QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: This indicates that the attackers stole and modified a legitimate document from the compromised user account, crafted a malicious decoy Word macro document using this stolen document and sent it to the target recipient who might be expecting the email from the original account user before the real sender had time to send it
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1204: User Execution
Threat description: This is a classic RAT that can download, upload, execute commands on the victim host and, finally, perform keylogging
MITRE ATT&CK techniques:
- T1056: Input Capture
- T1105: Ingress Tool Transfer
Threat description: This is performed by checking if the following libraries are loaded on the victim machine.SbieDll.dll (sandboxie library)Dbghelp.dll (Microsoft debugging tools)Api_log.dll (threatAnalyzer / GFI SandBox)Dir_watch.dll (threatAnalyzer / GFI SandBox)We were able to uncover some other techniques used by this variant of ROKRAT to make analysis difficult, Group 123 used an anti-debugging technique related to NOP (No Operation).nop dword ptr [eax+eax+00h] is a 5 byte NOP
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: This log contains the external IP, the geographic location, the machine name, the time the machine was infected, as well as fields to be logged in the threat actor’s database
MITRE ATT&CK techniques:
- T1070: Indicator Removal
- T1124: System Time Discovery
Threat description: This plugin provides the attacker with the ability to both list files and download/upload files on the victim machine
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1083: File and Directory Discovery
Threat description: This shortcut file points to ‘C:\Windows\system32\rundll32.exe “%APPDATA%\cnagnt.dll”,Sd’    One of the exceptions to the installation routine above is in the event Symantec is detected
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Thread Name   Description    Key logger  Logs key strokes for configured processes and sends them to the command and control (C2) server    Form grabber  Monitors HTTP traffic for form data and sends it to the C2 server    POS monitor  Monitors for changes to logs stored in C:\NSB\Coalition\Logs and nsb.pos.client.log and sends parsed data to the C2 server    PST monitor  Searches recursively for newly created Outlook personal storage table (PST) files within user directories and sends them to the C2 server    HTTP proxy monitor  Monitors HTTP traffic for requests sent to HTTP proxies, saves the proxy address and credentials for future use
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
- T1090: Proxy
- T1071: Application Layer Protocol
- T1132: Data Encoding
- T1041: Exfiltration Over C2 Channel
Threat description: Threat actor using appcmd to delete logs and disable logging
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1070.004: Indicator Removal - File Deletion
Threat description: To create the scheduled task, the PowerShell payload starts by writing the following to a VBScript file with the same name as the task name  (ex
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: To install the payload, the script will create a file %APPDATA%\OneDrive.bat and save the following string to it: powershell.exe -WindowStyle Hidden -exec bypass  -File “%APPDATA%\OneDrive.ps1” The script then writes a modified copy of itself to %APPDATA%\OneDrive.ps1, with the code that performs this installation omitted
MITRE ATT&CK techniques:
- T1064: Scripting
- T1036: Masquerading
Threat description: To set up persistence, the loader creates a folder named “c:\temp”, sets its attributes to be a hidden and system folder to hide the folder from view in Windows Explorer
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Tweets by second account @dookhtegan1 providing a Telegram channel with the leaked files Data Dump Contents The contents of the data dump includes various types of datasets that appear to be results from reconnaissance activity, initial compromises, and tools the OilRig operators use against target organizations
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
- T1041: Exfiltration Over C2 Channel
Threat description: Unpacking routine for SWF exploit The exploit is a memory corruption vulnerability that exists in the “com.adobe.tvsdk.mediacore.BufferControlParameters” class.  If the exploit is successful, it will gain arbitrary read / write operations within memory, thus allowing it to execute a second stage shellcode
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1068: Exploitation for Privilege Escalation
Threat description: Upon execution, the “Windows Folder.exe” file copies itself to C:\Users\<username>\AppData\Roaming and creates a Windows shortcut (LNK) file in the victim’s Startup directory as a persistence mechanism
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Upon execution, this command extracted, decrypted, and executed the PowerShell backdoor payload stored in the HiveUploadTask text property of the RacTask class
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1140: Deobfuscate/Decode Files or Information
Threat description: Victims are targeted by watering hole attacks, and emails with links to malicious websites or with malicious attachments
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
- T1189: Drive-by Compromise
Threat description: Watch on Fox News: Hackers may use fake Netflix app to spy on users As users have become more attached to their mobile devices, they want everything on those devices
