QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Capturing screenshots at a configurable interval and uploading them to the attacker. Downloading and executing additional files. Executing arbitrary commands on the system.
MITRE ATT&CK techniques:
T1113
T1119
T1105
T1041
T1005
Threat description: The exploit also contains an additional check that ATMFD.dll is of the exact version “5.0.2.227”. As the Houston Disk exploit supported additional versions, we aren’t fully sure why the version range was narrowed down in DanderSpritz. Compared to ElEi, there is no indicative patch check, which may be because the DanderSpritz files are dated to mid-2013, which is prior to the patch that was identified by Kaspersky and is dated to October 2013.
MITRE ATT&CK techniques:
T1518
T1203
Threat description: APT33 registered multiple domains that masquerade as Saudi Arabian aviation companies and Western organizations that together have partnerships to provide training, maintenance and support for Saudi’s military and commercial fleet. Based on observed targeting patterns, APT33 likely used these domains in spear phishing emails to target victim organizations.
MITRE ATT&CK techniques:
T1583.001
T1598
T1566
T1036.005
T1598.003
Threat description: Another important conclusion we drew from analyzing the exploited vulnerability is that we now know for sure that EpMe exploits CVE-2017-0005. On top of our analysis of both the Equation Group and APT31 exploits, the EpMe exploit aligns perfectly with the details reported in Microsoft’s blog on CVE-2017-0005. And if that wasn’t enough, the exploit indeed stopped working after Microsoft’s March 2017 patch, the patch that addressed the said vulnerability.
MITRE ATT&CK techniques:
T1587.004
T1499.004
T1588.006
T1588.005
Threat description: DeathStalker has leveraged several malware strains and delivery chains over the years, from the Python- and VisualBasic-based Janicab to the PowerShell-based Powersing and the JavaScript-based Evilnum. The actor consistently used what we call “dead-drop resolvers” (DDRs), which is obfuscated content hosted on major public web services like YouTube, Twitter or Reddit; once decoded by malware this content reveals a command-and-control (C2) server address. DeathStalker also consistently leveraged anti-detection and antivirus evasion techniques, as well as intricate delivery chains that drop lots of files to the target’s filesystems. To kick-start an infection, DeathStalker usually relies on spear-phishing emails with attachments, or links to public file sharing services, as well as script execution based on Windows shortcuts. We have identified how DeathStalker’s malware compromises in clusters or targets various types of entities in all parts of the world, with a possible focus on law and consultancy offices, as well as FINTECH companies, but without a clearly identifiable or consistent interest. The targeting does not seem to be politically or strategically defined and doesn’t appear to be the usual financially motived crime. Because of this, we conclude that DeathStalker is a cyber-mercenary organization.
MITRE ATT&CK techniques:
T1102
T1059.007
T1059
T1204
T1059.006
T1059.001
T1204.002
T1566.001
T1566.002
T1598.002
T1566
T1587.001
T1027
T1566.003
T1588.001
T1059.005
T1204.001
T1598.003
Threat description: While investigating the activity, we found a CASHY200 PowerShell-based payload that communicated with windows64x[.]com. We analyzed this PowerShell script and found that its DNS tunneling protocol matched the outbound DNS requests at the Kuwait organization which were blocked by DNS Security. We will provide an analysis of CASHY200 and its DNS tunneling protocol in a later section of this blog.
MITRE ATT&CK techniques:
T1572
T1059
T1071.004
T1583.002
Threat description: The infection procedure lists all directories. Then, for each directory, it creates a copy of itself in the drive root directory using the same directory name and changing the directory attribute to “hidden”. This results in all the actual directories being hidden and replaced with a copy of the malware using the same directory name.
MITRE ATT&CK techniques:
T1036
T1036.005
T1083
Threat description: Aro.dat is, in fact, an encrypted and compressed PlugX payload. The decryption routine within Aro.dat closely resembles that of older PlugX variants (see Figure 3 below) in that it involves multiple decryption keys and bit shift operations. Once decrypted, it gets decompressed via the Windows API RtlDecompressBuffer into a Windows module (DLL). The compression algorithm is LZ compression (COMPRESSION_FORMAT_LZNT1).
MITRE ATT&CK techniques:
T1027
T1106
T1140
T1027.002
Threat description: The two variants of Helminth do require different delivery methods, with the script variant relying on an Excel spreadsheet for delivery, while the executable variant is more traditional in the fact that it can be installed without a delivery document. We speculate that the executable variant involves threat actors socially engineering the victim into running the payload, rather than installing the payload as the result of successful exploitation of a vulnerability. The multiple delivery methods suggest this threat group is capable of adapting their procedures to suit the current operation in the overarching campaign.
MITRE ATT&CK techniques:
T1204
T1204.001
T1204.002
Threat description: DeathStalker hides strings in Word embedded shape and object (OLE packages) properties, like the “hyperlink” property, to obfuscate the malicious execution workflow, as well as reconstruct and execute commands or scripts.
