Both attackers and victims speak Spanish natively , as we see it consistently in the source code of the client side and in the Python code .


We are also grateful to the Private Office of his Holiness the Dalai Lama , the Tibetan Government-in-Exile , the missions of Tibet in London , Brussels , and New York , and Drewla ( a Tibetan NGO ) .


Between June 2008 and March 2009 the Information Warfare Monitor conducted an extensive and exhaustive two-phase investigation focused on allegations of Chinese cyber espionage against the Tibetan community .


These instances of Gh0st RAT are consistently controlled from commercial Internet access accounts located on the island of Hainan , People's Republic of China .


The fieldwork generated extensive data that allowed us to examine Tibetan information security practices , as well as capture real-time evidence of malware that had penetrated Tibetan computer systems .


It is therefore possible that the large percentage of high value targets identified in our analysis of the GhostNet are coincidental , spread by contact between individuals who previously communicated through e-mail .


Where they exist , they often use grey market or pirated software .


Contextually relevant emails are sent to specific targets with attached documents that are packed with exploit code and Trojan horse programmes designed to take advantage of vulnerabilities in software installed on the target 's computer .


GhostNet represents a network of compromised computers resident in high-value political , economic , and media locations spread across numerous countries worldwide .


After that , the attacker is capable to control the compromised device .


The computers of diplomats , military attachés , private assistants , secretaries to Prime Ministers , journalists and others are under the concealed control of unknown assailant (s ) .


The C&C server ( 82.137.255.56 ) used by the above backdoors was used by APT-C-27 ( Goldmouse ) many times since 2017 .


According to 360 Threat Intelligence Center , Goldmouse was observed deploying the nebulous njRAT backdoor .


The banking malware GozNym has legs ; only a few weeks after the hybrid Trojan was discovered , it has reportedly spread into Europe and begun plaguing banking customers in Poland with redirection attacks .


The APT group is reportedly targeting the Middle East region .


The malware has started targeting corporate , SMB , investment banking and consumer accounts at banks , including some in Portugal and the U.S. , in addition to Poland , according to researchers at IBM 's X-Force team .


According to Kessem the malware has redirection instructions for 17 banks , and features an additional 230 URLs to assist attackers in targeting community banks and email service providers in Poland .


With GozNym , attackers dupe users by showing them the actual bank 's URL and SSL certificate .


Fresh from targeting banks in Poland , the banking Trojan GozNym has begun taking aim at banks in Germany .


Attackers went on to use the Trojan to steal $4 million from 24 banks , including 22 in the United States and two in Canada , in just two weeks .


Recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the GozNym group appears up to the task .


The malware is distributed primarily through laced spam emails that lure recipients into opening attachments .


Kessem .


Fresh from targeting banks in Poland , the banking Trojan has reportedly begun taking aim at banks in Germany .


Now GozNym is now targeting 13 banks and subsidiaries in Germany , Limor Kessem , Executive Security Advisor at IBM , said Tuesday .


he Trojan , a hybrid of Nymaim and Gozi malware , initially formed in April and thrives on carrying out redirection attacks via DNS poisoning .


In April , shortly after the Trojan 's discovery , researchers observed a massive GozNym campaign targeting 24 North American banks .


The method , which technically redirects users through local DNS poisoning , requires a fair bit of work ; recreating and maintaining fake bank sites can be an arduous task , but Kessem claims the group behind GozNym – Nymaim – appear up to the task .


Attackers behind Dyre have used similar tactics in the past but have only deployed their attacks in English speaking countries and Spain .


When we last heard from the Trojan , its operators were seen launching redirection attacks on four large , U.S. banks in June .


The fact that the cybercriminals behind GozNym have already adapted the Trojan for three different languages and in countries which have different banking systems is unique , according to Kessem .


By the end of April , GozNym had redirection instructions for 17 Polish banks in its repertoire , along with an extra 230 URLs designed to assist attackers in targeting community banks and email service providers in the Eastern European country .


Seeking to tease out any possible links between Operation Aurora , VOHO , Operation DeputyDog , and Ephemeral Hydra , we began with Symantec 's Hidden Lynx report as our foundation .


The authors of that report identify three primary tools used in the campaigns attributed to Hidden Lynx : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit .


We will detail how the C&C infrastructure and tools used by hacker group Hidden Lynx during its VOHO campaign ( 2012 ) , excellently documented by Symantec researchers last September , overlap with tools used in other high profile operations during the past few years .


When the New York Times and Mandiant last year unmasked a large scale Chinese hacking operation , pinpointing its location down to the building , the report drew mainstream attention to what security professionals already well knew : sophisticated threat actors carry out persistent cyber operations over months and years .


Using Recorded Future , we quickly built a timeline of the reported use of those tools in major security incidents , finding many events prior to the early 2013 exposé on Hidden Lynx .


In particular , FireEye during the fall of 2013 called out infrastructure overlap between Ephemeral Hydra and DeputyDog .


The above network shows relationships between three tools used by Hidden Lynx during its VOHO campaign : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit .


Symantec during 2012 linked the Elderwood Project to Operation Aurora ; Trojan.Naid and Backdoor.Moudoor were also used in Aurora , by the Elderwood Gang , and by Hidden Lynx .


In addition to these , we also identified " Macfog " , a native Mac OS X implementation of Icefog that infected several hundred victims worldwide .


Icefog , also known as the " Dagger Panda " by Crowdstrike 's naming convention , infected targets mainly in South Korea and Japan .


In 2013 , a public report reveals a group of actors conducted targeted attacks leverage a malware dubbed ICEFOG against mainly government organizations and defense industry of South Korea and Japan .


Similar to our approach with Symantec 's report on Hidden Lynx , we used Recorded Future to organize the technical details about the DeputyDog attacks to reveal technical information described in the open source reporting across multiple campaigns .


With Javafog , we are turning yet another page in the Icefog story by discovering another generation of backdoors used by the attackers .


Since January 2013 , we've been on the lookout for a possible RedOctober comeback .


One possible hit was triggered when we observed Mevade , an unusual piece of malware that appeared late in 2013 .


In August 2014 , some of our users observed targeted attacks with a variation of CVE-2012-0158 and an unusual set of malware .


It wasn't until August 2014 that we observed something which made us wonder if RedOctober is back for good .


The Cloud Atlas implants utilize a rather unusual C&C mechanism .


We named it RedOctober because we started this investigation in October 2012 , an unusually hot month .


The attackers upload data to the account , which is downloaded by the implant , decrypted and interpreted .


Just like with RedOctober , the top target of Cloud Atlas is Russia , followed closely by Kazakhstan , according to data from the Kaspersky Security Network ( KSN ) .


In May 2015 , Palo Alto Networks WildFire detected two e-mails carrying malicious documents from a genuine and compromised Israeli Gmail account , sent to an Israeli industrial organization .


One e-mail carried a Microsoft PowerPoint file named " thanks.pps " ( VirusTotal ) , the other a Microsoft Word document named " request.docx " .


Around the same time , WildFire also captured an e-mail containing a Word document ( " hello.docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient .


Attacks using this tool were still active as of April 2016 .


Considering the language being used in the malicious code is Arabic , it seems that the attacker is familiar with Arabic language as well .


The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll .


In this case , the file used the software name " Cyberlink " , and a description of " CLMediaLibrary Dynamic Link Library " and listing version 4.19.9.98 .


Unit 42 published a blog at the beginning of May titled " Prince of Persia " , in which we described the discovery of a decade-long campaign using a formerly unknown malware family , Infy , that targeted government and industry interests worldwide .


We noted in our original blog the large amount of targeting of Iranian citizens in this campaign , we observed almost one-third of all victims to be Iranian .


In addition to the original " Infy " variant , we also see the newer , more sophisticated , interactive , and fuller-featured " Infy M " variant deployed against apparently-higher-value targets .


This documentation provides new insight into intrusion efforts conducted by at least four discrete Iranian threat actors , Rocket Kitten , Infy , Sima , and Operation Cleaver , including groups and tools that have not been previously disclosed .


Since early 2013 , we have observed activity from a unique threat actor group , which we began to investigate based on increased activities against human right activists in the beginning of 2015 .


Over the course of three years of observation of campaigns targeting civil society and human rights organizations , from records of well over two hundred spearphishing and other intrusion attempts against individuals inside of Iran and in the diaspora , a narrative of persistent intrusion efforts emerges .


Thanks to information we have been able to collect during the course of our research , such as characteristics of the group 's malware and development cycle , our research strongly supports the claim that the Infy group is of Iranian origin and potentially connected to the Iranian state .


Amongst a backdrop of other incidents , Infy became one of the most frequently observed agents for attempted malware attacks against Iranian civil society beginning in late 2014 , growing in use up to the February 2016 parliamentary election in Iran .


Until the publication of the Palo Alto report , the developers of the Infy appeared to be actively updating and maintaining the codebase , and new releases were distributed to existing , as well as new , targets quite regularly .


Other samples were found bearing a compilation time as early as June 2012 and version 00002 .


Over the months following the elections , the accounts of Iranians that had been compromised by the actors were then used for spreading the malware .


When activities targeting of civil society subsided , the actors instead appeared to have focused on external targets , such a series of attempts to spearphish the Danish Ministry of Foreign Affairs .


