search or even a single application ’ s page , the actor can gain exposure for other threat actors and increase his profits . During intense intelligence gathering over the last 24 months , we observed the technical capabilities of the Operation Cleaver team rapidly evolve faster than any previously observed Iranian effort . While tracking what days of the week Suckfly used its hacktools , we discovered that the group was only active Monday through Friday .


The actor can even take his malicious activities to the next level by installing a remote application from a designated server , thus allowing him to install new malware once it is required . Gallmaker used lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange ( DDE ) protocol in order to gain access to victim machines . By targeting all of these organizations together , Suckfly could have had a much larger impact on India and its economy .


The C & C server observed in this campaign is ‘ www [ . Just a few months later , in February 2015 , we announced the discovery of Carbanak , a cyber-criminal gang that used custom malware and APT techniques to steal millions of dollars while infecting hundreds of financial institutions in at least 30 countries . While we don't know the motivations behind the attacks , the targeted commercial organizations , along with the targeted government organizations , may point in this direction .


] addroider.com ’ . Our investigations revealed that the attackers drove around several cities in Russia , stealing money from ATMs belonging to different banks . There is no evidence that Suckfly gained any benefits from attacking the government organizations , but someone else may have benefited from these attacks .


This server runs an instance of ‘ Parse Server ’ ( source on GitHub ) , an open source version of the Parse Backend infrastructure , which is a model for providing web app and mobile app developers with a way to link their applications to backend cloud storage and APIs exposed by back-end applications , while also providing features such as user management , push notifications and more . Utilizing KillDisk in the attack scenario most likely served one of two purposes : the attackers covering their tracks after an espionage operation , or it was used directly for extortion or cyber-sabotage . During this time they were able to steal digital certificates from South Korean companies and launch attacks against Indian and Saudi Arabian government organizations .


The domain ‘ addroider [ . The Lazarus Group 's objective was to gain access to the target 's environment and obtain key military program insight or steal money . We believe that Suckfly will continue to target organizations in India and similar organizations in other countries in order to provide economic insight to the organization behind Suckfly 's operations .


] com ’ was registered via GoDaddy , and uses privacy protection service . Just last week Lazarus were found stealing millions from ATMs across Asia and Africa . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) .


While accessing the domain from a browser you get a login page very similar to other malware panels . The backdoors Lazarus are deploying are difficult to detect and a significant threat to the privacy and security of enterprises , allowing attackers to steal information , delete files , install malware , and more . Proofpoint is tracking this attacker , believed to operate out of China , as TA459 .


The ‘ Register ’ and ‘ Sign Up ’ links are broken and ‘ redirects ’ the user back to the login page . Bankshot is designed to persist on a victim 's network for further exploitation ; thus the Advanced Threat Research team believes this operation is intended to gain access to specific financial organizations . This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) .


According to RiskIQ ’ s PassiveTotal , the domain expired 7 months ago . The Leafminer 's post-compromise toolkit suggests that Leafminer is looking for email data , files , and database servers on compromised target systems . TA549 possesses a diverse malware arsenal including PlugX , NetTraveler , and ZeroT .


As a result , it may be that are looking into a compromised , parked domain that was initially used legitimately , but is now participating in malicious activities . Another intrusion approach used by Leafminer seems a lot less sophisticated than the previously described methods but can be just as effective : using specific hacktools to guess the login passwords for services exposed by a targeted system . TA459 is well-known for targeting organizations in Russia and neighboring countries .


With the capabilities of showing out-of-scope ads , exposing the user to other applications , and opening a URL in a browser , ‘ SimBad ’ acts now as an Adware , but already has the infrastructure to evolve into a much larger threat . While the group has not yet demonstrated an ICS capability , RASPITE 's recent targeting focus and methodology are clear indicators of necessary activity for initial intrusion operations into an IT network to prepare the way for later potential ICS events . Ongoing activity from attack groups like TA459 who consistently target individuals specializing in particular LOCs of research and expertise further complicate an already difficult security situation for organizations dealing with more traditional malware threats , phishing campaigns , and socially engineered threats every day .


FireEye is highlighting a cyber espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40 . Using data collected from the Trend Micro™ Smart Protection Network , we are able to identify victims whose networks communicated with Taidoor C&C servers .


APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia . The Taidoor attackers have been actively engaging in targeted attacks since at least March 4 , 2009 .


The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan . Taidoor spoofed Taiwanese government email addresses to send out socially engineered emails in the Chinese language that typically leveraged Taiwan-themed issues .


During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros . Despite some exceptions , the Taidoor campaign often used Taiwanese IP addresses as C&C servers and email addresses to send out socially engineered emails with malware as attachments .


APT35 also installed BROKEYOLK , a custom backdoor , to maintain persistence on the compromised host . One of the primary targets of the Taidoor campaign appeared to be the Taiwanese government .


They then proceeded to log directly into the VPN using the credentials of the compromised user . Suckfly targeted one of India 's largest e-commerce companies , a major Indian shipping company , one of India 's largest financial organizations , and an IT firm that provides support for India 's largest stock exchange .


Ultimately , APT35 had used access to hundreds of mailboxes to read email communications and steal data related to Middle East organizations , which later became victims of destructive attacks . Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 .


The group has repeatedly used social media , particularly LinkedIn , to identify and interact with employees at targeted organizations , and then used weaponized Excel documents to deliver RATs such as PupyRAT . Taidoor actively sent out malicious documents and maintained several IP addresses for command and control .


Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as Oilrig1 and CopyKittens2 . The attackers actively sent out malicious documents and maintained several IP addresses for command and control .


To sum up , the HBO hacker - Behzad Mesri is a member of Turk Black Hat along with ArYaIeIrAn , who provides infrastructure for Charming Kitten activity via PersianDNS / Mahanserver together with Mohammad Rasoul Akbari , who is a Facebook friend of Behzad Mesri 's . As part of their social engineering ploy , the Taidoor attackers attach a decoy document to their emails that , when opened , displays the contents of a legitimate document but executes a malicious payload in the background .


They move laterally and escalate system privileges to extract sensitive information — whenever the attacker wants to do so.4 ,5 Because some RATs used in targeted attacks are widely available , determining whether an attack is part of a broader APT campaign can be difficult . Sometimes , however , certain samples made use of domain names for HTTP communication .


In 2011 , three years after the most recent release of PIVY , attackers used the RAT to compromise security firm RSA and steal data about its SecureID authentication system . Based on the command capabilities of the Taidoor malware , we were able to determine that data theft and data destruction was possible .


Attackers can point and click their way through a compromised network and exfiltrate data . The ultimate objective of targeted attacks is to acquire sensitive data .


The campaign , which we refer to as Operation Cloud Hopper , has targeted managed IT service providers ( MSPs ) , allowing APT10 unprecedented potential access to the intellectual property and sensitive data of those MSPs and their clients globally . In December 2017 , FireEye publicly released our first analysis on the TRITON attack where malicious actors used the TRITON custom attack framework to manipulate industrial safety systems at a critical infrastructure facility and inadvertently caused a process shutdown .


PwC UK and BAE Systems assess it is highly likely that APT10 is a China-based threat actor with a focus on espionage and wide ranging information collection . In our most recent analysis , we attributed the intrusion activity that led to the deployment of TRITON to a Russian government-owned technical research institute in Moscow .


APT10 is known to have exfiltrated a high volume of data from multiple victims , exploiting compromised MSP networks , and those of their customers , to stealthily move this data around the world . For more in-depth analysis of TRITON and other cyber threats , consider subscribing to FireEye Cyber Threat Intelligence .


This , in turn , would provide access to a larger amount of intellectual property and sensitive data . During this time , the attacker must ensure continued access to the target environment or risk losing years of effort and potentially expensive custom ICS malware .


