Patchwork targets were chosen worldwide with a focus on personnel working on military and political assignments , and specifically those working on issues relating to Southeast Asia and the South China Sea .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools .


In this case , a small group reusing exploit code , some powershell-based malware and mostly social engineering has been able to steal sensitive documents and data from victims since at least November 2015 .


The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries .


In 2015 and 2016 , Dridex was one of the most prolific eCrime banking trojans on the market and , since 2014 , those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits .


In August 2017 , a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K. 's National Health Service ( NHS ) , with a high ransom demand of 53 BTC ( approximately $200,000 USD ) .


Known for hijacking prominent social media accounts , the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network .


Through research , 360 Helios Team has found that , since 2007 , the Poison Ivy Group has carried out 11 years of cyber espionage campaigns against Chinese key units and departments , such as national defense , government , science and technology , education and maritime agencies .


Dragos has reported that XENOTIME , the APT group behind the TRISIS (aka TRITON and HatMan) attack on a Saudi Arabian petro-chemical facility in 2017 , has expanded its focus beyond the oil and gas industries .


Known targets of this group have been involved in the maritime industry , as well as engineering-focused entities , and include research institutes , academic organizations , and private firms in the United States .


Historically , the majority of their targeting has been focused on the South Korean government , military , and defense industrial base .


These malware families have a rich history of being used in many targeted attacks against government and private organizations .


In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage .


The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


The admin@338 started targeting Hong Kong media companies , probably in response to political and economic challenges in Hong Kong and China .


The admin@338 linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong .


The group targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


The agroup targeting Hong Kong media outlets is called admin@338 and is known to researchers for using publicly available remote access Trojans such as Poison Ivy to attack government and financial firms specializing in global economic policy .


The admin@338 , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


The APT actor , active since 2008 , has been seen targeting organizations in the financial services , telecoms , government , and defense sectors .


FireEye said it has tracked admin@338 's activity since 2013 and the group has largely targeted organizations involved in financial , economic , and trade policy .


They have largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT groups launched several spear phishing attacks targeting Japanese and Taiwanese organizations in the high-tech , government services , media and financial services industries .


TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and political , financial , pharmaceutical and energy sectors that could benefit the Chinese economy .


APT19 seemed to be going after defense sector firms , Chinese dissident groups and other political target , as well as certain financial targets and other commercial targets in pharmaceutical and energy sectors that could benefit the Chinese economy .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments , militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government .


APT33 has targeted organizations – spanning multiple industries – headquartered in the United States , Saudi Arabia and South Korea .


During the same time period , APT33 also targeted companies in South Korea involved in oil refining and petrochemicals .


APT33 's targeting of organizations involved in aerospace and energy most closely aligns with nation-state interests , implying that the threat actor is most likely government sponsored .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


Specifically , the targeting of organizations in the aerospace and energy sectors indicates that the APT33 is likely in search of strategic intelligence capable of benefitting a government or military sponsor .


APT33 's focus on aviation may indicate the group 's desire to gain insight into regional military aviation capabilities to enhance Iran 's aviation capabilities or to support Iran 's military and strategic decision making .


We surmise that the targeting of banks , media , and government agencies is conducted in support of APT38 's primary mission .


The APT38 targeted news outlets known for their business and financial sector reporting , probably in support of efforts to identify and compromise additional financial institutions .


APT39 has prioritized the telecommunications sector , with additional targeting of the travel industry and IT firms that support it and the high-tech industry .


APT39 's focus on the telecommunications and travel industries suggests intent to perform monitoring , tracking , or surveillance operations against specific individuals , collect proprietary or customer data for commercial or operational purposes that serve strategic requirements related to national priorities , or create additional accesses and vectors to facilitate future campaigns .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japanese organizations such as government agencies ( including defense ) as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


REDBALDKNIGHT , also known as BRONZE BUTLER and Tick , is a cyberespionage group known to target Japan such as government agencies as well as those in biotechnology , electronics manufacturing , and industrial chemistry .


From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space .


Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team .


Since 2013 , the Cobalt have attempted to attack banks and financial institutions using pieces of malware they designed .


Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt .


There are no obvious links between the Eastern European and Middle Eastern targets , but it is clear that Gallmaker is specifically targeting the defense , military , and government sectors .


traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


The Ke3chang have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , chemicals , manufacturing , mining sectors .


The attackers have used three types of malware over the years and have traditionally targeted the aerospace , energy , government , high-tech , consulting services , and chemicals / manufacturing / mining sectors .


APT15 was targeting information related to UK government departments and military technology .


APT15 is known for committing cyberespionage against companies and organizations located in many different countries , targeting different sectors such as the oil industry , government contractors , military , and more .


cyber actors of the North Korean to target the media , aerospace , financial , and critical infrastructure sectors in the United States and globally .


According to trusted third-party reporting , HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace , telecommunications , and finance industries .


McAfee Advanced Threat Research analysts have uncovered a global data reconnaissance campaign assaulting a wide number of industries including critical infrastructure , entertainment , finance , health care , and telecommunications .


Since at least 2013 , HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government , financial , automotive , and media industries .


Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others .


Known targets of the Leviathan have been involved in the maritime industry , and research institutes , academic organizations , and private firms in the United States .


Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities .


Within a year APT40 was observed masquerading as a UUV manufacturer , and targeting universities engaged in naval research .


APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia .


Lotus Blossom targeted the government , higher education , and high tech companies .


The Lotus Blossom largely targets military or government , with some cases of higher education and high tech companies .


Organizations in the government , energy , and technology sectors have been targeted by Magic Hound , specifically organizations based in or doing business in Saudi Arabia .


Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents .


Evidence also suggests that APT32 has targeted network security and technology infrastructure corporations with connections to foreign investors .


Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations foreign governments .


Additionally , there is evidence to suggest APT33 targeted Saudi Arabian and Western organizations that provide training , maintenance and support for Saudi Arabia 's military and commercial fleets .


The OilRig group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries .


APT35 typically targets military , diplomatic and government , media , energy , engineering , business services and telecommunications sectors in U.S. and the Middle East .


APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors .


Ultimately , APT35 had used access to hundreds of mailboxes to read email communications and steal data related to Middle East organizations , which later became victims of destructive attacks .


Further analysis revealed a well-established collection of fake social media profiles that appear intended to build trust and rapport with potential victims .


COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites .


Spam emails targeting email accounts used in the integrated mail service of public officials were also found in the hacking activity .


Should a user enable this content , Gallmaker is then able to use the DDE protocol to remotely execute commands in memory on the victima 's system .


These socially engineered emails contain web links of weaponized documents containing exploits or macros .


It contains an additional meta tag at the end of the web page source code , " refreshing " ( redirecting ) the site visitor to the weaponized document .


The majority of the code for TINYTYPHON is taken from the MyDoom worm and has been repurposed to find and exfiltrate documents .


Pitty Tiger group is sometimes using stolen material as spear phishing content to target other persons .


The Pitty Tiger group mostly uses spear phishing in order to gain an initial foothold within the targeted environment .


PLATINUM often spear phishes its targets at their non-official or private email accounts , to use as a stepping stone into the intended organization 's network .


PLATINUM primarily targets its intended victims using spear phishing .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


In August 2015 , the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations , including newspapers , radio , and television .


In August 2015 , the admin@338 sent spear phishing emails to a number of Hong Kong-based media organizations .


The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


n one case from 2013 , the target was sent a malicious document through a spear phishing email message .


According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


This week the experts at FireEye discovered that a group of Chinese-based hackers called admin@338 had sent multiple MH370-themed spear phishing emails , the attackers targeted government officials in Asia-Pacific , it is likely for cyber espionage purpose .


The group previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences .


On November 26 , 2015 , a suspected China-based APT16 sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


On November 26 , 2015 , a suspected China-based APT group sent Japanese defense policy-themed spear phishing emails to multiple Japanese financial and high-tech companies .


APT16 actors sent spear phishing emails to two Taiwanese media organizations .


On the same date that APT16 targeted Taiwanese media , suspected Chinese APT actors also targeted a Taiwanese government agency , sending a lure document that contained instructions for registration and subsequent listing of goods on a local Taiwanese auction website .


APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


APT33 sent spear phishing emails to employees whose jobs related to the aviation industry .


It is possible that APT37 's distribution of KARAE malware via torrent websites could assist in creating and maintaining botnets for future distributed denial-of-service ( DDoS ) attacks , or for other activity such as financially motivated campaigns or disruptive operations .


In May 2017 , APT37 used a bank liquidation letter as a spear phishing lure against a board member of a Middle Eastern financial company .


Operation Daybreak appears to have been launched by APT37 to infect high profile targets through spear-phishing e-mails .


BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when the group compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


Symantec discovered the most recent wave of Tick attacks in July 2015 , when BRONZE BUTLER compromised three different Japanese websites with a Flash ( .swf ) exploit to mount watering hole attacks .


However , even though the TTPs of the Cleaver team have some overlap to techniques used by Iranian Cyber Army ( botnets ) , Ashiyane ( SQL injection ) and Syrian Electronic Army ( phishing ) , we believe this is largely the work of a new team .


In several cases , the Cobalt compromised company infrastructure and employee accounts in order to send phishing messages to partner companies in North and South America , Europe , CIS countries , and Central and Southeast Asia .


To ensure remote access to the workstation of an employee at a target organization , the Cobalt group ( as in previous years ) uses Beacon , a Trojan available as part of commercial penetration testing software .


In a recent spear-phishing campaign , the Cobalt Hacking Group used a remote code execution vulnerability in Microsoft Office software to connect to its command and control server via Cobalt Strike .


Gallmaker used lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange ( DDE ) protocol in order to gain access to victim machines .


We believe that these industries have also been targeted as part of a larger supply-chain attack in order for Orangeworm to get access to their intended victims related to healthcare .


Orangeworm 's secondary targets include Manufacturing , Information Technology , Agriculture , and Logistics .


While these industries may appear to be unrelated , we found them to have multiple links to healthcare , such as large manufacturers that produce medical imaging devices sold directly into healthcare firms , IT organizations that provide support services to medical clinics , and logistical organizations that deliver healthcare products .


Once Orangeworm has infiltrated a victim 's network , they deploy Trojan.Kwampirs , a backdoor Trojan that provides the attackers with remote access to the compromised computer .


Patchwork targets were chosen worldwide with a focus on personnel working on military and political assignments , and specifically those working on issues relating to Southeast Asia and the South China Sea .


Kwampirs uses a fairly aggressive means to propagate itself once inside a victim 's network by copying itself over network shares .


In mid-August , the OilRig threat group sent what appeared to be a highly targeted phishing email to a high-ranking office in a Middle Eastern nation .


The attack was detected as part of a spear phishing against a government organization in Europe in late May 2016 .


The Patchwork attack group has been targeting more than just government-associated organizations .


Symantec has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks .


Two security companies , Cymmetria and Kaspersky , each recently released reports on the campaign , most of which are in line with our observations .


Symantec Security Response has been actively monitoring Patchwork , also known as Dropping Elephant , which uses Chinese-themed content as bait to compromise its targets ' networks .


While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec , we have seen infections in multiple countries due to the nature of the victims operating large international corporations .


Although approximately half of the attacks focus on the US , other targeted regions include China , Japan , Southeast Asia , and the United Kingdom .


While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec telemetry , we have seen infections in multiple countries due to the nature of the victims operating large international corporations .


Our first observation of an attempted attack related to this campaign dates back to November 2015 , although Symantec telemetry data indicates that the campaign may have already existed in early 2015 or perhaps even earlier .


Should a user enable this content , Gallmaker is then able to use the DDE protocol to remotely execute commands in memory on the victima 's system .


While both back door Trojans wait for commands from the threat actor , they can search for files and upload them to the specified server once activated .


Patchwork is known for rehashing off-therack tools and malware for its own campaigns .


They also included Dynamic Data Exchange ( DDE ) and Windows Script Component ( SCT ) abuse to their tactics , as well as started exploiting recently reported vulnerabilities .


These socially engineered emails contain web links of weaponized documents containing exploits or macros .


It contains an additional meta tag at the end of the web page source code , " refreshing " ( redirecting ) the site visitor to the weaponized document .


It 's probable that Patchwork uses this package to facilitate server installation when using a Windows environment .


In March and April 2018 , Volexity identified multiple spear phishing campaigns attributed to Patchwork , an Indian APT group also known as Dropping Elephant .


The newsletter includes a link to the attacker 's website , which has content focusing on topics related to China to draw the target 's interest .


The threat actors appear to have leveraged publicly available exploit code that can be found on Github at the URL : https://github.com/rxwx/CVE-2017-8570 .


Dropping Elephant ( also known as " Chinastrats " and " Patchwork " ) is a relatively new threat actor that is targeting a variety of high profile diplomatic and economic targets using a custom set of attack tools .


From the attacks observed by Volexity , what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks .


Once started , it downloads additional malware from the C2 and also uploads some basic system information , stealing , among other things , the user 's Google Chrome credentials .


It repeatedly attempts to iterate through directories and to collect files with the following extensions : doc , docx , ppt , pptx , pps , ppsx , xls , xlsx , and pdf .


In this case , a small group reusing exploit code , some powershell-based malware and mostly social engineering has been able to steal sensitive documents and data from victims since at least November 2015 .


In the past few months , Unit 42 has observed the Patchwork group , alternatively known as Dropping Elephant and Monsoon , conducting campaigns against targets located in the Indian subcontinent .


The Patchwork group continues to plague victims located within the Indian subcontinent .


The overarching campaign appears to target both Chinese nationals within different industries and government agencies in Southern Asia .


It appears to have started in December 2015 and is still ongoing as of July 2016 .


The use of weaponized legitimate documents is a longstanding operational standard of Patchwork .


It is dropped by at least one of the weaponised documents17 used in the MONSOON campaign where it is embedded inside another executable .


The majority of the code for TINYTYPHON is taken from the MyDoom worm and has been repurposed to find and exfiltrate documents .


The targeting of Chinese nationals may also be related to this campaign , but equally may be part of a separate campaign by the adversary or even as part of them selling Surveillance-As-A-Service in a similar manner previously seen with the HANGOVER group .


The use of weaponized legitimate documents is a longstanding operational standard of this group .


We decided to spend some time to investigate around this malware and found out that it was used exclusively by a single group of attackers .


The newsnstat.com domain was used earlier in 2015 for previous HANGOVER campaigns , and was then repurposed in December 2015 for the MONSOON campaign .


Our researches around the malware family revealed the " Pitty Tiger " group has been active since 2011 , yet we found traces which makes us believe the group is active since 2010 .


The group exploits known vulnerabilities in Microsoft Office products to infect their targets with malware .


Pitty Tiger group is sometimes using stolen material as spear phishing content to target other persons .


PittyTiger could also use CVE-2014-1761 , which is more recent .


" PittyTiger " is a mutex used by the malware .


This RAT is the origin of the attackers ' group name .


Paladin RAT is another remote administration tool used by the Pitty Tiger group .


Pitty Tiger , like other APT attackers , often use anti-virus " familiar names " when registering domains or creating subdomains .


" Pitty Tiger " is also a string transmitted in the network communications of the RAT .


A recent report documents a group of attackers known as " PittyTiger " that appears to have been active since at least 2011 ; however , they may have been operating as far back as 2008 .


We have been monitoring the activities of this group and believe they are operating from China .


By integrating the findings with prior research , it was possible to connect MONSOON directly with infrastructure used by the HANGOVER group via a series of strong connections .


Backdoor.APT.PittyTiger – This malware is the classic " PittyTiger " malware ( PittyTigerV1.0 ) that was heavily used by this group in 2012 - 2013 .


It also appears the attackers use this as second-stage malware .


The Pitty Tiger group mostly uses spear phishing in order to gain an initial foothold within the targeted environment .


PLATINUM has been targeting its victims since at least as early as 2009 , and may have been active for several years prior .


This section describes the history , behavior , and tactics of a newly discovered targeted activity group , which Microsoft has code-named PLATINUM .


Like many such groups , PLATINUM seeks to steal sensitive intellectual property related to government interests , but its range of preferred targets is consistently limited to specific governmental organizations , defense institutes , intelligence agencies , diplomatic institutions , and telecommunication providers in South and Southeast Asia .


LATINUM makes a concerted effort to hide their infection tracks , by self-deleting malicious components , or by using server side logic in ' one shot mode ' where remotely hosted malicious components are only allowed to load once .


PLATINUM often spear phishes its targets at their non-official or private email accounts , to use as a stepping stone into the intended organization 's network .


PLATINUM uses custom-developed malicious tools and has the resources to update these applications often to avoid being detected .


PLATINUM primarily targets its intended victims using spear phishing .


PLATINUM configures its backdoor malware to restrict its activities to victims ' working hours , in an attempt to disguise post-infection network activity within normal user traffic .


PLATINUM does not conduct its espionage activity to engage in direct financial gain , but instead uses stolen information for indirect economic advantages .


PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts .


For the initial infection , PLATINUM typically sends malicious documents that contain exploits for vulnerabilities in various software programs , with links or remotely loaded components ( images or scripts or templates ) that are delivered to targets only once .


PLATINUM 's approach toward exploiting vulnerabilities varies between campaigns .


n one case from 2013 , the target was sent a malicious document through a spear phishing email message .


When the document was opened in Word , it exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer .


In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves .


Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015 .


In both these campaigns the activity group included remote triggers to deactivate exploitation , with an attempt to conceal the vulnerability , and prevent analysis of the attack .


After gaining access to a victim 's computer , PLATINUM installs its own custom-built malware to communicate with the compromised system , issue commands , and move laterally through the network .


PLATINUM uses a number of different custom-developed backdoors to communicate with infected computers .


This section describes some of the tools used by the group .


The lack of any significant evidence of shared code between any of these backdoor families is another clue as to the scope of the resources on which the activity group is able to draw , and the precautions the group is willing and able to take in order to avoid losing its ability to conduct its espionage operations .


The PLATINUM group has written a few different versions of keyloggers that perform their functions in different ways , most likely to take advantage of different weaknesses in victims ' computing environments .


While one family relies on a small number of supported commands and simple shells , the other delves into more convoluted methods of injections , checks , and supported feature sets .


Both groups can set permissions on specific files to Everyone , and work in tandem with the PLATINUM backdoors .


In particular , this second group also has the capability of dumping users ' credentials using the same technique employed by Mimikatz .


In addition to using several publicly known injection methods to perform this task , it also takes advantage of an obscure operating system feature known as hot patching .


One of PLATINUM 's most recent and interesting tools is meant to inject code into processes using a variety of injection techniques .


Multiple Dipsind variants have been identified , all of which are believed to be used exclusively by PLATINUM .


The group 's most frequently used backdoors belong to a malware family that Microsoft has designated Dipsind , although some variants are detected under different names .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 Administrator permissions are required for hot patching , and the technique used by PLATINUM does not attempt to evade this requirement through exploitation .


PLATINUM has used several zero-day exploits against their victims .


The technique PLATINUM uses to inject code via hot patching was first documented by security researchers in 2013.7 .


PLATINUM has consistently targeted victims within a small set of countries in South and Southeast Asia .


PLATINUM has developed or commissioned a number of custom tools to provide the group with access to victim resources .


Some of the tools used by PLATINUM , such as the port-knocking backdoor , show signs of organized thinking .


Take advantage of native mitigations built into Windows 10 .


For example , the summer 2015 attack that used the unusual ' resume ' would not have been successful on Windows 10 as-is because of the presence of the Supervisor Mode Execution Prevention ( SMEP ) mitigation , even without the latest security updates installed .


Even if CVE-2015-2546 affected Windows 10 , the exploitation would have required much more technical prowess to succeed ; ultimately , SMEP makes it more difficult for attackers .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel® Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication .


Since the 2016 publication , Microsoft has come across an evolution of PLATINUM 's file-transfer tool , one that uses the Intel Active Management Technology ( AMT ) Serial-over-LAN ( SOL ) channel for communication .


We confirmed that the tool did not expose vulnerabilities in the management technology itself , but rather misused AMT SOL within target networks that have already been compromised to keep communication stealthy and evade security applications .


In either case , PLATINUM would need to have gained administrative privileges on targeted systems prior to the feature 's misuse .


The updated tool has only been seen in a handful of victim computers within organizational networks in Southeast Asia—PLATINUM is known to customize tools based on the network architecture of targeted organizations .


One possibility is that PLATINUM might have obtained compromised credentials from victim networks .


During the provisioning process , PLATINUM could select whichever username and password they wish .


The PLATINUM tool is , to our knowledge , the first malware sample observed to misuse chipset features in this way .


Microsoft reiterates that the PLATINUM tool does not expose flaws in Intel® Active Management Technology ( AMT ) , but uses the technology within an already compromised network to evade security monitoring tools .


The discovery of this new PLATINUM technique and the development of detection capabilities highlight the work the Windows Defender ATP team does to provide customers greater visibility into suspicious activities transpiring on their networks .


It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks .


This signals just how long ago the Poseidon threat actor was already working on its offensive framework .


However , Poseidon 's practice of being a ' custom-tailored malware implants boutique ' kept security researchers from connecting different campaigns under the umbrella of a single threat actor .


Poseidon Group is dedicated to running targeted attacks campaigns to aggressively collect information from company networks through the use of spear-phishing packaged with embedded , executable elements inside office documents and extensive lateral movement tools .


The Poseidon Group is a long-running team operating on all domains : land , air , and sea .


The Poseidon Group has been active , using custom code and evolving their toolkit since at least 2005 .


Poseidon has maintained a consistently evolving toolkit since the mid-2000s .


The Poseidon Group actively targets this sort of corporate environment for the theft of intellectual property and commercial information , occasionally focusing on personal information on executives .


PROMETHIUM is an activity group that has been active as early as 2012 .


This malware family is known as " PittyTiger " by the anti-virus community .


NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird .


The previous two volumes of the Microsoft Security Intelligence Report explored the activities of two such groups , code-named STRONTIUM and PLATINUM , which used previously unknown vulnerabilities and aggressive , persistent techniques to target specific individuals and institutions — often including military installations , intelligence agencies , and other government bodies .


PROMETHIUM distributed links through instant messengers , pointing recipients to malicious documents that invoked the exploit code to launch Truvasys on victim computers .


PROMETHIUM is an activity group that has been active since at least 2012 .


Truvasys is a collection of modules written in the Delphi programming language , a variant of Pascal .


While studying Truvasys , Microsoft uncovered a previously undocumented piece of malware known as Myntor that is a completely separate malware family .


Unit 61486 is the 12th Bureau of the PLA 's 3rd General Staff Department ( GSD ) and is headquartered in Shanghai , China .


The CrowdStrike has been tracking this particular unit since 2012 , under the codename PUTTER PANDA , and has documented activity dating back to 2007 .


The CrowdStrike Intelligence team has been tracking this particular unit since 2012 , under the codename PUTTER PANDA , and has documented activity dating back to 2007 .


Parts of the PUTTER PANDA toolset and tradecraft have been previously documented , both by CrowdStrike , and in open source , where they are referred to as the MSUpdater group .


PUTTER PANDA is a determined adversary group , conducting intelligence-gathering operations targeting the Government , Defense , Research , and Technology sectors in the United States , with specific targeting of the US Defense and European satellite and aerospace industries .


According to the hacking collective , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks .


Targeting antivirus companies appears to have been the primary goal of Fxmps' latest network intrusions .


This period started with their seeming disappearance in October 2018 and concluded with their return in April 2019 .


The hacker 's name is Gnosticplayers , and since February 11 the hacker has put up for sale data for 32 companies in three rounds [stories on Round 1 , Round 2 , and Round 3] on Dream Market , a dark web marketplace .


But according to Gnosticplayers , his foray into a public marketplace like Dream has two goals --besides the first and obvious one being money .


Data collected by Secureworks incident response ( IR ) analysts and analyzed by CTU researchers indicates that GOLD LOWELL extorts money from victims using the custom SamSam ransomware .


However , CTU analysis indicates that GOLD LOWELL is motivated by financial gain , and there is no evidence of the threat actors using network access for espionage or data theft .


In 2015 and 2016 , GOLD LOWELL frequently exploited JBoss enterprise applications using several versions of this open-source JBoss exploitation tool .


In 2017 and early 2018 , the group used PowerShell commands to call Mimikatz from an online PowerSploit repository , which is a collection of publicly available PowerShell modules for penetration testing .


Gold Lowell responded by modifying a registry entry to disable the endpoint tool 's scanning functionality .


This methodology , known as " big game hunting " , signals a shift in operations for WIZARD SPIDER , a criminal enterprise of which GRIM SPIDER appears to be a cell .


The WIZARD SPIDER threat group , known as the Russia-based operator of the TrickBot banking malware , had focused primarily on wire fraud in the past .


Similar to Samas and BitPaymer , Ryuk is specifically used to target enterprise environments .


Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release .


Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors .


However , Ryuk is only used by GRIM SPIDER and , unlike Hermes , Ryuk has only been used to target enterprise environments .


Since Ryuk 's appearance in August , the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD .


Hermes ransomware , the predecessor to Ryuk , was first distributed in February 2017 .


In mid-August 2018 , a modified version of Hermes , dubbed Ryuk , started appearing in a public malware repository .


Ryuk was tailored to target enterprise environments and some of the modifications include removing anti-analysis checks .


As mentioned in the Hermes to Ryuk section , Ryuk uses a combination of symmetric ( AES ) and asymmetric ( RSA ) encryption to encrypt files .


For each mounted drive , Ryuk calls GetDriveTypeW to determine the drive 's type .


To retrieve IP addresses that have ARP entries , Ryuk calls GetIpNetTable .


Falcon Intelligence has medium-high confidence that the GRIM SPIDER threat actors are operating out of Russia .


The hackers also started tweeting a few samples of internal emails from the company .


From a process and file perspective , Hermes and Ryuk target files in a similar fashion .


Claudio Guarnieri , a security researcher who has investigated Hacking Team along with others at the Citizen Lab , was quick to point this out .


Their software , once surreptitiously installed on a target 's cell phone or computer , can be used to monitor the target 's communications , such as phone calls , text messages , Skype calls , or emails .


In 2015 and 2016 , Dridex was one of the most prolific eCrime banking trojans on the market and , since 2014 , those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits .


In August 2017 , a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K. 's National Health Service ( NHS ) , with a high ransom demand of 53 BTC ( approximately $200,000 USD ) .


The targeting of an organization rather than individuals , and the high ransom demands , made BitPaymer stand out from other contemporary ransomware at the time .


Though the encryption and ransom functionality of BitPaymer was not technically sophisticated , the malware contained multiple anti-analysis features that overlapped with Dridex .


Later technical analysis of BitPaymer indicated that it had been developed by INDRIK SPIDER , suggesting the group had expanded its criminal operation to include ransomware as a monetization strategy .


The beginning of 2017 also brought a turning point in INDRIK SPIDER 's operation of Dridex .


CrowdStrike® Falcon® Intelligence™ also observed a strong correlation between Dridex infections and BitPaymer ransomware .


During incidents that involved BitPaymer , Dridex was installed on the victim network prior to the deployment of the BitPaymer malware .


Also unusual was the observation that both Dridex and BitPaymer were spread through the victim network using lateral movement techniques traditionally associated with nation-state actors and penetration testing .


The information gathered from these engagements , combined with information from prior Dridex IR engagements , provides insight into how INDRIK SPIDER deploys and operates both Dridex and BitPaymer .


In recent BitPaymer IR engagements , Falcon Intelligence linked the initial infection vector to fake updates for a FlashPlayer plugin and the Chrome web browser .


With the move to targeting select victims for high-value payouts , the INDRIK SPIDER adversary group is no longer forced to scale its operations , and now has the capacity to tailor its tooling to the victim 's environment and play a more active role in the compromise with " hands on keyboard " activity .


These new tactics of selectively targeting organizations for high ransomware payouts have signaled a shift in INDRIK SPIDER 's operation with a new focus on targeted , low-volume , high-return criminal activity : a type of cybercrime operation we refer to as big game hunting .


Later , in January 2018 , a report was released that identified similarities between the BitPaymer ransomware and Dridex malware .


The report authors renamed the malware " FriedEx " .


Though there is no functionality to collect this information in the ransomware itself , the ransomware is deployed by INDRIK SPIDER in parallel with Dridex malware , and the Dridex malware contains modules that may be used to collect information from infected hosts .


Falcon Intelligence has acquired multiple decryption tools related to BitPaymer , which confirm the theory that a unique key is used for each infection .


Unlike many ransomware operations , which usually just require victims to make the payment and subsequently download a decryptor , INDRIK SPIDER requires the victim to engage in communication with an operator .


Falcon Intelligence has had unique insight into the email dialogue between a victim and an INDRIK SPIDER operator .


Initial victim communication with the INDRIK SPIDER operator , using one of the email addresses provided , results in the operator providing key pieces of information up front , such as the BTC address and the ransom amount .


It was made clear during communications that INDRIK SPIDER is not willing to negotiate on the ransom amount , explicitly stating that the victim can use multiple Bitcoin exchanges to obtain the number of BTC required , and the exchange rate should be calculated based on the rate posted on the cryptocurrency exchange Bittrex .


Of note , INDRIK SPIDER specifies the geographical location of where the victim should seek help , confirming that they know key information about the victim .


INDRIK SPIDER uses file sharing platforms to distribute the BitPaymer decryptor .


In an extensive email to the victim , the INDRIK SPIDER operator provides a decryptor download link , decryptor deletion link ( to be used following decryptor download ) and a password .


The recommendations provided are not only good advice , but also provide indications of how INDRIK SPIDER breaches organizations and moves laterally until domain controller access is gained .


Ransom demands have varied significantly , suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization .


INDRIK SPIDER consists of experienced malware developers and operators who have likely been part of the group since the early days of Dridex operations , beginning in June 2014 .


The formation of the group and the modus operandi changed significantly in early 2017 .


Dridex operations became more targeted , resulting in less distribution and Dridex sub-botnets in operation , and BitPaymer ransomware operations began in July 2017 .


There is no doubt that BitPaymer ransomware operations are proving successful for Indrik Spider , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan .


There is no doubt that BitPaymer ransomware operations are proving successful for this criminal group , with an average estimate take of over $200,000 USD per victim , but it is also important to remember that INDRIK SPIDER continues to operate the Dridex banking trojan .


Though Dridex is still bringing in criminal revenue for the actor after almost four years of operation , targeted wire fraud operations likely require lengthy planning .


