Among the artifacts hosted in GreedyAntd 's servers , we managed to find a single component not related to the same cryptojacking operation just previously discussed and leveraged by Pacha Group .


It was one of the few ransomware strains that were being mass-distributed via email spam and exploit kits , but also as part of targeted attacks against high-profile organizations ( a tactic known as big-game hunting ) at the same time .


The GandCrab author also had a spat with South Korean security vendor AhnLab last summer after the security firm released a vaccine for the GandCrab ransomware .


Recently , Sophos Labs has observed criminal groups scanning the internet for open MySQL databases running on Windows systems , which they tried to infect with GandCrab .


CrowdStrike Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams .


Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February .


CrowdStrike® Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams .


PINCHY SPIDER is the criminal group behind the development of the ransomware most commonly known as GandCrab , which has been active since January 2018 .


PINCHY SPIDER sells access to use GandCrab ransomware under a partnership program with a limited number of accounts .


The main catalyst for dedicated development by PINCHY SPIDER , however , has been an ongoing battle with cybersecurity providers that are actively developing GandCrab mitigations and decryptors .


In February , PINCHY SPIDER released version 5.2 of GandCrab , which is immune to the decryption tools developed for earlier versions of GandCrab and in fact , was deployed the day before the release of the latest decryptor .


CrowdStrike Intelligence first identified new GandCrab ransomware deployment tactics in mid-February , when a threat actor was observed performing actions on a victim host in order to install GandCrab .


Using RDP and stolen credentials from the initially compromised host , the threat actor then proceeded to move laterally around the victim network and was able to deploy GandCrab across several other hosts .


Near the end of February , CrowdStrike Intelligence observed another incident in which similar manual lateral movement techniques were used to deploy GandCrab across multiple hosts in an enterprise .


Once Domain Controller access was acquired , Pinchy Spider used the enterprise 's own IT systems management software , LANDesk , to deploy a loader to hosts across the enterprise .


This loader , known as Phorpiex Downloader , is not specifically tied to GandCrab or PINCHY SPIDER , and it has previously been observed dropping other malware , such as Smoke Bot , Azorult , and XMRig .


As reported in the CrowdStrike 2018 Global Threat Report , big game hunting was a trend that helped define the criminal threat landscape in 2018 .


BOSS SPIDER used both enterprise and per-host pricing during their campaigns .


Both INDRIK SPIDER ( with BitPaymer ransomware ) and GRIM SPIDER ( with Ryuk ransomware ) have made headlines with their high profile victims and ransom profits , demonstrating that big game hunting is a lucrative enterprise .


Running successful big game hunting operations results in a higher average profit per victim , allowing adversaries like PINCHY SPIDER and their partners to increase their criminal revenue quickly .


The threat actor Rocke was originally revealed by Talos in August of 2018 and many remarkable behaviors were disclosed in their blog post .


The family was suspected to be developed by the Iron cybercrime group and it's also associated with the Xbash malware we reported on in September of 2018 .


The threat actor Rocke was first reported by Cisco Talos in late July 2018 .


The ultimate goal of this threat is to mine Monero cryptocurrency in compromised Linux machines .


To deliver the malware to the victim machines , the Rocke group exploits vulnerabilities in Apache Struts 2 , Oracle WebLogic , and Adobe ColdFusion .


Once the C2 connection is established , malware used by the Rocke group downloads shell script named as " a7 " to the victim machine .


To be more specific , the malware uninstalls cloud security products by Alibaba Cloud and Tencent Cloud .


Public cloud infrastructure is one of the main targets for Rocke .


FortiGuard Labs has been monitoring a Linux coin mining campaign from " Rocke " – a malware threat group specializing in cryptomining .


The malicious bash script components of the malware are hosted in Pastebin , with the profile name " SYSTEMTEN " , which is very similar to previous names used by the " Rocke " threat group .


However , around a month ago , Rocke started targeting systems that run Jenkins by attempting to exploit CVE-2018-1000861 and CVE-2019-1003000 .


By utilizing a hook library , it is more complicated for users to manually detect and remove the infection from their systems , giving the threat actors more time to generate profit .


The group also made it back into the news with the recent WannaCry ransomware that targeted computers around the globe ; it piggybacked on exploits revealed by the Shadow Brokers .


A mysterious hacker or hackers going by the name " The Shadow Brokers " claims to have hacked a group linked to the NSA and dumped a bunch of its hacking tools .


The Shadow Brokers claimed to have hacked the Equation Group and stolen some of its hacking tools .


The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites .


The Shadow Brokers , the group that publicly dumped a cache of NSA hacking tools , appears to be back and ready to sell stolen material on an individual basis .


Wh1sks estimated that , between June and early August , the Shadow Brokers have made up to $88,000 in an alternative cryptocurrency called Monero .


Moreover , Wh1sks was able to find out the email addresses of five people who have subscribed to the Shadow Brokers' monthly dump service .


Buried among this new treasure trove , there are several mentions of previously disclosed NSA top secret programs and software such as " STRAITBIZARRE " , used to control implants remotely , and " JEEPFLEA " , a project to hack the money transferring system SWIFT .


The Shadow Brokers have long claimed that the tools they release are from the " Equation Group " , the name of a government hacking group outed by Kaspersky Lab in 2015 , which is widely believed to be the NSA .


Recently , FireEye released a great report on one of the more active groups , now known as APT30 .


In addition , Kaspersky discovered that the Winnti group uses a popular backdoor known as PlugX which also has Chinese origins .


Previous work published by security vendor FireEye in October 2014 suggests APT28 might be of Russian origin .


After publishing our initial series of blogposts back in 2016 , Kaspersky has continued to track the ScarCruft threat actor .


Based on the ScarCruft’s recent activities , Kaspersky strongly believes that this ScarCruft group is likely to continue to evolve .


Kaspersky also discovered an interesting piece of rare malware created by this threat actor ScarCruft .


Kaspersky witnessed the ScarCruft threat actor extensively testing a known public exploit during its preparation for the next campaign .


Based on our telemetry , Kaspersky can reassemble ScarCruft’s binary infection procedure .


In addition , Kaspersky analyzed the victims of this campaign and spotted an interesting overlap of this campaign with another APT actor known as DarkHotel .


Secureworks researchers investigated activities associated with the BRONZE BUTLER (also known as Tick) threat group , which likely originates in the People .


However , an investigation by Symantec has found that Butterfly has been active since at least March 2012 and its attacks have not only continued to the present day , but have also increased in number .


Talos assesses with high confidence that Group 123 was responsible for six campaigns .


Attacks launched by Scarlet Mimic were publicly exposed on 2013 in a Trend Micro report about the FakeM Trojan .


Finally , Talos identified a 6th campaign that is also linked to Group 123 .


As Talos observed at the beginning of 2017 , Group 123 started a campaign corresponding with the new year in 2018 .


Last month , researchers at Kaspersky reported on a Lazarus APT campaign targeting both macOS and Windows users .


Cylance uncovered several bespoke backdoors deployed by the OceanLotus APT Group a.k.a APT32 , Cobalt Kitty .


While continuing to monitor activity of the OceanLotus APT Group , Cylance researchers uncovered a novel payload loader that utilizes steganography to read an encrypted payload concealed within a .png image file .


Gobelin Panda , a.k.a Goblin Panda , is a group that has been identified by CrowdStrike as a Chinese threat actor .


CrowdStrike observed Goblin Panda activity spike as tensions among South China Sea nations has risen .


This confirms Tropic Trooper is using Poison Ivy as part of their toolkit , something speculated in the original Trend Micro report but not confirmed by them .


In a 2018 blogpost , ESET researchers predicted that Turla would use more and more generic tools .


ESET researchers will continue monitoring new Turla activities and will publish relevant information on our blog .


ESET researchers analyze new TTPs attributed to the Turla group that leverage PowerShell to run malware in-memory only .


ESET have been tracking the malicious activities related to the Ke3chang group .


According to Kaspersky Lab’s report , NetTraveler has been active since as early as 2004; however , the highest volume of activity occurred from 2010 – 2013 .


Kaspersky Lab’s experts calculated the amount of stolen data stored on NetTraveler’s C&C servers to be more than 22 gigabytes .


FireEye believes the Ke3chang attackers likely began attempting to exfiltrate sensitive data shortly thereafter .


This report details some of the technical findings of the Lazarus Group’s malware , observed by Novetta during Operation Blockbuster .


The Lazarus Group was first identified in Novetta’s report Operation Blockbuster in February 2016 .


FireEye has not identified APT33 using SHAPESHIFT , but APT33 is the only group FireEye has seen to use DROPSHOT .


In 2018 , Kaspersky Labs published a report that analyzed Turla threat group .


Starting in February 2018 , Palo Alto identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


Proofpoint researchers have observed a well-known Russian-speaking APT actor usually referred to as Turla using a new .NET/MSIL dropper for an existing backdoor called JS/KopiLuwak .


Insikt Group investigated the domain and hosting infrastructure used by the APT33 group .


Symantec tracks the group behind this activity as Blackfly and detects the malware they use as Backdoor.Winnti .


As shown within the timeline above , the WINDSHIFT activity observed by Unit 42 falls between January and May of 2018 .


Symantec discovered Suckfly , an advanced threat group , conducting targeted attacks using multiple stolen certificates , as well as hacktools and custom malware .


In April Novetta released its excellent report on the Winnti malware spotted in the operations of Axiom group .


A few days ago , Symantec discovered a new document that appears to be part of the ongoing BlackEnergy APT group attacks against Ukraine .


While analyzing a campaign run by the Gamaredon group , FortiGuard Labs discovered the tools they used to prepare the attack and found artifacts left behind by the actors that allowed us to perform a large amount of forensic analysis .


In this blog , Unit 42 provides details of the tools and tactics we observed on these compromised SharePoint servers , explain how we believe these connect to the Emissary Panda threat group .


QiAnXin identified this APT group coded as ‘APT-C-35’ in 2017 , who is mainly targeting Pakistan and other South Asian countries for cyber espionage .


CTU researchers assess with moderate confidence that APT28 is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government .


It is worth noting that during our investigation f-secure uncovered links between infrastructure associated with the Callisto Group and infrastructure used to host online stores selling controlled substances .


As Unit 42 have observed throughout our tracking of the OilRig group , adopting proven tactics has been a common behavior over time .


The OceanLotus group was first revealed and named by QiAnXin in May 2015 .


The OceanLotus , an APT group said to have a Vietnamese background , was first exposed and named by QiAnXin in May 2015 .


The QiAnXin keeps a close eye on activities made by OceanLotus .


Donot , named and tracked by PatchSky , is an attack group that mainly targets countries such as Pakistan in South Asia .


After investigation , QiAnXin suspect this attack is carried out by Molerats .


In June 2017 , QiAnXin discovered new malware used by Molerats .


Last month , QiAnXin captured multiple phishing emails sent by TA505 Group to target financial institutions .


QiAnXin confirmed that this is a DarkHydrus Group’s new attack targeting Middle East region .


First described by Kaspersky in 2014 and later by Cylance in 2017 , Machete is a piece of malware found to be targeting high profile individuals and organizations in Latin American countries .


It’s now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware , ” said Dennis Schwarz , research analyst on Arbor , in an interview with Threatpost .


After thorough analysis , ESET researchers are highly confident that this campaign is run by the OceanLotus group , also known as APT32 and APT-C-00 .


360 Helios Team captured the first Trojan of the Poison Ivy Group in December 2007 .


Through research , 360 Helios Team has found that , since 2007 , the Poison Ivy Group has carried out 11 years of cyber espionage campaigns against Chinese key units and departments , such as national defense , government , science and technology , education and maritime agencies .


In addition , Antiy Lab revealed the APT organization Green Spot on September 19 , 2018 .


Recently , the 360 Core Security discovered an APT attack code named as APT-C-26 against cryptocurrency institutions and related individuals .


This APT attack was analyzed and attributed upon the detection and 360 Core Security now confirmed its association with the APT-C-06 Group .


In April , 2018 , the 360 Core Security takes the lead in capturing the APT-C-06 group’s new APT attack using 0-day vulnerabilities (CVE-2018-8174) in the wild .


ESET researchers have dissected some of the latest additions to the malicious toolkit of the Advanced Persistent Threat (APT) group known as OceanLotus , also dubbed APT32 and APT-C-00 .


Earlier this year , our colleagues at Symantec uncovered an interesting story about the use of Equation group exploitation tools by an alleged Chinese group named Buckeye a.k.a APT3 , or UPS team .


In addition , OceanLotus is also known to use ‘watering hole attacks’ , which involve the compromise of a website that the victim is likely to visit .


Kaspersky found Zebrocy deploying a compiled Python script , which we call PythocyDbg , within a Southeast Asian foreign affairs organization: this module primarily provides for the stealthy collection of network proxy and communications debug capabilities .


ESET researchers have investigated a distinctive backdoor used by the notorious APT group known as Turla (or Snake , or Uroburos) to siphon off sensitive communications from the authorities of at least three European countries .


Dragos has reported that XENOTIME , the APT group behind the TRISIS (aka TRITON and HatMan) attack on a Saudi Arabian petro-chemical facility in 2017 , has expanded its focus beyond the oil and gas industries .


ESET researchers have observed a significant change in the campaign of the infamous espionage group .


On the technical side , since mid-January Kaspersky researchers have been tracking an active Turla campaign targeting government bodies in Turkmenistan and Tajikistan .


Kaspersky also published details on how Zebrocy has added the Go” language to its arsenal – the first time that we have observed a well-known APT threat actor deploy malware with this compiled , open source language .


ESET researchers have found that Turla , the notorious state-sponsored cyberespionage group , has added a fresh weapon to its arsenal that is being used in new campaigns targeting embassies and consulates in the post-Soviet states .


Turla has been operating for a number of years and its activities have been monitored and analyzed by ESET research laboratories .


Kaspersky researchers attribute the campaign , which we call SpoiledLegacy” , to the LuckyMouse APT group (aka EmissaryPanda and APT27) .


Further tracking of the Lazarus’s activities has enabled Kaspersky researchers to discover a new operation , active since at least November 2018 , which utilizes PowerShell to control Windows systems and Mac OS malware to target Apple customers .


However , over the last nine campaigns since Trend Micro‘s June report , TA505 also started using .ISO image attachments as the point of entry , as well as a .NET downloader , a new style for macro delivery , a newer version of ServHelper , and a .DLL variant of FlawedAmmyy downloader .


In this blog post , FireEye researchers are going to examine a recent instance where FireEye Managed Defense came toe-to-toe with APT41 .


The group has demonstrated access to zero-day vulnerabilities (CVE-2018-0802) , and the ability to incorporate them into operations .


More information on this threat actor is found in our report , APT37 (Reaper): The Overlooked North Korean Actor .


There have been reports of real-time phishing in the wild as early as 2010 .


Explanation of ToolTo improve social engineering assessments , we developed a tool – named ReelPhish – that simplifies the real-time phishing technique .


We assess with high confidence that this activity is carried out on behalf of the North Korean government given malware development artifacts and targeting that aligns with North Korean state interests .


Known targets of this group have been involved in the maritime industry , as well as engineering-focused entities , and include research institutes , academic organizations , and private firms in the United States .


By releasing ReelPhish , we at Mandiant hope to highlight the need for multiple layers of security and discourage the reliance on any single security mechanism .


The group has also been reported as Leviathanby other security firms .


Like multiple other Chinese cyber espionage actors , TEMP.Periscope has recently re-emerged and has been observed conducting operations with a revised toolkit .


The tool then starts a new web browser instance on the attacker’s system and submits credentials on the real VPN portal .


These tools include:AIRBREAK: a JavaScript-based backdoor also reported as Orz that retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services.BADFLICK: a backdoor that is capable of modifying the file system , generating a reverse shell , and modifying its command and control (C2) configuration .


HOMEFRY: a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors .


The following are tools that TEMP.Periscope has leveraged in past operations and could use again , though these have not been seen in the current wave of activity:Beacon: a backdoor that is commercially available as part of the Cobalt Strike software platform , commonly used for pen-testing network environments .


This entry was posted on Fri Mar 16 00:00 EDT 2018 and filed under Targeted Attacks , FireEye , and China .


Read our report , APT37 (Reaper): The Overlooked North Korean Actor , to learn more about our assessment that this threat actor is working on behalf of the North Korean government , as well as various other details about their operations .


A brief timeline of this activity is shown in Figure 1.Figure 1: Timeline of this recently observed spear phishing campaign .


The first part of the campaign From Jan. 23 , 2018 , to Feb. 26 , 2018 used a macro-based document that dropped a VBS file and an INI file .


One such email that we were able to obtain was targeting users in Turkey , as shown in Figure 4:Figure 4: Sample spear phishing email containing macro-based document attachment The malicious Microsoft Office attachments that we observed appear to have been specially crafted for individuals in four countries: Turkey , Pakistan , Tajikistan and India .


The INI file contains the Base64 encoded PowerShell command , which will be decoded and executed by PowerShell using the command line generated by the VBS file on execution using WScript.exe .


cmstp.exe system restart , cmstp.exe will be used to execute the SCT file indirectly through the INF file .


The following are the three files:Defender.sct – The malicious JavaScript based scriptlet file .


FireEye observed a high volume of activity associated with the exploitation of CVE-2017-10271 following the public posting of proof of concept code in December 2017 .


Users who failed to patch their systems may find themselves mining cryptocurrency for threat actors .


This entry was posted on Tue Mar 13 12:15 EDT 2018 and filed under Yogesh Londhe , Dileep .


If the lateral movement with credentials fails , then the malware uses PingCastle MS17-010 scanner (PingCastle is a French Active Directory security tool) to scan that particular host to determine if its vulnerable to EternalBlue , and uses it to spread to that host .


Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() .


The malware checks whether its running on a 32-bit or 64-bit system to determine which PowerShell script to grab from the command and control (C2) server .


Notably , cryptocurrency mining malware is being distributed using various tactics , typically in an opportunistic and indiscriminate manner so cyber criminals will maximize their outreach and profits .


After all network derived IPs have been processed , the malware generates random IPs and uses the same combination of PingCastle and EternalBlue to spread to that host .


They have taken interest in subject matter of direct importance to the Democratic People's Republic of Korea (DPRK) such as Korean unification efforts and North Korean defectors .


We assess that the actors employing this latest Flash zero-day are a suspected North Korean group we track as TEMP.Reaper .


Historically , the majority of their targeting has been focused on the South Korean government , military , and defense industrial base .


While we have observed other suspected North Korean threat groups such as TEMP.Hermit employ wiper malware in disruptive attacks , we have not thus far observed TEMP.Reaper use their wiper malware actively against any targets .


In the past year , FireEye iSIGHT Intelligence has discovered newly developed wiper malware being deployed by TEMP.Reaper , which we detect as RUHAPPY .


FireEye products have robust detection for the malware used in this campaign .


TEMP.Periscope BackgroundActive since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities .


Infection VectorWe have observed this recent wave of Zyklon malware being delivered primarily through spam emails .


The document files exploit at least three known vulnerabilities in Microsoft Office , which we discuss in the Infection Techniques section .


Figure 2: Zyklon attack flowInfection Techniques CVE-2017-8759 .


This vulnerability was discovered by FireEye in September 2017 , and it is a vulnerability we have observed being exploited in the wild .


We have observed this recent wave of Zyklon malware being delivered primarily through spam emails .


The malware may communicate with its command and control (C2) server over The Onion Router (Tor) network if configured to do so .


Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly , we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office .


It follows Stuxnet which was used against Iran in 2010 and Industroyer which we believe was deployed by Sandworm Team against Ukraine in 2016 .


Command & Control Communication The C2 communication of Zyklon is proxied through the Tor network .


At this time of writing , FireEye Multi Vector Execution (MVX) engine is able to recognize and block this threat .


The targeting of critical infrastructure to disrupt , degrade , or destroy systems is consistent with numerous attack and reconnaissance activities carried out globally by Russian , Iranian , North Korean , U.S. , and Israeli nation state actors .


Specifically , the following facts support this assessment: The attacker targeted the SIS suggesting an interest in causing a high-impact attack with physical consequences .


First , the attacker’s mission is to disrupt an operational process rather than steal data .


The TRITON malware contained the capability to communicate with Triconex SIS controllers .


the attacker did not leverage all of TRITON’s extensive reconnaissance capabilities .


This file is decrypted and injected into an instance of InstallUtiil.exe , and functions as a Tor anonymizer .


For instance , Russian operators , such as Sandworm Team , have compromised Western ICS over a multi-year period without causing a disruption .


The TRITON sample Mandiant analyzed added an attacker-provided program to the execution table of the Triconex controller .


Along with the executable , two binary files , inject.bin (malicious function code) and imain.bin (malicious control logic) , were deployed as the controller’s payload .


We assess that this was an anti-forensics technique to hide the presence of the attacker code on the Triconex controller .


This entry was posted on Thu Dec 14 10:00 EST 2017 and filed under Malware , Nathan Brubaker , Christopher Glyer , Blake Johnson , Dan Caban , Marina Krotofil , ICS Security , and Dan Scali .


This isn’t a bad thing as it shows a natural grouping of nodes that could be a good candidate to group to help simplify the overall graph and make analysis easier .


Keeping in mind the sensitivity of passwords , GoCrack includes an entitlement-based system that prevents users from accessing task data unless they are the original creator or they grant additional users to the task .


Throughout 2017 , we observed two versions of BACKSWING and saw a significant increase in May with an apparent focus on compromising Ukrainian websites .


During our investigation into the activity , FireEye identified a direct overlap between BADRABBIT redirect sites and sites hosting a profiler we’ve been tracking as BACKSWING .


This entry was posted on Tue Nov 28 14:00 EST 2017 and filed under Malware , Sandor Nemes , Malware Analysis , and Abhay Vaish .


FireEye network devices blocked infection attempts at over a dozen victims primarily in Germany , Japan , and the U.S until Oct. 24 at 15:00 UTC , when the infection attempts ceased and attacker infrastructure – both 1dnscontrol.com and the legitimate websites containing the rogue code – were taken offline .


Incident Background Beginning on Oct. 24 at 08:00 UTC , FireEye detected and blocked attempts to infect multiple clients with a drive-by download masquerading as a Flash Update (install_flash_player.exe) that delivered a wormable variant of ransomware .


FireEye observed that BACKSWING , a malicious JavaScript profiling framework , was deployed to at least 54 legitimate sites starting as early as September 2016 .


Figure 3: BACKSWING Version 2Version 1:FireEye observed the first version of BACKSWING in late 2016 on websites belonging to a Czech Republic hospitality organization in addition to a government website in Montenegro .


Beginning in May 2017 , FireEye observed a number of Ukrainian websites compromised with BACKSWING v1 , and in June 2017 , began to see content returned from BACKSWING receivers .


FireEye observed this framework on compromised Turkish sites and Montenegrin sites over the past year .


While FireEye has not directly observed BACKSWING delivering BADRABBIT , BACKSWING was observed on multiple websites that were seen referring FireEye customers to 1dnscontrol.com , which hosted the BADRABBIT dropper .


Harvested credentials provided by an embedded Mimikatz executable facilitate the infection of other systems on the network .


Like EternalPetya , infpub.dat determines if a specific file exists on the system and will exit if found .


This entry was posted on Mon Dec 04 12:00 EST 2017 and filed under Code , Reverse Engineering , Nick Harbour , and Incident Response .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory .


The developer consistently used Accept-Enconding” (note the extra ‘n’) in all DanBot samples analyzed by CTU researchers .


Previous versions were described by Kaspersky in 2014 and Cylance in 2017 .


The GoogleUpdate.exe component is responsible for communicating with the remote C&C server .


This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage .


The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system .


Backdoor installed in the infected system distributed additional botnet malware , ransomware and email stealers .


The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format .


The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


Group-IB has also detected recon emails sent out to New Zealand .


In 2019 , Group-IB also observed the use of a new fileless PowerShell loader called Ivoke .


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer .


Group-IB specialists tracked a massive mailout of emails containing a malicious Microsoft Word attachment titled Договор.doc” [Contract.doc] .


On 24 March 2019 , Silence.ProxyBot (MD5 2fe01a04d6beef14555b2cf9a717615c) was uploaded to VirusTotal from an IP address in Sri Lanka .


To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank .


The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine .


Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server .


Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe .


These malware families have a rich history of being used in many targeted attacks against government and private organizations .


The samples we analyzed originated from the Philippines .


Also , the certificate embedded in the Quasar sample was issued at 22.12.2018 , which correlates with the file’s compilation date .


PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more .


TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution .


Of note , FireEye discovered two additional new malware families hosted at this domain , VALUEVAULT and LONGWATCH .


PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file .


FireEye detects this activity across our platforms , including named detection for TONEDEAF , VALUEVAULT , and LONGWATCH .


Banks in countries such as Russia , the United Kingdom , the Netherlands , Spain , Romania , Belarus , Poland , Estonia , Bulgaria , Georgia , Moldova , Kyrgyzstan , Armenia , Taiwan and Malaysia have allegedly been targeted with spearphishing emails , luring victims into clicking malicious URLs and executing booby-trapped documents .


The other overlapping files are tools used by the adversary to locate other systems on the network (etool.exe) , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 (checker1.exe) and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) .


Also , the NCSC advisory mentioned that the actors used a file name stylecss.aspx for their webshell , which is the same filename we saw associated with China Chopper .


We will provide an analysis of the HyperBro tool in an upcoming section .


Figure 9 shows a code comparison between the PYTHON33.dll (right) and inicore_v2.3.30.dll (left) (SHA256: 4d65d371a789aabe1beadcc10b38da1f998cd3ec87d4cc1cfbf0af014b783822) , which was sideloaded to run the SysUpdate tool in a previous Emissary Panda campaign .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 .


The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation .


The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method .


In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger .


The main payload is usually Imminent Monitor RAT ; however , at the beginning of 2018 , we also observed the use of LuminosityLink RAT , NetWire RAT , and NjRAT .


In a case in June 2019 , we also noticed Warzone RAT being used .


Xpert RAT reportedly first appeared in 2011 .


The first version of Proyecto RAT” was published at the end of 2010 .


Similar to previous campaigns , the JAR was directly attached to emails and used file names such as Order_2018.jar .


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework .


On June 24 , we found another campaign targeting Lebanon with the ServHelper malware .


Nonetheless , these spam emails were not delivered to the UAE or Arabic-speaking users , but to banks in Asian countries such as India , Indonesia , and the Philippines .


In April 2019 , several national security organizations released alerts on CVE-2019-0604 exploitation , including the Saudi Arabian National Cyber Security Center and the Canadian Center for Cyber Security .


Both of these alerts discussed campaigns in which actors used the CVE-2019-0604 to exploit SharePoint servers to install the China Chopper webshell .


The other overlapping files are tools used by the adversary to locate other systems on the network (etool.exe) , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 (checker1.exe) and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) .


The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 .


To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills. In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks .


The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability .


This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April .


The SLUB malware was delivered through watering hole websites that were injected with exploits for CVE-2018-8174 or CVE-2019-0752 .


In May 2018 , campaigns being conducted by SWEED began leveraging another vulnerability in Microsoft Office: CVE-2017-11882 , a remote code execution bug in Microsoft Office that is commonly observed being leveraged in malicious documents used in commodity malware distribution .


Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits .


On Nov14 , 2017 , FireEye observed APT34 using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack .


Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day .


Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download .


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 .


As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload .


Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


Some of the documents exploited CVE-2017-0199 to deliver the payload .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent .


The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 .


The attackers stole organizations' SSL certificates associated with security appliances such as ASA to obtain VPN credentials , allowing the actors to gain access to the targeted network .


More importantly , one of these files also enables the download of TeamViewer , a remote access tool that gives threat actors remote control over the system .


The agency's hacking division freed it from having to disclose its often controversial operations to the NSA (its primary bureaucratic rival) in order to draw on the NSA's hacking capacities .


After infestation , Weeping Angel places the target TV in a 'Fake-Off' mode , so that the owner falsely believes the TV is off when it is on .


The CIA's Mobile Devices Branch (MDB) developed numerous attacks to remotely hack and control popular smart phones .


These techniques permit the CIA to bypass the encryption of WhatsApp , Signal , Telegram , Wiebo , Confide and Cloackman by hacking the smart phones that they run on and collecting audio and message traffic before encryption is applied .


The CIA also runs a very substantial effort to infect and control Microsoft Windows users with its malware .


As an example , specific CIA malware revealed in Year Zero is able to penetrate , infest and control both the Android phone and iPhone software that runs or has run presidential Twitter accounts .


we assess with high confidence that these incidents were conducted by APT10 also known as Stone Panda , menuPass , CVNX in an effort to gain access to networks and steal valuable intellectual property or gain commercial advantage .


Utilizing actors working for shell companies such as Huaying Haitai Science and Technology Development Co Ltd , the MSS has conducted an unprecedented campaign , dubbed Operation Cloud Hopper , ” against managed IT service providers (MSPs) designed to steal intellectual property and enable secondary attacks against their clients .


We assess that APT10 likely compromised Visma with the primary goal of enabling secondary intrusions onto their client networks , and not of stealing Visma intellectual property .


In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage .


Access to the networks of these third-party service providers grants the MSS the ability to potentially access the networks of hundreds , if not thousands , of corporations around the world .


In all three incidents , the attackers gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials .


In early 2017 , APT10 began conducting attacks against global managed IT service providers (MSPs) that granted them unprecedented access to MSPs and their customers’ networks .


This was followed by an initial exploitation , network enumeration , and malicious tool deployment on various Visma endpoints within two weeks of initial access .


They also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API .


The attacker gained access to the victim’s internet-accessible Citrix systems and authenticated to them from networks associated with low-cost VPN providers owned by VPN Consumer Network .


The attackers used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script .


APT10's unprecedented campaign against MSPs , alleged to have included some of the largest MSPs in the world , in order to conduct secondary attacks against their clients , grants the Chinese state the ability to potentially access the networks of hundreds (if not thousands) of corporations around the world .


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests .


What lied beneath this facade was a well-engineered campaign of phishing attacks designed to steal credentials and spy on the activity of dozens of journalists , human rights defenders , trade unions and labour rights activists , many of whom are seemingly involved in the issue of migrants’ rights in Qatar and Nepal .


It appears that the attackers may have impersonated the identity of a real young woman and stole her pictures to construct the fake profile , along with a professional biography also stolen from yet another person .


Dubbed ‘Operation Sheep’ , this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year .


In theory , Shun Wang Technologies could have collected a third of China’s population names and contact numbers if not more .


With no clear declaration of usage from Shun Wang , nor proper regulatory supervision , such data could circulate into underground markets for further exploit , ranging from rogue marketing , targeted telephone scams or even friend referral program abuse during November’s Single’s Day and December’s Asian online shopping fest .


In Operation Sheep’s case , Shun Wang likely harvests end user contact lists without application developer acknowledgement .


APT41 has executed multiple software supply chain compromises , gaining access to software companies to inject malicious code into legitimate files before distributing updates .


Learning to access video game production environments enabled APT41 to develop the tactics , techniques , and procedures (TTPs) that were later leveraged against software companies to inject malicious code into software updates .


We believe that like other Chinese espionage operators , APT41 has moved toward strategic intelligence collection and establishing access , but away from direct intellectual property theft .


In June 2018 , APT41 sent spear-phishing emails using an invitation lure to join a decentralized gaming platform linked to a cryptocurrency service (Figure 5) that had positioned itself as a medium of exchange for online games and gambling sites .


We suggest that APT41 sought to target in-game currency but found they could not monetize the specific targeted game , so the group resorted to ransomware to attempt to salvage their efforts and profit from the compromise .


In addition to the aforementioned post-exploitation tools , the actors used these webshells to upload legitimate executables that they would use DLL sideloading to run a malicious DLL that has code overlaps with known Emissary Panda attacks .


In April 2019 , several national security organizations released alerts on CVE-2019-0604 exploitation , including the Saudi Arabian National Cyber Security Center and the Canadian Center for Cyber Security .


Both of these alerts discussed campaigns in which actors used the CVE-2019-0604 to exploit SharePoint servers to install the China Chopper webshell .


The other overlapping files are tools used by the adversary to locate other systems on the network (etool.exe) , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 (checker1.exe) and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) .


The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 .


To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills. In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks .


The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability .


This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April .


The SLUB malware was delivered through watering hole websites that were injected with exploits for CVE-2018-8174 or CVE-2019-0752 .


In May 2018 , campaigns being conducted by SWEED began leveraging another vulnerability in Microsoft Office: CVE-2017-11882 , a remote code execution bug in Microsoft Office that is commonly observed being leveraged in malicious documents used in commodity malware distribution .


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework .


Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits .


On Nov14 , 2017 , FireEye observed APT34 using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack .


Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day .


Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download .


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 .


As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload .


Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


Some of the documents exploited CVE-2017-0199 to deliver the payload .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent .


The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 .


Due to these changes without a new date string , we believe the date codes are used for campaign tracking rather than a Bookworm build identifier .


In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task .


The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon .


The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio .


If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs .


This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics .


There is the exploit code and malware used to gain access to systems , the infrastructure that provides command and control to the malware operator , and the human elements – developers who create the malware , operators who deploy it , and analysts who extract value from the stolen information .


This file requires the target to attempt to open the .lnk file , which redirects the user to a Windows Scripting Component ( .wsc ) file , hosted on an adversary-controlled microblogging page .


Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique .


The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems .


wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 .


As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC .


The RAT , however , had a multitude of functionalities (as listed in the table below) such as to download and execute , compress , encrypt , upload , search directories , etc .


Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor .


DoublePulsar is then used to inject a secondary payload , which runs in memory only .


The detection evasion techniques we observed in the Okrum malware include embedding the malicious payload within a legitimate PNG image , employing several anti-emulation and anti-sandbox tricks , as well as making frequent changes in implementation .


The diagram below illustrates how we believe the actors behind the Sea Turtle campaign used DNS hijacking to achieve their end goals .


If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file .


Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies .


Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant .


UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques .


'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS (JukeBox) and Linux (DanceFloor) .


This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 .


The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process .


Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials .


This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more .


In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document .


The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” .


The group has repeatedly used social media , particularly LinkedIn , to identify and interact with employees at targeted organizations , and then used weaponized Excel documents to deliver RATs such as PupyRAT .


CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering .


The persistent use of social media to identify and manipulate victims indicates that COBALT GYPSY successfully achieves its objectives using this tactic .


COBALT GYPSY 's continued social media use reinforces the importance of recurring social engineering training .


The report specifies the Magic Hound targeted political , military and defense industry in the US , UK and Israel .


PwC UK and BAE Systems , working closely with industry and government , have uncovered a new , unparallelled campaign which we refer to as Operation Cloud Hopper .


By targeting high-tech and manufacturing operations in Japan and Taiwan , DragonOK may be acquiring trade secrets for a competitive economic advantage .


Targeted sectors of Molerats include governmental and diplomatic institutions , including embassies ; companies from the aerospace and defence Industries ; financial institutions ; journalists ; software developers .


FIN7 is a threat actor group that is financially motivated with targets in the restaurant , services and financial sectors .


Over the past year , we've seen the group extensively targeting a wide gamut of entities in various sectors , including Governments , Academy , Crypto-Currency , Telecommunications and the Oil sectors .


The group has focused mainly on governmental targets in Iraq and Saudi Arabia , according to past telemetry .


The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros .


Given the use of lure documents designed with social engineering in mind , it is likely that MuddyWater use phishing or spam to target users who are unaware of these documents ' malicious nature .


The oil and gas infrastructure nexus observed in connection with greensky27.vicp.net and other Unit 78020 ( Naikon ) infrastructure suggests targeting patterns supportive of the PRC 's strategic interests over energy resources within the South China Sea and Southeast Asia .


These attacks have involved social engineering , spearphishing attacks , exploitation of Microsoft Windows operating systems vulnerabilities , Microsoft Active Directory compromises , and the use of remote administration tools ( RATs ) in targeting and harvesting sensitive competitive proprietary operations and project-financing information with regard to oil and gas field bids and operations .


Night Dragon 's attacks have involved social engineering , spearphishing attacks , exploitation of Microsoft Windows operating systems vulnerabilities , Microsoft Active Directory compromises , and the use of remote administration tools ( RATs ) in targeting and harvesting sensitive competitive proprietary operations and project-financing information with regard to oil and gas field bids and operations .


It appears that the group values hardcoded into the malware is associated with the targeted organization , as several are Saudi Arabian organizations within the telecommunications and defense industries .


Should a user enable this content , the attackers are then able to use the DDE protocol to remotely execute commands in memory on the victim 's system .


These VNC exectuables would either be included in the SFX file or downloaded by the batch script .


Our investigation revealed an attack where the GCMAN group then planted a cron script into bank 's server , sending financial transactions at the rate of $200 per minute .


The GCMAN group used an MS SQL injection in commercial software running on one of bank 's public web services , and about a year and a half later , they came back to cash out .


Gorgon Group used common URL shortening services to download payloads .


Gorgon used numerous decoy documents and phishing emails , both styles of attacks lacked overall sophistication .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON , which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics .


All contain the same Visual Basic macro code and author name as Honeybee .


Ke3chang attackers have used spear-phishing emails .


Traditionally , the Ke3chang attackers have used spear-phishing emails with either a malware attachment or a link to a malicious download .


DLL hijacking techniques have been seen in the past with the APT15 group .


This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets Bitcoin users and global financial organizations .


This new campaign , dubbed HaoBao , resumes Lazarus ' previous phishing emails , posed as employee recruitment , but now targets financial organizations .


Beginning in 2017 , the Lazarus group heavily targeted individuals with spear phishing emails impersonating job recruiters which contained malicious documents .


Therefore , it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer .


Notably , after the first SMB packet sent to the victim 's IP address , WannaCry sends two additional packets to the victim containing the hard-coded IP addresses 192.168.56.20 and 172.16.99.5 .


Kaspersky believes both Shamoon and StoneDrill groups are aligned in their interests , but are two separate actors , which might also indicate two different groups working together .


Indeed , Kaspersky started tracking the BlueNoroff actor a long time ago .


Eset has published a report on the state-sponsored Russian turla apt group .


It seems Eset has discovered and published on a new malware module created by Turla .


The majority of NewsBeef targets that Kaspersky researchers have observed are located in SA .


While not directly overlapping , this potential infrastructure link is interesting , as Vixen Panda has previously displayed TTPs similar to COMMENT PANDA , and has extensively targeted European entities .


Given the evidence outlined above , CrowdStrike attributes the PUTTER PANDA group to PLA Unit 61486 within Shanghai , China with high confidence .


Several RATs are used by PUTTER PANDA .


The most common of these , the 4H RAT and the 3PARA RAT , have been documented previously by CrowdStrike in previous CrowdStrike Intelligence reporting .


This analysis will be revisited below , along with an examination of two other PUTTER PANDA tools : pngdowner and httpclient .


Other CrowdStrike reporting describes a dropper used by PUTTER PANDA to install the 4H RAT .


This dropper uses RC4 to decrypt an embedded payload from data in an embedded resource before writing the payload to disk and executing it .


It contains a Word document in plaintext ( written to Bienvenue_a_Sahaja_Yoga_Toulouse.doc ) , along with an executable ( Update.exe ) and DLL ( McUpdate.dll ) .


PUTTER PANDA are a determined adversary group who have been operating for several years , conducting intelligence-gathering operations with a significant focus on the space sector .


Research presented in this report shows that the PUTTER PANDA operators are likely members of the 12th Bureau , 3rd General Staff Department ( GSD ) of the People 's Liberation Army ( PLA ) , operating from the unit 's headquarters in Shanghai with MUCD 61486 .


PUTTER PANDA is likely to continue to aggressively target Western entities that hold valuable information or intellectual property relevant to these interests .


Mandiant 's APT1 report was the first to change the game , and paved the way for private security companies to expose advanced threat actors en masse .


Mandianta 's APT1 report was the first to change the game , and paved the way for private security companies to expose advanced threat actors en masse .


In 2014 , our colleagues at Crowdstrike wrote an exposé about a long-standing Chinese APT threat group they self-named Putter Panda , which Mandiant / FireEye refers to as APT2 .


In 2014 , our colleagues at Crowdstrike wrote an expos about a long-standing Chinese APT threat group they self-named Putter Panda , which Mandiant / FireEye refers to as APT2 .


This threat group attacked defense contractors and aerospace companies .


The document exploited CVE-2012-0158 and will decode and write an executable to disk upon infection .


Unit 42 believes this group is previously unidentified and therefore have we have dubbed it " RANCOR " .


The Rancor group 's attacks use two primary malware families which we describe in depth later in this blog and are naming DDKONG and PLAINTEE .


We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages .


Based on this , we believe the Rancor attackers were targeting political entities .


Additionally , these decoy documents are hosted on legitimate websites including a government website belonging to the Cambodia Government and in at least once case , Facebook .


Our Investigation into both clusters further showed that they were both involved in attacks targeting organizations in South East Asia .


We observed DDKONG in use between February 2017 and the present , while PLAINTEE is a newer addition with the earliest known sample being observed in October 2017 .


The RANCOR campaign represents a continued trend of targeted attacks against entities within the South East Asia region .


They are interested in users of remote banking systems ( RBS ) , mainly in Russia and neighboring countries .


That this group is mostly targeting businesses is apparent from the processes they are looking for on a compromised system .


While both RTM and Buhtrap are looking for a quite similar process list , the infection vectors are quite different .


This group has used a large array of infection vectors , mostly revolving around drive-by downloads and spam .


They are both targeting businesses using accounting software , are fingerprinting systems of interest similarly , are looking for smart card readers , and finally , they deploy an array of malicious tools to spy on their victims .


In particular , we will focus on the samples SHA-1 AA0FA4584768CE9E16D67D8C529233E99FF1BBF0 and 48BC113EC8BA20B8B80CD5D4DA92051A19D1032B .


Despite its known weaknesses , the RC4 algorithm is regularly used by malware authors .


Based on the use of the relatively unique PLAINTEE malware , the malware 's use of the same file paths on in each cluster , and the similar targeting , we have grouped these attacks together under the RANCOR campaign moniker .


Bdo is the Russian translation for RBS ( Remote Banking System ) so it is clear that RBS is a target for this malware .


Other groups , such as Buhtrap , Corkow and Carbanak , were already known to target and successfully steal money from financial institutions and their customers in Russia .


Our research on the RTM malware shows that the Russian banking system is still a target of choice for criminals .


Since last week , iSIGHT Partners has worked to provide details on the power outage in Ukraine to our global customers .


Shortly after releasing information on their espionage operations , our friends at TrendMicro found evidence that the operators were not only conducting classic strategic espionage but targeting SCADA systems as well .


iSiGHT has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 .


Sandworm Team went to ground shortly after being exposed in October of 2014 , and malware with Dune references ( the genesis for the ' Sandworm ' moniker ) which we had previously used to track them disappeared entirely .


However , the unique malware variant , BlackEnergy 3 , reemerged in Ukraine early in 2015 , where we had first found Sandworm Team .


iSiGHT Partners has tracked Sandworm Team for some time - and we publicly reported on some of their activities in October 2014 , when we discovered their use of a zero-day exploit , CVE-2014-4114 .


SIGHT Partners is still collecting information on the mechanics of the power outage and what role the KillDisk malware played in the greater event .


Last week iSIGHT 's sources provided us with the same KillDisk malware published by Rob Lee of SANS and Dragos Security .


The aggressive nature of Sandworm Team 's previous activity in Europe and the United States exposed their interest in targeting critical systems and indicated preparation for cyber attack .


This year we are going to be releasing a monthly blog post introducing the " Threat Actor of the Month " , complete with detailed background information on that actor .


VOODOO BEAR is a highly advanced adversary with a suspected nexus to the Russian Federation .


Destructive malware used by VOODOO BEAR includes a wiper called PassKillDisk .


Some tools used by this actor — specifically BlackEnergy and GCat — have been adapted from commodity malware .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , industrial control systems and SCADA , government , and media for espionage and destructive purposes , since at least 2011 .


A commonly observed element of implants from VOODOO BEAR — at least until this information was made public in late 2014 — were references in the malware to the 1965 science fiction novel Dune , by Frank Herbert .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , government , and media for espionage and destructive purposes , since at least 2011 .


these characteristics all highlight the likelihood that VOODOO BEAR operates in alignment with Russian state interests .


This adversary displays a particular focus on targeting entities in the Ukraine and is believed to be behind the Ukrainian energy sector attacks that caused widespread power outages in late 2015 .


VOODOO BEAR appears to be integrated into an organization that also operates or tasks multiple pro-Russian hacktivist entities .


In the summer of 2014 , BlackEnergy caught our attention when we noticed that samples of it were now tailored to target Ukrainian government institutions .


Related or not , one thing is certain : the actor ( s ) using these customized BlackEnergy malware are intent on stealing information from the targets .


In this paper we focus only on BlackEnergy samples known to be used specifically by the actors we identify as Quedagh , who seem to have a particular interest in political targets .


Special focus will be on the samples that were used in targeted attacks against Ukrainian government organizations earlier this year .


Although they may have started much earlier , the earliest BlackEnergy sample we could attribute to the Quedagh gang is from December 14 , 2010 .


We warned our clients of new features suggesting an increased focus on European targets - though verification of targets was not possible at the time .


Sandworm Team may have opted for a ' hide in plain sight ' approach to evade detections from rootkit scanners , such as GMER and RootkitRevealer , that checks for system anomalies .


Table 3 ( above ) summarizes the commands supported by the variants used in the attack against Ukrainian government organizations .


In the summer of 2014 , we noted that certain samples of BlackEnergy malware began targeting Ukranian government organizations for information harvesting .


These samples were identified as being the work of one group , referred to in this document as " Quedagh " , which has a history of targeting political organizations .


The attacks we attribute to Scarlet Mimic have primarily targeted Uyghur and Tibetan activists as well as those who are interested in their causes .


To infect individuals with access to the data the actors desire , Scarlet Mimic deploys both spear-phishing and watering hole ( strategic web compromise ) attacks .


As with many other attackers who use spear-phishing to infect victims , Scarlet Mimic makes heavy use of " decoy " files .


The most recent Scarlet Mimic attacks we have identified were conducted in 2015 and suggest the group has a significant interest in both Muslim activists and those interested in critiques of the Russian government and Russian President Vladimir Putin .


Using these tactics Scarlet Mimic can directly target previously identified individuals ( spear phishing ) as well as unidentified individuals who are interested in a specific subject ( watering hole ) .


This group has been conducting attacks for at least four years using a backdoor Trojan that has been under active development .


Based on analysis of the data and malware samples we have collected , Unit 42 believes the attacks described herein are the work of a group or set of cooperating groups who have a single mission , collecting information on minority groups who reside in and around northwestern China .


Attacks launched by this group were publicly exposed on 2013 in a Trend Micro report about the FakeM Trojan .


We will also provide detailed analysis of the latest variants of the malware they deploy ( known as FakeM ) as well as other associated tools that allow Scarlet Mimic to target Android and OS X devices .


In the past , Scarlet Mimic has primarily targeted individuals who belong to these minority groups as well as their supporters , but we've recently found evidence to indicate the group also targets individuals working inside government anti-terrorist organizations .


We also know Scarlet Mimic uses a number of toolkits to create documents that contain exploit code to install the FakeM payload on a compromised system .


Unit 42 tracks the toolkits delivering FakeM under the names MNKit , WingD and Tran Duy Linh .


In July of 2015 , we identified a full e-mail uploaded to an antivirus scanning service that carried a Scarlet Mimic exploit document .


We are aware of one case where Scarlet Mimic broke from the spear-phishing pattern described above .


In 2013 , the group deployed a watering hole attack , also known as a strategic web compromise to infect victims with their backdoor .


FakeM 's functional code is shellcode-based and requires another Trojan to load it into memory and execute it .


First discussed in January 2013 in a Trend Micro whitepaper , FakeM is a Trojan that uses separate modules to perform its functionality .


We end this section with a discussion on tools related to FakeM and used by Scarlet Mimic .


Microsoft patched this vulnerability in September 2012 , suggesting that this watering hole attack used an older vulnerability , which aligns with the threat groups continued use of older vulnerabilities in their spear-phishing efforts .


Microsoft patched this vulnerability in September 2012 , suggesting that this watering hole attack used an older vulnerability , which aligns with Scarlet Mimic continued use of older vulnerabilities in their spear-phishing efforts .


Based on the timeline , it appears that the actors were actively developing several of the loaders at the same time from 2009 until the early months of 2014 .


Unit 42 tracks this mobile Trojan as MobileOrder , as the authors specifically refer to commands within the app as orders .


There are also infrastructure ties between some FakeM variants and older activity using Trojans such as Elirks , Poison Ivy , and BiFrost , which were used in attacks as old as 2009 .


There is some infrastructure overlap in the C2 servers used by almost all of the FakeM variants , as well other Trojans such as MobileOrder , Psylo , and CallMe .


Trend Micro published their analysis of the FakeM Trojan on January 17 , 2013 that discussed the original variant of FakeM .


The primary source of data used in this analysis is Palo Alto Networks WildFire , which analyzes malware used in attacks across the world .


Scarlet Mimic also uses the infamous HTRAN tool on at least some of their C2 servers .


Scarlet Mimic primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 .


Kaspersky Lab has produced excellent research on Scarlet Mimic group .


Actors will run HTRAN on a server and configure their malware to interact with that server ; however , the actor will configure HTRAN to forward traffic to another server where the actual C2 server exists .


The information discovered by Unit 42 and shared here indicates Scarlet Mimic is likely a well-funded and skillfully resourced cyber adversary .


Scarlet Mimic has carried out attacks using both spear-phishing and watering holes since at least 2009 with increasingly advanced malware , and has deployed malware to attack multiple operating systems and platforms .


This time I'm going to focus on malicious CHM files used by Silence APT .


If you haven't heard about it for some reason , I would recommend to read this detailed report by Group-IB , as this APT attacks not only Russian banks , but also banks in more than 25 countries .


The group primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 .


The group uses legitimate administration tools to fly under the radar in their post-exploitation phase , which makes detection of malicious activity , as well as attribution more complicated .


On January 12 , 2016 , Cylance published a blog linking an exploit document to the group Mandiant refers to as APT2 and CrowdStrike as " Putter Panda " .


In 2016 , Unit 42 launched an unprecedented analytic effort focused on developing a modern assessment of the size , scope and complexity of this threat .


In 2014 , Unit 42 released a report titled " 419 Evolution " that documented one of the first known cases of Nigerian cybercriminals using malware for financial gain .


A few months later , in February 2017 , the FBI published a press release revising its estimates and stating that " Since January 2015 , there has been a 1,300 percent increase in identified exposed losses , now totaling over $3 billion " Recognizing the significance of this threat group , Unit 42 continues to track the evolution of Nigerian cybercrime under the code name SilverTerrier .


In the 2016 Internet Crime Report published by the FBI , BEC was specifically highlighted as a " Hot Topic " , having been attributed to more than US$360 million in losses and gaining status as its own category of attack .


Recognizing the significance of this threat group , Unit 42 continues to track the evolution of Nigerian cybercrime under the code name SilverTerrier .


Pony is a fairly common malware family that has existed in various forms since 2012 , with our first indications of Nigerian use occurring in August 2014 .


Of the four , KeyBase stands out due to its rapid rise in popularity , with a peak deployment of 160 samples per month and usage by 46 separate SilverTerrier actors , followed by a fairly rapid decline .


NetWire , DarkComet , NanoCore , LuminosityLink , Remcos and Imminent Monitor are all designed to provide remote access to compromised systems .


Unit 42 analyzed the use of these six malware families and found that Nigerian actors are currently producing an average of 146 unique samples of malware per month ( see Figure 6 ) .


Given this requirement , SilverTerrier actors often rely on Dynamic DNS and virtual private servers to provide a layer of obfuscation to protect their identities .


When using email scams , SilverTerrier actors preferred to use large target audiences , which maximized the likelihood of success with very little risk .


Unit 42 tracks roughly 300 SilverTerrier actors who have registered a combined 11,600 domains over the past five years .


To support the rapid growth and pace of malware distribution efforts , SilverTerrier actors are in constant need of domains to serve as C2 nodes .


To that end , it is very unlikely that the United States government or Shell , a global energy company , would commission SilverTerrier actors to develop domains that impersonate their own legitimate websites and services .


The credentials they use to register their malware infrastructure are easily associated with their public social media accounts on Google® , Facebook® , MySpace® , Instagram® , and various dating and blogging sites .


Earlier this year , Cybereason identified an advanced , persistent attack targeting telecommunications providers that has been underway for years , soon after deploying into the environment .


Based on the data available to us , Operation Soft Cell has been active since at least 2012 , though some evidence suggests even earlier activity by the threat actor against telecommunications providers .


Threat actors , especially those at the level of nation state , are seeking opportunities to attack these organizations , conducting elaborate , advanced operations to gain leverage , seize strategic assets , and collect information .


The tools and techniques used throughout these attacks are consistent with several Chinese threat actors , such as APT10 , a threat actor believed to operate on behalf of the Chinese Ministry of State Security .


The threat actor attempted to compromise critical assets , such as database servers , billing servers , and the active directory .


The attack began with a web shell running on a vulnerable , publicly-facing server , from which the attackers gathered information about the network and propagated across the network .


The initial indicator of the attack was a malicious web shell that was detected on an IIS server , coming out of the w3wp.exe process .


An investigation of the web shell , later classified as a modified version of the China Chopper web shell , uncovered several attack phases and TTPs .


The threat actor was able to leverage the web shell to run reconnaissance commands , steal credentials , and deploy other tools .


The web shell parameters in this attack match to the China Chopper parameters , as described in FireEye 's analysis of China Chopper .


It is used to remotely control web servers , and has been used in many attacks against Australian web hosting providers .


This tool has been used by several Chinese-affiliated threat actors , such as APT 27 and APT 40 .


The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes .


The threat actor relied on WMI and PsExec to move laterally and install their tools across multiple assets .


Nbtscan has been used by APT10 in Operation Cloud Hopper to search for services of interest across the IT estate and footprint endpoints of interest .


A second method the threat actor used to maintain access across the compromised assets was through the deployment of the PoisonIvy RAT ( PIVY ) .


This infamous RAT has been associated with many different Chinese threat actors , including APT10 , APT1 , and DragonOK .


It is a powerful , multi-featured RAT that lets a threat actor take total control over a machine .


In an attempt to hide the contents of the stolen data , the threat actor used winrar to compress and password-protect it .


The winrar binaries and compressed data were found mostly in the Recycle Bin folder , a TTP that was previously observed in APT10-related attacks , as well as others .


This ' connection bouncer ' tool lets the threat actor redirect ports and connections between different networks and obfuscate C2 server traffic .


In order to exfiltrate data from a network segment not connected to the Internet , the threat actor deployed a modified version of hTran .


There have been numerous reports of hTran being used by different Chinese threat actors , including : APT3 , APT27 and DragonOK .


The threat actor made some modifications to the original source code of hTran .


The threat actor had a specific pattern of behavior that allowed us to understand their modus operandi : they used one server with the same IP address for multiple operations .


There are previous reports of threat actors including APT10 and APT1 using dynamic DNS .


Our investigation showed that these attacks were targeted , and that the threat actor sought to steal communications data of specific individuals in various countries .


The data exfiltrated by this threat actor , in conjunction with the TTPs and tools used , allowed us to determine with a very high probability that the threat actor behind these malicious operations is backed by a nation state , and is affiliated with China .


Symantec saw the first evidence of Sowbug-related activity with the discovery in March 2017 of an entirely new piece of malware called Felismus used against a target in Southeast Asia .


Symantec saw the first evidence of Sowbug group with the discovery in March 2017 of an entirely new piece of malware called Felismus used against a target in Southeast Asia .


Symantec has also been able to connect earlier attack campaigns with Sowbug , demonstrating that it has been active since at least early-2015 and may have been operating even earlier .


To date , Sowbug appears to be focused mainly on government entities in South America and Southeast Asia and has infiltrated organizations in Argentina , Brazil , Ecuador , Peru , Brunei and Malaysia .


For example , in a 2015 attack on one South American foreign ministry , the group appeared to be searching for very specific information .


The first evidence of its intrusion dated from May 6 , 2015 but activity appeared to have begun in earnest on May 12 .


In total , the attackers maintained a presence on the target 's network for four months between May and September 2015 .


We have previously detected groups we suspect are affiliated with the North Korean government compromising electric utilities in South Korea , but these compromises did not lead to a disruption of the power supply .


Instead , sensitive KHNP documents were leaked by the actors as part of an effort to exaggerate the access they had and embarrass the South Korean Government , a technique we assess North Korea would turn to again in order to instill fear and/or meet domestic propaganda aims .


North Korea linked hackers are among the most prolific nation-state threats , targeting not only the U.S. and South Korea but the global financial system and nations worldwide .


FireEye has detected more than 20 cyber threat groups suspected to be sponsored by at least four other nation-states attempting to gain access to targets in the energy sector that could have been used to cause disruptions .


CapabilitiesFormBook is a data stealer , but not a full-fledged banker .


FormBook OverviewFormBook is a data stealer and form grabber that has been advertised in various hacking forums since early 2016 .


The malware may inject itself into browser processes and explorer.exe .


The attackers involved in these email campaigns leveraged a variety of distribution mechanisms to deliver the information stealing FormBook malware .


Much of the activity was observed in the United States (Figure 11) , and the most targeted industry vertical was Aerospace/Defense Contractors (Figure 12) .


In the last few weeks , FormBook was seen downloading other malware families such as NanoCore .


We have associated this campaign with APT19 , a group that we assess is composed of freelancers , with some degree of sponsorship by the Chinese government .


The vulnerability is bypassing most mitigations; however , as noted above , FireEye email and network products detect the malicious documents .


We have previously observed APT19 steal data from law and investment firms for competitive economic purposes .


Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download .


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 .


Furthermore , there are indications that APT32 actors are targeting peripheral network security and technology infrastructure corporations .


This focused intelligence and detection effort led to new external victim identifications as well as providing sufficient technical evidence to link twelve prior intrusions , consolidating four previously unrelated clusters of threat actor activity into FireEye’s newest named advanced persistent threat group: APT32 .


In mid-2016 , malware that FireEye believes to be unique to APT32 was detected on the networks of a global hospitality industry developer with plans to expand operations into Vietnam .


In March 2017 , in response to active targeting of FireEye clients , the team launched a Community Protection Event (CPE) – a coordinated effort between Mandiant incident responders , FireEye as a Service (FaaS) , FireEye iSight Intelligence , and FireEye product engineering – to protect all clients from APT32 activity .


In their current campaign , APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros .


APT32 actors continue to deliver the malicious attachments via spear-phishing emails .


APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel files to deliver their initial exploits .


In the following weeks , FireEye released threat intelligence products and updated malware profiles to customers while developing new detection techniques for APT32’s tools and phishing lures .


Also in 2014 , APT32 carried out an intrusion against a Western country’s national legislature .


In 2015 , SkyEye Labs , the security research division of the Chinese firm Qihoo 360 , released a report detailing threat actors that were targeting Chinese public and private entities including government agencies , research institutes , maritime agencies , sea construction , and shipping enterprises .


In order to track who opened the phishing emails , viewed the links , and downloaded the attachments in real-time , APT32 used cloud-based email analytics software designed for sales organizations .


Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnama's manufacturing , consumer products , and hospitality sectors .


Mandiant consultants suspect that APT32 was monitoring web logs to track the public IP address used to request remote images .


APT32 often deploys these backdoors along with the commercially-available Cobalt Strike BEACON backdoor .


The targeting of private sector interests by APT32 is notable and FireEye believes the actor poses significant risk to companies doing business in , or preparing to invest in , the country .


While the motivation for each APT32 private sector compromise varied – and in some cases was unknown – the unauthorized access could serve as a platform for law enforcement , intellectual property theft , or anticorruption measures that could ultimately erode the competitive advantage of targeted organizations .


While actors from China , Iran , Russia , and North Korea remain the most active cyber espionage threats tracked and responded to by FireEye , APT32 reflects a growing host of new countries that have adopted this dynamic capability .


Several Mandiant investigations revealed that , after gaining access , APT32 regularly cleared select event log entries and heavily obfuscated their PowerShell-based tools and shellcode loaders with Daniel Bohannon’s Invoke-Obfuscation framework .


Furthermore , APT32 continues to threaten political activism and free speech in Southeast Asia and the public sector worldwide .


North Korea's Office 39 is involved in activities such as gold smuggling , counterfeiting foreign currency , and even operating restaurants .


With these details , we will then draw some conclusions about the operators of CARBANAK .


Most of these data-stealing capabilities were present in the oldest variants of CARBANAK that we have seen and some were added over time .


Since May 2017 , Mandiant experts observed North Korean actors target at least three South Korean cryptocurrency exchanges with the suspected intent of stealing funds .


February saw three particularly interesting publications on the topic of macOS malware: a Trojan Cocoa application that sends system information including keychain data back to the attacker , a macOS version of APT28’s Xagent malware , and a new Trojan ransomware .


Per a 2015 report from CitizenLab , Gamma Group licenses their software to clients and each client uses unique infrastructure , making it likely that the two documents are being used by a single client .


As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware .


LATENTBOT is a modular and highly obfuscated type of malware first discovered by FireEye iSIGHT intelligence in December 2015 .


It is capable of a variety of functions , including credential theft , hard drive and data wiping , disabling security software , and remote desktop functionality .


Additionally , this incident exposes the global nature of cyber threats and the value of worldwide perspective – a cyber espionage incident targeting Russians can provide an opportunity to learn about and interdict crime against English speakers elsewhere .


Recent DRIDEX activity began following a disclosure on April 7 , 2017 .


This campaign primarily affected the government sector in the Middle East , U.S. , and Japan .


FireEye believes that two actors – Turla and an unknown financially motivated actor – were using the first EPS zero-day CVE-2017-0261 , and APT28 was using the second EPS zero-day CVE-2017-0262 along with a new Escalation of Privilege (EOP) zero-day CVE-2017-0263 .


Turla and APT28 are Russian cyber espionage groups that have used these zero-days against European diplomatic and military entities .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” .


It is possible that CVE-2017-8759 was being used by additional actors .


Russian cyber espionage actors use zero-day exploits in addition to less complex measures .


The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities .


Given the release of sensitive victim data , extortion , and destruction of systems , FireEye considers FIN10 to be one of the most disruptive threat actors observed in the region so far .


To install and register the malicious shim database on a system , FIN7 used a custom Base64 encoded PowerShell script , which ran the sdbinst.exe” utility to register a custom shim database file containing a patch onto a system .


During the investigations , Mandiant observed that FIN7 used a custom shim database to patch both the 32-bit and 64-bit versions of services.exe” with their CARBANAK payload .


FIN7 is a financially motivated intrusion set that selectively targets victims and uses spear phishing to distribute its malware .


During the investigations , Mandiant observed that FIN7 used a custom shim database to patch both the 32-bit and 64-bit versions of a??services.exea?? with their CARBANAK payload .


CARBANAK malware has been used heavily by FIN7 in previous operations .


We have not yet identified FIN7’s ultimate goal in this campaign , as we have either blocked the delivery of the malicious emails or our FaaS team detected and contained the attack early enough in the lifecycle before we observed any data targeting or theft .


If the attackers are attempting to compromise persons involved in SEC filings due to their information access , they may ultimately be pursuing securities fraud or other investment abuse .