APT10 has been observed to exfiltrate stolen intellectual property via the MSPs , hence evading local network defences . In this report we continue our research of the actor 's operations with a specific focus on a selection of custom information technology ( IT ) tools and tactics the threat actor leveraged during the early stages of the targeted attack lifecycle .


In order to gain any further credentials , APT10 will usually deploy credential theft tools such as mimikatz or PwDump , sometimes using DLL load order hijacking , to use against a domain controller , explained further in Annex B . Additionally , the actor possibly gained a foothold on other target networks—beyond the two intrusions discussed in this post – using similar strategies .


For example , in addition to compromising high value domain controllers and security servers , the threat actor has also been observed identifying and subsequently installing malware on low profile systems that provide non-critical support functions to the business , and are thus less likely to draw the attention of system administrators . There is often a singular focus from the security community on ICS malware largely due to its novel nature and the fact that there are very few examples found in the wild .


Primarily focused on governments and military operations of countries with interests in the South China Sea , Moafee likely chooses its targets based on region 's rich natural resources . In this blog post we provide additional information linking TEMP.Veles and their activity surrounding the TRITON intrusion to a Russian government-owned research institute .


By targeting high-tech and manufacturing operations in Japan and Taiwan , DragonOK may be acquiring trade secrets for a competitive economic advantage . Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates .


It is in use by the Molerats ( aka Gaza cybergang ) , a politically motivated group whose main objective , we believe , is intelligence gathering . TEMP.Veles' lateral movement activities used a publicly-available PowerShell-based tool , WMImplant .


DustySky has been developed and used since May 2015 by Molerats ( aka " Gaza cybergang " ) , a terrorist group whose main objective in this campaign is intelligence gathering . On multiple dates in 2017 , TEMP.Veles struggled to execute this utility on multiple victim systems , potentially due to AV detection .


FIN7 is a threat actor group that is financially motivated with targets in the restaurant , services and financial sectors . Custom payloads utilized by TEMP.Veles in investigations conducted by Mandiant are typically weaponized versions of legitimate open-source software , retrofitted with code used for command and control .


Seedworm likely functions as a cyber espionage group to secure actionable intelligence that could benefit their sponsor 's interests . We identified file creation times for numerous files that TEMP.Veles created during lateral movement on a target 's network .


After compromising a system , typically by installing Powermud or Powemuddy , Seedworm first runs a tool that steals passwords saved in users ' web browsers and email , demonstrating that access to the victim 's email , social media , and chat accounts is one of their likely goals . Adversary behavioral artifacts further suggest the TEMP.Veles operators are based in Moscow , lending some further support to the scenario that CNIIHM , a Russian research organization in Moscow , has been involved in TEMP.Veles activity .


It was during operator X 's network monitoring that the attackers placed Naikon proxies within the countries ' borders , to cloak and support real-time outbound connections and data exfiltration from high-profile victim organizations . XENOTIME is easily the most dangerous threat activity publicly known .


In addition to stealing keystrokes , Naikon also intercepted network traffic . CNIIHM 's characteristics are consistent with what we might expect of an organization responsible for TEMP.Veles activity .


Although most malware today either seeks monetary gain or conducts espionage for economic advantage , both of these activity groups appear to seek information about specific individuals . Dragos identified several compromises of ICS vendors and manufacturers in 2018 by activity associated with XENOTIME , providing potential supply chain threat opportunities and vendor-enabled access to asset owner and operator ICS networks .


PROMETHIUM uses a unique set of tools and methods to perform actions like lateral movement and data exfiltration . XENOTIME rose to prominence in December 2017 when Dragos and FireEye jointly published details of TRISIS destructive malware targeting Schneider Electric 's Triconex safety instrumented system .


Last year , Microsoft researchers described Neodymium 's behavior as unusual : " unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals . Targeting a safety system indicates significant damage and loss of human life were either intentional or acceptable goals of the attack , a consequence not seen in previous disruptive attacks such as the 2016 CRASHOVERRIDE malware that caused a power loss in Ukraine .


Unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals . XENOTIME used credential capture and replay to move between networks , Windows commands , standard command-line tools such as PSExec , and proprietary tools for operations on victim hosts .


The threat actor behind ProjectSauron commands a top-of-the-top modular cyber-espionage platform in terms of technical sophistication , designed to enable long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods . Dragos' data indicates XENOTIME remains active .


In March 2016 , Symantec published a blog on Suckfly , an advanced cyberespionage group that conducted attacks against a number of South Korean organizations to steal digital certificates . TEMP.Veles created a custom malware framework and tailormade credential gathering tools , but an apparent misconfiguration prevented the attack from executing properly .


During this time they were able to steal digital certificates from South Korean companies and launch attacks against Indian and Saudi Arabian government organizations . Furthermore , Dragos' analysis of the TRISIS event continues as we recover additional data surrounding the incident .


The ultimate objective of targeted attacks is to acquire sensitive data . XENOTIME operates globally , impacting regions far outside of the Middle East , their initial target .


Like many threat groups , TG-3390 conducts strategic web compromises ( SWCs ) , also known as watering hole attacks , on websites associated with the target organization 's vertical or demographic to increase the likelihood of finding victims with relevant information . Intelligence suggests the group has been active since at least 2014 and is presently operating in multiple facilities targeting safety systems beyond Triconex .


Based on this information , CTU researchers assess that TG-3390 aims to collect defense technology and capability intelligence , other industrial intelligence , and political intelligence from governments and NGOs . Dragos instead focuses on threat behaviors and appropriate detection and response .


CTU researchers have discovered numerous details about TG-3390 operations , including how the adversaries explore a network , move laterally , and exfiltrate data . Dragos assesses with moderate confidence that XENOTIME intends to establish required access and capability to cause a potential , future disruptive—or even destructive—event .


Within six hours of entering the environment , the threat actors compromised multiple systems and stole credentials for the entire domain . However , full details on XENOTIME and other group tools , techniques , procedures , and infrastructure is available to network defenders via Dragos WorldView .


As of this publication , BRONZE UNION remains a formidable threat group that targets intellectual property and executes its operations at a swift pace . This seems confusing as FireEye earlier publicly declared the TRITON as a discrete entity , linked to a Russian research institution , and christened it as " TEMP.Veles " .


This time the group chose a national data center as its target from an unnamed country in Central Asia in an attempt to gain " access to a wide range of government resources at one fell swoop " . This seems confusing as FireEye earlier publicly declared the " TRITON actor " as a discrete entity , linked to a Russian research institution , and christened it as " TEMP.Veles " .


Dell SecureWorks researchers unveiled a report on Threat Group-3390 that has targeted companies around the world while stealing massive amounts of industrial data . Meanwhile , parallel work at Dragos ( my employer , where I have performed significant work on the activity described above ) uncovered similar conclusions concerning TTPs and behaviors , for both the 2017 event and subsequent activity in other industrial sectors .


LAS VEGAS—Today at the Black Hat information security conference , Dell SecureWorks researchers unveiled a report on a newly detected hacking group that has targeted companies around the world while stealing massive amounts of industrial data . FireEye recently published a blog covering the tactics , techniques , and procedures ( TTPs ) for the " TRITON actor " when preparing to deploy the TRITON/TRISIS malware framework in 2017 .


Once inside networks , the group generally targeted Windows network domain controllers and Exchange e-mail servers , targeting user credentials to allow them to move to other systems throughout the targeted network . Based on information gained from discussion with the initial TRITON/TRISIS responders and subsequent work on follow-on activity by this entity , Dragos developed a comprehensive ( public ) picture of adversary activity roughly matching FireEye 's analysis published in April 2019 , described in various media .


