DHS and FBI are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity .


The malware known as RATANKBA is just one of the weapons in Lazarus ' arsenal .


We analyzed a new RATANKBA variant ( BKDR_RATANKBA.ZAEL–A ) , discovered in June 2017 , that uses a PowerShell script instead of its more traditional PE executable form—a version that other researchers also recently identified .


Around 55% of the victims of Lazarus were located in India and neighboring countries .


Lazarus group could have been active since late 2016 , was used in a recent campaign targeting financial institutions using watering hole attacks .


Since they first emerged back in 2007 with a series of cyberespionage attacks against the South Korean government , these threat actors have successfully managed to pull off some of the most notable and devastating targeted attacks—such as the widely-reported 2014 Sony hack and the 2016 attack on a Bangladeshi bank—in recent history .


It 's possible that Lazarus is using RATANKBA to target larger organizations .


RATANKBA is delivered to its victims using a variety of lure documents , including Microsoft Office documents , malicious CHM files , and different script downloaders .


Overall , an organization will need multilayered security strategies , as Lazarus and other similar groups are experienced cybercriminals who employ different strategies to get past organizational defenses .


simultaneous use of the detected Win32/KillDisk.NBO variants .


Working with U.S. Government partners , DHS and FBI identified Trojan malware variants used by the North Korean government – commonly known as HARDRAIN .


These files have the capability to download and install malware , install proxy and Remote Access Trojans ( RATs ) , connect to command and control ( C2 ) servers to receive additional instructions , and modify the victim 's firewall to allow incoming connections .


The cybercriminal group Lazarus has a history of attacking financial organizations in Asia and Latin America .


We also recently discovered that Lazarus successfully planted their backdoor ( detected by Trend Micro as BKDR_BINLODR.ZNFJ-A ) into several machines of financial institutions across Latin America .


We determined that these backdoors were installed on the targets ' machines on September 19 2018 , based mainly on the service creation time of the loader component .


Just last week Lazarus were found stealing millions from ATMs across Asia and Africa .


These and other tools used by the Lazarus group can be mitigated by routinely scanning the network for any malicious activity to help prevent the malware from entering and spreading through an organization .


The backdoors Lazarus are deploying are difficult to detect and a significant threat to the privacy and security of enterprises , allowing attackers to steal information , delete files , install malware , and more .


Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security can protect users and businesses from these threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs .


FBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation .


Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others .


We also saw that the attack technique bears some resemblance to a previous 2017 Lazarus attack , analyzed by BAE Systems , against targets in Asia .


Notably , after the first SMB packet sent to the victim 's IP address , WannaCry sends two additional packets to the victim containing the hard-coded IP addresses 192.168.56.20 and 172.16.99.5 .


WannaCry ( also known as WCry or WanaCryptor ) malware is a self-propagating ( worm-like ) ransomware that spreads through internal networks and over the public internet by exploiting a vulnerability in Microsoft 's Server Message Block ( SMB ) protocol , MS17-010 .


The WannaCry malware consists of two distinct components , one that provides ransomware functionality and a component used for propagation , which contains functionality to enable SMB exploitation capabilities .


WannaCry leverages an exploit , codenamed " EternalBlue " , that was released by the Shadow Brokers on April 14 , 2017 .


WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data .


In May 2017 , SecureWorks® Counter Threat Unit® ( CTU ) researchers investigated a widespread and opportunistic WCry ( also known as WanaCry , WanaCrypt , and Wana Decrypt0r ) ransomware campaign that impacted many systems around the world .


In November 2017 , SecureWorks Counter Threat Unit ( CTU ) researchers investigated a widespread and opportunistic WCry ransomware campaign that impacted many systems around the world .


The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April .


If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit .


WCry uses a combination of the RSA and AES algorithms to encrypt files .


The campaign 's use of an SMB worm to distribute WCry contributed to the ransomware 's virulence .


Last week Microsoft , working together with Facebook and others in the security community , took strong steps to protect our customers and the internet from ongoing attacks by an advanced persistent threat actor known to us as ZINC , also known as the Lazarus Group .


Last week Microsoft , working together with Facebook , took strong steps to protect our customers and the internet from ongoing attacks by the Lazarus Group .


We concluded that Lazarus Group was responsible for WannaCry , a destructive malware .


We concluded that Lazarus Group was responsible for WannaCry , a destructive attack in May that targeted Microsoft customers .


Today , the governments of the United States , United Kingdom , Australia , Canada , New Zealand and Japan have all announced that the government of North Korea is responsible for the activities of ZINC/Lazarus .


In November 2017 , Secureworks Counter Threat Unit™ ( CTU ) researchers discovered the North Korean cyber threat group , known as Lazarus Group and internally tracked as NICKEL ACADEMY by Secureworks , had launched a malicious spearphishing campaign using the lure of a job opening for the CFO role at a European-based cryptocurrency company .


In November 2017 , CTU researchers discovered the North Korean cyber threat group , known as Lazarus Group , had launched a malicious spearphishing campaign using the lure of a job opening for the CFO role at a European-based cryptocurrency company .


Bankshot is designed to persist on a victim 's network for further exploitation ; thus the Advanced Threat Research team believes this operation is intended to gain access to specific financial organizations .


CTU researchers assess this as the continuation of activity first observed in 2016 , and it is likely that the campaign is ongoing .


CTU researchers have observed NICKEL ACADEMY ( Lazarus ) copying and pasting job descriptions from online recruitment sites in previous campaigns .


There are several indicators , which have led CTU researchers to believe with high confidence that NICKEL ACADEMY is behind the current spearphishing campaign .


CTU researchers also identified components in the custom C2 protocol being used which they have seen utilized by Nickel Academy ( Lazarus ) previously .


CTU researchers also identified components in the custom C2 protocol being used ( the way in which the malware talks to the Command and Control Servers ) which they have seen utilized by Nickel Academy ( Lazarus ) previously .


The researchers found that there are common elements in the macro and in the first- stage RAT used in this campaign , with former campaigns of the NICKEL ACADEMY ( Lazarus ) threat group .


During our investigation , there was a breakthrough discovery that helped connect Leafminer to a number of attacks observed on systems in the Middle East and identify the toolkit used in the group 's efforts of intrusion , lateral movement , and exfiltration .


As of early June 2018 , the server hosted 112 files in a subdirectory that could be accessed through a public web shell planted by the Leafminer .


As of early June 2018 , the server hosted 112 files in a subdirectory that could be accessed through a public web shell planted by the attackers .


The Leafminer 's post-compromise toolkit suggests that Leafminer is looking for email data , files , and database servers on compromised target systems .


Researching the hacker handle MagicCoder results in references to the Iranian hacking forum Ashiyane as well as defacements by the Iranian hacker group Sun Army .


Targeted regions included in the list of Leafminer are Saudi Arabia , United Arab Emirates , Qatar , Kuwait , Bahrain , Egypt , Israel , and Afghanistan .


Our investigation of Leafminer started with the discovery of JavaScript code on several compromised websites in the Middle East .


This included the Fuzzbunch framework that was part of an infamous leak of exploits and tools by the Shadow Brokers in April 2017 .


Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft .


The EternalBlue exploit from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 .


The Leafminer operators use EternalBlue to attempt lateral movement within target networks from compromised staging servers .


Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address .


Furthermore , the Leafminer arsenal server hosted a Python script to scan for this vulnerability .


Another intrusion approach used by Leafminer seems a lot less sophisticated than the previously described methods but can be just as effective : using specific hacktools to guess the login passwords for services exposed by a targeted system .


Commands found in a readme text that was stored in a ZIP archive together with the hacktool THC Hydra in Leafminer 's tool arsenal represent online dictionary attacks on Microsoft Exchange and Remote Desktop Protocol services of regional government servers in Saudi Arabia .


Symantec identified two strains of custom malware used by the Leafminer group : Trojan.Imecab and Backdoor.Sorgu .


Leafminer is a highly active group , responsible for targeting a range of organizations across the Middle East .


Leafminer appears to be based in Iran and seems to be eager to learn from and capitalize on tools and techniques used by more advanced threat actors .


Dragos has identified Leafminer group targeting access operations in the electric utility sector .


Analysis of RASPITE tactics , techniques , and procedures ( TTPs ) indicate the group has been active in some form since early - to mid-2017 .


RASPITE targeting includes entities in the US , Middle East , Europe , and East Asia .


RASPITE overlaps significantly with Symantec 's Leafminer , which recently released a report on the group 's activity in the Middle East .


RASPITE 's activity to date currently focuses on initial access operations within the electric utility sector .


This means that the Leafminer group is targeting electric utilities .


While the group has not yet demonstrated an ICS capability , RASPITE 's recent targeting focus and methodology are clear indicators of necessary activity for initial intrusion operations into an IT network to prepare the way for later potential ICS events .


Active since at least 2014 , this actor has long-standing interest in maritime industries , naval defense contractors , and associated research institutions in the United States and Western Europe .