Palo Alto Networks has noted and described the differences of two malware agents developed in parallel , with commonalities in behavior but differing functionalities ; families described as Infy and Infy M. Our primary observation was of the Infy ( non-M ) malware , which primarily functions as a keylogger for the collection of account credentials .


Our observation of Infy 's campaigns , primarily through the lens of spearphishing attacks against Iranian civil society and media organizations , indicates a wandering focus on particular demographics on a strategic basis over time .


The Infy malware was seen targeting Iranians again in June 2015 , when it was shared with researchers after being sent to a broadcast journalist at BBC Persian with a generic introduction and a PowerPoint presentation attached titled " Nostalogy " ( sic ) .


Based on information collected in the course of this research , the targets and victims of Infy 's campaigns have continued to be strongly aligned with Iran 's " soft war " agenda , internal security policies , and regional adversaries of the hardline establishment of the Islamic Republic of Iran .


Until late December 2015 , in nearly every Infy message documented since our tracking began in May 2013 , no attempt included strong tailoring of the approach , often not even including an email body , instead relying on cryptic filenames and email subjects to attract interest .


One narrowly-targeted spearphishing from Infy was sent from the compromised account of a political activist promoting participation inside of Iran , claiming to be a set of images of a British-Iranian dual national that has been held in Evin Prison for five years on espionage charges .


As in the past , these messages have been sent accounts believed to be fake and accounts compromised by Infy , including Kurdish activists that had previously been compromised by the Flying Kitten actor group .


The actors successfully compromised a host of an Saudi government institutions on January 17 , 2016 , and maintained access for at least two weeks .


The Infy group also appears to engage in espionage activities against foreign governments and businesses .


In order to initially compromise the designated targets , Infy typically distributed specifically-crafted malicious documents containing Infy through spearphishing attacks .


In order to initially compromise the designated targets , the attackers typically distributed specifically-crafted malicious documents containing Infy through spearphishing attacks .


On May 2 , 2016 , Palo Alto Networks published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available .


Prior to the distribution of new versions of the agent , the Infy developers appear to consistently conduct tests from local hosts , which indicates that the control and maintenance of the software occurs in the Khorasan Razavi province of Iran , potentially in the city of Mashhad .


On May 2 , 2016 , Palo Alto published the report " Prince of Persia " , which provided the first public and widely-reported indication of Infy 's activities in Iran , while other publications either refrained from making the association or were not openly available .


Only one client , based in Iran , continued to communicate with the infrastructure .


A researcher has attributed a recently publicized attack on Citrix' internal network to the Iranian-linked group known as IRIDIUM – and said that the data heist involved 6 terabytes of sensitive data .


" IRIDIUM has hit more than 200 government agencies , oil and gas companies and technology companies , including Citrix Systems Inc " , they said .


Citrix told Threatpost that this is indeed the same password-spraying attack it announced itself last week – but it wouldn't confirm the other details in Resecurity 's post , including the attribution .


In wake of these events , a security firm Resecurity reached out to NBC news and claimed that they had reasons to believe that the attacks were carried out by Iranian-linked group known as IRIDIUM .


Resecurity says that IRIDIUM " has hit more than 200 government agencies , oil and gas companies , and technology companies including Citrix .


Resecurity claims that IRIDIUM breached Citrix 's network during December 2018 .


Infy engaged in malware spearphishing against the same targets as Flying Kitten from the outset of its campaign ; Operation Cleaver has registered several resources related to development agencies that have been the subject of intrusion attempts by others since February 2014 .


The malicious samples we found are the early stage malware most often delivered by spear-phishing e-mails .


This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample .


At this stage , the malware gathers information about the infected computer .


Hancom Office is widely used in South Korea .


Perhaps it also points to the suspected North Korean origin of attack .


The attacker is from North Korea .


All of them lie in ranges of the Jilin Province Network and Liaoning Province Network , in China .


Finally , this geo-location supports the likely theory that the attackers behind Kimsuky are based in North Korea .


In this blog , we look at the Winnti malware implant as used by two known activity groups BARIUM and LEAD .


According to the German press , the intruders used the Winnti family of malware as their main implant , giving them persistent access to the conglomerate 's network as early as February 2016 .


In the case of this malware , the activity groups strongly associated with Winnti are BARIUM and LEAD .


But even though they share the use of Winnti , the BARIUM and LEAD activity groups are involved in very different intrusion scenarios .


To show how this breach and similar breaches can be mitigated , we look at how Windows Defender ATP flags activities associated with BARIUM , LEAD , and other known activity groups and how it provides extensive threat intelligence about these groups .


BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms .


During these intrusions , LEAD 's objective was to steal sensitive data , including research materials , process documents , and project plans .


Once BARIUM has established rapport , they spear-phish the victim using a variety of unsophisticated malware installation vectors , including malicious shortcut ( .lnk ) files with hidden payloads , compiled HTML help ( .chm ) files , or Microsoft Office documents containing macros or exploits .


Instead , the group often simply emails a Winnti installer to potential victims , relying on basic social engineering tactics to convince recipients to run the attached malware .


Microsoft Analytics shows that Winnti has been used in intrusions carried out throughout Asia , Europe , Oceania , the Middle East , and the United States in the last six months ( Figure 1 ) .


Instead , Lead often simply emails a Winnti installer to potential victims , relying on basic social engineering tactics to convince recipients to run the attached malware .


In some other cases , LEAD gains access to a target by brute-forcing remote access login credentials , performing SQL injection , or exploiting unpatched web servers , and then they copy the Winnti installer directly to compromised machines .


This was the case in two known intrusions in 2015 , where attackers named the implant DLL " ASPNET_FILTER.DLL " to disguise it as the DLL for the ASP.NET ISAPI Filter .


Windows Defender ATP helps network security professionals deal with intrusions from activity groups like LEAD and BARIUM in several ways .


The following examples were developed using a Winnti installer that was used in attacks in December 2016 .


The Windows 10 Creators Update will bring several enhancements to Windows Defender ATP that will provide SOC personnel with options for immediate mitigation of a detected threat .


LEAD and BARIUM are not known for large-scale spear-phishing , so it is unlikely that SOC personnel would have to deal with multiple machines having been compromised by these groups at the same time .


And , finally , with the upcoming Creators Update , Windows Defender ATP will provide additional capabilities for detecting threats such as Winnti , as well as centralized response options , such as machine isolation and file blocking , that will enable fast containment of known attack jump off points .


The police suspected Lurk of stealing nearly three billion rubles , using malicious software to systematically withdraw large sums of money from the accounts of commercial organizations , including banks .


When we first encountered Lurk , in 2011 , it was a nameless Trojan .


While the machine is in isolation , SOC personnel can direct the infected machine to collect live investigation data , such as the DNS cache or security event logs , which they can use to verify alerts , assess the state of the intrusion , and support follow-up actions .


This article is an attempt to share this experience with other experts , particularly the IT security specialists in companies and financial institutions that increasingly find themselves the targets of cyber-attacks .


In most cases , the attackers only had to infect the computer on which the RBS software was installed in order to start stealing the cash .


We were soon able to help investigate another incident involving Lurk .


This event significantly affected the Russian cybercriminal world as the gang had stolen hundreds of millions of rubles during a few years of activity , and was considered a " leader " among cybercriminals .


In April 2013 , a year after we found the " bodiless " Lurk module , the Russian cybercriminal underground exploited several families of malicious software that specialized in attacks on banking software .


Through the information exchanges used by people in the security industry , we learned that several Russian banks were struggling with malicious programs created specifically to attack a particular type of legal banking software .


If it did , the malware downloaded additional modules , including ones allowing for the automatic creation of unauthorized payment orders , changing details in legal payment orders , etc .


As far as we can judge from the data we have , in 2014 the criminal group behind Lurk seriously reduced its activity and " lived from hand to mouth " , attacking anyone they could , including ordinary users .


In February 2015 , Kaspersky Lab 's Global Research and Analysis Team ( GReAT ) released its research into the Carbanak campaign targeting financial institutions .


Since 2011 , the robbers had allegedly been stealing money directly from bank accounts in Russia and other countries of the Commonwealth of Independent States ( CIS ) by using a Trojan called Lurk .


which they launched targeted attacks against Russian banks , businesses and media companies .


Lurk uses a form of steganography : that's where one file is hidden away inside another file of a completely different sort , such as an image , audio , or video file .


The latest version of Madi also has the ability to monitor the Russian social network Vkontakte ( VK ) along with the Jabber messaging platform to look for users who visit websites that contain words like " USA " , " Skype " , and " gov " .


Madi was found capturing computer screens , recording audio and stealing screenshots , keystrokes , documents and e-mail correspondence from " Middle Eastern critical infrastructure engineering firms , government agencies , financial houses and academia .


A timeline of new activity can be scoped out for the group , with the greatest number of related downloaders created by the developers in December 2011 , Feb and March of 2012 , followed by June of 2012 .


it reports to was created on August 10 , 2011 .


Since at least 2008 , The Lamberts have used multiple sophisticated attack tools against high-profile victims .


The attack leveraged malware we called ' BlackLambert ' , which was used to target a high profile organization in Europe .


Their arsenal includes network-driven backdoors , several generations of modular backdoors , harvesting tools , and wipers .


The first time the Lambert family malware was uncovered publicly was in October 2014 , when FireEye posted a blog about a zero day exploit ( CVE-2014-4148 ) used in the wild .