MITRE ATT&CK techniques:
T1036
T1027
T1140
Threat description: In order to terminate some of these processes and services, DopplePaymer uses an interesting technique that leverages ProcessHacker, a legitimate open-source administrative utility. This application is bundled with a kernel driver that can be used to terminate processes and services. DoppelPaymer is bundled with six portable executable (PE) files that are encrypted and compressed in the malware’s sdata section. These PE files contain 32-bit and 64-bit versions of the following:
MITRE ATT&CK techniques:
T1027
T1562.001
T1489
T1140
Threat description: The main payload is encrypted and packed inside the .tls section of the second stage injector. It first gets decrypted and then unpacked with the aPLib compression library. As persistence method, the main payload copies the initial loader to the AppData folder and creates a Jscript file inside the Startup folder which points to it. The second stage injector injects the main payload inside a x86 instance of svchost and patches its API function calls with an obfuscation technique to make static and dynamic analysis of the malware more difficult.
MITRE ATT&CK techniques:
T1055.012
T1547.009
T1547.001
T1055
T1140
T1036
T1027
T1027.002
Threat description: The TwoFace loader parses the HTTP POST requests issued by the actor and references data at specific locations, more specifically at certain indexes within the posted data (C# “Request.Forms”) that the shell will use to determine the functionality the actor wishes to execute. While we did not have logs of HTTP requests for the loader shell, we were able to determine some of the indexes that the webshell will specifically access within the data. Table 2 shows the known indexes within the HTTP POST data that TwoFace references.
MITRE ATT&CK techniques:
T1105
T1071.001
T1071
Threat description: We confirmed RGDoor installed correctly into IIS by checking the HTTP Modules display in IIS Manager. Figure 2 shows the RGDoor DLL (HTTPParser.dll) was loaded into IIS using the module name HTTPParser.
MITRE ATT&CK techniques:
T1036
T1505.004
T1036.005
Threat description: The end result is a legitimate, though outdated (version 11, compiled on September 17, 2018, at 10:30:12 UTC), TeamViewer instance hijacked by a malicious sideloaded DLL (MINEBRIDGE).
MITRE ATT&CK techniques:
T1055.001
T1588.002
T1036.005
T1574.002
T1036
T1219
Threat description: On April 24, 2017, a fourth IP address, this one apparently in the United States, issued 61 commands to the TwoFace webshell. Like the previous set of commands issued in March 2017 from France, this IP address issued the command to obtain objects in the Exchange Trusted Subsystem group, and it appears the actor copied over yet another webshell named “global.aspx” and set the file’s attributes to be hidden using the following command:
MITRE ATT&CK techniques:
T1105
T1083
T1564.001
Threat description: The decrypted payload belongs to the malware family POISONPLUG (MD5: 84b69b5d14ba5c5c9258370c9505438f). POISONPLUG is a highly obfuscated modular backdoor with plug-in capabilities. The malware is capable of registry or service persistence, self-removal, plug-in execution, and network connection forwarding. POISONPLUG has been observed using social platforms to host encoded command and control commands.
MITRE ATT&CK techniques:
T1543.003
T1569.002
T1112
T1547.001
T1140
T1027
T1070.004
Threat description: The evolution of the reflective DLL injection technique can be found from the relevant PDB paths, and there are a lot of variants of this series of backdoors.
MITRE ATT&CK techniques:
T1620
T1055.001
T1055
Threat description: In total, we observed three variations of CMSTAR in these recent attacks against Belarusian targets. The biggest change observed between them looks to be minor modifications made to the string obfuscation routine. A very simple modification to the digit used in subtraction was modified between the variants, as shown below:
MITRE ATT&CK techniques:
T1587.001
T1027
Threat description: The lure documents captured in this attack are in Yiddish[1] The attackers exploit office with OLE autolink objects (CVE-2017-0199) to embed the documents onto malicious websites. All the exploits and malicious payload were uploaded through remote servers. [1]The language is automatically identified by Google Translate  _Notification in the pop-up window: _ Links to this document may reference other files. Do you want to update this document with the data in the linked file? Once victims opened the lure document, Word will firstly visit a remote website of IE vbscript 0day (CVE-2018-8174) to trigger the exploit. Afterwards, Shellcode will be running to send several requests to get payload from remote servers. The payload will then be decrypted for further attack. While the payload is running, Word will release three DLL backdoors locally. The backdoors will be installed and executed through PowerShell and rundll32. UAC bypass was used in this process, as well as file steganography and memory reflection uploading, in order to bypass traffic detection and to complete loading without any files. The main process of the attack is shown in the following figure:
MITRE ATT&CK techniques:
T1102
T1218.011
T1059
T1204
T1203
T1548.002
T1204.002
T1140
T1036
T1027
T1204.001
T1059.001
Threat description: The hooking of IofCallDriver is implemented in a relatively unconventional way. The hook unwinds the execution stack; if it finds any driver in the stack which is not in the rootkit’s allowlist, and that driver attempts to read certain files, a fake “reading successful” status is returned. However, the file is not actually read.
MITRE ATT&CK techniques:
T1518.001
T1057
T1014
Threat description: Each target country is assigned its own operator, who is able to take advantage of local cultural features – for example, the tendency to use personal email accounts for work. They also made use of a specific proxy server within a country’s borders, to manage connections to infected computers and transfer data to the attackers’ Command-and-Control (C2) servers.
MITRE ATT&CK techniques:
T1090
T1090.002
Threat description: Throughout January 2020, FireEye has continued to observe multiple targeted phishing campaigns designed to download and deploy a backdoor we track as MINEBRIDGE. The campaigns primarily targeted financial services organizations in the United States, though targeting is likely more widespread than those we’ve initially observed in our FireEye product telemetry. At least one campaign targeted South Korean organizations, including a marketing agency.