Also , by creating this type of API access , Turla could use one accessible server as a single point to dump data to and exfiltrate data from . Since late 2018 , based upon the most-recent posting , FireEye appears to have " walked back " the previously-used terminology of TEMP.Veles and instead refers rather cryptically to the " TRITON actor " , while Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME .


However , based on the findings shared in this report we assess with high confidence that the actor 's primary long-term mission is politically focused . Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME .


The primary goal of these attacks was likely to find code-signing certificates for signing future malware . Aside from the competitive vendor naming landscape ( which I am not a fan of in cases on direct overlap , but which has more to say for itself when different methodologies are employed around similar observations ) , the distinction between FireEye and Dragos' approaches with respect to the " TRITON actor " comes down to fundamental philosophical differences in methodology .


ALLANITE uses email phishing campaigns and compromised websites called watering holes to steal credentials and gain access to target networks , including collecting and distributing screenshots of industrial control systems . In the 2018 public posting announcing TEMP.Veles , FireEye researchers noted that the institute in question at least supported TEMP.Veles activity in deploying TRITON .


ALLANITE operations limit themselves to information gathering and have not demonstrated any disruptive or damaging capabilities . My understanding is FireEye labels entities where definitive attribution is not yet possible with the " TEMP " moniker ( hence , TEMP.Veles ) – yet in this case FireEye developed and deployed the label , then appeared to move aACT from it in subsequent reporting .


A current round of cyber-attacks from Chinese source groups are targeting the maritime sector in an attempt to steal technology . In comparison , XENOTIME was defined based on principles of infrastructure ( compromised third-party infrastructure and various networks associated with several Russian research institutions ) , capabilities ( publicly- and commercially-available tools with varying levels of customization ) and targeting ( an issue not meant for discussion in this blog ) .


Dragos does not corroborate nor conduct political attribution to threat activity . Of note , this methodology of naming abstracts aACT the " who " element – XENOTIME may represent a single discrete entity ( such as a Russian research institution ) or several entities working in coordination in a roughly repeatable , similar manner across multiple events .


As recently as this past week , researchers observed Chinese hackers escalating cyber-attack efforts to steal military research secrets from US universities . Much like the observers watching the shadows of objects cast upon the wall of the cave , these two definitions ( XENOTIME and TEMP.Veles , both presumably referring to " the TRITON actor " ) describe the same phenomena , yet at the same time appear different .


The group has also targeted businesses operating in the South China Sea , which is a strategically important region and the focus of disputes between China and other states . To better understand how the adversary was operating and what other actions they had performed , CTU researchers examined cmd.exe and its supporting processes to uncover additional command line artifacts .


Like many espionage campaigns , much of APT40 's activity begins by attempting to trick targets with phishing emails , before deploying malware such as the Gh0st RAT trojan to maintain persistence on a compromised network . CTU researchers assess with high confidence that threat groups like Threat Group-1314 will continue to live off of the land to avoid detection and conduct their operations .


The group used malware with keylogging capabilities to monitor the computer of an executive who manages the company 's relationships with other telecommunications companies . Analysis of TG-3390 's operations , targeting , and tools led CTU researchers to assess with moderate confidence the group is located in the People's Republic of China .


We suspect that the group sought access to these networks to obtain information that would enable it to monitor communications passing through the providers' systems . The threat actors target a wide range of organizations : CTU researchers have observed TG-3390 actors obtaining confidential data on defense manufacturing projects , but also targeting other industry verticals and attacking organizations involved in international relations .


Bahamut was shown to be resourceful , not only maintaining their own Android malware but running propaganda sites , although the quality of these activities varied noticeably . In comparison to other threat groups , TG-3390 is notable for its tendency to compromise Microsoft Exchange servers using a custom backdoor and credential logger .


One curious trait of Bahamut is that it develops fully-functional applications in support of its espionage activities , rather than push nonfunctional fake apps or bundle malware with legitimate software . CTU researchers have evidence that the TG-3390 compromised U.S. and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations .


Curiously , Bahamut appears to track password attempts in response to failed phishing attempts or to provoke the target to provide more passwords . Based on analysis of the group 's SWCs , TG-3390 operations likely affect organizations in other countries and verticals .


Thus far , Bahamut 's campaigns have appeared to be primarily espionage or information operations – not destructive attacks or fraud . TG-3390 operates a broad and long-running campaign of SWCs and has compromised approximately 100 websites as of this publication .


Once the Barium Defendants have access to a victim computer through the malware described above , they monitor the victim 's activity and ultimately search for and steal sensitive documents ( for example , exfiltration of intellectual property regarding technology has been seen ) , and personal information fi"om the victim 's network . CTU researchers have evidence that the threat group compromised U.S. and UK organizations in the following verticals : manufacturing ( specifically aerospace ( including defense contractors ) , automotive , technology , energy , and pharmaceuticals ) , education , and legal , as well as organizations focused on international relations .


Based on the mutexes and domain names of some of their C&C servers , BlackTech 's campaigns are likely designed to steal their target 's technology . Like many threat groups , TG-3390 conducts strategic web compromises ( SWCs ) , also known as watering hole attacks , on websites associated with the target organization 's vertical or demographic to increase the likelihood of finding victims with relevant information .


Bookworm has little malicious functionality built-in , with its only core ability involving stealing keystrokes and clipboard contents . Through an IP address whitelisting process , the threat group selectively targets visitors to these websites .


Also , Bookworm uses a combination of encryption and compression algorithms to obfuscate the traffic between the system and C2 server . After the initial compromise , TG-3390 delivers the HTTPBrowser backdoor to its victims .


They have different functions and ways of spreading , but the same purpose — to steal money from the accounts of businesses . CTU researchers assess with high confidence that TG-3390 uses information gathered from prior reconnaissance activities to selectively compromise users who visit websites under its control .


At that time it was the name of a cybercriminal group that was stealing money from Russian financial establishments — to the tune of at least $150,000 per hit . TG-3390 uses the PlugX remote access tool .


Estimating the damages is challenging , but as we learned , the criminals are siphoning off assets in transactions that do not exceed $15,000 each . The SWC of a Uyghur cultural website suggests intent to target the Uyghur ethnic group , a Muslim minority group primarily found in the Xinjiang region of China .


Once an exploitable page is identified , Clever Kitten will attempt to upload a PHP backdoor to gain remote access to the system . The threat actors have used the Baidu search engine , which is only available in Chinese , to conduct reconnaissance activities .


Once an exploitable page is identified , the actor will attempt to upload a PHP backdoor to gain remote access to the system . Recently , CTU researchers responded to an intrusion perpetrated by Threat Group-1314 , one of numerous threat groups that employ the " living off the land " technique to conduct their intrusions .


In Clever Kitten 's attacks , the goal is lateral movement ; this is an attempt to move further into the target environment in order to begin intelligence collection . CTU researchers have observed the Threat Group-3390 obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both .


Confucius' operations include deploying bespoke backdoors and stealing files from their victim 's systems with tailored file stealers , some of which bore resemblances to Patchwork 's . CTU researchers have observed the threat group obtaining information about specific U.S. defense projects that would be desirable to those operating within a country with a manufacturing base , an interest in U.S. military capability , or both .


Threat actors like Confucius and Patchwork are known for their large arsenal of tools and ever-evolving techniques that can render traditional security solutions — which are often not designed to handle the persistent and sophisticated threats detailed in this blog — ineffective . TG-3390 can quickly leverage compromised network infrastructure during an operation and can conduct simultaneous intrusions into multiple environments .