Interestingly , while most Blue Lambert variants have version numbers in the range of 2.x , Green Lambert is mostly in 3.x versions .


While investigating one of these infections involving White Lambert ( network-driven implant ) and Blue Lambert ( active implant ) , we found yet another family of tools that appear to be related .


Versions of this particular orchestrator were found on other victims , together with White Lambert samples , indicating a close relationship between the White and Pink Lambert malware families .


While in most cases the infection vector remains unknown , the high profile attack from 2014 used a very complex Windows TTF zero-day exploit ( CVE-2014-4148 ) .


This migration activity was last observed in October 2016 .


Most of the Blue and Green Lambert samples have two C&C servers hardcoded in their configuration block : a hostname and an IP address .


Some of the known filenames for Gray Lambert are mwapi32.dll and poolstr.dll – it should be pointed though that the filenames used by the Lamberts are generally unique and have never been used twice .


Black Lambert was seen only briefly and we assume it was " retired " from the arsenal after being discovered by FireEye in 2014 .


The Lamberts toolkit spans across several years , with most activity occurring in 2013 and 2014 .


To further exemplify the proficiency of the attackers leveraging the Lamberts toolkit , deployment of Black Lambert included a rather sophisticated TTF zero day exploit , CVE-2014-4148 .


Taking that into account , we classify the Lamberts as the same level of complexity as Regin , ProjectSauron , Equation and Duqu2 , which makes them one of the most sophisticated cyber espionage toolkits we have ever analysed .


On January 15 , Confiant exposed the activity of the Zirconium group , spreading malicious ads via a network of fake ad agencies through 2017 , in what amounted to the largest malvertising campaign of recent times .


Cadelle , uses Backdoor.Cadelspy .


Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014 , however , it's likely that activity began well before this date .


Chafer , uses Backdoor.Remexi .


Chafer , uses Backdoor.Remexi.B .


registrant information points to activity possibly as early as 2011 .


These threats are capable of opening a back door and stealing information from victims' computers .


executable compilation times suggest early 2012 .


It's unclear how Cadelle infects its targets with Backdoor.Cadelspy .


The affected organizations we were able to identify are mostly based in the Middle East .


one organization is located in the US .


There are a number of factors in these groups' campaigns that suggests that the attackers may be based in Iran .


Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands .


Their primary interest appears to be gathering intelligence .


This stands in opposition to the data gathered from export timestamps and C&C domain activity that points to Green Lambert being considerably older than the Blue variant .


security policy in the Eastern Europe and South Caucasus regions .


Callisto Group via credential phishingThese spear phishing emails were crafted to appear highly convincing , including being sent from legitimate email accounts suspected to have been previously compromised by the Callisto Group via credential phishing .


In early 2016 the Callisto Group began sending highly targeted spear phishing emails with malicious attachments that contained , as their final payload , the " Scout " malware tool from the HackingTeam RCS Galileo platform .


These spear phishing emails were crafted to appear highly convincing , including being sent from legitimate email accounts suspected to have been previously compromised by the Callisto Group via credential phishing .


Callisto Group appears to be intelligence gathering related to European foreign and security policy .


some indications of loosely linked activity dating back to at least 2013 .


In October 2015 , the Callisto Group was observed sending targeted credential phishing emails .


In early 2016 , the Callisto Group was observed sending targeted spear phishing emails .


The malicious attachments purported to be invitations or drafts of the agenda for the conference .


Based on our analysis of Callisto Group 's usage of RCS Galileo , we believe the Callisto Group did not utilize the leaked RCS Galileo source code , but rather used the leaked readymade installers to set up their own installation of the RCS Galileo platform .


In the known spear phishing attacks by the Callisto Group , they employed the " Scout " malware tool from the RCS Galileo platform .


We are confident the Callisto Group used this type of access to a target 's email account for the purposes of sending spear phishing to other targets .


If a target of the spear phishing described in " Phase 2 : malware deployment " opened the email attachment and , crucially , clicked on the icon in the attachment , this would lead to the target 's computer becoming infected with the " Scout " malware tool from the RCS Galileo platform .


Callisto Group and related infrastructure contain links to at least Russia , Ukraine , and China .


they have been last known to employ malware in February 2016 .


RCS Galileo platform .


The spear phishing emails used in the known attacks by the Callisto Group were so convincing that even skilled and alert users would likely have attempted to open the malicious attachment .


In October 2015 the Callisto Group targeted a handful of individuals with phishing emails that attempted to obtain the target 's webmail credentials .


The Callisto Group has been active at least since late 2015 and continues to be so , including continuing to set up new phishing infrastructure every week .


Called Greenbug , this group is believed to be instrumental in helping Shamoon steal user credentials of targets ahead of Shamoon 's destructive attacks .


On Tuesday , Arbor Networks said that it has new leads on a credential stealing remote access Trojan ( RAT ) called Ismdoor , possibly used by Greenbug to steal credentials on Shamoon 's behalf .


" With our latest research we now see how Greenbug has shifted away from HTTP-based C2 communication with Ismdoor .


It's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost .


t's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost .


By relying on a native PDF command to navigate to a new URL , Zirconium successfully circumvented Chrome 's anti-redirect protection .


In the context of the Ismdoor RAT , the DNS attack technique is used primarily by Greenbug for stealing credentials .


To do this , it employs a number of specific commands via DNSMessenger .


Iranian Threat Agent Greenbug has been registering domains similar to those of Israeli High-Tech and Cyber Security Companies .


By pivoting off the registration details and servers data of the two domains we discovered others registered by the threat agent .


Named Trochilus , this new RAT was part of Group 27 's malware portfolio that included six other malware strains , all served together or in different combinations , based on the data that needed to be stolen from each victim .


Trochilus RAT activity was discovered during both months of October and November 2015 .


From September 2016 through late November 2016 , a threat actor group used both the Trochilus RAT and a newly idenfied RAT we've named MoonWind to target organizations in Thailand , including a utility organization .


We chose the name ' MoonWind ' based on debugging strings we saw within the samples , as well as the compiler used to generate the samples .


The attackers compromised two legitimate Thai websites to host the malware , which is a tactic this group has used in the past .


Both the Trochilus and MoonWind RATs were hosted on the same compromised sites and used to target the same organization at the same time .


The attackers used different command and control servers ( C2s ) for each malware family , a tactic we believe was meant to thwart attempts to tie the attacks together using infrastructure alone .


Further research led us to additional MoonWind samples using the same C2 ( dns.webswindows.com ) but hosted on a different compromised but legitimate website .


The attacks in that case took place in late September to early October 2016 and the attackers stored the MoonWind samples as RAR files , while in the November attacks the RATs were stored as executables .


We were not able to find additional tools , but the attackers again compromised a legitimate Thai website to host their malware , in this case the student portal for a Thai University .


Trochilus was first reported by Arbor Networks in their Seven Pointed Dagger report tying its use to other targeted Southeast Asia activity .


The activity dates to at least 2013 and has ties to multiple reports by other researchers .


It is highly likely MoonWind is yet another new tool being used by the group or groups responsible for that activity , indicating they are not only still active but continuing to evolve their playbook .


The samples provided were alleged to be targeting Tibetan and Chinese Pro-Democracy Activists .


On June 7 , 2013 , Rapid7 released an analysis of malware dubbed ' KeyBoy ' , also exploiting unknown vulnerabilities in Microsoft Office , similarly patched by MS12-060 , but allegedly targeting interests in Vietnam and India .


As we have seen in some previous targeted malware attacks , the attackers in this incident are taking advantage of services like changeip.com to establish free subdomains in their infrastructure .


Blending in with legitimate traffic is a common tactic used by attackers to help fly under the radar .


Subdomains at phmail.us have been linked to malicious activity dating back as far as December 2011 .


Based on the patterns of subdomain registration over time in DNS , TRAC believes this is an example where the attackers registered their own second-level domain .


In this blog post we'll analyze two specific incidents apparently targeting victims in Vietnam and in India and we'll describe the capabilities of the custom backdoor being used that for convenience ( and to our knowledge , for a lack of an existing name ) we call KeyBoy , due to a string present in one of the samples .


We encountered the first document exploit called " THAM luan - GD - NCKH2.doc " a few days ago , which appears to be leveraging some vulnerabilities patched with MS12-060 .


This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics .


For the sake of this analysis we'll take the Vietnamese backdoor as an example ; the one found in the Indian attack operates in the exact same way .


In the second set they are making use of a dynamic DNS service by ChangeIP.com .


The Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information .


he Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information .


They are often targeted simultaneously with other ethnic minorities and religious groups in China .


Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups .


More recently in 2016 , Arbor Networks reported on connected malware operations continuing to target these same groups , which the Communist Party of China perceives as a threat to its power .


There is the exploit code and malware used to gain access to systems , the infrastructure that provides command and control to the malware operator , and the human elements – developers who create the malware , operators who deploy it , and analysts who extract value from the stolen information .


For example , we have observed frequent reuse of older ( patched ) exploits in malware operations against the Tibetan community .


These operations involved highly targeted email lures with repurposed content and attachments that contained an updated version of KeyBoy .


In August and October 2016 we observed a malware operation targeting members of the Tibetan Parliament ( the highest legislative organ of the Tibetan government in exile , formally known as Central Tibetan Administration ) .


The Arbor report describes the ongoing use of these four vulnerabilities in a series of espionage campaigns against not only Tibetan groups , but also others related to Hong Kong , Taiwan , and Uyghur interests .


