QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Waterbear employs a modular approach to its malware. It utilizes a DLL loader to decrypt and execute an RC4-encrypted payload. Sometimes, the hardcoded file paths of the encrypted payloads are not under Windows native directories (e.g. It is also possible that the attackers use Waterbear as a secondary payload to help maintain presence after gaining some levels of access to the targets’ systems. The evidence is that Waterbear frequently uses internal IPs as its own C&amp;C servers (for instance, b9f3a3b9452a396c3ba0ce4a644dd2b7f494905e820e7b1c6dca2fdcce069361 uses an internal IP address of 10[.]0[.]0[.]211 as its C&amp;C server
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Throughout the spear-phishing campaign, the threat actors used email attachments to leverage legitimate Microsoft Office functions for retrieving a document from a remote server using the Server Message Block (SMB) protocol. After obtaining a credential hash, the threat actors can use password-cracking techniques to obtain the plaintext password. With valid credentials, the threat actors are able to masquerade as authorized users in environments that use single-factor authentication
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Sodinokibi gathers some basic system information and saves it to the registry together with the generated encryption parameters. If the dbg option is not set in the config, the UI language and keyboard layout values are checked, and the malware will simply exit on systems which use one of the following language codes
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1082: System Information Discovery
Threat description: Cisco Talos has discovered a new malware campaign based on a previously unknown family we're calling "PoetRAT. The droppers are Microsoft Word documents that deploy a Python-based remote access trojan (RAT). We named this malware PoetRAT due to the various references to William Shakespeare, an English poet and playwright. The RAT has all the standard features of this kind of malware, providing full control of the compromised system to the operation. For exfiltration, it uses FTP, which denotes an intention to transfer large amounts of data. The campaign shows us that the operators manually pushed additional tools when they needed them on the compromised systems. We will describe a couple of these tools. The most interesting is a tool used to monitor the hard disk and exfiltrate data automatically. Besides these, there are keyloggers, browser-focused password stealers, camera control applications, and other generic password stealers
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: PDB Path: C:\Users\803\Desktop\ytyboth\yty 2.0\Release\vstservice.pdb The vstservice.exe plugin is .NET file responsible for sending a list of the file system to the C2. The malware retrieves the C2 from a Google Docs file like the previous binaries. The file was located at the following location
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: In one sample we analyzed, the zip file contains a VBS file named NUM_56960.vbs. The size of the file is around 30MB. The large file size helps it evade detection, as file scanners usually skip scanning huge files for performance reasons. This VBS file then downloads the malicious executable file PaintHelper.exe
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: The Maze-delivered virtual machine was running Windows 7, as opposed to the Windows XP VM distributed in the Ragnar Locker incident. In this case, Cryptoguard was preventing the malware from encrypting files by intercepting and neutralizing the Windows APIs that the ransomware was attempting to use to encrypt the hard drive. Weaponized virtual machine . The Maze attackers delivered the attack components for the third attack in the form of an .msi installer file. The root of that virtual disk contained three files associated with the Maze ransomware: preload.bat, vrun.exe, and a file just named payload (with no file extension), which is the actual Maze DLL payload. The Maze attackers took a slightly different approach, using a virtual Windows 7 machine instead of XP. The virtual machine (VM) that Sophos extracted from the Maze attack shows that this (newer) VM is configured in such a way that it allows easy insertion of another ransomware on the attacker’s ‘builder’ machine. But the cost in terms of size is signficant: The Ragnar Locker virtual disk was only a quarter the size of the nearly 2GB virtual disk used in the Maze attack—all just to conceal one 494 KB ransomware executable from detection. The attackers also executed the following commands on the host computer during the Maze attack: This ran the Microsoft Installer that installs VirtualBox and the virtual hard drive. They stop the Volume Shadow Copy service; the ransomware itself includes a command to delete existing shadow copies. The Maze threat actors have proven to be adept at adopting the techniques demonstrated to be successful by other ransomware gangs, including the use of extortion as a means to extract payment from victims