Active since at least 2014 , the Leviathan has long-standing interest in maritime industries , naval defense contractors , and associated research institutions in the United States and Western Europe .


The attachments exploited CVE-2017-8759 which was discovered and documented only five days prior to the campaign .


The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period .


The period between November 2014 and January 2015 marked one of the earlier instances in which Proofpoint observed persistent exploitation attempts by this actor .


The Leviathan , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 .


This actor , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 .


The campaign is linked to a group of suspected Chinese cyber espionage actors we have tracked since 2013 , dubbed TEMP.Periscope .


The current campaign is a sharp escalation of detected activity since summer 2017 .


Since early 2018 , FireEye ( including our FireEye as a Service ( FaaS ) , Mandiant Consulting , and iSIGHT Intelligence teams ) has been tracking an ongoing wave of intrusions targeting engineering and maritime entities , especially those connected to South China Sea issues .


Known targets of the Leviathan have been involved in the maritime industry , and research institutes , academic organizations , and private firms in the United States .


Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities .


TEMP.Periscope overlaps in targeting , as well as tactics , techniques , and procedures ( TTPs ) , with TEMP.Jumper , a group that also overlaps significantly with public reporting on NanHaiShu .


The actor has conducted operations since at least 2013 in support of China 's naval modernization effort .


FireEye is highlighting a cyber espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40 .


The Leviathan group has specifically targeted engineering , transportation , and the defense industry , especially where these sectors overlap with maritime technologies .


We believe APT40 's emphasis on maritime issues and naval technology ultimately support China 's ambition to establish a blue-water navy .


Within a year APT40 was observed masquerading as a UUV manufacturer , and targeting universities engaged in naval research .


APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia .


We assess with moderate confidence that APT40 is a state-sponsored Chinese cyber espionage operation .


The actor 's targeting is consistent with Chinese state interests and there are multiple technical artifacts indicating the actor is based in China .


Analysis of the operational times of the group 's activities indicates that it is probably centered around China Standard Time ( UTC +8 ) .


APT40 relies heavily on web shells for an initial foothold into an organization .


APT40 has been observed leveraging a variety of techniques for initial compromise , including web server exploitation , phishing campaigns delivering publicly available and custom backdoors , and strategic web compromises .


Depending on placement , a web shell can provide continued access to victims ' environments , re-infect victim systems , and facilitate lateral movement .


The group 's capabilities are more than the much discussed CVE-2012-0158 exploits over the past few years .


A paper released today by our colleagues at Palo Alto Networks presented a portion of data on this crew under the label " the Lotus Blossom Operation " , likely named for the debug string present in much of the " Elise " codebase since at least 2012 : " d:\lstudio\projects\lotus\… " .


The group 's spearphish toolset includes PDF exploits , Adobe Flash Player exploits , and the common CVE-2012-0158 Word exploits including those generated from the infamous " Tran Duy Linh " kit .


The Spring Dragon appears to have rolled out a steady mix of exploits against government-related organizations in VN , TW , PH , and other locations over the past few years .


Organizations located in Myanmar and targeted by Spring Dragon have gone unmentioned .


Spring Dragon 's infiltration techniques there were not simply spearphish .


The download name was " Zawgyi_Keyboard_L.zip " , and it dropped a " setup.exe " that contained several backdoor components , including an Elise " wincex.dll " ( a42c966e26f3577534d03248551232f3 , detected as Backdoor.Win32.Agent.delp ) .


While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past , Spring Dragon employs more involved and creative intrusive activity as well .


The well-known threat group called DRAGONFISH or Lotus Blossom are distributing a new form of Elise malware targeting organizations for espionage purposes .


The threat actors associated with DRAGONFISH have previously focused their campaigns on targets in Southeast Asia , specifically those located in countries near the South China Sea .


iDefense analysts have identified a campaign likely to be targeting members of— or those with affiliation or interest in—the ASEAN Defence Ministers ' Meeting ( ADMM ) .


iDefense analysts have identified a campaign likely to be targeting members of or those with affiliation or interest in the ASEAN Defence Minister 's Meeting ( ADMM ) .


iDefense assesses with high confidence that this campaign is associated with the threat group DRAGONFISH ( also known as Lotus Blossom and Spring Dragon ) .


The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign .


Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


Lotus Blossom attempted to exploit CVE-2014-6332 using the POC code available in the wild .


This Trojan is related to the Elise backdoor described in the Operation Lotus Blossom report .


Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 .


APT threat actors , most likely nation state-sponsored , targeted a diplomat in the French Ministry of Foreign Affairs with a seemingly legitimate invitation to a technology conference in Taiwan .


Additionally , the targeting of a French diplomat based in Taipei , Taiwan aligns with previous targeting by these actors , as does the separate infrastructure .


The Elise malware used by Lotus Blossom , which was an attack campaign on targets in Southeast Asia .


Based on the targeting and lures , Unit 42 assesses that the Lotus Blossom actors ' collection requirements include militaries and government agencies in Southeast Asia .


In December 2015 , Unit 42 published a blog about a cyber espionage attack using the Emissary Trojan as a payload .


The oldest sample we found was created in 2009 , indicating this tool has been in use for almost seven years .


In addition , Emissary appears to against Taiwan or Hong Kong , all of the decoys are written in Traditional Chinese , and they use themes related to the government or military .


Of note , this is three years earlier than the oldest Elise sample we have found , suggesting this group has been active longer than previously documented .


In addition , we observed a TTP shift post publication with regards to their malware delivery ; they started using compromised but legitimate domains to serve their malware .


All of the Emissary we've collected are written in Traditional Chinese , which is used primarily in Taiwan and Hong Kong .


One of the most interesting observations made during this analysis is that the amount of development effort devoted to Emissary significantly increased after we published our Operation Lotus Blossom report in June 2015 , resulting in many new versions of the Emissary Trojan .


Lotus Blossom targeted the government , higher education , and high tech companies .


Our evidence suggests that malware authors created Emissary as early as 2009 , which suggests that threat actors have relied on this tool as a payload in cyber-espionage attacks for many years .


The timeline in Figure 2 shows that the Emissary Trojan was first created ( version 1.0 ) in May 2009 and quickly received an update that resulted in version 1.1 in June 2009 .


Between August and November 2015 the malware author creates several new versions of Emissary , specifically 5.0 , 5.1 , 5.3 and 5.4 in a much more rapid succession compared to development process in earlier versions .


Version 2.0 received one update in October 2013 before the malware author released version 3.0 in December 2014 .


While this may be coincidental , the out-of-sequence version 3.0 sample was created ten days after we published the Operation Lotus Blossom paper that exposed the Elise Trojan that is closely related to Emissary .


The Lotus Blossom largely targets military or government , with some cases of higher education and high tech companies .


The use of Emissary appears to be focused only on Taiwan and Hong Kong , with regular malware updates to avoid detection and to increase the odds of success .


The Lotus Blossom actors using Emissary have been active for at least seven years in Southeast Asia .


Magic Hound has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia .


Regardless of causation , the rapid development of new versions of Emissary suggests that the malware authors are making frequent modifications to evade detection , which as a corollary suggests the Lotus Blossom are actively using the Emissary Trojan as a payload in attacks .


Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called " Rocket Kitten " ( AKA Operation Saffron Rose , Ajax Security Team , Operation Woolen-Goldfish ) as well as an older attack campaign called Newscasters .


In addition to the malware evolution , the actors also shifted from solely spear-phishing targets with attachments to also compromising legitimate websites to host malware .


It is highly likely the Lotus Blossom used spear-phishing attacks containing links to these malicious documents as a delivery mechanism .


We were ultimately able to identify multiple organizations in the government , energy , and technology sectors targeted by Magic Hound .


The MPK bot is not publicly available and had previously been attributed to an adversary group called " Rocket Kitten " which has often been thought to be a state sponsored adversary operating in the Middle East region .


One payload was a Python based open source remote administration tool ( RAT ) called Pupy .


Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES .


The loader 's main goal was to run a PowerShell command to execute shellcode .


To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys .


The Magic Hound campaign was also discovered using a custom dropper tool , which we have named MagicHound.DropIt .


We have also seen Magic Hound using DropIt as a binder , specifically dropping a legitimate decoy executable along with the malicious executable onto the target host .


We also found a second IRC bot called MPK using the same IP for its C2 server that a Leash sample was hosted on .


The Magic Hound attack campaign is an active and persistent espionage motivated adversary operating in the Middle East region .


Organizations in the government , energy , and technology sectors have been targeted by Magic Hound , specifically organizations based in or doing business in Saudi Arabia .


At a high level , Retriever is a .NET downloader that downloads secondary payloads from servers associated with Magic Hound .


For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer .


M-Trends 2018 can arm security teams with the knowledge they need to defend against today 's most often used cyber attacks , as well as lesser seen and emerging threats .


FireEye tracks thousands of threat actors , but pays special attention to state-sponsored attackers who carry out advanced persistent threat ( APT ) attacks .


Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents .


Evidence also suggests that APT32 has targeted network security and technology infrastructure corporations with connections to foreign investors .


Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations foreign governments .


FireEye asesses that APT32 actors may be aligned with the national interests of Vietnam .


APT32 poses a threat to companies doing business or preparing to invest in Vietnam .


We believe recent activity targeting private interests in Vietnam suggests that APT32 poses a threat to companies doing business or preparing to invest in the country .


DROPSHOT is a notable piece of malware used to deliver variants of the TURNEDUP backdoor .


Additionally , there is evidence to suggest APT33 targeted Saudi Arabia .


Additionally , there is evidence to suggest APT33 targeted Saudi Arabian and Western organizations that provide training , maintenance and support for Saudi Arabia 's military and commercial fleets .


Although we have only observed APT33 use DROPSHOT to deliver TURNEDUP , we have identified multiple DROPSHOT samples in the wild that delivered wiper malware we call SHAPESHIFT .


The SHAPESHIFT wiper is capable of wiping disks and volumes , as well as deleting files .


Ties to SHAPESHIFT suggest that APT33 may engage in destructive operations or shares tools or development resources with an Iranian threat group that conducts destructive operations .


Since at least 2014 , an Iranian threat group tracked by FireEye as APT34 has conducted reconnaissance aligned with the strategic interests of Iran .


The OilRig group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries .


APT34 uses a mix of public and non-public tools .


In July 2017 , FireEye observed APT34 targeting an organization in the Middle East using the POWRUNER PowerShell-based backdoor and the downloader BONDUPDATER , which includes a domain generation algorithm ( DGA ) for command and control .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch .


FireEye has identified APT35 operations dating back to 2014 .


APT35 , also known as the Newscaster Team , is a threat group sponsored by the Iranian government that conducts long term , resource-intensive operations to collect strategic intelligence .


APT35 typically targets military , diplomatic and government , media , energy , engineering , business services and telecommunications sectors in U.S. and the Middle East .


APT35 has historically used unsophisticated tools like those listed below in Figure 3 .


APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors .


Many of the fake personas utilized by APT35 claimed to be part of news organizations , which led to APT35 being referred to as the Newscaster Team .


In early 2017 , Mandiant responded to an incident involving APT35 targeting an energy company .


The attacker used a spear-phishing email containing a link to a fake resume hosted on a legitimate website that had been compromised .


APT35 also installed BROKEYOLK , a custom backdoor , to maintain persistence on the compromised host .


The resume contained the PupyRAT backdoor , which communicated with known APT35 infrastructure .


Once connected to the VPN , APT35 focused on stealing domain credentials from a Microsoft Active Directory Domain Controller to allow them to authenticate to the single-factor VPN and Office 365 instance .


While having access to the organization 's environment , the Magic Hound targeted data related to entities in the Middle East .


Mandiant has previously observed targeted attackers stealing email , but few threat actors have been as successful at this as APT35 .


The campaigns delivered PupyRAT , an open-source cross-platform remote access trojan ( RAT ) .


Ultimately , APT35 had used access to hundreds of mailboxes to read email communications and steal data related to Middle East organizations , which later became victims of destructive attacks .


CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash .


Further analysis revealed a well-established collection of fake social media profiles that appear intended to build trust and rapport with potential victims .


COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites .


The connections associated with these profiles indicate the threat actor began using the persona to target organizations in April 2016 .


Between December 28 , 2016 and January 1 , 2017 , CTU researchers observed a phishing campaign targeting Middle Eastern organizations .


The macro ran a PowerShell command that attempted to download additional PowerShell loader scripts for PupyRAT , a research and penetration-testing tool that has been used in attacks .


The survey contained macros that , once enabled , downloaded PupyRAT .


CTU researchers determined that the COBALT GYPSY threat group orchestrated this activity due to the tools , techniques , and procedures ( TTPs ) used in both campaigns .


The group has repeatedly used social media , particularly LinkedIn , to identify and interact with employees at targeted organizations , and then used weaponized Excel documents to deliver RATs such as PupyRAT .


By compromising a user account that has administrative or elevated access , Magic Hound can quickly access a targeted environment to achieve their objectives .


These characteristics suggest that COBALT GYPSY executed the January and February phishing campaigns and that it created the Mia Ash persona .


CTU researchers have observed multiple COBALT GYPSY campaigns since 2015 and consider it highly likely that the group is associated with Iranian government-directed cyber operations .


The use of the Mia Ash persona demonstrates the creativity and persistence that threat actors employ to compromise targets .


CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering .


The persistent use of social media to identify and manipulate victims indicates that COBALT GYPSY successfully achieves its objectives using this tactic .


COBALT GYPSY 's continued social media use reinforces the importance of recurring social engineering training .


SecureWorks Counter Threat Unit ( CTU ) researchers analyzed a phishing campaign that targeted a Middle Eastern organization in early January 2017 .


SecureWorks® Counter Threat Unit™ ( CTU ) researchers analyzed a phishing campaign that targeted a Middle Eastern organization in early January 2017 .


CTU analysis suggests this activity is related to Iranian threat actors closely aligned with or acting on behalf of the COBALT GYPSY threat group ( formerly labeled Threat Group-2889 ) .


Since early 2014 , an attacker group of Iranian origin has been actively targeting persons of interest by means of malware infection , supported by persistent spear phishing campaigns .


This cyber-espionage group was dubbed ' Rocket Kitten ' , and remains active as of this writing , with reported attacks as recent as October 2015 .


Characterized by relatively unsophisticated technical merit and extensive use of spear phishing , the Magic Hound targeted individuals and organizations in the Middle East ( including targets inside Iran itself ) , as well as across Europe and in the United States .


The May 2014 ' Operation Saffron Rose ' publication identifies an Iranian hacking group formerly named ' Ajax Security ' ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


An Iranian hacking group formerly named Ajax Security ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


The report specifies the Magic Hound targeted political , military and defense industry in the US , UK and Israel .


ClearSky 's September 2014 blog post first described active attacks using a piece of malware they dubbed ' Gholee ' ( as appears in a malicious payload export function , potentially named after a popular Iranian singer9 ) .


The Rocket Kitten attacker group 's main attack vector is spear-phishing .


After learning of an active attack incident from the Rocket Kitten group on a customer network , Check Point researchers decided to actively join the investigation .


As described in previous publications , the Rocket Kitten attackers make extensive use of various phishing schemes .


While the recent paper from Trend Micro and ClearSky ( ' The Spy Kittens Are Back : Rocket Kitten 2 ' ) does extensively cover the campaign 's narrative , we aimed to seek confirmation that our analyzed attack was positively connected to the same campaign and set out to provide additional value and insight .


As the Rocket Kitten group 's behavior was well characterized in previous publications ( see the recent report from Trend Micro and ClearSky ) .


Magic Hound will often find simpler ways for effective compromise , such as creative phishing and simple custom malware .


We present the connection between Behzad Mesri , an Iranian national recently indicted for his involvement in hacking HBO , and Charming Kitten .


Sometimes , they aim at establishing a foothold on the target 's computer to gain access into their organization , but , based on our data , this is usually not their main objective , as opposed to other Iranian threat groups , such as Oilrig1 and CopyKittens2 .


A case of these obscure lines can be found in a blogpost published in coordination and parallel to this report - " Flying Kitten to Rocket Kitten , A Case of Ambiguity and Shared Code " 3 by Collin Anderson and Claudio Guarnieri .


FireEye 's publication of " Operation Saffron Rose " report , which described Flying Kitten 's operations against aviation firms , led to the dismantling of Flying Kitten 's infrastructure and the apparent end of its activities .


To sum up , the HBO hacker - Behzad Mesri is a member of Turk Black Hat along with ArYaIeIrAn , who provides infrastructure for Charming Kitten activity via PersianDNS / Mahanserver together with Mohammad Rasoul Akbari , who is a Facebook friend of Behzad Mesri 's .


Charming kitten regularly target international media outlets with Persian-language services .


It was a decoy to make visitor download a " Flash Player " , which was in fact DownPaper malware , analyzed later in this report .


In addition to using PlugX and Poison Ivy ( PIVY ) , both known to be used by the group , they also used a new Trojan called " ChChes " by the Japan Computer Emergency Response Team Coordination Center ( JPCERT ) .


Wapack labs also observed a similar sample targeting Japan in November .


MenuPass spoofed several sender email addresses to send spear phishing emails , most notably public addresses associated with the Sasakawa Peace Foundation and The White House .


menuPass typically makes use of a mix of DDNS and actor-registered domains in their attack campaigns .


There is not much public information about the APT campaign called menuPass ( also known as Stone Panda and APT10 ) .


A paper from FireEye in 2013 on several campaigns using PIVY included menuPass as one of them .


