GLOBAL

THREATINTELLIGENCEREPORT
DELIVERING ACTIONABLE AND
CONTEXTUALIZED INTELLIGENCETO INCREASE CYBER RESILIENCE

Reporting Period: September 1 to November 30, 2022

Global Threat Intelligence Report

1

CONTENTS
5 The Last 90 Days in Numbers
Total Number of Attacks

Geography of Attacks Prevented byCylance Endpoint Security Solutions

9

Types of Malware Used During
Attacks in this Reporting Period
Windows
Downloaders
Ransomware
Infostealers
File Infectors
Remote Access Trojans
macOS/OSX
Adware/Spyware
Browser Hijackers
Proxy Malware and AgentsLinux
Bots and Botnets
Malware and Tooling
Crypto Miners and Cryptojacking
Mobile Devices
AndroidiOS

15 Industry-Specific Attacks
Automotive

Recent Threat Trends
Downloaders
Infostealers
Ransomware
Dual-Use Tools
Wider Automotive Threat LandscapeSupply-Chain Attacks
Trends for the Future
Healthcare
The Financial Industry

21 Most Active Threat Actors
TA505

ALPHV
APT32
APT29 (the Dukes)
Mustang Panda
TA542

23 Common MITRE Techniques

Sample Behaviors of Common Techniques
MITRE D3FEND Countermeasures

25 Most Sound Attacks

DJVU: Strangely Familiar Ransomware
Mustang Panda Abuses Legitimate
Apps to Target Victims in Myanmar
BianLian Ransomware Encrypts
Files in the Blink of an Eye
Unattributed RomCom Threat Actor Spoofing
Popular Apps Now Hits Ukrainian Military
RomCom Threat Actor Abuses Popular
Software Brands to Target Ukraine andPotentially the United Kingdom
ARCrypter Ransomware Expands Its
Operations from Latin America to the World
Mustang Panda Uses the Russian-Ukrainian War
to Attack Europe and Asia Pacific Targets

28 Additional Attacks
EmotetCryWiperand Forecast
29 Conclusionsfor Q1 2023
Lessons Learned/ Takeaways
Q1 2023 Forecast

30 Resources

Public Indicators of Compromise (IoCs)
Public Rules
Common MITRE Techniques
MITRE Defend Countermeasures

The information contained in this report is intended for educational purposes only. BlackBerry does not guarantee or take responsibility for the accuracy, completeness andreliability of any third-party statements or research referenced herein. The analysis expressed in this report reflects the current understanding of available information by our
research analysts and may be subject to change as additional information is made known to us. Readers are responsible for exercising their own due diligence when applying thisinformation to their private and professional lives. BlackBerry does not condone any malicious use or misuse of the information presented in this report.

Global Threat Intelligence Report2

INTRODUCTION
THREAT INTELLIGENCE CAN BE CONSIDERED “THE ART OF
TAKING THE ADVERSARY BY SURPRISE.” ANTICIPATING,
MITIGATING, AND PREVENTING SURPRISES IN THE FORM
OF CYBERATTACKS IS THE PRIMARY MISSION OF A
PRACTICAL THREAT INTELLIGENCE PROGRAM.
Achieving that goal requires a proactive approach that answers criticalquestions like the following: Which threat actors are most likely to cause
an impact in my organization? What are their motivations, goals, andcapabilities? How do they behave, and what cyber-weapons do they
use to achieve those goals? And most importantly, what actionablecountermeasures can I deploy to improve my organization’s cyber defense
capabilities?
Our team is proud to release our first BlackBerry Cybersecurity Global
Threat Intelligence Report. The mission of this report is to provide
actionable intelligence on targeted attacks, cybercrime-motivated threat
actors, and campaigns targeting organizations like yours so that you canmake well-informed decisions and take prompt effective actions.
In this first edition, you’ll find reports from some of the top threat researchers
and intelligence analysts on the BlackBerry Threat Research and Intelligenceteam, world-class experts who understand not only technical threats but also
local and global geopolitical developments and their impact on organizational
threat models in each region. To produce this report (covering the 90 days
between September 1 and November 30, 2022), the team leveraged data andtelemetry obtained from our own artificial intelligence (AI)-driven products
and analytical capabilities, complemented by other public and private
intelligence sources.

Some of the research highlights in this report include:•

90 days by the numbers. An overview of the 90-day reporting
period in statistics, including the number of unique malware samples
that BlackBerry prevented from impacting our customers and thegeographical distribution of those attacks. Here’s a preview: ourtechnology stopped an average of 62 new malicious samples per hour, orapproximately one new sample per minute.

•

Most common weapons. Information about the most common
weapons used in cyberattacks, including the resurgence of malicious
loaders like Emotet, Qakbot’s extensive presence on the cyberthreat
landscape, and the increase in downloaders like GuLoader.

Global Threat Intelligence Report

3

TITLE•

Remote access increases infostealers. With the post-pandemic riseof remote and hybrid work, the need to access internal networks from theoutside has become widespread. Attackers are taking advantage of new
remote access possibilities by using information stealers (infostealers)
to steal corporate credentials to sell them on the black market. Our reportdiscusses some of the most prevalent and widespread infostealers wesaw deployed during this time period.

•

No platform is ‘safe.’ Threat actors have multiple strategies fortargeting different server, desktop and mobile platforms. For example,
despite prevailing opinion, macOS is not a “safer” platform: macOS
malware and vulnerabilities abound. Other topics covered include trends
such as the increasing number of attacks against Linux platforms; theway that less mainstream programming languages like GoLang are being
used to develop cross-platform malware; and an in-depth analysis ofthreats affecting mobile devices running Android and iOS.

•

Unique industry perspective. Due to our strong presence in boththe cybersecurity and Internet of Things (IoT) industries, BlackBerry is
uniquely positioned to uncover threats to industries such as automotivethat aren’t often discussed in other threat reports. This edition includes
information about cybersecurity trends we observed that will impact the
automotive industry as well as the healthcare and financial industries.

•

BLACKBERRYCYBERSECURITY THREATINTELLIGENCE AUTHORS
Dmitry Bestuzhev
Pedro Drimel
Jacob Faires
Dean Given
Eoin Healy
Geoff O’RourkeJose Luis Sanchez

Top threat actors and countermeasures. Our telemetry also
revealed the activities of many different threat actors. The report includes
information about some of their most common tactics, techniques,and procedures (TTPs) as well as links to public lists of appliedcountermeasures mapped to MITRE ATT&CK and MITRE D3FEND. Our
goal is to make it easier to update your organizational defenses andthreat models based on this actionable information.

•

Wrapping up and looking ahead. Finally, we present our conclusions
and cyberthreat forecast for 2023.

I want to thank our elite global researchers on the BlackBerry Threat
Research and Intelligence team who made this report possible and continue
to produce numerous “first-to-market” research reports while continuously
improving BlackBerry’s data- and Cylance AI-driven products and services.

Ismael Valenzuela
Vice President, Threat Research & Intelligence at BlackBerry@aboutsecurity

The data in this report was produced byBlackBerry Cybersecurity telemetry and is
the property of BlackBerry Limited.

Global Threat Intelligence Report

4

TITLE XXXXXXXXXXXX

THE LAST 90 DAYS IN NUMBERSTOTAL NUMBER OF ATTACKSIn the 90 days between September 1 and November 30, 2022, Cylance® Endpoint Security solutions by BlackBerrystopped 1,757,248 malware-based cyberattacks. On average, threat actors deployed approximately 19,524 malicious
samples per day against customers protected by our technologies. These threats included 133,695 unique malware
samples, which translates to an average of 1,485 novel malware samples per day and 62 samples per hour: in otherwords, an average of roughly one new sample per minute.
The following graph shows the dynamics of potential cyberattacks that Cylance Endpoint Security solutions prevented
between September 1 and November 30, 2022. The spikes during week 4 (September 29 to October 5) and week 7(October 20 to October 26) were a result of threat actors reusing malware samples.

DYNAMICS OF PREVENTED ATTACKS

2022

Figure 1: Cyberattacks prevented by BlackBerry per week from September 1 to November 30, 2022

Global Threat Intelligence Report

5

TITLEGEOGRAPHY OF ATTACKS PREVENTED BY CYLANCE ENDPOINT
SECURITY SOLUTIONSGenerally, countries with greater Internet penetration, economy, and population experience the mostthreats. Our telemetry shows that threat actors during this period targeted BlackBerry clients in countries
around the world.

