In November 2018 , Silence tried their hand at targeting the Asian market for the first time in their history .


In total , Silence sent out about 80 , 000 emails , with more than half of them targeting Taiwan , Malaysia , and South Korea .


Prior to April 2018 , as described in Group-IB’s Silence: Moving into the darkside report , Silence’s target interests were primarily limited to former Soviet and Eastern European countries including Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan .


From 16 October 2018 to 1 January 2019 , Silence sent out about 84 , 000 emails in Russia alone to update their address database .


As part of their phishing campaigns , silence still uses Microsoft Office documents with macros or exploits , CHM files , and .LNK shortcuts as malicious attachments .


In the former Soviet Union , Silence targeted banks in Kyrgyzstan , Kazakhstan , and Ukraine .


The Silence.Main Trojan , which is the main stage of the attack , has a full set of commands to control a compromised computer .


As the CnC server , Silence use CnC-3 server running Windows , from which they send commands to download additional modules .


To control ATMs , the group uses the Atmosphere Trojan , which is unique to Silence , or a program called xfs-disp.exe .


In addition , Silence downloads the reverse proxy programs Silence.ProxyBot and Silence. ProxyBot.NET , which are described in detail in the report Silence: moving into the darkside .


Analysis of the emails has shown that the attachment contains an exploit for the CVE-2017-11882 vulnerability .


Group-IB specialists tracked a massive mailout of emails containing a malicious Microsoft Word attachment titled Договор.doc” [Contract.doc] .


Silence sent out emails to Russian banks .


Silence conducted a massive phishing campaign posing as the Central Bank of the Russian Federation .


Silence attacked financial organisations in the UK .


Silence conducted the first stage of their Asian campaign , organising a massive phishing attack aimed at receiving an up-to-date list of current recipients in different countries for further targeted attacks delivering their malicious software .


The attackers used the server deployed on 6 June 2019 to control compromised workstations in these banks .


On 24 March 2019 , Silence.ProxyBot (MD5 2fe01a04d6beef14555b2cf9a717615c) was uploaded to VirusTotal from an IP address in Sri Lanka .


On October 18th , 2018 , the group sent out emails to British financial companies as part of their preparatory campaign .


Group-IB experts established that the server 185.20.187.89 started functioning no later than 28 January 2019 .


According to local media reports , in 2019 Silence successfully withdrew money from the Bangladeshi bank twice within 2 months .


To do this , the actor may have used a unique tool called Atmosphere , a Trojan developed by Silence to remotely control ATM dispensers , or a similar program called xfs-disp.exe , which the actor may have used in their attack on IT Bank .


As we described in Silence: Moving into the darkside report , Silence has experience with theft using compromised card processing systems .


In February 2019 , Russian media7 reported a Silence attack on IT Bank in the city of Omsk .


On 16 January 2019 , Silence sent out phishing emails with malicious attachments disguised as invitations to the International Financial Forum iFin-2019 (see section ‘Attack timeline’) .


Group-IB specialists determined that the email addresses of IT bank employees were among the recipients of these emails .


The main goal of Silence.Downloader is to receive an executable file and run it on an infected machine .


Since at least 2011 , these hackers have been using malware to spy on corporate networks .


Hackers are targeting high-tech companies as well as chemical and pharmaceutical companies .


The corporation conrms the Winnti incident and issues the following statement: The cyberattack was discovered in the summer of 2014 and Henkel promptly took all necessary precautions.” Henkel claims that a very small portion” of its worldwide IT systems had been aected — the systems in Germany .


A BASF spokeswoman tells us in an email that in July 2015 , hackers had successfully overcome the rst levels” of defense .


The tool was written by sta of Thyssenkrupp , because the industrial giant—company number eleven—had been spied on by Winnti .


Hackers are charged with spying on a manufacturer of gas turbines .


The Hong Kong government was spied on by the Winnti hackers .


Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX .


While OceanLotus’ targets are global , their operations are mostly active within the APAC region which encompasses targeting private sectors across multiple industries , foreign governments , activists , and dissidents connected to Vietnam .


NewsBeef attacks against Saudi Arabian organizations and individuals (as well as targets in the European Union) are likely to continue .


Rapid7 discovered that additional data was placed into the Dropbox accounts under control of the APT10 during the compromise and was able to attribute data that was placed into it as being owned by Visma .


Rapid7 again observed APT10 dropping payloads named ccSEUPDT.exe .


These RAT families are discussed in Novetta’s other report on the Lazarus Group’s RAT and Staging capabilities .


Magic Hound has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia .


Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a cyber espionage operation to collect information from defense , aerospace and petrochemical organizations .


CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash .


CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering .


Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East (including targets inside Iran itself) , as well as across Europe and in the United States .


These malware families have a rich history of being used in many targeted attacks against government and private organizations .


The activity surfaced in Southeast Asia , a region where APT10 frequently operates .


The samples we analyzed originated from the Philippines .


APT10 frequently targets the Southeast Asia region .


Both of the loader’s variants and their various payloads that enSilo analyzed share similar Tactics , Techniques , and Procedures (TTPs) and code associated with APT10 .


Over the past three months , Recorded Future’s Insikt Group has observed an increase in APT33’s also known as Elfin infrastructure building and targeting activity , and on June 21 , 2019 , Yahoo .


News reported that the U.S. Cyber Command launched cyberattacks on an Iranian spy group .


Iranian state-sponsored threat actor APT33 has been conducting cyberespionage activity since at least 2013 , predominantly targeting nations in the Middle East , but also notably targeting U.S. , South Korean , and European commercial entities across a wide variety of sectors .


Our research found that APT33 , or a closely aligned threat actor , continues to conduct and prepare for widespread cyberespionage activity , with over 1 , 200 domains used since March 28 , 2019 and with a strong emphasis on using commodity malware .


The targeting of mainly Saudi Arabian organizations across a wide variety of industries aligns with historical targeting patterns for the group , which appear undeterred following previous exposés of their activity .


Towards the end of April 2019 , we tracked down what we believe to be new activity by APT10 , a Chinese cyber espionage group .


Almost 60% of the suspected APT33 domains that were classified to malware families related to njRAT infections , a RAT not previously associated with APT33 activity .


Other commodity RAT malware families , such as AdwindRAT and RevengeRAT , were also linked to suspected APT33 domain activity .


APT33 is an Iranian state-sponsored threat actor that has engaged in cyberespionage activities since at least 2013 .


Western and Saudi organizations in industries that have been historically targeted by APT33 should be monitoring geopolitical developments and increasing the scrutiny of operational security controls focusing on detection and remediation of initial unauthorized access , specifically from phishing campaigns , webshells .


Symantec’s Elfin report denoted additional targeting of the engineering , chemical , research , finance , IT , and healthcare sectors .


We assess that the recent reporting on links between the Nasr Institute and Kavosh Security Group , as well as technical and persona analysis , overlaps among APT33 , APT35 , and MUDDYWATER , and is probably a result of the tiered structure that Iran utilizes to manage cyber operations .


Recorded Future has been monitoring APT33 activity , beginning with research published in October 2017 , which revealed new infrastructure , malware hashes , and TTPs relating to the threat actor(s) .


FireEye also noted in their 2017 report that the online handle xman_1365_x , ” found within the PDB path in an APT33 TURNEDUP backdoor sample , belonged to an individual at the Nasr Institute .


Recorded Future’s Insikt Group has been monitoring APT33 activity , beginning with research published in October 2017 , which revealed new infrastructure , malware hashes , and TTPs relating to the threat actor(s) .


Based on this information , it is possible that upon the exposure of the Nasr Institute as a front for Iranian state-sponsored offensive cyber activity , employees transitioned over to other entities , such as Kavosh , to protect their identities and minimize further exposure .


Insikt Group researchers used proprietary methods , including Recorded Future Domain Analysis and Recorded Future Network Traffic Analysis , along with other common analytical approaches , to profile recently reported Iranian threat actor APT33’s domain and hosting infrastructure in an effort to identify recent activity .


Insikt Group enumerated all domains reported as being used by APT33 since January 2019 .


PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption , network enumeration , files interaction , remote shell operations and more .


Using data from Recorded Future Domain Analysis and combining it with data derived from Recorded Future Network Traffic Analysis , Insikt Group researchers were able to identify a small selection of likely targeted organizations impacted by suspected APT33 activity .


Following the exposure of a wide range of their infrastructure and operations by Symantec earlier this year , we discovered that APT33 , or closely aligned actors , reacted by either parking or reassigning some of their domain infrastructure .