Believed to have started activity in 2009 and to originate from China , the group initially was known for targeting US and overseas defense contractors but broadened their targeting as time passed .


menuPass has targeted individuals and organizations in Japan since at least 2014 , and as the same organizations and academics were largely targeted each month in these attacks , it further shows menuPass is persistent in attempts to compromise their targets .


menuPass also heavily favors spear phishing , and so takes steps to socially engineer their spear phishes for maximum appearance of legitimacy .


menuPass is an ongoing APT campaign with a broad range of targets and will likely continue to target Japan in the future .


ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints .


PyCommands , meanwhile , are Python scripts that automate tasks for Immunity Debugger , a popular tool for reverse-engineering malware binaries .


First released in 2005 , the tool has gone unchanged since 2008 with v ersion 2.3.2 .


Poison Ivy includes features common to most Windows-based RATs , including key logging , screen capturing , video capturing , file transfers , system administration , password theft , and traffic relaying .


APT40 was previously reported as TEMP.Periscope and TEMP.Jumper .


They move laterally and escalate system privileges to extract sensitive information — whenever the attacker wants to do so.4 ,5 Because some RATs used in targeted attacks are widely available , determining whether an attack is part of a broader APT campaign can be difficult .


In 2011 , three years after the most recent release of PIVY , attackers used the RAT to compromise security firm RSA and steal data about its SecureID authentication system .


Just recently , PIVY was the payload of a zero-day exploit in Internet Explorer used in what is known as a " strategic web compromise " attack against visitors to a U.S. government website and a variety of others .


The Poison Ivy builder kit allows attackers to customize and build their own PIVY server , which is delivered as mobile code to a target that has been compromised , typically using social engineering .


Attackers can point and click their way through a compromised network and exfiltrate data .


Commodity RATs also complicate efforts by security professionals to correlate a threat actor 's activity over time—attackers can hide in the sea of malicious activity that also uses Poison Ivy-based malware .


This report is an initial public release of research PwC UK and BAE Systems have conducted into new , sustained global campaigns by an established threat actor against managed IT service providers and their clients as well as several directly targeted organisations in Japan .


Since late 2016 , PwC UK and BAE Systems have been assisting victims of a new cyber espionage campaign conducted by APT10 .


The campaign , which we refer to as Operation Cloud Hopper , has targeted managed IT service providers ( MSPs ) , allowing APT10 unprecedented potential access to the intellectual property and sensitive data of those MSPs and their clients globally .


APT10 ceased its use of the Poison Ivy malware family after a 2013 FireEye report , which comprehensively detailed the malware 's functionality and features , and its use by several China-based threat actors , including APT10 .


APT10 primarily used PlugX malware from 2014 to 2016 , progressively improving and deploying newer versions , while simultaneously standardising their command and control function .


APT10 is known to have exfiltrated a high volume of data from multiple victims , exploiting compromised MSP networks , and those of their customers , to stealthily move this data around the world .


APT10 , a name originally coined by FireEye , is also referred to as Red Apollo by PwC UK , CVNX by BAE Systems , Stone Panda by CrowdStrike , and menuPass Team more broadly in the public domain .


The threat actor has previously been the subject of a range of open source reporting , including most notably a report by FireEye comprehensively detailing the threat actor 's use of the Poison Ivy malware family and blog posts by Trend Micro3 similarly detailing the use of EvilGrab malware .


The threat actor has previously been the subject of a range of open source reporting , including most notably a report by FireEye comprehensively detailing the threat actor 's use of the Poison Ivy malware family and blog posts by Trend Micro similarly detailing the use of EvilGrab malware .


APT10 has been in operation since at least 2009 , and has evolved its targeting from an early focus on the US defence industrial base ( DIB )1 and the technology and telecommunications sector , to a widespread compromise of multiple industries and sectors across the globe , most recently with a focus on MSPs .


The research and ongoing tracking of APT10 by both PwC UK and BAE .


APT10 has been in operation since at least 2009 , and has evolved its targeting from an early focus on the US defence industrial base ( DIB ) and the technology and telecommunications sector , to a widespread compromise of multiple industries and sectors across the globe , most recently with a focus on MSPs .


PwC UK has been engaged in supporting investigations linked to APT10 compromises .


As a result of our analysis of APT10 's activities , we believe that it almost certainly benefits from significant staffing and logistical resources , which have increased over the last three years , with a significant step-change in 2016 .


Due to the scale of the threat actor 's operations throughout 2016 and 2017 , we similarly assess it currently comprises multiple teams , each responsible for a different section of the day-to-day operations , namely domain registration , infrastructure management , malware development , target operations , and analysis .


APT10 withdrew from direct targeting using Poison Ivy in 2013 and conducted its first known retooling operation , upgrading its capabilities and replatforming to use PlugX .


It is highly likely that this is due to the release of the 2013 FireEye report .


Our report will detail the most recent campaigns conducted by APT10 , including the sustained targeting of MSPs , which we have named Operation Cloud Hopper , and the targeting of a number of Japanese institutions .


MSPs therefore represent a high-payoff target for espionagefocused threat actors such as APT10 .


Given the level of client network access MSPs have , once APT10 has gained access to a MSP , it is likely to be relatively straightforward to exploit this and move laterally onto the networks of potentially thousands of other victims .


This , in turn , would provide access to a larger amount of intellectual property and sensitive data .


APT10 has been observed to exfiltrate stolen intellectual property via the MSPs , hence evading local network defences .


The command and control ( C2 ) infrastructure chosen by APT10 for Operation Cloud Hopper is predominantly referenced using dynamic-DNS domains .


Several of these provide enterprise services or cloud hosting , supporting our assessment that APT10 are almost certainly targeting MSPs .


The 13th FYP was released in March 2016 and the sectors and organisations known to be targeted by APT10 are broadly in line with the strategic aims documented in this plan .


These aims outlined in the FYP will largely dictate the growth of businesses in China and are , therefore , likely to also form part of Chinese companies ' business strategies .


APT10 has , in the past , primarily been known for its targeting of government and US defence industrial base organisations , with the earliest known date of its activity being in December 2009 .


Observed APT10 targeting is in line with many of the historic compromises we have outlined previously as originating from China .


In line with commonly used APT actor methodologies , the threat actor aligns its decoy documents to a topic of interest relevant to the recipient .


This section details changes made to APT10 tools , techniques and procedures ( TTPs ) post-2014 , following its shift from Poison Ivy to PlugX .


We have observed that in cases where APT10 has infiltrated a target via an MSP , it continues to use the MSPs credentials .


In order to gain any further credentials , APT10 will usually deploy credential theft tools such as mimikatz or PwDump , sometimes using DLL load order hijacking , to use against a domain controller , explained further in Annex B .


APT10 achieves persistence on its targets primarily by using scheduled tasks or Windows services in order to ensure the malware remains active regardless of system reboots .


For example , in addition to compromising high value domain controllers and security servers , the threat actor has also been observed identifying and subsequently installing malware on low profile systems that provide non-critical support functions to the business , and are thus less likely to draw the attention of system administrators .


In the majority of instances APT10 used either a reverse shell or RDP connection to install its malware ; the actor also uses these methods to propagate across the network .


The tactical malware , historically EvilGrab , and now ChChes ( and likely also RedLeaves ) , is designed to be lightweight and disposable , often being delivered through spear phishing .


Once executed , tactical malware contains the capability to profile the network and manoeuvre through it to identify a key system of interest .


We have also observed APT10 use DLL search order hijacking and sideloading , to execute some modified versions of open-source tools .


For example , PwC UK has observed APT10 compiling DLLs out of tools , such as Mimikatz and PwDump6 , and using legitimate , signed software , such as Windows Defender to load the malicious payloads .


During our analysis of victim networks , we were able to observe APT10 once again initiate a retooling cycle in late 2016 .


We observed the deployment and testing of multiple versions of Quasar malware , and the introduction of the bespoke malware families ChChes and RedLeaves .


APT10 is a constantly evolving , highly persistent China-based threat actor that has an ambitious and unprecedented collection programme against a broad spectrum of sectors , enabled by its strategic targeting .


Since exposure of its operations in 2013 , APT10 has made a number of significant changes intended to thwart detection of its campaigns .


PwC UK and BAE Systems , working closely with industry and government , have uncovered a new , unparallelled campaign which we refer to as Operation Cloud Hopper .


This operation has targeted managed IT service providers , the compromise of which provides APT10 with potential access to thousands of further victims .


An additional campaign has also been observed targeting Japanese entities .


APT10 's malware toolbox shows a clear evolution from malware commonly associated with China-based threat actors towards bespoke in-house malware that has been used in more recent campaigns ; this is indicative of APT10 's increasing sophistication , which is highly likely to continue .


The threat actor 's known working hours align to Chinese Standard Time ( CST ) and its targeting corresponds to that of other known China-based threat actors , which supports our assessment that these campaigns are conducted by APT10 .


APT10 ( MenuPass Group ) is a Chinese cyber espionage group that FireEye has tracked since 2009 .


Its targets include the military organizations and governments of countries with national interests in the South China Sea , including some within the U.S. defense industrial base .


DragonOK appears to operate out of China 's Jiangsu Province .