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1120: Peripheral Device Discovery
Threat description: We are still analyzing this Trojan to determine the specific structure of the data sent between the Trojan and the C2 server; however, it does appear that the Trojan is using the RC4 algorithm to encrypt data sent to the C2 server within HTTP POST requests
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1041: Exfiltration Over C2 Channel
Threat description: We are unsure of the shellcode hosted at this URL, but it is possible that additional shellcode-based payloads like Meterpreter could have been served by this shellcode
MITRE ATT&CK techniques:
- T1064: Scripting
- T1105: Ingress Tool Transfer
Threat description: We determined this by following the process in which the TwoFace++ loader webshell uses the actor provided password to authenticate and decrypt the embedded webshell:  Append a string to the password that acts as a salt Obtain the SHA1 hash of the resulting string containing the password and salt Base64 encode the SHA1 hash Compare the encoded hash with hardcoded base64 string If the encoded hash matches hardcoded base64 string then the inbound request is authenticated Generates the SHA256 hash of the password string Base64 encodes the SHA256 hash and uses the first 24 characters as a key Uses 24-character key and the 3DES cipher to decrypt the embedded webshell  Now let’s look at how this works with the values in the TwoFace++ loader sample
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1027: Obfuscated Files or Information
- T1550.002: Use Alternate Authentication Material - Pass the Hash
- T1132: Data Encoding
- T1140: Deobfuscate/Decode Files or Information
Threat description: We found two obfuscation techniques applied to the script: the first one changing the representation of variables; the second one changing the representation of strings in the script
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1027: Obfuscated Files or Information
Threat description: We have gathered three samples of the default loader associated with this group and extracted the following configurations:    SHA256 of Sample Configuration   82779504d3fa0ffc8506ab69de9cb4d8f6415adbb11a9b8312828c539cf10190 LAUNCHER_ARGS=[‘–host’, ‘www1.chrome-up[.]date:4443’, ‘-t’, ‘obfs3’]   db453b8de1a01a3e4d963847c0a0a45fb7e1a9b9e6d291c8883c74019f2fc91f LAUNCHER_ARGS=[‘–host’, ‘www1.chrome-up[.]date:4443’, ‘-t’, ‘obfs3’]   7e57e35f8fce0efc3b944a7545736fa419e9888514fcd9e098c883b8d85e7e73 LAUNCHER_ARGS=[‘–host’, ‘139.59.46[.]154:3543’, ‘-t’, ‘obfs3’]      These configurations show that this group uses both fully-qualified domain names and IP addresses to host their Pupy C2 servers
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1008: Fallback Channels
- T1102: Web Service
Threat description: We have observed the following capabilities of this payload:  Get drive information Read files Write files Delete files Move files Spawn processes Create directories   Reaver TCP Payload The malicious CPL payload of Reaver has the following three exported functions:  ServiceMain CPlApplet DllEntryPoint  When the malware is initially loaded, DllEntryPoint will be called, which in turn will call a function that is responsible for decompressing a blob of data
MITRE ATT&CK techniques:
- T1005: Data from Local System
- T1083: File and Directory Discovery
- T1070.004: Indicator Removal - File Deletion
Threat description: We observed the threat group issue the following commands:  @echo off    dir c:\ >> %temp%\download    ipconfig /all >> %temp%\download    net user >> %temp%\download    net user /domain >> %temp%\download    ver >> %temp%\download    del %0    @echo off    dir "c:\Documents and Settings" >> %temp%\download    dir "c:\Program Files\    " >> %temp%\download    net start >> %temp%\download    net localgroup administrator >> %temp%\download    netstat -ano >> %temp%\download   These commands allow the threat group to gain information about the compromised computer and the network to which it belongs
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1007: System Service Discovery
- T1105: Ingress Tool Transfer
Threat description: We’ve seen two onion addresses used in different samples:  g5wcesdfjzne7255.onion (Down) r2elajikcosf7zee.onion (Alive at time of writing)  The HTTP resource always starts with /api/osx/ and contains actions such as:  /api/osx/started to report the bot has just started /api/osx/keychain to exfiltrate the content of the keychain /api/osx/get_task?bot_id={botid}&version={version} to request a task (described below) /api/osx/cmd_executed to report a the output of a command that was executed /api/osx/task_complete?bot_id={botid}&task_id={taskid} to report a task was completed  HTTP POST content has two fields: bot_id and data
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1106: Native API
Threat description: When communicating with its C2 server, the downloaders use multiple protocols, specifically HTTPS, HTTP or DNS, each of which provide a fallback channel in that order
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
Threat description: When comparing the provided timestamps of the delivery documents to the timestamps for the remote template documents from Table 2, we find that the time to attack is directly correlated to the last time the templates are modified
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