Since late March , suspected APT33 threat actors have continued to use a large swath of operational infrastructure , well in excess of 1 , 200 domains , with many observed communicating with 19 different commodity RAT implants .


While we haven’t observed a widespread targeting of commercial entities or regional adversaries like in previously documented APT33 operations , the handful of targeted organizations that we did observe were mainly located in Saudi Arabia across a range of industries , indicating ongoing targeting aligned with geopolitical aims .


The zip contained a sample of the Poison Ivy malware which is also known to be used by APT10 .


The new malware families , which we will examine later in this post , show APT34 relying on their PowerShell development capabilities , as well as trying their hand at Golang .


Additionally , with the assistance of our FireEye Labs Advanced Reverse Engineering (FLARE) , Intelligence , and Advanced Practices teams , we identified three new malware families and a reappearance of PICKPOCKET , malware exclusively observed in use by APT34 .


This threat group has conducted broad targeting across a variety of industries operating in the Middle East; however , we believe APT34's strongest interest is gaining access to financial , energy , and government entities .


Additionally , with the assistance of FireEye Labs , we identified three new malware families and a reappearance of PICKPOCKET , malware exclusively observed in use by APT34 .


APT34 is an Iran-nexus cluster of cyber espionage activity that has been active since at least 2014 .


This CPE was created to ensure our customers are updated with new discoveries , activity and detection efforts related to this campaign , along with other recent activity from Iranian-nexus threat actors to include APT33 , which is mentioned in this updated FireEye blog post .


On June 19 , 2019 , FireEye’s Managed Defense Security Operations Center received an exploit detection alert on one of our FireEye Endpoint Security appliances .


A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests , TONEDEAF supports collecting system information , uploading and downloading of files , and arbitrary shell command execution .


FireEye’s Advanced Practices and Intelligence teams were able to identify additional artifacts and activity from the APT34 actors at other victim organizations .


Of note , FireEye discovered two additional new malware families hosted at this domain , VALUEVAULT and LONGWATCH .


This tool was previously observed during a Mandiant incident response in 2018 and , to date , solely utilized by APT34 .


PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome , Firefox , and Internet Explorer to a file .


Several spear-phishing campaigns attributed to Carbanak , all occurring between March and May 2018 , were analyzed by security researchers in 2018 .


One of the most prolific APT-style cyberattacks , specifically targeting the financial sector , is known as Carbanak .


Discovered in 2014 , the campaign quickly gained notoriety after compromising the security systems of 100 banks in 40 countries and stealing up to $1 billion in the process .


The same group is believed to have also been using the Cobalt Strike framework to run sophisticated campaigns , plotting and performing financial heists of financial institutions .


Banks in countries such as Russia , the United Kingdom , the Netherlands , Spain , Romania , Belarus , Poland , Estonia , Bulgaria , Georgia , Moldova , Kyrgyzstan , Armenia , Taiwan and Malaysia have allegedly been targeted with spearphishing emails , luring victims into clicking malicious URLs and executing booby-trapped documents .


A Carbanak trademark in cyberattacks remains the use of Cobalt Strike – a powerful pentesting tool designed for exploiting and executing malicious code , simulating post-exploitation actions of advanced threat actors – which allows them to infiltrate the organization , move laterally , exfiltrate data , and deploy anti-forensic and evasion tools .


However , this action doesn’t appear to have made a dent in the cybercriminal organization , as subsequent spear-phishing campaigns seem to have been reported from March until May 2018 .


Bitdefender’s forensics and investigation team was contacted to look into a security incident that started in May 2018 with an email received by two of the bank’s employees .


The Carbanak group , which has a long track record of compromising infrastructure belonging to financial institutions , is still active .


Its purpose remains to manipulate financial assets , such as transferring funds from bank accounts or taking over ATM infrastructures and instructing them to dispense cash at predetermined time intervals .


The actors uploaded a variety of tools that they used to perform additional activities on the compromised network , such as dumping credentials , as well as locating and pivoting to additional systems on the network .


We believe Emissary Panda exploited a recently patched vulnerability in Microsoft SharePoint tracked by CVE-2019-0604 , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell .


Bitdefender’s investigation shows the attackers’ main methods remain to quietly infiltrate the infrastructure by establishing a foothold on an employee’s system , then move laterally across the infrastructure or elevate privileges to find critical systems that manage financial transactions or ATM networks .


We also found the China Chopper webshell on the SharePoint servers , which has also been used by the Emissary Panda threat group .


Of particular note is their use of tools to identify systems vulnerable to CVE-2017-0144 , which is the same vulnerability exploited by EternalBlue that is best known for its use in the WannaCry attacks of 2017 .


In addition to the aforementioned post-exploitation tools , the actors used these webshells to upload legitimate executables that they would use DLL sideloading to run a malicious DLL that has code overlaps with known Emissary Panda attacks .


This webshell activity took place across three SharePoint servers hosted by two different government organizations between April 1 , 2019 and April 16 , 2019 , where actors uploaded a total of 24 unique executables across the three SharePoint servers .


The timeline shows three main clusters of activity across the three webshells , with activity occurring on two separate webshells (green and orange) within a very small window of time on April 2 , 2019 and the activity involving the third webshell two weeks later on April 16 , 2019 .


We also observed the actors uploading custom backdoors such as HyperBro which is commonly associated with Emissary Panda .


During our research into this attack campaign , Unit 42 gathered several tools that the Emissary Panda uploaded to the three webshells at the two government organizations .


We also observed the actors uploading the HyperBro backdoor to one of the webshells , as well as legitimate executables that would sideload malicious DLLs that have overlapping code associated with known Emissary Panda activity .


Lastly , we saw the actor uploading a custom backdoor called HyperBro , which has been associated with Emissary Panda operations in the past .


The other overlapping files are tools used by the adversary to locate other systems on the network (etool.exe) , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 (checker1.exe) and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) .


Also , the NCSC advisory mentioned that the actors used a file name stylecss.aspx for their webshell , which is the same filename we saw associated with China Chopper .


We will provide an analysis of the HyperBro tool in an upcoming section .


However , using NCC Group’s research published in May 2018 , we were able to discover code overlaps between these DLLs and a sideloaded DLL that ran the SysUpdate tool that the NCC group has associated with an Emissary Panda campaign .


The list also includes several hack tools , such as Mimikatz for credential dumping and several compiled python scripts used to locate and compromise other systems on the local network .


Unfortunately , we do not have access to the PYTHON33.hlp or CreateTsMediaAdm.hlp files , so we do not know the final payload loaded by either of these DLLs .


Figure 9 shows a code comparison between the PYTHON33.dll (right) and inicore_v2.3.30.dll (left) (SHA256: 4d65d371a789aabe1beadcc10b38da1f998cd3ec87d4cc1cfbf0af014b783822) , which was sideloaded to run the SysUpdate tool in a previous Emissary Panda campaign .


The Emissary Panda threat group loaded the China Chopper webshell onto SharePoint servers at two Government organizations in the Middle East , which we believe with high confidence involved exploiting a remote code execution vulnerability in SharePoint tracked in CVE-2019-0604 .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell .


According to Microsoft’s advisory , this vulnerability was patched on March 12 , 2019 and we first saw the webshell activity on April 1 , 2019 .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 .


Once the adversary established a foothold on the targeted network , they used China Chopper and other webshells to upload additional tools to the SharePoint server to dump credentials , perform network reconnaissance and pivot to other systems .


We also observed Emissary Panda uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before .


Consequently , the Linux malware ecosystem is plagued by financial driven crypto-miners and DDoS botnet tools which mostly target vulnerable servers .


We also observed the actors uploading legitimate tools that would sideload DLLs , specifically the Sublime Text plugin host and the Microsoft’s Create Media application , both of which we had never seen used for DLL sideloading before .


It has been active since at least 2013 , and has targeted individuals likely involved with the Ukrainian government .


The group’s implants are characterized by the employment of information stealing tools among them being screenshot and document stealers delivered via a SFX , and made to achieve persistence through a scheduled task .


The finding shows that EvilGnome operates on an IP address that was controlled by the Gamaredon group two months ago .


FIN7 operations are linked to numerous intrusion attempts having targeted hundreds of companies since at least as early as 2015 .


The FIN7 intrusion set continued its tailored spear phishing campaigns throughout last year .