In order to increase the likelihood of their malware successfully communicating home , cyber espionage threat actors are increasingly abusing legitimate web services , in lieu of DNS lookups to retrieve a command and control address . Malware used by the threat group can be configured to bypass network-based detection ; however , the threat actors rarely modify host-based configuration settings when deploying payloads .


To spread the Corkow malware criminals use a drive-by downloads method , when victims are infected while visiting compromised legitimate websites . TG-3390 uses older exploits to compromise targets , and CTU researchers have not observed the threat actors using zero-day exploits as of this publication .


Group-IB specialists detected various sites used by criminals to spread the Trojan : mail tracking websites , news portals , electronic books , computer graphics resources , music portals , etc . In addition to using SWCs to target specific types of organizations , TG-3390 uses spearphishing emails to target specific victims .


Metel is a banking Trojan ( also known as Corkow ) discovered in 2011 when it was used to attack users of online banking services . After gaining access to a target network in one intrusion analyzed by CTU researchers , TG-3390 actors identified and exfiltrated data for specific projects run by the target organization , indicating that they successfully obtained the information they sought .


After the infection stage , criminals move laterally with the help of legitimate and pentesting tools , stealing passwords from their initial victims ( entry point ) to gain access to the computers within the organization that have access to money transactions . Based on this information , CTU researchers assess that TG-3390 aims to collect defense technology and capability intelligence , other industrial intelligence , and political intelligence from governments and NGOs .


Delivering a backdoor and spyware , this campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video . Incident response engagements have given CTU researchers insight into the tactics TG-3390 employs during intrusions .


Delivering a backdoor and spyware , Desert Falcons 's campaign was designed to steal information from infected systems using a malware client capable of filtering out " uninteresting " files , and spread primarily via a targeted phishing email usually promising a pornographic video . CTU researchers have not observed TG-3390 actors performing reconnaissance prior to compromising organizations .


Talos said the perpetrators of DNSpionage were able to steal email and other login credentials from a number of government and private sector entities in Lebanon and the United Arab Emirates by hijacking the DNS servers for these targets , so that all email and virtual private networking ( VPN ) traffic was redirected to an Internet address controlled by the attackers . CTU researchers have observed the threat actors installing a credential logger and backdoor on Microsoft Exchange servers , which requires a technical grasp of Internet Information Services ( IIS ) .


Talos reported that these DNS hijacks also paved the way for the attackers to obtain SSL encryption certificates for the targeted domains ( e.g.webmail.finance.gov.lb ) , which allowed them to decrypt the intercepted email and VPN credentials and view them in plain text . TG-3390 is capable of using a C2 infrastructure that spans multiple networks and registrars .


This APT group usually carries out target attacks against government agencies to steal sensitive information . TG-3390 SWCs may be largely geographically independent , but the group 's most frequently used C2 registrars and IP net blocks are located in the U.S .


All attackers simply moved to new C2 infrastructure , based largely around dynamic DNS domains , in addition to making minimal changes to the malware in order to evade signature-based detection . Using a U.S. based C2 infrastructure to compromise targets in the U.S. helps TG-3390 actors avoid geo-blocking and geo-flagging measures used in network defense .


With GozNym , attackers dupe users by showing them the actual bank 's URL and SSL certificate . The threat actors create PlugX DLL stub loaders that will run only after a specific date .


During these intrusions , LEAD 's objective was to steal sensitive data , including research materials , process documents , and project plans . The compile dates of the samples analyzed by CTU researchers are all later than the hard-coded August 8 , 2013 date , indicating that the code might be reused from previous tools .


While the machine is in isolation , SOC personnel can direct the infected machine to collect live investigation data , such as the DNS cache or security event logs , which they can use to verify alerts , assess the state of the intrusion , and support follow-up actions . One archive sample analyzed by CTU researchers contained a legitimate PDF file , a benign image of interest to targets ( see Figure 8 ) , and an HTTPBrowser installer disguised as an image file .


In Russia , there were several relatively large cybercriminal groups engaged in financial theft via attacks on RBS . CTU researchers have observed TG-3390 activity between 04:00 and 09:00 UTC , which is 12:00 to 17:00 local time in China ( UTC +8 ) .


Since 2011 , the robbers had allegedly been stealing money directly from bank accounts in Russia and other countries of the Commonwealth of Independent States ( CIS ) by using a Trojan called Lurk . TG-3390 sends spearphishing emails with ZIP archive attachments .


Cadelle 's threats are capable of opening a back door and stealing information from victims' computers . CTU researchers have observed TG-3390 compromising a target organization 's externally and internally accessible assets , such as an OWA server , and adding redirect code to point internal users to an external website that hosts an exploit and delivers malware .


These threats are capable of opening a back door and stealing information from victims' computers . TG-3390 actors have used Java exploits in their SWCs .


Callisto Group appears to be intelligence gathering related to European foreign and security policy . In particular , TG-3390 has exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code .


Based on our analysis of Callisto Group 's usage of RCS Galileo , we believe the Callisto Group did not utilize the leaked RCS Galileo source code , but rather used the leaked readymade installers to set up their own installation of the RCS Galileo platform . In activity analyzed by CTU researchers , TG-3390 executed the Hunter web application scanning tool against a target server running IIS .


Called Greenbug , this group is believed to be instrumental in helping Shamoon steal user credentials of targets ahead of Shamoon 's destructive attacks . In particular , the threat actors have exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HTTPBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code .


On Tuesday , Arbor Networks said that it has new leads on a credential stealing remote access Trojan ( RAT ) called Ismdoor , possibly used by Greenbug to steal credentials on Shamoon 's behalf . TG-3390 uses DLL side loading , a technique that involves running a legitimate , typically digitally signed , program that loads a malicious DLL .


It's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost . CTU researchers have observed the Threat Group-3390 employing legitimate Kaspersky antivirus variants in analyzed samples .


t's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost . The adversaries have used this technique to allow PlugX and HTTPBrowser to persist on a system .


In the context of the Ismdoor RAT , the DNS attack technique is used primarily by Greenbug for stealing credentials . CTU researchers have observed the TG-3390 employing legitimate Kaspersky antivirus variants in analyzed samples .


According to the security experts , this collection of malware was discovered after their first initial report was published , meaning that Group 27 ignored the fact they were unmasked and continued to infect their targets regardless , through the same entry point , the Myanmar Union Election Commission ( UEC ) website . TG-3390 actors have deployed the OwaAuth web shell to Exchange servers , disguising it as an ISAPI filter .


The attackers compromised two legitimate Thai websites to host the malware , which is a tactic this group has used in the past . In other cases , threat actors placed web shells on externally accessible servers , sometimes behind a reverse proxy , to execute commands on the compromised system .


We were not able to find additional tools , but the attackers again compromised a legitimate Thai website to host their malware , in this case the student portal for a Thai University . CTU researchers have discovered numerous details about TG-3390 operations , including how the adversaries explore a network , move laterally , and exfiltrate data .


As we have seen in some previous targeted malware attacks , the attackers in this incident are taking advantage of services like changeip.com to establish free subdomains in their infrastructure . When the adversaries' operations are live , they modify the record again to point the C2 domain to an IP address they can access .


Blending in with legitimate traffic is a common tactic used by attackers to help fly under the radar . They then identify the Exchange server and attempt to install the OwaAuth web shell .


The Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information . If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail , TG-3390 identify other externally accessible servers and deploy ChinaChopper web shells .


he Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information . After compromising an initial victim 's system ( patient 0 ) , the threat actors use the Baidu search engine to search for the victim 's organization name .


In another modification , first observed in the most recent October 11 Parliamentarian operation ( version agewkassif ) , the developer (s ) of KeyBoy began using a string obfuscation routine in order to hide many of the critical values referenced within the malware . CTU researchers discovered the threat actors searching for " [company] login " , which directed them to the landing page for remote access .


