QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Capturing screenshots at a configurable interval and uploading them to the attacker. Downloading and executing additional files. Executing arbitrary commands on the system.
MITRE ATT&CK techniques:
T1113
T1119
T1005
T1041
T1105
Threat description: The exploit also contains an additional check that ATMFD.dll is of the exact version “5.0.2.227”. As the Houston Disk exploit supported additional versions, we aren’t fully sure why the version range was narrowed down in DanderSpritz. Compared to ElEi, there is no indicative patch check, which may be because the DanderSpritz files are dated to mid-2013, which is prior to the patch that was identified by Kaspersky and is dated to October 2013.
MITRE ATT&CK techniques:
T1203
T1518
Threat description: APT33 registered multiple domains that masquerade as Saudi Arabian aviation companies and Western organizations that together have partnerships to provide training, maintenance and support for Saudi’s military and commercial fleet. Based on observed targeting patterns, APT33 likely used these domains in spear phishing emails to target victim organizations.
MITRE ATT&CK techniques:
T1566
T1598
T1036.005
T1583.001
T1598.003
Threat description: Another important conclusion we drew from analyzing the exploited vulnerability is that we now know for sure that EpMe exploits CVE-2017-0005. On top of our analysis of both the Equation Group and APT31 exploits, the EpMe exploit aligns perfectly with the details reported in Microsoft’s blog on CVE-2017-0005. And if that wasn’t enough, the exploit indeed stopped working after Microsoft’s March 2017 patch, the patch that addressed the said vulnerability.
MITRE ATT&CK techniques:
T1499.004
T1587.004
T1588.006
T1588.005
Threat description: DeathStalker has leveraged several malware strains and delivery chains over the years, from the Python- and VisualBasic-based Janicab to the PowerShell-based Powersing and the JavaScript-based Evilnum. The actor consistently used what we call “dead-drop resolvers” (DDRs), which is obfuscated content hosted on major public web services like YouTube, Twitter or Reddit; once decoded by malware this content reveals a command-and-control (C2) server address. DeathStalker also consistently leveraged anti-detection and antivirus evasion techniques, as well as intricate delivery chains that drop lots of files to the target’s filesystems. To kick-start an infection, DeathStalker usually relies on spear-phishing emails with attachments, or links to public file sharing services, as well as script execution based on Windows shortcuts. We have identified how DeathStalker’s malware compromises in clusters or targets various types of entities in all parts of the world, with a possible focus on law and consultancy offices, as well as FINTECH companies, but without a clearly identifiable or consistent interest. The targeting does not seem to be politically or strategically defined and doesn’t appear to be the usual financially motived crime. Because of this, we conclude that DeathStalker is a cyber-mercenary organization.
MITRE ATT&CK techniques:
T1566.003
T1598.002
T1566.002
T1204.002
T1566
T1027
T1059.005
T1204
T1102
T1059.006
T1566.001
T1204.001
T1059.001
T1059.007
T1598.003
T1059
T1588.001
T1587.001
Threat description: While investigating the activity, we found a CASHY200 PowerShell-based payload that communicated with windows64x[.]com. We analyzed this PowerShell script and found that its DNS tunneling protocol matched the outbound DNS requests at the Kuwait organization which were blocked by DNS Security. We will provide an analysis of CASHY200 and its DNS tunneling protocol in a later section of this blog.
MITRE ATT&CK techniques:
T1071.004
T1059
T1572
T1583.002
Threat description: The infection procedure lists all directories. Then, for each directory, it creates a copy of itself in the drive root directory using the same directory name and changing the directory attribute to “hidden”. This results in all the actual directories being hidden and replaced with a copy of the malware using the same directory name.
MITRE ATT&CK techniques:
T1036.005
T1083
T1036
Threat description: Aro.dat is, in fact, an encrypted and compressed PlugX payload. The decryption routine within Aro.dat closely resembles that of older PlugX variants (see Figure 3 below) in that it involves multiple decryption keys and bit shift operations. Once decrypted, it gets decompressed via the Windows API RtlDecompressBuffer into a Windows module (DLL). The compression algorithm is LZ compression (COMPRESSION_FORMAT_LZNT1).
MITRE ATT&CK techniques:
T1027.002
T1027
T1140
T1106
Threat description: The two variants of Helminth do require different delivery methods, with the script variant relying on an Excel spreadsheet for delivery, while the executable variant is more traditional in the fact that it can be installed without a delivery document. We speculate that the executable variant involves threat actors socially engineering the victim into running the payload, rather than installing the payload as the result of successful exploitation of a vulnerability. The multiple delivery methods suggest this threat group is capable of adapting their procedures to suit the current operation in the overarching campaign.
MITRE ATT&CK techniques:
T1204.001
T1204
T1204.002
Threat description: The services simply call mshta.exe to download an HTML application that downloads and runs the same cryptominer loader.
MITRE ATT&CK techniques:
T1218.005
T1105
Threat description: DeathStalker hides strings in Word embedded shape and object (OLE packages) properties, like the “hyperlink” property, to obfuscate the malicious execution workflow, as well as reconstruct and execute commands or scripts.
MITRE ATT&CK techniques:
T1027
T1140
T1036
Threat description: Some malicious documents that we managed to retrieve contained a social engineering banner asking users to enable macros execution. This explains how the malicious logic from the macro-based delivery chain could actually be triggered when macros are disabled by default on most modern Office settings.