In addition , during the investigation , we discovered certain similarities to other attacker groups that seemed to share or copy the FIN7 TTPs in their own operations .


In 2018-2019 , researchers of Kaspersky Lab’s Global Research and Analysis Team analyzed various campaigns that used the same Tactics Tools and Procedures (TTPs) as the historic FIN7 , leading the researchers to believe that this threat actor had remained active despite the 2018 arrests .


One of the domains used by FIN7 in their 2018 campaign of spear phishing contained more than 130 email HackOrges , leading us to think that more than 130 companies had been targeted by the end of 2018 .


Interestingly , following some open-source publications about them , the FIN7 operators seems to have developed a homemade builder of malicious Office document using ideas from ThreadKit , which they employed during the summer of 2018 .


The new GRIFFON implant is written to the hard drive before each execution , limiting the file-less” aspect of this method .


Given FIN7’s previous use of false security companies , we decided to look deeper into this one .


This activity cluster , which Kaspersky Lab has followed for a few years , uses various implants for targeting mainly banks , and developers of banking and money processing software solutions .


FIN7’s last campaigns were targeting banks in Europe and Central America .


After a successful penetration , FIN7 uses its own backdoors and the CobaltStrike framework or Powershell Empire components to hop to interesting parts of the network , where it can monetize its access .


AveMaria is a new botnet , whose first version we found in September 2018 , right after the arrests of the FIN7 members .


This threat actor stole suspected of stealing €13 million from Bank of Valetta , Malta earlier this year .


In fact , AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers , email clients , messengers , etc , and can act as a keylogger .


They also use AutoIT droppers , password-protected EXE files and even ISO images .


To deliver their malware , the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882 , or documents with Ole2Link and SCT .


Interestingly , this actor targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center .


At the end of 2018 , while searching for new FIN7 campaigns via telemetry , we discovered a set of activity that we temporarily called CopyPaste” from a previously unknown APT .


FIN7 and Cobalt used decoy 302 HTTP redirections too , FIN7 on its GRIFFON C2s before January 2018 , and Cobalt , on its staging servers , similar to CopyPaste .


Quite recently , FIN7 threat actors typosquatted the brand Digicert” using the domain name digicert-cdn[.]com , which is used as a command and control server for their GRIFFON implants .


The second one is CobaltGoblin Carbanak EmpireMonkey , which uses the same toolkit , techniques and similar infrastructure but targets only financial institutions and associated software/services providers .


We observe , with various level of confidence , that there are several interconnected groups using very similar toolkits and the same infrastructure to conduct their cyberattacks .


The last piece is the newly discovered CopyPaste group , who targeted financial entities and companies in one African country , which lead us to think that CopyPaste was associated with cybermercenaries or a training center .


At the end of 2018 , the cluster started to use not only CobaltStrike but also Powershell Empire in order to gain a foothold on the victims’ networks .


FIN7 thus continues to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework .


MuddyWater is widely regarded as a long-lived APT group in the Middle East .


From February to April 2019 , MuddyWater launched a series of spear-phishing attacks against governments , educational institutions , financial , telecommunications and defense companies in Turkey , Iran , Afghanistan , Iraq , Tajikistan and Azerbaijan .


FIN7 thus continue to use effective spearphishing campaigns in conjunction with well-known MS Office exploits generated by the framework .


We also unearthed and detailed our other findings on MuddyWater , such as its connection to four Android malware variants and its use of false flag techniques , among others , in our report New MuddyWater Activities Uncovered: Threat Actors Used Multi-Stage Backdoors , False Flags , Android Malware , and More .


Instead , the campaign used compromised legitimate accounts to trick victims into installing malware .


Notably , the group’s use of email as infection vector seems to yield success for their campaigns .


We also observed MuddyWater’s use of multiple open source post-exploitation tools , which they deployed after successfully compromising a target .


The attacker also connected to the compromised servers from IP addresses that were linked to dynamic domain names used as C&Cs by the delivered payloads .


The main payload is usually Imminent Monitor RAT; however , at the beginning of 2018 , we also observed the use of LuminosityLink RAT , NetWire RAT , and NjRAT .


In a case in June 2019 , we also noticed Warzone RAT being used .


Xpert RAT reportedly first appeared in 2011 .


The first version of Proyecto RAT” was published at the end of 2010 .


But with the West African gang we’ve named Scattered Canary , we have a deeper look at how business email compromise is connected to the rest of the cybercrime .


In a recent report , the FBI’s Internet Crime Complaint Center (IC3) reported that more than 20 , 000 businesses lost nearly $1.3 billion to BEC attacks in 2018 .


This investigation by the Agari Cyber Intelligence Division into the cybercriminal group we’ve named Scattered Canary offers unprecedented visibility into eleven years of fraud and criminal activities , and the growth of a 419 startup into a fully operational BEC business .


While this criminal organization’s activities now center around BEC , and extend to romance scams , credit card fraud , check fraud , fake job listings , credential harvesting , tax schemes , and more , these actors came from much humbler beginnings , starting with basic Craigslist scams in 2008 .


On November 29 , 2018 , Scattered Canary sent an attack email to Agari CFO Raymond Lim , enquiring as to his availability to send out a domestic wire transfer .


Many feel that they have a home team advantage living in Nigeria , where they are free to pay off law enforcement to look the other way .


Scattered Canary’s fraudulent history can be traced as far back as October 2008 , when the group first arrived on the cybercriminal circuit .


By March 2016 , one of Scattered Canary’s members had built enough trust with a romance victim—who we’ll call Jane—that she became a frequent source of new mule accounts for the group .


By all accounts , late 2015 was the beginning of BEC for Scattered Canary .


The first type of attack Scattered Canary pivoted to was credential phishing .


Between July 2015 and February 2016 , Scattered Canary’s primary focus seemed to be mass harvesting general credentials using a Google Docs phishing page .


In the first few months of their credential phishing ventures , Scattered Canary’s sights were mostly set on Asian targets—Malaysia and Japan , in particular .


In November 2015 , the group started to focus on North American users , mostly in the United States .


This activity ceased in February 2016 , likely because the men who made up Scattered Canary began to focus on honing their BEC skills. In total , Scattered Canary received more than 3 , 000 account credentials as a result of their phishing attacks .


For over eighteen months from March 2017 until November 2018 , Scattered Canary’s frequent enterprise-focused credential phishing campaigns almost exclusively targeted businesses in the United States and Canada .


In July 2018 , following a trend we have observed across the entire BEC threat landscape , Scattered Canary changed their preferred cash out mechanism from wire transfers to gift cards .


Using personal information obtained from various sources , Scattered Canary started perpetrating fraud against US federal and state government agencies .


In total , 35 actors have been tied to Scattered Canary’s operations since the group emerged in 2008 .


Just as with romance scams , actors make use of scripts and templates they can copy-and-paste without having to create something on their own .


When it comes to engaging targets , Scattered Canary frequently maximized efficiencies through the use of scripts , or as some members of the group call them , formats.” These formats are templated text documents that can contain several layers of phishing messages to send to potential victims .


Recently , we unveiled the existence of a UEFI rootkit , called LoJax , which we attribute to the Sednit group .


If Scattered Canary can be seen as a microcosm for the rapidly evolving organizations behind today’s most pernicious email scams , this report demonstrates that a much more holistic approach—one based on threat actor identity rather than type of fraudulent activity—is required to detect email fraud and protect organizations .


This is a first for an APT group , and shows Sednit has access to very sophisticated tools to conduct its espionage operations .


Three years ago , the Sednit group unleashed new components targeting victims in various countries in the Middle East and Central Asia .


In the past , Sednit used a similar technique for credential phishing .


At the end of August 2018 , the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components .


As we explained in our most recent blogpost about Zebrocy , the configuration of the backdoor is stored in in the resource section and is split into four different hex-encoded , encrypted blobs .


The past iteration of SLUB spread from a unique watering hole website exploiting CVE-2018-8174 , a VBScript engine vulnerability .


It used GitHub and Slack as tools for communication between the malware and its controller .


On July 9 , we discovered a new version of SLUB delivered via another unique watering hole website .


This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April .


Since we published out last report on SLUB , the backdoor has been updated and several improvements were implemented .


During this attack , we found that the SLUB malware used two Slack teams sales-yww9809” and marketing-pwx7789 .


SWEED remains consistent across most of their campaigns in their use of spear-phishing emails with malicious attachments .


In April 2018 , SWEED began making use of a previously disclosed Office exploit .