COUNTRIES WHERE BLACKBERRY PROTECTEDCUSTOMERS FROM CYBERATTACKSUSAWAS THE MOST PROTECTEDCOUNTRY WITH ALMOST ONEMILLION ATTACKS STOPPED.

Figure 2: Countries where BlackBerry protected clients from cyberattacks. Darker blue represents more cyberattacks.
Countries without blue shading do not currently contain a statistically significant number of BlackBerry clients.

Global Threat Intelligence Report

6

TITLEFIGURE 3 SHOWS THE TEN COUNTRIES WHERE CYLANCE ENDPOINT SECURITY
SOLUTIONS PREVENTED THE GREATEST NUMBER OF CYBERATTACKS.

TOP 10 COUNTRIES EXPERIENCINGCYBERATTACKS IN Q4

United StatesJapan
BrazilCanadaAustralia
Mexico
Korea
Chile
India
Peru

Figure 3: Top 10 countries where BlackBerry clients were targeted by cyberattacks

Global Threat Intelligence Report

7

TITLEFIGURE 4 SHOWS THE COUNTRIES WHERE BLACKBERRY CLIENTS WERE MOSTFREQUENTLY ATTACKED WITH UNIQUE MALICIOUS SAMPLES.

TOP 10 COUNTRIES WHERE UNIQUE MALWARESAMPLES WERE USED

United StatesJapan
Brazil53%

CanadaKorea
Australia
MexicoIndia
ChileSingapore

Figure 4: Top 10 countries where unique malicious samples were used incyberattacks against BlackBerry clients

Global Threat Intelligence Report

8

TITLE

TYPES OFMALWARE
USED DURING ATTACKS IN THISREPORTING PERIOD

Between September 1 and November 30, 2022,
threat actors used a wide variety of malware toachieve their financial, geopolitical, military andtactical goals. The most widespread and interesting
malware families identified are organized byoperating system (OS) below.

•

Emotet is one of the most prolific threats in current
use. It first surfaced in 2014 and survived an April
2021 law-enforcement takedown, resurrecting at
the end of 2021. This past quarter, Emotet resurged
after a four-month hiatus, using previously seentechniques including a phishing campaign that
distributed malicious Microsoft® Office documents.
These documents attempt to persuade the victim
to copy them into an official Microsoft directory,
where macros are automatically executed without
asking for the user’s permission. Emotet haslong been known for dropping the banking Trojan
IcedID, which has strong connections with multiple
ransomware groups.

•

Qakbot is usually delivered through phishingtechniques, using a lure email. The lure typicallycontains a LNK hyperlink that redirects to a malicious
webpage containing a password-protected ZIP filethat contains an ISO file. The LNK file executes a
JavaScript file, which in turn executes a Qakbot
malicious DLL with a .DAT extension. An interesting
Qakbot feature is its use of existing email threads
as a means of propagation. Its ability to “reply to”
recipients can make intended victims believe thatthe link or attachment in the existing email thread
is being sent from a trusted source. Qakbot isfrequently used by many ransomware groups, andwas associated this quarter with Black Basta, apossible Conti rebrand that targeted a rash of U.S.based companies in 2022.

It’s important to note that while Windows® is still themost attacked OS, its users may be somewhat better
prepared to face a malware attack than other OS users,
who may still believe they are immune to cyberattacks.
However, BlackBerry® telemetry data shows thatmacOS®, Linux®, and mobile users are also frequently
attacked: no platforms are immune from infection.

WINDOWS
While malware can run on any OS, Microsoft® Windows®
remains the most commonly attacked. Reasons
include the popularity of the OS, the wide range of
documentation for developers, and the many years of
cumulative experience in the cybercriminal community,
where tips and tricks are frequently shared in forums.

Downloaders
Downloaders lure victims to open files that downloadmalware. The files frequently pose as legitimate digital
documents or executables. Common downloaders
include the following:

Global Threat Intelligence Report

9

TITLE•

GuLoader downloads and implements an executablefrom a remote location, and is frequently used
to download and execute infostealers such as
RedLine and Raccoon. GuLoader commonly abuses
cloud-based services such as Google Cloud™ and
OneDrive® to host its payloads; however, we havealso detected it using Telegram bots.

Ransomware
LockBit remained the most active and successful
ransomware-as-a-service (RaaS) used in 2022, and the
90 days covered in this report showed no signs that thethreat group is slowing down. LockBit has now evolved
to version 3.0, which uses several anti-debugging
techniques that make it harder to analyze and string
encryption and other techniques borrowed from the
now-retired BlackMatter ransomware.

REDLINE
IS CAPABLE OF STEALING CREDENTIALSFROM NUMEROUS TARGETS INCLUDINGBROWSERS, CRYPTO WALLETS, FTP,
AND VIRTUAL PRIVATE NETWORK (VPN)
SOFTWARE, AND MORE.

Infostealers
With the post-pandemic rise of remote and hybrid
work, the need for outside access to internal networks
became more widespread. Attackers immediately took
advantage of increased remote access authorization byusing infostealers—which were previously used mostoften for cyber-fraud—to steal corporate credentials tosell on the black market. Those stolen credentials areoften used by initial access brokers (IABs) and affiliatesof ransomware operations to compromise the originalorganizations’ networks and deploy ransomware.
Infostealers seen during this reporting period include thefollowing:•

Redline was the most active and widespreadinfostealer seen. Redline is capable of stealing
credentials from numerous targets includingbrowsers, crypto wallets, FTP, and virtual private
network (VPN) software, and more.

•

Raccoon infostealer functions as a malware-as-aservice (MaaS), enabling aspiring cybercriminals
to use its powerful features for as little as $100 amonth. While Raccoon was not as widely deployed

Global Threat Intelligence Report

10

TITLE
as Redline, it is still considered a potent threat.
BlackBerry even detected cases where Raccoon
was dropped by an initial Redline infection.
Raccoon can steal credentials from crypto wallets,
browser extensions, Discord, and Telegram;take screenshots; and act as a loader to launch
additional payloads.
In September 2022, threat actors attempted tocompromise Uber1. The attack was publicly attributed
to affiliates of the Lapsus$ group. No ransomware was
deployed in the Uber incident due to the company’s swift
actions to shut down the attack.

Remote Access Trojans
Remote access Trojans (RATs) can log keystrokes,
access the user’s webcam, steal browser credentials,
and provide attackers a remote shell command-line
program that can execute shell commands on theinfected device as well as on other computers in the
network. RATs observed during this reporting period
include the following:•

njRAT was initially seen in 2015 and is still one of themost popular RATs in use today. It has been deployedby financially motivated threat actors as well as
in more targeted attacks. njRAT’s builder is widely
available, making it easy for threat actors to adapt it
to any desired attack model. It is commonly used bythreat actors in the Middle East, and our proprietary
telemetry identified an instance of njRAT with acommand-and-control server (C2) hosted in Jordan.

•

FlawedAmmyy, which appeared in 2018, is based onleaked source code of the valid remote access tool
Ammyy Admin, which is used by both businesses
and consumers to handle remote control anddiagnostics on Microsoft Windows machines. While
FlawedAmmyy was primarily attributed to cybercrimegroup TA505 (known for performing ransomware
operations through its Cl0p ransomware), it iscommonly used by multiple cybercrime threat actors.

File Infectors
File infectors work by infecting other executable files
and can spread through network shares or removabledevices. The file infector Neshta was first identified in2003 and is still observed decades later. Neshta has
previously been associated with BlackPOS, a point-ofsale (POS) malware used to scrape credit card datafrom POS systems, which was highly prevalent in
attacks against the consumer goods, energy, finance,and manufacturing industries in 2018. We published anin-depth report on Neshta in 2019 and have continued toobserve similar traffic every year since then.

MACOS/OSX
BLACKBERRY RESEARCHERS NOTEDTHAT A WHOPPING34%

OF CLIENT ORGANIZATIONS USING
MACOS HAD DOCK2MASTER ON
THEIR NETWORK, WHERE IT WAS
FOUND ON 26% OF THEIR DEVICES.

While macOS is not the most widespread corporate
platform, it is being installed on a growing number ofenterprise systems2. Although macOS has a reputation
as a “safer” platform than Windows, macOS malware
and vulnerabilities exist.