MITRE ATT&CK techniques:
T1204
T1204.002
Threat description: In order to terminate some of these processes and services, DopplePaymer uses an interesting technique that leverages ProcessHacker, a legitimate open-source administrative utility. This application is bundled with a kernel driver that can be used to terminate processes and services. DoppelPaymer is bundled with six portable executable (PE) files that are encrypted and compressed in the malware’s sdata section. These PE files contain 32-bit and 64-bit versions of the following:
MITRE ATT&CK techniques:
T1027
T1489
T1140
T1562.001
Threat description: The main payload is encrypted and packed inside the .tls section of the second stage injector. It first gets decrypted and then unpacked with the aPLib compression library. As persistence method, the main payload copies the initial loader to the AppData folder and creates a Jscript file inside the Startup folder which points to it. The second stage injector injects the main payload inside a x86 instance of svchost and patches its API function calls with an obfuscation technique to make static and dynamic analysis of the malware more difficult.
MITRE ATT&CK techniques:
T1027.002
T1547.001
T1547.009
T1055
T1027
T1055.012
T1140
T1036
Threat description: The TwoFace loader parses the HTTP POST requests issued by the actor and references data at specific locations, more specifically at certain indexes within the posted data (C# “Request.Forms”) that the shell will use to determine the functionality the actor wishes to execute. While we did not have logs of HTTP requests for the loader shell, we were able to determine some of the indexes that the webshell will specifically access within the data. Table 2 shows the known indexes within the HTTP POST data that TwoFace references.
MITRE ATT&CK techniques:
T1071
T1105
T1071.001
Threat description: Starting in mid-December 2020, malicious actors that Mandiant tracks as UNC2546 exploited multiple zero-day vulnerabilities in Accellion’s legacy File Transfer Appliance (FTA) to install a newly discovered web shell named DEWMODE. The motivation of UNC2546 was not immediately apparent, but starting in late January 2021, several organizations that had been impacted by UNC2546 in the prior month began receiving extortion emails from actors threatening to publish stolen data on the “CL0P^_- LEAKS" .onion website.
MITRE ATT&CK techniques:
T1505.003
Threat description: We confirmed RGDoor installed correctly into IIS by checking the HTTP Modules display in IIS Manager. Figure 2 shows the RGDoor DLL (HTTPParser.dll) was loaded into IIS using the module name HTTPParser.
MITRE ATT&CK techniques:
T1036.005
T1505.004
T1036
Threat description: The end result is a legitimate, though outdated (version 11, compiled on September 17, 2018, at 10:30:12 UTC), TeamViewer instance hijacked by a malicious sideloaded DLL (MINEBRIDGE).
MITRE ATT&CK techniques:
T1588.002
T1574.002
T1219
T1055.001
T1036.005
T1036
Threat description: On April 24, 2017, a fourth IP address, this one apparently in the United States, issued 61 commands to the TwoFace webshell. Like the previous set of commands issued in March 2017 from France, this IP address issued the command to obtain objects in the Exchange Trusted Subsystem group, and it appears the actor copied over yet another webshell named “global.aspx” and set the file’s attributes to be hidden using the following command:
MITRE ATT&CK techniques:
T1564.001
T1083
T1105
Threat description: Once the decrypted payload runs in memory, it exhibits the same behaviors as previous PlugX implant variants. It starts by decrypting the embedded PlugX hardcoded configuration settings. The decryption algorithm and XOR keys are fairly consistent across multiple PlugX implants. Code behavior closely resembles that of the RedDelta PlugX that’s been reported by Insikt Group. One noticeable difference with this sample compared to all the other known PlugX malware families is the magic number check performed during the initialization of the PlugX plugins. Historically, that number has always been 0x504C5547, which corresponds to the PLUG value in ASCII encoding. In this sample, the magic number is 0x54484F52, corresponding to the THOR value in ASCII encoding.
MITRE ATT&CK techniques:
T1027
T1140
Threat description: BokBot has several executable modules that can be downloaded and injected into a svchost.exe child process. Once the relevant DAT file is decoded using RC4, no additional decoding or decompression is necessary for the executable module DAT files. The executable module header contains information necessary to ID the module:
MITRE ATT&CK techniques:
T1027
T1140
T1055.003
T1055
Threat description: The decrypted payload belongs to the malware family POISONPLUG (MD5: 84b69b5d14ba5c5c9258370c9505438f). POISONPLUG is a highly obfuscated modular backdoor with plug-in capabilities. The malware is capable of registry or service persistence, self-removal, plug-in execution, and network connection forwarding. POISONPLUG has been observed using social platforms to host encoded command and control commands.
MITRE ATT&CK techniques:
T1569.002
T1547.001
T1027
T1112
T1070.004
T1140
T1543.003
Threat description: The evolution of the reflective DLL injection technique can be found from the relevant PDB paths, and there are a lot of variants of this series of backdoors.
MITRE ATT&CK techniques:
T1055.001
T1620
T1055
Threat description: Our Ramnit sample exploits both CVE-2013-3660 (by PlayBit) and CVE-2014-4113 (using the same exploit code originally found as a 0-Day). The original exploit for CVE-2014-4113 was part of an exploit framework in which the API passes a command-line argument, and that command is executed as SYSTEM. As that wasn’t the original API for PlayBit’s exploit, some adjustments were made and PlayBit’s exploits were re-adjusted to receive a command-line argument to be executed once elevated.
MITRE ATT&CK techniques:
T1203
T1068
Threat description: In total, we observed three variations of CMSTAR in these recent attacks against Belarusian targets. The biggest change observed between them looks to be minor modifications made to the string obfuscation routine. A very simple modification to the digit used in subtraction was modified between the variants, as shown below:
MITRE ATT&CK techniques:
T1027
T1587.001
Threat description: After the execution of qnxfhfim.cmdline, PowerShell initiated the first connection to the fronted domain lumiahelptipsmscdnqa[.]microsoft[.]com used by SMOKEDHAM.
MITRE ATT&CK techniques:
T1059.001
Threat description: The lure documents captured in this attack are in Yiddish[1] The attackers exploit office with OLE autolink objects (CVE-2017-0199) to embed the documents onto malicious websites. All the exploits and malicious payload were uploaded through remote servers. [1]The language is automatically identified by Google Translate  _Notification in the pop-up window: _ Links to this document may reference other files. Do you want to update this document with the data in the linked file? Once victims opened the lure document, Word will firstly visit a remote website of IE vbscript 0day (CVE-2018-8174) to trigger the exploit. Afterwards, Shellcode will be running to send several requests to get payload from remote servers. The payload will then be decrypted for further attack. While the payload is running, Word will release three DLL backdoors locally. The backdoors will be installed and executed through PowerShell and rundll32. UAC bypass was used in this process, as well as file steganography and memory reflection uploading, in order to bypass traffic detection and to complete loading without any files. The main process of the attack is shown in the following figure:
MITRE ATT&CK techniques:
T1204.002
T1027
T1204
T1102
T1203
T1059.001
T1204.001
T1218.011
T1548.002
T1140
T1059
T1036
Threat description: The hooking of IofCallDriver is implemented in a relatively unconventional way. The hook unwinds the execution stack; if it finds any driver in the stack which is not in the rootkit’s allowlist, and that driver attempts to read certain files, a fake “reading successful” status is returned. However, the file is not actually read.
MITRE ATT&CK techniques:
T1057
T1014
T1518.001
Threat description: The execution flow of GandCrab 2 is inherited from GandCrab 1 (pictured), and can be roughly divided into three parts: housekeeping (appears in the diagram as teal), C&C Communication (green), actual encryption (yellow) and final housekeeping (teal again). This execution flow proceeds as follows:
MITRE ATT&CK techniques:
T1486
Threat description: Each target country is assigned its own operator, who is able to take advantage of local cultural features – for example, the tendency to use personal email accounts for work. They also made use of a specific proxy server within a country’s borders, to manage connections to infected computers and transfer data to the attackers’ Command-and-Control (C2) servers.
MITRE ATT&CK techniques:
T1090.002
T1090
Threat description: Throughout January 2020, FireEye has continued to observe multiple targeted phishing campaigns designed to download and deploy a backdoor we track as MINEBRIDGE. The campaigns primarily targeted financial services organizations in the United States, though targeting is likely more widespread than those we’ve initially observed in our FireEye product telemetry. At least one campaign targeted South Korean organizations, including a marketing agency.
MITRE ATT&CK techniques:
T1598.003
T1598.002
T1566.002
T1105
Threat description: Now that we have the decrypted AES key, we can decrypt the actual payload. The Flash downloader uses a custom initialization vector (IV) for the AES algorithm which can be found at offset 0x44 in the encrypted blob and is 16 bytes long:
MITRE ATT&CK techniques:
T1027
T1140
Threat description: Unlike previously identified RedDelta PlugX samples, this one uses a legitimate Avast Proxy executable for the second DLL side-loading phase rather than the legitimate Adobe executable used in previously analyzed samples. When loaded into memory, the PlugX payload uses www.systeminfor[.]com for command and control — the same domain used across the Catholic church-themed PlugX samples. Across all four newly analyzed samples, the first stage DLL loader files share an identical, uncommon import hash and rich header with previously observed first stage RedDelta PlugX DLLs. The loaded PlugX payload also matches the custom RedDelta PlugX variant previously described, using RC4 encryption for C2 communications with the same hardcoded RC4 passphrase and configuration block decoding function.
MITRE ATT&CK techniques:
T1574.002
T1573
T1027
T1104
T1036.005
T1140
T1036
Threat description: In February 2019, Unit 42 found that a yet-to-be-known threat actor — unbeknownst to the infosec community — discovered that the second unpatched vulnerability can not only exploit VirtualBox VBoxDrv.sys driver v1.6.2, but also all other versions up to v3.0.0. Furthermore, our research shows that this unknown actor exploited VirtualBox driver version 2.2.0 to target at least two different Russian organizations in 2017, which we are revealing for the first time. We anticipate this was done because the driver version 2.2.0 wasn’t known to be vulnerable and thus most likely is not on the radar of security companies being exploited. Since no other victims have been found, we believe this is a very rare malware used in targeted attacks only.
MITRE ATT&CK techniques:
T1068
T1211
T1203
T1588.006
T1588.005
Threat description: This attack consisted of maldocs masquerading as internal government or military documents. For example, some of the maldocs discovered by Talos masquerade as Indian Air Publications (IAP) documents dictating safeguard procedures for the IT infrastructure of the Indian Air Force (IAF). These documents are aptly named:
MITRE ATT&CK techniques:
T1036
Threat description: After the bootstrap is finished, the exploit triggers a call to the NtGdiBitBlt syscall. This initiates a chain of events in the Windows kernel and eventually passes the flow back to our user-mode callback (DrvBitBlt()) registered by our UMPD. Here lies the heart of the exploit.
MITRE ATT&CK techniques:
T1106
T1068
Threat description: When initiated, the Python code attempts to retrieve and use SOCKS/HTTP proxy settings from the victim’s computer. The Python code then tries to initiate a reverse connection to the C2 server (139.59.46[.]154:3543) using a TCP protocol with RSA+AES traffic encryption and obfs3 transport using default keys from Pupy sources.
MITRE ATT&CK techniques:
T1573
T1090.001
T1573.001
T1571
T1090
T1095
T1001
Threat description: To gather credentials and facilitate lateral movement, ransomware deployment, the operators used PowerShell to recursively search the file system for logon credentials stored in text files and spreadsheets. The PowerShell tool "SessionGopher", capable of extracting session information from remote access tools, such as WinSCP, PuTTY, FileZilla and more, was also used enabling RDP and the Microsoft Sysinternals utility PsExec to allow lateral movement.
MITRE ATT&CK techniques:
T1003
T1552.001
T1005
T1021
T1059.001
T1555
T1021.001
Threat description: The platform is started by the kernel mode driver component (“msndsrv.sys” on Windows 2000 or above and “mssvc32.vxd” on Windows 9x). The driver then waits for the system to start and initiates execution of the user-mode loader “mscfg32.exe”. The loader then starts the platform’s central module (an orchestrator) from the “mscfg32.dll” module. Additional drivers and libraries may be loaded by different components of the platform, either built-in or auxiliary.
MITRE ATT&CK techniques:
T1106
T1543.003
Threat description: In June of 2015 a custom downloader used by many newer samples was first seen in the wild and is often included in SFX implants with the name “LocalSMS.dll”. This downloader makes requests to adobe.update-service[.]net (hardcoded in the sample) and is further discussed in Appendix A.
MITRE ATT&CK techniques:
T1036.005
T1027.002
T1105
T1036
Threat description: Here is the script hosted on Pastebin: Reflective loader downloaded from pastebin.com The script executes a hardcoded PE file located — Gandcrab —at the end of the script using a reflective DLL-loading technique. In addition to the ransomware, we identified another actor trying to execute a Monero miner on the vulnerable server with China Chopper:
MITRE ATT&CK techniques:
T1620
T1102
Threat description: Ryuk uses a rather basic injection technique, whereby it first gets a handle on the target process using OpenProcess and allocates a buffer in its address space using VirtualAllocEx. The allocated buffer would have the size of the malware’s image and would be required to be positioned at the same base address.
MITRE ATT&CK techniques:
T1055.002
T1106
T1055
Threat description: The following figure shows the content of the downloaded shell script sh. Upon execution, the sh script downloads different architectures of DDoS bot, and runs the downloaded binaries. None of the malwares was available on Virustotal at the time of our discovery, however many of them were uploaded to Virustotal not long after. More and more attack traffic are being detected at the time of writing, indicating that many devices are probably infected already.
MITRE ATT&CK techniques:
T1059.004
T1587.001
T1059
Threat description: 2.      The “set key” handler is used for accepting the victim ID, a random string with six characters, assigned by the C&C server. It will be attached in each of commands sent from the server and will also be used as the folder name on a cloud storage service to save the stolen data. The victim ID will be stored in the “bps.key” file.
MITRE ATT&CK techniques:
T1041
T1567.002
Threat description: We observed previous, somewhat similar spearphishing scenarios with an archive containing .LNK, .docx, and base64 encoded executable code, delivering offensive Finfisher objects in separate intrusion activity clusters. This activity was not Sofacy, but the spearphishing techniques were somewhat similar – the layered powershell script attachment technique is not the same, but not altogether new.
MITRE ATT&CK techniques:
T1566.001
T1598.002
T1547.009
Threat description: Out of all the modules used in this attack, Filesystem.dll might be the only one whose code was actually written by the attackers themselves. The purpose of this module is to enumerate drives, folders and files on the infected system and write the final results to two text files: Drives.txt and Files.txt.
MITRE ATT&CK techniques:
T1083
T1074.001
Threat description: The persistence is guaranteed by a method that is called when the program is closing. It checks if the malware directory exists as specified in an embedded configuration and then copies the malware executable inside it. It also creates a registry key under “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” to execute the worm automatically.
MITRE ATT&CK techniques:
T1547
T1547.001
Threat description: Assuming the weaponized document’s macro code has executed the encoded, heavily obfuscated JScript code will be saved to disk and executed. One of the first behaviours observed is that of a fake error message box, such as the example in Figure 25. Message text varies but follows a theme of reporting something seemingly legitimate failed to run – another false sense of security for the victim.
MITRE ATT&CK techniques:
T1204.002
T1027
T1204
T1059.007
T1140
T1036
Threat description: During our analysis, we identified follow on POST requests containing screenshots of the compromised desktop and process activity lists which were encrypted and appended to a false JPEG header as described previously.
MITRE ATT&CK techniques:
T1057
T1113
T1140
T1071.001
Threat description: To enable lateral movement, the adversary uses ping and nslookup commands, in addition to scanning the environment for Windows systems listening on port 445. This is done using a simple port scanning binary unique to PROPHET SPIDER, typically named pscan or pscan2. For example, process logging may reveal similar commands to the below. Note the commands are executed by the oracle user account, which is the user that runs WebLogic. In multiple PROPHET SPIDER cases, CrowdStrike observed a reverse shell binary located at /var/tmp/[filename], which launches bash as a child; and the pscan2 command is a child to bash. The reverse shell is a child to PID 1, which indicates it was either executed via an init script created for persistence, or its parent was terminated causing it to become a zombie process that was reaped by the init daemon.
MITRE ATT&CK techniques:
T1059.004
T1021.002
T1049
T1046
T1018
T1059
Threat description: Cardinal RAT is deployed using an interesting technique of compiling and executing a downloader via a malicious macro embedded within a Microsoft Excel file. The Excel files themselves contain lures that have financial themes. This threat has had a low volume of samples in the past two years, with 11 instances of Carp Downloader and 27 instances of Cardinal RAT observed. Palo Alto Networks customers are protected by these threats in the following ways:
MITRE ATT&CK techniques:
T1204.002
T1203
T1204
T1105
Threat description: The global reach of the January 2017 campaign which we analyzed in this post is a marked departure from previous Dimnie targeting tactics. Multiple factors have contributed to Dimnie’s relatively long-lived existence. By masking upload and download network traffic as innocuous user activity, Dimnie has taken advantage of defenders’ assumptions about what normal traffic looks like. This blending in tactic, combined with a prior penchant for targeting systems used by Russian speakers, likely allowed Dimnie to remain relatively unknown.
MITRE ATT&CK techniques:
T1027
T1132
T1105
Threat description: During the execution of subsequent instructions, a call to the 0x10001D9A function is made. This function has a loop located at offset 0x10001E4D and performs several operations. One of these operations is a 1-byte XOR instruction (xor byte ptr [esi+ecx], al) located at offset 0x10001E4D. Its purpose is to decrypt a total of 110591 bytes of the executable’s resource data where the PE binary data is stored. The final result is an in-memory reconstructed executable file. In Figure 19, the encrypted and decrypted data in the process’s memory can be seen.
MITRE ATT&CK techniques:
T1140
Threat description: Agent ORM began circulating alongside Sekur in campaigns throughout the second half of 2015. The malware collects basic system information and is able to take screenshots of victim systems. It is used to download next-stage payloads when systems of interest are identified. It is strongly suspected that Agent ORM has been deprecated in favor of script-based first-stage implants (VB Flash, JS Flash, and Bateleur).
MITRE ATT&CK techniques:
T1113
T1119
T1082
T1005
T1059.005
T1059.007
T1105
Threat description: In this sense, APT3 crafted its own exploit from other exploits – a tactic very similar to one used by the Equation group. As this threat group also uses the name UPS team, we decided to name their version of the exploit bundle UPSynergy.
MITRE ATT&CK techniques:
T1587.004
T1588.005
T1068
Threat description: First, the module checks if it is running in a target process name and (if specified) by the target username. If the module or user names do not match, the thread terminates.
MITRE ATT&CK techniques:
T1057
T1033
T1087
T1480
Threat description: SMOKEDHAM was observed using UltraVNC to establish a connection to the IP address and port pair 81.91.177[.]54[:]7234 that has been observed in past UNC2465 intrusions.
MITRE ATT&CK techniques:
T1571
Threat description: The execution of the modified Mshta file resulted in the creation of a HTM file called loubSi78Vgb9[1].htm that was written to a temporary INetCache directory. Mandiant was not able to acquire this file at the time of writing; however, Mandiant was able to recover partial contents of the file.
MITRE ATT&CK techniques:
T1036.005
Threat description: But even more curious were the names of malicious drivers in this list, which if found could indicate that the target system has already been compromised by another attacker, and would then warn the operators to “pull back”. Another pivotal component in the Equation Group’s arsenal that is in charge of such checks is called “Territorial Dispute”, or “TeDi”.
MITRE ATT&CK techniques:
T1480
T1083
T1082
Threat description: In recent OilRig attacks, the threat actors purport to be legitimate service providers offering service and technical troubleshooting as a social engineering theme in their spear-phishing attacks. Earlier OilRig attacks appear to use fake job offers as a social engineering theme. The campaign appears highly targeted and delivers a backdoor we have called ‘Helminth’. Over the course of the attack campaign, we have observed two different variations of the Helminth backdoor, one written in VBScript and PowerShell that was delivered via a macro within Excel spreadsheets and the other a standalone Windows executable.
MITRE ATT&CK techniques:
T1598.002
T1566
T1566.002
T1566.001
T1598.001
T1598.003
T1036
Threat description: This attacker utilized an additional keylogging utility named C:\ProgramData\psh\console.exe. The keylogging utility was configured to capture and record keystrokes to C:\ProgramData\psh\System32Log.txt.
