The Shadow Brokers have long claimed that the tools they release are from the " Equation Group " , the name of a government hacking group outed by Kaspersky Lab in 2015 , which is widely believed to be the NSA . The actors behind LUCKY ELEPHANT recognize the effectiveness and use doppelganger webpages nearly identical to legitimate sites , enticing users to input their credentials . The heavier targeting in Pakistan adheres to historical targeting and the ongoing tension between the two countries , which has escalated since a terrorist attack in Kashmir on 14 February 2019 . The targeting of Pakistan , Bangladesh , Sri Lanka , Maldives , Myanmar , Nepal , and the Shanghai Cooperation Organization are all historical espionage targets by India . However , it is clear is that Donot are actively establishing infrastructure and are targeting governments in South Asia . First attack of this campaign took place in May 2018 . Arbor also published APT research on this group , and named it ‘Donot’ . Donot attacked government agencies , aiming for classified intelligence . We identified this APT group coded as ‘APT-C-35’ in 2017 , who is mainly targeting Pakistan and other South Asian countries for Cyber Espionage . At least 4 attack campaigns against Pakistan have been observed by us since 2017 . Spear phishing emails with vulnerable Office documents or malicious macros are sent to victims . In the latest attack , Donot group is targeting Pakistani businessman working in China . Two unique malware frameworks , EHDevel and yty , are developed by attackers . wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 . Furthermore , it has similar code logic as previous ones wuaupdt.exe in this attack appears in previous Donot attack , and C2 addresses are same to previous ones . From the attack activity captured this time , it is obvious that Donot APT group is still keen on Pakistan as primary target of attack , and even expands scope of attack to include Pakistani staffs and institutions in China . Buhtrap still make extensive use of NSIS installers as droppers and these are mainly delivered through malicious documents . They first came to light in 2016 , when they managed to steal sensitive information from the US Democratic National Committee (DNC) . Earworm first came to light in 2016 , when they managed to steal sensitive information from the US Democratic National Committee (DNC) . They were also behind an attack on the World Anti-Doping Agency (WADA) , in which they leaked confidential information about several drug tests . SPLM , GAMEFISH , and Zebrocy delivery all maintain their own clusters , but frequently overlap later . Our previous post on Sofacy's 2017 activity stepped aACT from the previously covered headline buzz presenting their association with previously known political hacks and interest in Europe and the US , and examines their under-reported ongoing activity in middle east , central asia , and now a shift in targeting further east , including China , along with an overlap surprise . The larger , 300kb+ SPLM backdoors deployed in 2016 and 2017 are not observed any longer at targets in 2018 . A previous , removed , report from another vendor claimed non-specific information about the groups' interest in Chinese universities , but that report has been removed – most likely detections were related to students’ and researchers’ scanning known collected samples and any incidents” remain unconfirmed and unknown . Either ACT , the group's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion . The actors behind this campaign we call LUCKY ELEPHANT use doppelganger webpages to mimic legitimate entities such as foreign governments , telecommunications , and military . Currently , Sofacy targets large air-defense related commercial organizations in China with SPLM , and moves Zebrocy focus across Armenia , Turkey , Kazahkstan , Tajikistan , Afghanistan , Mongolia , China , and Japan . Either ACT , Sofacy's consistent activity throughout central and eastern asia seems to be poorly represented in the public discussion . According to this new alert , Hidden Cobra the U.S. government’s code name for Lazarus has been conducting FASTCash attacks stealing money from Automated Teller Machines (ATMs) from banks in Asia and Africa since at least 2016 . Lazarus is a very active attack group involved in both cyber crime and espionage . The group was initially known for its espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures . Following US-CERTs report , Symantec's research uncovered the key component used in Lazarus's recent wave of financial attacks . More recently , Lazarus has also become involved in financially motivated attacks , including an US$81 million dollar theft from the Bangladesh Central Bank and the WannaCry ransomware . Other open source and semi-legitimate pen-testing tools like nbtscan and powercat are being used for mapping available resources and lateral movement as well . To make the fraudulent withdrawals , Lazarus first breaches targeted banks' networks and compromises the switch application servers handling ATM transactions . The operation , known as FASTCash” has enabled Lazarus to fraudulently empty ATMs of cash . In order to permit their fraudulent withdrawals from ATMs , Lazarus inject a malicious Advanced Interactive eXecutive (AIX) executable into a running , legitimate process on the switch application server of a financial transaction network , in this case a network handling ATM transactions . It was previously believed that the attackers used scripts to manipulate legitimate software on the server into enabling the fraudulent activity . In recent years , Lazarus has also become involved in financially motivated attacks . This malware in turn intercepts fraudulent Lazarus cash withdrawal requests and sends fake approval responses , allowing the attackers to steal cash from ATMs . Lazarus was linked to the $81 million theft from the Bangladesh central bank in 2016 , along with a number of other bank heists . Lazarus was also linked to the WannaCry ransomware outbreak in May 2017 . WannaCry incorporated the leaked EternalBlue exploit that used two known vulnerabilities in Windows CVE-2017-0144 and CVE-2017-0145 to turn the ransomware into a worm , capable of spreading itself to any unpatched computers on the victim's network and also to other vulnerable computers connected to the internet . Lazarus was initially known for its involvement in espionage operations and a number of high-profile disruptive attacks , including the 2014 attack on Sony Pictures that saw large amounts of information being stolen and computers wiped by malware . In short , Lazarus continues to pose a serious threat to the financial sector and organizations should take all necessary steps to ensure that their payment systems are fully up to date and secured . As with the 2016 series of virtual bank heists , including the Bangladesh Bank heist , FASTCash illustrates that Lazarus possesses an in-depth knowledge of banking systems and transaction processing protocols and has the expertise to leverage that knowledge in order to steal large sums from vulnerable banks . The attack , which starts with a malicious attachment disguised as a top secret US document , weaponizes TeamViewer , the popular remote access and desktop sharing software , to gain full control of the infected computer . As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC . It is hard to tell if there are geopolitical motives behind this campaign by looking solely at the list of countries it was targeting , since it was not after a specific region and the victims came from different places in the world . The initial infection vector used by the threat actor also changed over time , during 2018 we have seen multiple uses of self-extracting archives instead of malicious documents with AutoHotKey , which displayed a decoy image to the user . The recent wave of FASTCash attacks demonstrates that financially motivated attacks are not simply a passing interest for the Lazarus group and can now be considered one of its core activities . Although both examples of the different delivery methods described above show an exclusive targeting of Russian speakers , the recurring financial and political themes that they use highlight the attacker's interest in the financial world once more . Throughout our investigation , we have found evidence that shows operational similarities between this implant and Gamaredon Group . Gamaredon Group is an alleged Russian threat group . Gamaredon Group has been active since at least 2013 , and has targeted individuals likely involved with the Ukrainian government . EvilGnome's functionalities include desktop screenshots , file stealing , allowing capturing audio recording from the user’s microphone and the ability to download and execute further modules . Gamaredon Group primarily makes use of Russian hosting providers in order to distribute its malware . Gamaredon Group's implants are characterized by the employment of information stealing tools — among them being screenshot and document stealers delivered via a SFX , and made to achieve persistence through a scheduled task . Gamaredon Group infects victims using malicious attachments , delivered via spear phishing techniques . The techniques and modules employed by EvilGnome — that is the use of SFX , persistence with task scheduler and the deployment of information stealing tools—remind us of Gamaredon Group’s Windows tools . We can observe that the sample is very recent , created on Thursday , July 4 . As can be observed in the illustration above , the makeself script is instructed to run ./setup.sh after unpacking . The ShooterAudio module uses PulseAudio to capture audio from the user's microphone . makeself.sh is a small shell script that generates a self-extractable compressed tar archive from a directory . During our 2018 monitoring of this group , we were able to identify different techniques utilized by very similar attackers in the MENA region , sometimes on the same target . Gaza Cybergang Group3 (highest sophistication) whose activities previously went by the name Operation Parliament . Gaza Cybergang has been seen employing phishing , with several chained stages to evade detection and extend command and control server lifetimes . The most popular targets of SneakyPastes are embassies , government entities , education , media outlets , journalists , activists , political parties or personnel , healthcare and banking . Through our continuous monitoring of threats during 2018 , we observed a new wave of attacks by Gaza Cybergang Group1 targeting embassies and political personnel . Gaza Cybergang Group1 is an attack group with limited infrastructure and an open-source type of toolset , which conducts widespread attacks , but is nevertheless focused on Palestinian political problems . In this campaign , Gaza Cybergang used disposable emails and domains as the phishing platform to target the victims . The RAT , however , had a multitude of functionalities (as listed in the table below) such as to download and execute , compress , encrypt , upload , search directories , etc . We expect the damage caused by these groups to intensify and the attacks to extend into other regions that are also linked to the complicated Palestinian situation . Cylance determined that the ‘Ghost Dragon’ group utilized specifically tailored variants of Gh0st RAT , which the group modified from the 3.6 version of the source code released in 2008 . The standard network protocol for Gh0st RAT 3.6 employs zlib compression , which utilizes ‘Gh0st’ as a static five-byte packet flag that must be included in the first five bytes of initial transmission from the victim . In a more recent version of the modified Gh0st RAT malware , Ghost Dragon implemented dynamic packet flags which change the first five bytes of the header in every login request with the controller . SPEAR has observed numerous different XOR keys utilized by Ghost Dragon . exploit and tools continued to be used after Buckeye's apparent disappearance in 2017 . The Buckeye attack group was using Equation Group tools to gain persistent access to target organizations at least a year prior to the Shadow Brokers leak . Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability . While Buckeye appeared to cease operations in mid-2017 , the Equation Group tools it used continued to be used in attacks until late 2018 . The 2017 leak of Equation Group tools by a mysterious group calling itself the Shadow Brokers was one of the most significant cyber security stories in recent years. However , Symantec has now found evidence that the Buckeye Cyber Espionage group (aka APT3 , Gothic Panda ) began using Equation Group tools in attacks at least a year prior to the Shadow Brokers leak . Equation is regarded as one of the most technically adept espionage groups and the release of a trove of its tools had a major impact , with many attackers rushing to deploy the malware and exploits disclosed . DoublePulsar was delivered to victims using a custom exploit tool (Trojan.Bemstour) that was specifically designed to install DoublePulsar . One vulnerability is a Windows zero-day vulnerability (CVE-2019-0703) discovered by Symantec . Bemstour exploits two Windows vulnerabilities in order to achieve remote kernel code execution on targeted computers .


Whitefly is a highly adept group with a large arsenal of tools at its disposal , capable of penetrating targeted organizations and maintaining a long-term presence on their networks . According to FireEye , the attackers sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


The group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries . The functionalities are similar to the malicious app provided , which includes installing tor and proxy .


On August 23 , 2017 , DHS published a Malware Analysis Report ( MAR-10132963 ) that examines malware functionality to provide detailed code analysis and insight into specific tactics , techniques , and procedures ( TTPs ) observed in the malware .


Pony is a fairly common malware family that has existed in various forms since 2012 , with our first indications of Nigerian use occurring in August 2014 . The initial attack vector used in the attack against the data center is unclear , but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees at the national data center .


] commargaery [ . This documentation provides new insight into intrusion efforts conducted by at least four discrete Iranian threat actors , Rocket Kitten , Infy , Sima , and Operation Cleaver , including groups and tools that have not been previously disclosed . In the same way that people program named contacts into their cell phones and no longer need to remember phone numbers , DNS allows people to remember names like “ google.com ” instead of IP addresses . Tarrask is able to create " hidden " scheduled tasks by deleting the Security Descriptor ( SD ) registry value.[9 ] WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it 's attempts to elevate privileges through IFileOperation .


The Tibetan community has been targeted for over a decade by espionage operations that use malware to infiltrate communications and gather information . If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail , TG-3390 identify other externally accessible servers and deploy ChinaChopper web shells .


To retrieve IP addresses that have ARP entries , Ryuk calls GetIpNetTable . ScarCruft has several ongoing operations , utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer .


For instance , in the case of the “ Execute ” opcode ( 0x17 ) , the 32-bit code to run is stored entirely into the variable section with the value at offset 5 specifying the number of bytes to be copied and executed . Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called " Rocket Kitten " ( AKA Operation Saffron Rose , Ajax Security Team , Operation Woolen-Goldfish ) as well as an older attack campaign called Newscasters . Winnti : a260dcf193e747cee49ae83568eea6c04bf93cb3 https://bugcheck.xigncodeservice.com/Common/Lib/Common_Include.php . DDoS and MiTM Attacks Any anomalous increase in traffic or redirect through unrecognized external servers can be an indication of a cyberattack that s about to happen .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . In 2017 , the same entities that were affected by the Okrum malware and by the 2015 Ketrican backdoors again became targets of the malicious actors .


Tropic Trooper is also still exploiting CVE-2012-0158 , as are many threat actors . The Winnti umbrella and linked groups' initial targets are gaming studios and high tech businesses .


] com are or were intended for malicious use . According to our telemetry , the campaign spreading these tools has been live since 2016 , with the most recent detections as late as in July 2019 . Cybereason also attributes the recently reported Backdoor.Win32.Denis to the OceanLotus Group , which at the time of this report 's writing , had not been officially linked to this threat actor .


An example of the string which is sent to the command-and-control would be “ phone 26.03.2013 ” . Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 ( Microsoft Office Equation Editor , widely used by Chinese-speaking actors since December 2017 ) , we can′t prove they were related to this particular attack . NEODYMIUM also used the exact same CVE-2016-4117 exploit code that PROMETHIUM used , prior to public knowledge of the vulnerability 's existence .


The newer variant of KopiLuwak is now capable of exfiltrating files to the C&C as well as downloading files and saving them to the infected machine . This malware , which specifically targets Swiss banking users , uses a phishing campaign to drop its payload , which eventually results in the hijacking of a user ’s network traffic using a Man-in-the-Middle ( MitM ) attack .


Between November 26 , 2015 , and December 1 , 2015 , known and suspected China-based APT16 launched several spear phishing attacks targeting Japan and Taiwan in the high-tech , government services , media and financial services industries . We will detail how the C&C infrastructure and tools used by hacker group Hidden Lynx during its VOHO campaign ( 2012 ) , excellently documented by Symantec researchers last September , overlap with tools used in other high profile operations during the past few years .


In all emails sent to these government officials , the actor used the same attachment : a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload . While the machine is in isolation , SOC personnel can direct the infected machine to collect live investigation data , such as the DNS cache or security event logs , which they can use to verify alerts , assess the state of the intrusion , and support follow-up actions .


What is Chrysaor ? Targeted regions included in the list of Leafminer are Saudi Arabia , United Arab Emirates , Qatar , Kuwait , Bahrain , Egypt , Israel , and Afghanistan . APT33 : 192.119.15.39 remote-server.ddns.net . Instead , it appeared that corresponding requests were made directly through the Outlook Web Application ( OWA ) endpoint , indicating a previously undisclosed exploit method for Exchange .


Due to the current absence of maintained and supported Android banking Malware-as-a-Service in the underground community , there is a certainly demand for a new service . The SectorJ04 group has carried out large-scale hacking activities targeting South Korea , while also expanding the field of attacks to Southeast Asian countries such as Taiwan and the Philippines . The group has used phishing emails with Flash animation attachments to download and execute Daserf malware , and has also leveraged Flash exploits for SWC attacks .


Data collectors : dump all existing content on the device into a queue . This actor , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 . Winnti : a045939f 2018-07-11 15:45:57 https://bugcheck.xigncodeservice.com/Common/Lib/Common_bsod.php . The file ’s name consists of six randomly - generated alphanumeric characters .


It does so using the Services , Broadcast Receivers , and Activities components of the Android platform . From 16 October 2018 to 1 January 2019 , Silence sent out about 84 , 000 emails in Russia alone to update their address database . Flying Kitten ( which is another name given by the security industry to Charming Kitten ) was one of the first groups to be described as a coherent threat actor conducting operations against political opponents of the IRI ( Islamic Republic of Iran ) government and foreign espionage targets .


Beginning in mid-January 2019 , TA542 distributed millions of Emotet-laden emails in both English and German . Active since 2012 , it has so far targeted Taiwanese government agencies and private organizations .


It ’ s even possible to send log messages via SMS to the attacker ’ s number . Malefactors used watering hole attacks to compromise legitimate and trusted websites frequently visited by their targets . APT33 : 87e2cf4aa266212aa8cf1b1c98ae905c7bac40a6fc21b8e821ffe88cf9234586 S-SHA2 LaZagne . We found roughly 500 domain names that lead or have led to the “ Pig network ” between 2015 to March 2017 .


Infrastructure The infrastructure supporting this malware is rather complex . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign . If the module that loads the sample is named myapp.exe the module will exit Once loaded , it sleeps for six seconds . The adversary may drop or create malware , tools , or other non - native files on a target system to accomplish this , potentially leaving behind traces of malicious activities .


] ponethus [ . There is the exploit code and malware used to gain access to systems , the infrastructure that provides command and control to the malware operator , and the human elements – developers who create the malware , operators who deploy it , and analysts who extract value from the stolen information . Cybercriminals are constantly evolving and adapting in their attempts to bypass computer network defenses . The decoy installer ( Install%20Updater%20(V104.25.151)-stable.url ) is an Internet shortcut downloaded from another compromised WordPress site .


Such app stores are so-called because they are not officially supported by Android , nor are they provided by Google , unlike the Play Store . Turla is a complex cyberattack platform focused predominantly on diplomatic and government-related targets , particularly in the Middle East , Central and Far East Asia , Europe , North and South America and former Soviet bloc nations . APT1 has used and steadily modified BISCUIT since as early as 2007 and continues to use it presently .


ZeroT remained the primary stage 1 payload , but the stage 2 payloads varied .


While all of the earlier toolsets – GeminiDuke , PinchDuke , and CosmicDuke – were designed around a core infostealer component , MiniDuke is centered on a simplistic backdoor component whose purpose is to enable the remote execution of commands on the compromised system .


Cannon uses SMTPS and POP3S as its C2 channel compared to Zebrocy that uses a more commonly observed HTTP or HTTPS based C2 .


Samples uploaded to VirusTotal To encourage further research in the security community , we ’ ve uploaded these sample Chrysaor apps to Virus Total . FireEye is highlighting a cyber espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40 . Winnti : xigncodeservice.com 2018-07-10 09:18:17 https://namu.wiki/w/XIGNCODE . If the main function is called with only , it will take the path that is intended for connect to the MSSQL server and , upload • None are supplied to the main function , it will immediately fail due to attempting to utilize command line arguments that were not parsed yet .


Otherwise , it will launch an ACTION_APPLICATION_SETTINGS intent trying to trick the user to grant the permissions . Both the Trochilus and MoonWind RATs were hosted on the same compromised sites and used to target the same organization at the same time . The same “ Tran Duy Linh ” Microsoft Word Exploit Kit was used in delivery of this backdoor . Enterprise T1078 Valid Accounts APT29 has used a compromised account to access an organization 's VPN infrastructure .


Their software , once surreptitiously installed on a target 's cell phone or computer , can be used to monitor the target 's communications , such as phone calls , text messages , Skype calls , or emails . After publishing our initial series of blogposts back in 2016 , we have continued to track the ScarCruft threat actor .


If the text is retrieved successfully , the app uses JavaScript injection again to submit the HTML form with the captcha answer . The China-backed BARIUM APT is suspected to be at the helm of the project . The code then tries to kill each process and service that belongs to the following list of AV products : Symantec B-TOOL S-IDTY Firewall Norton ESET McAfee Avast Avira Sophos Malwarebytes . The name of the shortcut file , depending on the campaign , is either randomly generated by a random string generator function or hardcoded in the macro code .


The evidence above suggests that EventBot is still in the development stage , and as such , is not likely to have been used for large attack campaigns thus far . Just to highlight its capabilities , TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue . As described in previous publications , the Rocket Kitten attackers make extensive use of various phishing schemes .


The first part of the campaign From Jan. 23 , 2018 , to Feb. 26 , 2018 used a macro-based document that dropped a VBS file and an INI file . The samples we identified target the ATM vendor Diebold .


In addition , these out-of-the-box hosting services usually provide better infrastructure than the attackers could manage to construct ( or compromise ) themselves . Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system . Before reversing the executable , it is possible to clean it allowing the size reduction and the junk instruction reduction inside the code . Researchers have linked the group with low confidence to APT33 and APT34 .


Some of the documents exploited CVE-2017-0199 to deliver the payload . According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 .


Check Point reached out to the Google Security team immediately with information on this campaign . In early 2014 , the APT38 deployed NESTEGG ( a backdoor ) and KEYLIME ( a keylogger ) malware designed to impact financial institution-specific systems at a Southeast Asian bank . Before continuing , Several issues in Foxit PDF reader could lead to arbitrary code execution Foxit PDF Reader is one of the most popular PDF readers on the market , offering many similar features to Adobe Acrobat .


This was probably done for debugging purposes , indicating the malware may be an early prototype version . The document attached to this e-mail exploits CVE-2012-0158 . In the past , BlackOasis messages were designed to appear like news articles from 2016 about political relations between Angola and China .


It is capable of a variety of functions , including credential theft , hard drive and data wiping , disabling security software , and remote desktop functionality . In addition to these , the Animal Farm attackers used at least one unknown , mysterious malware during an operation targeting computer users in Burkina Faso .


WICKED SPIDER has been observed targeting technology companies in Germany , Indonesia , the Russian Federation , South Korea , Sweden , Thailand , Turkey , the United States , and elsewhere . The group spearphished targets in several waves with Flash exploits leading to their Carberp based JHUHUGIT downloaders and further stages of malware .


The following is a review of scope and impact of the Chrysaor app named com.network.android tailored for a Samsung device target , with SHA256 digest : ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5Upon installation , the app uses known framaroot exploits to escalate privileges and break Android 's application sandbox . Between August 2 and 4 , the Leviathan sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors . A string identifying a campaign . Systems are compromised to enable them to then attack other systems .


Write a new file “ %LOCAL_APPDATA%\dllhost.exe ” or “ %TEMP%\dllhost.exe ” and execute it , then delete the file , Write a new file “ %LOCAL_APPDATA%\sechost.dll ” or “ %TEMP%\sechost.dll ” and call its first exported function using “ rundll32.exe ” or Windows API , then delete the file , Run shellcode provided by the server in a new thread While processing the commands , the backdoor logs all errors and execution results .


However , over the last nine campaigns since Trend Micro‘s June report , TA505 also started using .ISO image attachments as the point of entry , as well as a .NET downloader , a new style for macro delivery , a newer version of ServHelper , and a .DLL variant of FlawedAmmyy downloader . Lotus Blossom attempted to exploit CVE-2014-6332 using the POC code available in the wild .


Backdoor.SH.SHELLBOT.AA : b68bd3a54622792200b931ee5eebf860acf8b24f4b338b5080193573a81c747d .


The Zebrocy tool associated with this current strain of attacks is constructed in several different forms based on the programming language the developer chose to create the tool .


However , the underlying code can be quite different in that various obfuscation mechanisms were adopted to evade detection by anti-virus tools . Iranian threat agent OilRig has been targeting multiple organisations in Israel and other countries in the Middle East since the end of 2015 . The ﬁrst check performed is on the arguments : if the arguments length is equal to zero , the malware terminates the execution . Cl0p 's precipitous rise to the top of the charts this month , on the other hand , can be explained by their exploitation of a zero - day in MOVEit Transfer , a widely used file transfer software .


All contain the same Visual Basic macro code and author name as Honeybee . Based on recent reports , the country has been plagued by attacks using the Ursnif and Urlzone banking malware .


CNIIHM officially collaborates with other national technology and development organizations , including :


Either method to load HenBox ultimately results in an instance of a service being launched . In March 2017 , suspected Chinese espionage operators targeted CCleaner , a utility that assists in the removal of unwanted files from a computer . Their evolving and modified SPLM , CHOPSTICK , XAgent code is a long-standing part of Sofacy activity , however much of it is changing .


When the attacker restarts the Quasar application , our uploaded “ dnsapi.dll ” will instead be loaded .


EventBot is in constant development , as seen with the botnetID string above , which shows consecutive numbering across versions . It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns . Since early 2014 , an attacker group of Iranian origin has been actively targeting persons of interest by means of malware infection , supported by persistent spear phishing campaigns .


Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . Symantec during 2012 linked the Elderwood Project to Operation Aurora ; Trojan.Naid and Backdoor.Moudoor were also used in Aurora , by the Elderwood Gang , and by Hidden Lynx .


This newest variant has been labeled XLoader version 6.0 ( detected as AndroidOS_XLoader.HRXD ) , following the last version discussed in a previous research on the malware family . Researchers have pointed out that it is not uncommon for admin@338 to target Hong Kong media organizations , particularly ones whose reporting focuses on the pro-democracy movement . Name SHA256 . " The server was used to distribute and infect victims with an upgraded version of Rising Sun with SSL capabilities , " informs a report shared with BleepingComputer .


Health_insurance_registration.doc : 1b5e33e5a244d2d67d7a09c4ccf16e56 . job_titles.doc : fa72c068361c05da65bf2117db76aaa8 . job_titles_itworx.doc : 43fad2d62bc23ffdc6d301571135222c . job_titles_mci.doc : ce25f1597836c28cf415394fb350ae93 .


The following archive caught our attention for exploiting a WinRAR unacev2 module vulnerability and for having interesting content . To compromise the utility , Kaspersky Lab determined that Barium used stolen digital certificates used by ASUS to sign legitimate binaries , and altered older versions of ASUS software to inject their own malicious code .


Look for information about the status of your device . The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . Beyond the file system metadata for the Prefetch file ( creation and last modification times ) and the last execution time within the file metadata , CTU analysts did not observe any indicators of value on the source host . [ c2_hostname ] The purpose of the shellcode is to download a GIF image file from URL hxxp://[c2_hostname]/groups / pic.gif , then search for and decrypt the hidden PE file inside of it .


] 6 2020-03-26 http : //rxc.rxcoordinator [ . These campaign-related VPSs are located in South Africa . MenuPass spoofed several sender email addresses to send spear phishing emails , most notably public addresses associated with the Sasakawa Peace Foundation and The White House .


In 2013 , the Sofacy group expanded their arsenal and added more backdoors and tools , including CORESHELL , SPLM ( aka Xagent , aka CHOPSTICK ) , JHUHUGIT ( which is built with code from the Carberp sources ) , AZZY ( aka ADVSTORESHELL , NETUI , EVILTOSS , and spans across 4-5 generations ) and a few others .


“ As part of our ongoing efforts to protect users from the Ghost Push family of malware , we ’ ve taken numerous steps to protect our users and improve the security of the Android ecosystem overall. ” We are very encouraged by the statement Google shared with us addressing the issue . Per the complaint , the email account watsonhenny@gmail.com was used to send LinkedIn invitations to employees of a bank later targeted by APT38 . the application will perform distinct layers of code analysis and optimization , Mandiant attributed these intrusions to UNC4899 , a Democratic People 's Republic of Korea ( DPRK)-nexus actor , with a history of targeting companies within the cryptocurrency vertical .


The archive also contained all the necessary codes to target Australian financial institutions . The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros . Derusbi is a backdoor B-MAL S-MAL Trojan E-MAL believed to be used among a small group of attackers , which includes the Rancor group . Open - source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org .


This campaign has most likely been created to allow the targeting of people linked to or interested by cybersecurity , so probably the people who are more sensitive to cybersecurity threats .


Adobe independently patched the vulnerability ( CVE-2015-3043 ) in APSB15-06 .


The code to load the main module dynamically can also be seen statically . Upon decrypting and executing , it drops two additional files wsc_proxy.exe (legitimate Avast executable) and a malicious DLL wsc.dll in the %TEMP% folder . APT35 has historically used unsophisticated tools like those listed below in Figure 3 .


It is also able to move code execution into different locations if needed . Regardless of causation , the rapid development of new versions of Emissary suggests that the malware authors are making frequent modifications to evade detection , which as a corollary suggests the Lotus Blossom are actively using the Emissary Trojan as a payload in attacks . Winnti : a045939f53c5ad2c0f7368b082aa7b0bd7b116da https://bugcheck.xigncodeservice.com/Common/Lib/Common_bsod.php . Since early 2023 , we have seen several new Yashma strains emerge , including ANXZ , Sirattacker , and Shadow Men Team .


More data is appearing daily , leading us to believe the actors are still highly active . The malware is distributed primarily through laced spam emails that lure recipients into opening attachments . WEBC2 backdoors are often packaged with spear phishing emails . Digital certificates stolen in some of the heists have been used to sign malware that targeted Tibetan and Uyghur activists .


The threat actors behind the Sea Turtle campaign were successful in compromising entities by manipulating and falsifying DNS records at various levels in the domain name space . The campaign targets Middle Eastern organizations largely from the Lebanon and United Arab Emirates , though , Indian and Canadian companies with interests in those Middle Eastern countries are also targeted .


The following code shows EventBot parsing instructions sent from the C2 . UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques . The HTA files contained job descriptions and links to job postings on popular employment websites .


What is most significant about the July 2015 CloudDuke campaign is the timeline .


Figure 6 : Targeted ad network Figure 7 : Injection example After all of the required changes , “ Agent Smith ” compiles the application and builds a DEX file containing both the original code of the original application and the malicious payload . The executable would install the real Ammyy product , but would also launch a file called either AmmyyService.exe or AmmyySvc.exe which contained the malicious payload . If the package contains this file , the script is the first thing that msiexec.exe runs when it begins the installation process . The threat actors are distributing NetSupport RAT either as a zipped download or via an Internet shortcut .


Figure 1 – Phishing Email When the email link is opened from an Android device , an APK file ( Fattura002873.apk ) , is downloaded . For the sake of narrative we are going to focus exclusively to those samples we identified being used in attacks against Iranian civil society and diaspora . They rely on a Griffon JS backdoor and Cobalt S-MAL/Meterpreter , and in recent attacks , Powershell Empire . This will essentially create a client - side WAF that can enforce a policy on where specific data field are allowed to be transmitted .


Subsequently , the malware will change the screen off time-out to 10 minutes . Another new malware we found that TA505 is using in their campaigns last June 20 against targets in Japan , the Philippines , and Argentina is FlowerPippi . In this latest discovery by McAfee , despite a short pause in similar operations , the Lazarus group targets financial organizations .


The attack relied on a spear-phishing email with a subject of “ Defence & Security 2018 Conference Agenda ” that had an attachment with a filename of “ Defence&Security_2018_Conference_Agenda.docx ” .


What are Google authorization tokens ? Targeting data supports the belief that APT39 's key mission is to track or monitor targets of interest , collect personal information , including travel itineraries , and gather customer data from telecommunications firms . Data-flow tracking code was added to detect these use-cases . The way Hack520 signs his messages in one hacker forum provides a clue pointing to this connection .


Overlapping Infrastructure with eSurv Surveillance Cameras The Command & Control domain configured in several of the malicious applications found on Google Play Store , ws.my-local-weather [ . Using data collected from the Trend Micro™ Smart Protection Network , we are able to identify victims whose networks communicated with Taidoor C&C servers . Writes the decoded payload to C:\ProgramData\IntegratedOffice.txt . Another wave of suspected Dukes attacks was identified in November 2018 by FireEye , this time again relying on Windows LNK files and deploying Cobalt Strike .


com.dhp.ozqh Facebook 5022495104c280286e65184e3164f3f248356d065ad76acef48ee2ce244ffdc8 ufD.wyjyx.vahvh Anshin Scan a0f3df39d20c4eaa410a61a527507dbc6b17c7f974f76e13181e98225bda0511 com.aqyh.xolo 佐川急便 cb412b9a26c1e51ece7a0e6f98f085e1c27aa0251172bf0a361eb5d1165307f7 While TG-4127 continues to primarily threaten organizations and individuals operating in Russia and former Soviet states , this campaign illustrates its willingness to expand its scope to other targets that have intelligence of interest to the Russian government . With that method, the malware’s query will traverse the native DNS architecture as opposed to the victim making a direct connection to the . Kaspersky ’s Global Research and Analysis Team ( GReAT ) has observed signs of its attacks in several countries including Germany , South Korea and Uzbekistan , as well as the US .


APT28 has been active since at least January 2007 but received public attention in a major way during 2016 when it was implicated in a series of cyber attacks in the run up to the U.S. presidential election .


Instead of implementing very basic gameplay , the authors pirated and repackaged the original game in their app and bundled with it their advertisement SDK . Hackers use Metasploit to conduct all these activities : network reconnaissance , search for vulnerable applications , exploit vulnerabilities , escalate systems privileges , and collect information . APT16 . If you ’re a user in Ukraine or Poland , especially someone working in the government or military sectors , this is a clear - cut example of a spam campaign targeting this population .


Analysis of Nidiran samples determined that the back door had been updated three times since early 2014 , which fits the timeline outlined in Figure 4 .


The IP belongs to the free Russian web hosting service Ucoz . Lazarus actors commonly maintain persistence on a victim 's system by installing the malware-as-a-service . APT33 : 8.26.21.120 [REDACTED].ddns.net . The videos were quickly passed around offices while users ’ systems were silently infected in the background , and many of the APT ’s components were signed with phony Intel and AMD digital certificates .


Every once in a while , authors leave behind a trace that allows us to attribute not only similar apps , but also multiple different PHA families to the same group or person . To ensure persistence in the system MoneyTaker relies on PowerShell and VBS scripts - they are both difficult to detect by antivirus and easy to modify . The encoded and decoded payloads are written to files named igfxHK[%rand%].dat and igfxHK[%rand%].exe respectively , where [%rand%] is a 4-byte hexadecimal number based on the current timestamp . The activity we have observed , coupled with others in the information security industry , indicate that these threat actors are likely using Exchange Server vulnerabilities to gain a foothold into environments .


Example of a command that steals specific files from an infected device ’ s application ( top ) , and GolfSpy ’ s parse-and-perform command ( bottom ) Apart from the HTTP POST method , GolfSpy also creates a socket connection to the remote C & C server in order to receive and perform additional commands . Earlier this month , we caught another zero-day Adobe Flash Player exploit deployed in targeted attacks . This module stores another instance of the GRIFFON implant inside the registry to achieve persistence . Our analysis indicates that attackers may have been using attackers since mid-2022 .


The JavaScript code locates the targeted ads by searching for iframes which contain ads from Google ads infrastructure , as shown in the image below : The fraudulent clicks generate a large revenue for the perpetrators , especially since the malware reached a presumably wide spread . ALLANITE uses email phishing campaigns and compromised websites called watering holes to steal credentials and gain access to target networks , including collecting and distributing screenshots of industrial control systems . The function GetLocalPcDescrStr is used to compose a large string that contains system information of the target workstation . Cisco Talos recently worked with two vendors to patch multiple vulnerabilities in a favored software library used in chemistry laboratories and the Foxit PDF Reader , one of the most popular PDF reader alternatives to Adobe Acrobat .


The admin@338 previous activities against financial and policy organizations have largely focused on spear phishing emails written in English , destined for Western audiences . security policy in the Eastern Europe and South Caucasus regions .


For example , some strains of ransomware abuse accessibility features , a method that could easily alarm users because accessibility is a special permission that requires users to go through several screens and accept a warning that the app will be able to monitor activity via accessibility services . This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON , which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics . . These servers may be approved , but a compromised network endpoint can be modified to mask the final destination of the server requests originating externally .


Checking this Minigameshouse page further indicates that this person is indeed the owner of the minigameshouse [ . This malware family can be used to compromise multiple vendor platforms and leverages uncommon technology to access physical devices . Pactchfilepacks.net23.net . checkmail.phpnet.us .


For our M-Trends 2017 report , we took a look at the incidents we investigated last year and provided a global and regional (the Americas , APAC and EMEA) analysis focused on attack trends , and defensive and emerging trends . In 2014 , APT32 leveraged a spear-phishing attachment titled " Plans to crackdown on protesters at the Embassy of Vietnam.exe , " which targeted dissident activity among the Vietnamese diaspora in Southeast Asia .


Further details in it reflect characteristics of Exodus ( such as the bypass of power managers we described from Exodus One , and more ) : Indicators of Compromise Exodus One 011b6bcebd543d4eb227e840f04e188fb01f2335b0b81684b60e6b45388d3820 0f5f1409b1ebbee4aa837d20479732e11399d37f05b47b5359dc53a4001314e5 2055584625d24687bd027a63bc0b8faa7d1a854a535de74afba24840a52b1d2f Intelligence suggests the group has been active since at least 2014 and is presently operating in multiple facilities targeting safety systems beyond Triconex . Removing information : Through it all , our 2023 State of Ransomware equips your organization with the knowledge to counter the hidden mechanics of global ransomware .


Using these credentials , the attackers are able to compromise more machines on the network and , from those machines , again obtain more credentials . Figure 2: Zyklon attack flowInfection Techniques CVE-2017-8759 .


DOWNLOAD AND UPDATE THE TARGET CONFIGURATION FILE By analyzing and decoding the HTTP packets in EventBot Version 0.0.0.1 , we can see that EventBot downloads and updates a configuration file with almost 200 different financial application targets . Bemstour was used again in June 2017 in an attack against an organization in Luxembourg . The Magic Hound attacks did not rely on exploit code to compromise targeted systems , instead relying on Excel and Word documents containing malicious macros .


When the recipient attempted to open the attachment , they would inadvertently execute the file , causing PoisonIvy to be installed .


The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 . At this time , we do not believe that the attackers found a new ASA exploit .


The injection method used for winlogon.exe is also interesting and quite unusual . ClearSky 's September 2014 blog post first described active attacks using a piece of malware they dubbed ' Gholee ' ( as appears in a malicious payload export function , potentially named after a popular Iranian singer9 ) . We can see the familiar DOS stub in plain text , but the rest of the header and binary body are encrypted . We have been documenting it recently and are reporting the abuse to Cloudflare which it uses to hide its real infrastructure .


Analysis revealed a consistent first-stage payload of the well-documented Zebrocy Trojan .


The samples we analyzed originated from the Philippines . The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information .


The creation of this malicious document , coming on the same day that the UK government announced an initial agreed draft of the BREXIT agreement , suggests that SNAKEMACKEREL is a group that pays close attention to political affairs and is able to leverage the latest news headlines to develop lure documents to deliver firststage malware , such as Zekapab , to its intended targets .


Third , based on the server response , the app can also hide its icon and create a shortcut instead . Additionally , these decoy documents are hosted on legitimate websites including a government website belonging to the Cambodia Government and in at least once case , Facebook . The infrastructure remains up and running at the time of this post .


Cybercriminals have become obsessed by this method of illegal earnings : at the beginning of the year we knew only 67 banking Trojans , but by the end of the year there were already 1321 unique samples . Taiwan has been a regular target of cyber espionage threat actors for a number of years . The communication is then handled by the TCP module ( 200 ) , which was previously documented by Kaspersky . In June 2023 , Anonymous Sudan claimed an operation targeting Microsoft services .


Further research is needed to understand the full breadth of this group 's cyber capabilities .


If connections to the C&C are blocked or terminated through a firewall , the artifact will be inhibited , as it doesn’t seem to have any fallback protocol .


t's now relying on a new DNS-based attack technique to better cloak command and control communications between Greenbug and the malware " , said Dennis Schwarz , research analyst on Arbor 's ASERT Team , in an interview with Threatpost . The adversaries have used this technique to allow PlugX and HTTPBrowser to persist on a system .


Command Action Unistxcr Restart the app dowsizetr Send the file stored in the /sdcard/DCIM/.dat/ directory to the C & C server Caspylistx Get a list of all hidden files in the /DCIM/.dat/ directory spxcheck Check whether call details are collected by the spyware S8p8y0 Delete call details stored by the spyware screXmex Take screenshots of the device screen Batrxiops Check battery status L4oclOCMAWS Fetch the victim 's location GUIFXB Launch DoublePulsar is then used to inject a secondary payload , which runs in memory only . Scarlet Mimic is a threat group that has targeted minority rights activists .


, android:4.2.2 , model : GT-N5100 , phonenumber : +486679225120 , sim:6337076348906359089f , app : null , ver:5.0.2″ } Data sent to the server [ { “ command ” : ” sent & & & ” , ” params ” : { “ to ” : ” +79262000900″ , ” body ” : ” \u0410\u0412\u0422\u041e\u041f\u041b\u0410\u0422\u0415\u0416 Malware used by the threat group can be configured to bypass network-based detection ; however , the threat actors rarely modify host-based configuration settings when deploying payloads . The tsm binary then runs in the background , forwarding a series of error messages to /dev/null to keep the code running , ensuring the continuous execution of the code referenced with a set of parameters /tmp/up.txt . Based on our research , we discovered an unknown threat actor using MortalKombat ransomware since December 2022 to target individuals and smaller companies .


In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch . In 2010 US-based HBGary investigated an information security incident related to the Winnti group at one of HBGary 's customers – an American video game company .


The attackers involved in these email campaigns leveraged a variety of distribution mechanisms to deliver the information stealing FormBook malware . An interesting point in the Silence attack is that the cybercriminals had already compromised banking infrastructure in order to send their spear-phishing emails from the addresses of real bank employees and look as unsuspicious as possible to future victims .


It is highly likely that BRONZE PRESIDENT is based in the PRC due to the following observations :


At the time of writing , the dropper supports aepic.dll , sspisrv.dll , ftllib.dll , and userenv.dll to host the malicious FinFisher payload . The Magic Hound has repeatedly used social media to identify and interact with employees at targeted organizations and then used weaponized Excel documents . Uses AES128 implementation from Crypto++ library for payload decryption . We were able to find additional links between Hack520 ’s “ Pig network ” and the Winnti group ’s activities .


Moreover , eSurv was a business unit of Connexxa and was leased to eSurv S.R.L in 2014 . However , in September last year , our friends at CSIS published a blog detailing a new Carbanak variant affecting one of its customers . MuddyWater is a relatively new APT that surfaced in 2017 .


Similarly , GeminiDuke may also download image files , but these would contain embedded additional configuration information for the toolset itself .


Next to the features , we expect the target list to be expanded to contain additional ( banking ) apps in the near future . In addition to their preexist backdoor , ServHelper and FlawedAmmy , they have also been confirmed to use the backdoor called AdroMut and FlowerPippi . While investigating a 2016 intrusion , Secureworks incident responders identified BRONZE BUTLER exploiting a then-unpatched remote code execution vulnerability ( CVE-2016-7836 ) in SKYSEA Client View , a popular Japanese product used to manage an organization .


In such situations , mobile users should always take the utmost precautions while downloading any applications from the internet . Hussarini was first mentioned in APT campaigns targeting the Philippines and Thailand in 2014 . APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries , including , manufacturing , human rights , government , and .


During our analysis , Downeks created a file in “ Appdata\Roaming ” containing only “ SD{new line} 0 ” ( “ SD ” possibly for “ SharpDownloader ” ) .


Based upon Cylance 's observations , the Tofu Backdoor was deployed in far fewer instances than the Ham Backdoor . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East .


We believe these timestamps to be generated during the compilation of GeminiDuke from the local time of the computer being used .


It was originally documented on July 25 , 2014 ( or June 22 , 2014 , according to Kaspersky ) and the first campaign we observed in which TA505 distributed Dridex occurred three days later on July 28 .


Types of attacks possibly averted include Structured Query Language ( SQL ) injection , cross-site scripting , and command injection .


A few months later , in February 2017 , the FBI published a press release revising its estimates and stating that " Since January 2015 , there has been a 1,300 percent increase in identified exposed losses , now totaling over $3 billion " Recognizing the significance of this threat group , Unit 42 continues to track the evolution of Nigerian cybercrime under the code name SilverTerrier . In late 2015 , Symantec identified suspicious activity involving a hacking tool used in a malicious manner against one of our customers .


The admin@338 has largely targeted organizations involved in financial , economic and trade policy , typically using publicly available RATs such as Poison Ivy , as well some non-public backdoors . Now GozNym is now targeting 13 banks and subsidiaries in Germany , Limor Kessem , Executive Security Advisor at IBM , said Tuesday .


Presumably , this was done to make the app seem more credible to targeted users in different countries . This includes Python scripts . Mandiant has previously observed targeted attackers stealing email , but few threat actors have been as successful at this as APT35 .


Cybereason Mobile Detecting EventBotCybereason Mobile detecting EventBot . Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique . This Trojan is related to the Elise backdoor described in the Operation Lotus Blossom report .


The group was also responsible for the 2016 attack on the World Anti Doping Agency ( WADA ) and the leaking of confidential drug testing information .


In this latest campaign , APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER . The group 's main objective is to steal source codes .


Upon execution , KASPERAGENT drops the payload and a decoy document that displays Arabic names and ID numbers .


EventBot Dropped XML configuration files Dropped XML configuration files on the device . Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies . Ties to SHAPESHIFT suggest that APT33 may engage in destructive operations or shares tools or development resources with an Iranian threat group that conducts destructive operations .


VOODOO BEAR is a highly advanced adversary with a suspected nexus to the Russian Federation . Probably the most high-profile attack that GandCrab was behind is a series of infections at customers of remote IT support firms in the month of February .


On 27th February , Kaspersky and CrySyS Lab published research on this previously unidentified malware family , dubbing it MiniDuke .


The multiple vulnerabilities in these older systems provide cyber actors many targets for exploitation .


Step 1 : Download Bank Austria Security App Download the Bank Austria security app to your Android device . Sea Turtle have been more aggressive in their pursuit targeting DNS registries and a number of registrars , including those that manage ccTLDs . APT33 Elfin APT33 is a suspected Iranian threat group that has carried out operations since at least 2013 .


As a result of the long-term development process , there are multiple , exceptional capabilities : usage of multiple exploits for gaining root privileges , a complex payload structure , never-before-seen surveillance features such as recording surrounding audio in specified locations . To learn more about this campaign , you may refer to our report , Operation Pawn Storm Using Decoys to Evade Detection . The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets .


In doing so , users can mistakenly install malicious apps , such as the spyware mentioned in this blog . Xagent – A variant of JbossMiner Mining Worm” – a worm written in Python and compiled using PyInstaller for both Windows and Linux platforms . Group5 has used two commonly available remote access tools ( RATs ) , njRAT S-MAL and NanoCore , as well as an Android RAT , DroidJack .


Trend Micro detects these as ANDROIDOS_XLOADER.HRX . The heavier targeting in Pakistan adheres to historical targeting and the ongoing tension between the two countries , which has escalated since a terrorist attack in Kashmir on 14 February 2019 . Once the macro is executed , the malware downloads two files from “ kentona[.su ” , using an SSL encrypted communication , and stores them in “ C:\Users\Public ” path : “ rtegre.exe ” and “ wprgxyeqd79.exe ” .


Payment card dumps are commonly shared amongst Brazilian threat actors via social media forums such as Facebook , Skype , and web-based WhatsApp messenger . An Iranian hacking group formerly named Ajax Security ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


This sample is clearly a mix between the two . Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands . The changes to RIPTIDE were significant enough to circumvent existing RIPTIDE detection rules . RedLeaves can use HTTP over non - standard ports , such as 995 , for C2.Rocke 's miner connects to a C2 server using port 51640.[32 ]


Recently , Sophos Labs has observed criminal groups scanning the internet for open MySQL databases running on Windows systems , which they tried to infect with GandCrab . The server used to host these malware samples was located on the German provider Hetzner ( 148.251.55.114 ) , within a small block of IP addresses that are registered with the customer ID " HOS-156205 " .


If an incoming SMS contains one of the following magic strings : ” 2736428734″ or ” 7238742800″ the malware will execute multiple initial commands : Keylogger implementation Keylogging is implemented in an original manner . This malware report contains analysis of one 32-bit Windows executable file , identified as a Remote Access Trojan ( RAT ) . APT33 : c7a2559f0e134cafbfc27781acc51217127a7739c67c40135be44f23b3f9d77b S-SHA2 AutoIt FTP tool . Attackers could exploit these vulnerabilities to carry out a variety of attacks , in some cases gaining the ability to execute remote code on the targeted machine .


Split Strings Encrypted strings can be a signal that the code is trying to hide something . The group subsequently stole communications related to the firm 's business relationship with a national military , including inventories and memoranda about specific products they provided . GetCMD Remote Shell . June also witnessed a staggering increase in attacks from relatively new gangs such as Akira ( 26 ) and 8Base ( 41 ) , enough to propel both of them into the top five — a designation usually reserved for more familiar names like ALPHV , who was conspicuously silent in June .


These tools often lay the groundwork for further malicious activity , such as the targeting of antivirus capabilities and the disabling of firewalls , both of which are very fundamental defensive measures . While we did not discuss the surrounding attacks using Bookworm in detail , we have observed threat actors deploying Bookworm primarily in attacks on targets in Thailand .


Port 6210 : SBrowser extraction service . The threat then executes " svchost.exe " . Potentially fake , leaked Hamas documents . " These [ Rising Sun ] implants were all based on the original Backdoor Duuzer source code , " the researchers say in their report .


Registering broadcast receivers enable XLoader to trigger its malicious routines . wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 . It has a structure similar to previous “ wprgxyeqd79.exe ” file : two of their files have the same name , but the content of this new SFX is extracted in the “ %ALLUSERSPROFILE%\Windows Anytime Upgrade ” directory .


As it launches , it requests device administrator rights , and then starts communicating with its C & C server . Ke3chang has also leveraged a Java zero-day vulnerability ( CVE-2012-4681 ) , as well as older , reliable exploits for Microsoft Word ( CVE-2010-3333 ) and Adobe PDF Reader ( CVE-2010-2883 ) . It 's possible that Lazarus is using RATANKBA to target larger organizations .


What makes this malware extremely powerful is the capability to adapt after it 's deployed . This domain and IP address has been previously associated with the BITTER APT and targeting government agencies in China with phishing attacks , based on reporting from 360-CERT . APT33 leverages popular Iranian hacker tools and DNS servers used by other suspected Iranian threat groups .


CTU researchers assess with moderate confidence that APT28 is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government . Since we published out last report on SLUB , the backdoor has been updated and several improvements were implemented . The SLUB malware was delivered through watering hole websites that were injected with exploits for CVE-2018-8174 or CVE-2019-0752 . During this attack , we found that the SLUB malware used two Slack teams sales-yww9809” and marketing-pwx7789 . SWEED remains consistent across most of their campaigns in their use of spear-phishing emails with malicious attachments . In April 2018 , SWEED began making use of a previously disclosed Office exploit . In May 2018 , campaigns being conducted by SWEED began leveraging another vulnerability in Microsoft Office: CVE-2017-11882 , a remote code execution bug in Microsoft Office that is commonly observed being leveraged in malicious documents used in commodity malware distribution . We found them targeting countries in the Middle East such as United Arab Emirates and Saudi Arabia , as well as other countries such as India , Japan , Argentina , the Philippines , and South Korea . Similar to previous campaigns , the JAR was directly attached to emails and used file names such as Order_2018.jar . Code contained inside one of the slides triggers an exploit for CVE-2017-8759 , a remote code execution vulnerability in Microsoft .NET framework .


Security solutions can detect it in countless combinations with other suspicious permissions and functions , or malicious functionalities – but when faced with no additional functionality nor permission , all failed to trigger any alarm on DEFENSOR ID . This malicious site used CVE-2019-0752 , an Internet Explorer vulnerability discovered by Trend Micro’s Zero Day Initiative (ZDI) that was just patched this April . While the tools profiled in this report are not inherently malicious , their capabilities are nonetheless integral to the Lazarus Group 's cyber operations , both espionage and destructive in nature , making them inherently dangerous to potential victims .


For example , this could be when the victim ’ s device connects to a Wi-Fi access point that is infected or controlled by the attackers . Japan is no stranger to banking malware . Multiple China-based cyber threat groups have targeted international media organizations in the past .


Known for hijacking prominent social media accounts , the self-styled white hat hacking group OurMine took over a number of verified Twitter and Facebook accounts belonging to the cable network . The APT group is reportedly targeting the Middle East region .


The Rancor group 's attacks use two primary malware families which we describe in depth later in this blog and are naming DDKONG and PLAINTEE . The China Chopper actor activity starts with the download and execution of two exploit files which attempt to exploit the Windows vulnerabilities CVE-2015-0062 , CVE-2015-1701 and CVE-2016-0099 to allow the attacker to modify other objects on the server .


Our research team has found infected apps on third-party app stores , but they could also be downloaded by Android users directly by tapping malicious links in phishing attack messages . APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol ( RDP ) , Secure Shell ( SSH ) , PsExec , RemCom , and xCmdSvc . There are some variants with this pattern ( e.g , the variable – 10 < 0 ) Given that threat actors use red team tools and public exploitation frameworks for targeted threat activity in the wild , we believe COSMICENERGY poses a plausible threat to affected electric grid assets .


The Curious Case of Notepad and Chthonic : Exposing a Malicious Infrastructure .


If the user has launched Play Market , the Trojan intercepts the event and displays a window on top of the Google Play window , prompting the user to enter his/her bank card details in the fake window . The attackers behind Epic Turla have infected several hundred computers in more than 45 countries , including education . These tools are used to further compromise the organization by attacking other hosts inside the targets network . Furthermore , these reports indicated that Zarya was cooperating with or being handled by officers of Russia ’s Federal Security Service ( FSB ) .


This new organization seems to work on securing Android devices . The following examples were developed using a Winnti installer that was used in attacks in December 2016 . In most cases , the attacks involved Adobe Acrobat , Reader , and Flash Player exploits such as : CVE-2009-4324 , CVE-2009-0927 , CVE-2011-0609 , CVE-2011-0611 . RussianPanda ( @AnFam17 ) named the URL shortcut campaign RogueRaticate .


The updated tool has only been seen in a handful of victim computers within organizational networks in Southeast Asia—PLATINUM is known to customize tools based on the network architecture of targeted organizations . At this point , the current attack campaign against the chemical industry began .


Based on our observations , this group uses a variety of different methods to either compromise or acquire already compromised payment card credentials . The May 2014 ' Operation Saffron Rose ' publication identifies an Iranian hacking group formerly named ' Ajax Security ' ( code-named ' Flying Kitten ' by CrowdStrike ) engaged in active spear phishing attacks on Iranian dissidents ( those attempting to circumvent government traffic monitoring ) .


The admin@338 linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries , has now pointed its focus inward at China autonomous territory Hong Kong . In April , shortly after the Trojan 's discovery , researchers observed a massive GozNym campaign targeting 24 North American banks .


After receiving the rights , it sets itself as the default SMS app and disappears from the device screen . CTU researchers have observed TG-3390 activity between 04:00 and 09:00 UTC , which is 12:00 to 17:00 local time in China ( UTC +8 ) . It then resets cron and removes possible cache files from other programs , starts scripts and binaries a , init0 , and start , and sets the persistence by modifying the crontab . CrowdStrike Services recently investigated several Play ransomware intrusions where the common entry vector was suspected to be the Microsoft Exchange ProxyNotShell vulnerabilities CVE-2022 - 41040 and CVE-2022 - 41082 .


The documents that exploit CVE2017-11882 download another payload — an HTML Application ( HTA ) file toting a malicious Visual Basic ( VBS ) script — from the server , which is executed accordingly by the command-line tool mshta.exe . TG-3390 uses older exploits to compromise targets , and CTU researchers have not observed the threat actors using zero-day exploits as of this publication .


TG-0416 is a stealthy and extremely successful Advanced Persistent Threat ( APT ) group known to target a broad range of verticals since at least 2009 , including technology , industrial , manufacturing , human rights groups , government , pharmaceutical , and medical technology . By the end of April , GozNym had redirection instructions for 17 Polish banks in its repertoire , along with an extra 230 URLs designed to assist attackers in targeting community banks and email service providers in the Eastern European country .


Of note , FireEye discovered two additional new malware families hosted at this domain , VALUEVAULT and LONGWATCH . Once exploit has been achieved , Nidiran is delivered through a self-extracting executable that extracts the components to a .tmp folder after it has been executed .


Apart from injecting code to read the CAPTCHA , the app also injects its own code into the system_server process , which requires root privileges . The Sogu gang use a custom developed threat – Backdoor.Sogu , whereas the group described in this document use an off the shelf threat – Poison Ivy . APT17 , also known as DeputyDog , is a Chinabased threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities , the defense industry , law firms , information technology companies , mining companies , and non-government organizations . To compromise the victims , the attackers used extremely effective social engineering techniques which involved sending malicious PDF documents to their targets .


] it Firenze serverrt.exodus.connexxa [ . Furthermore , Dragos' analysis of the TRISIS event continues as we recover additional data surrounding the incident . This command is used to upload collected data to the C2 server . By creating awareness and using the right solutions , both individuals and organizations can take the steps needed to defend against the malicious tactics used by threat actors like the Winnti group .


The malware searches both internal and external storage and encrypts them using RC4 . Wild Neutron hit the spotlight in 2013 , when it successfully infected companies such as Apple , Facebook , Twitter and Microsoft . ScarCruft continues to evolve, introduces Bluetooth harvester . Both of these campaigns use a similar structure with compromised WordPress sites hosting the lure shortcuts and a WebDav server that loads NetSupport RAT .


We ’ ve noticed an increase in the number of attacks using this event as a lure . This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . In the Naikon scheme , a C&C server can be specialized XSControl software running on the host machine .


In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch . Our research shows that compromised organizations are at risk of not only being spied on by the Turla group who planted the backdoor , but also by other attackers .


In another case , Vcrodat was also used in an attack on a UK-based organization in the hospitality sector . According to FireEye , the admin@338 sent out emails containing malicious documents designed to exploit Microsoft Office vulnerabilities in an effort to deliver a piece of malware dubbed LOWBALL .


Due to the specific nature of its activity , Perkele is distributed in a rather unusual way . Finally , some of the victims are also infected with other Turla-related malware such as ComRAT or Gazer . An individual who goes by the name LZX in some online forums is believed to be the original author of ZxShell . Supply Chain Attack


So far we have identified the following behaviors : Sending device information to a remote command and control ( C2 ) server . The Middle Eastern hacker group in this case is codenamed " BlackOasis " Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday . If we decide to open the document , we see that the document is empty , but it requires the enabling of the macro . Spyware can even be used to track the device 's physical location and record from the camera or microphone .


In scenarios where wire fraud is not as lucrative an option , INDRIK SPIDER might use ransomware to monetize the compromise instead . In August 2017 , the National Bank of Ukraine warned state-owned and private banks across the country about a large-scale phishing attack .


This routine is a form of generic and variable generator of DLL side-loading combinations . These characteristics suggest that COBALT GYPSY executed the January and February phishing campaigns and that it created the Mia Ash persona . This DLL does not contain an export table and its entire functionality resides in the DllMain routine . • None consisting of CVE-2022 - 41080 and CVE-2022 - 41082 to achieve remote code execution ( RCE ) through Outlook Web Access ( OWA ) .


A second Quasar sample was also observed attacking this new victim :


After the demise of Storm , it was replaced by another new botnet known as Waledac that also leveraged peer-to-peer communications . Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of " FinSpy " malware , according to a new blog post published Monday .


As will become evident in this report , this was not a one-off case but a recurring theme with the Dukes , in that they would rather continue with their operations as planned than retreat from operating under the spotlight .


North Korea's Office 39 is involved in activities such as gold smuggling , counterfeiting foreign currency , and even operating restaurants . Our investigation showed that these attacks were targeted , and that the threat actor sought to steal communications data of specific individuals in various countries .


However , the unique malware variant , BlackEnergy 3 , reemerged in Ukraine early in 2015 , where we had first found Sandworm Team . Researching this attack and the malware used therein led Microsoft to discover other instances of PLATINUM attacking users in India around August 2015 .


Android services are components that can be made to execute independently in the background without the victim 's knowledge . In a more recent version of the modified Gh0st RAT malware , Ghost Dragon implemented dynamic packet flags which change the first five bytes of the header in every login request with the controller . This second request ( Encoded Get System Information Request ) is encoded using the same method as the custom TCP protocol used for communication with command-and-control servers , which uses a four-byte XOR encoding .


Using AutoFocus , we pivoted from the user agent string to expand our data set to three additional Zebrocy samples using the exact same user agent .


Yet irrespective of this , it is confusing why the previously-declared “ TEMP ” category was walked back as this has led to not small amount of confusion – in both technical and non-technical audiences – as to just what FireEye ’s blog post refers .


This event triggers archive downloading thread . Similar to RIPTIDE campaigns , APT12 infects target systems with HIGHTIDE using a Microsoft Word ( .doc ) document that exploits CVE-2012-0158 . The United States and countries in Europe are targeted as well .


For the past five months , Check Point researchers have quietly observed the China-based advertising company behind HummingBad in several ways , including by infiltrating the command and control servers it uses . These files have the capability to download and install malware , install proxy and Remote Access Trojans ( RATs ) , connect to command and control ( C2 ) servers to receive additional instructions , and modify the victim 's firewall to allow incoming connections . APT33 : 8.26.21.119 [REDACTED].ddns.net . Its demands for ransom have exceeded 145 million , with collections exceeding 60 million .


The software manages the delivery of firmware updates over-the-air , the term used for transmission via a mobile network . We believe APT10 is the most significant known Chinese state-sponsored cyber threat to global corporations . Minzen : 797d9c00022eaa2f86ddc9374f60d7ad92128ca07204b3e2fe791c08da9ce2b1 .


App icons under which Asacub masks itself The APK files of the Trojan are downloaded from sites such as mmsprivate [ . CTU researchers have observed the threat actors installing a credential logger and backdoor on Microsoft Exchange servers , which requires a technical grasp of Internet Information Services ( IIS ) . If the system has been previously infected with a cryptominer , it also attempts to kill the running miner and all its related activities . Rhysida , a new ransomware gang claiming to be a " cybersecurity team , " has been in operation since May 17 , 2023 , making headlines for their high - profile attack against the Chilean Army .


Kaspersky also published details on how Zebrocy has added the Go” language to its arsenal – the first time that we have observed a well-known APT threat actor deploy malware with this compiled , open source language . Figure 1 shows a sample phishing email used by HawkEye operators in this latest campaign .


The value used to replace GET_IMG_OBJECT comes from the JSON configuration . Our prior publication also failed to acknowledge immensely valuable input from a number of colleagues , including Nadim Kobeissi 's feedback on how the API endpoints on the Android malware were encrypted . 0x111111111 : Hide “ Loveusd ” driver from the system kernel driver list . 0x22222222 : Securely delete an in-use or no-access target file-name . 0x44444444 : Unhook the ZwWriteFile API and hook KiFastCallEntry . 0x55555555 : Remove the ZxShell Image Load Notify routine . 0x88888888 : Set a special value called “ type ” in Windows registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverMain . Ukraine ’s Computer Emergency Response Team ( CERT - UA ) has attributed the July campaign to the threat actor group UNC1151 , as a part of the GhostWriter operational activities allegedly linked to the Belarusian government .


Despite the attention and public exposure of the toolset ’s technical details ( including IOCs ) to defenders , the Dukes still continued with their second wave of spear-phishing , including the continued use of CloudDuke .


changeActivity command The webview injects are not hosted on the C2 , they are hosted on a completely different server . From January 2018 to March 2018 , through FireEye 's Dynamic Threat Intelligence , we observed attackers leveraging the latest code execution and persistence techniques to distribute malicious macro-based documents to individuals in Asia and the Middle East . KHRAT : File Type : PE32 executable ( DLL ) Intel 80386, for MS Windows . It crafts configurable IEC-104 ASDU messages , to change the state of RTU IOAs to ON or OFF .


Table 5 describes the latest variant seen in AutoFocus . Another Chinese espionage group used a similar tool , CLASSFON , to covertly proxy network communications in 2011 . This whitepaper explores the tools - such as MiniDuke , CosmicDuke , OnionDuke , CozyDuke , etc- of the Dukes , a well-resourced , highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making .


In addition to this , as reported by our peers at ESET last week , the group has also begun using a UEFI ( Unified Extensible Firmware Interface ) rootkit known as Lojax .


We initially reported on Transparent Tribe and their UPDATESEE malware in our FireEye Intelligence Center in February 2016 . Sometimes Patchwork send an MS PowerPoint document instead , which exploits CVE-2014-6352 .


The Shellbot script is added to run after the victim ’s system reboots , and scripts /a/upd , /b/sync/ , and /c/aptitude/ are added to the crontab .


The secondary payload was also written in Delphi and its developer configured it to communicate with its C2 server using HTTPS via the following URL : https://200.122.181.25/catalog/products/books.php .


In order to achieve this , mike.jar connects to rootdaemon through various TCP ports that the daemon binds on some extraction routines for supported applications : Port 6202 : WhatsApp extraction service . In late 2015 , Symantec identified suspicious activity involving a hacking tool used in a malicious manner against one of our customers . However , some of the documents also play an additional role in the attack . On Oct. 10 , 2023 , Citrix released a security bulletin for a sensitive information disclosure vulnerability ( CVE-2023 - 4966 ) impacting NetScaler ADC and NetScaler Gateway appliances .


The sctrls backdoor we came across is delivered via RTF files exploiting CVE-2015-1641 . Dragos does not publicly describe ICS activity group technical details except in extraordinary circumstances in order to limit tradecraft proliferation .


Threat actors , especially those at the level of nation state , are seeking opportunities to attack these organizations , conducting elaborate , advanced operations to gain leverage , seize strategic assets , and collect information . Bahamut was first noticed when it targeted a Middle Eastern human rights activist in the first week of January 2017 .


Our Umbrella telemetry shows that the majority of the request comes from Australia and the majority of the phone numbers infected have the international indicative for Australia . The command and control ( C2 ) infrastructure chosen by APT10 for Operation Cloud Hopper is predominantly referenced using dynamic-DNS domains . OceanLotus : plan.evillese.com:8888 11b4 . The dump files will start ' NSPPE- ' .


Accessing the “ Cmd ” folder in the attacker ’ s email box Moreover , it can send a specified file or all the gathered data from the victim device via email . We have found what may be an early data-gathering stage for future possible heists from financial organizations in Turkey ( and possibly other countries ) . APT33 : bf9c589de55f7496ff14187b1b5e068bd104396c23418a18954db61450d21bab S-SHA2 DarkComet . The compromise of a system that is within the bot net is simply used to facilitate another attack .


The downloaded macro component includes a function called AutoClose() as well as two payloads embedded via Base64 encoded strings .


Exodus One checks-in by sending a POST request containing the app package name , the device IMEI and an encrypted body containing additional device information . During the summer of 2018 , HELIX KITTEN actors were observed targeting entities in the Middle East — of note , targets appeared to be located in Bahrain and Kuwait . It also shows us an actor that puts effort in opsec by only using cloud providers . This technique has been used by the group for some time , with reports of INISafeWebSSO being leveraged dating as far back as 2018 .


Zebrocy activity initiates with spearphishing operations delivering various target profilers and downloaders without the use of any 0day exploits . Lately , Patchwork has been sending multiple RTF files exploiting CVE-2017-8570 .


The trojan will receive instructions from the C2 to spread . The research and ongoing tracking of APT10 by both PwC UK and BAE . OceanLotus : E:\ProjectGit\SHELL\BrokenSheild\BrokenShieldPrj\Bin\x86\Release\DllExportx86.pdb Loader #1 . AdFind A publicly available tool that is used to query Active Directory .


Lazarus is a very active attack group involved in both cyber crime and espionage . The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server ( systsm.webServer/httplogging ) and then delete existing logs from the system ( see Figure 4 ) .


Initial reports about HIGHNOON and its variants reported publicly as Winnti dating back to at least 2013 indicated the tool was exclusive to a single group , contributing to significant conflation across multiple distinct espionage operations . In order to increase the likelihood of their malware successfully communicating home , Cyber Espionage threat actors are increasingly abusing legitimate web services , in lieu of DNS lookups to retrieve a command and control address .


This OnionDuke variant is related to the one seen during the summer of 2013 being spread via torrent files .


The class “ org.starsizew.Ma ” is registered to intercept incoming SMS messages , the arrival of which will trigger the Android system to call its “ onReceive ” API . FireEye also reported on these attacks in a May 22 blog post . This function accepts three parameters : the input ﬁle , the output ﬁle and the arrKey ; arrKey is calculated thanks to GetKey function that accepts as input the Hexadecimal value of the Driver SN installed on the machine and returns the key as results . The group appears to commonly deploy double extortion of the victims that have been listed on the leak site , several of them have had some portion of their exfiltrated data exposed .


Kaspersky spyware sensors caught the signal of an attack from the device of one of the victims ; and a hash of the APK involved ( Android application ) was tagged in our sample feed for inspection . A ransomware variant dubbed PyLocky was observed in September 2018 being distributed by a phishing campaign using an invoicing theme . However , sometimes using public exploit code is quicker and more effective for malware authors . The RAT 's main binary is launched from " C:\Users\%username%\AppData\Roaming\BranScale\client32.exe " .


At this point , the attackers know the user has opened the document and send another spear-phishing email , this time containing an MS Word document with an embedded executable . As far as we can judge from the data we have , in 2014 the criminal group behind Lurk seriously reduced its activity and " lived from hand to mouth " , attacking anyone they could , including ordinary users .


The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities . The operation against the Tibetan Parliamentarians illustrates the continued use of malicious attachments in the form of documents bearing exploits .


Through open-source research , CTU researchers identified the owners of 66 of the targeted email addresses .


It was recently reported that Ismail Haniyeh , the head of Hamas ’ political Bureau , had a falling-out with the Egyptian government over his visit to Tehran to participate in General Qasem Soleimani ’s funeral , following Soleimani ’s assassination .


It can also be downloaded by a specific command . In fact , according to reports of various security vendors , OceanLotus also attacked several countries , including Cambodia , Thailand , Laos , even some victims in Vietnam , like opinion leaders , media , real estate companies , foreign enterprises and banks . SilverTerrier is a Nigerian threat group that has been seen active since 2014 .


Retrieve the browsing history and bookmarks from Chrome and SBrowser ( the browser shipped with Samsung phones ) . Symantec has found evidence of Starloader files being named AdobeUpdate.exe , AcrobatUpdate.exe , and INTELUPDATE.EXE among others . JhoneRAT : https://twitter.com/jhone87438316 . They are usually motivated by a cause of some sort , such as highlighting human rights or alerting a large corporation to their system vulnerabilities .


Each of these elements makes TA505 a magnifying lens through which to consider the framework employed by many modern threat actors .


Adups addressed the issue in a Nov. 16 news release , writing that some products made by BLU were updated in June with a version of its FOTA that had actually been intended for other clients who had requested an ability to stop text spam . In addition , a current ANY.RUN playback of our observed Elise infection is also available . C2 : news.softfix.co.kr .


Oddly enough they also use it to make fun of the AV community , sharing detection screenshots from VirusTotal ( thus leaking IoC ) and even engaging in discussions with malware researchers directly The following screenshot shows tweets from their advertisement campaign : That unusual behavior could be explained by the combination of the need for attention and a probable lack of experience . As of June 2019 , ESET has seen over 50 victims being actively spied upon by Machete , with more than half of them being computers belonging to the Venezuelan military forces . Malware overlaps between APT38 and TEMP.Hermit highlight the shared development resources accessible by multiple operational groups linked to North Korean state-sponsored activity .


We have detected a total of 17 C & C servers on 4 different domains , which probably means the bad guys are quite familiar with what redundancy is . It is also possible that ScarCruft deployed another zero day exploit , CVE-2016-0147 , which was patched in April . The executable variant of Helminth is installed with a dropper Trojan that we are tracking as the HerHer Trojan .


Bouncing Golf ’ s operators also try to cover their tracks . Adobe on Thursday patched a zero-day vulnerability in Flash Player that has been used in targeted attacks carried out by a new APT group operating primarily against high-profile victims in Russia and Asia . In order to trick blue teams and other DFIR analysts , the operators created fake HTTP 302 redirection to various Google services on their C2s servers . All they need to do is deploy and configure the provided phishing kit with an API key .


If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail , the adversaries identify other externally accessible servers and deploy ChinaChopper web shells .


However , it also targets applications from Romania , Ireland , India , Austria , Switzerland , Australia , Poland and the USA . this RTF exploits again the CVE-2017_1882 on eqnedt32.exe . We also found a second IRC bot called MPK using the same IP for its C2 server that a Leash sample was hosted on .


WE WILL UNLOCK THE MOBILE DEVICE AND DELETE ALL YOUR DATA FROM OUR SERVER ! Group-IB detected the first incidents relating to Silence in June 2016 . Both used DocuSign decoy documents with different macros . Monitor newly executed processes that may attempt to hide artifacts associated with their behaviors to evade detection .


In April 2019 , several national security organizations released alerts on CVE-2019-0604 exploitation , including the Saudi Arabian National Cyber Security Center and the Canadian Center for Cyber Security . Leader is Bookworm 's main module and controls all of the activities of the Trojan , but relies on the additional DLLs to provide specific functionality .


Silence.MainModule is a typical remote control Trojan that provides access to the command shell CMD.EXE with the possibility of downloading files from remote nodes to a computer and uploading files from a computer to a remote server . Their next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting , again attempting to extract all Word documents .


To maximize profit , variants with “ MinSDK ” or “ OTA ” SDK are present to further infect victims with other adware families . The decoy documents used by the InPage exploits suggest that the targets are likely to be politically or militarily motivated . For example , the MSI package used in the campaign contains different files , as shown in the table below . The web shell , named help.aspx ( MD5 : 4b3039cf227c611c45d2242d1228a121 ) , contained code to identify the presence of ( 1 ) FireEye xAgent , ( 2 ) CarbonBlack , or ( 3 ) CrowdStrike Falcon endpoint products and write the output of discovery .


Extract logs from WhatsApp . In September 2015 , our anti-targeted attack technologies caught a previously unknown attack . Similar to previous attacks , this campaign starts with social engineering . As confirmed by our own research data , CISA also found LockBit took the top spot as the biggest global ransomware threat in 2022 .


Also unusual was the observation that both Dridex and BitPaymer were spread through the victim network using lateral movement techniques traditionally associated with nation-state actors and penetration testing . The ScarCruft group keeps expanding its Exfiltration targets to steal further information from infected hosts and continues to create tools for additional data Exfiltration .


Adversary behavioral artifacts further suggest the TEMP.Veles operators are based in Moscow , lending some further support to the scenario that CNIIHM , a Russian research organization in Moscow , has been involved in TEMP.Veles activity .