In scenarios where wire fraud is not as lucrative an option , INDRIK SPIDER might use ransomware to monetize the compromise instead .


INDRIK SPIDER isn't the only criminal actor running big game hunting operations ; The first ransomware to stake a claim for big game hunting was Samas ( aka SamSam ) , which is developed and operated by BOSS SPIDER .


Since they were first identified in January 2-16 , this adversary has consistently targeted large organizations for high ransom demands .


In July 2017 , INDRIK SPIDER joined the movement of targeted ransomware with BitPaymer .


Most recently , the ransomware known as Ryuk came to market in August 2017 and has netted its operators , tracked by Falcon Intelligence as GRIM SPIDER , a significant ( and immediate ) profit in campaigns also targeting large organizations .


The LUNAR SPIDER threat group is the Eastern European-based operator and developer of the commodity banking malware called BokBot ( aka IcedID ) , which was first observed in April 2017 .


The BokBot malware provides LUNAR SPIDER affiliates with a variety of capabilities to enable credential theft and wire fraud , through the use of webinjects and a malware distribution function .


campaigns involving both BokBot and TrickBot were first identified by CrowdStrike Intelligence in July 2017 .


These gtags have been closely associated with LUNAR SPIDER activity .


Unit 42 followed network traces and pivoted on the information left behind by this actor , such as open directories , document metadata , and binary peculiarities , which enabled us to find a custom-made piece of malware , that we named " CapturaTela " .


Our telemetry for this campaign identified email as the primary delivery mechanism and found the first related samples were distributed in August 2018 .


Aside from the use of the custom trojan CapturaTela , the actor makes extensive use of several other remote access Trojans to perform its malicious activities .


Why would OurMine want to target WikiLeaks .


Instead , OurMine had managed to alter WikiLeaks 's DNS records ( held by a third-party registrar ) to direct anyone who tried to visit wikileaks.org to visit a different IP address which definitely wasn't under the control of Julian Assange and his cronies .


We don't know how OurMine managed to access WikiLeaks 's DNS records , but past experience has shown that their typical modus operandi is simply to log in using their victim 's password .


Alternatively , OurMine might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address .


Alternatively , the attackers might have used social engineering to trick WikiLeaks 's DNS provider into handing over the credentials , or simple requested that a password reset link be sent to a compromised email address .


Known for hijacking prominent social media accounts , the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network .


Last year , OurMine victimized Marvel , The New York Times , and even the heads of some of the biggest technology companies in the world .


The group is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


OurMine is well known : They hijacked WikiLeaks' DNS last month shortly after they took over HBO 's Twitter account ; last year , they took over Mark Zuckerberg 's Twitter and Pinterest accounts ; and they hit both BuzzFeed and TechCrunch not long after that .


The group 's primary goal is demonstrating to companies that they have weak security .


US intelligence agencies pinned the breach on North Korea ( one of the hacking group 's demands was that Sony pull The Interview , Seth Rogan 's comedy about a plot to assassinate Kim Jong-Un ) .


The cryptominer employed by Pacha Group , labeled Linux.GreedyAntd by Intezer , was completely undetected by all leading engines , demonstrating the sophistication of this malware .


Intezer has evidence dating back to September 2018 which shows Pacha Group has been using a cryptomining malware that has gone undetected on other engines .


The new miner employed by Pacha Group , named Linux.GreedyAntd , has shown to be more sophisticated than the average Linux threat , using evasion techniques rarely seen in Linux malware .


We have labeled the undetected Linux.Antd variants , Linux.GreedyAntd and classified the threat actor as Pacha Group .


Based on our findings Linux.GreedyAntd 's operations closely resemble previous cryptojacking campaigns deployed by Pacha Group in the past .


It was one of the few ransomware strains that were being mass-distributed via email spam and exploit kits , but also as part of targeted attacks against high-profile organizations ( a tactic known as big-game hunting ) at the same time .


The GandCrab author also had a spat with South Korean security vendor AhnLab last summer after the security firm released a vaccine for the GandCrab ransomware .


Recently , Sophos Labs has observed criminal groups scanning the internet for open MySQL databases running on Windows systems , which they tried to infect with GandCrab .


CrowdStrike Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams .


Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February .


CrowdStrike® Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments , using lateral movement techniques and tooling commonly associated with nation-state adversary groups and penetration testing teams .


PINCHY SPIDER is the criminal group behind the development of the ransomware most commonly known as GandCrab , which has been active since January 2018 .


PINCHY SPIDER sells access to use GandCrab ransomware under a partnership program with a limited number of accounts .


The main catalyst for dedicated development by PINCHY SPIDER , however , has been an ongoing battle with cybersecurity providers that are actively developing GandCrab mitigations and decryptors .


In February , PINCHY SPIDER released version 5.2 of GandCrab , which is immune to the decryption tools developed for earlier versions of GandCrab and in fact , was deployed the day before the release of the latest decryptor .


CrowdStrike Intelligence first identified new GandCrab ransomware deployment tactics in mid-February , when a threat actor was observed performing actions on a victim host in order to install GandCrab .


Using RDP and stolen credentials from the initially compromised host , the threat actor then proceeded to move laterally around the victim network and was able to deploy GandCrab across several other hosts .


Near the end of February , CrowdStrike Intelligence observed another incident in which similar manual lateral movement techniques were used to deploy GandCrab across multiple hosts in an enterprise .


Once Domain Controller access was acquired , Pinchy Spider used the enterprise 's own IT systems management software , LANDesk , to deploy a loader to hosts across the enterprise .


As reported in the CrowdStrike 2018 Global Threat Report , big game hunting was a trend that helped define the criminal threat landscape in 2018 .


BOSS SPIDER used both enterprise and per-host pricing during their campaigns .


Both INDRIK SPIDER ( with BitPaymer ransomware ) and GRIM SPIDER ( with Ryuk ransomware ) have made headlines with their high profile victims and ransom profits , demonstrating that big game hunting is a lucrative enterprise .


Running successful big game hunting operations results in a higher average profit per victim , allowing adversaries like PINCHY SPIDER and their partners to increase their criminal revenue quickly .


The threat actor Rocke was originally revealed by Talos in August of 2018 and many remarkable behaviors were disclosed in their blog post .


The family was suspected to be developed by the Iron cybercrime group and it's also associated with the Xbash malware we reported on in September of 2018 .


The threat actor Rocke was first reported by Cisco Talos in late July 2018 .


The ultimate goal of this threat is to mine Monero cryptocurrency in compromised Linux machines .


To deliver the malware to the victim machines , the Rocke group exploits vulnerabilities in Apache Struts 2 , Oracle WebLogic , and Adobe ColdFusion .


To be more specific , the malware uninstalls cloud security products by Alibaba Cloud and Tencent Cloud .


Public cloud infrastructure is one of the main targets for Rocke .


FortiGuard Labs has been monitoring a Linux coin mining campaign from " Rocke " – a malware threat group specializing in cryptomining .


The malicious bash script components of the malware are hosted in Pastebin , with the profile name " SYSTEMTEN " , which is very similar to previous names used by the " Rocke " threat group .


By utilizing a hook library , it is more complicated for users to manually detect and remove the infection from their systems , giving the threat actors more time to generate profit .


A mysterious hacker or hackers going by the name " The Shadow Brokers " claims to have hacked a group linked to the NSA and dumped a bunch of its hacking tools .


The Shadow Brokers claimed to have hacked the Equation Group and stolen some of its hacking tools .


The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites .


The Shadow Brokers , the group that publicly dumped a cache of NSA hacking tools , appears to be back and ready to sell stolen material on an individual basis .


Wh1sks estimated that , between June and early August , the Shadow Brokers have made up to $88,000 in an alternative cryptocurrency called Monero .


Moreover , Wh1sks was able to find out the email addresses of five people who have subscribed to the Shadow Brokers' monthly dump service .