MITRE ATT&CK techniques:
T1056
T1056.001
T1074
T1074.001
Threat description: We observed another campaign targeting an organisation located in Lebanon. While our first case describes a targeted campaign with the goal to exfiltrate data affecting internal servers, this one is the opposite: an auxiliary public web site compromised by several attackers for different purposes. We identified actors trying to deploy ransomware on the vulnerable server using China Chopper. The first attempt was Sodinokibi ransomware:
MITRE ATT&CK techniques:
T1584.006
T1584.004
T1102
Threat description: Finally, the Phorpiex VNC worm executes several scripts on a victim’s machine by simulating keyboard input using VNC protocol. First it enters Win+R to open the “Run program” window. Then it “enters” the script contents by sending the corresponding VNC packets:
MITRE ATT&CK techniques:
T1059.003
T1059
T1021.005
Threat description: The second functionality enabled in this sample that had not been observed in previous Thanos variants involved the ability to overwrite the master boot record (MBR). Once the code checks to see if the operating system version is not “Windows 10” or “Windows 8,” the code will attempt to open “\\.\PhysicalDrive0” and write a 512-byte string to offset 0. The byte array that is written to offset 0 of “\\.\PhysicalDrive0” initially has a ransom message of “Your files are encrypted. Contact us at: get-my-data@protonmail.com…”, but the code will replace this string with the following string before writing to disk:
MITRE ATT&CK techniques:
T1561.002
T1485
T1082
Threat description: In several instances, UNC215 used the same exact file against multiple victims and frequently shared infrastructure across victims. This lack of compartmentalization is not uncommon, but does show that UNC215 is relatively less concerned about the ability for their compromises to be linked to each other. C2 servers used by UNC215 frequently reuse the same SSL certificate, as described in Team Cymru’s research in 2020. On one network, between April 2019 and April 2020, an operator repeatedly and infrequently revisited a compromised network whenever an Endpoint Detection and Response (EDR) tool detected or quarantined tools like HYPERBRO and Mimikatz. After several months of repeated detections, UNC215 deployed an updated version of HYPERBRO and a tool called “anti.exe” to stop Windows Update service and terminate EDR and Antivirus related services.
MITRE ATT&CK techniques:
T1518.001
T1102
Threat description: The embedded SWF decrypted contains ActionScript that attempts to exploit a vulnerability. The purpose of aforementioned version check is to make sure that the correct malicious ActionScript is executed to exploit a vulnerability that the Flash player is vulnerable to. Table 1 shows the range of Flash player versions within DealersChoice.A, the embedded SWF file loaded and the associated vulnerability exploited by the loaded SWF.
MITRE ATT&CK techniques:
T1203
T1068
Threat description: Since initially surfacing in August 2020, the creators of DARKSIDE ransomware and their affiliates have launched a global crime spree affecting organizations in more than 15 countries and multiple industry verticals. Like many of their peers, these actors conduct multifaceted extortion where data is both exfiltrated and encrypted in place, allowing them to demand payment for unlocking and the non-release of stolen data to exert more pressure on victims.
MITRE ATT&CK techniques:
T1041
T1020
T1486
Threat description: In March 2017, Kasperksy released a report that compared DROPSHOT (which they call Stonedrill) with the most recent variant of SHAMOON (referred to as Shamoon 2.0). They stated that both wipers employ anti-emulation techniques and were used to target organizations in Saudi Arabia, but also mentioned several differences. For example, they stated DROPSHOT uses more advanced anti-emulation techniques, utilizes external scripts for self-deletion, and uses memory injection versus external drivers for deployment. Kaspersky also noted the difference in resource language sections: SHAMOON embeds Arabic-Yemen language resources while DROPSHOT embeds Farsi (Persian) language resources.
MITRE ATT&CK techniques:
T1587.001
T1070.004
Threat description: If an encrypted command arrives from the C&C, it is decrypted using RC4. The source domain name is used as the decryption key. Once the C&C command has been executed, a [Tasks] section will be created in config.ini; this is a logall actions performed by the bot.
MITRE ATT&CK techniques:
T1573.001
T1027
T1140
T1573
Threat description: To make sure the malware is executed after reboot, Ryuk uses a straight forward persistence technique, whereby it writes itself to the Run registry key using the following command:
MITRE ATT&CK techniques:
T1547
T1547.001
T1112
Threat description: It also searches for directories with names “.Backup0D” – “.Backup0M”, and for each directory, removes contained files named “target.lnk” and “desktop.ini” and the directory itself. These directories are also created during the Gauss USB infection.
MITRE ATT&CK techniques:
T1083
Threat description: Gather all system information using the "systeminfo" command and record to a file: cmd.exe /c systeminfo >>"%s" where %s = <file_path>.
MITRE ATT&CK techniques:
T1074
T1074.001
T1059.003
T1082
T1059
Threat description: The remainder of this section focuses largely on Object Linking and Embedding (OLE) Microsoft Excel documents, as they are most commonly used by the Hangover group, at least when it comes to the BackConfig malware. Through infrastructure analysis however, Unit 42 was able to find a BackConfig PE sample (SHA256: e28f1bc0b0910757b25b2146ad02798ee6b206a5fe66ce68a28f4ab1538d6a1f; first seen 10/24/2019) using the C2 domain matissues[.]com and dropped by the weaponised Rich Text Format (RTF) file (SHA256: 752c173555edb49a2e1f18141859f22e39155f33f78ea70a3fbe9e2599af3d3f) from the same day. The RTF used the CVE-2017-11882 exploit against equation editor vulnerabilities in Office applications to execute the PE sample which was a unique exploitation method compared to all other samples analyzed.
MITRE ATT&CK techniques:
T1203
T1068
Threat description: First technique: FIN6 used PowerShell to execute an encoded command. The command consisted of a byte array containing a base64 encoded payload shown in Figure 1.
MITRE ATT&CK techniques:
T1027
T1059.001
T1140
Threat description: We first discussed ShaggyPanther, a previously unseen malware and intrusion set targeting Taiwan and Malaysia, in a private report in January 2018. Related activities date back to more than a decade ago, with similar code maintaining compilation timestamps from 2004. Since then, ShaggyPanther activity has been detected in several more locations: most recently in Indonesia in July, and – somewhat surprisingly – in Syria in March. The newer 2018 and 2019 backdoor code maintains a new layer of obfuscation and no longer maintains clear-text C2 strings. Since our original release, we have identified an initial server-side infection vector from this actor, using SinoChopper/ChinaChopper, a commonly used web shell shared by multiple Chinese-speaking actors. SinoChopper not only performs host identification and backdoor delivery but also email archive theft and additional activity. Although not all incidents can be traced back to server-side exploitation, we did detect a couple of cases and obtained information about their staged install process. In 2019, we observed ShaggyPanther targeting Windows servers.
MITRE ATT&CK techniques:
T1027
T1505.003
T1048
Threat description: USB Worm -> this is the USBWorm component developed for stealing files from removable drives, spread across systems by infecting removable media, and download and execute the “Thin Client” component from a remote Crimson server.
MITRE ATT&CK techniques:
T1570
T1025
T1005
T1091
T1105
Threat description: 8. Copy “winrestore.dll” to the directory set in step 6 or 7a with the filename “MSO1234.win” .
MITRE ATT&CK techniques:
T1036.005
T1036
Threat description: The cheat sheet is separated into several sections, based on the purpose of the example commands. Fortunately, the commands listed in the cheat sheet provides us with a great deal of insight into some of the tools and techniques the actors will possibly use after compromising the end system. The cheat sheet shows significant batch and PowerShell scripting and a preference for using RDP, as well as the following tools not provided natively in Windows (i.e. thc-hydra, Plink, Mimikatz, Powercat, ProcDump, SharpHound/BloodHound and PowerSploit). Table 1 shows the headers and a description of each section within the cheat sheet.
MITRE ATT&CK techniques:
T1219
T1082
T1059.003
T1003.001
T1057
T1021
T1059.001
T1083
T1059
Threat description: Later payloads would write batch scripts to disk as well as wget binaries. The batch scripts would use the wget binaries to download and execute additional executables. The scripts would also use wget to send POST requests to command and control (C2) servers that would contain information about the compromised system. Some of these payloads included decoy documents that would open when the malware is executed.
MITRE ATT&CK techniques:
T1041
T1082
T1059
T1105
Threat description: In this blog we show that CVE-2017-0005, a Windows Local-Privilege-Escalation (LPE) vulnerability that was attributed to a Chinese APT, was replicated based on an Equation Group exploit for the same vulnerability that the APT was able to access. “EpMe”, the Equation Group exploit for CVE-2017-0005, is one of 4 different LPE exploits included in the DanderSpritz attack framework. EpMe dates back to at least 2013 – four years before APT31 was caught exploiting this vulnerability in the wild.
MITRE ATT&CK techniques:
T1587.004
T1588.005
T1068
Threat description: This watchdog process also ensures that the Cardinal RAT process is always running, as well as ensures that the executable is located in the correct path. Should either of these conditions not be met, the watchdog process will spawn a new instance of Cardinal RAT, or write Cardinal RAT to the correct location, respectively.
MITRE ATT&CK techniques:
T1057
Threat description: Zebrocy has continued adding new tools to its arsenal using various kinds of programming languages. We found Zebrocy deploying a compiled Python script, which we call PythocyDbg, within a Southeast Asian foreign affairs organization. This module primarily provides for the stealthy collection of network proxy and communications debug capabilities. In early 2019, Zebrocy shifted its development efforts with the use of Nimrod/Nim, a programming language with syntax resembling both Pascal and Python that can be compiled down to JavaScript or C targets. Both the Nim downloaders that the group mainly uses for spear phishing, and other Nim backdoor code, are currently being produced by Zebrocy and delivered alongside updated compiled AutoIT scripts, Go, and Delphi modules. In September, Zebrocy spear-phished multiple NATO and alliance partners throughout Europe, attempting to gain access to email communications, credentials and sensitive documents. This campaign is similar to past Zebrocy activity, with target-relevant content used within emails, and ZIP attachments containing harmless documents alongside executables with altered icons and identical filenames. The group also makes use of remote Word templates pulling contents from the legitimate Dropbox file-sharing site. In this campaign, Zebrocy targeted defense and diplomatic targets located throughout Europe and Asia with its Go backdoor and Nimcy variants.
MITRE ATT&CK techniques:
T1027.009
T1027.002
T1598.002
T1119
T1204.002
T1204
T1059.006
T1566.001
T1059.007
T1587.001
T1036
Threat description: This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL, depending on the malware sample. Then the service is created for the service dll. Service names also can differ from version to version; we discovered the following names — DriverManage, WebService and WebClientManager. These functions assure malware persistence in a compromised OS between system reboots.
MITRE ATT&CK techniques:
T1569.002
T1543
T1036.005
T1036.004
T1543.003
Threat description: While investigating a recent security incident, Unit 42 found a webshell that we believe was used by the threat actor to remotely access the network of a targeted Middle Eastern organization. The construction of the webshell was interesting by itself, as it was actually two separate webshells: an initial webshell that was responsible for saving and loading the second fully functional webshell. It is this second webshell that enabled the threat actor to run a variety of commands on the compromised server. Due to these two layers, we use the name TwoFace to track this webshell.
MITRE ATT&CK techniques:
T1505.003
Threat description: Figure 6 shows our testing of the download command within RGDoor, specifically a command “download$c:\windows\temp\test.txt” that downloads the file uploaded in our previous test. We chose to use the key “89” (0x89) in this test to showcase RGDoor’s ability to use any hexadecimal byte as a key, which resulted in an encoded command string of “7eb+5+Xm6O2t6rPV/uDn7eb++tX97OT51f3s+v2n/fH9”. RGDoor responds to this command with the encoded string “/ez6/eDn7ri7uoM=”, which when decrypted with the “89” key results in the string ‘testing123\n’, which is the contents of the “test.txt” file.
MITRE ATT&CK techniques:
T1140
T1132
T1105
Threat description: The second file is downloaded from hxxp://checkin.travelsanignacio[.]com/static/20160204.jpg. The C2 response is RC5 decrypted with the key “wsprintfA” and then XORed with 0x74, before it is saved as C:\Windows\System32\wcnapi.mui.
MITRE ATT&CK techniques:
T1573
T1027
T1036.005
T1140
T1001
T1105
T1036
Threat description: One of the maldocs disclosed here was referred to by a Bit.ly-shortened URL (created Jan. 23, 2020) — hxxp://bit[.]ly/iaf-guidelines — which redirects to hxxp://tecbeck[.]com/IAP39031[.]docx. It is highly likely that the attackers hosted the maldocs on a public server and distributed the direct or Bit.ly links to the targets in the form of spear-phishing emails. This may be done to bypass detection systems that scan email attachments for malware.
MITRE ATT&CK techniques:
T1598.003
T1566.002
Threat description: The back door program used in the APT-C-06 organization's early APT operation was Lucker. It is a set of self-developed and customized modular Trojans. The set of Trojans is powerful, with keyboard recording, voice recording, screen capture, file capture and U disk operation functions, etc. The Lucker ‘s name comes from the PDB path of this type of Trojan, because most of the backdoor's function use the LK abbreviation. In the middle to late period we have discovered its evolution and two different types of backdoor programs. We have named them Retro and Collector by the PDB path extracted from the program. The Retro backdoor is an evolution of the Lucker backdoor and it actives in a series of attacks from 2016 till now. The name comes from the pdb path of this type of Trojan with the label Retro, and also has the word Retro in the initial installer.
MITRE ATT&CK techniques:
T1005
T1113
T1123
T1083
Threat description: Cisco Talos has observed a new malware campaign operated by the Kimsuky APT group since June 2021. Kimsuky, also known as Thallium and Black Banshee, is a North Korean state-sponsored advanced persistent threat (APT) group active since 2012. This campaign utilizes malicious blogs hosted on Blogspot to deliver three types of preliminary malicious content: beacons, file exfiltrators and implant deployment scripts. The implant deployment scripts, in turn, can infect the endpoint with additional implants such as system information-stealers, keyloggers and credential stealers. These implants are derivatives of the Gold Dragon/Brave Prince family of malware operated by Kimsuky since at least 2017 — now forked into three separate modules. This campaign targets South Korea-based think tanks whose research focuses on political, diplomatic and military topics pertaining to North Korea, China, Russia and the U.S.
MITRE ATT&CK techniques:
T1189
T1082
Threat description: This infection chain is based on a Windows shortcut file, with a misleading .docx.lnk double extension, and constitutes a more modular approach to PowerPepper delivery.
MITRE ATT&CK techniques:
T1204.002
T1036.007
T1036
Threat description: But these are not the only differences between the two versions: while the Filesystem.dll module was dropped by all the known variants of gpUpdates.exe, it was not always used in the same manner.
MITRE ATT&CK techniques:
T1036
Threat description: Vesta Control Panel command injection is one of the several newly included exploits. The version released on May 18 also included Python versions of EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147) exploits with a Windows download command line as the payload. The addition of new exploits shows that the actor is actively developing new methods of spreading and following the latest vulnerabilities with published PoCs. In the newest instances discovered on May 22, the bot improved its ability to supply credentials for SMB but excluded it from the main exploit function. The usernames and passwords are now in a separate two arrays and extended to include many other usernames and passwords. The exploitation function of this sample does not contain EternalBlue and EternalRomance but attempts to connect over SMB (port 445) and create a service remotely to download and run the main bot file. This latest sample is a pyinstaller-generated sample but is PE file rather than ELF, which was seen previously.
MITRE ATT&CK techniques:
T1570
T1021.002
T1068
T1210
T1203
T1021
T1059
T1543.003
Threat description: During the C2 interactions, PyMICROPSIA downloads two additional samples that are dropped and executed on the victim’s system, running additional functionality. These payloads are not Python / PyInstaller based.
MITRE ATT&CK techniques:
T1105
Threat description: There are multiple web inject files. One contains all of the target URL and hostname data, and the second contains regex patterns, as well as the code to inject. These files are both RC4-encrypted and compressed.
MITRE ATT&CK techniques:
T1027
Threat description: The path configured in the VNC configuration file across all implants employing VNC (UltraVNC.ini) is “Y:\ПРОБА\Создание троянов\создание RMS\vnc”. This isn’t the only place hardcoded Cyrillic file paths are used by implants. Many of the batch scripts also use hardcoded paths such as “Главное меню\Программы\Автозагрузка”. Many payloads also include a VBS script which raises a dialog box to the users asking them to run the malware again. It reads, “Ошибка при инициализации приложения (0xc0000005). Повторить попытку открытия файла?” (English Translation from Russian: Application failed to initialize (0xc0000005). Try to open the file again?).
MITRE ATT&CK techniques:
T1059.003
T1059