We found them targeting countries in the Middle East such as United Arab Emirates and Saudi Arabia , as well as other countries such as India , Japan , Argentina , the Philippines , and South Korea .


Similar to previous campaigns , the JAR was directly attached to emails and used file names such as Order_2018.jar .


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework .


TA505 is also using FlowerPippi (Backdoor.Win32.FLOWERPIPPI.A) , a new backdoor that we found them using in their campaigns against targets in Japan , India , and Argentina .


TA505 targeted Middle Eastern countries in a June 11 campaign that delivered more than 90% of the total spam emails to the UAE , Saudi Arabia , and Morroco .


It fetches the same FlawedAmmyy downloader .msi file , then downloads the FlawedAmmyy payload .


TA505 used Wizard (.wiz) files in this campaign , with FlawedAmmyy RAT as the final payload .


On June 14 , we saw TA505’s campaign still targeting UAE with similar tactics and techniques , but this time , some of the spam emails were delivered via the Amadey botnet .


It later delivered an information stealer named EmailStealer , ” which stolesimple mail transfer protocol (SMTP) credentials and email addresses in the victim’s machine .


On June 18 , the majority of the campaign’s spam emails were sent with the subject , Your RAKBANK Tax Invoice / Tax Credit Note” or Confirmation .


This campaign used the abovementioned .html file , malicious Excel/Word document VBA macro , the FlawedAmmyy payload , and Amadey .


On June 24 , we found another campaign targeting Lebanon with the ServHelper malware .


On June 17 , we observed the campaign’s spam emails delivering malware-embedded Excel files directly as an attachment .


On June 20 , we spotted the campaign’s spam emails delivering .doc and .xls files .


Nonetheless , these spam emails were not delivered to the UAE or Arabic-speaking users , but to banks in Asian countries such as India , Indonesia , and the Philippines .


After our analysis , we found that Proofpoint reported this malware as AndroMut as well .


Another new malware we found that TA505 is using in their campaigns last June 20 against targets in Japan , the Philippines , and Argentina is FlowerPippi .


The malicious email contains a highly suspicious sample which triggered the ZLAB team to investigate its capabilities and its possible attribution , discovering a potential expansion of the TA505 operation .


The attack , as stated by CyberInt , leveraged a command and control server located in Germany related to the TA505 actor: a very active group involved in cyber-criminal operation all around the world , threatening a wide range of high profile companies , active since 2014 .


The comparison of the infection chains reveals in both cases TA505 used a couple of SFX stages to deploy the RMS” software: a legitimate remote administration tool produced by the Russian company TektonIT .


The TA505 group is one of the most active threat groups operating since 2014 , it has traditionally targeted Banking and Retail industries , as we recently documented during the analysis of the Stealthy Email Stealer” part of their arsenal .


In 2018 , Kaspersky Labs published a report that analyzed a Turla PowerShell loader that was based on the open-source project Posh-SecMod .


Turla is believed to have been operating since at least 2008 , when it successfully breached the US military .


This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products .


However , it is likely the same scripts are used more globally against many traditional Turla targets in Western Europe and the Middle East .


Based on our research , SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans .


It is interesting to note that Turla operators used the free email provider GMX again , as in the Outlook Backdoor and in LightNeuron .


This new research confirms our forecast and shows that the Turla group does not hesitate to use open-source pen-testing frameworks to conduct intrusion .


One attack during this campaign involved the use of infrastructure belonging to another espionage group known as Crambus aka OilRig , APT34 .


Waterbug has been using Meterpreter since at least early 2018 and , in this campaign , used a modified version of Meterpreter , which was encoded and given a .wav extension in order to disguise its true purpose .


In all likelihood , Waterbug’s use of Crambus infrastructure appears to have been a hostile takeover .


One of the most interesting things to occur during one of Waterbug’s recent campaigns was that during an attack against one target in the Middle East , Waterbug appeared to hijack infrastructure from the Crambus espionage group and used it to deliver malware on to the victim’s network .


These three recent Waterbug campaigns have seen the group compromise governments and international organizations across the globe in addition to targets in the IT and education sectors .


Curiously though , Waterbug also compromised other computers on the victim’s network using its own infrastructure .


Symantec believes that the variant of Mimikatz used in this attack is unique to Waterbug .


Aside from the attack involving Crambus infrastructure , this sample of Mimikatz has only been seen used in one other attack , against an education target in the UK in 2017 .


The first observed evidence of Waterbug activity came on January 11 , 2018 , when a Waterbug-linked tool (a task scheduler named msfgi.exe) was dropped on to a computer on the victim’s network .


In the case of the attack against the Middle Eastern target , Crambus was the first group to compromise the victim’s network , with the earliest evidence of activity dating to November 2017 .


Waterbug’s intrusions on the victim’s network continued for much of 2018 .


Symantec did not observe the initial access point and the close timeframe between Waterbug observed activity on the victim’s network and its observed use of Crambus infrastructure suggests that Waterbug may have used the Crambus infrastructure as an initial access point. It also reconfigures the Microsoft Sysinternals registry to prevent pop-ups when running the PsExec tool .


Waterbug also used an older version of PowerShell , likely to avoid logging .


In one of these campaigns , Waterbug used a USB stealer that scans removable storage devices to identify and collect files of interest .


The DeepSight Managed Adversary and Threat Intelligence (MATI) team co-authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug (aka Turla) cyber espionage group , and methods of detecting and thwarting activities of this adversary .


The DeepSight MATI team authored this blog and its customers have received intelligence with additional details about these campaigns , the characteristics of the Waterbug (aka Turla) cyber espionage group , and methods of detecting and thwarting activities of this adversary .


While reviewing a 2015 report⁵ of a Winnti intrusion at a Vietnamese gaming company , we identified a small cluster of Winnti⁶ samples designed specifically for Linux⁷ .


Following these reports , Chronicle researchers doubled down on efforts to try to unravel the various campaigns where Winnti was leveraged .


Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits .


We will see more from Zebrocy into 2019 on government and military related organizations .


In the same year , Silence conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans .


The FBI issued a rare bulletin admitting that a group named APT6 hacked into US government computer systems as far back as 2011 and for years stole sensitive data .


FireEye iSIGHT Intelligence believes that APT37 is aligned with the activity publicly reported as Scarcruft and Group123 .


Trend Micro attributes this activity to MuddyWater , an Iran-nexus actor that has been active since at least May 2017 .


FireEye assess that the actors employing this latest Flash zero-day are a suspected North Korean group we track as TEMP.Reaper .


FireEye has observed other suspected North Korean threat groups such as TEMP.Hermit employ wiper malware in disruptive attacks .


On Nov14 , 2017 , FireEye observed APT34 using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


Kaspersky reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013 .


APT33 is the only group that Kaspersky has observed use the DROPSHOT dropper .


The cyber espionage group APT32 heavily obfuscates their backdoors and scripts , and Mandiant consultants observed APT32 implement additional command argument obfuscation in April 2017 .


In all Mandiant investigations to date where the CARBANAK backdoor has been discovered , the activity has been attributed to the FIN7 threat group .


Kaspersky released a similar report about the same group under the name Carbanak in February 2015 .


FireEye assesses that APT32 leverages a unique suite of fully-featured malware .


FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam’s manufacturing , consumer products , and hospitality sectors .


The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on these backdoor families based on Mandiant investigations of APT32 intrusions .


FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests .


In May and June 2017 , FireEye has associated this campaign with APT19 , a group that we assess is composed of freelancers , with some degree of sponsorship by the Chinese government .


APT10 is a Chinese cyber espionage group that FireEye has tracked since 2009 .


In addition to the spear phishes , FireEye ISIGHT Intelligence has observed APT10 accessing victims through global service providers .


FireEye’s visibility into the operations of APT28 – a group we believe the Russian government sponsors – has given us insight into some of the government’s targets , as well as its objectives and the activities designed to further them .


FireEye has tracked and profiled APT28 group through multiple investigations , endpoint and network detections , and continuous monitoring .


In April 2015 , FireEye uncovered the malicious efforts of APT30 , a suspected China-based threat group .


FireEye iSIGHT Intelligence has been tracking a pair of cybercriminals that we refer to as the Vendetta Brothers .


Google and Microsoft have already confirmed the Russian hacker group APT28 used a Flash vulnerability CVE-2016-7855 along with this kernel privilege escalation flaw to perform a targeted attack .