Buried among this new treasure trove , there are several mentions of previously disclosed NSA top secret programs and software such as " STRAITBIZARRE " , used to control implants remotely , and " JEEPFLEA " , a project to hack the money transferring system SWIFT .


The Shadow Brokers have long claimed that the tools they release are from the " Equation Group " , the name of a government hacking group outed by Kaspersky Lab in 2015 , which is widely believed to be the NSA .


Recently , FireEye released a great report on one of the more active groups , now known as APT30 .


In addition , Kaspersky discovered that the Winnti group uses a popular backdoor known as PlugX which also has Chinese origins .


Previous work published by security vendor FireEye in October 2014 suggests APT28 might be of Russian origin .


After publishing our initial series of blogposts back in 2016 , Kaspersky has continued to track the ScarCruft threat actor .


Kaspersky also discovered an interesting piece of rare malware created by this threat actor ScarCruft .


Kaspersky witnessed the ScarCruft threat actor extensively testing a known public exploit during its preparation for the next campaign .


Based on our telemetry , Kaspersky can reassemble ScarCruft’s binary infection procedure .


In addition , Kaspersky analyzed the victims of this campaign and spotted an interesting overlap of this campaign with another APT actor known as DarkHotel .


Secureworks researchers investigated activities associated with the BRONZE BUTLER (also known as Tick) threat group , which likely originates in the People .


However , an investigation by Symantec has found that Butterfly has been active since at least March 2012 and its attacks have not only continued to the present day , but have also increased in number .


Talos assesses with high confidence that Group 123 was responsible for six campaigns .


Attacks launched by Scarlet Mimic were publicly exposed on 2013 in a Trend Micro report about the FakeM Trojan .


Finally , Talos identified a 6th campaign that is also linked to Group 123 .


As Talos observed at the beginning of 2017 , Group 123 started a campaign corresponding with the new year in 2018 .


Last month , researchers at Kaspersky reported on a Lazarus APT campaign targeting both macOS and Windows users .


Cylance uncovered several bespoke backdoors deployed by the OceanLotus APT Group a.k.a APT32 , Cobalt Kitty .


While continuing to monitor activity of the OceanLotus APT Group , Cylance researchers uncovered a novel payload loader that utilizes steganography to read an encrypted payload concealed within a .png image file .


This confirms Tropic Trooper is using Poison Ivy as part of their toolkit , something speculated in the original Trend Micro report but not confirmed by them .


ESET researchers will continue monitoring new Turla activities and will publish relevant information on our blog .


ESET researchers analyze new TTPs attributed to the Turla group that leverage PowerShell to run malware in-memory only .


ESET have been tracking the malicious activities related to the Ke3chang group .


According to Kaspersky Lab’s report , NetTraveler has been active since as early as 2004; however , the highest volume of activity occurred from 2010 – 2013 .


Kaspersky Lab’s experts calculated the amount of stolen data stored on NetTraveler’s C&C servers to be more than 22 gigabytes .


This report details some of the technical findings of the Lazarus Group’s malware , observed by Novetta during Operation Blockbuster .


The Lazarus Group was first identified in Novetta’s report Operation Blockbuster in February 2016 .


FireEye has not identified APT33 using SHAPESHIFT , but APT33 is the only group FireEye has seen to use DROPSHOT .


In 2018 , Kaspersky Labs published a report that analyzed Turla threat group .


Starting in February 2018 , Palo Alto identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom , Spain , Russia , and the United States .


Insikt Group investigated the domain and hosting infrastructure used by the APT33 group .


Symantec discovered Suckfly , an advanced threat group , conducting targeted attacks using multiple stolen certificates , as well as hacktools and custom malware .


In April Novetta released its excellent report on the Winnti malware spotted in the operations of Axiom group .


A few days ago , Symantec discovered a new document that appears to be part of the ongoing BlackEnergy APT group attacks against Ukraine .


While analyzing a campaign run by the Gamaredon group , FortiGuard Labs discovered the tools they used to prepare the attack and found artifacts left behind by the actors that allowed us to perform a large amount of forensic analysis .


In this blog , Unit 42 provides details of the tools and tactics we observed on these compromised SharePoint servers , explain how we believe these connect to the Emissary Panda threat group .


QiAnXin identified this APT group coded as ‘APT-C-35’ in 2017 , who is mainly targeting Pakistan and other South Asian countries for cyber espionage .


CTU researchers assess with moderate confidence that APT28 is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government .


It is worth noting that during our investigation f-secure uncovered links between infrastructure associated with the Callisto Group and infrastructure used to host online stores selling controlled substances .


As Unit 42 have observed throughout our tracking of the OilRig group , adopting proven tactics has been a common behavior over time .


The OceanLotus group was first revealed and named by QiAnXin in May 2015 .


The OceanLotus , an APT group said to have a Vietnamese background , was first exposed and named by QiAnXin in May 2015 .


The QiAnXin keeps a close eye on activities made by OceanLotus .


Donot , named and tracked by PatchSky , is an attack group that mainly targets countries such as Pakistan in South Asia .


After investigation , QiAnXin suspect this attack is carried out by Molerats .


In June 2017 , QiAnXin discovered new malware used by Molerats .


Last month , QiAnXin captured multiple phishing emails sent by TA505 Group to target financial institutions .


QiAnXin confirmed that this is a DarkHydrus Group’s new attack targeting Middle East region .


First described by Kaspersky in 2014 and later by Cylance in 2017 , Machete is a piece of malware found to be targeting high profile individuals and organizations in Latin American countries .


It’s now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware , ” said Dennis Schwarz , research analyst on Arbor , in an interview with Threatpost .


After thorough analysis , ESET researchers are highly confident that this campaign is run by the OceanLotus group , also known as APT32 and APT-C-00 .


360 Helios Team captured the first Trojan of the Poison Ivy Group in December 2007 .


Through research , 360 Helios Team has found that , since 2007 , the Poison Ivy Group has carried out 11 years of cyber espionage campaigns against Chinese key units and departments , such as national defense , government , science and technology , education and maritime agencies .


In addition , Antiy Lab revealed the APT organization Green Spot on September 19 , 2018 .


Recently , the 360 Core Security discovered an APT attack code named as APT-C-26 against cryptocurrency institutions and related individuals .


This APT attack was analyzed and attributed upon the detection and 360 Core Security now confirmed its association with the APT-C-06 Group .


ESET researchers have dissected some of the latest additions to the malicious toolkit of the Advanced Persistent Threat (APT) group known as OceanLotus , also dubbed APT32 and APT-C-00 .


Earlier this year , our colleagues at Symantec uncovered an interesting story about the use of Equation group exploitation tools by an alleged Chinese group named Buckeye a.k.a APT3 , or UPS team .


In addition , OceanLotus is also known to use ‘watering hole attacks’ , which involve the compromise of a website that the victim is likely to visit .


Kaspersky found Zebrocy deploying a compiled Python script , which we call PythocyDbg , within a Southeast Asian foreign affairs organization: this module primarily provides for the stealthy collection of network proxy and communications debug capabilities .


ESET researchers have investigated a distinctive backdoor used by the notorious APT group known as Turla (or Snake , or Uroburos) to siphon off sensitive communications from the authorities of at least three European countries .


Dragos has reported that XENOTIME , the APT group behind the TRISIS (aka TRITON and HatMan) attack on a Saudi Arabian petro-chemical facility in 2017 , has expanded its focus beyond the oil and gas industries .


ESET researchers have observed a significant change in the campaign of the infamous espionage group .


On the technical side , since mid-January Kaspersky researchers have been tracking an active Turla campaign targeting government bodies in Turkmenistan and Tajikistan .


Kaspersky also published details on how Zebrocy has added the Go” language to its arsenal – the first time that we have observed a well-known APT threat actor deploy malware with this compiled , open source language .


ESET researchers have found that Turla , the notorious state-sponsored cyberespionage group , has added a fresh weapon to its arsenal that is being used in new campaigns targeting embassies and consulates in the post-Soviet states .


Turla has been operating for a number of years and its activities have been monitored and analyzed by ESET research laboratories .


Kaspersky researchers attribute the campaign , which we call SpoiledLegacy” , to the LuckyMouse APT group (aka EmissaryPanda and APT27) .


Further tracking of the Lazarus’s activities has enabled Kaspersky researchers to discover a new operation , active since at least November 2018 , which utilizes PowerShell to control Windows systems and Mac OS malware to target Apple customers .


The group has demonstrated access to zero-day vulnerabilities (CVE-2018-0802) , and the ability to incorporate them into operations .


More information on this threat actor is found in our report , APT37 (Reaper): The Overlooked North Korean Actor .


There have been reports of real-time phishing in the wild as early as 2010 .


Explanation of ToolTo improve social engineering assessments , we developed a tool – named ReelPhish – that simplifies the real-time phishing technique .


We assess with high confidence that this activity is carried out on behalf of the North Korean government given malware development artifacts and targeting that aligns with North Korean state interests .


Known targets of this group have been involved in the maritime industry , as well as engineering-focused entities , and include research institutes , academic organizations , and private firms in the United States .


By releasing ReelPhish , we at Mandiant hope to highlight the need for multiple layers of security and discourage the reliance on any single security mechanism .


The group has also been reported as Leviathanby other security firms .


Like multiple other Chinese cyber espionage actors , TEMP.Periscope has recently re-emerged and has been observed conducting operations with a revised toolkit .


The tool then starts a new web browser instance on the attacker’s system and submits credentials on the real VPN portal .


These tools include:AIRBREAK: a JavaScript-based backdoor also reported as Orz that retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services.BADFLICK: a backdoor that is capable of modifying the file system , generating a reverse shell , and modifying its command and control (C2) configuration .


HOMEFRY: a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors .


The following are tools that TEMP.Periscope has leveraged in past operations and could use again , though these have not been seen in the current wave of activity:Beacon: a backdoor that is commercially available as part of the Cobalt Strike software platform , commonly used for pen-testing network environments .


This entry was posted on Fri Mar 16 00:00 EDT 2018 and filed under Targeted Attacks , FireEye , and China .


Read our report , APT37 (Reaper): The Overlooked North Korean Actor , to learn more about our assessment that this threat actor is working on behalf of the North Korean government , as well as various other details about their operations .


A brief timeline of this activity is shown in Figure 1.Figure 1: Timeline of this recently observed spear phishing campaign .


One such email that we were able to obtain was targeting users in Turkey , as shown in Figure 4:Figure 4: Sample spear phishing email containing macro-based document attachment The malicious Microsoft Office attachments that we observed appear to have been specially crafted for individuals in four countries: Turkey , Pakistan , Tajikistan and India .


Users who failed to patch their systems may find themselves mining cryptocurrency for threat actors .


This entry was posted on Tue Mar 13 12:15 EDT 2018 and filed under Yogesh Londhe , Dileep .


If the lateral movement with credentials fails , then the malware uses PingCastle MS17-010 scanner (PingCastle is a French Active Directory security tool) to scan that particular host to determine if its vulnerable to EternalBlue , and uses it to spread to that host .


The malware checks whether its running on a 32-bit or 64-bit system to determine which PowerShell script to grab from the command and control (C2) server .


Notably , cryptocurrency mining malware is being distributed using various tactics , typically in an opportunistic and indiscriminate manner so cyber criminals will maximize their outreach and profits .


They have taken interest in subject matter of direct importance to the Democratic People's Republic of Korea (DPRK) such as Korean unification efforts and North Korean defectors .


Historically , the majority of their targeting has been focused on the South Korean government , military , and defense industrial base .


While we have observed other suspected North Korean threat groups such as TEMP.Hermit employ wiper malware in disruptive attacks , we have not thus far observed TEMP.Reaper use their wiper malware actively against any targets .


In the past year , FireEye iSIGHT Intelligence has discovered newly developed wiper malware being deployed by TEMP.Reaper , which we detect as RUHAPPY .


FireEye products have robust detection for the malware used in this campaign .


Infection VectorWe have observed this recent wave of Zyklon malware being delivered primarily through spam emails .


Figure 2: Zyklon attack flowInfection Techniques CVE-2017-8759 .


This vulnerability was discovered by FireEye in September 2017 , and it is a vulnerability we have observed being exploited in the wild .


We have observed this recent wave of Zyklon malware being delivered primarily through spam emails .


Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly , we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office .


It follows Stuxnet which was used against Iran in 2010 and Industroyer which we believe was deployed by Sandworm Team against Ukraine in 2016 .


Command & Control Communication The C2 communication of Zyklon is proxied through the Tor network .


At this time of writing , FireEye Multi Vector Execution (MVX) engine is able to recognize and block this threat .


The targeting of critical infrastructure to disrupt , degrade , or destroy systems is consistent with numerous attack and reconnaissance activities carried out globally by Russian , Iranian , North Korean , U.S. , and Israeli nation state actors .


Specifically , the following facts support this assessment: The attacker targeted the SIS suggesting an interest in causing a high-impact attack with physical consequences .


First , the attacker’s mission is to disrupt an operational process rather than steal data .


The TRITON malware contained the capability to communicate with Triconex SIS controllers .


the attacker did not leverage all of TRITON’s extensive reconnaissance capabilities .


For instance , Russian operators , such as Sandworm Team , have compromised Western ICS over a multi-year period without causing a disruption .


We assess that this was an anti-forensics technique to hide the presence of the attacker code on the Triconex controller .


This entry was posted on Thu Dec 14 10:00 EST 2017 and filed under Malware , Nathan Brubaker , Christopher Glyer , Blake Johnson , Dan Caban , Marina Krotofil , ICS Security , and Dan Scali .


Keeping in mind the sensitivity of passwords , GoCrack includes an entitlement-based system that prevents users from accessing task data unless they are the original creator or they grant additional users to the task .


Throughout 2017 , we observed two versions of BACKSWING and saw a significant increase in May with an apparent focus on compromising Ukrainian websites .


This entry was posted on Tue Nov 28 14:00 EST 2017 and filed under Malware , Sandor Nemes , Malware Analysis , and Abhay Vaish .


FireEye network devices blocked infection attempts at over a dozen victims primarily in Germany , Japan , and the U.S until Oct. 24 at 15:00 UTC , when the infection attempts ceased and attacker infrastructure – both 1dnscontrol.com and the legitimate websites containing the rogue code – were taken offline .


FireEye observed that BACKSWING , a malicious JavaScript profiling framework , was deployed to at least 54 legitimate sites starting as early as September 2016 .


Beginning in May 2017 , FireEye observed a number of Ukrainian websites compromised with BACKSWING v1 , and in June 2017 , began to see content returned from BACKSWING receivers .


FireEye observed this framework on compromised Turkish sites and Montenegrin sites over the past year .


The developer consistently used Accept-Enconding” (note the extra ‘n’) in all DanBot samples analyzed by CTU researchers .


Previous versions were described by Kaspersky in 2014 and Cylance in 2017 .


The GoogleUpdate.exe component is responsible for communicating with the remote C&C server .


This way , the malware can have its configuration , malicious binaries and file listings updated , but can also download and execute other binaries .


They also download apks secretly and record audios and videos , then upload users’ privacy information to server , causing users’ privacy leakage .


The SectorJ04 group mainly utilizes a spear phishing email with MS Word or Excel files attached , and the document files downloads the Microsoft Installer (MSI) installation file from the attacker server and uses it to install backdoor on the infected system .