Adware/Spyware
Adware and spyware are by far the most widely
seen threats that impact macOS. These applications
masquerade as legitimate software, with the underlying
intent to take advantage of the user. Unlike threatsthat are placed on computers by a targeted infection

Global Threat Intelligence Report

11

TITLE
campaign, users often install adware and spyware
themselves because they believe them to be legitimate
applications and they are unaware of the (often free)
software’s dangers. During the 90-day reporting period,
the malicious application Dock2Master was the mostseen threat on macOS: BlackBerry researchers notedthat a whopping 34 percent of client organizations
using macOS had Dock2Master on their network, where
it was found on 26 percent of their devices. Officiallydesignated as a potentially unwanted application (PUA),
Dock2Master surreptitiously injects ads directly into web
pages that users visit and collects user and system data
to sell on the underground market.

Browser Hijackers
Browser hijackers, which change a browser’s searchengine and manipulate other browser settings, aren’t
as prevalent as they were in the early 2000s, but they
are still plentiful. While the most noticeable effect ofa browser hijack is the user’s default search enginechanging without their consent, browser hijackers also
may monetize the installation by stealing user identity
information stored in browsers and injecting ads into
displayed web pages. This quarter, active browser
hijackers included OriginalModule and SearchInstaller,
which uses InstallCore to target multiple platforms.

Proxy Malware and Agents
Proxy malware is a type of Trojan that turns an infected
system into a proxy server that allows an attacker to
execute actions on your behalf. Proxy agents are proxymalware that also add RAT-like capabilities, such as
running local commands on infected machines. Proxy
malware typically tends to support fewer functions thanother malware types, allowing it to target a larger range ofvictims because fewer libraries are required. The GoLang
programming language is used heavily in this class of
malware because its support for proxy libraries like Proxit
make development easy for novice cybercriminals.
BlackBerry has noticed the increasing use of GoLang totarget macOS systems as part of a wider cross-platform

attack against multiple platforms for opportunistic
attacks like malicious spam (malspam). To operate
effectively on multiple platforms, these attacks rely on
simple functions that exist across all platforms. Most
proxy malware samples observed are proxy agents that
attack browsers that are available on multiple platforms.

LINUX
The Linux operating system is powerful, flexible, largely
open-source, and ubiquitous: up to 90 percent ofpublic cloud services run on Linux3. As a result, Linux
is an appealing target for cybercriminals who rapidly
weaponize and exploit weaknesses and vulnerabilities
disclosed by vendors or other industry players.

Bots and Botnets
A bot is an autonomous program that executes
commands without human intervention, and a botnet
is a group of bots controlled by a single threat actor.
Botnets are typically formed by taking advantage of a
misconfiguration or unpatched vulnerability that allows
installation of malicious code that adds the victim’s
computer to the botnet. Since the emergence of the nowinfamous Mirai bot-network that conducted large-scale
distributed denial-of-service (DDoS) attacks in 2016,
more Linux botnets have emerged.
Noted Internet Relay Chat (IRC) botnets like ShellBot still
lingered at the end of 2022, using brute-force tactics toenter systems via misconfigured or default credentials4.
In addition, we’ve seen the Sysrv botnet abusing remotecode execution (RCE) flaws5 via CVE-2022-229476 tocompromise systems and grow their botnet at scale.

Malware and ToolingBlackBerry observed and identified other malware
and malicious tooling during this reporting period.
SSH tooling (based on the secure shell protocol thatenables remote access) is often dropped in tandemwith malicious code to brute-force credentials and/or
scan networks for propagation opportunities. During the

Global Threat Intelligence Report12

90-day reporting period, use of the tool Faster than Lite
(FTL) increased. The tool is often abused by threat group
OutLaw7 and was noted to be bundled with ShellBot.
Our telemetry revealed similar campaigns deploying the
GoLang-based SSH brute-force tool Spirit, which is also
abused as a propagation tool. Spirit is typically dropped
alongside the Pwnrig and Tsunami IRC bots, which we
can attribute with reasonably high confidence to thehacking group 8220 Gang.
The now-infamous Log4j vulnerability was regularly
abused by various malware families and threat actors
during the reporting period. For example, the Kinsing
Trojan abused the Java Log4j package vulnerability8
CVE-2021-442289 for RCE on Linux platforms, and has
been seen more recently abusing Oracle WebLogic
Server vulnerability10 CVE-2020-1488211. This Trojan
attempts to disable a device’s security and cloud service
agents and kill any rival malware and cryptocurrency
miners (crypto miners) on the victim system before
deploying its own crypto miner.

THIS QUARTER, CRYPTOMINERS MADE UP ASIGNIFICANT PORTION OF THE

THREATSTARGETING LINUX DEVICES.

Crypto Miners and Cryptojacking
Cryptojacking is a widespread scheme in which athreat actor installs malicious crypto mining software
on a victim’s device to mine cryptocurrency coins
without the user’s consent. Crypto miners have been apersistent plague on the cyberthreat landscape for the
past decade. Crypto miners affect all major computing
systems and can linger a long time before discovery.
Even though cryptocurrency in general lost value during
the reporting period, deploying crypto miners at scale
can generate tangible financial benefits for threat actors.
Overall, despite the market changes, crypto is still kingfor many of these Linux-based threat actors.
This quarter, crypto miners made up a significant
portion of the threats targeting Linux devices. The act of
crypto mining has become more resource-intensive andtherefore more costly. As a result, attackers have begun
compromising the environments of multiple victims to
deploy miners and misappropriate needed computing

Global Threat Intelligence Report

13

59%
OVER

TITLE

OF ALL INTERNET TRAFFIC IN 2022 WAS
GENERATED BY MOBILE DEVICES.

resources. Both the previously mentioned ShellBot andthe Sysrv bot infiltrate systems, deploy crypto miners,
and hijack system resources.
Typically, crypto miners make their way onto a victim’s
environment post-compromise through a dropped
payload or by exploiting a vulnerability such as CVE2022-2613412 (Atlassian Confluence) or CVE-2019-272513(WebLogic), as frequently seen14 with the PwnRig crypto
miner. Crypto miners attempt to blend in with standard
background resources such as cron jobs (which scheduleroutine tasks to repeat at specific times in the future) andremain undetected for as long as possible.
The quarter also revealed detections related to
CryptoNight, a mining algorithm used to secure networks
and validate transactions in some cryptocurrency suchas Monero and Webchain, including a spike in the useof the Webchain miner as well as several XMRig-basedminers. XMRig is a popular open-source utility commonlyused to mine cryptocurrencies including Bitcoin andMonero, and is one of the most abused coin miners bythreat actors today.

MOBILE DEVICES
Mobile devices continue to replace laptops and desktop
computers for many functions, including electronicbanking, mobile payments, messaging apps, and social
networks. In fact, 59.54 percent of all Internet traffic in
2022 was generated by mobile devices15.

Android
In 2022, nearly 71 percent of mobile devices worldwide
used the Android™ operating system. Threats during thereporting period include the following:•

Lotoor is a tool that can be used for both benign andmalicious purposes. Android owners can use Lotoor toroot or unlock additional capabilities on their devices, but
the tool can also be used to bypass Google’s embedded
security features and implant persistent malware.

•

AdvLibrary infects devices to monetize Internet traffic
by showing unsolicited ads and generating outgoingtraffic on paid ads. Victims typically do not experiencea direct financial loss, but they may incur additional
expenses for increased data traffic. Cybercriminals
generate income with AdvLibrary through clicks on
ads and traffic to maliciously advertised sites.

iOS
iOS® is generally considered to be a more secure mobile
OS than others. While zero-day iOS exploits are expensive
and rarely used in uncontrolled attacks, iOS is not immune
to exploits that “jailbreak” or unlock iPhone® devices, apotentially hazardous activity that removes original Apple®
security features and provides complete access to thedevice. While some owners intentionally jailbreak theiriPhones for purposes like removing unwanted default
apps, jailbroken phones are vulnerable to attacks.
Many levels of threat actors rely on iPhone jailbreaks
to deploy implants onto victims’ devices. For example,
Vortex is a potentially malicious malware family thattargets iOS users. Like Lotoor for Android, Vortex is arooter that can jailbreak iPhones that cybercriminals canuse to install malware. This technique is most common
among mid-level threat actors without the technicalcapability to launch zero-day threats. In the past quarter,
BlackBerry saw at least two different versions of Vortex
intended to jailbreak iOS devices.