McAfee concludes that some groups—and especially the Poetry Group —have shifted tactics to use Citadel in ways other than what it was originally intended for .


In November 2017 , Talos observed the Group123 , which included a new version of ROKRAT being used in the latest wave of attacks .


In addition to TALOS investigation on KONNI , on July 18 2017 , BitDefender released a whitepaper on DarkHotel .


ESET has also reported PowerShell scripts being used by Turla to provide direct , in-memory loading and execution of malware .


Researchers at Symantec suspect that Turla used the hijacked network to attack a Middle Eastern government .


Symantec researchers have uncovered evidence that the Waterbug APT group has conducted a hostile takeover of an attack platform .


Researchers at the Microstep Intelligence Bureau have published a report on targeted attacks on the Ukrainian government that they attribute to the Gamaredon threat actor .


Kaspersky found an active campaign by a Chinese APT group we call SixLittleMonkeys that uses a new version of the Microcin Trojan and a RAT that we call HawkEye as a last stager .


Trend Micro has previously reported the use of this malware in targeted attacks by the BlackTech group , primarily focused on cyber-espionage in Asia .


LuckyMouse activity detected by Palo Alto involved the attackers installing web shells on SharePoint servers to compromise government organizations in the Middle East .


Talos published its analysis of the BlackWater campaign , related to MuddyWater group .


Regarding other groups , Kaspersky discovered new activity related to ZooPark , a cyber-espionage threat actor that has focused mainly on stealing data from Android devices .


Recorded Future published an analysis of the infrastructure built by APT33 (aka Elfin) to target Saudi organizations .


In a recent campaign , Kaspersky observed ScarCruft using a multi-stage binary to infect several victims and ultimately install a final payload known as ROKRAT – a cloud service-based backdoor .


The threat actor behind the campaign , which Kaspersky believes to be the PLATINUM APT group , uses an elaborate , previously unseen , steganographic technique to conceal communication .


FireEye defined APT40 as the Chinese state-sponsored threat actor previously reported as TEMP.Periscope , Leviathan and TEMP.Jumper .


In January , Kaspersky identified new activity by the Transparent Tribe APT group aka PROJECTM and MYTHIC LEOPARD , a threat actor with interests aligned with Pakistan that has shown a persistent focus on Indian military targets .


OceanLotus was another actor active during this period , using a new downloader called KerrDown , as reported by Palo Alto .


ESET recently uncovered a new addition to OceanLotus’s toolset targeting Mac OS .


In mid-2018 , Kaspersky's report on Operation AppleJeus” highlighted the focus of the Lazarus threat actor on cryptocurrency exchanges .


Kaspersky also observed some activity from Gaza Team and MuddyWater .


Kaspersky wrote about LuckyMouse targeting national data centers in June .


Kaspersky also discovered that LuckyMouse unleashed a new wave of activity targeting Asian governmental organizations just around the time they had gathered for a summit in China .


Kaspersky have observed similar activity in the past from groups such as Oilrig and Stonedrill , which leads us to believe the new attacks could be connected , though for now that connection is only assessed as low confidence .


In August 2019 , FireEye released the Double Dragon” report on our newest graduated threat group , APT41 .


Today , FireEye Intelligence is releasing a comprehensive report detailing APT41 , a prolific Chinese cyber threat group that carries out state-sponsored espionage activity in parallel with financially motivated operations .


Group-IB experts continuously monitor the Silence’ activities .


Group-IB has uncovered a hacker group , MoneyTaker , attacking banks in the USA and Russia .


Group-IB reveals the unknown details of attacks from one of the most notorious APT groups , Lazarus .


Finally , Kaspersky produced a summary report on Sofacy’s summertime activity .


Kaspersky were also able to produce two reports on Korean speaking actors , specifically involving Scarcruft and Bluenoroff .


Analysis of the payload allowed us to confidently link this attack to an actor Kaspersky track as BlackOasis .


Kaspersky first became aware of BlackOasis’ activities in May 2016 , while investigating another Adobe Flash zero day .


Once the LOWBALL malware calls back to the Dropbox account , the admin@338 will create a file called upload.bat which contains commands to be executed on the compromised computer .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe " .


More recently , in May 2017 , APT33 appeared to target a Saudi organization and a South Korean business conglomerate using a malicious file that attempted to entice victims with job vacancies for a Saudi Arabian petrochemical company .


More recently , in May 2017 , APT33 appeared to target organizations in Saudi and South Korea using a malicious file that attempted to entice victims with job vacancies .


In fact , REDBALDKNIGHT has been targeting Japan as early as 2008 , based on the file properties of the decoy documents they've been sending to their targets .


In fact , REDBALDKNIGHT has been zeroing in on Japanese organizations as early as 2008 — at least based on the file properties of the decoy documents they've been sending to their targets .


Carbanak is a backdoor used by the attackers to compromise the victim .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


The Korean-language Word document manual.doc appeared in Vietnam on January 17 , with the original author name of Honeybee .


This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON , which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


For example , DeltaAlfa specifies a DDoS bot family identified as Alfa .


This alert 's IOC files provide HIDDEN COBRA indicators related to FALLCHILL .


The McAfee Advanced Threat Research team discovered a previously unknown data-gathering implant that surfaced in mid-February 2018 .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


This malware report contains analysis of one 32-bit Windows executable file , identified as a Remote Access Trojan ( RAT ) .


In one of the samples received for analysis , the US-CERT Code Analysis Team observed botnet controller functionality .


Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library ( .dll )


Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs .


WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data .


The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period .


The download name was " Zawgyi_Keyboard_L.zip " , and it dropped a " setup.exe " that contained several backdoor components , including an Elise " wincex.dll " ( a42c966e26f3577534d03248551232f3 , detected as Backdoor.Win32.Agent.delp ) .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys .


The Magic Hound campaign was also discovered using a custom dropper tool , which we have named MagicHound.DropIt .


For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints .


Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document .


This blog post analyzes several recent Molerats attacks that deployed PIVY against targets in the Middle East and in the U.S. We also examine additional PIVY attacks that leverage Arabic-language content related to the ongoing crisis in Egypt and the wider Middle East to lure targets into opening malicious files .


The archive contains an .exe file , sometimes disguised as a Microsoft Word file , a video , or another file format , using the corresponding icon .


The Palo Alto Networks Unit 42 research team recently came across a series of malicious files which were almost identical to those targeting the Saudi Arabian government previously discussed by MalwareBytes .


We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded .


Analysts in our DeepSight Managed Adversary and Threat Intelligence ( MATI ) team have found a new backdoor , Backdoor.Powemuddy , new variants of Seedworm 's Powermud backdoor ( aka POWERSTATS ) , a GitHub repository used by the group to store their scripts , as well as several post-compromise tools the group uses to exploit victims once they have established a foothold in their network .


Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload .


In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign .


This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent .


Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system .


The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 .


The vulnerability exists in the old Equation Editor ( EQNEDT32.EXE ) , a component of Microsoft Office that is used to insert and evaluate mathematical formulas .


The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 .


The email contained an attachment named Seminar-Invitation.doc , which is a malicious Microsoft Word document we track as ThreeDollars .


We also identified another sample of ThreeDollars , created on January 15 , 2017 with the file name strategy preparation.dot .


We had previously observed this author name in use once before , in the very first ThreeDollars document we collected that we had reported on in August 2017 .


The June 2017 sample of Clayslide contained the same OfficeServicesStatus.vbs file found in the ISMAgent Clayslide document , but instead of having the payload embedded in the macro as segregated base64 strings that would be concatenated , this variant obtained its payload from multiple cells within the " Incompatible " worksheet .


During this testing , we saw document filenames that contain the C2 we witnessed in the targeted attack above , specifically the filenames XLS-withyourface.xls and XLS-withyourface – test.xls .


These samples appeared to have been created by OilRig during their development and testing activities , all of which share many similarities with the delivery document used in the recent OilRig attack against a Middle Eastern government , N56.15.doc ( 7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00 ) that we have also included in Table 1 .


The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East .


In the first week of May 2016 , FireEye 's DTI identified a wave of emails containing malicious attachments being sent to multiple banks in the Middle East region .


Their next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting , again attempting to extract all Word documents .


For example , in September 2016 , Sowbug infiltrated an organization in Asia , deploying the Felismus backdoor on one of its computers , Computer A , using the file name adobecms.exe in CSIDL_WINDOWS\debug .


Symantec has found evidence of Starloader files being named AdobeUpdate.exe , AcrobatUpdate.exe , and INTELUPDATE.EXE among others .


The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information .


In September 2015 , Kaspersky Lab 's Anti-Targeted Attack Platform discovered anomalous network traffic in a government organization network .


Symantec detects this threat as Backdoor.Nidiran .


Attackers have been known to distribute malicious files masquerading as the legitimate iviewers.dll file and then use DLL load hijacking to execute the malicious code and infect the computer .


Once exploit has been achieved , Nidiran is delivered through a self-extracting executable that extracts the components to a .tmp folder after it has been executed .


While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions .


To better understand how the adversary was operating and what other actions they had performed , CTU researchers examined cmd.exe and its supporting processes to uncover additional command line artifacts .


In a separate incident , CTU researchers identified a file named s.txt , which is consistent with the output of the Netview host-enumeration tool .


Thrip was attempting to remotely install a previously unknown piece of malware ( Infostealer.Catchamas ) on computers within the victim 's network .


Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection .


The malicious loader will use dynamic-link library ( DLL ) hijacking — injecting malicious code into a process of a file/application — on sidebar.exe and launch dllhost.exe ( a normal file ) .


As we have noted in many earlier reports , attackers commonly use decoy files to trick victims into thinking a malicious document is actually legitimate .


Even an experienced user can be fooled by downloading a malicious file that is apparently from adobe.com , since the URL and the IP address correspond to Adobe 's legitimate infrastructure .


According to Deepen , APT6 has been using spear phishing in tandem with malicious PDF and ZIP attachments or links to malware infected websites that contains a malicious SCR file .


Bellingcat also reported the domain had been used previously to host potential decoy documents as detailed in VirusTotal here using hxxp://voguextra.com/decoy.doc .


We identified an overlap in the domain voguextra.com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post .


While not detected at the time , Microsoft 's antivirus and security products now detect this Barium malicious file and flag the file as " Win32/ShadowPad.A " .


MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com.mxi.videoplay ) .


Like PLEAD , Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents .


The self-extracting RAR writes a legitimate executable , an actor-created DLL called Loader.dll and a file named readme.txt to the filesystem and then executes the legitimate executable .


Leader is Bookworm 's main module and controls all of the activities of the Trojan , but relies on the additional DLLs to provide specific functionality .


We speculate that other attacks delivering Bookworm were also targeting organizations in Thailand based on the contents of the associated decoys documents , as well as several of the dynamic DNS domain names used to host C2 servers that contain the words " Thai " or " Thailand " .


Due to these changes without a new date string , we believe the date codes are used for campaign tracking rather than a Bookworm build identifier .


Another decoy slideshow associated with the Bookworm attack campaign contains photos of an event called Bike for Dad 2015 .


The executable would install the real Ammyy product , but would also launch a file called either AmmyyService.exe or AmmyySvc.exe which contained the malicious payload .


The second , aptly titled " kontrakt87.doc " , copies a generic telecommunications service contract from MegaFon , a large Russian mobile phone operator .


In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task .


Careto 's Mask campaign we discovered relies on spear-phishing e-mails with links to a malicious website .


Sometimes , the attackers use sub-domains on the exploit websites , to make them seem more legitimate .


We initially became aware of Careto when we observed attempts to exploit a vulnerability in our products to make the malware " invisible " in the system .


The scanner was identified as the Acunetix Web Vulnerability Scanner which is a commercial penetration testing tool that is readily available as a 14-day trial .


The decoy documents dropped suggest that the targets are likely to be politically or militarily motivated , with subjects such as Intelligence reports and political situations being used as lure documents .


The first of which we call ' CONFUCIUS_A ' , a malware family that has links to a series of attacks associated with a backdoor attack method commonly known as SNEEPY ( aka ByeByeShell ) first reported by Rapid7 in 2013 .


At first glance CONFUCIUS_B looks very similar to CONFUCIUS_A , and they are also packaged in plain SFX binary files .


The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon .


We also believe that both clusters of activity have links to attacks with likely Indian origins , the CONFUCIUS_A attacks are linked to the use of SNEEPY/BYEBYESHELL and the CONFUCIUS_B have a loose link to Hangover .


The two malware families themselves are also very similar , and therefore we think that the shared technique is an indication of a single developer , or development company , behind both CONFUCIUS_A and CONFUCIUS_B .


The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio .


According to our statistics , as of the beginning of 2015 this botnet encompassed over 250 000 infected devices worldwide including infecting more than 100 financial institutions with 80% of them from the top 20 list .


If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs .


At first look , it pretends to be a Java related application but after a quick analysis , it was obvious this was something more than just a simple Java file .


Contextually relevant emails are sent to specific targets with attached documents that are packed with exploit code and Trojan horse programmes designed to take advantage of vulnerabilities in software installed on the target 's computer .


The authors of that report identify three primary tools used in the campaigns attributed to Hidden Lynx : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit .


The above network shows relationships between three tools used by Hidden Lynx during its VOHO campaign : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit .


Symantec during 2012 linked the Elderwood Project to Operation Aurora ; Trojan.Naid and Backdoor.Moudoor were also used in Aurora , by the Elderwood Gang , and by Hidden Lynx .


One e-mail carried a Microsoft PowerPoint file named " thanks.pps " ( VirusTotal ) , the other a Microsoft Word document named " request.docx " .


Around the same time , WildFire also captured an e-mail containing a Word document ( " hello.docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient .


The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll .


In this case , the file used the software name " Cyberlink " , and a description of " CLMediaLibrary Dynamic Link Library " and listing version 4.19.9.98 .


This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample .


Once BARIUM has established rapport , they spear-phish the victim using a variety of unsophisticated malware installation vectors , including malicious shortcut ( .lnk ) files with hidden payloads , compiled HTML help ( .chm ) files , or Microsoft Office documents containing macros or exploits .


This was the case in two known intrusions in 2015 , where attackers named the implant DLL " ASPNET_FILTER.DLL " to disguise it as the DLL for the ASP.NET ISAPI Filter .


In early 2016 the Callisto Group began sending highly targeted spear phishing emails with malicious attachments that contained , as their final payload , the " Scout " malware tool from the HackingTeam RCS Galileo platform .


The malicious attachments purported to be invitations or drafts of the agenda for the conference .


We encountered the first document exploit called " THAM luan - GD - NCKH2.doc " a few days ago , which appears to be leveraging some vulnerabilities patched with MS12-060 .


This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics .


Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups .


There is the exploit code and malware used to gain access to systems , the infrastructure that provides command and control to the malware operator , and the human elements – developers who create the malware , operators who deploy it , and analysts who extract value from the stolen information .


The operation against the Tibetan Parliamentarians illustrates the continued use of malicious attachments in the form of documents bearing exploits .


The first attack started in early July with a ShimRatReporter payload .


In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy .


The exploit document carrying this alternate KeyBoy configuration also used a decoy document which was displayed to the user after the exploit launched .


This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files .


Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique .


We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester .


For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2 This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP port 443 .


Previous reports have discussed Bisonal malware used in attacks against Japan , South Korea and Russia .


This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others .


If it's Cyrillic and the command to the shell is not ‘ipconfig’ , the threat converts the command result text encoding from Cyrillic to UTF-16 .


Similar to the Bisonal variant targeting the Russian organization , this sample was also disguised as PDF document .


The contents of the decoy PDF is a job descriptions with the South Korean Coast Guard .


The installed EXE file is almost exactly the same as the DLL version of Bisonal variant used against the Russian organization .


ined in the archive is called DriverInstallerU.exe” but its metadata shows that its original name is Interenet Assistant.exe” .


In this sample , however , the module names were changed from actors and characters’ names to car models , namely BMW_x1” , BMW_x2” and up to BMW_x8” .


wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 .


Furthermore , it has similar code logic as previous ones wuaupdt.exe in this attack appears in previous Donot attack , and C2 addresses are same to previous ones .


Other open source and semi-legitimate pen-testing tools like nbtscan and powercat are being used for mapping available resources and lateral movement as well .


As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC .


Throughout our investigation , we have found evidence that shows operational similarities between this implant and Gamaredon Group .


The techniques and modules employed by EvilGnome — that is the use of SFX , persistence with task scheduler and the deployment of information stealing tools—remind us of Gamaredon Group’s Windows tools .


We can observe that the sample is very recent , created on Thursday , July 4


As can be observed in the illustration above , the makeself script is instructed to run ./setup.sh after unpacking .