Backdoor installed in the infected system distributed additional botnet malware , ransomware and email stealers .


The email stealer collects connection protocol information and account information , such as SMTP , IMAP , and POP3 , which are stored in the registry by Outlook and Thunderbird mail clients and sends them to the attacker server in a specific format .


The threat actor’s emails usually contain a picture or a link without a malicious payload and are sent out to a huge recipient database of up to 85 , 000 users .


Group-IB has also detected recon emails sent out to New Zealand .


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer .


Group-IB specialists tracked a massive mailout of emails containing a malicious Microsoft Word attachment titled Договор.doc” [Contract.doc] .


On 24 March 2019 , Silence.ProxyBot (MD5 2fe01a04d6beef14555b2cf9a717615c) was uploaded to VirusTotal from an IP address in Sri Lanka .


To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank .


The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine .


Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe .


These malware families have a rich history of being used in many targeted attacks against government and private organizations .


The samples we analyzed originated from the Philippines .


PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more .


TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution .


Of note , FireEye discovered two additional new malware families hosted at this domain , VALUEVAULT and LONGWATCH .


PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file .


Banks in countries such as Russia , the United Kingdom , the Netherlands , Spain , Romania , Belarus , Poland , Estonia , Bulgaria , Georgia , Moldova , Kyrgyzstan , Armenia , Taiwan and Malaysia have allegedly been targeted with spearphishing emails , luring victims into clicking malicious URLs and executing booby-trapped documents .


The other overlapping files are tools used by the adversary to locate other systems on the network (etool.exe) , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 (checker1.exe) and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) .


Also , the NCSC advisory mentioned that the actors used a file name stylecss.aspx for their webshell , which is the same filename we saw associated with China Chopper .


We will provide an analysis of the HyperBro tool in an upcoming section .


Figure 9 shows a code comparison between the PYTHON33.dll (right) and inicore_v2.3.30.dll (left) (SHA256: 4d65d371a789aabe1beadcc10b38da1f998cd3ec87d4cc1cfbf0af014b783822) , which was sideloaded to run the SysUpdate tool in a previous Emissary Panda campaign .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 .


The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method .


In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger .


The main payload is usually Imminent Monitor RAT ; however , at the beginning of 2018 , we also observed the use of LuminosityLink RAT , NetWire RAT , and NjRAT .


In a case in June 2019 , we also noticed Warzone RAT being used .


Xpert RAT reportedly first appeared in 2011 .


The first version of Proyecto RAT” was published at the end of 2010 .


Similar to previous campaigns , the JAR was directly attached to emails and used file names such as Order_2018.jar .


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework .


On June 24 , we found another campaign targeting Lebanon with the ServHelper malware .


Nonetheless , these spam emails were not delivered to the UAE or Arabic-speaking users , but to banks in Asian countries such as India , Indonesia , and the Philippines .


The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 .


To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills. In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks .


The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability .


This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April .


Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits .


On Nov14 , 2017 , FireEye observed APT34 using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack .


Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent .


The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 .


The attackers stole organizations' SSL certificates associated with security appliances such as ASA to obtain VPN credentials , allowing the actors to gain access to the targeted network .


More importantly , one of these files also enables the download of TeamViewer , a remote access tool that gives threat actors remote control over the system .


The agency's hacking division freed it from having to disclose its often controversial operations to the NSA (its primary bureaucratic rival) in order to draw on the NSA's hacking capacities .


After infestation , Weeping Angel places the target TV in a 'Fake-Off' mode , so that the owner falsely believes the TV is off when it is on .


The CIA's Mobile Devices Branch (MDB) developed numerous attacks to remotely hack and control popular smart phones .


These techniques permit the CIA to bypass the encryption of WhatsApp , Signal , Telegram , Wiebo , Confide and Cloackman by hacking the smart phones that they run on and collecting audio and message traffic before encryption is applied .


The CIA also runs a very substantial effort to infect and control Microsoft Windows users with its malware .


we assess with high confidence that these incidents were conducted by APT10 also known as Stone Panda , menuPass , CVNX in an effort to gain access to networks and steal valuable intellectual property or gain commercial advantage .


Utilizing actors working for shell companies such as Huaying Haitai Science and Technology Development Co Ltd , the MSS has conducted an unprecedented campaign , dubbed Operation Cloud Hopper , ” against managed IT service providers (MSPs) designed to steal intellectual property and enable secondary attacks against their clients .


We assess that APT10 likely compromised Visma with the primary goal of enabling secondary intrusions onto their client networks , and not of stealing Visma intellectual property .


In this same time frame , APT10 also targeted a U.S. law firm and an international apparel company , likely to gather information for commercial advantage .


Access to the networks of these third-party service providers grants the MSS the ability to potentially access the networks of hundreds , if not thousands , of corporations around the world .


In all three incidents , the attackers gained access to networks through deployments of Citrix and LogMeIn remote-access software using stolen valid user credentials .


In early 2017 , APT10 began conducting attacks against global managed IT service providers (MSPs) that granted them unprecedented access to MSPs and their customers’ networks .


This was followed by an initial exploitation , network enumeration , and malicious tool deployment on various Visma endpoints within two weeks of initial access .


They also used WinRAR and cURL for Windows , both often renamed , to compress and upload the exfiltrated files from the Visma network to the Dropbox API .


The attackers used the same method of lateral movement by mounting the remote drive on a system , copying 1.bat to it , using task scheduler to execute the batch script , and finally , deleting the batch script .


APT10's unprecedented campaign against MSPs , alleged to have included some of the largest MSPs in the world , in order to conduct secondary attacks against their clients , grants the Chinese state the ability to potentially access the networks of hundreds (if not thousands) of corporations around the world .


What lied beneath this facade was a well-engineered campaign of phishing attacks designed to steal credentials and spy on the activity of dozens of journalists , human rights defenders , trade unions and labour rights activists , many of whom are seemingly involved in the issue of migrants’ rights in Qatar and Nepal .


It appears that the attackers may have impersonated the identity of a real young woman and stole her pictures to construct the fake profile , along with a professional biography also stolen from yet another person .


In theory , Shun Wang Technologies could have collected a third of China’s population names and contact numbers if not more .


With no clear declaration of usage from Shun Wang , nor proper regulatory supervision , such data could circulate into underground markets for further exploit , ranging from rogue marketing , targeted telephone scams or even friend referral program abuse during November’s Single’s Day and December’s Asian online shopping fest .


APT41 has executed multiple software supply chain compromises , gaining access to software companies to inject malicious code into legitimate files before distributing updates .


Learning to access video game production environments enabled APT41 to develop the tactics , techniques , and procedures (TTPs) that were later leveraged against software companies to inject malicious code into software updates .


We believe that like other Chinese espionage operators , APT41 has moved toward strategic intelligence collection and establishing access , but away from direct intellectual property theft .


In June 2018 , APT41 sent spear-phishing emails using an invitation lure to join a decentralized gaming platform linked to a cryptocurrency service (Figure 5) that had positioned itself as a medium of exchange for online games and gambling sites .


We suggest that APT41 sought to target in-game currency but found they could not monetize the specific targeted game , so the group resorted to ransomware to attempt to salvage their efforts and profit from the compromise .


In addition to the aforementioned post-exploitation tools , the actors used these webshells to upload legitimate executables that they would use DLL sideloading to run a malicious DLL that has code overlaps with known Emissary Panda attacks .


The other overlapping files are tools used by the adversary to locate other systems on the network (etool.exe) , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 (checker1.exe) and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) .


The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 .


To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills. In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks .


The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability .


This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April .


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework .


Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits .


On Nov14 , 2017 , FireEye observed APT34 using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack .


Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent .


The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 .


Due to these changes without a new date string , we believe the date codes are used for campaign tracking rather than a Bookworm build identifier .


In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task .


The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon .