More About HYDSEVEN Adversary and Cryptocurrency
Channel: FIRST
Date: 12/02/2021

Nowadays, with the growing interest in cryptocurrency (Crypto Asset), cyber attacks targeting this vector are taking place actively. The cryptocurrency stealing scheme by directly compromising its entities infrastructure has been increased, with reported damage of US$882 million, it’s a huge amount of money that has been illegally stolen, a fact that can not be ignored in our history of cyber security industry. This adversary's attack is keep on occurring.

We will explain our published research*1 about the techniques used by adversary dubbed as "HYDSEVEN", an alleged group behind these attacks, that is under our investigation among several incidents reported since 2016. The steps of investigation described its intrusion chains, from several spear phishing with VBA macro tricks, the usage of downloaders and fake software installers, exploitation on vulnerabilities and even 0-days, up to the usage of RAT malware variants known as HYDSEVEN's NetWire and Ekoms/Mokes. This report is bottom-lining the TTP (Tools, Techniques, Procedures) and MITRE ATT&CK formulation from the threat sequence that can be used to mitigate this threat.

Additionally, we will disclose several new contents that are not covered in our previously published report, which are marked with NEW tags in the outline.

References: *1 https://www.lac.co.jp/english/report/2019/07/19_cec_01.html
--
Yoshihiro Ishikawa is a member of the Cyber Emergency Center of LAC., he has engaged in malware analysis and cyber threat intelligence. esp. Advanced Persistent Threat (APT) attacks. He was a speaker at APCERT, AVAR, botconf, HITCON. He is also currently positioned as the Program Committee member of Japan Security Analyst Conference hosted by JPCERT/CC in Japan