To control the full operation , MoneyTaker uses a Pentest framework Server . TG-3390 actors keep track of and leverage existing ASPXTool web shells in their operations , preferring to issue commands via an internally accessible Web shell rather than HTTPBrowser or PlugX .


At the end of June 2015 Mofang started its campaign to gather information of a specific target in relation to the sezs : the cpg Corporation . Within six hours of entering the environment , the threat actors compromised multiple systems and stole credentials for the entire domain .


After successfully infecting one of the computers and gaining initial access to the system , the attackers perform reconnaissance of the local network in order to gain domain administrator privileges and eventually consolidate control over the network . Despite multiple public disclosures of their activities , BRONZE UNION remains an active and formidable threat as of this publication .


This newly observed activity uses a series of redirections and fileless , malicious implementations of legitimate tools to gain access to the targeted systems . In 2015 , the SecureWorks® Counter Threat Unit™ ( CTU ) research team documented the BRONZE UNION threat group ( formerly labeled TG-3390 ) , which CTU™ analysis suggests is based in the People's Republic of China ( PRC ) .


The goal of the attackers appears to be to collect intellectual property such as design documents , formulas , and manufacturing processes . After reestablishing access , the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used .


The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage . In 2015 , the SecureWorks documented the BRONZE UNION threat group ( formerly labeled TG-3390 ) , which CTU analysis suggests is based in the People's Republic of China ( PRC ) .


This particular threat was also used by hackers to compromise a Korean social network site to steal records of 35 million users . BRONZE UNION threat campaigns that illustrate the evolution of the group 's methods and espionage objectives .


These attacks are primarily targeting private industry in search of key intellectual property for competitive advantage , military institutions , and governmental organizations often in search of documents related to current political events and human rights organizations . Based on BRONZE UNION 's targeting activity , CTU researchers assess it is highly likely that the group focuses on political and defense organization networks .


Nitro 's campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes . this SWC was used to specifically target Turkish .


This attack campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes . In 2016 , the threat actors conducted a strategic web compromise ( SWC ) on the website of an international industry organization that affected aerospace , academic , media , technology , government , and utilities organizations around the world .


Examples of notable Potao dissemination techniques , some of which were previously unseen , or at least relatively uncommon , include the use of highly-targeted spear-phishing SMS messages to drive potential victims to malware download sites and USB worm functionality that tricked the user into ' willingly ' executing the trojan . In addition , BRONZE UNION activity on multiple U.S.-based defense manufacturer networks included the threat actors seeking information associated with aerospace technologies , combat processes , and naval defense systems .


The PassCV group continues to be one of the most successful and active threat groups that leverage a wide array of stolen Authenticode-signing certificates . this SWC was used to specifically target Turkish goverment .


The PassCV group continues to be extremely effective in compromising both small and large game companies and surreptitiously using their code-signing certificates to infect an even larger swath of organizations . Since that analysis , CTU researchers have observed multiple BRONZE UNION threat campaigns that illustrate the evolution of the group 's methods and espionage objectives .


The ScarCruft group keeps expanding its exfiltration targets to steal further information from infected hosts and continues to create tools for additional data exfiltration . this SWC was used to specifically target Turkish banking .


Financially motivated APT groups which focus efforts on targeted attacks on the financial sector such as — Anunak , Corkow , Buhtrap — usually managed botnets using developed or modified banking Trojans . this SWC was used to specifically target Turkish academic networks .


They are selective in their attacks and wait for about three months between incidents , which is approximately three times longer than other financially motivated APT groups , like MoneyTaker , Anunak ( Carbanak ) , Buhtrap or Cobalt . BRONZE UNION has consistently demonstrated the capability to conduct successful large-scale intrusions against high-profile networks and systems .


The company specializes in finance and natural resources specific to that region . The threat actors appear to be able to create and leverage multiple SWCs in parallel .


Based on the profile of the victims and the type of information targeted by the attackers , Symantec believes that Butterfly is financially motivated , stealing information it can potentially profit from . In a separate incident , CTU researchers identified a file named s.txt , which is consistent with the output of the Netview host-enumeration tool .


Fxmsp specialize in breaching highly secure protected networks to access private corporate and government information . BRONZE UNION actors leveraged initial web shell access on Internet-facing systems to conduct internal reconnaissance .


But , thanks to the attackers known affection for decoy documents that pose as news summaries , we were able to date the campaign back to March 2018 . BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control ( C2 ) and operational infrastructure .


Donot attacked government agencies , aiming for classified intelligence . This script relays commands and output between the controller and the system .


Lazarus is a very active attack group involved in both cyber crime and espionage . The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server ( systsm.webServer/httplogging ) and then delete existing logs from the system ( see Figure 4 ) .


To make the fraudulent withdrawals , Lazarus first breaches targeted banks' networks and compromises the switch application servers handling ATM transactions . In 2016 , CTU researchers observed the group using native system .


The operation , known as FASTCash” has enabled Lazarus to fraudulently empty ATMs of cash . In March 2018 we detected an ongoing campaign .


This malware in turn intercepts fraudulent Lazarus cash withdrawal requests and sends fake approval responses , allowing the attackers to steal cash from ATMs . TG-3390 's activities indicate a preference for leveraging SWCs and scan-and-exploit techniques to compromise target systems .


The threat actors behind the Sea Turtle campaign were successful in compromising entities by manipulating and falsifying DNS records at various levels in the domain name space . As of this publication , BRONZE UNION remains a formidable threat group that targets intellectual property and executes its operations at a swift pace .


If an attacker was able to compromise an organization's network administrator credentials , the attacker would be able to change that particular organization's DNS records at will . we detected an ongoing campaign targeting a national data center .


If the attackers were able to obtain one of these EPP keys , they would be able to modify any DNS records that were managed by that particular registrar . The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool ( RAT ) .


Captured legitimate user credentials when users interacted with these actor - controlled servers . we detected an ongoing campaign targeting a national data center in the Centeral Asia .


During a typical incident , the actor would modify the NS records for the targeted organization , pointing users to a malicious DNS server that provided actor-controlled responses to all DNS queries . The tools found in this campaign , such as the HyperBro Trojan , are regularly used by a variety of Chinese-speaking actors .


The next step for the actor was to build MitM servers that impersonated legitimate services to capture user credentials . Due to tools and tactics in use we attribute the campaign to LuckyMouse Chinese-speaking actor ( also known as EmissaryPanda and APT27 ) .


This redirection allowed the attackers to harvest credentials of administrators who manage domains with the TLD of Saudi Arabia (.sa) . It's possible TG-3390 used a waterhole to infect data center employees .


Obtaining access to this ccTLD registrars would have allowed attackers to hijack any domain that used those ccTLDs . Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 ( Microsoft Office Equation Editor , widely used by Chinese-speaking actors since December 2017 ) , we can′t prove they were related to this particular attack .


Once they have access to the network , they steal the organization's legitimate SSL certificate and use it on actor-controlled servers . We suspect this router was hacked as part of the campaign in order to process the malware 's HTTP requests .


The document exploited CVE-2012-0158 and will decode and write an executable to disk upon infection . In March 2017 , Wikileaks published details about an exploit affecting Mikrotik called ChimayRed .


iSiGHT Partners has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 . There were traces of HyperBro in the infected data center from mid-November 2017 .


In July of 2015 , we identified a full e-mail uploaded to an antivirus scanning service that carried a Scarlet Mimic exploit document . In March 2017 , Wikileaks published details about an exploit affecting Mikrotik called ChimayRed .