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Using job opportunities as template is the known method used by Lazarus to target its victims. The documents created by this actor are well designed and contain a large icon for a known company such as LockHeed Martin, BAE Systems, Boeing and Northrop Grumman in the template. In this campaign the actor has targeted people that are looking for job opportunities at Lockheed Martin. The document’s metadata used in this campaign links them to several other documents used by this actor in the past
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Windows Defender ATP displays these activities as process trees in a machine timeline for the infected computer. Analysts can easily extract detailed information from these trees, such as the implant DLL dropped by the installer, the command used to call rundll32.exe and load the DLL, and the registry modifications that set the DLL as a service
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: The function of this tool is to set up a TCP listener on a localhost, receive encoded data via requests from the SodomNormal localhost module, and to forward this data to the command and control IP via HTTP. The GUP Proxy Tool has a hardcoded configuration which is included as both strings and integers
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Note that regardless of whether Nyetya is successful in overwriting the boot sector or not, it will proceed to create a scheduled task via schtasks to reboot the system one hour after infection
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1529: System Shutdown/Reboot
Threat description: This script simply checks the operating system of the victim and downloads the respective payload again using the certutil executable. In this particular instance, the payload is encoded via base64, which certutil decodes. The payload in question is a CAB file that is then unpacked. Finally, the malware executes the extracted install.bat script before deleting the original files and exiting
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: While PotPlayerDB.dat is a variant of PlugX malware, TA416 has updated the payload by changing both its encoding method and expanding the payload’s configuration capabilities. Historically, TA416 relied on the DLL launcher to decode the PlugX payload utilizing an XOR key included at the offset 0 within the PlugX DAT configuration file. One of the main ways it does this is by resolving API functions during runtime. Generally, malware loads a DLL, iterates over the set of exports of the DLL and hashes the string, looking for a matching hash. This iteration of PlugX does standard API hashing, but only to resolve the address of the functions GetProcAddress as well as LoadLibrary. Once those functions are resolved properly, it loads the rest of the functions via their text name
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Torisma uses this method to send data back to the C2 server read from the named pipe. This is the results of the execution of the shellcode on the victim’s system through the ViewPrevPage action and the results of this execution are sent and processed using this function
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Summary In early May, Unit 42 discovered an attack campaign against at least one defense company in Russia and one unidentified organization in South Korea delivering a variant of Bisonal malware. While not previously publicly documented, the variant has been in the wild since at least 2014. There are three primary differences between it and older Bisonal malware including a different cipher and encryption for C2 communication, and a large rewrite of the code for both network communication and maintaining persistence. To date, we have only collected 14 samples of this variant, indicating it may be sparingly used. The adversary behind these attacks lured the targets into launching the Microsoft Windows executable malware by masquerading it as a PDF file (using a fake PDF icon) and reusing publicly available data for the decoy PDF file’s contents. Attacks using Bisonal have been blogged about in the past. We believe it is likely these tools are being used by one group of attackers. Though Bisonal malware has been in the wild for at least seven years and frequently updated, the actors keep using same high-level playbooks. Common features of attacks involving Bisonal include
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Mustang Panda APT uses a package of binaries to load the actual payload and it is intentionally designed this way to bypass file scanners and sandboxes. Obviously, file scanners or sandboxes can’t detect the PlugX payload without the encrypted DAT file
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: HOLMIUM has been observed using various vectors for initial access, including spear-phishing email, sometimes carrying archive attachments that exploit the CVE-2018-20250 vulnerability in WinRAR, and password-spraying. Many of their recent attacks, however, have involved the penetration testing tool Ruler used in tandem with compromised Exchange credentials
MITRE ATT&CK techniques:
- T1110.003: Brute Force - Password Spraying
Threat description: Completing missions typically involves gathering and transferring information out of the target network, which may involve moving files through multiple systems before reaching the destination. APT40 has been observed consolidating files acquired from victim networks and using the archival tool rar.exe to compress and encrypt the data before exfiltration. We have also observed APT40 develop tools such as PAPERPUSH to aid in the effectiveness of their data targeting and theft
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: It creates the folder "\ProgramData\AuditService\" and copies the clean file "lsass.exe" (taken from "\Windows\System32\") into the folder. The tainted "services.exe" installs "\ProgramData\AuditService\lsass.exe" as an autostart Windows service named "Audit Service". When the new "lsass.exe" service autostarts, the malicious file "sspisrv.dll" sideloads in the same folder. lsass.exe" will eventually crash because of a failure to load other dependencies
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
- T1569.002: System Services - Service Execution
Threat description: Companies in multiple sectors are targeted in this campaign, including those operating in the automotive, pharmaceutical, and engineering sector, as well as managed service providers (MSPs
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: The maldocs used in this campaign typically contain a malicious VBA macro that downloads and activates the next stage of the infection chain. Although the VBA macro contains an auto open subroutine, it uses several VBA functions registered to trigger if the "Typing replaces selection" property is enabled in Microsoft Word. The VBA functions trigger when the victim types any content into the maldoc. Appdata%\desktop.iniThe next stage of the VBS is run using wscript.exe using a command such as:%windir%\System32\wscript.exe //e:vbscript //b &lt;path_to_Stage_2&gt;Macros dropping VBS to disk and running via wscript.exe
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: The stage 2 payload for the macOS X malware was decoded and analyzed. The stage 2 malware has a variety of functionalities. Most importantly, it checks in with a C2 and, after connecting to the C2, can send or receive a payload, read and write files, execute commands via the terminal, etc
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: The threat actor accomplished this by using administrative accounts to connect via SMB to targeted users, and then copy their Chrome profile directories as well as data protection API (DPAPI) data
MITRE ATT&CK techniques:
- T1003.006: OS Credential Dumping - DCSync
Threat description: TA416 has used SMTP2Go to impersonate various European diplomatic organizations since at least 2020. In this historical campaign, TA416 delivered a DropBox URL that delivered a PlugX variant aligning with Recorded Future’s analysis of "Red Delta" PlugX malware. Included below is a publicly available malicious Zip file hash from August 2020 delivered via a DropBox URL which is attributable to TA416/Red Delta
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: One, called "frown.py," is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143. The RAT will answer the "who" command with a string that contains the username, computer name and the previously generated UUID. The "ice" command simply makes the RAT finish the connection procedure. This is responsible for the interpretation and execution of the C2 commands. The available commands are
MITRE ATT&CK techniques:
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: The use of the web bug reconnaissance technique suggests TA416 is being more discerning about which targets the group chooses to deliver malware payloads. Historically, the group primarily delivered web bug URLs alongside malware URLs to confirm receipt. In 2022, the group started to first profile users and then deliver malware URLs. This may be an attempt by TA416 to avoid having their malicious tools discovered and publicly disclosed. By narrowing the lens of targeting from broad phishing campaigns to focus on targets that have proven to be active and willing to open emails, TA416 increases its chance of success when following up with malicious malware payloads
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: In such a situation, the malware will find and run the built-in Microsoft Windows InfDefaultInstall.exe program, which will install a DLL via an INF file. Should Tencent be installed, the malware will execute the InfDefaultInstall.exe program with an argument of ‘QQMgr.inf’. Otherwise, it will use ‘hccutils.inf’ as an argument
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: On Sunday August 24, 2014 we observed a spear phish email sent to a Taiwanese government ministry. Attached to this email was a malicious Microsoft Word document (MD5: f6fafb7c30b1114befc93f39d0698560) that exploited CVE-2012-0158. It is worth noting that this email appeared to have been sent from another Taiwanese Government employee, implying that the email was sent from a valid but compromised account
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1566.001: Phishing - Spearphishing Attachment
Threat description: After successful lateral movement, the attackers tried to establish persistency on selected servers –targeting all domain controllers, but also other servers. To achieve persistency, they used WMI Event Subscription with a few different WMI objects
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: The macro prepends the string -----BEGIN CERTIFICATE----- to the beginning of the base64 encoded payload and appends -----END CERTIFICATE----- to the end of the data. The macro then writes this data to a text file in the C:\Programdata folder using a random filename with the .txt extension. The macro then uses the command certutil -decode to decode the contents of this text file and outputs the decoded content to a randomly named file with a .exe extension in the C:\Programdata folder. The newly dropped executable is a loader Trojan responsible for installing and running the payload of this attack. Overall, SofacyCarberp does initial reconnaissance by gathering system information and sending it to the C2 server prior to downloading additional tools to the system. These differences include a new hashing algorithm to resolve API functions and to find running browser processes for injection, as well as changes to the C2 communication mechanisms as explained in detail within the appendix. Open-source Delivery Document Generator It appears that Sofacy may have used an open-source tool called Luckystrike to generate the delivery document and/or the macro used in this attack. Luckystrike, which was presented at DerbyCon 6 in September 2016, is a Microsoft PowerShell-based tool that generates malicious delivery documents by allowing a user to add a macro to an Excel or Word document to execute an embedded payload. To confirm our suspicions, we generated a malicious Excel file with Luckystrike and compared its macro to the macro found within Sofacy's delivery document. We found that there was only one difference between the macros besides the random function name and random cell values that the Luckystrike tool generates for each created payload
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: If the connection to the C2 server is successful, the script parses the output and invokes it using IEX. The script sleeps for a random number of seconds between 60 and 100 after each attempt to reach the C2. The GET requests will be parsed by LitePower and invoked using PowerShell’s IEX function
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: It only installs the second-stage script in the default registry value under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot. Variant B registers a scheduled task named Sibot and programmed to run daily. This task, which is saved by Windows in the file C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\sibot, runs the following command-line daily
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Embedded Downloader Trojan The M payload (referenced previously along with the R payload, above) injected and executed within the memory space of the other process is a downloader Trojan. This specific downloader appears to have been created using a VB2Exe tool, as the functional code that carries out the downloading functionality exists as a VBScript embedded within the payload. The payload extracts this VBScript from a resource and saves it to a file that it extracts from another resource
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: The folder C:\Users\Public\Administrador\logs\ is created to store screenshots, as well as the number of mouse clicks the user has triggered while browsing the banking sites (Figure 12). The screenshots are continuously saved as .jpg images
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: 1) Resolves WINAPI functions 2) Hides its GUI using ShowWindow WINAPI call 3) Compares if the DLL is being ran by wmplayer
MITRE ATT&CK techniques:
- T1564.003: Hide Artifacts - Hidden Window
Threat description: BADNEWS Much of BADNEWS has remained consistent from when it was originally discussed by Forcepoint in August 2016. To briefly recap, the BADNEWS malware family acts as a backdoor, with communication occurring over HTTP. A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products. After a few months, Turla has improved these scripts and is now using them to load a wide range of custom malware from its traditional arsenal. PowerShell Loader . The PowerShell loader has three main steps: persistence, decryption and loading into memory of the embedded executable or library. It reads the Windows Registry key where the encrypted payload is stored, and contains the password and the salt needed to decrypt the payload. WMI consumer PowerShell command . Finally, the script stores the encrypted payload in the Windows registry. Hijacked profile.ps1 file . The base64-encoded PowerShell command is very similar to the one used in the WMI consumers. The key and the salt are also different for each script and are not stored in the script, but only in the WMI filter or in the profile.ps1 file. Patching of AmsiScanBuffer function . Payloads . The PowerShell scripts we have presented are generic components used to load various payloads, such as an RPC Backdoor and a PowerShell backdoor. We have seen operators use this backdoor for the following purposes: Conclusion . In a 2018 blogpost, we predicted that Turla would use more and more generic tools. Finally, the usage of open-source tools does not mean Turla has stopped using its custom tools
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: This appears to be an implementation of hashbusting — a method of obfuscation in which a malware sample is subtly changed on the fly so each sample has a different checksum. As a result, the SHA256 hash of each payload downloaded from the sites in question appeared to be unique. However, the SSDEEP fuzzy hash of this sample was as follows
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: By using these methods, Kimsuky can gain login and password information and/or launch malware outside of some application allowlisting solutions
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: Once delivered, Egregor will perform a sequence of language checks in a similar manner to both Maze and Sekhmet, before attempting to enumerate all connected drives. If successful, it connects to a command and control (C2) server to grab a list of directories present on the enumerated drives to search. Any files in these directories are then extracted and sent back to the C2 server
MITRE ATT&CK techniques:
- T1039: Data from Network Shared Drive
Threat description: After the driver is loaded, the VSS service is disabled using the Control Service Manager. Following this, a number of additional threads are created. A thread is created to handle the system reboot. It will sleep for the time specified by a command line parameter of 35 minutes, at which point the system will be restarted by an API call to InitializeSystemShutdownExW
MITRE ATT&CK techniques:
- T1134: Access Token Manipulation
Threat description: Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use the ‘net time' command to check the local time on the target system. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. Use an advanced endpoint threat detection (AETD) solution to monitor activity on network endpoints. In particular, review network access for use of mobile USB modems on corporate systems
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: The first of FIN7's new tools is BOOSTWRITE – an in-memory-only dropper that decrypts embedded payloads using an encryption key retrieved from a remote server at runtime. FIN7 has been observed making small changes to this malware family using multiple methods to avoid traditional antivirus detection, including a BOOSTWRITE sample where the dropper was signed by a valid Certificate Authority. While CARBANAK has been thoroughly analyzed and has been used maliciously by several financial attackers including FIN7, RDFSNIFFER is a newly-identified tool recovered by Mandiant investigators
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: The first layer of the FYAnti loader decrypts an embedded .NET module and executes it using the CppHostCLR technique. The .NET module is packed using “ConfuserEx v1.0.0” and acts as yet another loader that searches for a file in the “C:\Windows\Microsoft.NET\” directory with file sizes between 100,000 and 500,000
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
- T1083: File and Directory Discovery
Threat description: Once gaining a foothold, the threat actors use off-the-shelf tools to ensure persistence, including Remote Desktop Protocol (RDP) to maintain access. While GDPR requirements prevented us from pivoting on Registrant information, the actors reused IP space, reused a certificate, and the aforementioned domain mimicking technique allowed for some pivoting. Toolset . Once gaining a foothold on a user’s system, the threat actors behind STOLEN PENCIL use Microsoft’s Remote Desktop Protocol (RDP) for remote point-and-click access. This means a human is behind the keyboard interacting with a compromised system, and not using a RAT (Remote Access Trojan) with a command-and-control site acting as a proxy between the threat actor and the compromised system. A compromised or stolen certificate was used to sign several PE files used in STOLEN PENCIL for two sets of tools: - MECHANICAL Logs keystrokes to %userprofile%\appdata\roaming\apach. GREASE a tool to add a Windows administrator account with a specific username/password and enable RDP, circumventing any firewall rules. defaultes/1qaz2wsx#EDC - a tool to add a Windows administrator account with a specific username/password and enable RDP, circumventing any firewall rules. Figure 5: Certificate used to sign MECHANICAL/GREASE While the threat actors did use a few tools to automate intrusions, we also found a ZIP archive of tools that demonstrate their propensity for password theft to propagate. Using a combination of stolen passwords, backdoor accounts, and a forced-open RDP service, the threat actors are likely to retain a foothold on a compromised system. Conclusion . While we were able to gain insight into the threat actor’s TTPs (Tools, Techniques, &amp; Procedures) behind STOLEN PENCIL, this is clearly just a small window into their activity
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
Threat description: Filter the target machines: setup.bat first checks if the hostname of the machine is one of the following: PIS-APP, PIS-MOB, WSUSPROXY or PIS-DB. Download the malicious files onto the machine: the same batch file downloads a cab archive named env.cab from a remote address in the internal network: \\railways.ir\sysvol\railways.ir\scripts\env.cab. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Extract and run additional tools: update.bat, which was extracted and started by setup.bat, uses the password hackemall to extract the next stages: cache.bat, msrun.bat and bcd.bat. Corrupt the boot: bcd.bat is used in order to harm the boot process
MITRE ATT&CK techniques:
- T1489: Service Stop
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: The BONDUPDATER Trojan contains basic backdoor functionality, allowing threat actors to upload and download files, as well as the ability to execute commands. BONDUPDATER, like other OilRig tools, uses DNS tunneling to communicate with its C2 server
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
- T1105: Ingress Tool Transfer
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: As mentioned in our earlier technical report on Trojan.Hydraq, the back door allows the attacker to perform any of the following activities: - Adjust token privileges. Check status, control, and end processes and services. Create, modify, and delete registry subkeys. Retrieve a list of logical drives
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: The actor then tested connectivity to an IP managed by the victim’s service provider. Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor. This effectively routes SOGU malware traffic through the victim’s service provider, which likely indicates a foothold on the service provider’s network. The tactic also serves to mask malicious C2 and exfiltration traffic and make it appear innocuous
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: The malware component, test.exe, uses the Windows command "cmd.exe" /C whoami” to verify it is running with the elevated privileges of “System” and creates persistence by creating the following scheduled task
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: The download process is the same with the previous variant, the loader resolves the command and control server IP address using a hardcoded list of DNS servers and then downloads the corresponding file. An interesting addition, in the latest samples, is the use of an alternative command and control server IP address, in case the primary one fails. The alternative IP address is generated by applying a bitwise XOR operation to each byte of the resolved command and control IP address with the byte 0xFE. In addition, as a possible anti-behaviour method, the loader verifies that the command and control server IP address is not ‘127.0.0.1’. Both of these methods are also present in the latest Team9 backdoor variants
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Audit all remote authentications from trusted networks or service providers. Detect mismatches by correlating credentials used within internal networks with those employed on external-facing systems. Log use of system administrator commands such as net, ipconfig, and ping
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: 1) Use PowerShell Constrained Language Mode as it uses IEX, Add-Type, and New-Object. 2) Lock PowerShell Execution Policy, must be set to “AllSigned” via GPO. 3) An allowlisting solution to prevent certain process child-parent execution hierarchies
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: Endpoint Protection . Buckeye cyberespionage group shifts gaze from US to Hong Kong . Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009. Symantec has identified additional tools used by the group, which will be discussed later. Organizations that Buckeye targeted over time, per region . Malware and tools . Buckeye uses a number of hacking tools as well as malware. Buckeye uses Backdoor.Pirpi, a remote access Trojan capable of reading, writing, and executing files and programs. As mentioned previously, Buckeye also uses a number of hacking tools, including the following: Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister. RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool. On execution, the tool injects itself into lsass.exe and is triggered with the argument “dig”. OSinfo: OSInfo is a general purpose, system information gathering tool. It has the following command line argument help: ChromePass: A tool from NirSoft used for recovering passwords stored in the Chrome browser. This, coupled with the group’s use of zero-day exploits in the past, customized tools, and the types of organizations being targeted would suggest that Buckeye is a state-sponsored cyberespionage group
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: In this campaign, Palmerworm is also using stolen code-signing certificates to sign its payloads, which makes the payloads appear more legitimate and therefore more difficult for security software to detect. Palmerworm has been publicly documented using stolen code-signing certificates in previous attack campaigns
MITRE ATT&CK techniques:
- T1588.003: Obtain Capabilities - Code Signing Certificates
Threat description: Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. Officials at the games confirmed some technical issues to non-critical systems and they completed recovery within around 12 hours. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec &amp; WMI to further move through the environment. This feature explains why we discovered several samples with different sets of credentials that were collected from previously infected systems. Dropped Files . Browser Credential Stealer . Olympic Destroyer drops a browser credential stealer. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. This step is executed to ensure that file recovery is not trivial - WBAdmin can be used to recover individual files, folders and also whole drives so this would be a very convenient tool for a sysadmin to use in order to aid recovery. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: "Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. categories . Subscribe To Our Feed . Blog Archive . - - - - - - - - - - - - ▼ February (14) CannibalRAT targets Brazil Who Wasn’t Responsible for Olympic Destroyer
MITRE ATT&CK techniques:
- T1490: Inhibit System Recovery
Threat description: During this process, the adversary identifies data of interest from the network of the victim. This can be anything from file and directory-listings, configuration files, manuals, email stores in the guise of OST- and PST-files, file shares with intellectual property (IP), and data scraped from memory. If the data is small enough, it is exfiltrated through the command and control channel of the Cobalt Strike beacons. However, usually the data is compressed with WinRAR, staged on another system of the victim, and from there copied to a OneDrive-account controlled by the adversary
MITRE ATT&CK techniques:
- T1114.001: Email Collection - Local Email Collection
- T1083: File and Directory Discovery
Threat description: As the result of the RC4 encryption may contain binary data, the malware additionally encodes it in BASE64, to match the HTTP specification
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: We attribute this campaign with high confidence to an actor named WIRTE, which is a lesser-known threat actor first publicly referenced by our colleagues at Lab52 in 2019. We further suspect, with low confidence, that the WIRTE group has relations with the Gaza Cybergang threat actor
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: 1) QEMU Linux images. 2) Shell scripts used to launch the QEMU images. 3) Daemons used to start the shell scripts at boot and keep them running. 4) A CPU monitor shell script with an accompanying daemon that can start/stop the mining based on CPU usage and whether the Activity Monitor process is running
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Extract and run additional tools: update.bat, which was extracted and started by setup.bat, uses the password hackemall to extract the next stages: cache.bat, msrun.bat and bcd.bat. Corrupt the boot: bcd.bat is used in order to harm the boot process
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: The tool is used to hide the threat actors’ tools and services. The tool’s configuration was added to registry run keys on a victim’s computer
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: KillDisk, along with the multipurpose, cyberespionage-related BlackEnergy, was used in cyberattacks in late December 2015 against Ukraine’s energy sector as well as its banking, rail, and mining industries. The malware has since metamorphosed into a threat used for digital extortion, affecting Windows and Linux platforms
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool. Usage is: %s shareIp domain [USER INFORMATION||[USER NAME AND PASSWORD]] [/run:[COMMAND
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1569.002: System Services - Service Execution
Threat description: The new wave of Shamoon is accompanied by a .Net tool kit that spreads Shamoon Version 3 and the wiper Filerase
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: After achieving access to staging targets, the threat actors installed tools to carry out operations against intended victims. On one occasion, threat actors installed the free version of FortiClient, which they presumably used as a VPN client to connect to intended target networks
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: NCCIC observed multiple methods used by NotPetya to propagate across a network. The first and—in most cases—most effective method, uses a modified version of the Mimikatz tool to steal the user’s Windows credentials. The cyber threat actor can then use the stolen credentials, along with the native Windows Management Instrumentation Command Line (WMIC) tool or the Microsoft SysInternals utility, psexec.exe, to access other systems on the network. Another method for propagation uses the EternalBlue exploit tool to target unpatched systems running a vulnerable version of SMBv1
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Volexity has identified multiple new attack campaigns being launched by OceanLotus via multiple fake websites and Facebook pages that have been set up within the last year. In addition to targeting those within Vietnam, Volexity has seen renewed targeting of OceanLotus's neighbors throughout Southeast Asia. These websites have been observed profiling users, redirecting to phishing pages, and being leveraged to distribute malware payloads for Windows and OSX. This post will focus on one of the larger campaigns where OceanLotus has leveraged multiple fake news websites to target users
MITRE ATT&CK techniques:
- T1585.001: Establish Accounts - Social Media Accounts
Threat description: modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed) to maintain access to credentials and certain permission levels within an environment (Account Manipulation [T1098]) - Steal the credentials of a specific user or service account to bypass access controls and retain access to remote systems and externally available services (Valid Accounts [T1078]) - Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution for lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053]) - Abuse the Windows DLLs search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence (Hijack Execution Flow: DLL Search Order Hijacking [T1056.004]) - Exploit hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process’s memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1574.001]) - Use remote services to persist within a victim’s network (External Remote Services [T1133
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1505.003: Server Software Component - Web Shell
- T1569.002: System Services - Service Execution
Threat description: TA551 has distributed different families of malware, including Ursnif (Gozi/ISFB), Valak and IcedID. TA551 malspam spoofs legitimate email chains based on data retrieved from previously infected Windows hosts. This is a generic statement asking the recipient to open an attached ZIP archive using the supplied password. File names for the ZIP archives use the name of the company being spoofed in the email. For example, if the spoofed sender is someone@companyname.com, the ZIP attachment would be named companyname.zip. In 2020, we also started seeing emails with info.zip or request.zip as the attached ZIP archive names. These password-protected ZIP attachments contain a Word document with macros to install malware. File names for the extracted Word documents follow noticeable patterns that have evolved as this campaign has progressed. URLs generated by the associated Word macros also follow noticeable patterns that have also evolved as this campaign has progressed
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: This section describes how we identified additional Stealth Falcon victims and bait content, and traced Stealth Falcon’s spyware to additional C2 servers
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: Talos has identified two different infection vectors associated with this particular campaign. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. The second vector is a trojanized Word document that prompts the victim to enable macros and run a Visual Basic script. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine. The stager will be described in more detail in the next section
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Connects a computer to or disconnects a computer from a shared resource, or displays information about computer connections. The command also controls persistent net connections. Used without parameters, net use retrieves a list of network connections
MITRE ATT&CK techniques:
- T1070.005: Indicator Removal - Network Share Connection Removal
Threat description: The malware then allows the user to open the file as normal without any indication to the user that anything has occurred
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: These keystrokes would run PowerShell commands that downloaded and installed various malware strains that acted as backdoors for the attackers into the victims’ networks
MITRE ATT&CK techniques:
- T1091: Replication Through Removable Media
Threat description: In the course of our research we uncovered the activity of a hacking group which has Chinese origins. This group was named “Winnti
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: A malware variant named Mal/Miner-C (also known as PhotoMiner) is infecting Internet-exposed Seagate Central Network Attached Storage (NAS) devices and using them to infect connected computers to mine for the Monero cryptocurrency
MITRE ATT&CK techniques:
- T1080: Taint Shared Content
Threat description: PsExec is then used to launch PowerShell which uses the win32_service WMI class to retrieve services and the net stop command to stop these services. After Windows Defender is disabled and services have been stopped across the organization, PsExec is used to launch the WastedLocker ransomware itself, which then begins encrypting data and deleting shadow volumes
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1007: System Service Discovery
- T1489: Service Stop
Threat description: The file named ‘lsass.exe’ was downloaded from win10-update[.]com via an HTTP request. The win10-update[.]com domain has been noted in open source as an indicator associated with Chafer threat operations. The lsass.exe file downloaded from this domain is a previously unreported python-based payload that we are currently tracking as MechaFlounder. We believe Chafer uses MechaFlounder as a secondary payload that the group downloads from a first-stage payload to carry out its post-exploitation activities on the compromised host
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Ryuk attempts to encrypt all mounted drives and hosts that have Address Resolution Protocol (ARP) entries (IP addresses) and it enumerates all mounted drives by calling GetLogicalDrives. For each mounted drive, Ryuk calls GetDriveTypeW to determine the drive’s type. To retrieve IP addresses that have ARP entries, Ryuk calls GetIpNetTable. It iterates through all entries and then tries to enumerate files and folders on the remote host and encrypt the files
MITRE ATT&CK techniques:
- T1057: Process Discovery