The ShooterAudio module uses PulseAudio to capture audio from the user's microphone .


makeself.sh is a small shell script that generates a self-extractable compressed tar archive from a directory .


In a more recent version of the modified Gh0st RAT malware , Ghost Dragon implemented dynamic packet flags which change the first five bytes of the header in every login request with the controller .


One hour later , Bemstour was used against an educational institution in Belgium .


Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor .


DoublePulsar is then used to inject a secondary payload , which runs in memory only .


A significantly improved variant of the Bemstour exploit tool was rolled out in September 2016 , when it was used in an attack against an educational institution in Hong Kong .


Bemstour was used again in June 2017 in an attack against an organization in Luxembourg .


Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam .


Development of Bemstour has continued into 2019 .


Unlike earlier attacks when Bemstour was delivered using Buckeye's Pirpi backdoor , in this attack Bemstour was delivered to the victim by a different backdoor Trojan (Backdoor.Filensfer) .


The most recent sample of Bemstour seen by Symantec appears to have been compiled on March 23 , 2019 , eleven days after the zero-day vulnerability was patched by Microsoft .


Filensfer is a family of malware that has been used in targeted attacks since at least 2013 .


While Symantec has never observed the use of Filensfer alongside any known Buckeye tools , information shared privately by another vendor included evidence of Filensfer being used in conjunction with known Buckeye malware (Backdoor.Pirpi) .


Buckeye's exploit tool , EternalRomance , as well as EternalSynergy , can exploit the CVE-2017-0143 message type confusion vulnerability to perform memory corruption on unpatched victim computers .


And the dropper execute the iassvcs.exe to make a side loading and make the persistence .


Over the past three years , Filensfer has been deployed against organizations in Luxembourg , Sweden , Italy , the UK , and the U.S .


Our analysis of this malware shows that it belongs to Hussarini , also known as Sarhust , a backdoor family that has been used actively in APT attacks targeting countries in the ASEAN region since 2014 .


OutExtra.exe is a signed legitimate application from Microsoft named finder.exe .


Today , this malware is still actively being used against the Philippines .


Xagent” is the original filename Xagent.exe whereas seems to be the version of the worm .


Our technical analysis of the malware used in these attacks showed close ties to BS2005 backdoors from operation Ke3chang , and to a related TidePool malware family discovered by Palo Alto Networks in 2016 that targeted Indian embassies across the globe .


The malicious actors behind the Okrum malware were focused on the same targets in Slovakia that were previously targeted by Ketrican 2015 backdoors .


We started connecting the dots when we discovered that the Okrum backdoor was used to drop a Ketrican backdoor , freshly compiled in 2017 .


In 2017 , the same entities that were affected by the Okrum malware and by the 2015 Ketrican backdoors again became targets of the malicious actors .


This time , the attackers used new versions of the RoyalDNS malware and a Ketrican 2017 backdoor .


According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 .


According to our telemetry , Okrum was used to target diplomatic missions in Slovakia , Belgium , Chile , Guatemala , and Brazil , with the attackers showing a particular interest in Slovakia .


The detection evasion techniques we observed in the Okrum malware include embedding the malicious payload within a legitimate PNG image , employing several anti-emulation and anti-sandbox tricks , as well as making frequent changes in implementation .


According to ClearSky , the suspected Lazarus operatives looked to leverage a vulnerability in outdated WinRAR file-archiving software that hackers have been exploiting since it was disclosed last month .


The diagram below illustrates how we believe the actors behind the Sea Turtle campaign used DNS hijacking to achieve their end goals .


If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file .


Create a link file in the startup folder for AutoHotkeyU32.exe , allowing the attack to persist even after a system restart .


Such attacks highlight the need for caution before downloading files from unknown sources and enabling macro for files from unknown sources .


Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies .


Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant .


UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques .


This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 .


The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process .


Additionally , the same DLL sideloading technique observed in the Visma attack was used , and many of the tools deployed by the APT10 shared naming similarities as well 1.bat , cu.exe , ss.rar , r.exe , pd.exe .


Most interestingly , Rapid7 observed the use of the Notepad++ updater gup.exe as a legitimate executable to sideload a malicious DLL (libcurl.dll) in order to deploy a variant of the UPPERCUT backdoor also known as ANEL .


Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials .


KHRAT is a backdoor trojan purported to be used with the China-linked cyberespionage group DragonOK .


Rapid7 reviewed malware discovered in the victim’s environment and found implants that used Dropbox as the C2 .


The earliest use of the exploit ITW we were able to identify and confirm is a sample (e228045ef57fb8cc1226b62ada7eee9b) dating back to October 2018 (VirusTotal submission of 2018-10-29) with the RTF creation time 2018-10-23 .


Upon decrypting and executing , it drops two additional files wsc_proxy.exe” (legitimate Avast executable) and a malicious DLL wsc.dll” in the %TEMP% folder .


However , Beginning on 25 June 2019 , we started observing multiple commodity campaigns Mostly dropping AsyncRAT using the updated RTF weaponizer with the same exploit (CVE-2018-0798) .


In addition , a current ANY.RUN playback of our observed Elise infection is also available .


The well-crafted and socially engineered malicious documents then become the ﬁrst stage of a long and mainly ﬁleless infection chain that eventually delivers POWERSTATS , a signature PowerShell backdoor of this threat group .


This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more .


If the macros in SPK KANUN DEĞİŞİKLİĞİ GİB GÖRÜŞÜ.doc” are enabled , an embedded payload is decoded and saved in the %APPDATA% directory with the name CiscoAny.exe” .


INF ﬁles have been used in the past by MuddyWater , although they were launched using Advpack.dll and not IEAdvpack.dll .


We assume that RunPow stands for run PowerShell , ” and triggers the PowerShell code embedded inside the .dll file .


The main delivery method of this type of backdoor is spear phishing emails or spam that uses social engineering to manipulate targets into enabling malicious documents .


This includes Python scripts .


Usually , the Stageless Meterpreter has the Ext_server_stdapi.x64.dll” , Ext_server_extapi.x64.dll” , and Ext_server_espia.x64.dll” extensions .


However , Kaspersky Security Network (KSN) records also contain links that victims clicked from the Outlook web client outlook.live.com” as well as attachments arriving through the Outlook desktop application .


The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” .


We identified two methods to deliver the KerrDown downloader to targets .


The link to the final payload of KerrDown was still active during the time of analysis and hence we were able to download a copy which turned out to be a variant of Cobalt Strike Beacon .


While investigating KerrDown we found multiple RAR files containing a variant of the malware .


The dropped PE file has the distinctive file name 8.t” .


This time the document purported to be about the involvement of the Emir of Qatar in funding ISIS , which was seemingly copied from a website critical of Qatar .


The SDK , named SWAnalytics is integrated into seemingly innocent Android applications published on major 3rd party Chinese app stores such as Tencent MyApp , Wandoujia , Huawei App Store , and Xiaomi App Store .


From our first malicious sample encounter back in mid-September until now , we have observed 12 infected applications , the majority of which are in the system utility category .


Whenever users reboot their device or open up Network Speed Master , SWAnalytics will fetch the latest configuration file from http[:]//mbl[.]shunwang[.]com/cfg/config[.]json” .


In order to understand SWAnalytics’ impact , we turned to public download volume data available on Chandashi , one of the app store optimization vendors specialized in Chinese mobile application markets .


According to Cheetah Mobile’s follow-up investigation , fraudulent behaviors came from two 3rd party SDKs Batmobi , Duapps integrated inside Cheetah SDK .


It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns .


Webinjects targeting Japan , a country we haven’t seen targeted by Panda Banker before .


Japan is no stranger to banking malware .


Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware .


This post was our first analysis of the first Panda Banker campaign that we’ve seen to target financial institutions in Japan .


We believe the iOS malware gets installed on already compromised systems , and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems .


One is called XAgent detected as IOS_XAGENT.A and the other one uses the name of a legitimate iOS game , MadCap detected as IOS_ XAGENT.B .


Madcap” is similar to the XAgent malware , but the former is focused on recording audio .


This full-blown spying framework consists of two packages named ‘Tokyo’ and ‘Yokohama’ .


The first confirmed date when TajMahal samples were seen on a victim’s machine is August 2014 .


More details about TajMahal are available to customers of the Kaspersky Intelligence Reporting service (contact intelreports@kaspersky.com) .


The delivery of KopiLuwak in this instance is currently unknown as the MSIL dropper has only been observed by Proofpoint researchers on a public malware repository .


The earliest step in any possible attack(s) involving this variant of KopiLuwak of which Proofpoint researchers are currently aware begin with the MSIL dropper .


The basic chain of events upon execution of the MSIL dropper include dropping and executing both a PDF decoy and a Javascript (JS) dropper .


As explained in further detail below , the JS dropper ultimately installs a JS decryptor onto an infected machine that will then finally decrypt and execute the actual KopiLuwak backdoor in memory only .


As Proofpoint has not yet observed this attack in the wild it is likely that there is an additional component that leads to the execution of the MSIL payload .


We didn’t choose to name it after a vegetable; the .NET malware developers named it Topinambour themselves .


The role of the .NET module is to deliver the known KopiLuwak JavaScript Trojan .


RocketMan!” (probably a reference to Donald Trump’s nickname for Kim Jong Un) and MiamiBeach” serve as the first beacon messages from the victim to the control server .


These could be tools to circumvent internet censorship , such as Softether VPN 4.12” and psiphon3” , or Microsoft Office activators” .


These campaign-related VPSs are located in South Africa .


The Trojan is quite similar to the .NET RocketMan Trojan and can handle the same commands; additionally , it includes the #screen” command to take a screenshot .


Both BalkanRAT and BalkanDoor spread in Croatia , Serbia , Montenegro , and Bosnia and Herzegovina .


The main part of the BalkanRAT malware is a copy of the Remote Utilities software for remote access .


They download and install an archive containing executables and trivially modified source code of the password-stealing tool Mimikatz Lite as GetPassword.exe .


Let’s take a closer look at ITG08’s TTPs that are relevant to the campaign we investigated , starting with its spear phishing and intrusion tactics and covering information on its use of the More_eggs backdoor .


X-Force IRIS determined that the More_eggs backdoor later downloaded additional files , including a signed binary shellcode loader and a signed Dynamic Link Library (DLL) , as described below , to create a reverse shell and connect to a remote host .


PittyTiger could also use CVE-2014-1761 , which is more recent .


PLATINUM is known to have used a number of zero-day exploits , for which no security update is available at the time of transmission , in these attempts .


When the document was opened in Word , it exploited a previously unknown vulnerability in the Microsoft Office PostScript interpreter ( designated CVE-2015-2545 ) that enabled it to execute the attacker 's code and drop an attacker-generated malicious DLL onto the computer .


In total , PLATINUM made use of four zero-day exploits during these two attack campaigns ( two remote code execution bugs , one privilege escalation , and one information disclosure ) , showing an ability to spend a non-trivial amount of resources to either acquire professionally written zero-day exploits from unknown markets , or research and utilize the zero-day exploits themselves .


PLATINUM has used several zero-day exploits against their victims .


Even if CVE-2015-2546 affected Windows 10 , the exploitation would have required much more technical prowess to succeed ; ultimately , SMEP makes it more difficult for attackers .


It possesses a wide range of technical exploitation capabilities , significant resources for researching or purchasing complicated zero-day exploits , the ability to sustain persistence across victim networks for years , and the manpower to develop and maintain a large number of tools to use within unique victim networks .


To deliver the malware to the victim machines , the Rocke group exploits vulnerabilities in Apache Struts 2 , Oracle WebLogic , and Adobe ColdFusion .


The Shadow Brokers first emerged in August , when they posted links to a selection of NSA exploits and hacking tools onto Github and other websites .


The group has demonstrated access to zero-day vulnerabilities (CVE-2018-0802) , and the ability to incorporate them into operations .


If the lateral movement with credentials fails , then the malware uses PingCastle MS17-010 scanner (PingCastle is a French Active Directory security tool) to scan that particular host to determine if its vulnerable to EternalBlue , and uses it to spread to that host .


Figure 2: Zyklon attack flowInfection Techniques CVE-2017-8759 .


This vulnerability was discovered by FireEye in September 2017 , and it is a vulnerability we have observed being exploited in the wild .


Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly , we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office .


The other overlapping files are tools used by the adversary to locate other systems on the network (etool.exe) , check to see if they are vulnerable to CVE-2017-0144 (EternalBlue) patched in MS07-010 (checker1.exe) and pivot to them using remote execution functionality offered by a tool similar to PsExec offered by Impacket (psexec.exe) .


The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell .


We believe the actors pivoted to other systems on the network using stolen credentials and by exploiting the CVE-2017-0144 (EternalBlue) vulnerability patched in MS17-010 .


Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework .


According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 .


The Sofacy group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


APT28 spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 .


We are however only aware of one instance - the exploitation of CVE-2013-0640 to deploy MiniDuke - where we believe the exploited vulnerability was a zero-day at the time that the group acquired the exploit .


FireEye confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims .


FireEye iSIGHT Intelligence confirmed that since at least November 2017 , APT37 exploited a zero-day Adobe Flash vulnerability , CVE-2018-4878 , to distribute DOGCALL malware to South Korean victims .


A well-funded , highly active group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group .


A well-funded , highly active BlackOasis group of Middle Eastern hackers was caught , yet again , using a lucrative zero-day exploit in the wild to break into computers and infect them with powerful spyware developed by an infamous cyberweapons dealer named Gamma Group .


Kaspersky found the BlackOasis group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


BRONZE BUTLER has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


The group has demonstrated the ability to identify a significant zero-day vulnerability within a popular Japanese corporate tool and then use scan-and-exploit techniques to indiscriminately compromise Japanese Internet-facing enterprise systems .


BRONZE BUTLER has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


While investigating a 2016 intrusion , Secureworks identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


Carbanak is also aware of the IFOBS banking application and can , on command , substitute the details of payment documents in the IFOBS system .


Sensitive bank documents have be found on the servers that were controlling Carbanak .


Existing telemetry indicates that the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries , the Middle East , Asia and Africa .


From 2013 Carbanak intensified its activity focused on banks and electronic payment systems in Russia and in the post-Soviet space .


Since 2013 Carbanak has successfully gained access to networks of more than 50 banks and 5 payment systems .


To reduce the risk of losing access to the internal bank network , the Carbanak , in addition to malicious programs , also used for remote access legitimate programs such as Ammy Admin and Team Viewer .


Additionally the reports on Carbanak show a different picture , where banks targeted outside of Russia , specifically Europe , USA and Japan are mentioned , which does not match our research .


These attacks have included criminal groups responsible for the delivery of NewPosThings , MalumPOS and PoSeidon point of sale Malware , as well as Carbanak from the Russian criminal organization we track as Carbon Spider .


The leader of the crime gang behind the Carbanak and Cobalt malware attacks targeting over a 100 financial institutions worldwide has been arrested in Alicante , Spain , after a complex investigation conducted by the Spanish National Police .


Since 2013 , the cybercrime gang have attempted to attack banks , e-payment systems and financial institutions using pieces of malware they designed , known as Carbanak and Cobalt .


Other public tools used by the CopyKittens are Metasploit , a well-known free and open source framework for developing and executing exploit code against a remote target machine ; Mimikatz , a post-exploitation tool that performs credential dumping ; and Empire , a PowerShell and Python post-exploitation agent .


In one remarkable case , the Carbanak 2.0 gang used its access to a financial institution that stores information about shareholders to change the ownership details of a large company .


This Gorgon Group campaign leveraged spear phishing emails with Microsoft Word documents exploiting CVE-2017-0199 .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) .


While the URL acts similarly to how eye-watch.in : 443 delivers payloads , we also saw the URL leveraging and exploiting security flaws in Flash : CVE-2015-8651 , CVE-2016-1019 , and CVE-2016-4117 .


Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal .


WannaCry leverages an exploit , codenamed " EternalBlue " , that was released by the Shadow Brokers on April 14 , 2017 .


The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April .


If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit .


Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft .


The EternalBlue exploit from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 .


The Leafminer operators use EternalBlue to attempt lateral movement within target networks from compromised staging servers .


Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address .


The attachments exploited CVE-2017-8759 which was discovered and documented only five days prior to the campaign .


The group 's capabilities are more than the much discussed CVE-2012-0158 exploits over the past few years .


The group 's spearphish toolset includes PDF exploits , Adobe Flash Player exploits , and the common CVE-2012-0158 Word exploits including those generated from the infamous " Tran Duy Linh " kit .


While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past , Spring Dragon employs more involved and creative intrusive activity as well .


The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


Lotus Blossom attempted to exploit CVE-2014-6332 using the POC code available in the wild .


Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .