QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: The macro prepends the string -----BEGIN CERTIFICATE----- to the beginning of the base64 encoded payload and appends -----END CERTIFICATE----- to the end of the data. The macro then writes this data to a text file in the C:\Programdata folder using a random filename with the .txt extension. The macro then uses the command certutil -decode to decode the contents of this text file and outputs the decoded content to a randomly named file with a .exe extension in the C:\Programdata folder. The macro sleeps for two seconds and then executes the newly dropped executable. Open-source Delivery Document Generator It appears that Sofacy may have used an open-source tool called Luckystrike to generate the delivery document and/or the macro used in this attack. Luckystrike, which was presented at DerbyCon 6 in September 2016, is a Microsoft PowerShell-based tool that generates malicious delivery documents by allowing a user to add a macro to an Excel or Word document to execute an embedded payload. We believe Sofacy used this tool, as the macro within their delivery document closely resembles the macros found within Luckystrike. To confirm our suspicions, we generated a malicious Excel file with Luckystrike and compared its macro to the macro found within Sofacy's delivery document. We found that there was only one difference between the macros besides the random function name and random cell values that the Luckystrike tool generates for each created payload
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: In this blog post, we provide an in-depth analysis of Linux/Ebury. It is a sophisticated backdoor used to steal OpenSSH credentials and maintain access to a compromised server. According to previous reports, this backdoor has been in the wild for at least two years. Linux/Ebury comes in two different shapes: a malicious library and a patch to the main OpenSSH binaries. The malicious library is a modified version of libkeyutils.so. This shared library is loaded by all OpenSSH executables files such as ssh, sshd and ssh-agent. We will describe how the backdoor works and how the OpenSSH functionalities are hooked
MITRE ATT&CK techniques:
- T1554: Compromise Host Software Binary
Threat description: Our latest Transparent Tribe research confirms that the group continues to create malicious domains mimicking defense-related entities as a core component of their operations. The victim is encouraged to click on an embedded URL hosted on sharingmymedia[.]com, which then downloads ObliqueRAT, the trojan discovered by Talos in 2020 associated with threat activity targeting entities in South Asia. We cannot confirm how the maldocs were delivered to victims, but we suspect they were probably sent as attachments to phishing emails based on previous threat actor behavior and the targeted nature of this particular lure. Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. In such cases, adversaries would deliver phishing maldocs to targets containing a malicious VBA macro that extracted either the CrimsonRAT executable or a ZIP archive embedded in the maldoc. The macro dropped the implant to the disk, setting up persistence mechanisms and eventually executing the payload on the infected endpoint. For example, attackers leveraging ObliqueRAT started hosting their malicious payloads on compromised websites instead of embedding the malware in the maldoc. Figure 2 shows the attackers' use of HTTrack, a free website copier program, to duplicate a legitimate website to use for their own malicious purposes. These examples highlight Transparent Tribe's heavy reliance on social engineering as a core TTP and the group's efforts to make their operations appear as legitimate as possible.Figure 2: Fake website cloned using HTTrack on May 29, 2020. The malicious domain prompts the victim to enter their name and email address to sign up and download a seemingly important "guide on pay and allowance
MITRE ATT&CK techniques:
- T1608.004: Stage Capabilities - Drive-by Target
Threat description: It uses the string 5cd8f17f4086744065eb0992a09e05a2 as its mutex as well as its registry hive in the affected machine. It uses the value tcpClient_0 as its HTTP server, where it will receive all stolen information from the infected machine. However, since the value was set to null, all stolen information will be sent to the same C&amp;C server
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: While FIN7 has embedded VBE as OLE objects for over a year, they continue to update their script launching mechanisms. In the current lures, both the malicious DOCX and RTF attempt to convince the user to double-click on the image in the document, as seen in Figure 1. This spawns the hidden embedded malicious LNK file in the document. Overall, this is a more effective phishing tactic since the malicious content is embedded in the document content rather than packaged in the OLE object
MITRE ATT&CK techniques:
- T1497.002: Virtualization/Sandbox Evasion - User Activity Based Checks
Threat description: The sample checks that the machine is domain joined and retrieves the domain name before execution continues. A userID is generated by computing the MD5 of a network interface MAC address that is up and not a loopback device, the domain name, and the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: The campaigns use a TrickBot downloader that is signed and uses an icon to pretend it is a Microsoft Word document. To avoid suspicion, the decoy message suggests the user should update Microsoft Word or open the file from another computer
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Sakula also leverages single-byte XOR encoding to obfuscate various strings and files embedded in the resource section, which are subsequently used for User Account Control (UAC) bypass on both 32 and 64-bit systems. Analysis . CTU researchers performed detailed analysis on 346 Sakula samples, including the installer and all dropped files used by the malware to run. Source: Dell SecureWorks) . Installation . In most of the samples collected by the CTU research team, Sakula maintains persistence by setting the registry Run key (SOFTWARE\Microsoft\Windows\CurrentVersion\Run\) in either the HKLM or HKCU hive. In the samples compiled in 2014, the adversary switched to adding the Run key by invoking cmd.exe: The registry value and filename vary by sample. Three of the analyzed samples placed files in %APPDATA%, while the remaining Sakula samples placed files in a directory under %ALLUSERSPROFILE%. A small number of samples did not use an additional subdirectory. The msi.dll file is configured to read and XOR-decode setup.msi, also located in the same directory, and run it in memory. Based on whether the compromised system is 32-bit or 64-bit, the appropriate file is written and run using cmd.exe calling rundll32 on the DLL with the PlayWin32 or PlayWin64 export. Center509671.dat). In a small group of Sakula samples from 2013, the install process also modified the hosts file to point some of the victim's subdomains to various IP addresses within the victim's own organization. The malware also registered a file as a command component within the registry. In the Sakula samples where the install process performed cleanup, the malware invoked cmd.exe
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: The data found within this file is encrypted using a single-byte xor key of 0x41. The file header structure, with the underlying data still encrypted, can be seen below
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Since version 0.2.6 This function creates a Kerberos ticket with given user details and server (usually AZUREADSSOACC) password. Uses only user’s SID and server password
MITRE ATT&CK techniques:
- T1558.002: Steal or Forge Kerberos Tickets - Silver Ticket
Threat description: After the anti-analysis checks are complete, the loader starts preparing the infected environment for the downloading of additional payloads. There are 3 download attempts (and thus 3 GET requests trailing by a different numeric ID), the payloads are downloaded subsequently to the user’s %temp% folder
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: In 2018, CTU researchers observed several GOLD KINGSWOOD campaigns involving SpicyOmelette, a tool used by the group during initial exploitation of an organization. This sophisticated JavaScript remote access tool is generally delivered via phishing, and it uses multiple defense evasion techniques to hinder prevention and detection activities. GOLD KINGSWOOD delivered SpicyOmelette through a phishing email containing a shortened link that appeared to be a PDF document attachment. When clicked, the link used the Google AppEngine to redirect the system to a GOLD KINGSWOOD-controlled Amazon Web Services (AWS) URL that installed a signed JavaScript file, which was SpicyOmelette
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: Putty – can be leveraged by attackers for remote access, to exfiltrate data and send it back to attackers - PSExec – is a legitimate Microsoft tool that can be exploited by malicious actors and used for lateral movement across victim networks - SNScan – this tool can be used for network reconnaissance, to find other potential targets on victim networks - WinRAR – is an archiving tool that can be used to compress files (potentially to make them easier to send back to attackers) and also to extract files from zipped folders
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: For example, ORat uses a WMI event consumer to maintain its presence on a compromised host. The group also creates and maintains scheduled tasks to achieve this purpose
MITRE ATT&CK techniques:
- T1546.003: Event Triggered Execution - Windows Management Instrumentation Event Subscription
Threat description: Observed Clop samples try to kill several processes and services related to backups and security solutions. Clop also leverages Code Signing to evade detection
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: For instance, the character A would be represented by the two characters 41, which is the hexadecimal representation of that character. The run command (1) creates the process cmd.exe /c with the command parameters appended and will write the output of the command in hexadecimal format to the file %APPDATA%\tmpCa.vbs. The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(command prompt output)&gt; The upload command (2) writes data provided by the C2 to a specified file. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex("File Uploaded")&gt; The download command (3) reads the contents of a specified file and sends the data to the C2 server. If the file does not exist, the Trojan will send the C2 server a message &lt; File Not Found &gt; by sending the following URL: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex("&lt; File Not Found &gt;")&gt; If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class. The Trojan then gets the hexadecimal values of the compressed data and will replace the following hexadecimal values on each line with ASCII characters to further compressed the data
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: These events will run respectively at 15:30:40 and when the system uptime is between 300 and 400 seconds. The variable $HL39fjh contains the base64-encoded PowerShell command shown in Figure 2. It reads the Windows Registry key where the encrypted payload is stored, and contains the password and the salt needed to decrypt the payload
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: This transport library does not appear on disk in its PE format. It is maintained as encrypted resource 107 in the orchestrator module, then decrypted and loaded by the orchestrator directly into the memory of the target process. This C2 interaction module is independent, once started, it interacts with the orchestrator using its local named pipe
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Finally, OverWatch observed AQUATIC PANDA make multiple attempts at credential harvesting by dumping the memory of the LSASS process3 using living-off-the-land binaries rdrleakdiag.exe and cdump.exe — a renamed copy of createdump.exe. The threat actor used winRAR to compress the memory dump in preparation for exfiltration before attempting to cover their tracks by deleting all executables from the ProgramData and Windows\temp\ directories
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: The inclusion of both phone and IMSI numbers show the highly targeted nature of this cyber intrusion. If an SMS message contained either a phone number or an IMSI number that matched the predefined list, it was saved to a CSV file for later theft by the threat actor
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
- T1119: Automated Collection
Threat description: The program CrashReporter.exe is heavily obfuscated with the ADVObfuscation library, renamed “snowman” (Obfuscated Files or Information [T1027]). When run, it checks for the Maintain parameter and collects the victim’s host information (System Owner/User Discovery [T1033]), encrypts the collected information with a hardcoded XOR key before exfiltration, and sends the encrypted information to a C2 website (Exfiltration Over C2 Channel [T1041]). The program also creates a scheduled SYSTEM task, named JMTCrashReporter, which runs CrashReporter.exe with the Maintain parameter at any user’s login (Scheduled Task/Job: Scheduled Task [T1053.005
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: The function hashing algorithm is used to map a hash value of a given function name to its corresponding location in memory using a process known as Run-Time Dynamic Linking. Pre-computed hashes are passed to the hashing algorithm alongside the Windows library containing the related function name. Each function name within the library is hashed; when a match is found, its address is saved
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: As mentioned, the registry key (HKLM\SOFTWARE\Microsoft\DRM) is where the malicious payload is stored. In this case, this is the Pillowmint Trojan. Pillowmint is stored and compressed in the registry key
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: The ultimate goal of both Type A and B loaders is to de-obfuscate and load a Cobalt Strike Reflective Loader in memory. At the conclusion of the de-obfuscation process, both variants proceed to load the Reflective Loader in memory, which subsequently executes Cobalt Strike Beacon in memory
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
- T1140: Deobfuscate/Decode Files or Information
Threat description: The second module is used by the operators to execute an obfuscated PowerShell script, which contains a Meterpreter downloader widely known as “Tinymet“. This downloader, seen in past FIN7 campaigns, downloads a one-byte XOR-encrypted (eg. with the key equal to 0x50 or 0x51) piece of meterpreter shellcode to execute
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: This can potentially bypass application whitelisting since all processes spawned during the attack are legitimate Microsoft executables
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: IRON TWILIGHT’s email credential targeting system allows the threat group to target and exploit accounts for webmail services such as Gmail and Hotmail, as well as corporate email platforms that use webmail interfaces. When targeting email services that provide alternate methods to authenticate account access, such as Gmail’s use of OAuth, the threat actors may abuse this feature to maintain a persistent session with the compromised account
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: From these web shells, they launched reconnaissance commands, stole data, and dropped additional tools including portqry.exe, renamed cmd.exe, winrar, and the notorious hTran
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. 3) This file requires the target to attempt to open the .lnk file, which redirects the user to a Windows Scripting Component (.wsc) file, hosted on an adversary-controlled microblogging page. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs. 4) The .lnk file uses an embedded VBScript component to retrieve a decoy PDF file and a PowerShell script from the adversary-controlled web page
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: File hunting plugin: The most frequently used plugin, similar to one used in 2014. Often used to collect Office files from temporary internet history. Detailed survey plugin: Used to gather domain membership, processes/loaded modules, hardware enumeration, installed products, logical and mapped drive information. Evolution of earlier plugin used in 2014. Browser plugin: Used to steal browser history, stored passwords and sessions. Works with Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex. File listing plugin: Works on local or remote drives and can map additional paths when given credentials
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
Threat description: X-Session: 0"). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. The malware can be configured to use multiple network protocols to avoid network-based detection. DLL side loading is often used to maintain persistence on the compromised system. Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes. DLL side loading has been used to maintain persistence on the compromised system. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. The server-side component provides a simple graphical user interface for threat actors interacting with web shells. TG-3390 has used additional web shells containing similarly formatted passwords
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: After this registry change, ShowCompColor and ShowInfoTip keys are also modified to disable the display of compressed and encrypted NTFS files in color. This setting allows you to see compressed files in a blue color
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: After successfully exporting mail they wished to steal, the attacker would remove the evidence of the export request using Remove-MailboxExportRequest
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: Once executed, NavRAT will immediately leverage cmd.exe to perform a systeminfo and a tasklist check on the system it is running on while writing the output to a TMP file, once again attempting to hide within an AhnLab folder. Interestingly, the attacker has used the &gt;&gt; method to append to the file so there can be multiple outputs written to their single TMP file
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: We found four different trojaned binaries in use since July 2019. The 5kplayer, driver pack and Firefox trojanized software use a service to achieve persistence. The VPNpro trojanized application uses an AutoRun registry key, as mentioned in the publication released before July 2019. After that, it will check if ESET or BitDefender antivirus are installed before dropping the malware
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. Figure 2 shows the attackers' use of HTTrack, a free website copier program, to duplicate a legitimate website to use for their own malicious purposes. These examples highlight Transparent Tribe's heavy reliance on social engineering as a core TTP and the group's efforts to make their operations appear as legitimate as possible.Figure 2: Fake website cloned using HTTrack on May 29, 2020. Lures and targeting . Transparent Tribe uses a variety of themes in their lures that evolved over time. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. Figure 6: Transparent Tribe's spear-phishing email targeting defense personnel. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. Transparent Tribe also delivers malicious archives containing CrimsonRAT executables using various themes, including honeytraps. Conclusion . Transparent Tribe relies heavily on the use of maldocs to spread their Windows implants. Transparent Tribe uses generically themed content-hosting domains as well as malicious domains masquerading as legitimate defense-related websites
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: Once the macro collected all the information, it sends the data to the C2 server over an HTTP POST request
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: The main function within the ISMInjector assembly uses the Joiner module to construct the final payload and the Inner module to inject the final payload into a process. Figure 4 shows the ISMInjector’s main function that uses the two modules to carry out its injection process before exiting
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: The attackers manually send a command to the JS or C# component to drop and execute a batch file from one of their servers. That batch file writes a malicious INF file and supplies it as a parameter to the Microsoft utility cmstp.exe, which executes a remote scriptlet specified in the INF file. The remote scriptlet contains obfuscated JS code that drops an OCX file and executes it via regsvr32.exe
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: Almost exclusively, Unit 42 has seen the use of weaponized documents that require user execution. Only once in the last six months have we seen use of exploits to circumvent the need for the user to execute any part of the installation chain
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: The attacker created password-protected archives on the victims' OWA server so that they could be exfiltrated via a simple HTTP request
MITRE ATT&CK techniques:
- T1048.002: Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Threat description: This extreme level of variance was also applied to non-executable entities, such as WMI persistence filter name, WMI filter query, passwords used for 7-zip archives, and names of output log files. Camouflage and blending into the environment. ADFIND legit tool) were always renamed and placed in folders that mimicked existing programs and files already present on a machine. This blending was not just used for files, but for other elements. For example, WMI persistence filters were created with names and queries matching other scripts present in affected organizations. The firewall rules were also methodically removed after the network reconnaissance was completed. Lateral movement activities were never executed without preparation. To increase the likelihood that their activities remain undetected, the attackers first enumerated remote processes and services running on the target host and decided to move laterally only after disabling certain security services
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: For example, we recently disclosed the activities of one of those teams (dubbed Tsar team) surrounding the use of mobile malware. This team has previously launched campaigns targeting the United States and European intelligence communities, militaries, defense contractors, news organizations, NGOs and multilateral organizations. It has also targeted jihadists and rebels in Chechnya
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: ESET has recently discovered that the BlackEnergy trojan was recently used as a backdoor to deliver a destructive KillDisk component in attacks against Ukrainian news media companies and against the electrical power industry. In this blog, we provide details on the BlackEnergy samples ESET has detected in 2015, as well as the KillDisk components used in the attacks. Furthermore, we examine a previously unknown SSH backdoor that was also used as another channel of accessing the infected systems, in addition to BlackEnergy
MITRE ATT&CK techniques:
- T1133: External Remote Services
Threat description: Given this extended period, it is logical to assume that some credentials obtained by the threat actor would be rotated during normal business operations. To combat this, the threat actor periodically “refreshed” their credential set by performing credential theft activities in an already compromised environment. At one victim, CrowdStrike identified multiple instances of domain credential theft months apart, each time with a different credential theft technique
MITRE ATT&CK techniques:
- T1589.001: Gather Victim Identity Information - Credentials
Threat description: Case in point: Last week, we came across a worm (detected by Trend Micro as Worm.Win32.BLADABINDI.AA) that propagates through removable drives and installs a fileless version of the BLADABINDI backdoor
MITRE ATT&CK techniques:
- T1120: Peripheral Device Discovery
Threat description: The TrickBot modules used for discovery include networkdll and psfin. TrickBot downloads modules for collecting local system information and scouting the network, primarily part of the networkdll module. This module has a battery of command line, WMI and LDAP queries to gather information, and then exfiltrate the data to GRIM SPIDER for review. The psfin module has a similar purpose but specifically searches for financial and point-of-sales indicators
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
- T1047: Windows Management Instrumentation
- T1074: Data Staged
Threat description: OwaAuth is a web shell that is installed as an ISAPI filter on Exchange servers and shares characteristics with the ChinaChopper web shell. In addition to acting as a web shell, the malware captures and DES-encrypts credentials before writing the username and password to disk. The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
- T1056.001: Input Capture - Keylogging
Threat description: The macOS version of the malicious application is a DMG Installer that has a disk image format that Apple commonly uses to distribute software over the internet. The installer looks legitimate and has a valid digital signature from Sectigo (Obtain Capabilities: Digital Certificates [T1588.004]). It has very similar functionality to the Windows version
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: In this latest discovery by McAfee ATR, despite a short pause in similar operations, the Lazarus group targets crypto currency and financial organizations. Furthermore, we have observed an increased usage of limited data gathering modules to quickly identify targets for further attacks. This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: The malware also loads shellcode in an additional resource, MD5: a4808a329b071a1a37b8d03b1305b0cb, which contains the METALJACK payload. The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com. It then attempts to call out to the URL
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: The spreading technique observed by Anomali researchers is the same one used in previous campaigns. The malware in both previous and ongoing campaign assumes that it has root level access on the machine. Below are code snippets from the current campaign and the campaign reported by Unit 42, where the threat actor uses ssh keys and known hosts if they are available to infect other machines
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: GALLIUM predominantly uses widely available tools. In certain instances, GALLIUM has modified these tools to add additional functionality. However, it’s likely these modifications have been made to subvert antimalware solutions since much of the malware and tooling employed by GALLIUM is historic and is widely detected by security products. For example, QuarkBandit is a modified version of the widely used Gh0st RAT, an openly available remote access tool (RAT). Similarly, GALLIUM has made use of a modified version of the widely available Poison Ivy RAT. These RATs and the China Chopper web shell form the basis of GALLIUM’s toolkit for maintaining access to a victim network
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: For Linux Rabbit to establish a connection with the C2 server, it utilizes Tor hidden services to act as contact points to access a Tor gateway. The malware will randomly select one of the hidden services and then a Tor gateway to follow in order to establish an active C2 URL. The payload for the malware is then sent from the C2 server as an encoded URL parameter
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: ntlmrelayx.py: This script performs NTLM Relay Attacks, setting an SMB, HTTP, WCF and RAW Server and relaying credentials to many different protocols (SMB, HTTP, MSSQL, LDAP, IMAP, POP3, etc. The script can be used with predefined attacks that can be triggered when a connection is relayed (e.g. In this mode, for every connection relayed, it will be available to be used later on multiple times through a SOCKS proxy. karmaSMB.py: A SMB Server that answers specific file contents regardless of the SMB share and pathname specified. smbserver.py: A Python implementation of an SMB server
MITRE ATT&CK techniques:
- T1557.001: Adversary-in-the-Middle - LLMNR/NBT-NS Poisoning and SMB Relay
Threat description: Cisco Talos assesses with moderate confidence that a campaign we recently discovered called "BlackWater" is associated with suspected persistent threat actor MuddyWater. The findings outlined in this blog should help threat hunting teams identify MuddyWater's latest TTPs. In this latest activity, the threat actor first added an obfuscated Visual Basic for Applications (VBA) script to establish persistence as a registry key. Next, the script triggered a PowerShell stager, likely in an attempt to masquerade as a red-teaming tool rather than an advanced actor. The stager would then communicate with one actor-controlled server to obtain a component of the FruityC2 agent script, an open-source framework on GitHub, to further enumerate the host machine. This could allow the threat actor to monitor web logs and determine whether someone uninvolved in the campaign made a request to their server in an attempt to investigate the activity. Once the enumeration commands would run, the agent would communicate with a different C2 and send back the data in the URL field
MITRE ATT&CK techniques:
- T1104: Multi-Stage Channels
Threat description: 29],[30(link is external)] - During the STOLEN PENCIL operation in May 2018, Kimsuky used the GREASE malware. 32(link is external)] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Gather the list of all files names listed in the Recent Items folder i.e. Appdata%\Microsoft\Windows\Recent". - Gather all names of files listed in the Desktop folder of the current user. Gather names of all files and programs listed in the Taskbar i.e. Get Microsoft Version Number from the registry, specifically from reg key/value: HKEY_CLASSES_ROOT\Excel.Application\CurVer||Default. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\Software\Microsoft\Office\&lt;OfficeVersionNumber&gt;.0\Word\Security\VBAWarnings = 0x1
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Based on the use of the relatively unique PLAINTEE malware, the malware’s use of the same file paths on in each cluster, and the similar targeting, we have grouped these attacks together under the RANCOR campaign moniker. Interestingly, the delivery document borrowed a technique which was publicized in late 2017 as being used by the Sofacy threat actors, embedding the main malicious code in a EXIF metadata property of the document. By doing so, the main content of the macro itself (Figure 2) can be kept relatively simple, and the malicious’ codes small footprint can help enable evasion of automated detection mechanisms based on macro content
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: The QUADAGENT backdoors dropped onto the hosts were nearly identical to each other, with the only differences being the command and control server (C2) and randomized obfuscation. We were also able to locate a third delivery package of the QUADAGENT backdoor as reported by ClearSky Cyber Security. In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files. Its sole purpose here is to install the QUADAGENT backdoor and execute it. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files. Its sole purpose here is to install the QUADAGENT backdoor and execute it. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails. The wave against the government entity (June 26) also involved a simple PE file attachment (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) using the filename tafahom.exe. This PE was slightly different from the other attack, being compiled using the Microsoft .NET Framework instead of being generated via a bat2exe tool and containing a decoy dialog box as shown in Figure 1
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: 1) The printer vulnerability MS10-061 exploited by Stuxnet – using a special MOF file, executed on the attacked system using WMI
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: Endpoint Protection . Patchwork cyberespionage group expands targets from governments to wide range of industries . The Patchwork attack group has been targeting more than just government-associated organizations. Symantec Security Response has been actively monitoring Patchwork, also known as Dropping Elephant, which uses Chinese-themed content as bait to compromise its targets’ networks. A customized website with content related to the Chinese military . The malicious sites link to files hosted on different domains, which appear to be solely used for malicious purposes. The PowerPoint files appear to exploit the Microsoft Windows OLE Package Manager Remote Code Execution Vulnerability (CVE-2014-4114), which was used in the Sandworm attacks against American and European targets in October 2014. The rich text files typically attempt to exploit the Microsoft Office Memory Corruption Vulnerability (CVE-2015-1641), which was patched in April 2015. Users should manually remove any potential dropped files which would typically be named “sysvolinfo.exe”. Malicious Word .doc file Besides the .pps file, the threat actor uses rich text files to deliver the malware. While other researchers have reported that these files exploit CVE-2012-0158, Symantec has also observed CVE-2015-1641 being exploited to drop Backdoor.Steladok. As two file types are used to deliver two different payloads, there are likely multiple individuals or groups contributing to the malware development efforts. Mitigation Users should adhere to the following advice to prevent Patchwork’s attacks from succeeding: - Delete any suspicious-looking emails you receive, especially if they contain links or attachments. Spear-phishing emails are frequently used by cyberespionage attackers as a means of luring victims into opening malicious files
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: The configuration, along with downloaded plugins and all harvested data are stored in a custom database format inside a single file under the %TEMP% directory. The file name is hardcoded and obfuscated with XOR. The storage file is encrypted with AES-256 using a hardcoded key and is decrypted each time the malware needs to read or write it and re-encrypted after new data is added
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: After exfiltrating the files, the threat actor used web shell access on the staging server to delete the staged RAR archives and detach their network shares, likely to avoid detection
MITRE ATT&CK techniques:
- T1070.005: Indicator Removal - Network Share Connection Removal
Threat description: Targets common cloud applications such as web servers for initial access, using known vulnerabilities (“1-days”) – presumably those with a working exploit in the wild. Uses Windows container escape techniques to escape the container and gain code execution on the underlying node. Connects to its C2 server using the IRC protocol over the Tor network
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: Intelligence gathering and stealing information has generally been the motivation behind Cicada’s attacks in the past, and that would appear to be the case in this attack campaign too. We observed the attackers archiving some folders of interest in these attacks, including in one organization folders relating to human resources (HR), audit and expense data, and meeting memos
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: The macros are also responsible for achieving reboot persistence for the ObliqueRAT payloads. This is done by creating a shortcut (.url file extension) in the infected user's Startup directory. Malicious shortcut in the infected user's startup directory to execute ObliqueRAT on startup
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Shamoon creates the new malicious service MaintenaceSrv. It creates the service with the option Autostart (StartType: 2) and runs the service with its own process (ServiceType: 0x10
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: It will then resolve the current process’s PID and path to be used as script arguments, and proceeds to execute the script by running: /bin/sh -c ./update.sh &lt;process_id&gt; &lt;process_path
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater. MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East. The "Blackwater.bas" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer. The clear text version of the crf.txt file closely resembled the PowerShell agent that was previously used by the MuddyWater actors when they targeted Kurdish political groups and organizations in Turkey. The screenshot below shows the first few lines of the PowerShell trojan. Notably, a number of the PowerShell commands used to enumerate the host appear to be derived from a GitHub projected called FruityC2. rCecms=BlackWater". Notably, the trojanized document's macro was also called "BlackWater," and the value "BlackWater" was hard coded into the PowerShell script. Most of the PowerShell commands would call Windows Management Instrumentation (WMI) and then query the following information
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: The ‘jli.dll’ file acts as the first layer of the Ecipekac loader. This DLL file has a number of export functions; however, all of them refer to a similar function that carries the main loading feature
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: We believe the malware authors chose to send packets that look like legitimate DNS requests over UDP port 53 to avoid being blocked by firewalls. It is very common to whitelist DNS requests in firewall configurations because blocking them could disrupt name resolution
MITRE ATT&CK techniques:
- T1071.004: Application Layer Protocol - DNS
Threat description: At this point in the execution cycle, the FoggyWeb DLL is loaded into one or more application domains where the legitimate AD FS code is running. This means the backdoor code runs alongside the AD FS code with the same access and permissions as the AD FS application. Such access allows the FoggyWeb backdoor to directly interact with the AD FS codebase (that is, not an external disk-resident tool) and selectively invoke native AD FS methods needed to facilitate its malicious operations
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: The purpose of this malware is to allow the actors to download and execute an executable file, as well as download and run batch files to run commands on the end system
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Unwraps a DLL into memory and calls its one-and-only import using Reflective DLL injection. DLL information
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: netbook or inexpensive laptop - Raspberry Pi computer - Bash Bunny, a special tool for carrying out USB attacks
MITRE ATT&CK techniques:
- T1200: Hardware Additions
Threat description: To capture login credentials from all the previously listed websites, Javali monitors processes to find open browsers or custom banking applications. The most common web browsers thus monitored are Mozilla Firefox, Google Chrome, Internet Explorer and Microsoft Edge
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1057: Process Discovery