- T1124: System Time Discovery
Threat description: When executed, the .NET Framework wrapper will first check if VMware tools is running in background, this is done via a simple process check, searching for any process named “vmtoolsd.” Provided there are no matching processes running, the malware continues execution, creating a registry entry with the name ‘MSASCuiLTasks’ in HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce for persistence
MITRE ATT&CK techniques:
- T1057: Process Discovery
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: When generating the URL for the HTTP requests issued to the C2 server, the Trojan chooses a random folder from the following to include within the URL path: watch/? search/? find/? results/? open/? search/? close/? XAgent also will choose several parameters names from the following list when finishing the construction of the C2 URL: itwm= text= from=
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1083: File and Directory Discovery
Threat description: When one PlugX succeeds to infect a host, it then accesses to every IP address in the local network one-by-one and communicate with any connectable nodes, using one of the following protocols listed in Table 2
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1008: Fallback Channels
Threat description: When the actor modifies the file and changes the modification_time, the Trojan downloads the contents from the file by creating an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <file identifier in ‘f_id’> + “?alt=media” The Trojan processes the downloaded data within the file the same way it would to obtain a job from data received from the DNS tunneling channel using the TXT query mode, specifically by searching the data using the following regular expression: ([^r-v\\s]+)[r-v]([\\w\\d+\\/=]+).(<domainList[0]>|<domainList[1]>|<domainList[n]>) The Trojan function splits the matching data, specifically the subdomain on a separator that is a character between r and v and uses the data before the separator to get the sequence number and a Boolean value (0 or 1) if more data is expected
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
- T1074: Data Staged
- T1486: Data Encrypted for Impact
- T1041: Exfiltration Over C2 Channel
Threat description: While the seller specifies that HawkEye Reborn should only be used on systems with permission, they also explicitly forbid scanning of HawkEye Reborn executables using antivirus software, likely an attempt to minimize the likelihood that anti-malware solutions will detect HawkEye Reborn binaries.Following these changes, the new developer of HawkEye Reborn has continued to make changes and we expect this to continue as long as the developer can monetize their efforts.As with other malware that we wrote about last year, while the developer claims that the software should only be used on systems with permission, or "for educational purposes," malicious attackers have been continuously leveraging it against various targets around the world.Distribution campaignsFor several months during the last half of 2018 and continuing into 2019, Cisco Talos has observed ongoing malicious email campaigns that are being used to distribute versions of the HawkEye Reborn keylogger/stealer
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1018: Remote System Discovery
Threat description: Year  Country  Industry  Malware  2014  Vietnam  Network Security  WINDSHIELD  2014  Germany  Manufacturing  WINDSHIELD  2015  Vietnam  Media  WINDSHIELD  2016  Philippines  Consumer products  KOMPROGO WINDSHIELD SOUNDBITE BEACON   2016  Vietnam  Banking  WINDSHIELD  2016  Philippines  Technology Infrastructure  WINDSHIELD  2016  China  Hospitality  WINDSHIELD  2016  Vietnam  Media  WINDSHIELD  2016  United States  Consumer Products  WINDSHIELD PHOREAL BEACON SOUNDBITE  Table 1: APT32 Private Sector Targeting Identified by FireEye APT32 Interest in Political Influence and Foreign Governments In addition to focused targeting of the private sector with ties to Vietnam, APT32 has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: استطلاع.docx https://0utl00k[.]net/docs    Table 1 Additional DarkHydrus Word documents used to steal credentials Both of these related documents use the attachedTemplate technique to steal credentials by sending them to a URL https://0utl00k[.]net/docs
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: The command processing function starts by substituting the main module name and path in the hosting process PEB, with the one of the default internet browser. The path of the main browser of the workstation is obtained by reading the registry value
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Along the way, HermeticWiper’s more mundane operations provide us with further IOCs to monitor for. These include the momentary creation of the abused driver as well as a system service. It also modifies several registry keys, including setting the SYSTEM\CurrentControlSet\Control\CrashControl CrashDumpEnabled key to 0, effectively disabling crash dumps before the abused driver’s execution starts
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: These Microsoft Office templates are hosted on a command and control server and the downloaded link is embedded in the first stage malicious document
MITRE ATT&CK techniques:
- T1584.004: Compromise Infrastructure - Server
Threat description: Additionally, the IP 211[.]72 [.]242[.]120 is one of the hosts for the domain microsoftmse[.]com, which has been used by several KIVARS variants