MITRE ATT&CK techniques:
T1105
T1566.002
T1598.002
T1598.003
Threat description: Unlike previously identified RedDelta PlugX samples, this one uses a legitimate Avast Proxy executable for the second DLL side-loading phase rather than the legitimate Adobe executable used in previously analyzed samples. When loaded into memory, the PlugX payload uses www.systeminfor[.]com for command and control — the same domain used across the Catholic church-themed PlugX samples. Across all four newly analyzed samples, the first stage DLL loader files share an identical, uncommon import hash and rich header with previously observed first stage RedDelta PlugX DLLs. The loaded PlugX payload also matches the custom RedDelta PlugX variant previously described, using RC4 encryption for C2 communications with the same hardcoded RC4 passphrase and configuration block decoding function.
MITRE ATT&CK techniques:
T1104
T1574.002
T1140
T1036
T1027
T1036.005
T1573
Threat description: In February 2019, Unit 42 found that a yet-to-be-known threat actor — unbeknownst to the infosec community — discovered that the second unpatched vulnerability can not only exploit VirtualBox VBoxDrv.sys driver v1.6.2, but also all other versions up to v3.0.0. Furthermore, our research shows that this unknown actor exploited VirtualBox driver version 2.2.0 to target at least two different Russian organizations in 2017, which we are revealing for the first time. We anticipate this was done because the driver version 2.2.0 wasn’t known to be vulnerable and thus most likely is not on the radar of security companies being exploited. Since no other victims have been found, we believe this is a very rare malware used in targeted attacks only.
MITRE ATT&CK techniques:
T1588.006
T1068
T1588.005
T1211
T1203
Threat description: When initiated, the Python code attempts to retrieve and use SOCKS/HTTP proxy settings from the victim’s computer. The Python code then tries to initiate a reverse connection to the C2 server (139.59.46[.]154:3543) using a TCP protocol with RSA+AES traffic encryption and obfs3 transport using default keys from Pupy sources.
MITRE ATT&CK techniques:
T1001
T1573.001
T1090
T1571
T1090.001
T1095
T1573
Threat description: To gather credentials and facilitate lateral movement, ransomware deployment, the operators used PowerShell to recursively search the file system for logon credentials stored in text files and spreadsheets. The PowerShell tool "SessionGopher", capable of extracting session information from remote access tools, such as WinSCP, PuTTY, FileZilla and more, was also used enabling RDP and the Microsoft Sysinternals utility PsExec to allow lateral movement.
MITRE ATT&CK techniques:
T1003
T1021.001
T1021
T1555
T1552.001
T1005
T1059.001
Threat description: The platform is started by the kernel mode driver component (“msndsrv.sys” on Windows 2000 or above and “mssvc32.vxd” on Windows 9x). The driver then waits for the system to start and initiates execution of the user-mode loader “mscfg32.exe”. The loader then starts the platform’s central module (an orchestrator) from the “mscfg32.dll” module. Additional drivers and libraries may be loaded by different components of the platform, either built-in or auxiliary.
MITRE ATT&CK techniques:
T1543.003
T1106
Threat description: In June of 2015 a custom downloader used by many newer samples was first seen in the wild and is often included in SFX implants with the name “LocalSMS.dll”. This downloader makes requests to adobe.update-service[.]net (hardcoded in the sample) and is further discussed in Appendix A.
MITRE ATT&CK techniques:
T1036
T1105
T1036.005
T1027.002
Threat description: Here is the script hosted on Pastebin: Reflective loader downloaded from pastebin.com The script executes a hardcoded PE file located — Gandcrab —at the end of the script using a reflective DLL-loading technique. In addition to the ransomware, we identified another actor trying to execute a Monero miner on the vulnerable server with China Chopper:
MITRE ATT&CK techniques:
T1102
T1620
Threat description: The following figure shows the content of the downloaded shell script sh. Upon execution, the sh script downloads different architectures of DDoS bot, and runs the downloaded binaries. None of the malwares was available on Virustotal at the time of our discovery, however many of them were uploaded to Virustotal not long after. More and more attack traffic are being detected at the time of writing, indicating that many devices are probably infected already.
MITRE ATT&CK techniques:
T1587.001
T1059
T1059.004
Threat description: Out of all the modules used in this attack, Filesystem.dll might be the only one whose code was actually written by the attackers themselves. The purpose of this module is to enumerate drives, folders and files on the infected system and write the final results to two text files: Drives.txt and Files.txt.
MITRE ATT&CK techniques:
T1074.001
T1083
Threat description: Assuming the weaponized document’s macro code has executed the encoded, heavily obfuscated JScript code will be saved to disk and executed. One of the first behaviours observed is that of a fake error message box, such as the example in Figure 25. Message text varies but follows a theme of reporting something seemingly legitimate failed to run – another false sense of security for the victim.
MITRE ATT&CK techniques:
T1059.007
T1204
T1204.002
T1140
T1036
T1027
Threat description: During our analysis, we identified follow on POST requests containing screenshots of the compromised desktop and process activity lists which were encrypted and appended to a false JPEG header as described previously.
MITRE ATT&CK techniques:
T1057
T1071.001
T1113
T1140
Threat description: To enable lateral movement, the adversary uses ping and nslookup commands, in addition to scanning the environment for Windows systems listening on port 445. This is done using a simple port scanning binary unique to PROPHET SPIDER, typically named pscan or pscan2. For example, process logging may reveal similar commands to the below. Note the commands are executed by the oracle user account, which is the user that runs WebLogic. In multiple PROPHET SPIDER cases, CrowdStrike observed a reverse shell binary located at /var/tmp/[filename], which launches bash as a child; and the pscan2 command is a child to bash. The reverse shell is a child to PID 1, which indicates it was either executed via an init script created for persistence, or its parent was terminated causing it to become a zombie process that was reaped by the init daemon.
MITRE ATT&CK techniques:
T1049
T1059
T1059.004
T1018
T1046
T1021.002
Threat description: Cardinal RAT is deployed using an interesting technique of compiling and executing a downloader via a malicious macro embedded within a Microsoft Excel file. The Excel files themselves contain lures that have financial themes. This threat has had a low volume of samples in the past two years, with 11 instances of Carp Downloader and 27 instances of Cardinal RAT observed. Palo Alto Networks customers are protected by these threats in the following ways:
MITRE ATT&CK techniques:
T1105
T1204
T1203
T1204.002
Threat description: The global reach of the January 2017 campaign which we analyzed in this post is a marked departure from previous Dimnie targeting tactics. Multiple factors have contributed to Dimnie’s relatively long-lived existence. By masking upload and download network traffic as innocuous user activity, Dimnie has taken advantage of defenders’ assumptions about what normal traffic looks like. This blending in tactic, combined with a prior penchant for targeting systems used by Russian speakers, likely allowed Dimnie to remain relatively unknown.
MITRE ATT&CK techniques:
T1105
T1132
T1027
Threat description: Agent ORM began circulating alongside Sekur in campaigns throughout the second half of 2015. The malware collects basic system information and is able to take screenshots of victim systems. It is used to download next-stage payloads when systems of interest are identified. It is strongly suspected that Agent ORM has been deprecated in favor of script-based first-stage implants (VB Flash, JS Flash, and Bateleur).
MITRE ATT&CK techniques:
T1113
T1059.007
T1119
T1082
T1105
T1059.005
T1005
Threat description: In this sense, APT3 crafted its own exploit from other exploits – a tactic very similar to one used by the Equation group. As this threat group also uses the name UPS team, we decided to name their version of the exploit bundle UPSynergy.
MITRE ATT&CK techniques:
T1587.004
T1068
T1588.005
Threat description: First, the module checks if it is running in a target process name and (if specified) by the target username. If the module or user names do not match, the thread terminates.
MITRE ATT&CK techniques:
T1480
T1033
T1057
T1087
Threat description: But even more curious were the names of malicious drivers in this list, which if found could indicate that the target system has already been compromised by another attacker, and would then warn the operators to “pull back”. Another pivotal component in the Equation Group’s arsenal that is in charge of such checks is called “Territorial Dispute”, or “TeDi”.
MITRE ATT&CK techniques:
T1082
T1480
T1083
Threat description: In recent OilRig attacks, the threat actors purport to be legitimate service providers offering service and technical troubleshooting as a social engineering theme in their spear-phishing attacks. Earlier OilRig attacks appear to use fake job offers as a social engineering theme. The campaign appears highly targeted and delivers a backdoor we have called ‘Helminth’. Over the course of the attack campaign, we have observed two different variations of the Helminth backdoor, one written in VBScript and PowerShell that was delivered via a macro within Excel spreadsheets and the other a standalone Windows executable.
MITRE ATT&CK techniques:
T1598.001
T1566.001
T1566.002
T1598.002
T1566
T1036
T1598.003
Threat description: This attacker utilized an additional keylogging utility named C:\ProgramData\psh\console.exe. The keylogging utility was configured to capture and record keystrokes to C:\ProgramData\psh\System32Log.txt.
MITRE ATT&CK techniques:
T1056.001
T1056
T1074
T1074.001
Threat description: We observed another campaign targeting an organisation located in Lebanon. While our first case describes a targeted campaign with the goal to exfiltrate data affecting internal servers, this one is the opposite: an auxiliary public web site compromised by several attackers for different purposes. We identified actors trying to deploy ransomware on the vulnerable server using China Chopper. The first attempt was Sodinokibi ransomware:
MITRE ATT&CK techniques:
T1102
T1584.006
T1584.004
Threat description: Finally, the Phorpiex VNC worm executes several scripts on a victim’s machine by simulating keyboard input using VNC protocol. First it enters Win+R to open the “Run program” window. Then it “enters” the script contents by sending the corresponding VNC packets:
MITRE ATT&CK techniques:
T1059
T1059.003
T1021.005
Threat description: Since initially surfacing in August 2020, the creators of DARKSIDE ransomware and their affiliates have launched a global crime spree affecting organizations in more than 15 countries and multiple industry verticals. Like many of their peers, these actors conduct multifaceted extortion where data is both exfiltrated and encrypted in place, allowing them to demand payment for unlocking and the non-release of stolen data to exert more pressure on victims.
MITRE ATT&CK techniques:
T1041
T1486
T1020
Threat description: If an encrypted command arrives from the C&C, it is decrypted using RC4. The source domain name is used as the decryption key. Once the C&C command has been executed, a [Tasks] section will be created in config.ini; this is a logall actions performed by the bot.
MITRE ATT&CK techniques:
T1027
T1573.001
T1140
T1573
Threat description: Gather all system information using the "systeminfo" command and record to a file: cmd.exe /c systeminfo >>"%s" where %s = <file_path>.
MITRE ATT&CK techniques:
T1074.001
T1059
T1082
T1059.003
T1074
Threat description: First technique: FIN6 used PowerShell to execute an encoded command. The command consisted of a byte array containing a base64 encoded payload shown in Figure 1.
MITRE ATT&CK techniques:
T1027
T1140
T1059.001
Threat description: We first discussed ShaggyPanther, a previously unseen malware and intrusion set targeting Taiwan and Malaysia, in a private report in January 2018. Related activities date back to more than a decade ago, with similar code maintaining compilation timestamps from 2004. Since then, ShaggyPanther activity has been detected in several more locations: most recently in Indonesia in July, and – somewhat surprisingly – in Syria in March. The newer 2018 and 2019 backdoor code maintains a new layer of obfuscation and no longer maintains clear-text C2 strings. Since our original release, we have identified an initial server-side infection vector from this actor, using SinoChopper/ChinaChopper, a commonly used web shell shared by multiple Chinese-speaking actors. SinoChopper not only performs host identification and backdoor delivery but also email archive theft and additional activity. Although not all incidents can be traced back to server-side exploitation, we did detect a couple of cases and obtained information about their staged install process. In 2019, we observed ShaggyPanther targeting Windows servers.
MITRE ATT&CK techniques:
T1027
T1048
T1505.003
Threat description: USB Worm -> this is the USBWorm component developed for stealing files from removable drives, spread across systems by infecting removable media, and download and execute the “Thin Client” component from a remote Crimson server.
MITRE ATT&CK techniques:
T1025
T1105
T1091
T1570
T1005
Threat description: 8. Copy “winrestore.dll” to the directory set in step 6 or 7a with the filename “MSO1234.win” .
MITRE ATT&CK techniques:
T1036
T1036.005
Threat description: The cheat sheet is separated into several sections, based on the purpose of the example commands. Fortunately, the commands listed in the cheat sheet provides us with a great deal of insight into some of the tools and techniques the actors will possibly use after compromising the end system. The cheat sheet shows significant batch and PowerShell scripting and a preference for using RDP, as well as the following tools not provided natively in Windows (i.e. thc-hydra, Plink, Mimikatz, Powercat, ProcDump, SharpHound/BloodHound and PowerSploit). Table 1 shows the headers and a description of each section within the cheat sheet.
MITRE ATT&CK techniques:
T1003.001
T1059
T1082
T1059.003
T1057
T1021
T1219
T1083
T1059.001
Threat description: Later payloads would write batch scripts to disk as well as wget binaries. The batch scripts would use the wget binaries to download and execute additional executables. The scripts would also use wget to send POST requests to command and control (C2) servers that would contain information about the compromised system. Some of these payloads included decoy documents that would open when the malware is executed.
MITRE ATT&CK techniques:
T1105
T1059
T1041
T1082
Threat description: In this blog we show that CVE-2017-0005, a Windows Local-Privilege-Escalation (LPE) vulnerability that was attributed to a Chinese APT, was replicated based on an Equation Group exploit for the same vulnerability that the APT was able to access. “EpMe”, the Equation Group exploit for CVE-2017-0005, is one of 4 different LPE exploits included in the DanderSpritz attack framework. EpMe dates back to at least 2013 – four years before APT31 was caught exploiting this vulnerability in the wild.
MITRE ATT&CK techniques:
T1587.004
T1068
T1588.005
Threat description: Zebrocy has continued adding new tools to its arsenal using various kinds of programming languages. We found Zebrocy deploying a compiled Python script, which we call PythocyDbg, within a Southeast Asian foreign affairs organization. This module primarily provides for the stealthy collection of network proxy and communications debug capabilities. In early 2019, Zebrocy shifted its development efforts with the use of Nimrod/Nim, a programming language with syntax resembling both Pascal and Python that can be compiled down to JavaScript or C targets. Both the Nim downloaders that the group mainly uses for spear phishing, and other Nim backdoor code, are currently being produced by Zebrocy and delivered alongside updated compiled AutoIT scripts, Go, and Delphi modules. In September, Zebrocy spear-phished multiple NATO and alliance partners throughout Europe, attempting to gain access to email communications, credentials and sensitive documents. This campaign is similar to past Zebrocy activity, with target-relevant content used within emails, and ZIP attachments containing harmless documents alongside executables with altered icons and identical filenames. The group also makes use of remote Word templates pulling contents from the legitimate Dropbox file-sharing site. In this campaign, Zebrocy targeted defense and diplomatic targets located throughout Europe and Asia with its Go backdoor and Nimcy variants.
MITRE ATT&CK techniques:
T1059.007
T1119
T1204
T1059.006
T1027.009
T1204.002
T1566.001
T1598.002
T1587.001
T1027.002
T1036
Threat description: This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL, depending on the malware sample. Then the service is created for the service dll. Service names also can differ from version to version; we discovered the following names — DriverManage, WebService and WebClientManager. These functions assure malware persistence in a compromised OS between system reboots.
MITRE ATT&CK techniques:
T1543
T1036.004
T1543.003
T1569.002
T1036.005
Threat description: Figure 6 shows our testing of the download command within RGDoor, specifically a command “download$c:\windows\temp\test.txt” that downloads the file uploaded in our previous test. We chose to use the key “89” (0x89) in this test to showcase RGDoor’s ability to use any hexadecimal byte as a key, which resulted in an encoded command string of “7eb+5+Xm6O2t6rPV/uDn7eb++tX97OT51f3s+v2n/fH9”. RGDoor responds to this command with the encoded string “/ez6/eDn7ri7uoM=”, which when decrypted with the “89” key results in the string ‘testing123\n’, which is the contents of the “test.txt” file.
MITRE ATT&CK techniques:
T1105
T1132
T1140
Threat description: The second file is downloaded from hxxp://checkin.travelsanignacio[.]com/static/20160204.jpg. The C2 response is RC5 decrypted with the key “wsprintfA” and then XORed with 0x74, before it is saved as C:\Windows\System32\wcnapi.mui.
MITRE ATT&CK techniques:
T1001
T1105
T1140
T1036
T1027
T1036.005
T1573
Threat description: One of the maldocs disclosed here was referred to by a Bit.ly-shortened URL (created Jan. 23, 2020) — hxxp://bit[.]ly/iaf-guidelines — which redirects to hxxp://tecbeck[.]com/IAP39031[.]docx. It is highly likely that the attackers hosted the maldocs on a public server and distributed the direct or Bit.ly links to the targets in the form of spear-phishing emails. This may be done to bypass detection systems that scan email attachments for malware.
MITRE ATT&CK techniques:
T1566.002
T1598.003
Threat description: The back door program used in the APT-C-06 organization's early APT operation was Lucker. It is a set of self-developed and customized modular Trojans. The set of Trojans is powerful, with keyboard recording, voice recording, screen capture, file capture and U disk operation functions, etc. The Lucker ‘s name comes from the PDB path of this type of Trojan, because most of the backdoor's function use the LK abbreviation. In the middle to late period we have discovered its evolution and two different types of backdoor programs. We have named them Retro and Collector by the PDB path extracted from the program. The Retro backdoor is an evolution of the Lucker backdoor and it actives in a series of attacks from 2016 till now. The name comes from the pdb path of this type of Trojan with the label Retro, and also has the word Retro in the initial installer.
MITRE ATT&CK techniques:
T1113
T1005
T1083
T1123
Threat description: This infection chain is based on a Windows shortcut file, with a misleading .docx.lnk double extension, and constitutes a more modular approach to PowerPepper delivery.
MITRE ATT&CK techniques:
T1036
T1036.007
T1204.002
Threat description: Vesta Control Panel command injection is one of the several newly included exploits. The version released on May 18 also included Python versions of EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147) exploits with a Windows download command line as the payload. The addition of new exploits shows that the actor is actively developing new methods of spreading and following the latest vulnerabilities with published PoCs. In the newest instances discovered on May 22, the bot improved its ability to supply credentials for SMB but excluded it from the main exploit function. The usernames and passwords are now in a separate two arrays and extended to include many other usernames and passwords. The exploitation function of this sample does not contain EternalBlue and EternalRomance but attempts to connect over SMB (port 445) and create a service remotely to download and run the main bot file. This latest sample is a pyinstaller-generated sample but is PE file rather than ELF, which was seen previously.
MITRE ATT&CK techniques:
T1543.003
T1068
T1059
T1203
T1210
T1021
T1570
T1021.002
Threat description: The path configured in the VNC configuration file across all implants employing VNC (UltraVNC.ini) is “Y:\ПРОБА\Создание троянов\создание RMS\vnc”. This isn’t the only place hardcoded Cyrillic file paths are used by implants. Many of the batch scripts also use hardcoded paths such as “Главное меню\Программы\Автозагрузка”. Many payloads also include a VBS script which raises a dialog box to the users asking them to run the malware again. It reads, “Ошибка при инициализации приложения (0xc0000005). Повторить попытку открытия файла?” (English Translation from Russian: Application failed to initialize (0xc0000005). Try to open the file again?).
MITRE ATT&CK techniques:
T1059
T1059.003
Threat description: Mandiant observed this attacker dump the LSASS process using Task Manager to a file named lsass.DMP, and later, zip the dump into two files named lsass.zip and lsass2.zip located in the C:\ProgramData\psh\ directory.
MITRE ATT&CK techniques:
T1003
T1074.001
T1003.001
T1003.004
T1560
T1074
T1560.001
Threat description: This investigation illustrates an attacker using multiple tools and techniques to implement their full attack chain. A variety of infection artifacts are utilized ranging from bespoke tools (IndigoDrop) to customizable adversarial tools (Cobalt Strike beacons). The attackers also use a combination of public and private servers to host their malicious payloads with a growing trend towards the sole usage of public servers. The use of military-themed maldocs (lures) indicates that government and military organizations in South Asia may be the targets of this threat actor. The maldocs contain bonafide content and are most likely weaponized copies of benign documents known to peek the interests of their targets. The attack variants discovered over time show us that the threat actor can evolve their TTPs in a short period of time. The earliest observable campaigns of this actor date back to April 2018 and continue to operate today along with the most recent evolutions of the attacks. Evidence of rapid ideation, testing and production of new and diversified modules and IndigoDrop iterations indicates highly motivated and agile adversaries. The use of adversarial frameworks like Cobalt Strike suggests that the attackers are looking to expand their malicious arsenal at a significant rate with self-authored and customizable artifacts. Modern-day malware attack chains consist of multiple stages and operational entities. These artifacts and entities may be hosted locally or on remote servers. For example, this attack consists of multiple shellcodes hosted on remote locations downloaded by a local component (IndigoDrop) during runtime to instrument the attack chain. Thus, while network-based detection is important, it should be complemented with system behavior analysis and endpoint protections.
MITRE ATT&CK techniques:
T1036
T1588.001
T1587.001
Threat description: Since PROPHET SPIDER gains access via web servers or other public-facing servers, they will often initially compromise a Linux-based system. Once initial access is obtained on a Linux system, PROPHET SPIDER typically deploys a webshell, reverse shell binary or a perl reverse shell script (commonly named bc.pl) as their initial persistence mechanism.
MITRE ATT&CK techniques:
T1059
T1059.004
T1190
T1505.003
Threat description: When Gauss infects an USB memory stick, it sets a certain flag to 30. This TTL (time to live) flag is decremented every time the payload is executed from the stick. Once it reaches 0, the data stealing payload cleans itself from the USB stick. This makes sure that sticks with Gauss infections do not survive ItW for long enough to results in detection.
MITRE ATT&CK techniques:
T1091
T1070.004
T1052.001
T1052
Threat description: The ability to launch a .exe or .dll file in memory. The ability to leverage schtasks.exe to add or modify task schedules. The ability to launch custom PowerShell commands. The ability to leverage a standalone executable to load the DLL if the attacker otherwise has no way of doing so.
MITRE ATT&CK techniques:
T1053.005
T1053
T1059.001
Threat description: The cheat sheet includes examples of commands needed for persistence, network reconnaissance, pivoting, credential dumping, general system and network data gathering, as well as data exfiltration and commands to configure the system to allow remote desktop protocol (RDP) sessions. The commands provide insight into the techniques the actors will use after compromising a system, as well as the tools used to achieve their objectives. The commands also suggest that the threat group heavily relies on RDP to interact with compromised hosts, likely using secure shell (SSH) tunnels created with the Plink tool between the infected system and an actor-controlled domain. Also, the command examples show the threat group seeks to move across an infiltrated network to target additional devices, making it a greater threat to organizations once infected. According to these commands, the actor would likely make these pivots to other systems by performing credential dumping from the Windows registry and process memory.
MITRE ATT&CK techniques:
T1049
T1021.004
T1041
T1016
T1105
T1018
T1021.001
T1021
T1570
Threat description: The DEWMODE web shell (Figure 4) extracts a list of available files from a MySQL database on the FTA and lists those files and corresponding metadata—file ID, path, filename, uploader, and recipient—on an HTML page. UNC2546 then uses the presented list to download files through the DEWMODE web shell. Download requests are captured in the FTA’s web logs, which will contain requests to the DEWMODE web shell with encrypted and encoded URL parameters, where dwn is the file path and fn is the requested file name (Figure 5). The encrypted file path and name values visible in web logs can be decrypted using key material obtained from the database used by the targeted FTA. Given the complex nature of this process, if your organization needs assistance reviewing relevant logs, please contact Mandiant or Accellion.
MITRE ATT&CK techniques:
T1074.001
T1119
T1505.003
T1074
T1027
T1005
T1573
Threat description: Nemucod malware is mostly deployed using weaponized documents where the malicious VBA macro code is responsible for constructing and executing a malicious encoded JScript file that carries out further activities including registering victims with the actors before downloading payloads, which in this case included a credential stealing Trojan executable component.
MITRE ATT&CK techniques:
T1059.007
T1059
T1204.002
T1587.001
T1027
T1059.005
Threat description: The attack itself is performed in an infinite loop. The IP addresses used for scanning are generated randomly using the rand() function and the GetTickCount() results as a random seed. The only filter rule for an IP address is that it cannot start with 127, 172 or 192. A separate thread is created to communicate with each IP address.
MITRE ATT&CK techniques:
T1106
T1046
Threat description: In the initial versions of the earlier exploits, such as the exploit for CVE-2013-3660 and some versions of CVE-2015-0057, the exploit caused the kernel to execute a token-swapping shellcode stored in user-mode.
MITRE ATT&CK techniques:
T1134.001
T1134
T1134.002
Threat description: Gauss highly modular architecture reminds us of Duqu — it uses an encrypted registry setting to store information on which plugins to load; is designed to stay under the radar, avoid security and monitoring programs and performs highly detailed system monitoring functions. In addition, Gauss contains a 64-bit payload, together with Firefox-compatible browser plugins designed to steal and monitor data from the clients of several Lebanese banks: Bank of Beirut, EBLF, BlomBank, ByblosBank, FransaBank and Credit Libanais. In addition, it targets users of Citibank and PayPal.
MITRE ATT&CK techniques:
T1176
T1119
T1082
T1140
T1027
T1033
T1005
Threat description: Then, it reads user-related info from the file sqlxmlx.inc in the same folder (we can see strings referencing to “UserID” commentary in this part of the code). But this file was never created. As you recall, there is a function that should have collected this data and should have saved it into this sqlxmlx.inc file. However, on the first launch, the collected user information is saved into “xmlrwbin.inc”. This effectively means that the malware writer mistakenly coded the bot to save user information into the wrong file. There is a chance for the mistaken code to still work — user information could be copied into the send information heap. But not in this case – at the time of writing, the gathered user information variable which should point to the xmlrwbin.inc filename has not yet been initialized, causing the file write to fail. We see that sqlxmlx.inc is not created to store user information.
MITRE ATT&CK techniques:
T1074.001
T1119
T1087
T1074
T1033
Threat description: The Gasket tool referenced a proxying and tunneling capability known as MagicSocks, which is based on the open-source Chisel project. The actors also created a standalone version of MagicSocks that they would use in addition to Gasket. The standalone MagicSocks tool comes as a dynamic link library (DLL), which the actor also wrote in Golang. The developer of MagicSocks uses code from the Chisel project to tunnel traffic from the local system to an external actor-controlled Chisel server. The tool will build the string R:0.0.0.0:50000:socks that it supplies to the Chisel client code that will generate the following JSON that the client uses as a configuration:
MITRE ATT&CK techniques:
T1095
T1572
T1090
T1090.002
Threat description: UNC215 made technical modifications to their tools to limit outbound network traffic and used other victim networks to proxy their C2 instructions, likely to minimize the risk of detection and blend in with normal network traffic. The following are examples of HYPERBRO and FOCUSFJORD samples capable of acting as proxies to relay communications to their C2 servers. We do not have enough context about the following samples to attribute all of them to UNC215, though they are representative of activity we have seen from the group.
MITRE ATT&CK techniques:
T1090.003
T1090.001
T1090
T1090.002
Threat description: One such self-extracting archive (ca87eb1a21c6d4ffd782b225b178ba65463f73de6f4c736eb135be5864f556dc) was first observed around April of 2014.  The password (reused by many of the password protected SFX payloads) it used to extract itself is “1234567890__”. The files included in this SFX file we observed include a batch file named “123.cmd” and another SFX named “setting.exe”. This second SFX contains a .MSI installer package which installs Remote Manipulator System and a batch script which handles the installation.
MITRE ATT&CK techniques:
T1027
T1059
T1059.003
T1140
Threat description: The next program sent to victims enumerates all the drives on the infected system and executes the following command on them:
MITRE ATT&CK techniques:
T1105
T1083
T1135
T1082
Threat description: The BackConfig custom trojan has a flexible plug-in architecture for components offering various features, including the ability to gather system and keylog information and to upload and execute additional payloads.
MITRE ATT&CK techniques:
T1105
T1119
T1082
Threat description: The very first stage of the implant’s code is a custom loader written by APT3, which extracts an encrypted version of DoublePulsar code from incoming SMB packets, and decrypts and executes it. This is in fact a self-modifying piece of code, i.e. before it actually handles any of the aforementioned functionalities, it must decrypt subsequent parts of itself. The code is wrapped in 2 layers using simple crypters, so the first crypter decodes the second, and the latter decodes the actual loader code.
MITRE ATT&CK techniques:
T1105
T1140
T1620
T1587.001
T1027
T1027.002
Threat description: After executing all the commands given by the server, the bot sends a new request to the server. This request contains a complete log of executed commands. If any of the commands require the bot to send data to the server (i.e., SONIA), they are sent in separate HTTP requests preceding the log request. These requests can also be redirected do a different C&C, if specified in the command parameters.
MITRE ATT&CK techniques:
T1008
T1020
T1119
T1071
T1041
T1071.001
Threat description: This Zip archive contained a file named [redacted]-ITsoftwareUpdate.exe (SHA256: 5f42deb792d8d6f347c58ddbf634a673b3e870ed9977fdd88760e38088cd7336), which is a variant of the OopsIE Trojan we described in detail in a blog we published in September 2018. This suggests that the server displayed in the VPS control panel may have indeed been in use by the OilRig threat actors at the time of attack. In addition, two of the other IPs listed in this panel, 185.161.209[.]57 and 185.161.210[.]25 are in the same 185.161.208[.]0/22 range as an IP associated with the DNSpionage campaign, 185.161.211[.]72. This is a tenuous relationship at best and does not indicate that the OilRig group is the one executing the DNSpionage campaign, but with the combination of the use of DeltaHost and IPs belonging to a fairly small range, there may be reason to believe that these are related to some extent.
MITRE ATT&CK techniques:
T1036
T1140
Threat description: While we do not have telemetry showing how the CASHY200 PowerShell backdoor was delivered, in September 2019 we observed a host based in Kuwait beaconing to the windows64x[.]com domain using the same DNS tunneling protocol as the CASHY200 payload. Fortunately, the beaconing to this domain was blocked by our DNS security service, so the adversary was no longer able to communicate with their payload using this DNS tunnel. By analyzing the lineage of this tool, we found that actors may have used CASHY200 when targeting Kuwait government organizations starting in the spring of 2018 and continuing throughout 2019, according to our open source collection efforts.
MITRE ATT&CK techniques:
T1071.004
T1572
T1071
Threat description: The smartpss.exe file contained metadata describing itself as MSHTA.exe from Microsoft, a legitimate operating system component, but the MD5 hash was unknown. Disassembly analysis of the program showed it was a small application that loaded the IE COM object and launched the function RunHTMLApplication() against the command line argument provided. This functionality matched the behavior of the legitimate MSHTA.exe despite the hash discrepancy. Further analysis showed that the malware was based on a 2018 version of the binary (original hash: 5ced5d5b469724d9992f5e8117ecefb5) with only six bytes of data appended, as shown in Figure 4.
MITRE ATT&CK techniques:
T1036
T1559.001
T1218.005