The malware samples deployed in both of these operations are updated versions of the KeyBoy backdoor first discussed in 2013 by Rapid7 .


This behavioural tactic was previously mentioned in relation to KeyBoy in a 2013 blog post by Cisco .


These versions of KeyBoy differed from the one first described by Rapid7 in several ways , many of which will be described in the sections to follow .


These samples were contained in exploit documents containing distinct lure content , one having a Tibetan nexus , the other an Indian nexus .


We believe the 2013 , 2015 , and 2016 KeyBoy samples provide evidence of a development effort focused on changing components that would be used by researchers to develop detection signatures .


In another modification , first observed in the most recent October 11 Parliamentarian operation ( version agewkassif ) , the developer (s ) of KeyBoy began using a string obfuscation routine in order to hide many of the critical values referenced within the malware .


Trend Micro specifically noted that the 2013 versions of KeyBoy used the same algorithm for encoding their configuration files as was observed in the Operation Tropic Trooper malware .


This sample was also found to be deployed using the CVE-2012-0158 vulnerability .


The operation against the Tibetan Parliamentarians illustrates the continued use of malicious attachments in the form of documents bearing exploits .


Chances are about even , though , that Mofang is a relevant threat actor to any organization that invests in Myanmar or is otherwise politically involved .


In addition to the campaign in Myanmar , Mofang has been observed to attack targets across multiple sectors ( government , military , critical infrastructure and the automotive and weapon industries ) in multiple countries .


This threat report gives insight into some of the information that Fox-IT has about a threat actor that it follows , called Mofang .


The name Mofang is based on the Mandarin verb , which means to imitate .


It is highly likely that the Mofang group is a group that operates out of China and is probably government-affiliated .


Chapter 7 explains the working of Mofang 's preferred tools : ShimRat and SimRatReporter .


The Mofang group has been active in relation to the Kyaukphyu sez .


KeyBoy provides basic backdoor functionality , allowing the operators to select from various capabilities used to surveil and steal information from the victim machine .


The first attack started in early July with a ShimRatReporter payload .


Myanmar has been the target of Mofang 's attacks for years before the campaign related to the sez .


In late September 2015 Mofang used the website of Myanmar 's national airline hosted at www.flymna.com for an attack against an organization in Myanmar .


In December 2012 Mofang started a campaign against a new target , called ' seg ' for the purpose of this report .


From the configuration it can be determined that the company was running F-Secure Antivirus and Mofang registered the domain to not appear suspicious .


In September 2015 Mofang launched another attack .


A new version of ShimRat was built on the 7th of September , uploaded to the server and only days later used in a new campaign .


MoneyTaker has primarily been targeting card processing systems , including the AWS CBR ( Russian Interbank System ) and purportedly SWIFT ( US ) .


Given the wide usage of STAR in LATAM , financial institutions in LATAM could have particular exposure to a potential interest from the MoneyTaker group .


In addition to banks , the MoneyTaker group has attacked law firms and also financial software vendors .


Since that time , the group attacked companies in California , Utah , Oklahoma , Colorado , Illinois , Missouri , South Carolina , North Carolina , Virginia and Florida .


The first attack in the US that Group-IB attributes to MoneyTaker was conducted in the spring of 2016 : money was stolen from the bank by gaining access to First Data 's " STAR " network operator portal .


The first attack in the US that Group-IB attributes to this group was conducted in the spring of 2016 : money was stolen from the bank by gaining access to First Data 's " STAR " network operator portal .


In 2017 , the number of MoneyTaker 's attacks has remained the same with 8 US banks , 1 law firm and 1 bank in Russia being targeted .


In 2017 , the number of attacks has remained the same with 8 US banks , 1 law firm and 1 bank in Russia being targeted .


By analyzing the attack infrastructure , Group-IB identified that MoneyTaker group continuously exfiltrates internal banking documentation to learn about bank operations in preparation for future attacks .


Group-IB reports that MoneyTaker uses both borrowed and their own self-written tools .


Group-IB has provided Europol and Interpol with detailed information about the MoneyTaker group for further investigative activities as part of our cooperation in fighting cybercrime .


In late September 2015 Mofang used the website of Myanmara 's national airline hosted at www.flymna.com for an attack against an organization in Myanmar .


To control the full operation , MoneyTaker uses a Pentest framework Server .


On it , MoneyTaker install a legitimate tool for penetration testing – Metasploit .


At the end of June 2015 Mofang started its campaign to gather information of a specific target in relation to the sezs : the cpg Corporation .


MoneyTaker uses ' fileless ' malware only existing in RAM and is destroyed after reboot .


To ensure persistence in the system MoneyTaker relies on PowerShell and VBS scripts - they are both difficult to detect by antivirus and easy to modify .


After successfully infecting one of the computers and gaining initial access to the system , the attackers perform reconnaissance of the local network in order to gain domain administrator privileges and eventually consolidate control over the network .


MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs .


This newly observed activity uses a series of redirections and fileless , malicious implementations of legitimate tools to gain access to the targeted systems .


Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China .


Since that time , MoneyTaker attacked companies in California , Utah , Oklahoma , Colorado , Illinois , Missouri , South Carolina , North Carolina , Virginia and Florida .


In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy .


Our analysis shows that actors attempted to exploit CVE-2012-0158 to install NetTraveler Trojan .


Unit 42 's analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan .


Our analysis shows that NetTraveler attempted to exploit CVE-2012-0158 to install NetTraveler Trojan .


In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker , 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks .


In 2016 , Group-IB identified 10 attacks conducted by MoneyTaker ; 6 attacks on banks in the US , 1 attack on a US service provider , 1 attack on a bank in the UK and 2 attacks on Russian banks .


The NetTraveler trojan has been known to be used in targeted cyber espionage attacks for more than a decade by nation state threat actors and continues to be used to target its victims and exfiltrate data .


The exploit document carrying this alternate KeyBoy configuration also used a decoy document which was displayed to the user after the exploit launched .


Only one incident involving a Russian bank was promptly identified and prevented that is known to Group-IB .


This program is designed to capture keystrokes , take screenshots of the user 's desktop and get contents from the clipboard .


To conduct targeted attacks , MoneyTaker use a distributed infrastructure that is difficult to track .


This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files .


Hackers use Metasploit to conduct all these activities : network reconnaissance , search for vulnerable applications , exploit vulnerabilities , escalate systems privileges , and collect information .


Over the years they've used application components from Norman , McAfee and Norton .


Recently , Falcon Intelligence observed new activity from MUSTANG PANDA , using a unique infection chain to target likely Mongolia-based victims .


Throughout the years , the Mofang group has compromised countless servers belonging to government or other Myanmar related organizations , in order to stage attacks .


A report published by Kaspersky Labs in 2011 on NetTraveler also mentions the C2 servers were being hosted by Krypt Technolgies .


Obviously , the developers behind NetTraveler have taken steps to try to hide the malware 's configuration .


In this report , we'll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan .


In this report , we'll review how NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan .


In this report , we'll review how the NetTraveler attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan .


Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique .


NetTraveler has been used to target diplomats , embassies and government institutions for over a decade , and remains the tool of choice by the adversaries behind these cyber espionage campaigns .


WildFire correctly classifies NetTraveler as malicious .


The NetTraveler group has infected victims across multiple establishments in both the public and private sector including government institutions , embassies , the oil and gas industry , research centers , military contractors and activists .


Today Kaspersky Lab 's team of experts published a new research report about NetTraveler , which is a family of malicious programs used by APT actors to successfully compromise more than 350 high-profile victims in 40 countries .


According to Kaspersky Lab 's report , this threat actor has been active since as early as 2004 ; however , the highest volume of activity occurred from 2010 – 2013 .


Most recently , the NetTraveler group 's main domains of interest for cyberespionage activities include space exploration , nanotechnology , energy production , nuclear power , lasers , medicine and communications .


During Kaspersky Lab 's analysis of NetTraveler , the company 's experts identified six victims that had been infected by both NetTraveler and Red October , which was another cyberespionage operation analyzed by Kaspersky Lab in January 2013 .


Kaspersky Lab 's products detect and neutralize the malicious programs and its variants used by the NetTraveler Toolkit , including Trojan-Spy.Win32.TravNet and Downloader.Win32.NetTraveler .


Based on Kaspersky Lab 's analysis of NetTraveler 's C&C data , there were a total of 350 victims in 40 countries across including the United States , Canada , United Kingdom , Russia , Chile , Morocco , Greece , Belgium , Austria , Ukraine , Lithuania , Belarus , Australia , Hong Kong , Japan , China , Mongolia , Iran , Turkey , India , Pakistan , South Korea , Thailand , Qatar , Kazakhstan , and Jordan .


In this case , it was a group commonly referred to as " Nitro " , which was coined by Symantec in its 2011 whitepaper .


Historically , Nitro is known for targeted spear phishing campaigns and using Poison Ivy malware , which was not seen in these attacks .


Since at least 2013 , Nitro appears to have somewhat modified their malware and delivery methods to include Spindest and legitimate compromised websites , as reported by Cyber Squared 's TCIRT .


In July , Nitro compromised a South Korean clothing and accessories manufacturer 's website to serve malware commonly referred to as " Spindest " .


Of all the samples we've tied to this activity so far noted in this blog , this is the only one configured to connect directly to an IP address for Command and Control ( C2 ) .