Global Threat Intelligence Report

14

TITLE

INDUSTRY-SPECIFICATTACKS
While every industry is susceptible to cyberattacks, theautomotive, healthcare, and financial industries present
unique opportunities for cybercriminals.

AUTOMOTIVE
The century-old automotive industry is in the midstof a major technological revolution. Breakthroughtechnology advances are enabling the developmentof new types of vehicles, systems, and services. This
digital transformation offers many benefits but has also
introduced new cybersecurity challenges.
As vehicles become more connected and autonomous,they become potentially more vulnerable to cyberthreats
and threat actors. In addition, the increasingly complex
manufacturing systems that produce vehicles are also atrisk of cyberattacks.
In previous years, the automotive industry was relatively
unaffected by large-scale and highly publicized threats.
However, malicious entities have begun targeting not only
automobile manufacturers but the industry as a wholethrough efforts to disrupt operations, steal sensitive data,and compromise supply chains. In 2022, we observed
an increase in both the number of malicious entities
targeting the auto industry and the amount of disruptionthat they cause.
To protect against these threats, companies in theautomotive industry must recognize the potential risks
inherent in a more connected automotive future andimplement strong cybersecurity measures to protect
vehicles and drivers.

Recent Threat Trends
Because of its global scale, the automotive industry
presents an immense number of endpoints to monitor
and protect. It includes every organization in the value
chain, from companies that source raw building materials
all the way up to automotive dealerships and automobile
owners. The vast digital attack surface of this complex
supply chain must be secured to keep this important
global business operational.
Attacks between September 1 and November 30, 2022
ranged from sophisticated spearphishing to commodity
malspam, indicating that the automotive industry isconstantly under attack from both advanced and novice
cyber adversaries.

Downloaders
Malware downloaders are prevalent in almost every typeof cyberattack, and can vary in appearance, file type, andrelative sophistication of the techniques they use to entersystems. Deceptive threat actors coax unwitting victims
to install the downloader as the first part of a cyberattack.
Once the code is executed, downloaders install additional
malicious code and payloads to carry out more widereaching cyberattacks.
GuLoader is a prime example of a downloader thattargeted the automotive industry during this reporting
period. The malware was first identified in 2019 andcontinues to evolve. GuLoader often poses as legitimate
digital documents or executables before downloading
other commodity malware.

Global Threat Intelligence Report

15

TITLE
Infostealers
The automotive industry’s valuable and often proprietarydata makes the industry a prime target for cyber thieves.
This data is a commodity that can often be more valuable
than the vehicles themselves.
Malware infostealers are a type of malicious code thatseeks out and illicitly exfiltrates data from a victim’s
system that can then be used to support financial and/or tactical goals. Infostealers can be used in conjunction
with RATs like Remcos as commodity malware that isoften sold as a service for other threat actors to gain
malicious access and control of victim systems.

Ransomware
Ransomware is every security team’s nightmare, and threat
actors know that ransomware targeting industry supply
chains can be devastating. In the automotive industry, aransomware attack at any stage of the supply chain could
cease production or distribution, causing loss of revenue
and reputation throughout the industry’s ecosystems.
BlackCat ransomware was observed in some of themore notorious ransomware attacks throughout 2022.
Often preying on small- to medium-sized business, thecybercrime groups who use this particular RaaS appear
to be largely financially motivated and have largely
targeted manufacturing. BlackCat ransomware infiltrates

48%
OF CAR THEFTS WEREVEHICLES EQUIPPED WITH
KEYLESS TECHNOLOGY.

an environment, exfiltrates valuable data, and thenencrypts connected systems.
ALPVH (the threat group behind BlackCat ransomware)
frequently uses double-extortion ploys, often publicizing
compromised victims’ data via their leak site (a websitethat hosts stolen private and potentially sensitive
documents). Their goal is to pressure the targetedorganization to pay the ransom, capitalizing on the fearthat more valuable data will be published or sold tocompetitors16.

Dual-Use Tools
Dual-use applications are typically legitimate tools andsoftware that offer features or functions that threat
actors can potentially misuse or abuse. The term “living
off the land” (LotL) describes the actions of threat actors
who abuse legitimate tooling to bypass security systems
and avoid detection.
Threat actors increasingly rely on dual-use tools insteadof malicious code to propagate within an environment,
exfiltrate valuable data or even deploy malware as an“allowed” tool. System administrators should remove all
dual-use tools for which there are no valid use cases orbusiness justification.

Wider Automotive Threat LandscapeBecause of the proliferation of “smart” and Internetconnected features in modern cars and the adventof software-defined vehicles (SDVs) that receive andmanage new features through software updates,
vehicles present an increasingly enticing attack surface
for threat actors. In fact, estimates show that that there
will be as many as 775 million connected cars on theroad by 202317. The number of attempted cyberattacks
is likely to increase because adversaries know that
disruptions of any kind cannot be tolerated during
production, manufacturing, shipping, and sales.
Various types of direct attacks on vehicles haveoccurred in the last few years, and keyless-entry-enabled
vehicles have been shown to be particularly vulnerable.

Global Threat Intelligence Report

16

TITLEIn fact, data from U.K.-based insurance company LV=
General Insurance shows that 48 percent of car thefts
were vehicles equipped with keyless technology18.
Europol announced in October 2022 that it dismantled aEuropean car theft ring that targeted keyless-entry andkeyless-start vehicles, using fraudulent software to steal
vehicles without a physical key fob19. (The disclosure
occurred after the exploit was reported and patched.)
Overall, the automotive industry has suffered a nearcontinuous string of cyberattacks over the last five years,
including data breaches, ransomware, and attacks byadvanced persistent threat (APT) groups. The number of
threats spiked in 2022 and is likely to continue because of
the proliferation of embedded technology in new vehicles.

For example, in 2017, an automobile manufacturer
fell victim to WannaCry ransomware20, which forced
them to briefly halt production. In 2019, the group
APT32 (also known as OceanLotus) emerged21, whichsome sources link with providing support to Vietnam’s
automotive sector22. The same group also targeted
and compromised other automotive manufacturers’
networks23. From 2020 to 2022, the number of attacks(predominantly ransomware) increased. In 2022, notableransomware attacks affected one of Europe’s biggest car
dealerships24, a Dutch specialist vehicle manufacturer25,
and an American tire manufacturer26.
The figure below shows a timeline of a sample of larger
attacks reported within the auto industry in 2022.

LARGE AUTOMOTIVE ATTACKS 2022

Figure 5: Timeline of larger automotive attacks in 2022.

Global Threat Intelligence Report

17

TITLE
Supply-Chain Attacks
Both the pandemic and the Russian invasion of
Ukraine have revealed that supply chains are fragile.
The automotive industry is not immune to the delays,
shortages, and disruptions that other industries face.
Given the complexities of the industry, many businesses
rely on a just-in-time (JIT) supply-chain strategy tomaintain their vast ecosystems of vendors, parts, andmanufacturers, creating an extremely large attack
surface that can potentially be exploited by threat
actors. The hallmark of JIT strategy is that products
are not manufactured until they are needed. As a result,manufacturing may be slowed or stopped if needed
components and materials are not immediately available.
As a result, a cyberattack within the supply chain caneffectively halt automobile production.
Instead of directly targeting auto manufacturers, which
may be heavily fortified against intrusions, malicious
adversaries may instead attack its various vendors,
especially those with less cybersecurity. For example, inMarch 2022, compromised file systems at plastic andelectronic supplier resulted in production delays for an
estimated 13,000 vehicles at a Japanese automotive
company. According to a spokesperson quoted by
Automotive News Europe, the automotive company’s
supply chain includes 60,000 companies across four
tiers27. Cyberattacks anywhere in a supply chain of thatsize can potentially impact the ability of other companies
to receive necessary parts and materials.

Trends for the Future
As discussed above, the automotive industry’s sprawling
supply chains and business ecosystems present
attractive targets for cyberattacks. However, the industry
is taking steps to build greater security and resilience.
In 2022, the Swedish state-backed research institute
RISE announced the launch of the RISE Cyber Test
Lab for Automotive Cyber Security, which is designed
to be Europe’s most advanced hub for automotive
cybersecurity. It plans to start advanced testing in 2023.

In addition, NHTSA’s Cybersecurity Best Practices for
the Safety of Modern Vehicles, updated in 2022, strongly
recommends vehicle manufacturers and suppliers toprotect, detect, and respond to cyber risks across thewhole vehicle lifecycle28. This guidance is supported by
the global automotive cybersecurity engineering standard
ISO/SAE 21434.

HEALTHCARE
The healthcare industry is facing an increasing numberof cyberthreats as threat actors target healthcareorganizations for their highly confidential data andvaluable information. This is a significant issue forhealthcare providers, as a successful cyberattack
can have serious consequences including the loss or
publication of sensitive patient data, financial losses,
and even direct physical harm to patients. Healthcare
is particularly vulnerable to these threats due to a
combination of factors including the widespread useof medical technology with a long service life, thecomplex and often interconnected nature of healthcare
systems and the vast amounts of sensitive data thatare routinely collected and stored. It is imperative that
healthcare providers understand the dangers of thecurrent cyberthreat landscape and proactively protect
themselves and their patients from potential harm.
Overall, ransomware still poses the biggest threat tothe healthcare industry, and threat groups that rely on
ransomware are still very actively targeting it, as we
can see by the ransomware attack on CommonSpirit
Health in October, where data belonging to more than
600,000 patients was compromised29. In the past, someRaaS groups like Maze indicated they would not attack
hospitals, but such promises cannot be guaranteed. With
the diversity of multiple RaaS groups and the proliferationof affiliate models, the group that executes an attack
may not be the same group that developed the malware,
which makes tracing and attribution a concern.
According to our telemetry, Cylance Endpoint Security
solutions stopped 7,748 unique malware samples
targeting the healthcare industry during this reporting

Global Threat Intelligence Report

18

XXXXXXXXXXXX

600,000
PATIENTS’ DATA WAS COMPROMISED IN THE RANSOMWARE
ATTACK ON COMMONSPIRIT HEALTH IN OCTOBER.

period, accounting for an average of more than 80 uniquemalware samples per day. The most popular Trojan was
Qakbot, which has been used by cybercriminals sinceat least 2012 and poses a high risk to the healthcare
industry. In 2022, Qakbot was mostly used by affiliates
deploying Black Basta ransomware. Because Emotet
did not operate many campaigns after its recent fourmonth shutdown and TrickBot seems more focusedon improving its Bumblebee malware, we believe that
Qakbot continues to be the most active Trojan facilitating
healthcare network access for RaaS affiliates and IABs.
Meterpreter (a Metasploit payload that provides aninteractive shell for the attacker) and BloodHoundwere also active during this timeframe. We detected anattack that used Meterpreter alongside the executionof SharpHound, a collector for BloodHound that iscommonly used for lateral movement inside a network
after an attack takes place. The Cybersecurity andInfrastructure Security Agency (CISA) recommends that
network and system administrators intentionally execute
BloodHound themselves to understand possible attack
paths on their environments30.
We also observed TinyNuke dropping the Netwire RAT.
Originally a banking Trojan with similar functions as ZeuS,
TinyNuke is a fully featured Trojan that includes the VNC
server device controller and reverse SOCKS functionality.
TinyNuke has also been used by Kimsuky Group31 andattributed to the Democratic People’s Republic of Korea(DPRK). While examining this attack, we found TinyNuke

downloading and executing Netwire RAT and connecting
to a domain hosted on DuckDNS, which is commonlyused by RATs.
BlackBerry researchers also found an instance where an
unknown threat actor deployed the PlugX RAT, which iscommonly used by multiple nation-state threat actors
including Mustang Panda (learn more in our public
report), indicating that both cybercriminals and nationstate actors are interested in attacking the healthcare
industry. And, while we haven’t seen infostealers like
Redline and Raccoon specifically targeting healthcare,
we did encounter an instance of GuLoader, a downloader
commonly used by cybercriminals to deploy infostealers.

THE FINANCIAL INDUSTRY
The financial industry has historically been targeted bycybercriminals as well as nation-state threat actors who
reside in areas affected by financial sanctions. During
this 90-day reporting period, Cylance Endpoint Security
solutions stopped 9,721 unique malware samples
launched against targets in the financial industry, withan average of about 108 unique malicious samples
identified per day.
Different threat actors, including nation-state actors, haverelied on commercial penetration testing (pen testing)tools like Cobalt Strike and others to blur the attribution
line between cybercriminals and legitimate testing
activities. This confusion gives cybercriminals more time

Global Threat Intelligence Report

19

TITLEto operate within a network after they gain access. In
2022, we witnessed several incidents where commercial
adversary-simulating software including Cobalt Strikeand pen testing software Metasploit, Mimikatz, andBrute Ratel were used inside financial institutions.
Brute Ratel is an adversarial attack simulation tool, andattackers and security professionals both commonly
use Mimikatz to extract confidential information suchas passwords and credentials from a system’s memory.
At this time, it is not known whether the presence of
Mimikatz and Brute Ratel were part of legitimate pen
testing activities or real attacks.
Among other top threats, we stopped initial-accessinfostealers such as Redline Stealer. It is publicly known
that initial access tools are in high demand because theygain access to victims’ networks that can then be sold.
Many threat actors, including the Lapsus$ group, rely on
infostealers to gain access to enterprises. (The Lapsus$group is an international extortion-focused threat groupknown for numerous cyberattacks against companies
and government agencies.)

CYLANCE ENDPOINT SECURITY
SOLUTIONS STOPPED9,721
UNIQUE MALWARE SAMPLESLAUNCHED AGAINST TARGETS IN
THE FINANCIAL INDUSTRY.

Cylance Endpoint Security solutions have also stopped
miscellaneous attacks connected to crypto mining
and attacks on Linux ecosystems, which are attractive
targets because of the relative lack of visibility comparedto the Windows world. One example is the backdoor
Rekoobe, a Linux Trojan that has been actively targeting
victims worldwide for at least seven years32.

Global Threat Intelligence Report

20

XXXXXXXXXXXXMOST ACTIVE

THREAT

ACTORS
Our telemetry revealed the activities of many different
threat actors. Some of the attackers included in thissection were mentioned in the preceding sections
about specific types of attacks or industry sectors.

TA505
TA505 is an active and influential cybercrime group withsignificant impact in the world of financially motivatedcyberthreats. The group’s targets include education,
finance, healthcare, hospitality, and retail worldwide.
They are known for sending large volumes of malicious
email and have a wide range of malware at theirdisposal, indicating strong connections to undergroundmalware networks. Currently, the group continues to use
Locky ransomware as their primary tool for attacks, but
it has also been known to experiment with other typesof malware.
TA505’s toolset includes Cl0p ransomware, theFlawedAmmyy RAT (which was based on leaked sourcecode for a version of legitimate tool Ammyy Admin), andbanking Trojans like Dridex.

ALPHV
ALPHV is a relatively new and rapidly growing
cybercrime group that has gained attention for
innovative extortion tactics and unconventional attack
methods. Despite its relatively short history, the group

has made a significant impact in the cybercrimecommunity and is likely to continue to evolve andexpand its operations33.
ALPHV is well known for using Rust, a powerfulprogramming language that allows the threat operator
to use one code base on many different operating
systems. The group uses multiple LotL binaries, scripts,
and libraries (LOLBins) to achieve their objectives.
BlackCat RaaS is deployed as part of the final stageof ALPHV hacking campaigns after the group hascompleted lateral movements within specific hosts andcollected all the information they were seeking. ALPHV
then begins financial extortion, and has even threatened
to carry out DDoS attacks to coerce victims to pay theransom. With the release of BlackCat ransomware as a
RaaS, the hacking group has joined the rapidly growing
malware trend of double-extortion attacks that both
exfiltrate data and encrypt data for ransom.
The ALPHV group does not appear to target a specificsector or country. Because ALPHV allows other threat
actors to use BlackCat ransomware, the presence of themalware does not necessarily indicate a direct attackby ALPHV. To date, BlackCat ransomware has struck
retail, financial, manufacturing, government, technology,
education, and transportation in countries that include
the U.S., Australia, Japan, Italy, Indonesia, India, andGermany34.

Global Threat Intelligence Report

21

TITLE
APT32

MUSTANG PANDA

APT32 is believed to be based in Vietnam and has
conducted malicious cyber activities since at least 2014.
Its targets have included various private industries,
foreign governments, and individuals like dissidents andjournalists, with a particular focus on Southeast Asian
nations including Vietnam, the Philippines, Laos, andCambodia. APT32 frequently employs tactics such as
strategic web compromise to gain access to victims’
systems. This sophisticated group has also attacked
defense organizations, high-tech companies, healthcare,and manufacturing.

Mustang Panda is a China-based APT group that has
been identified as a cyber espionage threat actor. The
group was first detected in 2017 and may have been
active since 201435. Mustang Panda has targeted a wide
range of organizations including government agencies,
nonprofits, religious institutions and non-governmentalorganizations (NGOs) in countries around the world
including the U.S., Europe, Mongolia, Myanmar, Pakistan,and Vietnam.

The BlackBerry Threat Research and Intelligence teamhas analyzed multiple APT32 intrusions. The group has
used a suite of RATs dubbed Ratsnif to leverage new
network attack capabilities. We also identified the group’s
use of steganography (the technique of hiding secretdata within an ordinary, non-secret file or message) toembed a malicious payload in a PNG image.

APT29 (THE DUKES)
APT29, also known as the Dukes, are a well-funded andhighly organized group suspected of conducting cyberespionage on behalf of the Russian government since atleast 2008. The group particularly targets governments
and non-governmental organizations in North America
and Europe; however, entities across Asia, Africa, and the
Middle East have also been attacked.
The group frequently uses Cobalt Strike, Mimikatz, and
AdFind (a free command-line query tool that can be used
to gather information from Active Directory). The group
has also developed a set of custom tools that includes
CloudDuke, CozyDuke, and FatDuke, among others.
In addition, APT29 is known to exploit vulnerabilities
affecting some products to access their victims’
systems.

The group frequently uses China Chopper and PlugX
for its operations. PlugX is a modular RAT thatcan be configured to use both HTTP and DNS forcommand-and-control (C2) activities. China Chopper ismalicious software hosted on web servers that allows
unauthorized access to an organization’s network anddoes not require an infected device to communicate
with a remote C2 server.
The BlackBerry Threat Research and Intelligence teamhas also discovered recent activity in which Mustang
Panda used global interest in the Russian-Ukrainian war
to attack targets in Europe and Asia Pacific regions.

TA542
The cybercriminal group TA542 is believed to have playeda significant role in creating the Emotet malware. Thismalware was first discovered in mid-2014 and sharescertain characteristics with the Bugat (also known as
Feodo) banking Trojan, enhanced with the addition of an
RSA key exchange for C2 communication and a modular
design. TA542 does not follow the typical behavior
patterns of cybercriminal organizations and generally
carries out attacks for a short period of time, after which
they take a break for several months before returningwith a new version or variant of the malware. Targets ofTA542’s campaigns include the education, financial, retail,and healthcare industries.

Global Threat Intelligence Report

22

TITLE XXXXXXXXXXXXCOMMON MITRE TECHNIQUESThe BlackBerry Threat Research and Intelligence team utilizes multiple MITRE techniques, event analysis andtelemetry to analyze threats. Common MITRE techniques used during this reporting period are listed in the following
table. A full list of MITRE techniques used by the BlackBerry team is located in the MITRE ATT&CK® Navigator Layer.

TABLE 1: COMMON MITRE TECHNIQUES AND TACTICS
MITRE Technique

Technique ID

TacticSystem Information Discovery

T1082

Discovery

Process Injection

T1055

Defense evasion

Virtualization/Sandbox Evasion

T1497

Defense evasion

Remote System Discovery

T1018

Discovery

Masquerading

T1036

Defense evasion

Application Layer Protocol

T1071

Command-and-control

Software Packing

T1027.002

Defense evasion

Security Software Discovery

T1518.001

Discovery

Process Discovery

T1057

Discovery

Disable or Modify Tools

T1562.001

Defense evasion

Application Window Discovery

T1010

Discovery

Windows Management Instrumentation

T1047

Execution

Query Registry

T1012

Discovery

Obfuscated Files or Information

T1027

Defense evasion

Modify Registry

T1112

Defense evasion

File and Directory Discovery

T1083

Discovery

Encrypted Channel

T1573

Command-and-control

Command and Scripting Interpreter

T1059

Execution

Rundll32

T1218.011

Defense evasion

Regsvr32

T1218.010

Defense evasion

Most of the techniques listed are related to defense evasion and discovery tactics. In general, these tactics and related
techniques are uncovered during a post-mortem after an infection—use of these techniques requires knowledge ofpreviously identified intrusions. Sample behaviors associated with the five most common techniques are listed below.

Global Threat Intelligence Report

23

TITLESAMPLE BEHAVIORS OF COMMON TECHNIQUESThe following table lists the behaviors associated with the most common MITRE techniques.

TABLE 2: SAMPLE BEHAVIORS OF COMMON TECHNIQUESTechniqueBehaviors

System Information Discovery - T1082> wmic csproduct get UUID
> query user
> tasklist | findstr “dll”> systeminfo >> output> date /t

Process Injection - T1055> dllhost.exe> rundll32.exe> explorer.exe> MSBuild.exe

Virtualization/Sandbox Evasion - T1497> timeout 5000
> Start-Sleep -s 100> Check for registries of VMWare and VirtualBox

Remote System Discovery - T1018> net group /domain admins> nltest /domain_trusts /alltrusts> net view /all

Masquerading - T1036> Renaming the malware filename as a legitimatesounding filename> Use of .jpg extension for binaries> Use scheduled tasks with legitimate names like
win32times and others

Global Threat Intelligence Report

24

TITLE
MITRE D3FEND COUNTERMEASURES
Understanding common countermeasures can helporganizations improve their defensive strategies anddetermine whether adequate visibility and/or detection
techniques are in place. Countermeasures can be basedon OS events (such as process events that occur in thesystem) or file events (such as creating, modifying, ordeleting files).
A complete list of attack techniques and associatedcountermeasures is located in our GitHub repository. We
recommend choosing only countermeasures that you can fully
implement and that best meet your organization’s needs.

MOST SOUND ATTACKS
Between September 1 and November 30, 2022, theBlackBerry Threat Research and Intelligence teamtracked, uncovered, researched, and published the latest
information about the cyberthreat landscape aroundthe world. The world economy is still recovering in
the aftermath of the COVID-19 pandemic, and current
geopolitical events in Eastern Europe and East-West
relations continue to be uncertain. These factors
converge to create fertile soil for threat actors that
attempt both politically motivated and financial exploits.

FOR A COMPLETE LIST
OF ATTACK TECHNIQUESAND ASSOCIATED
COUNTERMEASURES VISIT
THE BLACKBERRY GITHUBREPOSITORY.

This quarter, we saw state-affiliated APT groups,
financially motivated ransomware gangs, and many otherthreat actors of all sizes, capabilities, and motivations
conducting multiple campaigns. Below is a selectionof some of the most consequential attacks across theglobal landscape and our own most significant finds
during the quarter.

DJVU: STRANGELY FAMILIAR RANSOMWARE
DJVU ransomware masquerades as legitimate services
or applications and is often bundled with decoy files
to appear benign. An evolution of the notorious STOP
ransomware, DJVU has seen many iterations since
its creation back in 2018. The ransomware uses
cryptography stream cipher Salsa20 for its encryption
routine. After carrying out numerous anti-analysis andGlobal Threat Intelligence Report

25

TITLEanti-sandbox checks to confirm that it’s running on areal system, the malware encrypts multiple file types
before generating a ransom note with instructions for thevictim to recover their files. The threat recently became
even more damaging when the threat actors added preencryption downloader capabilities to the ransomware.

of less commonly used languages like GoLang. Threat
actors recognize these languages’ potential to create
malware, especially bespoke ransomware. GoLang offers
particularly robust support for concurrency, which can
speed attacks by enabling multiple malicious functions to
run independently at the same time.

This quarter, DJVU downloaded and deployed infostealer
malware in apparent collaboration with the threat groups
behind Arkei variant Vidar Stealer and Redline Stealer,creating additional paths for threat actors to benefit at
victims’ expense.

BianLian is a relatively new threat that has targeted awide range of industries. The group behind the malware
appears to be purely financially motivated, and attacks
related to BianLian continued through the end of 2022.
The group appears to heavily exploit the systems andnetworks that they access. Their typical deployment
method is manual infiltration of systems to gain initialaccess, followed by abuse of LOLBins to explore the
networks and systems. After gathering this information,
they deploy their ransomware for financial gain.

MUSTANG PANDA ABUSES LEGITIMATEAPPS TO TARGET VICTIMS IN MYANMAR
In early October, we published the results of several
months of tracking the Mustang Panda APT group. Also
known as Bronze President, Red Delta, and Honeymyte,
this group is publicly attributed to China.
During our investigation, we uncovered a campaign
targeting Myanmar. The campaign impersonated popular
Myanmar news outlets and targeted multiple entities
including a government VPN portal. The infection vector
in this campaign used phishing lures with malicious
attachments that fool users into executing them, whichallows the attackers to gain a foothold on the system.
The execution chain contained several components,
including a legitimate benign utility that is susceptible to
DLL search order hijacking, plus a malicious DLL loader
and an encrypted DAT payload. After the malicious DLL
loader is sideloaded, a PlugX payload is loaded intomemory. The infection vector, execution chain, and useof PlugX and overall TTPs conform to Mustang Panda’s
tried-and-tested campaign methodology.

BIANLIAN RANSOMWARE ENCRYPTS FILESIN THE BLINK OF AN EYEUNATTRIBUTED ROMCOM THREAT ACTORSPOOFING POPULAR APPS NOW HITS
UKRAINIAN MILITARYIn October, BlackBerry uncovered the previously unknown
RomCom RAT targeting Ukrainian military institutions.
The same threat actor was known to deploy spoofed
versions of the popular Advanced IP Scanner software
before switching their efforts to PDF Filler (anotherpopular application) and may have developed these
exploits themselves.
The RomCom RAT attempts to take malicious control ofaffected devices. The initial infection vector we observed
was an email with an embedded link to a fake Ukrainianlanguage document called Наказ_309.pdf (Order_309.
pdf in English) that dropped the next-stage downloader.
During this reporting period, this threat actor wasobserved actively developing new techniques targeting
victims worldwide.

BianLian is an extremely fast-acting ransomware written
in the Go programming language (GoLang). In this white
paper, we predicted the current rise in the malicious use

Global Threat Intelligence Report

26

TITLEROMCOM THREAT ACTOR ABUSESPOPULAR SOFTWARE BRANDS TO TARGETUKRAINE AND POTENTIALLY THE UNITED
KINGDOM
After a series of attacks on Ukraine, the same group
launched new attack campaigns that took advantage
of popular software brands. The BlackBerry Threat
Research and Intelligence team uncovered thecampaigns while analyzing network artifacts identified
during our earlier research into RomCom RAT.
Our researchers found the threat actor impersonating
SolarWinds Network Performance Monitor, KeePass
Open-Source Password Manager, and PDF Reader
Pro in their campaigns. The campaigns used theselegitimate companies as fronts and designed fakewebsites that mimic the real ones to coax victims into
downloading the Remcos RAT malware. The RomComthreat actor has continued to actively deploy new
campaigns targeting victims in Ukraine, and may be
expanding to English-speaking targets worldwide in
their latest string of attacks.

THE GLOBAL RANGE OF THE
CAMPAIGNS INDICATES THAT THE
MUSTANG PANDA GROUP HAS

POWERFULRESOURCES AND CAPABILITIES.
WE DO NOT EXPECT THIS TO BE
THEIR LAST ATTACK.

ARCRYPTER RANSOMWARE EXPANDS ITSOPERATIONS FROM LATIN AMERICA TO THE
WORLD
The BlackBerry Threat Investigation team monitored
the ARCrypter ransomware family throughout 2022.
In August, an unknown variant that BlackBerry named
ARCrypter was found targeting Latin American
institutions. INVIMA (Colombia’s National Food and Drug
Surveillance Institute) was temporarily shut down in
October due to a reported cyberattack36.
Through our threat hunting efforts, BlackBerry identified
additional samples of interest for this ransomware. Given
the attack’s timeframe and the contents of the ransom
note mentioning INVIMA, we concluded with a highdegree of certainty that ARCrypter ransomware was usedin the INVIMA cyberattack. Additional research helped
uncover two sets of files: an additional malware dropperand a file encryptor.

Global Threat Intelligence Report

27

TITLEMUSTANG PANDA USES THE RUSSIANUKRAINIAN WAR TO ATTACK EUROPE AND
ASIA PACIFIC TARGETS
In December, our continuous monitoring of Mustang
Panda uncovered a campaign targeting entities acrossmultiple countries and continents.
This campaign relied on thematic lures (such as a file
titled “Political Guidance for the New EU Approach
Towards Russia.rar”) related to current geopoliticalevents. The lure contained a decoy document and LNK
file that followed the same naming convention as thelure RAR file. Additional components included legitimate
utilities that are susceptible to DLL search order hijacking,malicious DLL loaders, and DAT payloads similar tocomponents that the group has used in the past.
The goal of the execution chain is to deliver a PlugX
payload into the host system’s memory that provides full
remote access capabilities to compromised hosts.
Although the core execution chain and TTPs in thiscampaign have been seen before, these attacks
demonstrated subtle changes, including a small
alteration in execution flow so that the function
EnumSystemCodePagesW was used for shellcode
execution instead of EnumThreadWindows. This
modest modification required adjustments to defensive
awareness and countermeasures to ensure the mosteffective protection.
By pivoting off a unique domain SSL certificate, we wereable to uncover 15 additional IP addresses, five of whichwere C2 servers for the Mustang Panda group that serve
similar files conforming to the same attack chain and
TTPs to additional locations and victims.
The global range of the campaigns indicates that thegroup has powerful resources and capabilities. We do not
expect this to be their last attack.

ADDITIONAL ATTACKSEMOTET
Emotet is an elaborate and continually evolving malware
family that recently returned to the spotlight in November
2022. Attributed to the criminal entity TA542 and also
known as Heodo or Geodo, the malware has seen many
iterations since its conception in 201437.
Delivered via email, Emotet’s initial stager is often a
Trojanized Microsoft® Excel® document. It relies on
deception to persuade the victim to open the attachment
and disregard pop-up security warnings. Emotet targets
can vary widely and its lure documents masquerade asa range of topics across multiple languages and regions.
When a victim ignores warnings and allows the executionof the fake documents, the malware’s intended payload
attempts to download. After the malware is installed,
it can carry out a wide range of functions including
dropping and deploying additional malware.

CRYWIPER
In early December, details emerged about CryWiper, a
new malware wiper. CryWiper is unique because it was
specifically designed and deployed to target entities in
Russia, including courts and mayors’ offices38.
At first glance, CryWiper behaves like typical ransomware,
including removing system shadow copies to prevent
recovery of affected files; encrypting and appending the.CRY extension to affected files; and dropping a README.
txt ransom note that contains instructions for paying theransom to recover the files. However, CryWiper is not
ransomware: it’s a wiper. Like all wipers, CryWiper’s goal is tocorrupt and destroy files on the target systems so that they
are unrecoverable by any means, even if the ransom is paid.
CryWiper achieves this level of file devastation withthe use of Mersenne Vortex, a pseudo random number
generator (PRNG) algorithm that overwrites and destroys
the original contents of the files with no hope of recovery.

Global Threat Intelligence Report28CONCLUSIONS ANDFORECAST
FOR Q1 2023
The past quarter (and 2022 in general) revealed
significant cybersecurity trends that are likely tocontinue throughout 2023 and beyond. The numberof politically motivated threat actors continues
to grow, with threats including the distribution of
misinformation and disinformation through fake newssites, tracking the actions and behaviors of journalists
and dissidents, and attempted direct attacks on
government and military organizations.
Across the board, threat actors used an array of methods
that include newly identified tools and techniques as well
as modifications to existing tools that enable them tobetter evade detection. The growth of targeted attacks inthe automotive, healthcare, and financial industries casta harsh light on the critical need to protect these sectors’
expansive and vulnerable threat surfaces.
Defending your organization against malware andcyberattacks requires in-depth knowledge of how threat
actors are targeting your industry, the tools that they use,
and their possible motivations. This detailed knowledge
provides contextual, anticipative, and actionablecyberthreat intelligence that can reduce the impact of
threats on your organization.

LESSONS LEARNED / TAKEAWAYS•

In addition to financial motivation, increasing numbersof threat actors are now targeting individual andinstitutional victims based on economics, geopolitics,
and societal circumstances. Defenders must
proactively consider the possible impact of economic
and political developments on cybersecurity.
•

Threat actors are increasingly using less common
or exotic programming languages such as GoLang
and Rust to develop new malware. Threat huntersmust remain vigilant and learn how the use of novel
programming languages can manifest in attacks.
Because GoLang supports cross-platform coding, more
attacks on Linux and macOS may occur in the future.

•

Wider access to initial access tools resulted in major
incidents in 2022, as did the availability of ransomware
as a managed service to groups without sufficienttechnical skills to create their own malware. As a result,use of ransomware by nation-state threat actors grew.

•

The automotive industry was heavily impacted
by a wide variety of cyberattacks in 2022. The
compromise of large-scale manufacturers andindustry suppliers resulted in stoppages across anumber of production lines. These strings of attacks
are likely to continue into 2023.

•

Supply chain attacks that abuse legitimate apps todeliver malicious payloads can be mitigated and evenprevented by implementing zero-trust policies that
require continual authentication and authorization toaccess networks and applications.

Global Threat Intelligence Report

29

TITLE
Q1 2023 FORECAST•

To date, a key characteristic of Russia’s invasion of
Ukraine has included cyberattacks against Ukrainian
military and civilian infrastructure. If hostilities
continue, we are likely to see this pattern of targetedcyberattacks repeated.

•

Ransomware operations targeting hospitals andmedical organizations will continue, especially incountries that support or fund Ukraine.

•

Cyberattacks on critical infrastructure will continue.
AI may be increasingly used not only for attack
automation, but also to develop advanced deepfake
attacks.

•

•

•

•

Attacks on European financial institutions, like theSeptember 2022 attack on U.K.-based Revolut (apopular fintech company and app) that compromised
more than 50,000 customer records, may also
continue.
In the Americas, we predict an explosion ofcommercial mobile spyware attacks. We expectthat threat actors in Brazil will further expand
Trojan banking attacks from desktop systems tomobile devices and continue targeting victims in
Latin America. In fact, December 2022 revealed theBrasDex malware family39, which specifically targets
Brazilian banking including PIX, a payment system
similar to Zelle in the U.S.
Attacks on Linux systems may continue to fly under
the radar, especially those that virtualize systems,
drop ransomware and install backdoors on target
systems.
We expect more targeted attacks on cloudinfrastructure in every industry, as threat actors seek
to gain additional visibility into the organizations thatthey seek to undermine or extract profit.

RESOURCESThe following BlackBerry Threat Research andIntelligence resources are available.

PUBLIC INDICATORS OF COMPROMISE(IOCS)The BlackBerry Threat Research and Intelligenceteam publishes the indicators of compromise(IoCs) related to analyzed campaigns in our public
GitHub repository. All IoCs and other actionable
information mentioned in our threat reports, blogs,
and white papers (such as YARA or Sigma Rules)
can be found in the BlackBerry Threat Research &Intelligence Team Public GitHub.

PUBLIC RULES
The BlackBerry Threat Research and Intelligenceteam has authored YARA rules to identify many of
the threats discussed in this document. Our YARA
rules are publicly available here.

COMMON MITRE TECHNIQUESThe BlackBerry Threat Research and Intelligenceteam relies on multiple MITRE techniques, event
analysis and telemetry to analyze threats. A
full list of MITRE techniques is located in the
MITRE ATT&CK Navigator Layer generated by theBlackBerry team.

MITRE D3FEND COUNTERMEASURES
A complete list of attack techniques andassociated countermeasures is located in
the Blogs and Reports section of our GitHub
repository.

Global Threat Intelligence Report30

TITLE XXXXXXXXXXXXREFERENCES
1

https://www.uber.com/newsroom/security-update/242

https://www.computerworld.com/article/3604601/macsreach-23-share-in-us-enterprises-idc-confirms.html

https://www.zdnet.com/article/europes-biggestcar-dealer-hit-with-ransomware-attack/25

https://www.broshuis.com/news/ransomware-attack3

https://www.developer.com/news/90-ofthe-public-cloud-runs-on-linux/

26

https://www.reuters.com/business/autos-transportation/japansbridgestone-reports-ransomware-attack-us-subsidiary-2022-03-18/

4https://sysdig.com/blog/malware-analysis-shellbot-sysdig/

27

5https://threatpost.com/sysrv-k-botnettargets-windows-linux/179646/

https://europe.autonews.com/automakers/toyotasuspend-output-japan-after-supplier-hit-cyberattack

28

6

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22947

https://www.nhtsa.gov/press-releases/nhtsa-updatescybersecurity-best-practices-new-vehicles

7

https://yoroi.company/research/outlaw-is-back-a-newcrypto-botnet-targets-european-organizations/29

https://www.bleepingcomputer.com/news/security/commonspirithealth-ransomware-attack-exposed-data-of-623-000-patients/

8

https://sandflysecurity.com/blog/log4jkinsing-linux-malware-in-the-wild/30

https://www.cisa.gov/emergency-directive-21-02

31https://asec.ahnlab.com/en/27346/

9https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2021-44228

32

https://malpedia.caad.fkie.fraunhofer.de/details/elf.rekoobe

10

https://cyware.com/news/kinsing-operators-target-weblogicservers-and-docker-apis-for-cryptomining-5ce39d4b

33https://www.computerweekly.com/news/252525240/ALPHVBlackCat-ransomware-family-becoming-more-dangerous

11

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14882

34

12https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26134

https://www.securitymagazine.com/articles/97489blackcat-alphv-ransomware-breaches-60-organizations

13

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2725

35

https://attack.mitre.org/groups/G0129/

14

https://twitter.com/MsftSecIntel/status/1542281836742729733

36

15

https://www.statista.com/statistics/272698/global-marketshare-held-by-mobile-operating-systems-since-2009https://twitter.com/invimacolombia/
status/1577455552954712064?s=20&t=JYJsQ6PFhxBv3YHim_
PQrw

37

https://malpedia.caad.fkie.fraunhofer.de/actor/mummy_spider

38

https://www.bleepingcomputer.com/news/security/newcrywiper-data-wiper-targets-russian-courts-mayor-s-offices/39

https://thehackernews.com/2022/12/bewarecybercriminals-launch-new.html

16

https://www.reuters.com/business/autostransportation/continental-investigates-cyberattackafter-report-says-data-up-sale-2022-11-15/17https://www.juniperresearch.com/press/in-vehiclecommerce-opportunities-exceed-775mn

18

https://www.lv.com/insurance/press/keyless-technologydrives-rise-in-theft-over-past-four-years

19

https://www.europol.europa.eu/media-press/newsroom/
news/31-arrested-for-stealing-cars-hacking-keyless-tech20

https://www.bbc.com/news/uk-england-39906534

21

https://attack.mitre.org/groups/G0050/

22

https://resources.infosecinstitute.com/topic/
biggest-data-breaches-of-2019-so-far/

23

https://www.zdnet.com/article/bmw-and-hyundaihacked-by-vietnamese-hackers-report-claims/

Global Threat Intelligence Report31About BlackBerry: BlackBerry (NYSE: BB; TSX: BB) provides intelligent security softwareand services to enterprises and governments around the world. The company securesmore than 500M endpoints including over 215M vehicles. Based in Waterloo, Ontario,
the company leverages AI and machine learning to deliver innovative solutions in theareas of cybersecurity, safety and data privacy solutions, and is a leader in the areasof endpoint security, endpoint management, encryption, and embedded systems.
BlackBerry’s vision is clear - to secure a connected future you can trust.
For more information, visit BlackBerry.com and follow @BlackBerry.

©2023 BlackBerry Limited. Trademarks, including but not limited to BLACKBERRY, EMBLEM Design and
CYLANCE are the trademarks or registered trademarks of BlackBerry Limited, its subsidiaries and/or
affiliates, used under license, and the exclusive rights to such trademarks are expressly reserved. Allother trademarks are the property of their respective owners. BlackBerry is not responsible for any thirdparty products or services. This document may not be modified, reproduced, transmitted, or copied, inpart or whole, without the express written permission of BlackBerry Limited.

Disclaimer: The information contained in this report is intended for educational purposes only.
BlackBerry does not guarantee or take responsibility for the accuracy, completeness and reliability of any
third-party statements or research referenced herein. The analysis expressed in this report reflects thecurrent understanding of available information by our research analysts and may be subject to change
as additional information is made known to us. Readers are responsible for exercising their own due
diligence when applying this information to their private and professional lives. BlackBerry does notcondone any malicious use or misuse of the information presented in this report.

January 2023 Edition