He is responsible for developing tools for conducting attacks and is also able to modify complex exploits and third party software .


wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 .


As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC .


The RAT , however , had a multitude of functionalities (as listed in the table below) such as to download and execute , compress , encrypt , upload , search directories , etc .


Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor .


DoublePulsar is then used to inject a secondary payload , which runs in memory only .


The detection evasion techniques we observed in the Okrum malware include embedding the malicious payload within a legitimate PNG image , employing several anti-emulation and anti-sandbox tricks , as well as making frequent changes in implementation .


The threat actors behind the Sea Turtle campaign were successful in compromising entities by manipulating and falsifying DNS records at various levels in the domain name space .


The diagram below illustrates how we believe the actors behind the Sea Turtle campaign used DNS hijacking to achieve their end goals .


If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file .


The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell's 1984 , but Weeping Angel , developed by the CIA's Embedded Devices Branch (EDB) , which infests smart TVs , transforming them into covert microphones , is surely its most emblematic realization .


Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies .


The Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant .


UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques .


'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS (JukeBox) and Linux (DanceFloor) .


This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 .


The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process .


Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials .


This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more .


In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document .


The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” .


The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware .


The malware starts communicating with the C&C server by sending basic information about the infected machine .


The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests .


After app installation , whenever SWAnalytics senses victims opening up infected applications or rebooting their phones , it silently uploads their entire contacts list to Hangzhou Shun Wang Technologies controlled servers .


This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge .


It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in .


With default settings , SWAnalytics will scan through an Android device’s external storage , looking for directory tencent/MobileQQ/WebViewCheck” .


By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device .


To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control .


Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue .


The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine .


The tool does all that a typical Trojan needs to accomplish: upload , download and execute files , fingerprint target systems .


The PowerShell version of the Trojan also has the ability to get screenshots .


Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations .


BalkanRAT enables the attacker to remotely control the compromised computer via a graphical interface , i.e , manually; BalkanDoor enables them to remotely control the compromised computer via a command line , i.e , possibly en masse .


The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience .


China Chopper is a tool that allows attackers to remotely control the target system that needs to be running a web server application before it can be targeted by the tool .


China Chopper contains a remote shell (Virtual Terminal) function that has a first suggested command of netstat an|find ESTABLISHED .


The tool investigates the Local Security Authority Subsystem memory space in order to find , decrypt and display retrieved passwords .


Additional capabilities of the More_eggs malware include the download and execution of files and scripts and running commands using cmd.exe .


Mimikatz is a post-exploitation tool that allows attackers to extract credentials from volatile memory .


The GoogleUpdate.exe component is responsible for communicating with the remote C&C server .


This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage .


The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format .


AdroMut downloads the malware ServHelper and FlawedAmmy RAT used by the SectorJ04 group from the attacker server and simultaneously performs the functions of a backdoor .


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer .


The exploit installs Silence’s loader , designed to download backdoors and other malicious programs .


As we described in Silence: Moving into the darkside report , Silence has experience with theft using compromised card processing systems .


The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine .


Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server .


PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more .


A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests , TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution .


PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file .


The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript , which allows the cybercriminals to understand the context of the infected workstation .


The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method .


In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger .


Neptun is installed on Microsoft Exchange servers and is designed to passively listen for commands from the attackers .


The usefulness of flare-qdb can be seen in cases such as loops dealing with strings .


We have also observed them using virtual private network services that use IPs based in numerous countries to ensure anonymity and obfuscate criminal operations .


Once downloaded and executed , it drops an intermediate payload that further downloads a Pony DLL and Vawtrak executable , which perform data theft and connect to a command and control (C2) server .


Upon execution , it will communicate with an attacker-controller website to download a variant of the Pony malware , pm.dll” along with a standard Vawtrak trojan .


RIPPER interacts with the ATM by inserting a specially manufactured ATM card with an EMV chip that serves as the authentication mechanism .


RIPPER will examine the contents of directories associated with the targeted ATM vendors and will replace legitimate executables with itself .


This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices .


From our trend analysis seen in Figure 3 , Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August .


Discovered for the first time in Mexico back in 2013 , Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message , a technique that had never been seen before .


FireEye Labs recently identified a previously unobserved version of Ploutus , dubbed Ploutus-D , that interacts with KAL’s Kalignite multivendor ATM platform .


Written in pure C language , Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions , and carries out integrity control of various system components to avoid debugging and security detection .


WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data .


Some of the documents exploited CVE-2017-0199 to deliver the payload .


To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys .


For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer .


The HTA files contained job descriptions and links to job postings on popular employment websites .


ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints .


We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded .


Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload .


Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system .


The vulnerability exists in the old Equation Editor ( EQNEDT32.EXE ) , a component of Microsoft Office that is used to insert and evaluate mathematical formulas .


The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information .


Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection .


MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com.mxi.videoplay ) .


Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier .


Research presented in this report shows that the PUTTER PANDA operators are likely members of the 12th Bureau , 3rd General Staff Department ( GSD ) of the People 's Liberation Army ( PLA ) , operating from the unit 's headquarters in Shanghai with MUCD 61486 .


That this group is mostly targeting businesses is apparent from the processes they are looking for on a compromised system .


They are both targeting businesses using accounting software , are fingerprinting systems of interest similarly , are looking for smart card readers , and finally , they deploy an array of malicious tools to spy on their victims .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , industrial control systems and SCADA , government , and media for espionage and destructive purposes , since at least 2011 .


This adversary has been identified leveraging custom-developed plugins for versions 2 and 3 of the commodity malware Black Energy to target entities associated with energy , government , and media for espionage and destructive purposes , since at least 2011 .


If you haven't heard about it for some reason , I would recommend to read this detailed report by Group-IB , as this APT attacks not only Russian banks , but also banks in more than 25 countries .


The credentials they use to register their malware infrastructure are easily associated with their public social media accounts on Google® , Facebook® , MySpace® , Instagram® , and various dating and blogging sites .


We have previously detected groups we suspect are affiliated with the North Korean government compromising electric utilities in South Korea , but these compromises did not lead to a disruption of the power supply .


North Korea linked hackers are among the most prolific nation-state threats , targeting not only the U.S. and South Korea but the global financial system and nations worldwide .


CapabilitiesFormBook is a data stealer , but not a full-fledged banker .


Furthermore , there are indications that APT32 actors are targeting peripheral network security and technology infrastructure corporations .


The targeting of private sector interests by APT32 is notable and FireEye believes the actor poses significant risk to companies doing business in , or preparing to invest in , the country .


While the motivation for each APT32 private sector compromise varied – and in some cases was unknown – the unauthorized access could serve as a platform for law enforcement , intellectual property theft , or anticorruption measures that could ultimately erode the competitive advantage of targeted organizations .


The use of the CARBANAK malware in FIN7 operations also provides limited evidence that these campaigns are linked to previously observed CARBANAK operations leading to fraudulent banking transactions , ATM compromise , and other monetization schemes .


For our M-Trends 2017 report , we took a look at the incidents we investigated last year and provided a global and regional (the Americas , APAC and EMEA) analysis focused on attack trends , and defensive and emerging trends .


In April 2015 , we uncovered the malicious efforts of APT30 , a suspected China-based threat group that has exploited the networks of governments and organizations across the region , targeting highly sensitive political , economic and military information .


Yet the document cache published April 8 provides evidence that the NSA had once launched a series of successful computer-based intrusions against multiple high-profile foreign targets , including the Office of the President of Iran and the Russian Federal Nuclear Center .


Emotet activity in 2019 included several high-volume campaigns that collectively distributed tens of millions of messages primarily targeting the manufacturing and healthcare industries .


Originally targeting Western European banks , Emotet has since been developed into a robust global botnet that is comprised of several modules , each of which equips Emotet with different spamming , email logging , information stealing , bank fraud , downloading , and DDoS , among others .


Originally targeting Western European banks , it has since been developed into a robust global botnet that is comprised of several modules , each of which equips Emotet with different spamming , email logging , information stealing , bank fraud , downloading , and DDoS , among others .


Transparent Tribe has been active for several years and conducting suspected intelligence collection operations against South Asian political and military targets .


In previous incidents involving this threat actor , we observed them using malicious documents hosted on websites about the Indian Army , instead of sending these documents directly as an email attachment .


To date , Whitefly has attacked organizations in the healthcare , media , telecommunications , and engineering sectors .


Between May 2017 and December 2018 , a multi-purpose command tool that has been used by Whitefly was also used in attacks against defense , telecoms , and energy targets in Southeast Asia and Russia .


The malicious documents seen in recent activity refer to a number of topics , including recent military promotions within the Pakistan Army , information related to the Pakistan Atomic Energy Commission , as well as Pakistan 's Ministry of the Interior .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers .


APT41 has targeted payment services specializing in handling in-game transactions and real money transfer (RMT) purchases .


The group behind these attacks has stolen gigabytes of confidential documents , mostly from military organizations .


They seem to have specialized knowledge about military operations , as they are focused on stealing specific files such as those that describe navigation routes .


Early in Q2 , Kaspersky identified an interesting Lazarus attack targeting a mobile gaming company in South Korea that we believe was aimed at stealing application source code .


We believe that these industries have also been targeted as part of a larger supply-chain attack in order for Orangeworm to get access to their intended victims related to healthcare .


Orangeworm 's secondary targets include Manufacturing , Information Technology , Agriculture , and Logistics .


While these industries may appear to be unrelated , we found them to have multiple links to healthcare , such as large manufacturers that produce medical imaging devices sold directly into healthcare firms , IT organizations that provide support services to medical clinics , and logistical organizations that deliver healthcare products .


Patchwork targets were chosen worldwide with a focus on personnel working on military and political assignments , and specifically those working on issues relating to Southeast Asia and the South China Sea .


Patchwork ( also known as Dropping Elephant ) is a cyberespionage group whose targets included diplomatic and government agencies as well as businesses .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools .


In this case , a small group reusing exploit code , some powershell-based malware and mostly social engineering has been able to steal sensitive documents and data from victims since at least November 2015 .


PittyTiger leverages social engineering to deliver spearphishing emails , in a variety of languages including English , French and Chinese , and email phishing pages to their targets .


The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


This particular unit is believed to hack into victim companies throughout the world in order to steal corporate trade secrets , primarily relating to the satellite , aerospace and communication industries .


PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries .


In 2015 and 2016 , Dridex was one of the most prolific eCrime banking trojans on the market and , since 2014 , those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits .


In August 2017 , a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K. 's National Health Service ( NHS ) , with a high ransom demand of 53 BTC ( approximately $200,000 USD ) .


Known for hijacking prominent social media accounts , the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network .


Through research , 360 Helios Team has found that , since 2007 , the Poison Ivy Group has carried out 11 years of cyber espionage campaigns against Chinese key units and departments , such as national defense , government , science and technology , education and maritime agencies .


Dragos has reported that XENOTIME , the APT group behind the TRISIS (aka TRITON and HatMan) attack on a Saudi Arabian petro-chemical facility in 2017 , has expanded its focus beyond the oil and gas industries .


Known targets of this group have been involved in the maritime industry , as well as engineering-focused entities , and include research institutes , academic organizations , and private firms in the United States .


Historically , the majority of their targeting has been focused on the South Korean government , military , and defense industrial base .


TEMP.Periscope BackgroundActive since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities .


These malware families have a rich history of being used in many targeted attacks against government and private organizations .


In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage .


The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China .


The admin@338 linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


The group targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


The agroup targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


The admin@338 , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


FireEye said it has tracked admin@338 's activity since 2013 and the group has largely targeted organizations involved in financial , economic , and trade policy .


They have largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries .


TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and political , financial , pharmaceutical and energy sectors that could benefit the Chinese economy .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy .


FANCY BEAR ( also known as Sofacy or APT 28 ) is a separate Russian-based threat actor , which has been active since mid 2000s , and has been responsible for targeted intrusion campaigns against the Aerospace , Defense , Energy , Government and Media sectors .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government .


Since at least 2014 , FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam 's manufacturing , consumer products , and hospitality sectors .


APT33 has targeted organizations – spanning multiple industries – headquartered in the United States , Saudi Arabia and South Korea .


During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals .


The generalized targeting of organizations involved in energy and petrochemicals mirrors previously observed targeting by other suspected Iranian threat groups , indicating a common interest in the sectors across Iranian actors .


APT33 's targeting of organizations involved in aerospace and energy most closely aligns with nation-state interests , implying that the threat actor is most likely government sponsored .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


Specifically , the targeting of organizations in the aerospace and energy sectors indicates that the APT33 is likely in search of strategic intelligence capable of benefitting a government or military sponsor .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military aviation capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


In 2017 , APT37 expanded its targeting beyond the Korean peninsula to include Japan , Vietnam and the Middle East , and to a wider range of industry verticals , including chemicals , electronics , manufacturing , aerospace , automotive and healthcare entities .


We surmise that the targeting of banks , media , and government agencies is conducted in support of APT38 's primary mission .


The APT38 targeted news outlets known for their business and financial sector reporting , probably in support of efforts to identify and compromise additional financial institutions .


APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry .


APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japanese organizations such as government agencies ( including defense ) as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers .


This report describes the details and type of operations carried out by Carbanak that focuses on financial industry , such as payment providers , retail industry and PR companies .


From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space .


Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems .


The Charming Kitten' focus appears to be individuals of interest to Iran in the fields of academic research .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team .


Since 2013 , the Cobalt have attempted to attack banks and financial institutions using pieces of malware they designed .


Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt .


Gallmaker 's activity appears to be highly targeted , with its victims all related to government , military , or defense sectors .


There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors .


traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


The Ke3chang have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , chemicals , manufacturing , mining sectors .


The attackers have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


APT15 was targeting information related to UK government departments and military technology .


APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more .


cyber actors of the North Korean to target the media , aerospace , financial , and critical infrastructure sectors in the United States and globally .


According to trusted third-party reporting , HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace , telecommunications , and finance industries .


McAfee Advanced Threat Research analysts have uncovered a global data reconnaissance campaign assaulting a wide number of industries including critical infrastructure , entertainment , finance , health care , and telecommunications .


Since at least 2013 , HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government , financial , automotive , and media industries .


Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others .


Known targets of the Leviathan have been involved in the maritime industry , and research institutes , academic organizations , and private firms in the United States .


Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities .


Within a year APT40 was observed masquerading as a UUV manufacturer , and targeting universities engaged in naval research .


APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia .


Lotus Blossom targeted the government , higher education , and high tech companies .


The Lotus Blossom largely targets military or government , with some cases of higher education and high tech companies .


Organizations in the government , energy , and technology sectors have been targeted by Magic Hound , specifically organizations based in or doing business in Saudi Arabia .


Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents .


Evidence also suggests that APT32 has targeted network security and technology infrastructure corporations with connections to foreign investors .


Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations foreign governments .


Additionally , there is evidence to suggest APT33 targeted Saudi Arabian and Western organizations that provide training , maintenance and support for Saudi Arabia 's military and commercial fleets .


The OilRig group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries .


APT35 typically targets military , diplomatic and government , media , energy , engineering , business services and telecommunications sectors in U.S. and the Middle East .


APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors .


Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations .


Since at least 2013 , the Iranian threat group FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations .


Ultimately , APT35 had used access to hundreds of mailboxes to read email communications and steal data related to Middle East organizations , which later became victims of destructive attacks .


Further analysis revealed a well-established collection of fake social media profiles that appear intended to build trust and rapport with potential victims .


COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites .


The Magic Hound has repeatedly used social media to identify and interact with employees at targeted organizations and then used weaponized Excel documents .


We identified decoy files which indicate these attacks began with spear phishing messages but have not observed the actual messages .


This group has used a large array of infection vectors , mostly revolving around drive-by downloads and spam .


To infect individuals with access to the data the actors desire , Scarlet Mimic deploys both spear-phishing and watering hole ( strategic web compromise ) attacks .


As with many other attackers who use spear-phishing to infect victims , Scarlet Mimic makes heavy use of " decoy " files .


The most recent Scarlet Mimic attacks we have identified were conducted in 2015 and suggest the group has a significant interest in both Muslim activists and those interested in critiques of the Russian government and Russian President Vladimir Putin .


Using these tactics Scarlet Mimic can directly target previously identified individuals ( spear phishing ) as well as unidentified individuals who are interested in a specific subject ( watering hole ) .


Scarlet Mimic primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 .


Scarlet Mimic has carried out attacks using both spear-phishing and watering holes since at least 2009 with increasingly advanced malware , and has deployed malware to attack multiple operating systems and platforms .


The group primarily deploys spear-phishing e-mails to infect its targets , but was also responsible for a watering hole attack in 2013 .


When using email scams , SilverTerrier actors preferred to use large target audiences , which maximized the likelihood of success with very little risk .


The malware may inject itself into browser processes and explorer.exe .


In early May , the phishing lures leveraged RTF attachments that exploited the Microsoft Windows vulnerability described in CVE-2017-0199 .


In their current campaign , APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros .


APT32 actors continue to deliver the malicious attachments via spear-phishing emails .


In the following weeks , FireEye released threat intelligence products and updated malware profiles to customers while developing new detection techniques for APT32’s tools and phishing lures .


FIN7 is a financially motivated intrusion set that selectively targets victims and uses spear phishing to distribute its malware .


The malware was initially distributed through a compromised software update system and then self-propagated through stolen credentials and SMB exploits , including the EternalBlue exploit used in the WannaCry attack from May 2017 .


The threat actors , observed by FireEye Labs , use a variety of different methods to either compromise or acquire already compromised payment card credentials , including sharing or purchasing dumps online , hacking vulnerable merchant websites and compromising payment card processing devices .


Another common step taken by threat actors is changing their system's MAC Address to avoid being uniquely identified .


The attachment in these emails is a weaponized Microsoft Office document containing a malicious macro that – when enabled – leads to the download of Hancitor .


FireEye Labs detects this phishing attack and customers will be protected against the usage of these sites in possible future campaigns .


The threat actors used two publicly available techniques , an AppLocker whitelisting bypass and a script to inject shellcode into the userinit.exe process .


To run its code in kernel mode in the most recent versions of operating systems , that have Driver Signature Enforcement , Slingshot loads signed vulnerable drivers and runs its own code through their vulnerabilities .


To date , all observed Snake Wine 's attacks were the result of spear phishing attempts against the victim organizations .


Beginning in mid-January 2019 , TA542 distributed millions of Emotet-laden emails in both English and German .


Proofpoint researchers observed one DanaBot affiliate ( Affid 11 ) specifically targeting Canada with " Canada Post " themed lures between January 1 and May 1 , 2019 .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload .


In this latest incident , the group registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day .


In previous incidents involving this threat actor , we observed them using malicious documents hosted on websites about the Indian Army , instead of sending these documents directly as an email attachment .


In this latest incident , Transparent Tribe registered a fake news domain , timesofindiaa.in , on May 18 , 2016 , and then used it to send spear phishing emails to Indian government officials on the same day .


This exploit file made use of the same shellcode that we have observed Transparent Tribe use across a number of spear phishing incidents .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability .


Whitefly compromises its victims using custom malware alongside open-source hacking tools and living off the land tactics , such as malicious PowerShell scripts .


After the demise of Storm , it was replaced by another new botnet known as Waledac that also leveraged peer-to-peer communications .


ESET recently analyzed a new Mac OS sample from the OceanLotus group that had been uploaded to VirusTotal .


At this point , the attackers know the user has opened the document and send another spear-phishing email , this time containing an MS Word document with an embedded executable .


In one case from 2013 , the target was sent a malicious document through a spear phishing email message .


The malware may communicate with its command and control (C2) server over The Onion Router (Tor) network if configured to do so .


Harvested credentials provided by an embedded Mimikatz executable facilitate the infection of other systems on the network .


This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) .


This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) .


The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


We believe that the Carbanak campaign is a clear indicator of a new era in cybercrime in which criminals use APT techniques directly against the financial industry instead of through its customers .


Alternatively , it is also possible that APT41 injected malicious code into the package prior to compilation , circumventing the need to steal the code-signing certificate and compile it on their own .


SectorJ04 used the spear phishing email to spread malicious Excel or malicious Word files , and downloaded the MSI files from the attacker’s server when the malicious documents were run .


Spam emails targeting email accounts used in the integrated mail service of public officials were also found in the hacking activity .


Instead of using fake Google Docs phishing pages to collect personal email login credentials , Scattered Canary began using phishing pages of commonly used business applications to compromise enterprise credentials .


During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros .


Tactic #1: Delivering the miner directly to a vulnerable serverSome tactics we've observed involve exploiting CVE-2017-10271 , leveraging PowerShell to download the miner directly onto the victim’s system (Figure 1) , and executing it using ShellExecute() .


According to the security firm , this campaign targeted Indian military officials via spear-phishing emails , distributing spyware to its victims via an Adobe Reader vulnerability .


Should a user enable this content , Gallmaker is then able to use the DDE protocol to remotely execute commands in memory on the victima 's system .


These socially engineered emails contain web links of weaponized documents containing exploits or macros .


It contains an additional meta tag at the end of the web page source code , " refreshing " ( redirecting ) the site visitor to the weaponized document .


Volexity has also found that , in addition to sending malware lures , the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages .


At this point , the attackers know the user has opened the document and send another spear-phishing email , this time containing an MS Word document with an embedded executable .


The majority of the code for TINYTYPHON is taken from the MyDoom worm and has been repurposed to find and exfiltrate documents .


Pitty Tiger group is sometimes using stolen material as spear phishing content to target other persons .


The Pitty Tiger group mostly uses spear phishing in order to gain an initial foothold within the targeted environment .


PittyTiger leverages social engineering to deliver spearphishing emails , in a variety of languages including English , French and Chinese , and email phishing pages to their targets .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


PLATINUM often spear phishes its targets at their non-official or private email accounts , to use as a stepping stone into the intended organization 's network .


PLATINUM primarily targets its intended victims using spear phishing .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations .


The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


When the document was opened in Word , PLATINUM exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer .


n one case from 2013 , the target was sent a malicious document through a spear phishing email message .


According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose .


The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


On November 26 , 2015 , a suspected China-based APT16 sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


On November 26 , 2015 , a suspected China-based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


APT16 actors sent spear phishing emails to two Taiwanese media organizations .


On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website .


APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations .


In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company .


Operation Daybreak appears to have been launched by unknown attackers to infect high profile targets through spear-phishing e-mails .


Operation Daybreak appears to have been launched by APT37 to infect high profile targets through spear-phishing e-mails .


BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when the group compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when BRONZE BUTLER compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team .


In several cases , the Cobalt compromised company infrastructure and employee accounts in order to send phishing messages to partner companies in North and South America , Europe , CIS countries , and Central and Southeast Asia .


To ensure remote access to the workstation of an employee at a target organization , the Cobalt group ( as in previous years ) uses Beacon , a Trojan available as part of commercial penetration testing software .


In a recent spear-phishing campaign , the Cobalt Hacking Group used a remote code execution vulnerability in Microsoft Office software to connect to its command and control server via Cobalt Strike .


Gallmaker used lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange ( DDE ) protocol in order to gain access to victim machines .


We believe that these industries have also been targeted as part of a larger supply-chain attack in order for Orangeworm to get access to their intended victims related to healthcare .


Orangeworm 's secondary targets include Manufacturing , Information Technology , Agriculture , and Logistics .


While these industries may appear to be unrelated , we found them to have multiple links to healthcare , such as large manufacturers that produce medical imaging devices sold directly into healthcare firms , IT organizations that provide support services to medical clinics , and logistical organizations that deliver healthcare products .


Once Orangeworm has infiltrated a victim 's network , they deploy Trojan.Kwampirs , a backdoor Trojan that provides the attackers with remote access to the compromised computer .


Patchwork targets were chosen worldwide with a focus on personnel working on military and political assignments , and specifically those working on issues relating to Southeast Asia and the South China Sea .


Kwampirs uses a fairly aggressive means to propagate itself once inside a victim 's network by copying itself over network shares .


In mid-August , the OilRig threat group sent what appeared to be a highly targeted phishing email to a high-ranking office in a Middle Eastern nation .


Patchwork 's attack was detected as part of a spear phishing against a government organization in Europe in late May 2016 .


The attack was detected as part of a spear phishing against a government organization in Europe in late May 2016 .


The Patchwork attack group has been targeting more than just government-associated organizations .


Symantec has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks .


Two security companies , Cymmetria and Kaspersky , each recently released reports on the campaign , most of which are in line with our observations .


Symantec Security Response has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks .


While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec , we have seen infections in multiple countries due to the nature of the victims operating large international corporations .


Although approximately half of the attacks focus on the US , other targeted regions include China , Japan , Southeast Asia , and the United Kingdom .


While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec telemetry , we have seen infections in multiple countries due to the nature of the victims operating large international corporations .


Our first observation of an attempted attack related to this campaign dates back to November 2015 , although Symantec telemetry data indicates that the campaign may have already existed in early 2015 or perhaps even earlier .


Should a user enable this content , Gallmaker is then able to use the DDE protocol to remotely execute commands in memory on the victima 's system .


While both back door Trojans wait for commands from the threat actor , they can search for files and upload them to the specified server once activated .


Patchwork ( also known as Dropping Elephant ) is a cyberespionage group whose targets included diplomatic and government agencies as well as businesses .


Patchwork is known for rehashing off-therack tools and malware for its own campaigns .


They also included Dynamic Data Exchange ( DDE ) and Windows Script Component ( SCT ) abuse to their tactics , as well as started exploiting recently reported vulnerabilities .


These socially engineered emails contain web links of weaponized documents containing exploits or macros .


It contains an additional meta tag at the end of the web page source code , " refreshing " ( redirecting ) the site visitor to the weaponized document .


It 's probable that Patchwork uses this package to facilitate server installation when using a Windows environment .


In March and April 2018 , Volexity identified multiple spear phishing campaigns attributed to Patchwork , an Indian APT group also known as Dropping Elephant .


This increase in threat activity was consistent with other observations documented over the last few months in blogs by 360 Threat Intelligence Center analyzing attacks on Chinese organizations and Trend Micro noting targets in South Asia .


Volexity has also found that , in addition to sending malware lures , the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages .


The newsletter includes a link to the attacker 's website , which has content focusing on topics related to China to draw the target 's interest .


Each of the spear phishing attacks contained links to .doc files , which were really RTF documents that attempt to exploit CVE-2017-8570 ( Composite Moniker ) .


The threat actors appear to have leveraged publicly available exploit code that can be found on Github at the URL : https://github.com/rxwx/CVE-2017-8570 .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools .


At this point , the attackers know the user has opened the document and send another spear-phishing email , this time containing an MS Word document with an embedded executable .


The Word document usually exploits CVE-2012-0158 .


Sometimes the attackers send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


From the attacks observed by Volexity , what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks .


Once started , it downloads additional malware from the C2 and also uploads some basic system information , stealing , among other things , the user 's Google Chrome credentials .


It repeatedly attempts to iterate through directories and to collect files with the following extensions : doc , docx , ppt , pptx , pps , ppsx , xls , xlsx , and pdf .


In this case , a small group reusing exploit code , some powershell-based malware and mostly social engineering has been able to steal sensitive documents and data from victims since at least November 2015 .


In the past few months , Unit 42 has observed the Patchwork group , alternatively known as Dropping Elephant and Monsoon , conducting campaigns against targets located in the Indian subcontinent .


The malicious documents seen in recent activity refer to a number of topics , including recent military promotions within the Pakistan Army , information related to the Pakistan Atomic Energy Commission , as well as Pakistan 's Ministry of the Interior .


The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities .


Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability , however in late January 2018 when , paradoxically , newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability .


The Patchwork group continues to plague victims located within the Indian subcontinent .


The overarching campaign appears to target both Chinese nationals within different industries and government agencies in Southern Asia .


It appears to have started in December 2015 and is still ongoing as of July 2016 .


The use of weaponized legitimate documents is a longstanding operational standard of Patchwork .


It is dropped by at least one of the weaponised documents17 used in the MONSOON campaign where it is embedded inside another executable .


The majority of the code for TINYTYPHON is taken from the MyDoom worm and has been repurposed to find and exfiltrate documents .


The targeting of Chinese nationals may also be related to this campaign , but equally may be part of a separate campaign by the adversary or even as part of them selling Surveillance-As-A-Service in a similar manner previously seen with the HANGOVER group .


The use of weaponized legitimate documents is a longstanding operational standard of this group .


We decided to spend some time to investigate around this malware and found out that it was used exclusively by a single group of attackers .


The newsnstat.com domain was used earlier in 2015 for previous HANGOVER campaigns , and was then repurposed in December 2015 for the MONSOON campaign .


Our researches around the malware family revealed the " Pitty Tiger " group has been active since 2011 , yet we found traces which makes us believe the group is active since 2010 .


The group exploits known vulnerabilities in Microsoft Office products to infect their targets with malware .


Pitty Tiger group is sometimes using stolen material as spear phishing content to target other persons .


PittyTiger has also been seen using Heartbleed vulnerability in order to directly get valid credentials .


They have also been seen using Heartbleed vulnerability in order to directly get valid credentials .


One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability ( CVE-2012-0158 ) .


PittyTiger could also use CVE-2014-1761 , which is more recent .


" PittyTiger " is a mutex used by the malware .


This RAT is the origin of the attackers ' group name .


Paladin RAT is another remote administration tool used by the Pitty Tiger group .


Pitty Tiger , like other APT attackers , often use anti-virus " familiar names " when registering domains or creating subdomains .


" Pitty Tiger " is also a string transmitted in the network communications of the RAT .


A recent report documents a group of attackers known as " PittyTiger " that appears to have been active since at least 2011 ; however , they may have been operating as far back as 2008 .


We have been monitoring the activities of this group and believe they are operating from China .


This threat group uses a first-stage malware known as Backdoor.APT.Pgift ( aka Troj/ReRol.A ) , which is dropped via malicious documents and connects back to a C2 server .


By integrating the findings with prior research , it was possible to connect MONSOON directly with infrastructure used by the HANGOVER group via a series of strong connections .


Backdoor.APT.PittyTiger – This malware is the classic " PittyTiger " malware ( PittyTigerV1.0 ) that was heavily used by this group in 2012 - 2013 .


Backdoor.APT.PittyTiger1.3 ( aka CT RAT ) – This malware is likely used as a second-stage backdoor .


It also appears the attackers use this as second-stage malware .


We have observed the Enfal malware in use since 2011 and in conjunction with Backdoor.APT.Pgift as the payload of a malicious document used in spearphishing attacks .


The Pitty Tiger group mostly uses spear phishing in order to gain an initial foothold within the targeted environment .


PittyTiger leverages social engineering to deliver spearphishing emails , in a variety of languages including English , French and Chinese , and email phishing pages to their targets .


PLATINUM has been targeting its victims since at least as early as 2009 , and may have been active for several years prior .


This section describes the history , behavior , and tactics of a newly discovered targeted activity group , which Microsoft has code-named PLATINUM .


Like many such groups , PLATINUM seeks to steal sensitive intellectual property related to government interests , but its range of preferred targets is consistently limited to specific governmental organizations , defense institutes , intelligence agencies , diplomatic institutions , and telecommunication providers in South and Southeast Asia .


PLATINUM 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


The group 's persistent use of spear phishing tactics ( phishing attempts aimed at specific individuals ) and access to previously undiscovered zero-day exploits have made it a highly resilient threat .


LATINUM makes a concerted effort to hide their infection tracks , by self-deleting malicious components , or by using server side logic in ' one shot mode ' where remotely hosted malicious components are only allowed to load once .


PLATINUM often spear phishes its targets at their non-official or private email accounts , to use as a stepping stone into the intended organization 's network .


PLATINUM uses custom-developed malicious tools and has the resources to update these applications often to avoid being detected .


PLATINUM primarily targets its intended victims using spear phishing .


PLATINUM configures its backdoor malware to restrict its activities to victims ' working hours , in an attempt to disguise post-infection network activity within normal user traffic .


PLATINUM does not conduct its espionage activity to engage in direct financial gain , but instead uses stolen information for indirect economic advantages .


PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts .


For the initial infection , PLATINUM typically sends malicious documents that contain exploits for vulnerabilities in various software programs , with links or remotely loaded components ( images or scripts or templates ) that are delivered to targets only once .


PLATINUM 's approach toward exploiting vulnerabilities varies between campaigns .


The document , when opened , used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows ( later designated CVE-2013-7331 ) to read information about the browser 's installed components .


When the document was opened in Word , PLATINUM exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer .


n one case from 2013 , the target was sent a malicious document through a spear phishing email message .


The DLL exploited another previously unknown vulnerability ( designated CVE-2015-2546 ) in the Windows kernel , which enabled it to elevate privileges for the Word executable and subsequently install a backdoor through the application .


When the document was opened in Word , it exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer .


In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves .


Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015 .


In both these campaigns the activity group included remote triggers to deactivate exploitation , with an attempt to conceal the vulnerability , and prevent analysis of the attack .


After gaining access to a victim 's computer , PLATINUM installs its own custom-built malware to communicate with the compromised system , issue commands , and move laterally through the network .


PLATINUM uses a number of different custom-developed backdoors to communicate with infected computers .


This section describes some of the tools used by the group .


The lack of any significant evidence of shared code between any of these backdoor families is another clue as to the scope of the resources on which the activity group is able to draw , and the precautions the group is willing and able to take in order to avoid losing its ability to conduct its espionage operations .


In addition to Dipsind and its variants , PLATINUM uses a few other families of custom-built backdoors within its attack toolset .


The PLATINUM group has written a few different versions of keyloggers that perform their functions in different ways , most likely to take advantage of different weaknesses in victims ' computing environments .


While one family relies on a small number of supported commands and simple shells , the other delves into more convoluted methods of injections , checks , and supported feature sets .


Both groups can set permissions on specific files to Everyone , and work in tandem with the PLATINUM backdoors .


In particular , this second group also has the capability of dumping users ' credentials using the same technique employed by Mimikatz .


In addition to using several publicly known injection methods to perform this task , it also takes advantage of an obscure operating system feature known as hot patching .


One of PLATINUM 's most recent and interesting tools is meant to inject code into processes using a variety of injection techniques .


At a high level , hot patching can transparently apply patches to executables and DLLs in actively running processes , which does not happen with traditional methods of code injection such as CreateRemoteThread or WriteProcessMemory .


Hot patching is an operating system-supported feature for installing updates without having to reboot or restart a process .


Multiple Dipsind variants have been identified , all of which are believed to be used exclusively by PLATINUM .


The group 's most frequently used backdoors belong to a malware family that Microsoft has designated Dipsind , although some variants are detected under different names .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 Administrator permissions are required for hot patching , and the technique used by PLATINUM does not attempt to evade this requirement through exploitation .


PLATINUM has used several zero-day exploits against their victims .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 .


PLATINUM has consistently targeted victims within a small set of countries in South and Southeast Asia .


PLATINUM has developed or commissioned a number of custom tools to provide the group with access to victim resources .


Some of the tools used by PLATINUM , such as the port-knocking backdoor , show signs of organized thinking .


Take advantage of native mitigations built into Windows 10 .


For example , the summer 2015 attack that used the unusual ' resume ' would not have been successful on Windows 10 as-is because of the presence of the Supervisor Mode Execution Prevention ( SMEP ) mitigation , even without the latest security updates installed .


Even if CVE-2015-2546 affected Windows 10 , the exploitation would have required much more technical prowess to succeed ; ultimately , SMEP makes it more difficult for attackers .


For example , one zero-day vulnerability exploit ( CVE-2015-2545 ) used by PLATINUM was addressed immediately in September 2015 .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel® Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication .


Until this incident , no malware had been discovered misusing the AMT SOL feature for communication .


We confirmed that the tool did not expose vulnerabilities in the management technology itself , but rather misused AMT SOL within target networks that have already been compromised to keep communication stealthy and evade security applications .


In either case , PLATINUM would need to have gained administrative privileges on targeted systems prior to the feature 's misuse .


The updated tool has only been seen in a handful of victim computers within organizational networks in Southeast Asia—PLATINUM is known to customize tools based on the network architecture of targeted organizations .


One possibility is that PLATINUM might have obtained compromised credentials from victim networks .


Another possibility is that the targeted systems did not have AMT provisioned and PLATINUM , once they've obtained administrative privileges on the system , proceeded to provision AMT .


During the provisioning process , PLATINUM could select whichever username and password they wish .


The new SOL protocol within the PLATINUM file-transfer tool makes use of the AMT Technology SDK 's Redirection Library API ( imrsdk.dll ) .


The PLATINUM tool is , to our knowledge , the first malware sample observed to misuse chipset features in this way .


Microsoft reiterates that the PLATINUM tool does not expose flaws in Intel® Active Management Technology ( AMT ) , but uses the technology within an already compromised network to evade security monitoring tools .


The discovery of this new PLATINUM technique and the development of detection capabilities highlight the work the Windows Defender ATP team does to provide customers greater visibility into suspicious activities transpiring on their networks .


It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks .


This signals just how long ago the Poseidon threat actor was already working on its offensive framework .


However , Poseidon 's practice of being a ' custom-tailored malware implants boutique ' kept security researchers from connecting different campaigns under the umbrella of a single threat actor .


Poseidon Group is dedicated to running targeted attacks campaigns to aggressively collect information from company networks through the use of spear-phishing packaged with embedded , executable elements inside office documents and extensive lateral movement tools .


The Poseidon Group is a long-running team operating on all domains : land , air , and sea .


The Poseidon Group has been active , using custom code and evolving their toolkit since at least 2005 .


Poseidon has maintained a consistently evolving toolkit since the mid-2000s .


The Poseidon Group actively targets this sort of corporate environment for the theft of intellectual property and commercial information , occasionally focusing on personal information on executives .


PROMETHIUM is an activity group that has been active as early as 2012 .


This malware family is known as " PittyTiger " by the anti-virus community .


NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird .


The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


PROMETHIUM distributed links through instant messengers , pointing recipients to malicious documents that invoked the exploit code to launch Truvasys on victim computers .


PROMETHIUM is an activity group that has been active since at least 2012 .


In 2016 , an attack campaign by this group was recorded in early May that made use of an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player , which at the time was both unknown and unpatched .


Truvasys is a collection of modules written in the Delphi programming language , a variant of Pascal .


While studying Truvasys , Microsoft uncovered a previously undocumented piece of malware known as Myntor that is a completely separate malware family .


Unit 61486 is the 12th Bureau of the PLA 's 3rd General Staff Department ( GSD ) and is headquartered in Shanghai , China .


The CrowdStrike has been tracking this particular unit since 2012 , under the codename PUTTER PANDA , and has documented activity dating back to 2007 .


The CrowdStrike Intelligence team has been tracking this particular unit since 2012 , under the codename PUTTER PANDA , and has documented activity dating back to 2007 .


This particular unit is believed to hack into victim companies throughout the world in order to steal corporate trade secrets , primarily relating to the satellite , aerospace and communication industries .


Parts of the PUTTER PANDA toolset and tradecraft have been previously documented , both by CrowdStrike , and in open source , where they are referred to as the MSUpdater group .


PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries .


According to the hacking collective , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks .


The folders seem to contain information about the company 's development documentation , artificial intelligence model , web security software , and antivirus software base code .


Targeting antivirus companies appears to have been the primary goal of Fxmps' latest network intrusions .


This period started with their seeming disappearance in October 2018 and concluded with their return in April 2019 .


The hacker 's name is Gnosticplayers , and since February 11 the hacker has put up for sale data for 32 companies in three rounds [stories on Round 1 , Round 2 , and Round 3] on Dream Market , a dark web marketplace .


But according to Gnosticplayers , his foray into a public marketplace like Dream has two goals --besides the first and obvious one being money .


Data collected by Secureworks incident response ( IR ) analysts and analyzed by CTU researchers indicates that GOLD LOWELL extorts money from victims using the custom SamSam ransomware .


Some sources claimed that GOLD LOWELL operations specifically targeted the healthcare vertical following public SamSam incidents in 2016 and 2018 .


However , CTU analysis indicates that GOLD LOWELL is motivated by financial gain , and there is no evidence of the threat actors using network access for espionage or data theft .


In January 2017 , GOLD LOWELL began targeting legitimate RDP account credentials , in some cases discovering and compromising accounts using brute-force techniques .


In 2015 and 2016 , GOLD LOWELL frequently exploited JBoss enterprise applications using several versions of this open-source JBoss exploitation tool .


In 2017 and early 2018 , the group used PowerShell commands to call Mimikatz from an online PowerSploit repository , which is a collection of publicly available PowerShell modules for penetration testing .


Gold Lowell responded by modifying a registry entry to disable the endpoint tool 's scanning functionality .


Gold Lowell then provide a download link to a unique XML executable file and corresponding RSA private key to decrypt the files .


This methodology , known as " big game hunting " , signals a shift in operations for WIZARD SPIDER , a criminal enterprise of which GRIM SPIDER appears to be a cell .


The WIZARD SPIDER threat group , known as the Russia-based operator of the TrickBot banking malware , had focused primarily on wire fraud in the past .


Similar to Samas and BitPaymer , Ryuk is specifically used to target enterprise environments .


Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release .


Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors .


However , Ryuk is only used by GRIM SPIDER and , unlike Hermes , Ryuk has only been used to target enterprise environments .


Since Ryuk 's appearance in August , the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD .


Hermes ransomware , the predecessor to Ryuk , was first distributed in February 2017 .


In mid-August 2018 , a modified version of Hermes , dubbed Ryuk , started appearing in a public malware repository .


Ryuk was tailored to target enterprise environments and some of the modifications include removing anti-analysis checks .


As mentioned in the Hermes to Ryuk section , Ryuk uses a combination of symmetric ( AES ) and asymmetric ( RSA ) encryption to encrypt files .


For each mounted drive , Ryuk calls GetDriveTypeW to determine the drive 's type .


To retrieve IP addresses that have ARP entries , Ryuk calls GetIpNetTable .


Open-source reporting has claimed that the Hermes ransomware was developed by the North Korean group STARDUST CHOLLIMA ( activities of which have been public reported as part of the " Lazarus Group " ) , because Hermes was executed on a host during the SWIFT compromise of FEIB in October 2017 .


The two executables related to Hermes are bitsran.exe and RSW7B37.tmp .


Falcon Intelligence has medium-high confidence that the GRIM SPIDER threat actors are operating out of Russia .


Based on these factors , there is considerably more evidence supporting the hypothesis that the GRIM SPIDER threat actors are Russian speakers and not North Korean .


The hackers also started tweeting a few samples of internal emails from the company .


From a process and file perspective , Hermes and Ryuk target files in a similar fashion .


Claudio Guarnieri , a security researcher who has investigated Hacking Team along with others at the Citizen Lab , was quick to point this out .


The breach on Hacking Team comes almost a year after another surveillance tech company , the competing FinFisher , was hacked in a similar way , with a hacker leaking 40 Gb of internal files .


Their software , once surreptitiously installed on a target 's cell phone or computer , can be used to monitor the target 's communications , such as phone calls , text messages , Skype calls , or emails .


In 2015 and 2016 , Dridex was one of the most prolific eCrime banking trojans on the market and , since 2014 , those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits .


In August 2017 , a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K. 's National Health Service ( NHS ) , with a high ransom demand of 53 BTC ( approximately $200,000 USD ) .


The targeting of an organization rather than individuals , and the high ransom demands , made BitPaymer stand out from other contemporary ransomware at the time .


Though the encryption and ransom functionality of BitPaymer was not technically sophisticated , the malware contained multiple anti-analysis features that overlapped with Dridex .


Later technical analysis of BitPaymer indicated that it had been developed by INDRIK SPIDER , suggesting the group had expanded its criminal operation to include ransomware as a monetization strategy .


The beginning of 2017 also brought a turning point in INDRIK SPIDER 's operation of Dridex .


CrowdStrike® Falcon® Intelligence™ also observed a strong correlation between Dridex infections and BitPaymer ransomware .


During incidents that involved BitPaymer , Dridex was installed on the victim network prior to the deployment of the BitPaymer malware .


Also unusual was the observation that both Dridex and BitPaymer were spread through the victim network using lateral movement techniques traditionally associated with nation-state actors and penetration testing .


The information gathered from these engagements , combined with information from prior Dridex IR engagements , provides insight into how INDRIK SPIDER deploys and operates both Dridex and BitPaymer .


In recent BitPaymer IR engagements , Falcon Intelligence linked the initial infection vector to fake updates for a FlashPlayer plugin and the Chrome web browser .


With the move to targeting select victims for high-value payouts , the INDRIK SPIDER adversary group is no longer forced to scale its operations , and now has the capacity to tailor its tooling to the victim 's environment and play a more active role in the compromise with " hands on keyboard " activity .


This web hosting service provider continues to be the hosting provider of choice for the threat actors behind NetTraveler .


These new tactics of selectively targeting organizations for high ransomware payouts have signaled a shift in INDRIK SPIDER 's operation with a new focus on targeted , low-volume , high-return criminal activity : a type of cybercrime operation we refer to as big game hunting .


Later , in January 2018 , a report was released that identified similarities between the BitPaymer ransomware and Dridex malware .


The report authors renamed the malware " FriedEx " .


Falcon Intelligence has analyzed this malware and can confirm the overlap between BitPaymer/FriedEx and Dridex malware .


Though there is no functionality to collect this information in the ransomware itself , the ransomware is deployed by INDRIK SPIDER in parallel with Dridex malware , and the Dridex malware contains modules that may be used to collect information from infected hosts .


Falcon Intelligence has acquired multiple decryption tools related to BitPaymer , which confirm the theory that a unique key is used for each infection .


Unlike many ransomware operations , which usually just require victims to make the payment and subsequently download a decryptor , INDRIK SPIDER requires the victim to engage in communication with an operator .


Falcon Intelligence has had unique insight into the email dialogue between a victim and an INDRIK SPIDER operator .


Initial victim communication with the INDRIK SPIDER operator , using one of the email addresses provided , results in the operator providing key pieces of information up front , such as the BTC address and the ransom amount .


It was made clear during communications that INDRIK SPIDER is not willing to negotiate on the ransom amount , explicitly stating that the victim can use multiple Bitcoin exchanges to obtain the number of BTC required , and the exchange rate should be calculated based on the rate posted on the cryptocurrency exchange Bittrex .


Of note , INDRIK SPIDER specifies the geographical location of where the victim should seek help , confirming that they know key information about the victim .


INDRIK SPIDER uses file sharing platforms to distribute the BitPaymer decryptor .


In an extensive email to the victim , the INDRIK SPIDER operator provides a decryptor download link , decryptor deletion link ( to be used following decryptor download ) and a password .


The recommendations provided are not only good advice , but also provide indications of how INDRIK SPIDER breaches organizations and moves laterally until domain controller access is gained .


Ransom demands have varied significantly , suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization .


INDRIK SPIDER consists of experienced malware developers and operators who have likely been part of the group since the early days of Dridex operations , beginning in June 2014 .


The formation of the group and the modus operandi changed significantly in early 2017 .


Dridex operations became more targeted , resulting in less distribution and Dridex sub-botnets in operation , and BitPaymer ransomware operations began in July 2017 .


There is no doubt that BitPaymer ransomware operations are proving successful for Indrik Spider , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan .


There is no doubt that BitPaymer ransomware operations are proving successful for this criminal group , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan .


Though Dridex is still bringing in criminal revenue for the actor after almost four years of operation , targeted wire fraud operations likely require lengthy planning .


In scenarios where wire fraud is not as lucrative an option , INDRIK SPIDER might use ransomware to monetize the compromise instead .


INDRIK SPIDER isn't the only criminal actor running big game hunting operations ; The first ransomware to stake a claim for big game hunting was Samas ( aka SamSam ) , which is developed and operated by BOSS SPIDER .


Since they were first identified in January 2-16 , this adversary has consistently targeted large organizations for high ransom demands .


In July 2017 , INDRIK SPIDER joined the movement of targeted ransomware with BitPaymer .


Most recently , the ransomware known as Ryuk came to market in August 2017 and has netted its operators , tracked by Falcon Intelligence as GRIM SPIDER , a significant ( and immediate ) profit in campaigns also targeting large organizations .


The WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware .


The LUNAR SPIDER threat group is the Eastern European-based operator and developer of the commodity banking malware called BokBot ( aka IcedID ) , which was first observed in April 2017 .


The BokBot malware provides LUNAR SPIDER affiliates with a variety of capabilities to enable credential theft and wire fraud , through the use of webinjects and a malware distribution function .


campaigns involving both BokBot and TrickBot were first identified by CrowdStrike Intelligence in July 2017 .


These gtags have been closely associated with LUNAR SPIDER activity .


Unit 42 followed network traces and pivoted on the information left behind by this actor , such as open directories , document metadata , and binary peculiarities , which enabled us to find a custom-made piece of malware , that we named " CapturaTela " .


Our telemetry for this campaign identified email as the primary delivery mechanism and found the first related samples were distributed in August 2018 .


Aside from the use of the custom trojan CapturaTela , the actor makes extensive use of several other remote access Trojans to perform its malicious activities .


Why would OurMine want to target WikiLeaks .


Instead , OurMine had managed to alter WikiLeaks 's DNS records ( held by a third-party registrar ) to direct anyone who tried to visit wikileaks.org to visit a different IP address which definitely wasn't under the control of Julian Assange and his cronies .


We don't know how OurMine managed to access WikiLeaks 's DNS records , but past experience has shown that their typical modus operandi is simply to log in using their victim 's password .


Alternatively , OurMine might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address .


Alternatively , the attackers might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address .


Known for hijacking prominent social media accounts , the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network .


Last year , OurMine victimized Marvel , The New York Times , and even the heads of some of the biggest technology companies in the world .


Mark Zuckerberg , Jack Dorsey , Sundar Pichai , and Daniel Ek — the CEOs of Facebook , Twitter , Google and Spotify , respectively — have also fallen victim to the hackers , dispelling the notion that a career in software and technology exempts one from being compromised .


The group is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


OurMine is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


The group 's primary goal is demonstrating to companies that they have weak security .


US intelligence agencies pinned the breach on North Korea ( one of the hacking group 's demands was that Sony pull The Interview , Seth Rogan 's comedy about a plot to assassinate Kim Jong-Un ) .


Of course , Sony ( one of Vevo 's joint owners ) fell victim to a devastating hack in 2014 after a group of hackers calling themselves the " Guardians of Peace " dumped a wealth of its confidential data online .


The cryptominer employed by Pacha Group , labeled Linux.GreedyAntd by Intezer , was completely undetected by all leading engines , demonstrating the sophistication of this malware .


Intezer has evidence dating back to September 2018 which shows Pacha Group has been using a cryptomining malware that has gone undetected on other engines .


The new miner employed by Pacha Group , named Linux.GreedyAntd , has shown to be more sophisticated than the average Linux threat , using evasion techniques rarely seen in Linux malware .


Pacha Group is believed to be of Chinese origin , and is actively delivering new campaigns , deploying a broad number of components , many of which are undetected and operating within compromised third party servers .


We have labeled the undetected Linux.Antd variants , Linux.GreedyAntd and classified the threat actor as Pacha Group .


Based on our findings Linux.GreedyAntd 's operations closely resemble previous cryptojacking campaigns deployed by Pacha Group in the past .