The next sample was another Spindest variant and had the same timestamp as the aforementioned PcClient sample .


As this post and previous cited research show , APT groups such as Nitro will continue to evolve their techniques within the kill chain to avoid detection .


Attacks on the chemical industry are merely their latest attack wave .


The goal of the attackers appears to be to collect intellectual property such as design documents , formulas , and manufacturing processes .


The attack wave started in late July 2011 and continued into midSeptember 2011 .


The purpose of the attacks appears to be industrial espionage , collecting intellectual property for competitive advantage .


They then moved on to the motor industry in late May .


From late April to early May , the attackers focused on human rights related NGOs .


Attackers then moved on to the motor industry in late May .


At this point , the current attack campaign against the chemical industry began .


The attackers first researched desired targets and then sent an email specifically to the target .


First , when a specific recipient was targeted , the mails often purported to be meeting invitations from established business partners .


While the attackers used different pretexts when sending these malicious emails , two methodologies stood out .


Secondly , when the emails were being sent to a broad set of recipients , the mails purported to be a necessary security update .


The attacks were traced back to a computer system that was a virtual private server ( VPS ) located in the United States .


Attackers are sending malicious PDF and DOC files , which use exploits to drop variants of Backdoor.Sogu .


This particular threat was also used by hackers to compromise a Korean social network site to steal records of 35 million users .


The Sogu gang use a custom developed threat – Backdoor.Sogu , whereas the group described in this document use an off the shelf threat – Poison Ivy .


The Sogu gang , in contrast , use PDF and DOC files in very tailored , targeted emails .


These attacks are primarily targeting private industry in search of key intellectual property for competitive advantage , military institutions , and governmental organizations often in search of documents related to current political events and human rights organizations .


Nitro 's campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes .


This attack campaign focused on the chemical sector with the goal of obtaining sensitive documents such as proprietary designs , formulas , and manufacturing processes .


These have been highly active in the Middle East region and unveiled ongoing targeted attacks in multiple regions .


We found that the group behind this campaign targeted mainly industrial , engineering and manufacturing organizations in more than 30 countries .


Using the Kaspersky Security Network ( KSN ) and artifacts from malware files and attack sites , we were able to trace the attacks back to March 2015 .


Operation Ghoul is one of the many attacks in the wild targeting industrial , manufacturing and engineering organizations , Kaspersky Lab recommends users to be extra cautious while checking and opening emails and attachments .


The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People's Republics .


The attacks appear to be geopolitically motivated and target high profile organizations .


The objective of the attacks is clearly espionage – they involve gaining access to top legislative , executive and judicial bodies around the world .


The attackers have targeted a large number of organizations globally since early 2017 , with the main focus on the Middle East and North Africa ( MENA ) , especially Palestine .


The attacks were initially discovered while investigating a phishing attack that targeted political figures in the MENA region .


Like BlackEnergy ( a.k.a Sandworm , Quedagh ) , Potao is an example of targeted espionage ( APT ) malware detected mostly in Ukraine and a number of other CIS countries , including Russia , Georgia and Belarus .


The main reason for the increase in Potao detections in 2014 and 2015 were infections through USB drives .


The first Potao campaign that we examined took place in August 2011 .


In March 2014 , the gang behind Potao started using a new infection vector .


Since March 2015 , ESET has detected Potao binaries at several high-value Ukrainian targets that include government and military entities and one of the major Ukrainian news agencies .


As confirmation that the malware writers are still very active even at the time of this writing , ESET detected a new Potao sample compiled on July 20 , 2015 .


In the previous pages we have presented our findings based on ESET detection telemetry and our analysis of Win32/Potao and Win32/FakeTC samples .


Potao is another example of targeted espionage malware , a so-called APT , to use the popular buzzword , although technically the malware is not particularly advanced or sophisticated .


Examples of notable Potao dissemination techniques , some of which were previously unseen , or at least relatively uncommon , include the use of highly-targeted spear-phishing SMS messages to drive potential victims to malware download sites and USB worm functionality that tricked the user into ' willingly ' executing the trojan .


The PassCV group continues to be one of the most successful and active threat groups that leverage a wide array of stolen Authenticode-signing certificates .


The PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) .


he PassCV group typically utilized publicly available RATs in addition to some custom code , which ultimately provided backdoor functionality to affected systems via phony resumes and curriculum vitae ( CVs ) .


PassCV continues to maintain a heavy reliance on obfuscated and signed versions of older RATs like ZxShell and Ghost RAT , which have remained a favorite of the wider Chinese criminal community since their initial public release .


SPEAR identified recent PassCV samples which implemented another commercial off-the-shelf ( COTS ) RAT called Netwire .


The first new connection SPEAR identified was derived from an email address listed in Blue Coat Systems' original report on PassCV .


Syncopate is a well-known Russian company that is best known as the developer and operator of the ' GameNet ' platform .


The PassCV group continues to be extremely effective in compromising both small and large game companies and surreptitiously using their code-signing certificates to infect an even larger swath of organizations .


Since the last report , PassCV has significantly expanded its targets to include victims in the United States , Taiwan , China and Russia .


Based on data collected from Palo Alto Networks AutoFocus threat intelligence , we discovered continued operations of activity very similar to the Roaming Tiger attack campaign that began in the August 2015 timeframe , with a concentration of attacks in late October and continuing into December .


BBSRAT is typically packaged within a portable executable file , although in a few of the observed instances , a raw DLL was discovered to contain BBSRAT .


WildFire properly classifies BBSRAT malware samples as malicious .


This week we will discuss another Chinese nexus adversary we call Samurai Panda .


Samurai Panda is interesting in that their target selection tends to focus on Asia Pacific victims in Japan , the Republic of Korea , and other democratic Asian victims .


Next , in an effort to demonstrate it wasn't relegated to China , CrowdStrike exposed Clever Kitten , an actor we track out of Iran who leverages some very distinct TTPs when viewed next to a more visible adversary .


Next , in an effort to demonstrate it wasn't relegated to China , we exposed Clever Kitten , an actor we track out of Iran who leverages some very distinct TTPs when viewed next to a more visible adversary .


Beginning in 2009 , we've observed this actor conduct more than 40 unique campaigns that we've identified in the malware configurations' campaign codes .


These codes are often leveraged in the malware used by coordinated targeted attackers to differentiate victims that were successfully compromised from different target sets .


When conducting programmatic espionage activity , it can presumably become quite confusing if the attacker targets a heavy industry company , an avionics program , and seven other unique targets as to which infected host you will collect what information from .


These rules detect the malware " beaconing " to the command-and-control server , the initial malware check-in , and an attempt to download a backdoor module .


Earlier this month , Securelist 's technology caught another zero-day Adobe Flash Player exploit deployed in targeted attacks .


Securelist believe the attacks are launched by an APT Group we track under the codename " ScarCruft " .


ScarCruft is a relatively new APT group ; victims have been observed in Russia , Nepal , South Korea , China , India , Kuwait and Romania .


ScarCruft has several ongoing operations , utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer .


Adobe Flash Player exploit .


It is also possible that ScarCruft deployed another zero day exploit , CVE-2016-0147 , which was patched in April .


Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks .


ScarCruft 's Operation Erebus leverages another Flash Player exploit ( CVE-2016-4117 ) through the use of watering hole attacks .


Nevertheless , resourceful threat actors such as ScarCruft will probably continue to deploy zero-day exploits against their high profile targets .


After publishing our initial series of blogposts back in 2016 , Kaspersky have continued to track the ScarCruft threat actor .


After publishing our initial series of blogposts back in 2016 , we have continued to track the ScarCruft threat actor .


ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula .


The ScarCruft group uses common malware delivery techniques such as spear phishing and Strategic Web Compromises ( SWC ) .


ScarCruft uses a multi-stage binary infection scheme .


One of the most notable functions of the initial dropper is to bypass Windows UAC ( User Account Control ) in order to execute the next payload with higher privileges .


Afterwards , the installer malware creates a downloader and a configuration file from its resource and executes it .


The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload .


The ScarCruft group keeps expanding its exfiltration targets to steal further information from infected hosts and continues to create tools for additional data exfiltration .


We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester .


We believe they may have some links to North Korea , which may explain why ScarCruft decided to closely monitor them .


ScarCruft also attacked a diplomatic agency in Hong Kong , and another diplomatic agency in North Korea .


It appears ScarCruft is primarily targeting intelligence for political and diplomatic purposes .


ScarCruft infected this victim on September 21 , 2018 .


But before the ScarCruft infection , however , another APT group also targeted this victim with the host being infected with GreezeBackdoor on March 26 , 2018 .


ScarCruft has a keen interest in North Korean affairs , attacking those in the business sector who may have any connection to North Korea , as well as diplomatic agencies around the globe .


Earlier this month , we caught another zero-day Adobe Flash Player exploit deployed in targeted attacks .


ScarCruft is a relatively new APT group ; victims have been observed in several countries , including Russia , Nepal , South Korea , China , India , Kuwait and Romania .


Currently , the group is engaged in two major operations : Operation Daybreak and Operation Erebus .


The other one , ScarCruft 's Operation Erebus employs an older exploit , for CVE-2016-4117 and leverages watering holes .


The other one , " Operation Erebus " employs an older exploit , for CVE-2016-4117 and leverages watering holes .


We will publish more details about the attack once Adobe patches the vulnerability , which should be on June 16 .


The ScarCruft APT gang has made use of a Flash zero day patched Thursday by Adobe to attack more than two dozen high-profile targets in Russia and Asia primarily .


Adobe on Thursday patched a zero-day vulnerability in Flash Player that has been used in targeted attacks carried out by a new APT group operating primarily against high-profile victims in Russia and Asia .


Researchers at Kaspersky Lab privately disclosed the flaw to Adobe after exploits against the zero-day were used in March by the ScarCruft APT gang in what Kaspersky Lab is calling Operation Daybreak .


Kaspersky speculates that ScarCruft could also be behind another zero-day , CVE-2016-0147 , a vulnerability in Microsoft XML Core Services that was patched in April .


Attacks start with spear-phishing emails that include a link to a website hosting an exploit kit associated with ScarCruft and used in other attacks .


Another set of attacks called Operation Erebus leverages another Flash exploit , CVE-2016-4117 , and relies on watering hole attacks as a means of propagation .


Thursday 's Flash Player update patched 36 vulnerabilities in total including the zero day CVE-2016-4171 .


The ongoing operation likely began as early as January 2017 and has continued through the first quarter of 2019 .


Cisco Talos assess with high confidence that these operations are distinctly different and independent from the operations performed by DNSpionage , which we reported on in November 2018 .


We assess with high confidence that these operations are distinctly different and independent from the operations performed by DNSpionage , which we reported on in November 2018 .


The common use of the Enfal Trojan suggests that Shadow Network may be exchanging tools and techniques .


While Silence had previously targeted Russian banks , Group-IB experts also have discovered evidence of the group 's activity in more than 25 countries worldwide .


In August 2017 , the National Bank of Ukraine warned state-owned and private banks across the country about a large-scale phishing attack .


The threat actor used an exploit from the arsenal of the state-sponsored hacker group APT28 .


The new threat actor group was eventually named Silence .


Silence is a group of Russian-speaking hackers , based on their commands language , the location of infrastructure they used , and the geography of their targets ( Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan ) .


Although Silence 's phishing emails were also sent to bank employees in Central and Western Europe , Africa , and Asia ) .


Silence also used Russian-language web hosting services .


Financially motivated APT groups which focus efforts on targeted attacks on the financial sector such as — Anunak , Corkow , Buhtrap — usually managed botnets using developed or modified banking Trojans .


They tried new techniques to steal from banking systems , including AWS CBR ( the Russian Central Bank 's Automated Workstation Client ) , ATMs , and card processing .


Group-IB researchers were tracking Silence throughout this period and conducting response following incidents in the financial sector .


Group-IB detected the first incidents relating to Silence in June 2016 .


One of Silence 's first targets was a Russian bank , when they tried to attack AWS CBR .


Silence try to apply new techniques and ways of stealing from various banking systems , including AWS CBR , ATMs , and card processing .


Silence 's successful attacks currently have been limited to the CIS and Eastern European countries .


He is responsible for developing tools for conducting attacks and is also able to modify complex exploits and third party software .


Silence 's main targets are located in Russia , Ukraine , Belarus , Azerbaijan , Poland , and Kazakhstan .


However , some phishing emails were sent to bank employees in more than 25 countries of Central and Western Europe , Africa and Asia including : Kyrgyzstan , Armenia , Georgia , Serbia , Germany , Latvia , Czech Republic , Romania , Kenya , Israel , Cyprus , Greece , Turkey , Taiwan , Malaysia , Switzerland , Vietnam , Austria , Uzbekistan , Great Britain , Hong Kong , and others .


In the same year , they conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans .


In the same year , Silence conducted DDoS attacks using the Perl IRC bot and public IRC chats to control Trojans .


In two months , the group returned to their proven method and withdrew funds again through ATMs .


In September 2017 , we discovered a new targeted attack on financial institutions .


In September 2017 , we discovered Silence attack on financial institutions .


The infection vector is a spear-phishing email with a malicious attachment .


An interesting point in the Silence attack is that the cybercriminals had already compromised banking infrastructure in order to send their spear-phishing emails from the addresses of real bank employees and look as unsuspicious as possible to future victims .


The spear-phishing infection vector is still the most popular way to initiate targeted campaigns .


We conclude that the actor behind the attack is Silence group , a relatively new threat actor that's been operating since mid-2016 .


A preliminary analysis caught the attention of our Threat Analysis and Intelligence team as it yielded interesting data that , among other things , shows that Silence was targeting employees from financial entities , specifically in the Russian Federation and the Republic of Belarus .


As shown above , the threat runs several native binaries to collect useful information for its recon phase .


The intelligence we have collected shows that Silence is part of a more extensive operation , still focused on financial institutions operating mainly on Russian territory .


These spearphishing attempts represent an evolution of Iranian actors based on their social engineering tactics and narrow targeting .


Based on file modification dates and timestamps of samples , it appears that the observed campaign was initiated in the middle of February 2016 , with the infrastructure taken offline at the start of March .


While the Sima moniker could similarly originate from software labels , it is a common female Persian name and a Persian-language word for " visage " or " appearance " .


Given its use in more advanced social engineering campaigns against women 's rights activists , the label seem particularly apt .


Samples and resource names contained the family names of prominent Iranians , and several of these individuals received the malware located in their respective folder .


The Sima group also engaged in impersonation of Citizenship and Immigration Services at the Department of Homeland Security , posing as a notice about the expiration of the recipient 's Permanent Residence status .


In another case , Sima mirrored an announcement made about the broadcast of a television program on Iranian-American cultural affairs in order to impersonate the individual and engage in spearphishing within hours of the legitimate message .


The server used to host these malware samples was located on the German provider Hetzner ( 148.251.55.114 ) , within a small block of IP addresses that are registered with the customer ID " HOS-156205 " .


All the samples appear to be have been compiled between February 29 and March 1 2016 , shortly before our discovery , suggesting that , despite the known C&C servers having quickly gone offline shortly after , this spree of attacks might be fresh and currently undergoing .


These archives provide further indication that those entities behind the campaigns are Persian-language speakers , due to the naming of files and folders in Persian .


For the sake of narrative we are going to focus exclusively to those samples we identified being used in attacks against Iranian civil society and diaspora .


Butterfly has attacked multi-billion dollar companies operating in the internet , IT software , pharmaceutical , and commodities sectors .


The first signs of Butterfly 's activities emerged in early 2013 when several major technology and internet firms were compromised .


However , an investigation by Symantec has found that the group has been active since at least March 2012 and its attacks have not only continued to the present day , but have also increased in number .


Symantec has to date discovered 49 different organizations in more than 20 countries that have been attacked by Butterfly .


Aside from the four companies which have publicly acknowledged attacks , Symantec has identified five other large technology firms compromised by Butterfly , primarily headquartered in the US .


In the first attack , Butterfly gained a foothold by first attacking a small European office belonging to one firm and using this infection to then move on to its US office and European headquarters .


However , technology is not the only sector the group has focused on and Symantec has found evidence that Butterfly has attacked three major European pharmaceutical firms .


Butterfly has also shown an interest in the commodities sector , attacking two major companies involved in gold and oil in late 2014 .


The company specializes in finance and natural resources specific to that region .


The latter was one of at least three law firms Butterfly has targeted over the past three years .


In many attacks , the group has succeeded in compromising Microsoft Exchange or Lotus Domino email servers in order to intercept company emails and possibly use them to send counterfeit emails .


A powerful threat actor known as " Wild Neutron " ( also known as " Jripbot " and " Morpho " ) has been active since at least 2011 , infecting high profile companies for several years by using a combination of exploits , watering holes and multi-platform malware .


Based on the profile of the victims and the type of information targeted by the attackers , Symantec believes that Butterfly is financially motivated , stealing information it can potentially profit from .


Wild Neutron hit the spotlight in 2013 , when it successfully infected companies such as Apple , Facebook , Twitter and Microsoft .


Wild Neutron 's attacks in 2015 uses a stolen code signing certificate belonging to Taiwanese electronics maker Acer and an unknown Flash Player exploit .


During the 2013 attacks , the Wild Neutron actor successfully compromised and leveraged the website www.iphonedevsdk.com , which is an iPhone developers forum .


Wild Neutron 's attack took advantage of a Java zero-day exploit and used hacked forums as watering holes .


While the group used watering hole attacks in 2013 , it's still unclear how victims get redirected to the exploitation kits in the new 2014-2015 attacks .


Wild Neutron 's tools include a password harvesting trojan , a reverse-shell backdoor and customized implementations of OpenSSH , WMIC and SMB .


Instead of Flash exploits , older Wild Neutron exploitation and watering holes used what was a Java zero-day at the end of 2012 and the beginning of 2013 , detected by Kaspersky Lab products as Exploit.Java.CVE-2012-3213.b .


The victims for the 2014-2015 versions are generally IT and real estate/investment companies and in both cases , a small number of computers have been infected throughout Wild Neutron .


Wild Neutron 's targeting of major IT companies , spyware developers ( FlexiSPY ) , jihadist forums ( the " Ansar Al-Mujahideen English Forum " ) and Bitcoin companies indicate a flexible yet unusual mindset and interests .


We continue to track the Wild Neutron group , which is still active as of June 2015 .


A ransomware variant dubbed PyLocky was observed in September 2018 being distributed by a phishing campaign using an invoicing theme .