Moafee and DragonOK both use a well-known proxy tool – HUC Packet Transmit Tool ( HTRAN ) – to disguise their geographical locations .


However , FireEye researchers do not have enough insight to reliably report a definitive connection to the Moafee and DragonOK groups .


Both Moafee and DragonOK favor spear-phishing emails as an attack vector , often employing a decoy to deceive the victim .


Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document .


We observed Moafee running HTRAN proxies on their multiple Command and Control ( C2 ) servers – all operated on CHINANET , and hosted in Guangdong Province .


Like the Moafee group , we observed DragonOK running HTRAN to proxy their C2 servers , which are also operated on CHINANET but are hosted in the Jiangsu Province .


Primarily focused on governments and military operations of countries with interests in the South China Sea , Moafee likely chooses its targets based on region 's rich natural resources .


By targeting high-tech and manufacturing operations in Japan and Taiwan , DragonOK may be acquiring trade secrets for a competitive economic advantage .


Security researchers subsequently linked these attacks to a broader , yearlong campaign that targeted not just Israelis but Palestinians as well .


and as discovered later , even the U.S. and UK governments .


The second group , known as DragonOK , targets high-tech and manufacturing companies in Japan and Taiwan .


In 2012 , the Molerats attacks appeared to rely heavily on the XtremeRAT , a freely available tool that is popular with attackers based in the Middle East .


But the group has also used Poison Ivy ( PIVY ) , a RAT more commonly associated with threat actors in China — so much so that PIVY has , inaccurately , become synonymous with all APT attacks linked to China .


This blog post analyzes several recent Molerats attacks that deployed PIVY against targets in the Middle East and in the U.S. We also examine additional PIVY attacks that leverage Arabic-language content related to the ongoing crisis in Egypt and the wider Middle East to lure targets into opening malicious files .


We do not know whether using PIVY is an attempt by those behind the Molerats campaign to frame China-based threat actors for their attacks or simply evidence that they have added another effective , publicly-available RAT to its arsenal .


We observed several attacks in June and July 2013 against targets in the Middle East and the U.S. that dropped a PIVY payload that connected to command-and-control ( CnC ) infrastructure used by the Molerats attackers .


The archive contains an .exe file , sometimes disguised as a Microsoft Word file , a video , or another file format , using the corresponding icon .


In addition to DustySky , the attackers use publicly available tools such as the following Remote Administration Tools ( RAT ) : Poison Ivy , Nano Core , XtremeRAT , DarkComet and Spy-Net .


DustySky ( called " NeD Worm " by its developer ) is a multi-stage malware in use since May 2015 .


It is in use by the Molerats ( aka Gaza cybergang ) , a politically motivated group whose main objective , we believe , is intelligence gathering .


Operating since 2012 , the Molerats group 's activity has been reported by Norman , Kaspersky , FireEye , and PwC .


DustySky has been developed and used since May 2015 by Molerats ( aka " Gaza cybergang " ) , a terrorist group whose main objective in this campaign is intelligence gathering .


Most targets are from the Middle East : Israel , Egypt , Saudi Arabia , United Arab Emirates and Iraq .


The United States and countries in Europe are targeted as well .


The sample analyzed is f589827c4cf94662544066b80bfda6ab from late August 2015 .


The MuddyWater attacks are primarily against Middle Eastern nations .


However , we have also observed attacks against surrounding nations and beyond , including targets in India and the USA .


Targeted sectors of Molerats include governmental and diplomatic institutions , including embassies ; companies from the aerospace and defence Industries ; financial institutions ; journalists ; software developers .


The Palo Alto Networks Unit 42 research team recently came across a series of malicious files which were almost identical to those targeting the Saudi Arabian government previously discussed by MalwareBytes .


MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call " POWERSTATS " .


When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East , we were somewhat confused as the previous public reporting had attributed these attacks to FIN7 .


FIN7 is a threat actor group that is financially motivated with targets in the restaurant , services and financial sectors .


Following the trail of existing public reporting , the tie to FIN7 is essentially made based on a download observed from a MuddyWater C2 , of a non-public tool " DNSMessenger " .


There was a mistake in the original Morphisec analysis which linked these attacks to FIN7 .


The DNSMessenger malware is a shared tool , used by FIN7 , MuddyWater and perhaps other groups .


In September 2018 , we found evidence of Seedworm and the espionage group APT28 ( aka Swallowtail , Fancy Bear ) , on a computer within the Brazil-based embassy of an oil-producing nation .


We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded .


During the operations , the group used tools consistent with those leveraged during past intrusions including Powermud , a custom tool used by the Seedworm group , and customized PowerShell , LaZagne , and Crackmapexec scripts .


The Seedworm group controls its Powermud backdoor from behind a proxy network to hide the ultimate command-and-control ( C&C ) location .


After compromising a system , typically by installing Powermud or Powemuddy , Seedworm first runs a tool that steals passwords saved in users ' web browsers and email , demonstrating that access to the victim 's email , social media , and chat accounts is one of their likely goals .


Seedworm then uses open-source tools such as LaZagne and Crackmapexec to obtain Windows authorization credentials .


The group , which we call Seedworm ( aka MuddyWater ) , has been operating since at least 2017 , with its most recent activity observed in December 2018 .


The Seedworm group is the only group known to use the Powermud backdoor .


Additionally , the group compromised organizations in Europe and North America that have ties to the Middle East .


MuddyWater is an Iranian high-profile threat actor that 's been seen active since 2017 .


Little detail is given on the nature of how the connection between DNSMessenger and MuddyWater was discovered it isn't possible for us to verify this link .


Over the past year , we've seen the group extensively targeting a wide gamut of entities in various sectors , including Governments , Academy , Crypto-Currency , Telecommunications and the Oil sectors .


Depending on each sample , the content of document is either a fake resume application , or a letter from the Ministry of Justice in Lebanon or Saudi Arabia .


Analysts in our DeepSight Managed Adversary and Threat Intelligence ( MATI ) team have found a new backdoor , Backdoor.Powemuddy , new variants of Seedworm 's Powermud backdoor ( aka POWERSTATS ) , a GitHub repository used by the group to store their scripts , as well as several post-compromise tools the group uses to exploit victims once they have established a foothold in their network .


From January 2018 to March 2018 , through FireEye 's Dynamic Threat Intelligence , we observed attackers leveraging the latest code execution and persistence techniques to distribute malicious macro-based documents to individuals in Asia and the Middle East .


MuddyWater has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia .


This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia .


When successfully executed , the malicious documents install a backdoor we track as POWERSTATS .


The group is known for espionage campaigns in the Middle East .


The threat group in this recently observed campaign – TEMP.Zagros – weaponized their malware using the following techniques .


The MuddyWater campaign was first sighted in 2017 when it targeted the Saudi government using an attack involving PowerShell scripts deployed via Microsoft Office Word macro .


The threat group in this recently observed campaign a TEMP.Zagros a weaponized their malware using the following techniques .


Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload .


MuddyWater is a relatively new APT that surfaced in 2017 .


We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro as MuddyWater ) , an Iran-nexus actor that has been active since at least May 2017 .


We attribute this activity to TEMP.Zagros ( reported by Palo Alto Networks and Trend Micro ) , an Iran-nexus actor that has been active since at least May 2017 .


Entities in these sectors are often " enabling victims " as telecommunications providers or IT services agencies and vendors could provide Seedworm actors with further victims to compromise .


The group mainly targets the telecommunications and IT services sectors .


However , the group behind MuddyWater has been known to target other countries in the Middle East , Europe and the US .


The group has focused mainly on governmental targets in Iraq and Saudi Arabia , according to past telemetry .


The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros .


MuddyWater has recently been targeting victims likely from Lebanon and Oman , while leveraging compromised domains , one of which is owned by an Israeli web developer .


As MuddyWater has consistently been using POWERSTATS as its main tool , they are relatively easy to distinguish from other actors .


In March 2018 , Trend Micro provided a detailed analysis of another campaign that bore the hallmarks of MuddyWater .


In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign .


Given the use of lure documents designed with social engineering in mind , it is likely that MuddyWater use phishing or spam to target users who are unaware of these documents ' malicious nature .


We recently noticed the group behind MuddyWater that appear to be targeting government bodies , military entities , telcos and educational institutions in Jordan , Turkey , Azerbaijan and Pakistan , in addition to the continuous targeting of Iraq and Saudi Arabia , other victims were also detected in Mali , Austria , Russia , Iran and Bahrain. .


Observed Seedworm victims were located primarily in Pakistan and Turkey , but also in Russia , Saudi Arabia , Afghanistan , Jordan , and elsewhere .


The MuddyWaters group has carried out a large number of attacks and demonstrated advanced social engineering , in addition to the active development of attacks , infrastructure and the use of new methods and techniques .


Cisco Talos assesses with moderate confidence that a campaign we recently discovered called " BlackWater " is associated with suspected persistent threat actor MuddyWater .


In this latest activity , BlackWater first added an obfuscated Visual Basic for Applications ( VBA ) script to establish persistence as a registry key .


Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater .


MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East .


Between February and March 2019 , probable MuddyWater-associated samples indicated that BlackWater established persistence on the compromised host , at used PowerShell commands to enumerate the victim 's machine and contained the IP address of the actor 's command and control ( C2 ) .


Despite last month 's report on aspects of the MuddyWater campaign , the group is undeterred and continues to perform operations .


Based on these observations , as well as MuddyWater 's history of targeting Turkey-based entities , we assess with moderate confidence that this campaign is associated with the MuddyWater threat actor group .


Our recent report , " The Chronicles of the Hellsing APT : the Empire Strikes Back " began with an introduction to the Naikon APT , describing it as " One of the most active APTs in Asia , especially around the South China Sea " .


Considering the volume of Naikon activity observed and its relentless , repeated attack attempts , such a confrontation was worth looking into , so we did .


The attackers appeared to be Chinese-speaking and targeted mainly top-level government agencies and civil and military organizations in countries such as the Philippines , Malaysia , Cambodia , Indonesia , Vietnam , Myanmar , Singapore , Nepal , Thailand , Laos and China .


The oil and gas infrastructure nexus observed in connection with greensky27.vicp.net and other Unit 78020 ( Naikon ) infrastructure suggests targeting patterns supportive of the PRC 's strategic interests over energy resources within the South China Sea and Southeast Asia .


This Naikon report will be complemented by a follow-on report that will examine the Naikon TTP and the incredible volume of attack activity around the South China Sea that has been going on since at least 2010 .


The attackers appeared to be Chinese-speaking and targeted mainly top-level government agencies and civil and military organizations in countries such as the Philippines , Malaysia , Cambodia , Indonesia , Vietnam , Myanmar , Singapore , Nepal .


This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent .


In the Naikon scheme , a C&C server can be specialized XSControl software running on the host machine .


It was during operator X 's network monitoring that the attackers placed Naikon proxies within the countries ' borders , to cloak and support real-time outbound connections and data exfiltration from high-profile victim organizations .


In addition to stealing keystrokes , Naikon also intercepted network traffic .


Operator X also took advantage of cultural idiosyncrasies in its target countries , for example , the regular and widely accepted use of personal Gmail accounts for work .


In the spring of 2014 , we noticed an increase in the volume of attack activity by the Naikon APT .


In particular , we noticed that the Naikon group was spear-phished by an actor we now call " Hellsing " .


More details about the cloak and dagger games between Naikon and Hellsing can be found in our blogpost : " The Chronicles of the Hellsing APT : The Empire Strikes Back " .


Truvasys has been involved in several attack campaigns , where it has masqueraded as one of server common computer utilities , including WinUtils , TrueCrypt , WinRAR , or SanDisk .


PROMETHIUM is an activity group that has been active as early as 2012 .


The group primarily uses Truvasys , a first-stage malware that has been in circulation for several years .


NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird .


PROMETHIUM and NEODYMIUM both used an exploit for CVE-2016-4117 , a vulnerability in Adobe Flash Player that , at the time , was both unknown and unpatched .


Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks .


In early May 2016 , both PROMETHIUM and NEODYMIUM started conducting attack campaigns against specific individuals in Europe .


Meanwhile , NEODYMIUM used well-tailored spear-phishing emails with attachments that delivered the exploit code , ultimately leading to Wingbird 's installation on victim computers .


PROMETHIUM and NEODYMIUM both used a zero-day exploit that executed code to download a malicious payload .


Wingbird , the advanced malware used by NEODYMIUM , has several behaviors that trigger alerts in Windows Defender ATP .


This volume chronicles two activity groups , code-named PROMETHIUM and NEODYMIUM , both of which target individuals in a specific area of Europe .


Although most malware today either seeks monetary gain or conducts espionage for economic advantage , both of these activity groups appear to seek information about specific individuals .


In May 2016 , both PROMETHIUM and NEODYMIUM were observed to launch attack campaigns .


NEODYMIUM is an activity group that , like PROMETHIUM , conducted an attack campaign in early May 2016 .


Data about Wingbird activity indicates that it is typically used to attack individuals and individual computers instead of networks .


NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used , prior to public knowledge of the vulnerability 's existence .


NEODYMIUM used a backdoor detected by Windows Defender as Wingbird , whose characteristics closely match FinFisher , a government-grade commercial surveillance package .


In May 2016 , two apparently unrelated activity groups , PROMETHIUM and NEODYMIUM , conducted attack campaigns in Europe that used the same zeroday exploit while the vulnerability was publicly unknown .


The Middle Eastern hacker group in this case is codenamed " BlackOasis " Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


FinSpy , a final-stage payload that allows for an attacker to covertly learn what a target is talking about and who they are communicating with , is associated with Gamma Group — which goes by other names , including FinFisher and Lench IT Solutions .


In the past , BlackOasis messages were designed to appear like news articles from 2016 about political relations between Angola and China .


BlackOasis in recent months sent a wave of phishing emails .


PROMETHIUM uses a unique set of tools and methods to perform actions like lateral movement and data exfiltration .


Last year , Microsoft researchers described Neodymium 's behavior as unusual : " unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals .


The discovery by Kaspersky marks at least the fifth zero-day exploit used by BlackOasis and exposed by security researchers since June 2015 .


Victims of BlackOasis have been observed in the following countries : Russia , Iraq , Afghanistan , Nigeria , Libya , Jordan , Tunisia , Saudi Arabia , Iran , Netherlands , Bahrain , United Kingdom and Angola .


Unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals .


A cursory review of BlackOasis ' espionage campaign suggests there is some overlap between the group 's actions and Saudi Arabia 's geopolitical interests .


Kaspersky 's research notes that BlackOasis hacked into computers based in Saudi Arabia .


All 13 countries where Kaspersky reportedly observed BlackOasis activity are connected to Saudi Arabia in one of three ways : economically ; from a national security perspective ; or due to established policy agreements .


The Operation Aurora , named by McAfee and announced in January 2010 , and the WikiLeaks document disclosures of 2010 have highlighted the fact that external and internal threats are nearly impossible to prevent .


These attacks have involved social engineering , spearphishing attacks , exploitation of Microsoft Windows operating systems vulnerabilities , Microsoft Active Directory compromises , and the use of remote administration tools ( RATs ) in targeting and harvesting sensitive competitive proprietary operations and project-financing information with regard to oil and gas field bids and operations .


Night Dragon 's attacks have involved social engineering , spearphishing attacks , exploitation of Microsoft Windows operating systems vulnerabilities , Microsoft Active Directory compromises , and the use of remote administration tools ( RATs ) in targeting and harvesting sensitive competitive proprietary operations and project-financing information with regard to oil and gas field bids and operations .


We have identified the tools , techniques , and network activities used in these continuing attacks—which we have dubbed Night Dragon—as originating primarily in China .


Attackers using several locations in China have leveraged C&C servers on purchased hosted services in the United States and compromised servers in the Netherlands to wage attacks against global oil , gas , and petrochemical companies , as well as individuals and executives in Kazakhstan , Taiwan , Greece , and the United States to acquire proprietary and highly confidential information .


The primary operational technique used by Night Dragon comprised a variety of hacker tools , including privately developed and customized RAT tools that provided complete remote administration capabilities to the attacker .


While Night Dragon attacks focused specifically on the energy sector , the tools and techniques of this kind can be highly successful when targeting any industry .


In addition , the attackers employed hacking tools of Chinese origin and that are prevalent on Chinese underground hacking forums .


We have been presented with a rare opportunity to see some development activities from the actors associated with the OilRig attack campaign , a campaign Unit 42 has been following since May 2016 .


Recently we were able to observe these actors making modifications to their Clayslide delivery documents in an attempt to evade antivirus detection .


We collected two sets of Clayslide samples that appear to be created during the OilRig actor 's development phase of their attack lifecycle .


On November 15 , 2016 , an actor related to the OilRig campaign began testing the Clayslide delivery documents .


The actor then made subtle modifications to the file and uploaded the newly created file to the same popular antivirus testing website in order to determine how to evade detection .


In addition to making changes to the Excel worksheets that contain the decoy content , the actor also made changes to the worksheet that is initially displayed to the user .


Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system .


This realization suggests that the OilRig threat group will continue to use their delivery documents for extended periods with subtle modifications to remain effective .


Iranian threat agent OilRig has been targeting multiple organisations in Israel and other countries in the Middle East since the end of 2015 .


In recent attacks they set up a fake VPN Web Portal and targeted at least five Israeli IT vendors , several financial institutes , and the Israeli Post Office .


In these websites they hosted malware that was digitally signed with a valid , likely stolen code signing certificate .


In December 2015 , Symantec published a post about " two Iran-based attack groups that appear to be connected , Cadelle and Chafer " that " have been using Backdoor.Cadelspy and Backdoor.Remexi to spy on Iranian individuals and Middle Eastern organizations " .


In May 2016 , Unit 42 observed attacks of OilRig primarily focused on financial institutions and technology organizations within Saudi Arabia .


In recent OilRig attacks , the threat actors purport to be legitimate service providers offering service and technical troubleshooting as a social engineering theme in their spear-phishing attacks .


The campaign appears highly targeted and delivers a backdoor we have called ' Helminth ' .


Artifacts identified within the malware samples related to these attacks also suggest the targeting of the defense industry in Saudi Arabia , which appears to be related to an earlier wave of attacks carried out in the fall of 2015 .


In May 2016 , Unit 42 began researching attacks that used spear-phishing emails with attachments , specifically malicious Excel spreadsheets sent to financial organizations within Saudi Arabia .


Over the course of the attack campaign , we have observed two different variations of the Helminth backdoor , one written in VBScript and PowerShell that was delivered via a macro within Excel spreadsheets and the other a standalone Windows executable .


FireEye also reported on these attacks in a May 22 blog post .


The executable variant of Helminth is installed with a dropper Trojan that we are tracking as the HerHer Trojan .


The Helminth executable variant is very similar in functionality to its script-based counterpart , as it also communicates with its C2 server using both HTTP and DNS queries .


Helminth executable samples send artifacts within network beacons to its C2 server that the Trojan refers to as a ' Group ' and ' Name ' .


This suggests that the threat actors are not only focused on financial organizations , as their target set could include other industries as well .


The email address edmundj@chmail.ir and the geolocation of Tehran , Iran , being of note .


The registrant information for kernel.ws also provided a geolocation of Tehran , IR and the email provider for the address used in checkgoogle.org was the same used for mydomain1607.com , chmail.ir .


The mydomain1110.com domain did not appear to reuse any of the previously observed WHOIS data artifacts , but did still give a geolocation of Tehran in addition to the use of an email address linked to other domains thematically similar to the know command and control domains and are potentially related .


While researching the OilRig campaign , we have seen two waves of targeted attacks on Saudi Arabian organizations in which a group of threat actors delivered the Helminth Trojan as a payload .


The two variants of Helminth do require different delivery methods , with the script variant relying on an Excel spreadsheet for delivery , while the executable variant is more traditional in the fact that it can be installed without a delivery document .


Since our first published analysis of the OilRig campaign in May 2016 , we have continued to monitor this group for new activity .


Additionally , the scope of organizations targeted by this group has expanded to not only include organizations within Saudi Arabia , but also a company in Qatar and government organizations in Turkey , Israel and the United States .


The group behind the OilRig campaign continues to leverage spear-phishing emails with malicious Microsoft Excel documents to compromise victims .


In addition to these instances , multiple Qatari organizations were the subject to spear phishing attacks carrying Helminth samples earlier this year .


While the malware deployed is not terribly sophisticated , it uses techniques such as DNS command and control ( C2 ) that allows it to stay under the radar at many establishments .


Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov. 14 , 2017 , FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East .


We assess this activity was carried out by a suspected Iranian cyber espionage threat group , whom we refer to as APT34 , using a custom PowerShell backdoor to achieve its objectives .


We assess that APT34 works on behalf of the Iranian government based on infrastructure details that contain references to Iran , use of Iranian infrastructure , and targeting that aligns with nation-state interests .


APT34 uses a mix of public and non-public tools , often conducting spear phishing operations using compromised accounts , sometimes coupled with social engineering tactics .


We believe APT34 is involved in a long-term cyber espionage operation largely focused on reconnaissance efforts to benefit Iranian nation-state interests and has been operational since at least 2014 .


In May 2016 , we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware .


In July 2017 , we observed APT34 targeting a Middle East organization using a PowerShell-based backdoor that we call POWRUNER and a downloader with domain generation algorithm functionality that we call BONDUPDATER , based on strings within the malware .


APT34 loosely aligns with public reporting related to the group " OilRig " .


The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 .


In this latest campaign , APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER .


The vulnerability was patched by Microsoft on Nov 14 , 2017 .


The vulnerability exists in the old Equation Editor ( EQNEDT32.EXE ) , a component of Microsoft Office that is used to insert and evaluate mathematical formulas .


The OilRig group ( AKA APT34 , Helix Kitten ) is an adversary motivated by espionage primarily operating in the Middle East region .


We expect APT34 will continue to evolve their malware and tactics as they continue to pursue access to entities in the Middle East region .


We first discovered this group in mid-2016 , although it is possible their operations extends earlier than that time frame .


Between May and June 2018 , Unit 42 observed multiple attacks by the OilRig group appearing to originate from a government agency in the Middle East .


The use of script-based backdoors is a common technique used by the OilRig group as we have previously documented .


The attacks delivered a PowerShell backdoor called QUADAGENT , a tool attributed to the OilRig group by both ClearSky Cyber Security and FireEye .


A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation .


All three waves involved a single spear phishing email that appeared to originate from a government agency based in the Middle East .


This latest attack consisted of three waves between May and June 2018 .


The OilRig group continues to be a persistent adversary group in the Middle East region .


APT34 are involved in long-term cyber espionage operations largely focused on the Middle East .


Recent investigations by FireEye 's Mandiant incident response consultants combined with FireEye iSIGHT Threat Intelligence analysis have given us a more complete picture of a suspected Iranian threat group , that we believe has been operating since at least 2014 .


On January 8 , 2018 , Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East .


APT34 uses a mix of public and non-public tools , often conducting spear phishing operations using compromised accounts from trusted third parties , sometimes coupled with social engineering tactics .


Just over a week later , on January 16 , 2018 , we observed an attack on a Middle Eastern financial institution .


The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 .


However , the attack on January 16 did not involve ThreeDollars at all .


Interestingly , the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017 .


Instead , OilRig 's attack involved delivering the OopsIE Trojan directly to the victim , most likely using a link in a spear phishing email .


In the January 16 , 2018 attack , we observed OilRig attacking an organization it previously targeted in January 2017 .


On January 8 , 2018 , the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East .


The email contained an attachment named Seminar-Invitation.doc , which is a malicious Microsoft Word document we track as ThreeDollars .


This suggests that due to the January 2017 attack , the targeted organization may have taken actions to counter known OilRig TTPs , in this case delivering malicious macro documents , causing the OilRig operators to adopt a different delivery tactic .


We also identified another sample of ThreeDollars , created on January 15 , 2017 with the file name strategy preparation.dot .


The samples of ThreeDollars we collected in these attacks are structurally very similar to the first sample we analyzed in October 2017 , down to the lure image used to trick the recipient into clicking the " Enable Content " button to execute the malicious macro .


Since May 2016 , we have continued to monitor and uncover various attacks and tools associated with the OilRig group .


] com , which we previously identified in October 2017 to be an OilRig C2 .


Based on previously observed tactics , it is highly likely the OilRig group leveraged credential harvesting and compromised accounts to use the government agency as a launching platform for their true attacks .


Inspecting the class C network for 185.162.235.0/24 shows us that another IP on the same network resolves to an OilRig domain , msoffice-cdn.com which we identified in August 2017 .


We had previously observed this author name in use once before , in the very first ThreeDollars document we collected that we had reported on in August 2017 .


The OilRig group continues to remain a highly active adversary in the Middle East region .


Organizations detected a compromise themselves in 62% of the cases that Mandiant worked in 2017 .


Repeated targeting of Middle Eastern financial , energy and government organizations leads FireEye to assess that those sectors are a primary concern of APT34 .


The use of infrastructure tied to Iranian operations , timing and alignment with the national interests of Iran also lead FireEye to assess that APT34 acts on behalf of the Iranian government .


APT34 uses a mix of public and non-public tools ( Fig.2 ) and often uses compromised accounts to conduct spear-phishing operations .


In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch .


Unit 42 's ongoing research into the OilRig campaign shows that the threat actors involved in the original attack campaign continue to add new Trojans to their toolset and continue their persistent attacks in the Middle East .


When we first discovered the OilRig attack campaign in May 2016 , we believed at the time it was a unique attack campaign likely operated by a known , existing threat group .


The email address is associated with the Lebanese domain of a major global financial institution .


POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


In July 2017 , we observed the OilRig group using a tool they developed called ISMAgent in a new set of targeted attacks .


In August 2017 , we found this threat group has developed yet another Trojan that they call ' Agent Injector ' with the specific purpose of installing the ISMAgent backdoor .


On August 23 , 2017 , we observed OilRig targeting an organization within the United Arab Emirates government .


Based on that research and this observation , we postulate that the OilRig group gathered credentials to a legitimate user 's OWA account and logged into the user 's account to send phishing attacks to other individuals within the same , targeted organization .


The OilRig group continues to target organizations in the Middle East , in this instance targeting the government of the United Arab Emirates .


The payload embedded within the ISMInjector sample delivered in this attack is a variant of the ISMAgent backdoor that we had discussed in detail in our blog discussing a targeted attack on a Saudi Arabian technology company .


Initial inspection of this attack suggested this was again the OilRig campaign using their existing toolset , but further examination revealed not only new variants of the delivery document we named Clayslide , but also a different payload embedded inside it .


In July 2017 , we observed an attack on a Middle Eastern technology organization that was also targeted by the OilRig campaign in August 2016 .


This technique was observed in previous Clayslide documents to access the script variant of the Helminth Trojan in earlier OilRig attacks .


In the past , we had primarily associated the OilRig campaign with using the Clayslide documents to deliver as a payload a Trojan we named Helminth ; in this instance , the payload was instead a variant of the ISMDoor Trojan with significant modifications which we are now tracking as ISMAgent .


The June 2017 sample of Clayslide contained the same OfficeServicesStatus.vbs file found in the ISMAgent Clayslide document , but instead of having the payload embedded in the macro as segregated base64 strings that would be concatenated , this variant obtained its payload from multiple cells within the " Incompatible " worksheet .


Clearly , OilRig incorporates a testing component within their development process , as we have previously observed OilRig performing testing activities on their delivery documents and their TwoFace webshells .


While continuing research on the August 2018 attacks on a Middle eastern government that delivered BONDUPDATER , Unit 42 researchers observed OilRig 's testing activities and with high confidence links this testing to the creation of the weaponized delivery document used in this attack .


While investigating recent attacks performed by the threat actor group OilRig using their new Bondupdater version , Unit 42 researchers searched for additional Microsoft Office documents used by OilRig hoping to locate additional malware being used in other attacks during the same time period .


The tester created the final test file less than 8 hours before the creation time of a delivery document , which was then delivered via a spear-phishing email 20 minutes later .


During this testing , we saw document filenames that contain the C2 we witnessed in the targeted attack above , specifically the filenames XLS-withyourface.xls and XLS-withyourface – test.xls .


These samples appeared to have been created by OilRig during their development and testing activities , all of which share many similarities with the delivery document used in the recent OilRig attack against a Middle Eastern government , N56.15.doc ( 7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00 ) that we have also included in Table 1 .


However , they later continued by making modifications to the Excel document just prior to the attack on August 26th .


Additionally , HELIX KITTEN actors have shown an affinity for creating thoroughly researched and structured spear-phishing messages relevant to the interests of targeted personnel .


In addition to Helminth , the ISMDoor implant is likely used by the Iran-based adversary to attack targets particularly those in the Middle East region .


These incidents involved spear-phishing attacks , which characteristic of HELIX KITTEN , included emails containing malicious PowerShell in their macros that connects to known C2 infrastructure .


During the summer of 2018 , HELIX KITTEN actors were observed targeting entities in the Middle East — of note , targets appeared to be located in Bahrain and Kuwait .


ISMDoor is able to exfiltrate data , take screenshots , and execute arbitrary commands on the victim 's machine .


In early November 2018 , CrowdStrike observed activity from the HELIX KITTEN adversary at a customer in the telecommunications vertical .


The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East .


In the first week of May 2016 , FireEye 's DTI identified a wave of emails containing malicious attachments being sent to multiple banks in the Middle East region .


Our data suggests that actors have deployed the RGDoor backdoor on webservers belonging to eight Middle Eastern government organizations , as well as one financial and one educational institution .


In August 2018 , Unit 42 observed OilRig targeting a government organization using spear-phishing emails to deliver an updated version of a Trojan known as BONDUPDATER .


The OilRig group has been active since at least mid-2016 , and continues their attack campaigns throughout the Middle East , targeting both governmental agencies and businesses on an almost routine basis .


BONDUPDATER is a PowerShell-based Trojan first discovered by FireEye in mid-November 2017 , when OilRig targeted a different Middle Eastern governmental organization .


During the past month , Unit 42 observed several attacks against a Middle Eastern government leveraging an updated version of the BONDUPDATER malware , which now includes the ability to use TXT records within its DNS tunneling protocol for its C2 communications .


The email had no subject and what initially drew our attention to OilRig 's attack was the content of the spear phishing email .


As expected , OilRig is continuing their onslaught of attacks well into 2018 with continued targeting in the Middle East .


First identified in January 2015 , Orangeworm has also conducted targeted attacks against organizations in related industries as part of a larger supply-chain attack in order to reach their intended victims .


According to Symantec telemetry , almost 40 percent of Orangeworm 's confirmed victim organizations operate within the healthcare industry .


Their next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting , again attempting to extract all Word documents .


Sowbug 's next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting , again attempting to extract all Word documents .


For example , in September 2016 , Sowbug infiltrated an organization in Asia , deploying the Felismus backdoor on one of its computers , Computer A , using the file name adobecms.exe in CSIDL_WINDOWS\debug .


In this case , the attackers maintained a presence on the target 's network for nearly six months between September 2016 and March 2017 .


In other attacks , there was evidence that Felismus was installed using a tool known as Starloader ( detected by Symantec as Trojan.Starloader ) .


Symantec has found evidence of Starloader files being named AdobeUpdate.exe , AcrobatUpdate.exe , and INTELUPDATE.EXE among others .


Additionally , Starloader was also observed deploying additional tools used by the attackers , such as credential dumpers and keyloggers .


ASERT has learned of an APT campaign , possibly originating from DPRK , we are calling STOLEN PENCIL that is targeting academic institutions since at least May 2018 .


Once gaining a foothold on a user 's system , the threat actors behind STOLEN PENCIL use Microsoft 's Remote Desktop Protocol ( RDP ) for remote point-and-click access .


The group uses an advanced piece of malware known as Remsec ( Backdoor.Remsec ) to conduct its attacks .


Strider has been active since at least October 2011 .


Lua modules is a technique that has previously been used by Flamer .


The Remsec malware used by Strider has a modular design .


The group has maintained a low profile until now and its targets have been mainly organizations and individuals that would be of interest to a nation state 's intelligence services .


The group 's targets include a number of organizations and individuals located in Russia .


Remsec uses a Lua interpreter to run Lua modules which perform various functions .


Russia .


The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information .


the group 's targets include an organization in Sweden .


the group 's targets include an embassy in Belgium .


Symantec will continue to search for more Remsec modules and targets in order to build upon our understanding of Strider and better protect our customers .


Another such an exceptional espionage platform is " ProjectSauron , also known as " Strider " .


In September 2015 , our anti-targeted attack technologies caught a previously unknown attack .


Forensic analysis indicates that the APT has been operational since at least June 2011 and was still active in 2016 .


After getting the IP , the ProjectSauron component tries to communicate with the remote server using its own ( ProjectSauron ) protocol as if it was yet another C&C server .


In a number of the cases we analyzed , ProjectSauron deployed malicious modules inside the custom network encryption 's software directory , disguised under similar filenames and accessing the data placed beside its own executable .


The threat actor behind ProjectSauron commands a top-of-the-top modular cyber-espionage platform in terms of technical sophistication , designed to enable long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods .


In September 2015 , Kaspersky Lab 's Anti-Targeted Attack Platform discovered anomalous network traffic in a government organization network .


In late 2015 , Symantec identified suspicious activity involving a hacking tool used in a malicious manner against one of our customers .


Secondary ProjectSauron modules are designed to perform specific functions like stealing documents , recording keystrokes , and hijacking encryption keys from both infected computers and attached USB sticks .


activity originated from three separate IP addresses , all located in Chengdu , China .


We don't know the exact date Suckfly stole the certificates from the South Korean organizations .


stolen certificates being used maliciously occurred in early 2014 .


Symantec detects this threat as Backdoor.Nidiran .


Specifically , Suckfly used a specially crafted web page to deliver an exploit for the Microsoft Windows OLE Remote Code Execution Vulnerability ( CVE-2014-6332 ) , which affects specific versions of Microsoft Windows .


The threat then executes " svchost.exe " .


Attackers have been known to distribute malicious files masquerading as the legitimate iviewers.dll file and then use DLL load hijacking to execute the malicious code and infect the computer .


Once exploit has been achieved , Nidiran is delivered through a self-extracting executable that extracts the components to a .tmp folder after it has been executed .


Blackfly began with a campaign to steal certificates , which were later used to sign malware used in targeted attacks .


In March 2016 , Symantec published a blog on Suckfly , an advanced cyberespionage group that conducted attacks against a number of South Korean organizations to steal digital certificates .


Since then we have identified a number of attacks over a two-year period , beginning in April 2014 , which we attribute to Suckfly .


The attacks targeted high-profile targets , including government and commercial organizations .


these attacks were part of a planned operation against specific targets in India .


While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions .


The first known Suckfly campaign began in April of 2014 .


It has conducted attacks on similar organizations in Saudi Arabia , likely because of the access that those organizations have .


Similar to its other attacks , Suckfly used the Nidiran back door along with a number of hacktools to infect the victim 's internal hosts .


In 2015 , Suckfly conducted a multistage attack .


Suckfly conducted a multistage attack between April 22 and May 4 .


On April 22 , 2015 , Suckfly exploited a vulnerability on the targeted employee 's operating system ( Windows ) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack .


Suckfly conducted a multistage attack against an e-commerce organization .