MITRE ATT&CK techniques:
- T1113: Screen Capture
- T1056.001: Input Capture - Keylogging
Threat description: When communicating with its C2 server, Psylo will use HTTPS with a unique user-agent of (notice the lack of a space between "5.0" and "(Windows
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: We attribute this activity to TEMP.Zagros (reported by Palo Alto Networks and Trend Micro as MuddyWater), an Iran-nexus actor that has been active since at least May 2017. This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia. When successfully executed, the malicious documents install a backdoor we track as POWERSTATS
MITRE ATT&CK techniques:
- T1218.005: System Binary Proxy Execution - Mshta
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: dlpumgr32.exe, a legitimate signed file that belongs to the DESlock+ product - DLPPREM32.DLL, a malicious DLL sideloaded by dlpumgr32.exe that loads and decodes DLPPREM32.bin - DLPPREM32.bin, a shellcode that decompresses and loads a launcher in memory - data.res, an encrypted file decoded by the launcher and contains two SysUpdate versions: one for a 32-bit architecture and another for a 64-bit architecture - config.res, an encrypted file decoded by the launcher and contains the SysUpdate configuration, such as the command-and-control (C&amp;C) address
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1027: Obfuscated Files or Information
Threat description: The malware has specific features that allow the attackers to perform operations related to online banking transactions, password stealing and clipboard monitoring. We also found various versions of the payload: the version focused on stealing data from victims in Brazil is typically unpacked, while the versions targeting banks in Chile and Mexico are packed with VMProtect or Themida
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: The size of the image is more than 600KB and embedded in it is the encrypted IcedID main module. The encryption algorithm is RC4 and the keys are also embedded in the image at specific offset
MITRE ATT&CK techniques:
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: It is worth noting that in 2019, this actor used a fake file extension (*.png) for the MSI binary hosted on the attacker-controlled GitHub account
MITRE ATT&CK techniques:
- T1583.006: Acquire Infrastructure - Web Services
Threat description: While Kimsuky is very active, the KONNI RAT has also been upgraded to a more evasive piece of malware
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: This will also force the victim to re-open the browser using the newly written .lnk file, which is now loaded with Grandoreiro’s malicious extension. This extension will load on every browser startup using this specific .lnk file
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Endpoint Protection . The Trojan.Hydraq Incident . It has been about a week since news of the mysterious Hydraq Trojan (also known as Aurora) attack broke with the unveiling of a threat by Google to pull its operations out of China. Although concrete details of the attacks are not yet public, Google made reference to a number of Gmail accounts that were compromised during or after the attacks. Anatomy of the Attack For a number of years targeted attacks have nearly always followed the same modus operandi. In the more sophisticated attacks, the attacker will use a new zero day vulnerability, as obviously this will have a greater success rate. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. The number of computers we have observed being attacked or have been attacked is low as borne out by our field detection statistics. Prevention &amp; Mitigation Trojan.Hydraq has been known to be spread through specially crafted PDF files and also through malicious Web sites
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: For each enumeration, it performs a breadth-first search to wipe the files in the logical drive while ignoring files located in the "%HOMEDRIVE%\Windows" directory. It also only wipes files that have specific file extensions
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: It is distributed as a set of scripts and encrypted files and utilizes a PowerShell loader based on the Invoke-ReflectivePEInjection PowerSploit module to decode and inject the final payload DLL into memory
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
- T1027: Obfuscated Files or Information
Threat description: Registry traversal for Putty data exfiltration (left), code showing hostname, username and Private Key Files (right
MITRE ATT&CK techniques:
- T1552.002: Unsecured Credentials - Credentials in Registry
Threat description: One interesting thing to note is that the Keybase account used by the attacker to chat with their victims has the same logo of the Pay2Key EOSIO smart contract system
MITRE ATT&CK techniques:
- T1585: Establish Accounts
Threat description: The LNK file contains a list of commands that will be executed upon running, and a blob that is a base64 encoded compressed payload
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Fourth, this Darkhotel event is not based on the network protocol C2, but based on a custom file transfer control instruction
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: When PowerShell is invoked whether via WMI, wscript.exe, or mshta.exe, it executes a one-liner PowerShell code (as outlined above) that reads the encoded text file dropped in ProgramData and then decodes it. The resulting code has multiple layers of obfuscation
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
- T1218.005: System Binary Proxy Execution - Mshta
- T1027: Obfuscated Files or Information
- T1559.001: Inter-Process Communication - Component Object Model
Threat description: The threat used valid accounts against remote services: Cloud-based applications utilizing federated authentication protocols. Our incident responders analysed the credentials used by the adversary and the traces of the intrusion in log files. They uncovered an obvious overlap in the credentials used by this threat and the presence of those same accounts in previously breached databases. Besides that, the traces in log files showed more than usual login attempts with a username formatted as email address, e.g. username&gt;@&lt;email domain&gt;. While usernames for legitimate logins at the victim’s network were generally formatted like &lt;domain&gt;\&lt;username&gt;. And attempted logins came from a relative small set of IP-addresses
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1133: External Remote Services
Threat description: CookieMiner reports all the wallet-related file paths to its remote server so it can later upload the files according to the C2 commands. These files usually include private keys of cryptocurrency wallets. If the victims use iTunes to backup files from iPhone to Mac (can be via Wi-Fi), their iPhone text messages (SMSFILE) will also be retrieved by the attackers (Figure 5
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: The JavaScript component is the first stage of the attack and can deploy other malware such as a C# spy component, Golden Chickens components or several Python-based tools. The name Evilnum was given to the C# component by other researchers in the past, but the JS component also has been referred to as Evilnum. We have named the group Evilnum as that is the name of their flagship malware, and we’ll refer to the various malware pieces as components
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: But Ryuk isn’t new to us… we’ve been tracking it for years. More important than just looking at Ryuk ransomware itself, though, is looking at the operators behind it and their tactics, techniques, and procedures (TTPs)—especially those used before they encrypt any data. The operators of Ryuk ransomware are known by different names in the community, including “WIZARD SPIDER,” “UNC1878,” and “Team9. The malware they use has included TrickBot, Anchor, Bazar, Ryuk, and others
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
- T1018: Remote System Discovery
Threat description: We were able to collect over fifty samples of the tools used by the Magic Hound campaign using the AutoFocus threat intelligence tool. The earliest malware sample we were able to collect had a compile timestamp in May 2016. The samples themselves ranged from IRC bots, an open source Python remote access tool, malicious macros, and others
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: From the attacks observed by Volexity, what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks. Volexity has also found that, in addition to sending malware lures, the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages. Strangely, in one case, the threat actors also appear to have used a domain name similar to the Foreign Policy Research Institute (FPRI) in a message purporting to be from CFR. If the exploit is successful, the threat actors will attempt to drop and execute QuasarRAT. Its called the "packager trick" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\Users\%username%\AppData\Local\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious "scriptlet" file, or .sct file, which is also embedded in the malicious RTF document. The contents of the malicious scriptlet file (displayed below) clearly show the threat actor executing the initial "qrat.exe" dropper from the current user's %tmp% directory. The file, named Microsoft.Win32.TaskScheduler.dll, is digitally signed by a certificate from AirVPN. Conclusion . The addition of US-based think tanks to the list of organizations in the crosshairs of Patchwork shows an increasing diversity in the geographic regions being targeted. Volexity is actively tracking this group and the infrastructure currently in use for the benefit of its network security monitoring and threat intelligence customers
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: Apply the Microsoft security updates for MS17-010, including the updates for the Windows XP and Windows Server 2003 legacy operating systems. Disable SMBv1 on systems where it is not necessary (e.g. hosts that do not need to communicate with Windows XP and Windows 2000 systems). Carefully evaluate the need for allowing SMBv1-capable systems on interconnected networks compared to the associated risks. Scan networks for the presence of the DoublePulsar backdoor using plugins for tools such as Nmap. Use network auditing tools to scan networks for hosts that are vulnerable to the vulnerabilities described in MS17-010. Implement a backup strategy that includes storing data using offline backup media. Backups to locally connected, network-attached, or cloud-based storage are often insufficient because ransomware frequently accesses and encrypts files stored on these systems
MITRE ATT&CK techniques:
- T1490: Inhibit System Recovery
Threat description: SUPERNOVA is implemented as a modification to the existing ‘app_web_logoimagehandler.ashx.b6031896.dll’ module of the SolarWinds Orion application. The purpose of this module, in it’s legitimate form, is to return the logo image configured by the user to various web pages of the SolarWinds Orion web application. In legitimate operation, this class only contains the ProcessRequest() and LogoImageHandler() methods, a private static Log object, and public boolean parameter IsReusable
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: AgentTesla is a .Net-based infostealer that has the capability to steal data from different applications on victim machines, such as browsers, FTP clients, and file downloaders. One of the new modules that has been added to this malware is the capability to steal WiFi profiles
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
Threat description: TA551 has distributed different families of malware, including Ursnif (Gozi/ISFB), Valak and IcedID. TA551 malspam spoofs legitimate email chains based on data retrieved from previously infected Windows hosts. This is a generic statement asking the recipient to open an attached ZIP archive using the supplied password. For example, if the spoofed sender is someone@companyname.com, the ZIP attachment would be named companyname.zip. In 2020, we also started seeing emails with info.zip or request.zip as the attached ZIP archive names. These password-protected ZIP attachments contain a Word document with macros to install malware. File names for the extracted Word documents follow noticeable patterns that have evolved as this campaign has progressed. URLs generated by the associated Word macros also follow noticeable patterns that have also evolved as this campaign has progressed
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: The plugins are variously designed to load other tools like Mimikatz or Carbanak, retrieve information from the victim machine, take screenshots, harvest credentials, retrieve browser histories, and more
MITRE ATT&CK techniques:
- T1217: Browser Information Discovery
Threat description: During our analysis, we successfully extracted the command line argument to execute its payload. The following command is used to execute the payload
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: When receiving HTTP commands, the WellMess server is setup to receive POST requests that contain RC6 encrypted cookies. The server decrypts the cookies using a hardcoded RC6 key and expects the decrypted data to contain no more than four tags
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
- T1140: Deobfuscate/Decode Files or Information
Threat description: Despite the notion that modern cybersecurity protocols have stopped email-based attacks, email continues to be one of the primary attack vectors for malicious actors — both for widespread and targeted operations. Recently, Cisco Talos has observed numerous email-based attacks that are spreading malware to users at both a large and small scale. In this blog post, we analyze several of those campaigns and their tactics, techniques and procedures (TTPs). These campaigns were all observed between mid-May and early July of this year, and can likely be attributed to one, or possibly two, groups. The attacks have become more sophisticated, and have evolved to evade detection on a continual basis. Other researchers have attributed these attacks to a group known as the Cobalt Gang, which has continued its activities even after the arrest of its alleged leader in Spain this year. Simple campaigns typically use a single technique and often embed the final executable payload into the exploit document. The emails either contain a URL pointing to one of the three document types or have initial attack stages attached outright
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: IcedID uses TLS in all of its communication but the certificate is self-signed. They can be spotted, as they use this kind of a self-signed certificate. The keyword “Internet Widgits Pty Ltd” is also being used by Trickbot, another banking malware, and it is believed that Trickbot and IcedID are cousins
MITRE ATT&CK techniques:
- T1185: Browser Session Hijacking
- T1573.002: Encrypted Channel - Asymmetric Cryptography
Threat description: In December 2019, another version of the AppleJeus malware was identified on Twitter by a cybersecurity company based on many similarities to the original AppleJeus malware. In contrast, open-source reporting stated that the Windows version might have been downloaded via instant messaging service Telegram, as it was found in a “Telegram Downloads” folder on an unnamed victim
MITRE ATT&CK techniques:
- T1566.002: Phishing - Spearphishing Link
Threat description: PowerSploit can be used as a tool for the discovery of stored credentials. Specifically it supports the following modules which will check for credentials encrypted or plain-text in various files and in the registry
MITRE ATT&CK techniques:
- T1552.002: Unsecured Credentials - Credentials in Registry
Threat description: MegaCortex v1 was executed manually by threat actors using a separate batch file to kill security processes and stop/disable services related to security, backup and shadow copies. That same batch file was subsequently used to execute the MegaCortex binary with a Base64 key as a command-line argument
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1489: Service Stop