The group uses legitimate administration tools to fly under the radar in their post-exploitation phase , which makes detection of malicious activity , as well as attribution more complicated . This is a hacking group with Chinese origins which targets selected organisations related with education , energy and technology .


Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download . Usually , the delivered payload is either the well-known ' PlugX ' or ' HTTPBrowser ' RAT , a tool which is believed to have Chinese origins and to be used only by certain Chinese hacking groups .


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 . Emissary Panda has used many ACTs with the most notable being the exploits from the Hacking Team leak .


As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware . Emissary Panda is still active and continues to target selected organisations .


FireEye believes that two actors – Turla and an unknown financially motivated actor – were using the first EPS zero-day CVE-2017-0261 , and APT28 was using the second EPS zero-day CVE-2017-0262 along with a new Escalation of Privilege (EOP) zero-day CVE-2017-0263 . Cybersecurity researchers have uncovered an espionage campaign that has targeted a national data center of an unnamed central Asian country in order to conduct watering hole attacks .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME . The campaign is believed to be active covertly since fall 2017 .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” . LuckyMouse , also known as Iron Tiger , EmissaryPanda , APT 27 and Threat Group-3390 , is the same group of Chinese hackers who was found targeting Asian countries with Bitcoin mining malware early this year .


It is possible that CVE-2017-8759 was being used by additional actors . March by security researchers from Kaspersky Labs .


The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities . For example , at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network .


The Magnitude EK landing page consisted of CVE-2016-0189 , which was first reported by FireEye as being used in Neutrino Exploit Kit after it was patched . The group has been active since at least 2010 and was behind many previous attack campaigns resulting in the theft of massive amounts of data from the directors and managers of US-based defense contractors .


The malware leverages an exploit , codenamed EternalBlue” , that was released by the Shadow Brokers on April 14 , 2017 . attacks to a Chinese-speaking threat actor group called LuckyMouse .


Some hackers even went onto use the Cisco exploits in the wild . LuckyMouse has been spotted using a widely used Microsoft Office vulnerability ( CVE-2017-11882 ) .


DanderSpritz is the framework for controlling infected machines , different from FuZZbuNch as the latter provides a limited toolkit for the post-exploitation stage with specific functions such as DisableSecurity and EnableSecurity for DarkPulsar . This time the group chose a national data center as its target from an unnamed country in Central Asia in an attempt to gain " access to a wide range of government resources at one fell swoop " .


In their latest leak , they have released the UNITEDRAKE NSA exploit , which is a remote access and control tool that can remotely target Windows-based systems to capture desired information and transfer it to a server . The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center .


On the other hand , ShadowBrokers group made headlines in 2016 when it claimed to have robbed various exploitation tools used by the NSA including the notorious ETERNALBLUE that was a vital component in the WannaCry ransomware campaign causing damages to systems worldwide . According to the researchers , the group injected malicious JavaScript code into the official government websites associated with the data center in order to conduct watering hole attacks .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . the targeted system with a piece of malware called HyperBro , a Remote Access Trojan ( RAT ) .


Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word . The main command and control ( C&C ) server used in this attack is hosted on an IP address which belongs to a Ukrainian ISP , specifically to a MikroTik router running a firmware version released in March 2016 .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . the targets of the hacking group were in the automotive .


In order to carry out this operation , it uses publicly available tools , including Mimikatz ( Hacktool.Mimikatz ) and an open-source tool that exploits a known Windows privilege escalation vulnerability ( CVE-2016-0051 ) on unpatched computers . Dell SecureWorks researchers unveiled a report on Threat Group-3390 that has targeted companies around the world while stealing massive amounts of industrial data .


Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) . The group , believed to be based in China , has also targeted defense contractors , colleges and universities , law firms , and political organizations — including organizations related to Chinese minority ethnic groups .


The Word document usually exploits CVE-2012-0158 . LAS VEGAS—Today at the Black Hat information security conference , Dell SecureWorks researchers unveiled a report on a newly detected hacking group that has targeted companies around the world while stealing massive amounts of industrial data .


Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 . Designated as Threat Group 3390 and nicknamed " Emissary Panda " by researchers , the hacking group has compromised victims' networks largely through " watering hole " attacks launched from over 100 compromised legitimate websites , sites picked because they were known to be frequented by those targeted in the attack .


Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 . the United Kingdom had data stolen by members of Emissary Panda .


The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . the US had data stolen by members of Emissary Panda .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . No zero-day vulnerabilities were used to breach targeted networks , instead " TG-3390 relied on old vulnerabilities such as CVE-2011-3544 " — a near-year-old Java security hole — " and CVE-2010-0738 to compromise their targets " , Dell SecureWorks' researchers reported .


The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components . The group used a number of tools common to other Chinese hacking groups , but they had a few unique tools of their own with interfaces developed for Standard ( Simplified ) Chinese .


The document files exploit at least three known vulnerabilities in Microsoft Office , which we discuss in the Infection Techniques section . If the address falls within ranges that the attackers are interested in , the malicious site waits for their next page view to drop an exploit on the desirable target 's PC .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . Visitors to sites exploited by Emissary Panda are directed by code embedded in the sites to a malicious webpage , which screens their IP address .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability . There has also been at least one victim targeted by a spear-phishing attack .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . A variety of malware , including the PlugX tool , was shared with other known Chinese threat groups .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat . Once inside networks , the group generally targeted Windows network domain controllers and Exchange e-mail servers , targeting user credentials to allow them to move to other systems throughout the targeted network .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . They used an exploit of Internet Information Server to inject keylogger and backdoor malware onto the Exchange server .


Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . But two tools used were unique to the group : ASPXTool , an Internet Information Services ( IIS ) specific " Web shell " used to gain access to servers inside a target 's network ; and the OwaAuth credential stealing tool and Web shell , used to attack Microsoft Exchange servers running the Web Outlook interface .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . By using such features and tools , attackers are hoping to blend in on the victim 's network and hide their activity in a sea of legitimate processes .


PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 . TAA leverages advanced artificial intelligence and machine learning that combs through Symantec 's data lake of telemetry in order to spot patterns associated with targeted attacks .


Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) . January 2018 , TAA triggered an alert at a large telecoms operator in Southeast Asia .


The Word document usually exploits CVE-2012-0158 . Thrip was using PsExec to move laterally between computers on the company 's network .


Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 . TAA triggered an alert at a large telecoms operator in Southeast Asia .


Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 . AA triggered an alert at a large telecoms operator in Southeast Asia .


The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . PsExec is a Microsoft Sysinternals tool for executing processes on other systems and is one of the most frequently seen legitimate pieces of software used by attackers attempting to live off the land .


Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability . TAA not only flagged this malicious use of PsExec , it also told us what the attackers were using it for .


PittyTiger has also been seen using Heartbleed vulnerability in order to directly get valid credentials . Thrip was attempting to remotely install a previously unknown piece of malware ( Infostealer.Catchamas ) on computers within the victim 's network .


They have also been seen using Heartbleed vulnerability in order to directly get valid credentials . three computers in China being used to launch the Thrip attacks .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) . Perhaps the most worrying discovery we made was that Thrip had targeted a satellite communications operator .


PittyTiger could also use CVE-2014-1761 , which is more recent . Thrip seemed to be mainly interested in the operational side of the company .


PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts . This suggests to us that Thrip 's motives go beyond spying and may also include disruption .


The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components . Armed with this information about the malware and living off the land tactics being used by this group of attackers whom we named Thrip , we broadened our search to see if we could find similar patterns that indicated Thrip had been targeting other organizations .


When the document was opened in Word , PLATINUM exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer . The group had also targeted three different telecoms operators , all based in Southeast Asia .


The DLL exploited another previously unknown vulnerability ( designated CVE-2015-2546 ) in the Windows kernel , which enabled it to elevate privileges for the Word executable and subsequently install a backdoor through the application . In all cases , based on the nature of the computers infected by Thrip , it appeared that the telecoms companies themselves and not their customers were the targets of these attacks .


When the document was opened in Word , it exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer . Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection .


In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves . Many of the tools they use now feature new behaviors , including a change in the ACT they maintain a foothold in the targeted network .


PLATINUM has used several zero-day exploits against their victims . Execute a command through exploits for CVE-2017-11882 .


Even if CVE-2015-2546 affected Windows 10 , the exploitation would have required much more technical prowess to succeed ; ultimately , SMEP makes it more difficult for attackers . Execute a command through exploits for CVE-2018-0802 .


For example , one zero-day vulnerability exploit ( CVE-2015-2545 ) used by PLATINUM was addressed immediately in September 2015 . The backdoor will load the encrypted configuration file and decrypt it , then use Secure Sockets Layer ( SSL ) protocol to connect to command-and-control ( C&C ) servers .


It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks . TClient is actually one of Tropic Trooper 's other backdoors .


In 2016 , an attack campaign by this group was recorded in early May that made use of an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player , which at the time was both unknown and unpatched . The malicious loader will use dynamic-link library ( DLL ) hijacking — injecting malicious code into a process of a file/application — on sidebar.exe and launch dllhost.exe ( a normal file ) .


To deliver the malware to the victim machines , the Rocke group exploits vulnerabilities in Apache Struts 2 , Oracle WebLogic , and Adobe ColdFusion . TClient , for instance , uses DLL hijacking and injection that may not be as noticeable to others .


However , around a month ago , Rocke started targeting systems that run Jenkins by attempting to exploit CVE-2018-1000861 and CVE-2019-1003000 . The backdoor noted by other security researchers was encoded with different algorithms and configured with different parameter names in 2016 , for instance .


The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites . Taiwan has been a regular target of Cyber Espionage threat actors for a number of years .


In April , 2018 , the 360 Core Security takes the lead in capturing the APT-C-06 group’s new APT attack using 0-day vulnerabilities (CVE-2018-8174) in the wild . In early August , Unit 42 identified two attacks using similar techniques .


The group has demonstrated access to zero-day vulnerabilities (CVE-2018-0802) , and the ability to incorporate them into operations . which has been active since at least 2011 .


FireEye observed a high volume of activity associated with the exploitation of CVE-2017-10271 following the public posting of proof of concept code in December 2017 . One of the attacks used Tropic Trooper 's known Yahoyah malware , but the other attack deployed the widely available Poison Ivy RAT .


If the lateral movement with credentials fails , then the malware uses PingCastle MS17-010 scanner (PingCastle is a French Active Directory security tool) to scan that particular host to determine if its vulnerable to EternalBlue , and uses it to spread to that host . This confirms the actors are using Poison Ivy as part of their toolkit , something speculated in the original Trend Micro report but not confirmed by them .


Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() . The document attached to this e-mail exploits CVE-2012-0158 .


We assess that the actors employing this latest Flash zero-day are a suspected North Korean group we track as TEMP.Reaper . As we have noted in many earlier reports , attackers commonly use decoy files to trick victims into thinking a malicious document is actually legitimate .


Figure 2: Zyklon attack flowInfection Techniques CVE-2017-8759 . Further analysis uncovered a handful of ties indicating the actors may also be using the PCShare malware family , which has not been previously tied to the group .


This vulnerability was discovered by FireEye in September 2017 , and it is a vulnerability we have observed being exploited in the wild . This matches with known Tactics , Techniques , and Procedures ( TTPs ) for Tropic Trooper , targeting both government institutions and also the energy industry in Taiwan .


Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly , we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office . Tropic Trooper is also still exploiting CVE-2012-0158 , as are many threat actors .


The other overlapping files are tools used by the adversary to locate other systems on the network etool.exe , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 checker1.exe and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket psexec.exe . The Tropic Trooper threat actor group has been known to target governments and organizations in the Asia Pacific region for at least six years .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell . Turla is a notorious group that has been targeting governments .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 . Turla is known to run watering hole and spearphishing campaigns to better pinpoint their targets .


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework . Turla is a notorious group that has been targeting government officials .


According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors .


According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL . Turla is a notorious group that has been targeting diplomats .


Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 . The codename for Turla APT group in this presentation is MAKERSMARK .


The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . The Intercept reported that there exists a 2011 presentation by Canada 's Communication Security Establishment ( CSE ) outlining the errors made by the Turla operators during their operations even though the tools they use are quite advanced .


APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . The witnessed techniques , tactics and procedures ( TTPs ) are in-line with what we usuallysee in Turla 's operation : a first stage backdoor , such as Skipper , likely delivered through spearphishing followed by the appearance on the compromised system of a second stage backdoor , Gazerin this case .


The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware . Southeastern Europe as well as countries in the former Soviet Union Republichas recently been the main target .


APT28 is using novel techniques involving the EternalBlue exploit and the open source tool Responder to spread laterally through networks and likely target travelers . Finally , there are many similarities between Gazer and other second stage backdoors used by the Turla group such as Carbon and Kazuar .


The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 . Skipper , which has been linked to Turla in the past , was found alongside Gazer in most cases we investigated .


We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit . Turla APT group makes an extra effort to avoid detection by wiping files securely , changing the strings and randomizing what could be simple markers through the different backdoor versions .


FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including government institutions .


FireEye iSIGHT Intelligence confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims . Turla all uses an encrypted container to store the malware 's components and configuration and they also log their actions in a file .


A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . Over the last 10 months , Kaspersky Lab researchers have analyzed a massive cyber-espionage operation which we call " Epic Turla " .


A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group . We also observed exploits against older ( patched ) vulnerabilities , social engineering techniques and watering hole strategies in these attacks .


Kaspersky found the BlackOasis group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including embassies .


Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including military .


BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including education .


The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems . When G-Data published on Turla/Uroburos back in February , several questions remained unanswered .


BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including research and pharmaceutical companies .


The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks . The primary backdoor used in the Epic attacks is also known as " WorldCupSec " , " TadjMakhal " , " Wipbot " or " Tavdig " .


While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization . Thrip 's motive is likely espionage and its targets include those in the communications , geospatial imaging , and defense sectors , both in the United States and Southeast Asia .


While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization . One big unknown was the infection vector for Turla ( aka Snake or Uroburos ) .


Carbanak is a remote backdoor ( initially based on Carberp ) , designed for espionage , data exfiltration and to provide remote access to infected machines . The mothership server is generally a VPS , which runs the Control panel software used to interact with the victims .


If found on the target system , Carbanak will try to exploit a known vulnerability in Windows XP , Windows Server 2003 , Windows Vista , Windows Server 2008 , Windows 7 , Windows 8 , and Windows Server 2012 , CVE-2013-3660 , for local privilege escalation . the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated .


To enable connections to the infected computer using the Remote Desktop Protocol ( RDP ) , Carbanak sets Termservice service execution mode to Auto . Once a victim is confirmed as " interesting " , the attackers upload another Epic backdoor which has a unique ID used to control this specific victim .


Carbanak is also aware of the IFOBS banking application and can , on command , substitute the details of payment documents in the IFOBS system . Our analysis indicates this is a sophisticated multi-stage infection ; which begins with Epic Turla .


Sensitive bank documents have be found on the servers that were controlling Carbanak . this attack against a Kaspersky Lab user on August 5 , 2014 .


Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa . VENOMOUS BEAR is an advanced , Russia-based adversary that's been active since at least 2004 .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers . Venomous Bear has deployed malware to targets using several novel methods .


This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies . For years , Turla has relied , among other impersonations , on fake Flash installers to compromise victims .


Carbanak has its origin in more common financial fraud including theft from consumer and corporate bank accounts in Europe and Russia , using standard banking malware , mainly Carberp . Turla merely uses the Adobe brand to trick users into downloading the malware .


From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space . By looking at our telemetry , we found evidence that Turla installers were exfiltrating information to get.adobe.com URLs since at least July 2016 .


Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems . Thus , it is clear they are trying to be as stealthy as possible by hiding in the network traffic of the targeted organizations .


To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer . Finally , some of the victims are also infected with other Turla-related malware such as ComRAT or Gazer .


Additionally the reports on Carbanak show a different picture , where banks targeted outside of Russia , specifically Europe , USA and Japan are mentioned , which does not match our research . Kaspersky Lab documented this behavior in 2014 .


These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider . It is not a new tactic for Turla to rely on fake Flash installers to try to trick the user to install one of their backdoors .


The leader of the crime gang behind the Carbanak and Cobalt malware attacks targeting over a 100 financial institutions worldwide has been arrested in Alicante , Spain , after a complex investigation conducted by the Spanish National Police . Turla operators could use an already-compromised machine in the network of the victim 's organization to perform a local MitM attack .


Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt . Our January 2018 white paper was the first public analysis of a Turla campaign called Mosquito .


Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent . It is not the first time Turla has used generic tools .


Just a few months later , in February 2015 , we announced the discovery of Carbanak , a cyber-criminal gang that used custom malware and APT techniques to steal millions of dollars while infecting hundreds of financial institutions in at least 30 countries . In the past , we have seen the group using open-source password dumpers such as Mimikatz .


However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . Starting in March 2018 , we observed a significant change in the campaign : it now leverages the open source exploitation framework Metasploit before dropping the custom Mosquito backdoor .


In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company . Even an experienced user can be fooled by downloading a malicious file that is apparently from adobe.com , since the URL and the IP address correspond to Adobe 's legitimate infrastructure .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 . However , to our knowledge , this is the first time Turla has used Metasploit as a first stage backdoor , instead of relying on one of its own tools such as Skipper .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . Traffic was intercepted on a node between the end machine and the Adobe servers , allowing Turla 's operators to replace the legitimate Flash executable with a trojanized version .


While the URL acts similarly to how eye-watch.in : 443 delivers payloads , we also saw the URL leveraging and exploiting security flaws in Flash : CVE-2015-8651 , CVE-2016-1019 , and CVE-2016-4117 . At the beginning of March 2018 , as part of our regular tracking of Turla 's activities , we observed some changes in the Mosquito campaign .


The exploit , which takes advantage of CVE-2018-4878 , allows an attacker to execute arbitrary code such as an implant . In this post , we have presented the evolutions of the Turla Mosquito campaign over the last few months .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal . Primary targets for this adversary are in the government , aerospace , NGO , defense , cryptology and education sectors .


WannaCry utilizes EternalBlue by crafting a custom SMB session request with hard-coded values based on the target system . Turla 's campaign still relies on a fake Flash installer but , instead of directly dropping the two malicious DLLs , it executes a Metasploit shellcode and drops , or downloads from Google Drive , a legitimate Flash installer .


WannaCry leverages an exploit , codenamed " EternalBlue " , that was released by the Shadow Brokers on April 14 , 2017 . The Turla espionage group has been targeting various institutions for many years .


Microsoft addressed the SMBv1 vulnerabilities in March 2017 with Security Bulletin MS17-010 . Recently , we found several new versions of Carbon , a second stage backdoor in the Turla group arsenal .


The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April . The Turla group is known to be painstaking and work in stages , first doing reconnaissance on their victims' systems before deploying their most sophisticated tools such as Carbon .


If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit . Kaspersky APT Intelligence Reporting subscription , customers received an update in mid-February 2017 .


Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft . Like previous Turla activity , WhiteBear leverages compromised websites and hijacked satellite connections for command and control ( C2 ) infrastructure .


The EternalBlue exploit from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 . WhiteBear is a parallel project or second stage of the Skipper Turla cluster of activity documented in another private intelligence report " Skipper Turla – the White Atlas framework " from mid-2016 .


The Leafminer operators use EternalBlue to attempt lateral movement within target networks from compromised staging servers . However , despite the similarities to previous Turla campaigns , we believe that WhiteBear is a distinct project with a separate focus .


Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address . From February to September 2016 , WhiteBear activity was narrowly focused on embassies and consular operations around the world .


The attachments exploited CVE-2017-8759 which was discovered and documented only five days prior to the campaign . Continued WhiteBear activity later shifted to include defense-related organizations into June 2017 .


Some of the documents exploited CVE-2017-0199 to deliver the payload . All of these early WhiteBear targets were related to embassies and diplomatic/foreign affair organizations .


The group 's capabilities are more than the much discussed CVE-2012-0158 exploits over the past few years . Thus , Turla operators had access to some highly sensitive information ( such as emails sent by the German Foreign Office staff ) for almost a year .


Instead , the Spring Dragon group is known to have employed spearphish exploits , strategic web compromises , and watering holes attack . Our investigation also led to the discovery of dozens of email addresses registered by Turla operators for this campaign and used to receive exfiltrated data from the victims .


The group 's spearphish toolset includes PDF exploits , Adobe Flash Player exploits , and the common CVE-2012-0158 Word exploits including those generated from the infamous " Tran Duy Linh " kit . It mainly targets Microsoft Outlook , a widely used mail client , but also targets The Bat! , a mail client very popular in Eastern Europe .


While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past , Spring Dragon employs more involved and creative intrusive activity as well . First , Turla steals emails by forwarding all outgoing emails to the attackers .


To mitigate the threat of the described campaign , security teams can consider blocking access to the C2 server 103.236.150.14 and , where applicable , ensure that the Microsoft Security Update KB2553204 is installed in order to patch the CVE-2017-11882 vulnerability . We identified several European governments and defense companies compromised with this group .


The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign . What actually happens is that the malware is able to decode data from the PDF documents and interpret it as commands for the backdoor .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 . In early 2018 , multiple media claimed that Turla operators used mail attachments to control infected machines .


Lotus Blossom attempted to exploit CVE-2014-6332 using the POC code available in the wild . As detailed in the previous section , this malware is able to manipulate and exfiltrate emails .


Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 . To our knowledge , Turla is the only espionage group that currently uses a backdoor entirely controlled by emails , and more specifically via PDF attachments .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . The attackers first infected in March 2017 .


In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch . Our research shows that compromised organizations are at risk of not only being spied on by the Turla group who planted the backdoor , but also by other attackers .


PIVY also played a key role in the 2011 campaign known as Nitro that targeted chemical makers , government agencies , defense contractors , and human rights groups.10,11 Still active a year later , the Nitro attackers used a zero-day vulnerability in Java to deploy PIVY in 2012 . The developers refer to this tool by the name Kazuar , which is a Trojan written using the Microsoft.NET Framework that offers actors complete access to compromised systems targeted by its operator .


Just recently , PIVY was the payload of a zero-day exploit in Internet Explorer used in what is known as a " strategic web compromise " attack against visitors to a U.S. government website and a variety of others . We suspect the Kazuar tool may be linked to the Turla threat actor group ( also known as Uroburos and Snake ) , who have been reported to have compromised embassies , defense contractors , educational institutions , and research organizations across the globe .


It came in the form of a " Tran Duy Linh " CVE-2012-0158 exploit kit document MD5 : de8a242af3794a8be921df0cfa51885f61 and was observed on April 10 , 2014 . This is also a full-featured backdoor controlled by email , and which can work independently of any other Turla component .