These supply chain compromise tactics have also been characteristic of APT41’s best known and most recent espionage campaigns .


Interestingly , despite the significant effort required to execute supply chain compromises and the large number of affected organizations , APT41 limits the deployment of follow-on malware to specific victim systems by matching against individual system identifiers .


Mapping the group’s activities since 2012 (Figure 2) also provides some indication that APT41 primarily conducts financially motivated operations outside of their normal day jobs .


The latter is especially notable because APT41 has repeatedly returned to targeting the video game industry and we believe these activities were formative in the group’s later espionage operations .


APT41 leverages an arsenal of over 46 different malware families and tools to accomplish their missions , including publicly available utilities , malware shared with other Chinese espionage operations , and tools unique to the group .


Once in a victim organization , APT41 can leverage more sophisticated TTPs and deploy additional malware .


APT41 often relies on spear-phishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims .


APT41 has also deployed rootkits and Master Boot Record (MBR) bootkits on a limited basis to hide their malware and maintain persistence on select victim systems .


The limited use of these tools by APT41 suggests the group reserves more advanced TTPs and malware only for high-value targets .


Like other Chinese espionage operators , APT41 appears to have moved toward strategic intelligence collection and establishing access and away from direct intellectual property theft since 2015 .


This shift , however , has not affected the group's consistent interest in targeting the video game industry for financially motivated reasons .


BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e , possibly en masse .


With the contents of the emails , included links and decoy PDFs all involving taxes , the attackers are apparently targeting the financial departments of organizations in the Balkans region .


Some parts of the campaign were briefly described by a Serbian security provider in 2016 and the Croatian CERT in 2017 .


The campaign has been active at least from January 2016 to the time of writing the most recent detections in our telemetry are from July 2019 .


Our findings show that the mentioned attacks have been orchestrated and we consider them a single long-term campaign that spans Croatia , Serbia , Montenegro , and Bosnia and Herzegovina .


We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability CVE-2018-20250 .


Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina .


According to our telemetry , the campaign spreading these tools has been live since 2016 , with the most recent detections as late as in July 2019 .


In some of the latest samples of BalkanDoor detected in 2019 , the malware is distributed as an ACE archive , disguised as a RAR archive (i.e , not an executable file) , specially crafted to exploit the WinRAR ACE vulnerability CVE-2018-20250 .


Via the BalkanDoor backdoor , the attacker sends a backdoor command to unlock the screen… and using BalkanRAT , they can do whatever they want on the computer .


The BalkanDoor backdoor does not implement any exfiltration channel .


APT41 leveraged ADORE.XSEC , a Linux backdoor launched by the Adore-NG rootkit , throughout an organization's Linux environment .


The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience .


The main part of the BalkanRAT malware is a copy of the Remote Utilities software for remote access .


Interestingly , some of the APT41's POISONPLUG malware samples leverage the Steam Community website associated with Valve , a video game developer and publisher .


The campaign targeting accountants in the Balkans shows some similarities with a campaign aimed at Ukrainian notaries reported in 2016 .


Based on the Let’s Encrypt certificate issuance date , we believe this campaign to be active from May 2019 .


One of the domains uncovered during the investigation was identified by the Chinese security vendor CERT 360 as being part of the BITTER APT campaign in May 2019 .


Further analysis of the BITTER APT’s infrastructure uncovered a broader phishing campaign targeting other government sites and state-owned enterprises in China .


Further investigation revealed approximately 40 additional sites , all of which appear to be targeting the government of China and other organisations in China .


We expect to see BITTER APT continuing to target the government of China by employing spoofed login pages designed to steal user credentials and obtain access to privileged account information .


This domain and IP address has been previously associated with the BITTER APT and targeting government agencies in China with phishing attacks , based on reporting from 360-CERT .


At the time of analysis , the subdomains did not host a website; however , based on BITTER APT group’s targeting patterns , it is highly likely that they were created to host faux login phishing pages designed to steal user’s credentials .


BITTER APT campaigns are primarily targeting China , Pakistan and Saudi Arabia historically .


As part of its ongoing research initiatives , the Anomali Threat Research Team has discovered a new phishing attack leveraging spoof sites that seem to be designed to steal email credentials from the target victims within the government of the People’s Republic of China .


360 Threat Intelligence Center has reported on related indicators being attributed to BITTER APT a South Asian country suspected Indian APT in open source reporting .


China Chopper is a tool that has been used by some state-sponsored actors such as Leviathan and Threat Group-3390 , but during our investigation we've seen actors with varying skill levels .


China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool .


Cisco Talos discovered significant China Chopper activity over a two-year period beginning in June 2017 , which shows that even nine years after its creation , attackers are using China Chopper without significant modifications .


Here , we investigate a campaign targeting an Asian government organization .


We observed another campaign targeting an organisation located in Lebanon .


China Chopper contains a remote shell (Virtual Terminal) function that has a first suggested command of netstat an|find ESTABLISHED .


They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword.exe .


The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords .


The actor attempts to exploit CVE-2018–8440 — an elevation of privilege vulnerability in Windows when it improperly handles calls to Advanced Local Procedure Call — to elevate the privileges using a modified proof-of-concept exploit .


The attacker obtains the required privileges and launches a few other tools to modify the access control lists (ACLs) of all websites running on the affected server .


The Windows branch of the Cloud Atlas intrusion set still uses spear-phishing emails to target high profile victims .


From the beginning of 2019 until July , we have been able to identify different spear-phishing campaigns related to this threat actor mostly focused on Russia , Central Asia and regions of Ukraine with ongoing military conflicts .


We described one of the techniques used by Cloud Atlas in 2017 and our colleagues at Palo Alto Networks also wrote about it in November 2018 .


The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server .


Previously , Cloud Atlas dropped its validator” implant named PowerShower” directly , after exploiting the Microsoft Equation vulnerability CVE-2017-11882 mixed with CVE-2018-0802 .


This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage .


Cloud Atlas remains very prolific in Eastern Europe and Central Asia .


During its recent campaigns , Cloud Atlas used a new polymorphic” infection chain relying no more on PowerShower directly after infection , but executing a polymorphic HTA hosted on a remote server , which is used to drop three different files on the local system .


The Gamaredon Group has been actively launching spear-phishing attacks against Ukrainian government and military departments from the mid-2013s .


In addition , the anonymous cybersecurity experts referenced in the article connected the malicious Gamaredon Group actors with Russian state-sponsored hackers .


In one article published in the Kharkiv Observer – an independent Ukranian online publication – an unnamed source stated that even the Ukrainian Presidential Administration has been attacked by malware developed by the Gamaredon Group .


Gamaredon Group primarily target Ukrainian organizations and resources using spear-phishing attacks , and they use military or similar documents as bait .


Once they have found a victim , they then deploy remote manipulation system binaries (RMS) via self-extracting archives and batch command files .


The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content .


During a recent incident response investigation , our team identified new attacks by the financially motivated attack group ITG08 , also known as FIN6 .


More recently , ITG08 has been observed targeting e-commerce environments by injecting malicious code into online checkout pages of compromised websites — a technique known as online skimming — thereby stealing payment card data transmitted to the vendor by unsuspecting customers .


This tool , a TTP observed in ITG08 attacks since 2018 , is sold on the dark web by an underground malware-as-a-service (MaaS) provider .


ITG08 is an organized cybercrime gang that has been active since 2015 , mostly targeting pointof-sale (POS) machines in brick-and-mortar retailers and companies in the hospitality sector in the U.S. and Europe .


Past campaigns by ITG08 using the More_eggs backdoor were last reported in February 2019 .


Attackers use it to create , expand and cement their foothold in compromised environments .


Lastly , ITG08 used Comodo code-signing certificates several times during the course of the campaign .


Let’s take a closer look at ITG08’s TTPs that are relevant to the campaign we investigated , starting with its spear phishing and intrusion tactics and covering information on its use of the More_eggs backdoor .


Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe .


X-Force IRIS determined that the More_eggs backdoor later downloaded additional files , including a signed binary shellcode loader and a signed Dynamic Link Library (DLL) , as described below , to create a reverse shell and connect to a remote host .


Once the ITG08 established a foothold on the network , they employed WMI and PowerShell techniques to perform network reconnaissance and move laterally within the environment .


The attackers used this technique to remotely install a Metasploit reverse TCP stager on select systems , subsequently spawning a Meterpreter session and Mimikatz .


In addition to the More_eggs malware , ITG08 leveraged in-memory attacks by injecting malicious code , in this case Mimikatz , into legitimate system processes .


A recently rising attack tool in ITG08 campaigns has been the More_eggs JScript backdoor .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory .


After a successful phishing attack in which users have opened emails and browsed to malicious links , ITG08 attackers install the More_eggs JScript backdoor on user devices alongside several other malware components .


Beyond using More_eggs as a backdoor , ITG08 in this campaign also used offensive security tools and PowerShell scripts to carry out the different stages of the attack .


After injecting Meterpreter into memory , the attacker had complete control of the infected device .


IBM X-Force IRIS has gained insight into ITG08’s intrusion methods , ability to navigate laterally , use of custom and open-source tools , and typical persistence mechanisms .


After the phishing email resulted in a successful infiltration , ITG08 used the More_eggs backdoor to gain a foothold and infect additional devices .


In addition , configuring PowerShell script logging and identifying any obfuscation will assist in mitigating ITG08’s use of PowerShell to conduct malicious activity .


The LYCEUM threat group targets organizations in sectors of strategic national importance , including oil and gas and possibly telecommunications .


CTU research indicates that LYCEUM may have been active as early as April 2018 .


In May 2019 , the threat group launched a campaign against oil and gas organizations in the Middle East .


This campaign followed a sharp uptick in development and testing of their toolkit against a public multivendor malware scanning service in February 2019 .


Stylistically , the observed tradecraft resembles activity from groups such as COBALT GYPSY (which is related to OilRig , Crambus , and APT34 and COBALT TRINITY also known as Elfin and APT33 .


When CTU researchers first published information about LYCEUM to Secureworks Threat Intelligence clients , no public documentation on the group existed .


Using compromised accounts , LYCEUM send spearphishing emails with malicious Excel attachments to deliver the DanBot malware , which subsequently deploys post-intrusion tools .


The developer consistently used Accept-Enconding” (note the extra ‘n’) in all DanBot samples analyzed by CTU researchers .


Get-LAPSP.ps1 is a PowerShell script that gathers account information from Active Directory via LDAP .


LYCEUM deployed this tool via DanBot shortly after gaining initial access to a compromised environment .


LYCEUM delivers weaponized maldocs via spearphishing from the compromised accounts to the targeted executives , human resources (HR) staff , and IT personnel .


This focus on training aligns with LYCEUM’s targeting of executives , HR staff , and IT personnel .


Despite the initial perception that the maldoc sample was intended for ICS or OT staff , LYCEUM has not demonstrated an interest in those environments .


However , CTU researchers cannot dismiss the possibility that the LYCEUM could seek access to OT environments after establishing robust access to the IT environment .


LYCEUM is an emerging threat to energy organizations in the Middle East , but organizations should not assume that future targeting will be limited to this sector .


Aside from deploying novel malware , LYCEUM’s activity demonstrates capabilities CTU researchers have observed from other threat groups and reinforces the value of a few key controls .


Password spraying , DNS tunneling , social engineering , and abuse of security testing frameworks are common tactics , particularly from threat groups operating in the Middle East .


The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations .


Machete is still very active at the time of this publication , regularly introducing changes to its malware , infrastructure and spearphishing campaigns .


ESET has been tracking a new version of Machete (the group’s Python-based toolset) that was first seen in April 2018 .


This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted with the Machete malware .


Their long run of attacks , focused on Latin American countries , has allowed them to collect intelligence and refine their tactics over the years .


Machete is interested in files that describe navigation routes and positioning using military grids .


The Machete group sends very specific emails directly to its victims , and these change from target to target .


The Machete group is very active and has introduced several changes to its malware since a new version was released in April 2018 .


Previous versions were described by Kaspersky in 2014 and Cylance in 2017 .


Since August 2018 , the Machete components have been delivered with an extra layer of obfuscation .


The GoogleUpdate.exe component is responsible for communicating with the remote C&C server .


ESET has been tracking this threat for months and has observed several changes , sometimes within weeks .


This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries .


The presence of code to exfiltrate data to removable drives when there is physical access to a compromised computer may indicate that Machete operators could have a presence in one of the targeted countries , although we cannot be certain .


This group is very active and continues to develop new features for its malware , and implement infrastructure changes in 2019 .


Machete's long run of attacks , focused in Latin American countries , has allowed them to collect intelligence and refine their tactics over the years .


ESET researchers have detected an ongoing , highly targeted campaign , with a majority of the targets being military organizations .


The group behind Machete uses effective spearphishing techniques .


First described by Kaspersky in 2014 [1] and later , by Cylance in 2017 [2] , Machete is a piece of malware found to be targeting high profile individuals and organizations in Latin American countries .


In 2018 Machete reappeared with new code and new features .


As of June 2019 , ESET has seen over 50 victims being actively spied upon by Machete , with more than half of them being computers belonging to the Venezuelan military forces .


Machete has Latin American targets and has been developed by a Spanish-speaking group , presumably from a LATAM country .


Machete was active and constantly working on very effective spearphishing campaigns .


In some cases , Machete trick new victims by sending real documents that had been stolen on the very same day .


Machete relies on spearphishing to compromise its targets .


They seem to have specialized knowledge about military operations , as they are focused on stealing specific files such as those that describe navigation routes .


Attackers take advantage of that , along with their knowledge of military jargon and etiquette , to craft very convincing phishing emails .


Operators behind Machete apparently already have information about individuals or organizations of interest to them in Latin America , how to reach them , and how best to trick them into getting compromised .


Since the end of March up until the end of May 2019 , ESET observed that there were more than 50 victimized computers actively communicating with the C&C server .


This extends to other countries in Latin America , with the Ecuadorean military being another organization highly targeted by Machete .


Machete is malware that has been developed and is actively maintained by a Spanish-speaking group .


Since it was active in 2012 , it has been carrying out attacks against sensitive targets in China and is one of the most active APT attack organizations targeting mainland China in recent years .


By introducing small changes to their code and infrastructure , the group has bypassed several security products .


OceanLotus will release malicious sub-packages in the background , receive the remote control command , steal the privacy information of users such as SMS messages , contacts , call records , geographic locations , and browser records .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage .


It can be seen that after the code leakage , the CEO of the HackingTeam organization said that the leaked code is only a small part is based on the facts , which also reflects that the network arms merchants have lowered the threshold of APT attacks to a certain extent , making more uncertainties of cyber attacks .


This report includes details related to the major hacking targets of the SectorJ04 group in 2019 , how those targets were hacked , characteristics of their hacking activities this year and recent cases of the SectorJ04 group’s hacking .


In 2019 , the SectorJ04 group expanded its hacking activities to cover various industrial sectors located across Southeast Asia and East Asia , and is changing the pattern of their attacks from targeted attacks to searching for random victims .


The SectorJ04 group has maintained the scope of its existing hacking activities while expanding its hacking activities to companies in various industrial sectors located in East Asia and Southeast Asia .


There was a significant increase in SectorJ04's hacking activities in 2019 , especially those targeting South Korea .


They mainly utilize spam email to deliver their backdoor to the infected system that can perform additional commands from the attacker’s server .


We saw SectorJ04 group activity in Germany , Indonesia , the United States , Taiwan , India .


The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system .


The SectorJ04 group’s preexisting targets were financial institutions located in countries such as North America and Europe , or general companies such as retail and manufacturing , but they recently expanded their areas of activity to include the medical , pharmaceutical , media , energy and manufacturing industries .


The SectorJ04 group mainly used their own backdoor , ServHelper and FlawedAmmy RAT , for hacking .


SectorJ04 also used the Remote Manipulator System (RMS) RAT , a legitimate remote management software created in Russia .


Backdoors are installed in infected systems and SectorJ04 also distributed email stealers , botnet malware and ransomware through those backdoors .


Backdoor installed in the infected system distributed additional botnet malware , ransomware and email stealers .


SectorJ04 was recently confirmed to use additional backdoor called AdroMut and FlowerPippi , which is used to install other backdoor such as FlawedAmmy RAT on behalf of the MSI file , or to collect system information and send it to the attacker’s server .


Although the SectorJ04 group mainly targeted countries located in Europe or North America , it has recently expanded its field of activities to countries located in Southeast Asia and East Asia .


The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format .


A new type of backdoor called AdroMut and a new malware called FlowerPippi was also found coming from SectorJ04 .


But after 2019 SectorJ04 has changed its hacking strategy to attack using spam email .


The hacking activities of SectorJ04 group , which targeted South Korea in the first half of 2019 , have been continuously discovered .


Prior to 2019 , the SectorJ04 group conducted large-scale hacking activities for financial gain using exploit kits on websites to install ransomware , such as Locky and GlobeImporter , along with its banking Trojan , on its victims computers .