Threat description: Capable of stealing documents sent to the printer queue. Data gathered for victim recon includes the backup list for Apple mobile devices. Steals written CD images. Capable of stealing files previously seen on removable drives once they are available again. Steals Internet Explorer, Netscape Navigator, FireFox and RealNetworks cookies
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: The second family of Lazarus malware appearing in recent months has, as far as we are aware, received little to no analysis from researchers, possibly due to its targeted nature and a lack of ITW sightings
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: An uptick in activity from GRIM SPIDER, a subgroup of the criminal enterprise CrowdStrike Intelligence tracks as WIZARD SPIDER, has led to the identification of consistent actions employed to carry out their attacks. As part of their initial compromise — usually as a download from a spam email — they gain a foothold with their modular TrickBot malware, which was developed and is principally operated by WIZARD SPIDER. Once TrickBot is executed, new enumeration modules are downloaded onto the compromised machine to facilitate WIZARD SPIDER’s spread in search of credentials with the aim of gaining access to the domain controller. The criminal actors use RDP to perform lateral movement and explore the victim environment, with an end result of gaining access to the domain controller. Once this access has been achieved, GRIM SPIDER is able to deploy the Ryuk ransomware to the entire network
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
- T1204.002: User Execution - Malicious File
- T1071.001: Application Layer Protocol - Web Protocols
- T1041: Exfiltration Over C2 Channel
Threat description: Unlike recent variants of Mirai and Gafgyt that target vulnerable Linux systems via randomly generated IP addresses, Xbash also scans and trawls through domain names. The C&amp;C scans for specific destinations’ known vulnerabilities in Hadoop, Redis and ActiveMQ (CVE-2016-3088) for self-propagation. Hadoop’s unauthenticated command execution flaw discovered in October 2016, as well as the Redis arbitrary and remote command execution vulnerability disclosed in October 2015, have yet to be assigned CVE numbers. Based on the active C&amp;C traffic, it scans and probes for open TCP or UDP ports such as HTTP, VNC, MySQL/MariaDB, Telnet, FTP, MongoDB, RDP, ElasticSearch, Oracle Database, CouchDB, Rlogin and PostgreSQL. While the malware uses a weak username and password dictionary to brute force itself into the service, it is also able to update its set from the C&amp;C server, delete all the databases, and display the ransom message
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: We also analyzed further Gamaredon tools that have the ability to inject malicious macros and remote templates into existing Office documents. Tools linked to Gamaredon and discussed in this blogpost are detected as variants of MSIL/Pterodo, Win32/Pterodo or Win64/Pterodo by ESET’s products. Contrary to other APT groups, the Gamaredon group seems to make no effort in trying to stay under the radar. It also saves to disk the malicious OTM file (Outlook VBA project) that contains a macro, the malicious email attachment and, in some cases, a list of recipients that the emails should be sent to. Office macro injection module – CodeBuilder . We analyzed different variants of malicious modules used by the Gamaredon group to inject malicious macros or remote templates into documents already present on the compromised system. Module updates . Interestingly, some of the custom tools described in Palo Alto Networks’ 2017 blogpost on Gamaredon are still being updated and in use today. C# compiler module . This .NET executable, similar to many other tools used by the Gamaredon group, uses obfuscation techniques such as junk code insertion and string obfuscation. As with many other tools used by the Gamaredon group, they come in four different coding languages: C/C++, C#, batch file and VBScript. Quality of execution . We were able to collect numerous different samples of malicious scripts, executables and documents used by the Gamaredon group throughout their campaigns. Conclusion . Despite the simplicity of most of their tools, the Gamaredon group also is capable of deploying some novelty, such as their Outlook VBA module
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: b.wnry — Bitmap image used as desktop wallpaper (shown in Figure 2) - c.wnry — Configuration containing Tor command and control (C2) addresses, Bitcoin addresses, and other data - r.wnry — Ransom demand text - s.wnry — ZIP archive containing Tor software to be installed on the victim’s system; saved in TaskData directory - t.wnry — Encrypted DLL containing file-encryption functionality - u.wnry — Main module of the WCry ransomware “decryptor” - taskdl.exe — WNCRYT temporary file cleanup program - taskse.exe — Program that displays decryptor window to RDP sessions - msg — Directory containing Rich Text Format (RTF) ransom demands in multiple languages
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: CISA also observed the threat actor using open-source tools such as Plink and TightVNC for lateral movement. CISA observed the threat actor using the techniques identified in table 8 for lateral movement within the victim environment
MITRE ATT&CK techniques:
- T1021.004: Remote Services - SSH
- T1090: Proxy
- T1572: Protocol Tunneling