PyLocky was found to be targeting entities in France and Germany .


Fxmsp specialize in breaching highly secure protected networks to access private corporate and government information .


Fxmsp is a hacking collective that has operated in various top-tier Russian- and English-speaking underground communities since 2017 .


Throughout 2017 and 2018 , Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground .


On April 24 , 2019 , Fxmsp claimed to have secured access to three leading antivirus companies .


According to the Fxmsp , they worked tirelessly for the first quarter of 2019 to breach these companies and finally succeeded and obtained access to the companies' internal networks .


Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body . For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2 This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP port 443 .


Previous reports have discussed Bisonal malware used in attacks against Japan , South Korea and Russia .


This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others .


If it's Cyrillic and the command to the shell is not ‘ipconfig’ , the threat converts the command result text encoding from Cyrillic to UTF-16 .


Similar to the Bisonal variant targeting the Russian organization , this sample was also disguised as PDF document .


The contents of the decoy PDF is a job descriptions with the South Korean Coast Guard .


The installed EXE file is almost exactly the same as the DLL version of Bisonal variant used against the Russian organization .


The targets are military or defense industry in particular countries , it used DDNS for C2 servers , and tracked connections from their victims by using target or campaign codes , as well as disguising the malware as document file , and using a dropper to install the malware and decoy file .


A previous campaign of this APT group was uncovered by Talos in June 2017 , and since then very little of this operation was seen in the wild .


ined in the archive is called DriverInstallerU.exe” but its metadata shows that its original name is Interenet Assistant.exe” .


After reviewing all the malware functionalities , we are confident in saying that the attackers look for victims who answer well-defined characteristics and believe that further stages of the attack are delivered only to those who fit the specific victim profile .


In this sample , however , the module names were changed from actors and characters’ names to car models , namely BMW_x1” , BMW_x2” and up to BMW_x8” .


But , thanks to the attackers known affection for decoy documents that pose as news summaries , we were able to date the campaign back to March 2018 .


With the experience gained from the APT attack that began in March 2017 , it seems this campaign has evolved into an attack with new capabilities , and an even more specific target , over a year later .


These unknown actors continued launching DDoS attacks over the next few years .


For simplicity , Kaspersky is calling them the BlackEnergy APT group .


Since the middle of 2015 , one of the preferred attack vectors for BlackEnergy in Ukraine has been Excel documents with macros that drop the Trojan to disk if the user chooses to run the script in the document .


A very good analysis and overview of the BlackEnergy attacks in Ukraine throughout 2014 and 2015 was published by the Ukrainian security firm Cys Centrum the text is only available in Russian for now , but can be read via Google Translate .


The earliest signs of destructive payloads with BlackEnergy go back as far as June 2014 .


BlackEnergy is a highly dynamic threat actor and the current attacks in Ukraine indicate that destructive actions are on their main agenda , in addition to compromising industrial control installations and espionage activities .


Kaspersky will continue to monitor the BlackEnergy attacks in Ukraine and update our readers with more data when available .


From Buhtrap perpetrating cybercrime for financial gain , its toolset has been expanded with malware used to conduct espionage in Eastern Europe and Central Asia .


Throughout our tracking , we've seen this group deploy its main backdoor as well as other tools against various victims , but June 2019 was the first time we saw the Buhtrap group use a zero-day exploit as part of a campaign .


However , as the shift in targets occurred before the source code leak , we assess with high confidence that the same people behind the first Buhtrap malware attacks against businesses and banks are also involved in targeting governmental institutions .


When Buhtrap was targeting businesses , the decoy documents would typically be contracts or invoices .


The Buhtrap group is well known for its targeting of financial institutions and businesses in Russia .


Figure 2 is a typical example of a generic invoice the group used in a campaign in 2014 .


When the group's focus shifted to banks , the decoy documents were related to banking system regulations or advisories from FinCERT , an organization created by the Russian government to provide help and guidance to its financial institutions .


We confirmed that this is a DarkHydrus Group's new attack targeting Middle East region .


In July 2018 , Palo Alto disclosed DarkHydrus Group which showed its special interest to governments in Middle East .


Prior to that report , we published detail analysis on malware exploiting CVE-2018-8414 vulnerability (remote code execution in SettingContent-ms) , which is believed a work of DarkHydrus .


However , the final payload is something that welivesecurity have never seen associated with Buhtrap .


It's coincident that both 'darkhydrus' APT group name and ‘Williams’ user name in PDB path found in this Twitter user .


In recent APT incidents , Dark Hydruns tend to adopt Office VBA macro instead of Office 0day vulnerability in the consideration of cost reduction .


ASERT uncovered a credential theft campaign we call LUCKY ELEPHANT where attackers masquerade as legitimate entities such as foreign government , telecommunications , and military .


From at least February 2019 to present , the actors in the LUCKY ELEPHANT campaign copied webpages to mimic South Asian government websites as well as Microsoft Outlook 365 login pages and hosted them on their own doppelganger domains , presumably to trick victims into providing login credentials .


ASERT suspects that the Actors use phishing emails to lure victims to the doppelganger websites and entice users to enter their credentials .


It is important to note that one domain , yahoomail[.]cf is only associated with this group from February 2019 onward .


In late 2018 , the domain was associated with a different APT group / campaign of Chinese origin .


Based on our analysis into the activity , ASERT deems with moderate confidence that an Indian APT group is behind the LUCKY ELEPHANT campaign .


The targets are typical of known Indian APT activity and the infrastructure was previously used by an Indian APT group .


DoNot Team has a history of heavily targeting Pakistan , in addition to other neighboring countries .


The 360 Intelligence Center observed four distinct campaigns against Pakistan since 2017 (link) , recently targeting Pakistani businessmen working in China .


DoNot Team’s confirmed use of this IP dates back to September 2018 , with a six-month gap until it was used to host doppelganger domains for the LUCKY ELEPHANT campaign in early February .


One of the IP addresses , 128.127.105.13 , was previously used by the DoNot Team (aka APT-C-35) , a suspected Indian APT group .


The actors behind LUCKY ELEPHANT recognize the effectiveness and use doppelganger webpages nearly identical to legitimate sites , enticing users to input their credentials .


The heavier targeting in Pakistan adheres to historical targeting and the ongoing tension between the two countries , which has escalated since a terrorist attack in Kashmir on 14 February 2019 .


The targeting of Pakistan , Bangladesh , Sri Lanka , Maldives , Myanmar , Nepal , and the Shanghai Cooperation Organization are all historical espionage targets by India .


However , it is clear is that Donot are actively establishing infrastructure and are targeting governments in South Asia .


First attack of this campaign took place in May 2018 .


Arbor also published APT research on this group , and named it ‘Donot’ .


Donot attacked government agencies , aiming for classified intelligence .


We identified this APT group coded as ‘APT-C-35’ in 2017 , who is mainly targeting Pakistan and other South Asian countries for cyber espionage .


At least 4 attack campaigns against Pakistan have been observed by us since 2017 .


Spear phishing emails with vulnerable Office documents or malicious macros are sent to victims .


In the latest attack , Donot group is targeting Pakistani businessman working in China .


Two unique malware frameworks , EHDevel and yty , are developed by attackers .


wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 .


Furthermore , it has similar code logic as previous ones wuaupdt.exe in this attack appears in previous Donot attack , and C2 addresses are same to previous ones .


From the attack activity captured this time , it is obvious that Donot APT group is still keen on Pakistan as primary target of attack , and even expands scope of attack to include Pakistani staffs and institutions in China .


Buhtrap still make extensive use of NSIS installers as droppers and these are mainly delivered through malicious documents .


They first came to light in 2016 , when they managed to steal sensitive information from the US Democratic National Committee (DNC) .


Earworm first came to light in 2016 , when they managed to steal sensitive information from the US Democratic National Committee (DNC) .


They were also behind an attack on the World Anti-Doping Agency (WADA) , in which they leaked confidential information about several drug tests .


SPLM , GAMEFISH , and Zebrocy delivery all maintain their own clusters , but frequently overlap later .


Our previous post on Sofacy's 2017 activity stepped away from the previously covered headline buzz presenting their association with previously known political hacks and interest in Europe and the US , and examines their under-reported ongoing activity in middle east , central asia , and now a shift in targeting further east , including China , along with an overlap surprise .


The larger , 300kb+ SPLM backdoors deployed in 2016 and 2017 are not observed any longer at targets in 2018 .


A previous , removed , report from another vendor claimed non-specific information about the groups' interest in Chinese universities , but that report has been removed – most likely detections were related to students’ and researchers’ scanning known collected samples and any incidents” remain unconfirmed and unknown .


Either way , the group's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion .


The actors behind this campaign we call LUCKY ELEPHANT use doppelganger webpages to mimic legitimate entities such as foreign governments , telecommunications , and military .


Currently , Sofacy targets large air-defense related commercial organizations in China with SPLM , and moves Zebrocy focus across Armenia , Turkey , Kazahkstan , Tajikistan , Afghanistan , Mongolia , China , and Japan .


Either way , Sofacy's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion .


According to this new alert , Hidden Cobra the U.S government’s code name for Lazarus has been conducting FASTCash attacks stealing money from Automated Teller Machines (ATMs) from banks in Asia and Africa since at least 2016 .


Lazarus is a very active attack group involved in both cyber crime and espionage .


The group was initially known for its espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures .


Following US-CERTs report , Symantec's research uncovered the key component used in Lazarus's recent wave of financial attacks .


More recently , Lazarus has also become involved in financially motivated attacks , including an US$81 million dollar theft from the Bangladesh Central Bank and the WannaCry ransomware .


Other open source and semi-legitimate pen-testing tools like nbtscan and powercat are being used for mapping available resources and lateral movement as well .


To make the fraudulent withdrawals , Lazarus first breaches targeted banks' networks and compromises the switch application servers handling ATM transactions .


The operation , known as FASTCash” has enabled Lazarus to fraudulently empty ATMs of cash .


In order to permit their fraudulent withdrawals from ATMs , Lazarus inject a malicious Advanced Interactive eXecutive (AIX) executable into a running , legitimate process on the switch application server of a financial transaction network , in this case a network handling ATM transactions .


It was previously believed that the attackers used scripts to manipulate legitimate software on the server into enabling the fraudulent activity .


In recent years , Lazarus has also become involved in financially motivated attacks .


This malware in turn intercepts fraudulent Lazarus cash withdrawal requests and sends fake approval responses , allowing the attackers to steal cash from ATMs .


Lazarus was linked to the $81 million theft from the Bangladesh central bank in 2016 , along with a number of other bank heists .


Lazarus was also linked to the WannaCry ransomware outbreak in May 2017 .


WannaCry incorporated the leaked EternalBlue exploit that used two known vulnerabilities in Windows CVE-2017-0144 and CVE-2017-0145 to turn the ransomware into a worm , capable of spreading itself to any unpatched computers on the victim's network and also to other vulnerable computers connected to the internet .


Lazarus was initially known for its involvement in espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures that saw large amounts of information being stolen and computers wiped by malware .


In short , Lazarus continues to pose a serious threat to the financial sector and organizations should take all necessary steps to ensure that their payment systems are fully up to date and secured .


As with the 2016 series of virtual bank heists , including the Bangladesh Bank heist , FASTCash illustrates that Lazarus possesses an in-depth knowledge of banking systems and transaction processing protocols and has the expertise to leverage that knowledge in order to steal large sums from vulnerable banks .


The attack , which starts with a malicious attachment disguised as a top secret US document , weaponizes TeamViewer , the popular remote access and desktop sharing software , to gain full control of the infected computer .


As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC .


It is hard to tell if there are geopolitical motives behind this campaign by looking solely at the list of countries it was targeting , since it was not after a specific region and the victims came from different places in the world .


The initial infection vector used by the threat actor also changed over time , during 2018 we have seen multiple uses of self-extracting archives instead of malicious documents with AutoHotKey , which displayed a decoy image to the user .


The recent wave of FASTCash attacks demonstrates that financially motivated attacks are not simply a passing interest for the Lazarus group and can now be considered one of its core activities .


Although both examples of the different delivery methods described above show an exclusive targeting of Russian speakers , the recurring financial and political themes that they use highlight the attacker's interest in the financial world once more .


Throughout our investigation , we have found evidence that shows operational similarities between this implant and Gamaredon Group .


Gamaredon Group is an alleged Russian threat group .


Gamaredon Group has been active since at least 2013 , and has targeted individuals likely involved with the Ukrainian government .


EvilGnome's functionalities include desktop screenshots , file stealing , allowing capturing audio recording from the user’s microphone and the ability to download and execute further modules .


Gamaredon Group primarily makes use of Russian hosting providers in order to distribute its malware .


Gamaredon Group's implants are characterized by the employment of information stealing tools — among them being screenshot and document stealers delivered via a SFX , and made to achieve persistence through a scheduled task .


Gamaredon Group infects victims using malicious attachments , delivered via spear phishing techniques .


The techniques and modules employed by EvilGnome — that is the use of SFX , persistence with task scheduler and the deployment of information stealing tools—remind us of Gamaredon Group’s Windows tools .


We can observe that the sample is very recent , created on Thursday , July 4 .


As can be observed in the illustration above , the makeself script is instructed to run ./setup.sh after unpacking .


The ShooterAudio module uses PulseAudio to capture audio from the user's microphone .


makeself.sh is a small shell script that generates a self-extractable compressed tar archive from a directory .


During our 2018 monitoring of this group , we were able to identify different techniques utilized by very similar attackers in the MENA region , sometimes on the same target .


Gaza Cybergang Group3 (highest sophistication) whose activities previously went by the name Operation Parliament .


Gaza Cybergang has been seen employing phishing , with several chained stages to evade detection and extend command and control server lifetimes .


The most popular targets of SneakyPastes are embassies , government entities , education , media outlets , journalists , activists , political parties or personnel , healthcare and banking .


Through our continuous monitoring of threats during 2018 , we observed a new wave of attacks by Gaza Cybergang Group1 targeting embassies and political personnel .


Gaza Cybergang Group1 is an attack group with limited infrastructure and an open-source type of toolset , which conducts widespread attacks , but is nevertheless focused on Palestinian political problems .


In this campaign , Gaza Cybergang used disposable emails and domains as the phishing platform to target the victims .


We expect the damage caused by these groups to intensify and the attacks to extend into other regions that are also linked to the complicated Palestinian situation .


Cylance determined that the ‘Ghost Dragon’ group utilized specifically tailored variants of Gh0st RAT , which the group modified from the 3.6 version of the source code released in 2008 .


The standard network protocol for Gh0st RAT 3.6 employs zlib compression , which utilizes ‘Gh0st’ as a static five-byte packet flag that must be included in the first five bytes of initial transmission from the victim .


In a more recent version of the modified Gh0st RAT malware , Ghost Dragon implemented dynamic packet flags which change the first five bytes of the header in every login request with the controller .


SPEAR has observed numerous different XOR keys utilized by Ghost Dragon .


Exploit and tools continued to be used after Buckeye's apparent disappearance in 2017 .


The Buckeye attack group was using Equation Group tools to gain persistent access to target organizations at least a year prior to the Shadow Brokers leak .


Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability .


While Buckeye appeared to cease operations in mid-2017 , the Equation Group tools it used continued to be used in attacks until late 2018 .


The 2017 leak of Equation Group tools by a mysterious group calling itself the Shadow Brokers was one of the most significant cyber security stories in recent years .


However , Symantec has now found evidence that the Buckeye cyber espionage group (aka APT3 , Gothic Panda ) began using Equation Group tools in attacks at least a year prior to the Shadow Brokers leak .


Equation is regarded as one of the most technically adept espionage groups and the release of a trove of its tools had a major impact , with many attackers rushing to deploy the malware and exploits disclosed .


DoublePulsar was delivered to victims using a custom exploit tool (Trojan.Bemstour) that was specifically designed to install DoublePulsar .


One vulnerability is a Windows zero-day vulnerability (CVE-2019-0703) discovered by Symantec .


Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers .


The second Windows vulnerability (CVE-2017-0143) was patched in March 2017 after it was discovered to have been used by two exploit tools—EternalRomance and EternalSynergy—that were also released as part of the Shadow Brokers leak .


It was reported by Symantec to Microsoft in September 2018 and was patched on March 12 , 2019 .


How Buckeye obtained Equation Group tools at least a year prior to the Shadow Brokers leak remains unknown .


The Buckeye attack group had been active since at least 2009 , when it began mounting a string of espionage attacks , mainly against organizations based in the U.S .


These include CVE-2010-3962 as part of an attack campaign in 2010 and CVE-2014-1776 in 2014 .


Beginning in August 2016 , a group calling itself the Shadow Brokers began releasing tools it claimed to have originated from the Equation Group .


Over the coming months , it progressively released more tools , until April 2017 , when it released a final , large cache of tools , including the DoublePulsar backdoor , the FuzzBunch framework , and the EternalBlue , EternalSynergy , and EternalRomance exploit tools .


However , Buckeye had already been using some of these leaked tools at least a year beforehand .


The earliest known use of Equation Group tools by Buckeye is March 31 , 2016 , during an attack on a target in Hong Kong .


Beginning in March 2016 , Buckeye began using a variant of DoublePulsar (Backdoor.Doublepulsar) , a backdoor that was subsequently released by the Shadow Brokers in 2017 .


However , while activity involving known Buckeye tools ceased in mid-2017 , the Bemstour exploit tool and the DoublePulsar variant used by Buckeye continued to be used until at least September 2018 in conjunction with different malware .


During this attack , the Bemstour exploit tool was delivered to victims via known Buckeye malware (Backdoor.Pirpi) .


One hour later , Bemstour was used against an educational institution in Belgium .


Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor .


DoublePulsar is then used to inject a secondary payload , which runs in memory only .


A significantly improved variant of the Bemstour exploit tool was rolled out in September 2016 , when it was used in an attack against an educational institution in Hong Kong .


When used against 32-bit targets , Bemstour still delivered the same DoublePulsar backdoor .


Bemstour was used again in June 2017 in an attack against an organization in Luxembourg .


Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam .


Development of Bemstour has continued into 2019 .


Unlike earlier attacks when Bemstour was delivered using Buckeye's Pirpi backdoor , in this attack Bemstour was delivered to the victim by a different backdoor Trojan (Backdoor.Filensfer) .


The most recent sample of Bemstour seen by Symantec appears to have been compiled on March 23 , 2019 , eleven days after the zero-day vulnerability was patched by Microsoft .


Filensfer is a family of malware that has been used in targeted attacks since at least 2013 .