In June 2019 , continuous SectorJ04's activities targeting South Korea were found again and spam emails were written with various contents , including transaction statements , receipts and remittance cards .


The SectorJ04 group has carried out large-scale hacking activities targeting South Korea , while also expanding the field of attacks to Southeast Asian countries such as Taiwan and the Philippines .


In June , SectorJ04 group conducted hacking using spam emails written in various languages , including English , Arabic , Korean and Italian , and the emails were written with various contents , including remittance card , invoice and tax invoice .


Spam emails and attachments written in Chinese were found in May , and the SectorJ04 group at that time targeted industrial sectors such as electronics and telecommunications , international schools and manufacturing .


In addition to their preexist backdoor , ServHelper and FlawedAmmy , they have also been confirmed to use the backdoor called AdroMut and FlowerPippi .


AdroMut downloads the malware ServHelper and FlawedAmmy RAT used by the SectorJ04 group from the attacker server and simultaneously performs the functions of a backdoor .


The SectorJ04 group , which has been utilizing the same pattern of infection and the same malware for more than six months , is believed to be attempting to change its infection methods such as downloading malware directly from malicious documents without using MSI installation files , changing their spam email format and using new types of backdoor .


Until 2019 , SectorJ04 group had carried out massive website-based hacking activities that mainly utilize ransomware and banking trojans for financial profit , and has also been carrying out information gathering activities to secure attack resources such as email accounts and system login information from users since 2019 .


The SectorJ04 group has shown a pattern of hacking activities that have changed from targeted attacks to a large-scale distribution of spam .


This allows them to expand their range of targets of hacking activities for financial profit , and in this regard , SectorJ04 group has been found to have hacked into a company’s internal network by using a spear phishing email targeting executives and employees of certain South Korean companies around February 2019 .


SectorJ04 group carried out intensive hacking on various industrial sectors , including South Korea’s media , manufacturing and universities , around February and March 2019 .


SectorJ04 used the spear phishing email to spread malicious Excel or malicious Word files , and downloaded the MSI files from the attacker’s server when the malicious documents were run .


SectorJ04 group conducted hacking activities targeting financial institutions located in India and Hong Kong around April 2019 .


SectorJ04 group carried out hacking activities targeting financial institutions located in Italy and other countries around May 2019 .


In late July , SectorJ04 group used FlawedAmmy RAT to carry out hacking attacks on companies and universities in sectors such as education , job openings , real estate and semiconductors in South Korea .


In early August , the SectorJ04 group carried out extensive hacking activities targeting the users around the world , including South Korea , India , Britain , the United States , Germany , Canada , Argentina , Bangladesh and Hong Kong .


Spam emails targeting email accounts used in the integrated mail service of public officials were also found in the hacking activity .


They are one of the most active cyber crime groups in 2019 , and they often modify and tweak their hacking methods and perform periodic hacking activities .


Now , Silence is one of the most active threat actors targeting the financial sector .


Since we released our original report , Silence: Moving into the darkside , the confirmed damage from Silence's operations has increased fivefold compared to the figures in Group-IB's initial report .


Silence started by targeting organizations in Russia , gradually shifting their focus to former Soviet countries , and then the world .


Silence also started using Ivoke , a fileless loader , and EDA agent , both written in PowerShell .


Silence 2.0: Going Global is an extension of our original report: Silence: Moving into the Darkside which remains the most significant contribution to the research on the group and is the first such report to reveal Silence’s activity .


Since the report’s release in September 2018 , Group-IB’s Threat Intelligence team has detected 16 campaigns targeting banks launched by Silence .


Like the majority of APT groups , Silence uses phishing as their infection vector .


In the last successful attack described in Silence: Moving into the darkside , dated April 2018 , the hackers siphoned off about $150 , 000 through ATMs in a single night .


Prior to April 2018 , as described in Group-IB’s Silence: Moving into the darkside report , Silence’s target interests were primarily limited to former Soviet and Eastern European countries including Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan .


In 2018 , Silence conducted test campaigns to update their database of current targets and expand their attack geography .


The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


Silence has conducted at least three campaigns using recon emails , followed by malicious mail sent to an updated recipient list .


Group-IB has also detected recon emails sent out to New Zealand .


Since our last public report , Silence has sent out more than 170 , 000 recon emails to banks in Russia , the former Soviet Union , Asia and Europe .


In November 2018 , Silence tried their hand at targeting the Asian market for the first time in their history .


In total , Silence sent out about 80 , 000 emails , with more than half of them targeting Taiwan , Malaysia , and South Korea .


From 16 October 2018 to 1 January 2019 , Silence sent out about 84 , 000 emails in Russia alone to update their address database .


As part of their phishing campaigns , silence still uses Microsoft Office documents with macros or exploits , CHM files , and .LNK shortcuts as malicious attachments .


In the former Soviet Union , Silence targeted banks in Kyrgyzstan , Kazakhstan , and Ukraine .


In 2019 , Group-IB also observed the use of a new fileless PowerShell loader called Ivoke .


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer .


As the CnC server , Silence use CnC-3 server running Windows , from which they send commands to download additional modules .


To control ATMs , the group uses the Atmosphere Trojan , which is unique to Silence , or a program called xfs-disp.exe .


In addition , Silence downloads the reverse proxy programs Silence.ProxyBot and Silence. ProxyBot.NET , which are described in detail in the report Silence: moving into the darkside .


Analysis of the emails has shown that the attachment contains an exploit for the CVE-2017-11882 vulnerability .


Group-IB specialists tracked a massive mailout of emails containing a malicious Microsoft Word attachment titled Договор.doc” [Contract.doc] .


Silence sent out emails to Russian banks .


The exploit installs Silence’s loader , designed to download backdoors and other malicious programs .


Silence conducted a massive phishing campaign posing as the Central Bank of the Russian Federation .


Group-IB specialists have established that the aim of the attack was to deliver and launch the second stage of Silence’s Trojan , known as Silence.MainModule .


Silence attacked financial organisations in the UK .


Silence conducted the first stage of their Asian campaign , organising a massive phishing attack aimed at receiving an up-to-date list of current recipients in different countries for further targeted attacks delivering their malicious software .


The attackers used the server deployed on 6 June 2019 to control compromised workstations in these banks .


On 24 March 2019 , Silence.ProxyBot (MD5 2fe01a04d6beef14555b2cf9a717615c) was uploaded to VirusTotal from an IP address in Sri Lanka .


On October 18th , 2018 , the group sent out emails to British financial companies as part of their preparatory campaign .


Group-IB experts established that the server 185.20.187.89 started functioning no later than 28 January 2019 .


According to local media reports , in 2019 Silence successfully withdrew money from the Bangladeshi bank twice within 2 months .


To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank .


As we described in Silence: Moving into the darkside report , Silence has experience with theft using compromised card processing systems .


In February 2019 , Russian media7 reported a Silence attack on IT Bank in the city of Omsk .


On 16 January 2019 , Silence sent out phishing emails with malicious attachments disguised as invitations to the International Financial Forum iFin-2019 (see section ‘Attack timeline’) .


Group-IB specialists determined that the email addresses of IT bank employees were among the recipients of these emails .


The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine .


Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server .


Since at least 2011 , these hackers have been using malware to spy on corporate networks .


Hackers are targeting high-tech companies as well as chemical and pharmaceutical companies .


The hackers will map a company’s network and look for strategically favorable locations for placing their malware .


The corporation conrms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions.” Henkel claims that a very small portion” of its worldwide IT systems had been aected — the systems in Germany .


A BASF spokeswoman tells us in an email that in July 2015 , hackers had successfully overcome the rst levels” of defense .


The tool was written by sta of Thyssenkrupp , because the industrial giant—company number eleven—had been spied on by Winnti .


Hackers are charged with spying on a manufacturer of gas turbines .


The Hong Kong government was spied on by the Winnti hackers .


Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX .


While OceanLotus’ targets are global , their operations are mostly active within the APAC region which encompasses targeting private sectors across multiple industries , foreign governments , activists , and dissidents connected to Vietnam .


NewsBeef attacks against Saudi Arabian organizations and individuals (as well as targets in the European Union) are likely to continue .


Rapid7 discovered that additional data was placed into the Dropbox accounts under control of the APT10 during the compromise and was able to attribute data that was placed into it as being owned by Visma .


Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe .


These RAT families are discussed in Novetta’s other report on the Lazarus Group’s RAT and Staging capabilities .


Magic Hound has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia .


Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations .


CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash .


CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering .


Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East (including targets inside Iran itself) , as well as across Europe and in the United States .


These malware families have a rich history of being used in many targeted attacks against government and private organizations .


The activity surfaced in Southeast Asia , a region where APT10 frequently operates .


The samples we analyzed originated from the Philippines .


APT10 frequently targets the Southeast Asia region .


Both of the loader’s variants and their various payloads that enSilo analyzed share similar Tactics , Techniques , and Procedures (TTPs) and code associated with APT10 .


Typically , APT10 tends to employ a namesquatting scheme in their domains that aims to confuse the observer by posing as a legitimate domain .


Also , the certificate embedded in the Quasar sample was issued at 22.12.2018 , which correlates with the file’s compilation date .


Over the past three months , Recorded Future’s Insikt Group has observed an increase in APT33’s also known as Elfin infrastructure building and targeting activity , and on June 21 , 2019 , Yahoo .


News reported that the U.S. Cyber Command launched cyberattacks on an Iranian spy group .


Iranian state-sponsored threat actor APT33 has been conducting cyberespionage activity since at least 2013 , predominantly targeting nations in the Middle East , but also notably targeting U.S. , South Korean , and European commercial entities across a wide variety of sectors .


Our research found that APT33 , or a closely aligned threat actor , continues to conduct and prepare for widespread cyberespionage activity , with over 1 , 200 domains used since March 28 , 2019 and with a strong emphasis on using commodity malware .


The targeting of mainly Saudi Arabian organizations across a wide variety of industries aligns with historical targeting patterns for the group , which appear undeterred following previous exposés of their activity .


Towards the end of April 2019 , we tracked down what we believe to be new activity by APT10 , a Chinese cyber espionage group .


Almost 60% of the suspected APT33 domains that were classified to malware families related to njRAT infections , a RAT not previously associated with APT33 activity .


Other commodity RAT malware families , such as AdwindRAT and RevengeRAT , were also linked to suspected APT33 domain activity .


APT33 is an Iranian state-sponsored threat actor that has engaged in cyberespionage activities since at least 2013 .


Western and Saudi organizations in industries that have been historically targeted by APT33 should be monitoring geopolitical developments and increasing the scrutiny of operational security controls focusing on detection and remediation of initial unauthorized access , specifically from phishing campaigns , webshells .


Symantec’s Elfin report denoted additional targeting of the engineering , chemical , research , finance , IT , and healthcare sectors .


We assess that the recent reporting on links between the Nasr Institute and Kavosh Security Group , as well as technical and persona analysis , overlaps among APT33 , APT35 , and MUDDYWATER , and is probably a result of the tiered structure that Iran utilizes to manage cyber operations .


Recorded Future has been monitoring APT33 activity , beginning with research published in October 2017 , which revealed new infrastructure , malware hashes , and TTPs relating to the threat actor(s) .


FireEye also noted in their 2017 report that the online handle xman_1365_x , ” found within the PDB path in an APT33 TURNEDUP backdoor sample , belonged to an individual at the Nasr Institute .


Recorded Future’s Insikt Group has been monitoring APT33 activity , beginning with research published in October 2017 , which revealed new infrastructure , malware hashes , and TTPs relating to the threat actor(s) .


Based on this information , it is possible that upon the exposure of the Nasr Institute as a front for Iranian state-sponsored offensive cyber activity , employees transitioned over to other entities , such as Kavosh , to protect their identities and minimize further exposure .


Insikt Group researchers used proprietary methods , including Recorded Future Domain Analysis and Recorded Future Network Traffic Analysis , along with other common analytical approaches , to profile recently reported Iranian threat actor APT33’s domain and hosting infrastructure in an effort to identify recent activity .


Insikt Group enumerated all domains reported as being used by APT33 since January 2019 .


PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more .


Using data from Recorded Future Domain Analysis and combining it with data derived from Recorded Future Network Traffic Analysis , Insikt Group researchers were able to identify a small selection of likely targeted organizations impacted by suspected APT33 activity .


Following the exposure of a wide range of their infrastructure and operations by Symantec earlier this year , we discovered that APT33 , or closely aligned actors , reacted by either parking or reassigning some of their domain infrastructure .


Since late March , suspected APT33 threat actors have continued to use a large swath of operational infrastructure , well in excess of 1 , 200 domains , with many observed communicating with 19 different commodity RAT implants .


While we haven’t observed a widespread targeting of commercial entities or regional adversaries like in previously documented APT33 operations , the handful of targeted organizations that we did observe were mainly located in Saudi Arabia across a range of industries , indicating ongoing targeting aligned with geopolitical aims .


The zip contained a sample of the Poison Ivy malware which is also known to be used by APT10 .


The new malware families , which we will examine later in this post , show APT34 relying on their PowerShell development capabilities , as well as trying their hand at Golang .


Additionally , with the assistance of our FireEye Labs Advanced Reverse Engineering (FLARE) , Intelligence , and Advanced Practices teams , we identified three new malware families and a reappearance of PICKPOCKET , malware exclusively observed in use by APT34 .


This threat group has conducted broad targeting across a variety of industries operating in the Middle East; however , we believe APT34's strongest interest is gaining access to financial , energy , and government entities .


Additionally , with the assistance of FireEye Labs , we identified three new malware families and a reappearance of PICKPOCKET , malware exclusively observed in use by APT34 .


APT34 is an Iran-nexus cluster of cyber espionage activity that has been active since at least 2014 .


This CPE was created to ensure our customers are updated with new discoveries , activity and detection efforts related to this campaign , along with other recent activity from Iranian-nexus threat actors to include APT33 , which is mentioned in this updated FireEye blog post .


On June 19 , 2019 , FireEye’s Managed Defense Security Operations Center received an exploit detection alert on one of our FireEye Endpoint Security appliances .


A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests , TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution .


FireEye’s Advanced Practices and Intelligence teams were able to identify additional artifacts and activity from the APT34 actors at other victim organizations .


Of note , FireEye discovered two additional new malware families hosted at this domain , VALUEVAULT and LONGWATCH .


This tool was previously observed during a Mandiant incident response in 2018 and , to date , solely utilized by APT34 .


PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file .


FireEye detects this activity across our platforms , including named detection for TONEDEAF , VALUEVAULT , and LONGWATCH .


Several spear-phishing campaigns attributed to Carbanak , all occurring between March and May 2018 , were analyzed by security researchers in 2018 .


One of the most prolific APT-style cyberattacks , specifically targeting the financial sector , is known as Carbanak .


Discovered in 2014 , the campaign quickly gained notoriety after compromising the security systems of 100 banks in 40 countries and stealing up to $1 billion in the process .


The same group is believed to have also been using the Cobalt Strike framework to run sophisticated campaigns , plotting and performing financial heists of financial institutions .


Banks in countries such as Russia , the United Kingdom , the Netherlands , Spain , Romania , Belarus , Poland , Estonia , Bulgaria , Georgia , Moldova , Kyrgyzstan , Armenia , Taiwan and Malaysia have allegedly been targeted with spearphishing emails , luring victims into clicking malicious URLs and executing booby-trapped documents .


A Carbanak trademark in cyberattacks remains the use of Cobalt Strike – a powerful pentesting tool designed for exploiting and executing malicious code , simulating post-exploitation actions of advanced threat actors – which allows them to infiltrate the organization , move laterally , exfiltrate data , and deploy anti-forensic and evasion tools .


However , this action doesn’t appear to have made a dent in the cybercriminal organization , as subsequent spear-phishing campaigns seem to have been reported from March until May 2018 .


Bitdefender’s forensics and investigation team was contacted to look into a security incident that started in May 2018 with an email received by two of the bank’s employees .


The Carbanak group , which has a long track record of compromising infrastructure belonging to financial institutions , is still active .


Its purpose remains to manipulate financial assets , such as transferring funds from bank accounts or taking over ATM infrastructures and instructing them to dispense cash at predetermined time intervals .


If the attack had succeeded , it would have given hackers control over the ATM network , while money mules would have been standing by the ATM machines at pre-set time intervals to cash them out .


The actors uploaded a variety of tools that they used to perform additional activities on the compromised network , such as dumping credentials , as well as locating and pivoting to additional systems on the network .


We believe Emissary Panda exploited a recently patched vulnerability in Microsoft SharePoint tracked by CVE-2019-0604 , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell .


Bitdefender’s investigation shows the attackers’ main methods remain to quietly infiltrate the infrastructure by establishing a foothold on an employee’s system , then move laterally across the infrastructure or elevate privileges to find critical systems that manage financial transactions or ATM networks .


We also found the China Chopper webshell on the SharePoint servers , which has also been used by the Emissary Panda threat group .


Of particular note is their use of tools to identify systems vulnerable to CVE-2017-0144 , which is the same vulnerability exploited by EternalBlue that is best known for its use in the WannaCry attacks of 2017 .


In addition to the aforementioned post-exploitation tools , the actors used these webshells to upload legitimate executables that they would use DLL sideloading to run a malicious DLL that has code overlaps with known Emissary Panda attacks .


This webshell activity took place across three SharePoint servers hosted by two different government organizations between April 1 , 2019 and April 16 , 2019 , where actors uploaded a total of 24 unique executables across the three SharePoint servers .


The timeline shows three main clusters of activity across the three webshells , with activity occurring on two separate webshells (green and orange) within a very small window of time on April 2 , 2019 and the activity involving the third webshell two weeks later on April 16 , 2019 .


In April 2019 , several national security organizations released alerts on CVE-2019-0604 exploitation , including the Saudi Arabian National Cyber Security Center and the Canadian Center for Cyber Security .


Based on the functionality of the various tools uploaded to the webshells , we believe the threat actors breach the SharePoint servers to use as a beachhead , then attempt to move laterally across the network via stolen credentials and exploiting vulnerabilities .


We also observed the actors uploading custom backdoors such as HyperBro which is commonly associated with Emissary Panda .


Both of these alerts discussed campaigns in which actors used the CVE-2019-0604 to exploit SharePoint servers to install the China Chopper webshell .


During our research into this attack campaign , Unit 42 gathered several tools that the Emissary Panda uploaded to the three webshells at the two government organizations .


We also observed the actors uploading the HyperBro backdoor to one of the webshells , as well as legitimate executables that would sideload malicious DLLs that have overlapping code associated with known Emissary Panda activity .


Lastly , we saw the actor uploading a custom backdoor called HyperBro , which has been associated with Emissary Panda operations in the past .


The other overlapping files are tools used by the adversary to locate other systems on the network (etool.exe) , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 (checker1.exe) and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) .


Also , the NCSC advisory mentioned that the actors used a file name stylecss.aspx for their webshell , which is the same filename we saw associated with China Chopper .


We will provide an analysis of the HyperBro tool in an upcoming section .


However , using NCC Group’s research published in May 2018 , we were able to discover code overlaps between these DLLs and a sideloaded DLL that ran the SysUpdate tool that the NCC group has associated with an Emissary Panda campaign .


The list also includes several hack tools , such as Mimikatz for credential dumping and several compiled python scripts used to locate and compromise other systems on the local network .


Unfortunately , we do not have access to the PYTHON33.hlp or CreateTsMediaAdm.hlp files , so we do not know the final payload loaded by either of these DLLs .


Figure 9 shows a code comparison between the PYTHON33.dll (right) and inicore_v2.3.30.dll (left) (SHA256: 4d65d371a789aabe1beadcc10b38da1f998cd3ec87d4cc1cfbf0af014b783822) , which was sideloaded to run the SysUpdate tool in a previous Emissary Panda campaign .


The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell .


According to Microsoft’s advisory , this vulnerability was patched on March 12 , 2019 and we first saw the webshell activity on April 1 , 2019 .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 .


Once the adversary established a foothold on the targeted network , they used China Chopper and other webshells to upload additional tools to the SharePoint server to dump credentials , perform network reconnaissance and pivot to other systems .


We also observed Emissary Panda uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before .


Consequently , the Linux malware ecosystem is plagued by financial driven crypto-miners and DDoS botnet tools which mostly target vulnerable servers .


We also observed the actors uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before .


It has been active since at least 2013 , and has targeted individuals likely involved with the Ukrainian government .


The group’s implants are characterized by the employment of information stealing tools among them being screenshot and document stealers delivered via a SFX , and made to achieve persistence through a scheduled task .


The finding shows that EvilGnome operates on an IP address that was controlled by the Gamaredon group two months ago .


FIN7 operations are linked to numerous intrusion attempts having targeted hundreds of companies since at least as early as 2015 .


The FIN7 intrusion set continued its tailored spear phishing campaigns throughout last year .


In addition , during the investigation , we discovered certain similarities to other attacker groups that seemed to share or copy the FIN7 TTPs in their own operations .


In 2018-2019 , researchers of Kaspersky Lab’s Global Research and Analysis Team analyzed various campaigns that used the same Tactics Tools and Procedures (TTPs) as the historic FIN7 , leading the researchers to believe that this threat actor had remained active despite the 2018 arrests .


One of the domains used by FIN7 in their 2018 campaign of spear phishing contained more than 130 email HackOrges , leading us to think that more than 130 companies had been targeted by the end of 2018 .


Interestingly , following some open-source publications about them , the FIN7 operators seems to have developed a homemade builder of malicious Office document using ideas from ThreadKit , which they employed during the summer of 2018 .


The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation .


The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method .


Given FIN7’s previous use of false security companies , we decided to look deeper into this one .


This activity cluster , which Kaspersky Lab has followed for a few years , uses various implants for targeting mainly banks , and developers of banking and money processing software solutions .


FIN7’s last campaigns were targeting banks in Europe and Central America .


After a successful penetration , FIN7 uses its own backdoors and the CobaltStrike framework or Powershell Empire components to hop to interesting parts of the network , where it can monetize its access .


AveMaria is a new botnet , whose first version we found in September 2018 , right after the arrests of the FIN7 members .


This threat actor stole suspected of stealing €13 million from Bank of Valetta , Malta earlier this year .


In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger .


They also use AutoIT droppers , password-protected EXE files and even ISO images .


To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT .


Interestingly , this actor targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center .


At the end of 2018 , while searching for new FIN7 campaigns via telemetry , we discovered a set of activity that we temporarily called CopyPaste” from a previously unknown APT .


FIN7 and Cobalt used decoy 302 HTTP redirections too , FIN7 on its GRIFFON C2s before January 2018 , and Cobalt , on its staging servers , similar to CopyPaste .


Quite recently , FIN7 threat actors typosquatted the brand Digicert” using the domain name digicert-cdn[.]com , which is used as a command and control server for their GRIFFON implants .


The first of them is the well-known FIN7 , which specializes in attacking various companies to get access to financial data or PoS infrastructure .


The second one is CobaltGoblin Carbanak EmpireMonkey , which uses the same toolkit , techniques and similar infrastructure but targets only financial institutions and associated software/services providers .


We observe , with various level of confidence , that there are several interconnected groups using very similar toolkits and the same infrastructure to conduct their cyberattacks .


The last piece is the newly discovered CopyPaste group , who targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center .


At the end of 2018 , the cluster started to use not only CobaltStrike but also Powershell Empire in order to gain a foothold on the victims’ networks .


FIN7 thus continues to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework .


MuddyWater is widely regarded as a long-lived APT group in the Middle East .


From February to April 2019 , MuddyWater launched a series of spear-phishing attacks against governments , educational institutions , financial , telecommunications and defense companies in Turkey , Iran , Afghanistan , Iraq , Tajikistan and Azerbaijan .


FIN7 thus continue to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework .


We also unearthed and detailed our other findings on MuddyWater , such as its connection to four Android malware variants and its use of false flag techniques , among others , in our report New MuddyWater Activities Uncovered: Threat Actors Used Multi-Stage Backdoors , False Flags , Android Malware , and More .


Instead , the campaign used compromised legitimate accounts to trick victims into installing malware .


Notably , the group’s use of email as infection vector seems to yield success for their campaigns .


We also observed MuddyWater’s use of multiple open source post-exploitation tools , which they deployed after successfully compromising a target .


The attacker also connected to the compromised servers from IP addresses that were linked to dynamic domain names used as C&Cs by the delivered payloads .


The main payload is usually Imminent Monitor RAT; however , at the beginning of 2018 , we also observed the use of LuminosityLink RAT , NetWire RAT , and NjRAT .


In a case in June 2019 , we also noticed Warzone RAT being used .


Xpert RAT reportedly first appeared in 2011 .


The first version of Proyecto RAT” was published at the end of 2010 .


But with the West African gang we’ve named Scattered Canary , we have a deeper look at how business email compromise is connected to the rest of the cybercrime .


In a recent report , the FBI’s Internet Crime Complaint Center (IC3) reported that more than 20 , 000 businesses lost nearly $1.3 billion to BEC attacks in 2018 .


This investigation by the Agari Cyber Intelligence Division into the cybercriminal group we’ve named Scattered Canary offers unprecedented visibility into eleven years of fraud and criminal activities , and the growth of a 419 startup into a fully operational BEC business .


While this criminal organization’s activities now center around BEC , and extend to romance scams , credit card fraud , check fraud , fake job listings , credential harvesting , tax schemes , and more , these actors came from much humbler beginnings , starting with basic Craigslist scams in 2008 .


On November 29 , 2018 , Scattered Canary sent an attack email to Agari CFO Raymond Lim , enquiring as to his availability to send out a domestic wire transfer .


Many feel that they have a home team advantage living in Nigeria , where they are free to pay off law enforcement to look the other way .


Scattered Canary’s fraudulent history can be traced as far back as October 2008 , when the group first arrived on the cybercriminal circuit .


By March 2016 , one of Scattered Canary’s members had built enough trust with a romance victim—who we’ll call Jane—that she became a frequent source of new mule accounts for the group .


Alpha’s early role was fairly simple: engage with individuals , who he chose based on the goods they were selling , and then provide personal shipping addresses back to Omega .


By all accounts , late 2015 was the beginning of BEC for Scattered Canary .


The first type of attack Scattered Canary pivoted to was credential phishing .


Between July 2015 and February 2016 , Scattered Canary’s primary focus seemed to be mass harvesting general credentials using a Google Docs phishing page .


In the first few months of their credential phishing ventures , Scattered Canary’s sights were mostly set on Asian targets—Malaysia and Japan , in particular .


In November 2015 , the group started to focus on North American users , mostly in the United States .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills. In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks .


For over eighteen months from March 2017 until November 2018 , Scattered Canary’s frequent enterprise-focused credential phishing campaigns almost exclusively targeted businesses in the United States and Canada .


In July 2018 , following a trend we have observed across the entire BEC threat landscape , Scattered Canary changed their preferred cash out mechanism from wire transfers to gift cards .


Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials .


Using personal information obtained from various sources , Scattered Canary started perpetrating fraud against US federal and state government agencies .


In total , 35 actors have been tied to Scattered Canary’s operations since the group emerged in 2008 .


Just as with romance scams , actors make use of scripts and templates they can copy-and-paste without having to create something on their own .


When it comes to engaging targets , Scattered Canary frequently maximized efficiencies through the use of scripts , or as some members of the group call them , formats.” These formats are templated text documents that can contain several layers of phishing messages to send to potential victims .


Recently , we unveiled the existence of a UEFI rootkit , called LoJax , which we attribute to the Sednit group .


If Scattered Canary can be seen as a microcosm for the rapidly evolving organizations behind today’s most pernicious email scams , this report demonstrates that a much more holistic approach—one based on threat actor identity rather than type of fraudulent activity—is required to detect email fraud and protect organizations .


This is a first for an APT group , and shows Sednit has access to very sophisticated tools to conduct its espionage operations .


Three years ago , the Sednit group unleashed new components targeting victims in various countries in the Middle East and Central Asia .


In the past , Sednit used a similar technique for credential phishing .


At the end of August 2018 , the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components .


As we explained in our most recent blogpost about Zebrocy , the configuration of the backdoor is stored in in the resource section and is split into four different hex-encoded , encrypted blobs .


The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability .


It used GitHub and Slack as tools for communication between the malware and its controller .


On July 9 , we discovered a new version of SLUB delivered via another unique watering hole website .


This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April .


Since we published out last report on SLUB , the backdoor has been updated and several improvements were implemented .


The SLUB malware was delivered through watering hole websites that were injected with exploits for CVE-2018-8174 or CVE-2019-0752 .


During this attack , we found that the SLUB malware used two Slack teams sales-yww9809” and marketing-pwx7789 .


SWEED remains consistent across most of their campaigns in their use of spear-phishing emails with malicious attachments .


In April 2018 , SWEED began making use of a previously disclosed Office exploit .


In May 2018 , campaigns being conducted by SWEED began leveraging another vulnerability in Microsoft Office: CVE-2017-11882 , a remote code execution bug in Microsoft Office that is commonly observed being leveraged in malicious documents used in commodity malware distribution .


We found them targeting countries in the Middle East such as United Arab Emirates and Saudi Arabia , as well as other countries such as India , Japan , Argentina , the Philippines , and South Korea .


Similar to previous campaigns , the JAR was directly attached to emails and used file names such as Order_2018.jar .


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework .


TA505 is also using FlowerPippi (Backdoor.Win32.FLOWERPIPPI.A) , a new backdoor that we found them using in their campaigns against targets in Japan , India , and Argentina .


TA505 targeted Middle Eastern countries in a June 11 campaign that delivered more than 90% of the total spam emails to the UAE , Saudi Arabia , and Morroco .


It fetches the same FlawedAmmyy downloader .msi file , then downloads the FlawedAmmyy payload .


TA505 used Wizard (.wiz) files in this campaign , with FlawedAmmyy RAT as the final payload .


On June 14 , we saw TA505’s campaign still targeting UAE with similar tactics and techniques , but this time , some of the spam emails were delivered via the Amadey botnet .


It later delivered an information stealer named EmailStealer , ” which stolesimple mail transfer protocol (SMTP) credentials and email addresses in the victim’s machine .


On June 18 , the majority of the campaign’s spam emails were sent with the subject , Your RAKBANK Tax Invoice / Tax Credit Note” or Confirmation .


This campaign used the abovementioned .html file , malicious Excel/Word document VBA macro , the FlawedAmmyy payload , and Amadey .


On June 24 , we found another campaign targeting Lebanon with the ServHelper malware .


On June 17 , we observed the campaign’s spam emails delivering malware-embedded Excel files directly as an attachment .


On June 20 , we spotted the campaign’s spam emails delivering .doc and .xls files .


Nonetheless , these spam emails were not delivered to the UAE or Arabic-speaking users , but to banks in Asian countries such as India , Indonesia , and the Philippines .


After our analysis , we found that Proofpoint reported this malware as AndroMut as well .


In the campaign that targeted Japan , Philippines , and Argentina on June 20 , we found what seems to be a new , undisclosed malware , which we named Gelup .


Another new malware we found that TA505 is using in their campaigns last June 20 against targets in Japan , the Philippines , and Argentina is FlowerPippi .


The malicious email contains a highly suspicious sample which triggered the ZLAB team to investigate its capabilities and its possible attribution , discovering a potential expansion of the TA505 operation .


The attack , as stated by CyberInt , leveraged a command and control server located in Germany related to the TA505 actor: a very active group involved in cyber-criminal operation all around the world , threatening a wide range of high profile companies , active since 2014 .


The comparison of the infection chains reveals in both cases TA505 used a couple of SFX stages to deploy the RMS” software: a legitimate remote administration tool produced by the Russian company TektonIT .


The TA505 group is one of the most active threat groups operating since 2014 , it has traditionally targeted Banking and Retail industries , as we recently documented during the analysis of the Stealthy Email Stealer” part of their arsenal .


Also , some code pieces are directly re-used in the analyzed campaigns , such as the i.cmd” and exit.exe” files , and , at the same time , some new components have been introduced , for instance the rtegre.exe” and the veter1605_MAPS_10cr0.exe” file .


In 2018 , Kaspersky Labs published a report that analyzed a Turla PowerShell loader that was based on the open-source project Posh-SecMod .


Turla is believed to have been operating since at least 2008 , when it successfully breached the US military .


This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products .


However , it is likely the same scripts are used more globally against many traditional Turla targets in Western Europe and the Middle East .


In some samples deployed since March 2019 , Turla developers modified their PowerShell scripts in order to bypass the Antimalware Scan Interface (AMSI) .


Based on our research , SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans .


It is interesting to note that Turla operators used the free email provider GMX again , as in the Outlook Backdoor and in LightNeuron .


This new research confirms our forecast and shows that the Turla group does not hesitate to use open-source pen-testing frameworks to conduct intrusion .


Neptun is installed on Microsoft Exchange servers and is designed to passively listen for commands from the attackers .


One attack during this campaign involved the use of infrastructure belonging to another espionage group known as Crambus aka OilRig , APT34 .


Waterbug has been using Meterpreter since at least early 2018 and , in this campaign , used a modified version of Meterpreter , which was encoded and given a .wav extension in order to disguise its true purpose .


In all likelihood , Waterbug’s use of Crambus infrastructure appears to have been a hostile takeover .


One of the most interesting things to occur during one of Waterbug’s recent campaigns was that during an attack against one target in the Middle East , Waterbug appeared to hijack infrastructure from the Crambus espionage group and used it to deliver malware on to the victim’s network .


These three recent Waterbug campaigns have seen the group compromise governments and international organizations across the globe in addition to targets in the IT and education sectors .


Curiously though , Waterbug also compromised other computers on the victim’s network using its own infrastructure .


Symantec believes that the variant of Mimikatz used in this attack is unique to Waterbug .


Aside from the attack involving Crambus infrastructure , this sample of Mimikatz has only been seen used in one other attack , against an education target in the UK in 2017 .


The first observed evidence of Waterbug activity came on January 11 , 2018 , when a Waterbug-linked tool (a task scheduler named msfgi.exe) was dropped on to a computer on the victim’s network .


In the case of the attack against the Middle Eastern target , Crambus was the first group to compromise the victim’s network , with the earliest evidence of activity dating to November 2017 .


Waterbug’s intrusions on the victim’s network continued for much of 2018 .


Symantec did not observe the initial access point and the close timeframe between Waterbug observed activity on the victim’s network and its observed use of Crambus infrastructure suggests that Waterbug may have used the Crambus infrastructure as an initial access point. It also reconfigures the Microsoft Sysinternals registry to prevent pop-ups when running the PsExec tool .


Waterbug also used an older version of PowerShell , likely to avoid logging .


In one of these campaigns , Waterbug used a USB stealer that scans removable storage devices to identify and collect files of interest .


The malware then uses WebDAV to upload the RAR archive to a Box account .


The DeepSight Managed Adversary and Threat Intelligence (MATI) team co-authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug (aka Turla) cyber espionage group , and methods of detecting and thwarting activities of this adversary .


The DeepSight MATI team authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug (aka Turla) cyber espionage group , and methods of detecting and thwarting activities of this adversary .


While reviewing a 2015 report⁵ of a Winnti intrusion at a Vietnamese gaming company , we identified a small cluster of Winnti⁶ samples designed specifically for Linux⁷ .


Following these reports , Chronicle researchers doubled down on efforts to try to unravel the various campaigns where Winnti was leveraged .


Distinct changes to Azazel by the Winnti developers include the addition of a function named ‘Decrypt2’ , which is used to decode an embedded configuration similar to the core implant .


Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits .


We will see more from Zebrocy into 2019 on government and military related organizations .


The PowerShell script will look at the architecture of the system to check which malicious DLL files should be downloaded .


In the same year , Silence conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans .


The FBI issued a rare bulletin admitting that a group named APT6 hacked into US government computer systems as far back as 2011 and for years stole sensitive data .


FireEye iSIGHT Intelligence believes that APT37 is aligned with the activity publicly reported as Scarcruft and Group123 .


Trend Micro attributes this activity to MuddyWater , an Iran-nexus actor that has been active since at least May 2017 .


FireEye assess that the actors employing this latest Flash zero-day are a suspected North Korean group we track as TEMP.Reaper .


FireEye has observed other suspected North Korean threat groups such as TEMP.Hermit employ wiper malware in disruptive attacks .


On Nov14 , 2017 , FireEye observed APT34 using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


Kaspersky reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 .


APT33 is the only group that Kaspersky has observed use the DROPSHOT dropper .


The cyber espionage group APT32 heavily obfuscates their backdoors and scripts , and Mandiant consultants observed APT32 implement additional command argument obfuscation in April 2017 .


In all Mandiant investigations to date where the CARBANAK backdoor has been discovered , the activity has been attributed to the FIN7 threat group .


Kaspersky released a similar report about the same group under the name Carbanak in February 2015 .


FireEye assesses that APT32 leverages a unique suite of fully-featured malware .


FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam’s manufacturing , consumer products , and hospitality sectors .


The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on these backdoor families based on Mandiant investigations of APT32 intrusions .


FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests .


In May and June 2017 , FireEye has associated this campaign with APT19 , a group that we assess is composed of freelancers , with some degree of sponsorship by the Chinese government .


APT10 is a Chinese cyber espionage group that FireEye has tracked since 2009 .


In addition to the spear phishes , FireEye ISIGHT Intelligence has observed APT10 accessing victims through global service providers .


FireEye’s visibility into the operations of APT28 – a group we believe the Russian government sponsors – has given us insight into some of the government’s targets , as well as its objectives and the activities designed to further them .


FireEye has tracked and profiled APT28 group through multiple investigations , endpoint and network detections , and continuous monitoring .


In April 2015 , FireEye uncovered the malicious efforts of APT30 , a suspected China-based threat group .


FireEye iSIGHT Intelligence has been tracking a pair of cybercriminals that we refer to as the Vendetta Brothers .


Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack .


McAfee concludes that some groups—and especially the Poetry Group —have shifted tactics to use Citadel in ways other than what it was originally intended for .


McAfee Advanced Threat research determines with confidence that Lazarus is the threat group behind this attack for the following reasons:Contacts an IP address / domain that was used to host a malicious document from a Lazarus previous campaign in 2017 .


In November 2017 , Talos observed the Group123 , which included a new version of ROKRAT being used in the latest wave of attacks .


In addition to TALOS investigation on KONNI , on July 18 2017 , BitDefender released a whitepaper on DarkHotel .


According to security 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor .


ESET has also reported PowerShell scripts being used by Turla to provide direct , in-memory loading and execution of malware .


Additionally Kaspersky identified a new backdoor that we attribute with medium confidence to Turla .


Researchers at Symantec suspect that Turla used the hijacked network to attack a Middle Eastern government .


Symantec researchers have uncovered evidence that the Waterbug APT group has conducted a hostile takeover of an attack platform .


Researchers at the Microstep Intelligence Bureau have published a report on targeted attacks on the Ukrainian government that they attribute to the Gamaredon threat actor .


Kaspersky found an active campaign by a Chinese APT group we call SixLittleMonkeys that uses a new version of the Microcin Trojan and a RAT that we call HawkEye as a last stager .


Trend Micro has previously reported the use of this malware in targeted attacks by the BlackTech group , primarily focused on cyber-espionage in Asia .


LuckyMouse activity detected by Palo Alto involved the attackers installing web shells on SharePoint servers to compromise government organizations in the Middle East .


Talos published its analysis of the BlackWater campaign , related to MuddyWater group .


Trend Micro also reported MuddyWater’s use of a new multi-stage PowerShell-based backdoor called POWERSTATS v3 .


Regarding other groups , Kaspersky discovered new activity related to ZooPark , a cyber-espionage threat actor that has focused mainly on stealing data from Android devices .


Recorded Future published an analysis of the infrastructure built by APT33 (aka Elfin) to target Saudi organizations .


Early in Q2 , Kaspersky identified an interesting Lazarus attack targeting a mobile gaming company in South Korea that we believe was aimed at stealing application source code .


In a recent campaign , Kaspersky observed ScarCruft using a multi-stage binary to infect several victims and ultimately install a final payload known as ROKRAT – a cloud service-based backdoor .


ESET recently analyzed a new Mac OS sample from the OceanLotus group that had been uploaded to VirusTotal .


The threat actor behind the campaign , which Kaspersky believes to be the PLATINUM APT group , uses an elaborate , previously unseen , steganographic technique to conceal communication .


FireEye defined APT40 as the Chinese state-sponsored threat actor previously reported as TEMP.Periscope , Leviathan and TEMP.Jumper .


In January , Kaspersky identified new activity by the Transparent Tribe APT group aka PROJECTM and MYTHIC LEOPARD , a threat actor with interests aligned with Pakistan that has shown a persistent focus on Indian military targets .


OceanLotus was another actor active during this period , using a new downloader called KerrDown , as reported by Palo Alto .


ESET recently uncovered a new addition to OceanLotus’s toolset targeting Mac OS .


In mid-2018 , Kaspersky's report on Operation AppleJeus” highlighted the focus of the Lazarus threat actor on cryptocurrency exchanges .


Kaspersky also observed some activity from Gaza Team and MuddyWater .


Kaspersky wrote about LuckyMouse targeting national data centers in June .


Kaspersky also discovered that LuckyMouse unleashed a new wave of activity targeting Asian governmental organizations just around the time they had gathered for a summit in China .


Kaspersky have observed similar activity in the past from groups such as Oilrig and Stonedrill , which leads us to believe the new attacks could be connected , though for now that connection is only assessed as low confidence .


In August 2019 , FireEye released the Double Dragon” report on our newest graduated threat group , APT41 .


Today , FireEye Intelligence is releasing a comprehensive report detailing APT41 , a prolific Chinese cyber threat group that carries out state-sponsored espionage activity in parallel with financially motivated operations .


Group-IB experts continuously monitor the Silence’ activities .


Group-IB has uncovered a hacker group , MoneyTaker , attacking banks in the USA and Russia .


Group-IB reveals the unknown details of attacks from one of the most notorious APT groups , Lazarus .


Finally , Kaspersky produced a summary report on Sofacy’s summertime activity .


Kaspersky were also able to produce two reports on Korean speaking actors , specifically involving Scarcruft and Bluenoroff .


Analysis of the payload allowed us to confidently link this attack to an actor Kaspersky track as BlackOasis .


Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day .


It contains a Word document in plaintext ( written to Bienvenue_a_Sahaja_Yoga_Toulouse.doc ) , along with an executable ( Update.exe ) and DLL ( McUpdate.dll ) .


We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages .


Additionally , these decoy documents are hosted on legitimate websites including a government website belonging to the Cambodia Government and in at least once case , Facebook .


However , the unique malware variant , BlackEnergy 3 , reemerged in Ukraine early in 2015 , where we had first found Sandworm Team .


The initial indicator of the attack was a malicious web shell that was detected on an IIS server , coming out of the w3wp.exe process .


We have previously detected groups we suspect are affiliated with the North Korean government compromising electric utilities in South Korea , but these compromises did not lead to a disruption of the power supply .


Instead , sensitive KHNP documents were leaked by the actors as part of an effort to exaggerate the access they had and embarrass the South Korean Government , a technique we assess North Korea would turn to again in order to instill fear and/or meet domestic propaganda aims .


North Korea linked hackers are among the most prolific nation-state threats , targeting not only the U.S. and South Korea but the global financial system and nations worldwide .


The malware may inject itself into browser processes and explorer.exe .


In the last few weeks , FormBook was seen downloading other malware families such as NanoCore .


The vulnerability is bypassing most mitigations; however , as noted above , FireEye email and network products detect the malicious documents .


Through the exploitation of the HTA handler vulnerability described in CVE-2017-1099 , the observed RTF attachments download .


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 .


In their current campaign , APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros .


APT32 actors continue to deliver the malicious attachments via spear-phishing emails .


APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel files to deliver their initial exploits .


Most of these data-stealing capabilities were present in the oldest variants of CARBANAK that we have seen and some were added over time .


February saw three particularly interesting publications on the topic of macOS malware: a Trojan Cocoa application that sends system information including keychain data back to the attacker , a macOS version of APT28’s Xagent malware , and a new Trojan ransomware .


As early as March 4 , 2017 , malicious documents exploiting CVE-2017-0199 were used to deliver the LATENTBOT malware .


The first , st07383.en17.docx , continues by utilizing 32 or 64 bit versions of CVE-2017-0001 to escalate privileges before executing a final JavaScript payload containing a malware implant known as SHIRIME .


This vulnerability was found in a document named Trump's_Attack_on_Syria_English.docx” .


To install and register the malicious shim database on a system , FIN7 used a custom Base64 encoded PowerShell script , which ran the sdbinst.exe” utility to register a custom shim database file containing a patch onto a system .


During the investigations , Mandiant observed that FIN7 used a custom shim database to patch both the 32-bit and 64-bit versions of services.exe” with their CARBANAK payload .


We have not yet identified FIN7’s ultimate goal in this campaign , as we have either blocked the delivery of the malicious emails or our FaaS team detected and contained the attack early enough in the lifecycle before we observed any data targeting or theft .


Figure 1 shows a sample phishing email used by HawkEye operators in this latest campaign .


Many groups leverage the regsvr32.exe application whitelisting bypass , including APT19 in their 2017 campaign against law firms .


The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits , including the EternalBlue exploit used in the WannaCry attack from May 2017 .


The malware appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD (via Bitcoin) to decrypt the data .


The malware then builds two DLLs in memory – they are 32 and 64-bit DLLs that have identical functionality .


The malware continues by creating a service named mssecsvc2.0 with a binary path pointing to the running module with the arguments -m security .


The malware then writes the R resource data to the file C:\WINDOWS\tasksche.exe .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings .


Attaching with IDA Pro via WinDbg as in Figure 11 shows that the program counter points to the infinite loop written in memory allocated by flare-qdb .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations .


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server .


The attachment in these emails is a weaponized Microsoft Office document containing a malicious macro that – when enabled – leads to the download of Hancitor .


After the executable is executed , it downloads Pony and Vawtrak malware variants to steal data .


Upon execution , it will communicate with an attacker-controller website to download a variant of the Pony malware , pm.dll” along with a standard Vawtrak trojan .


In this blog , FireEye Labs dissects this new ATM malware that we have dubbed RIPPER (due to the project name ATMRIPPER” identified in the sample) and documents indicators that strongly suggest this piece of malware is the one used to steal from the ATMs at banks in Thailand .


RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism .


RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself .


This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices .


From our trend analysis seen in Figure 3 , Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August .


Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before .


FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform .


The samples we identified target the ATM vendor Diebold .


This blog covers the changes , improvements , and Indicators of Compromise (IOC) of Ploutus-D in order to help financial organizations identify and defend against this threat .


Ploutus-D also allows the attackers to enter the amount to withdraw (billUnits – 4 digits) and the number of cycles (billCount – 2 digits) to repeat the dispensing operation (see Figure 10) .


Ploutus-D will load KXCashDispenserLib” library implemented by Kalignite Platform (K3A.Platform.dll) to interact with the XFS Manager and control the Dispenser (see Figure 13) .


Since Ploutus-D interacts with the Kalignite Platform , only minor modifications to the Ploutus-D code may be required to target different ATM vendors worldwide .


The threat actors used two publicly available techniques , an AppLocker whitelisting bypass and a script to inject shellcode into the userinit.exe process .


The regsvr32.exe executable can be used to download a Windows Script Component file (SCT file) by passing the URL of the SCT file as an argument .


We observed implementation of this bypass in the macro code to invoke regsvr32.exe , along with a URL passed to it which was hosting a malicious SCT file .


There was code to download a decoy document from the Internet and open it in a second winword.exe process using the Start-Process cmdlet .


Ordnance will be able to immediately generate shellcode after users provide the IP and Port that the shellcode should connect to or listen on .


DarkPulsar is a very interesting administrative module for controlling a passive backdoor named ' sipauth32.tsp ' that provides remote control , belonging to this category .


One of them – ipv4.dll – has been placed by the APT with what is , in fact , a downloader for other malicious components .


Written in pure C language , Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions , and carries out integrity control of various system components to avoid debugging and security detection .


First observed in mid-2014 , this malware shared code with the Bugat ( aka Feodo ) banking Trojan .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload .


Despite being an older vulnerability , many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word .


Whitefly first infects its victims using a dropper in the form of a malicious.exe or .dll file that is disguised as a document or image .


CraP2P has frequently been used to distribute other malware such as Locky and Dridex , but also supported large scale spam campaigns for dating advertisement and pump-and-dump scams after the demise of Kelihos .


Once the LOWBALL malware calls back to the Dropbox account , the admin@338 will create a file called upload.bat which contains commands to be executed on the compromised computer .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


More recently , in May 2017 , APT33 appeared to target a Saudi organization and a South Korean business conglomerate using a malicious file that attempted to entice victims with job vacancies for a Saudi Arabian petrochemical company .


More recently , in May 2017 , APT33 appeared to target organizations in Saudi and South Korea using a malicious file that attempted to entice victims with job vacancies .


In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets .


In fact , REDBALDKNIGHT has been zeroing in on Japanese organizations as early as 2008 — at least based on the file properties of the decoy documents they've been sending to their targets .


Carbanak is a backdoor used by the attackers to compromise the victim .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


The Korean-language Word document manual.doc appeared in Vietnam on January 17 , with the original author name of Honeybee .


This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON , which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


For example , DeltaAlfa specifies a DDoS bot family identified as Alfa .


This alert 's IOC files provide HIDDEN COBRA indicators related to FALLCHILL .


The McAfee Advanced Threat Research team discovered a previously unknown data-gathering implant that surfaced in mid-February 2018 .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


This malware report contains analysis of one 32-bit Windows executable file , identified as a Remote Access Trojan ( RAT ) .


In one of the samples received for analysis , the US-CERT Code Analysis Team observed botnet controller functionality .


Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library ( .dll )


Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs .


WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data .


Some of the documents exploited CVE-2017-0199 to deliver the payload .


The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period .


The download name was " Zawgyi_Keyboard_L.zip " , and it dropped a " setup.exe " that contained several backdoor components , including an Elise " wincex.dll " ( a42c966e26f3577534d03248551232f3 , detected as Backdoor.Win32.Agent.delp ) .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys .


The Magic Hound campaign was also discovered using a custom dropper tool , which we have named MagicHound.DropIt .


For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer .


During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros .


The HTA files contained job descriptions and links to job postings on popular employment websites .


These emails included recruitment-themed lures and links to malicious HTML application ( HTA ) files .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints .


Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document .