Threat description: In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor. Part of this blog post will discuss the updates and differences we have observed across multiple versions of this backdoor
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: H1N1 has self-propagation/lateral movement functionality (which requires user interaction) via mapped/available network shares or mounted USB devices
MITRE ATT&CK techniques:
- T1080: Taint Shared Content
Threat description: Another component of the KGH suite is the m.dll module, which is an information stealer that harvest data from browsers, Windows Credential Manager, WINSCP and mail clients
MITRE ATT&CK techniques:
- T1114.001: Email Collection - Local Email Collection
Threat description: Before the driver is loaded, the malware disables crash dump by setting the following registry key
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1562.006: Impair Defenses - Indicator Blocking
- T1070: Indicator Removal
Threat description: Conclusion Tick has left a trail of evidence indicating that its activity began as early as 2006. In earlier attacks, the group used malicious Microsoft Word documents to infect victims, with compromised websites being added to the mix as a more recent attack vector
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: Gathering system information and sending it to the control server. The system information gathered from the endpoint includes: MAC address of the endpoint Computer Name Product name from HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName This information is concatenated into a single string in the format: “MAC_Address||ComputerName||ProductName” and is sent to the control server - MAC address of the endpoint - Computer Name - Product name from HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName - This information is concatenated into a single string in the format: “MAC_Address||ComputerName||ProductName” and is sent to the control server - Recording HTTP requests from the control server to the temporary file prx in the implant’s install directory with the current system timestamp
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: Credential hopping for obscuring lateral movement - Office 365 (O365) Service Principal and Application hijacking, impersonation and manipulation - Stealing browser cookies for bypassing multifactor authentication - Use of the TrailBlazer implant and the Linux variant of GoldMax malware - Credential theft using Get-ADReplAccount
MITRE ATT&CK techniques:
- T1550.001: Use Alternate Authentication Material - Application Access Token
- T1078.002: Valid Accounts - Domain Accounts
Threat description: In the analyzed sample the RAT component was named “BotDLL[.]dll”. It has some typical RAT functionality such as command shell, video recording of the screen, remote desktop, port forwarding, and file system access
MITRE ATT&CK techniques:
- T1125: Video Capture
- T1005: Data from Local System
- T1090: Proxy
Threat description: This final cluster appears to serve as the C2 infrastructure for a custom remote administration tool called Pteranodon. It is capable of downloading and executing files, capturing screenshots and executing arbitrary commands on compromised systems
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: Shortly after this RTF document is opened, the remaining stages of the Inception malware are found executing on the system. The loader DLL is responsible for decrypting and injecting the core payload DLL into memory, from an encrypted file present on disk. The core payload DLL's main function is to gather system information, execute other malware in the form of plugins, and update itself
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: The NOKKI malware itself has been updated in the short period of time it has been observed, moving from FTP to HTTP for C2 operations. The malware is modular in nature, and based on analysis of the information gathering module, it is highly likely the NOKKI operators are the same as the KONNI operators
MITRE ATT&CK techniques:
- T1071.002: Application Layer Protocol - File Transfer Protocols
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: The network mode being set to the host along with the container trying to be deployed as a privileged container. The Docker Hub account of MegawebMaster has numerous public images, five of which have TeamTNT utilities with a significant amount of downloads. These five images include dockgeddon, docker, tornadopw, and dcounter (T1204.003
MITRE ATT&CK techniques:
- T1496: Resource Hijacking
Threat description: TeamTNT has also been spotted using a malicious Docker image which can be found on Docker Hub to infect its victims’ servers
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
- T1610: Deploy Container
Threat description: Even simple API calls were obfuscated, and instead of just calling the functions, Siloscape made the effort to use the Native API (NTAPI) version of the same function
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1106: Native API
Threat description: The DLL expects the export named 'Add' to be used when initially loaded. When this function is executed PLAINTEE executes the following command in a new process to add persistence
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: In this version, the communication protocol with the C&amp;C server was also upgraded to use AES encryption
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography