mrmoor/cyber-threat-intelligence huggingface dataset:
In the second half of 2017 Pawn Storm, an extremely active espionage actor group, didn’t shy away from continuing their brazen attacks.
We saw attacks against political organizations again in the second half of 2017.
In summer and fall of 2017, we observed Pawn Storm targeting several organizations with credential phishing and spear phishing attacks.
Pawn Storm’s modus operandi is quite consistent over the years, with some of their technical tricks being used repeatedly.
The method, which we first discussed in 2014, involves changing a browser tab to point to a phishing site after distracting the target.
The screenshots below show two typical credential phishing emails that targeted specific organizations in October and November 2017.
The other says there is a new file on the company’s OneDrive system.
Figure 1. A sample of a credential phishing email Pawn Storm sent in October and November 2017  Figure 2.
Second type of credential phishing email that was sent by Pawn Storm in November 2017.
The logo of the target organization has been removed from the screenshot and the color was changed as not to reveal the source.
We successfully prevented both attacks from causing any harm.
In one case we were able to warn the target within two hours after a dedicated credential phishing site was set up.
In an earlier attack, we were able to warn the organization 24 hours before the actual phishing emails were sent.
Olympic Wintersports Federations
Political targets
In the week of the 2017 presidential elections in Iran, Pawn Storm set up a phishing site targeting chmail.ir webmail users.
We were able to collect evidence that credential phishing emails were sent to chmail.ir users on May 18, 2017, just one day before the presidential elections in Iran.
Beginning in June 2017, phishing sites were set up mimicking the ADFS (Active Directory Federation Services) of the U.S. Senate.
By looking at the digital fingerprints of these phishing sites and comparing them with a large data set that spans almost five years, we can uniquely relate them to a couple of Pawn Storm incidents in 2016 and 2017.
The real ADFS server of the U.S. Senate is not reachable on the open internet, however phishing of users’ credentials on an ADFS server that is behind a firewall still makes sense.
In case an actor already has a foothold in an organization after compromising one user account, credential phishing could help him get closer to high profile users of interest.
The future of politically motivated campaigns Rogue political influence campaigns are not likely to go away in the near future.
This makes them vulnerable to hacking and spear phishing.
As we have mentioned in our overview paper on Pawn Storm, other actors may also start their own campaigns that aim to influence politics and issues of interest domestically and abroad.
In 2016, we published a report on C Major, an espionage group that primarily targets the Indian military.
With the Olympics and several significant global elections taking place in 2018, we can be sure Pawn Storm’s activities will continue.
Indicators of Compromise (IoCs):  adfs[.]senate[.]group adfs-senate[.]email adfs-senate[.]services adfs.senate[.]qov[.]info chmail.ir[.]udelivered[.]tk webmail-ibsf[.]org fil-luge[.]com biathlovvorld[.]com mail-ibu[.]eu fisski[.]ca iihf[.]eu         Tags  Malware | APT & Targeted Attacks | Endpoints | Research | Phishing | Network
Likewise, brute force attacks on internet-facing services like email, Microsoft Autodiscover, SMB, LDAP, and SQL are so common that they may seem like background noise that can be ignored.
The RATs were also sent to a wider net of targets including various industries around the world.
The group also performed widespread brute force attacks to steal credentials such as those of corporate email accounts, as evidenced by network probes we attribute to Pawn Storm and the loose way the actor abused compromised email accounts in malware and in sending spear-phishing emails.
Recently, Norwegian authorities announced that Pawn Storm hacked the Norwegian parliament through brute force attacks.
As shown in incremental improvements, subsequent versions of the malware hint towards a learning curve of the malware author that is more typical for an inexperienced actor than for an advanced actor.
This mistake was corrected swiftly, but it shows the relative inexperience of this particular Pawn Storm operator.
However, we have solid attribution for these samples based on our long-term monitoring of Pawn Storm’s activities.
Recap of recent Pawn Storm activities Compromising accounts of users from the Middle East Trend Micro has been closely and consistently monitoring the activities of Pawn Storm, and in March 2020, we released our latest research on the group.
In the aforementioned research paper, we shared that Pawn Storm heavily abuses compromised accounts — mainly in the Middle East — to send spear-phishing emails.
The abuse of compromised email accounts in the Middle East continued in 2020.
The group then logged in to a compromised email account of a chicken farm in Oman, and then sent out credential phishing spam messages to high-profile targets around the world.
Since August 2020, they didn’t use these email addresses to only send spear-phishing emails, but also as a way to communicate with compromised systems in IMAP RATs.
Brute force attacks
We think that Pawn Storm compromises lots of email accounts through brute force attacks on internet-facing services like email, LDAP, Microsoft Autodiscover, SMB, and SQL.
For example, in May 2020, Pawn Storm scanned IP addresses worldwide, including IP addresses from the defense industry in Europe, on TCP port 445 and 1433, likely in an attempt to find vulnerable SMB and SQL servers or brute force credentials.
In 2020, Pawn Storm often tries to obfuscate these brute force attempts by routing their attack traffic over Tor and VPN servers.
Yet this is not always enough to hide these activities.
In a Microsoft article about brute-forcing Office365 credentials over Tor, Microsoft attributed the activities to Strontium, which is another name for Pawn Storm.
We wrote about related attacks in early 2020.
These brute force attacks started in 2019, and then we could firmly attribute them to Pawn Storm because we could cross-relate the extensive probing of Microsoft Autodiscover servers around the world with high-confidence indicators of the group’s more traditional attack methods (spear phishing and credential phishing).
To illustrate the simplicity of the malware in Pawn Storm’s recent spear-phishing attacks, we describe one example below:
Technical analysis of Google Drive RAT       Figure 1. Spear phishing email from Pawn Storm – collected in August 2020.
Starting from August 2020, Pawn Storm has sent several spear phishing emails with a malicious RAR attachment.
Among the earliest samples we received were two almost identical RAR files that contained a file called info.exe.
We have: c4a61b581890f575ba0586cf6d7d7d3e0c7603ca40915833d6746326685282b7
installing  decrypt.exe – 661d4a0d877bac9b813769a85c01bce274a77b29ccbd4b71e5b92df3c425b93b gdrive.exe – cbd9cb7b69f864ce8bae983ececb7cf8627f9c17fdaba74bd39baa5cdf605f79  3fd45b9b33ff5b6363ba0013178572723b0a912deb8235a951aa3f0aa3142509 installing  decrypt.exe – 661d4a0d877bac9b813769a85c01bce274a77b29ccbd4b71e5b92df3c425b93b gdrive.exe – 2060f1e108f5feb5790320c38931e3dc6c7224edf925bf6f1840351578bbf9cc  Decoy File
Figures 2-3.
The message box that decrypt.exe displays
The different versions of gdrive.exe are almost identical, with a minor addition to the file 2060f1e108f5feb5790320c38931e3dc6c7224edf925bf6f1840351578bbf9cc of base64 encoding on the victim’s id.
It does this via cmd.exe with the following command:   move /Y  "{malware_location}"  "C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdrive.exe"  Every time the malware runs a command using cmd.exe, the standard output (STDOUT) of the executed command is piped and written to a Google Drive account with the following filename format:   {utcnow}_report_{victim’s id}       Figure 6.
Figures 7-8.
Receiving commands and data exfiltration Every 20 minutes, the bot checks for a file in Google Drive.
If a file with a corresponding filename format exist (cmd_{victim’s id})
waiting for commands
, the attacker can exfiltrate data/documents using the following commands:  powershell -command "[Convert]::ToBase64String([IO.File]::ReadAllBytes('{filename}')       Figure 11.
Code snippets showing the exfiltration of data     The secondary payload with the filename Google Drivemonitor.exe (0b94e123f6586967819fa247cdd58779b1120ef93fa1ea1de70dffc898054a09) is a keylogger.
Code snippets showing keylogs     This secondary payload does not have any function to upload the collected keystrokes back to the attacker.
Eventually, the threat actor added improvements to the malware, like encryption.
Later the actor started to use IMAP RATs as well.
Indicators of compromise IP addresses  IP address  Description  Dates active  34.243.239[.]199  Connects to email servers of compromised accounts.
IP address possibly compromised by Pawn Storm.  October 29, 2020 – December 8, 2020  74.208.228[.]186  Connects to email servers of compromised accounts.
IP address possibly compromised by Pawn Storm.
October 15, 2020 – December 14, 2020  193.56.28[.]25  Scans TCP port 445 and 1433  May 21 – May 26, 2020  195.191.235[.]155  Scans UDP port 389   August 22, 2020   Files  SHA256  Filename  Description  Trend Micro Pattern Detection  Trend Micro Machine Learning Detection  c4a61b581890f575ba0586cf6d7d7d3e0c7603ca40915833d6746326685282b7  info.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FSX005  3fd45b9b33ff5b6363ba0013178572723b0a912deb8235a951aa3f0aa3142509  info.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FSX005  cbd9cb7b69f864ce8bae983ececb7cf8627f9c17fdaba74bd39baa5cdf605f79  gdrive.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FFF039  2060f1e108f5feb5790320c38931e3dc6c7224edf925bf6f1840351578bbf9cc  gdrive.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FFF039  f364729450cb91b2a4c4e378c08e555137028c63480a221bb70e7e179a03f5cc  gdrive.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  N/A  e3894693eff6a2ae4fa8a8134b846c2acaf5649cd61e71b1139088d97e54236d  info.exe  IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FSX005  83fbd76d298253932aa3e3a9bc48c201fe0b7089f0a7803e68f41792c05c5279  decrypt_v2.4.exe  IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FSX005  fe00bd6fba209a347acf296887b10d2574c426fa962b6d4d94c34b384d15f0f1  email.exe
IMAP RAT  Trojan
MSIL.OCEANMAP.A
Troj.Win32.TRX.XXPE50FFF039  b61e0f68772f3557024325f3a05e4edb940dbbe380af00f3bdaaaeabda308e72  igmtSX.exe
IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj
.Win32.TRX.XXPE50FFF039  c8b6291fc7b6339d545cbfa99256e26de26fff5f928fef5157999d121fe46135
igmtSX.exe  IMAP RAT
Trojan.MSIL.OCEANMAP.A
Troj.Win32.TRX.XXPE50FFF039  50b000a7d61885591ba4ec9df1a0a223dbceb1ac2facafcef3d65c8cbbd64d46  email.exe
IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FFF039  3384a9ef3438bf5ec89f268000cc7c83f15e3cdf746d6a93945add300423f756  email.exe
.Win32.TRX.XXPE50FFF039
abf0c2538b2f9d38c98b422ea149983ca95819aa6ebdac97eae777ea8ba4ca8c
email.exe  IMAP RAT
Troj.Win32.TRX.XXPE50FFF039  faf8db358e5d3dbe2eb9968d8b19f595f45991d938427124161f5ed45ac958d5  email.exe
IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FFF039  4c1b8d070885e92d61b72dc9424d9b260046f83daf00d93d3121df9ed669a5f9  email.exe
770206424b8def9f6817991e9a5e88dc5bee0adb54fc7ec470b53c847154c22b  email.exe
IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FFF039  6fb2facdb906fc647ab96135ce2ca7434476fb4f87c097b83fd1dd4e045d4e47  email.exe
IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FFF039  31577308ac62fd29d3159118d1f552b28a56a9c039fef1d3337c9700a3773cbf
photos.exe  IMAP RAT
N/A  661d4a0d877bac9b813769a85c01bce274a77b29ccbd4b71e5b92df3c425b93b  decrypt.exe
N/A  0b94e123f6586967819fa247cdd58779b1120ef93fa1ea1de70dffc898054a09  Google Drivemonitor.exe  keylogger
TrojanSpy
The MuddyWater campaign was first sighted in 2017 when it targeted the Saudi government using an attack involving PowerShell scripts deployed via Microsoft Office Word macro.
In March 2018, we provided a detailed analysis of another campaign that bore the hallmarks of MuddyWater.
Like the previous campaigns, these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell (PS) scripts leading to a backdoor payload.
One notable difference in the analyzed samples is that they do not directly download the Visual Basic Script(VBS) and PowerShell component files, and instead encode all the scripts on the document itself.
Executing the malicious routine via Document_Open()
The code inside the BLUE box constructs the main Powershell commands and scripts.
Analysis of the code revealed a PowerShell script capable of decoding the contents of the malicious document, which results in the execution of yet another encoded PowerShell script.
The second encoded PowerShell script, which is executed after the first script is decoded This will then result in more readable PowerShell scripts capable of dropping various components in the %Application Data%\Microsoft\CLR\* directory.
The main PowerShell file invoker.ps1 uses these components to run the final payload, PRB-Backdoor, previously analyzed by other security researchers in May 2018.
Figure 7: The components dropped in the %Application Data%\Microsoft\CLR\* directory PRB-Backdoor is a backdoor that takes its name from the function used in the final PowerShell script payload, as seen in the figure below.  Figure 8.
The PS function from which PRB-Backdoor takes its name
PRB-CREATEALIVE Initializes connection with the C&C Server PRB-CREATEINTRODUCE
introduces the affected machine to the C&C server PRB-History
If these samples are indeed related to MuddyWater, this means that the threat actors behind MuddyWater are continuously evolving their tools and techniques to make them more effective and persistent.
Given the use of lure documents designed with social engineering in mind, it is likely that the attackers use phishing or spam to target users who are unaware of these documents' malicious nature.
Awareness can effectively mitigate or stop these kinds of attacks from being successful.
The first step is to be able to identify phishing attacks and distinguish legitimate emails from malicious ones.
Trend Micro™
Indicators of Compromise (IoCs) Detected as W2KM_DLOADR.UHAOEEN - 240b7d2825183226af634d3801713b0e0f409eb3e1e48e1d36c96d2b03d8836b        Tags  APT & Targeted Attacks | Endpoints | Research | Articles, News, Reports | Network
We discovered a potential targeted attack that makes use of legitimate script engine AutoHotkey, in combination with malicious script files.
The user would need to enable macro for it to open fully, which would use AutoHotkey in loading the malicious script file to avoid detection.
It will then enable the threat actors to steal certain information and even download TeamViewer to gain remote access to the system.
Connect to the C&C server every 10 seconds to download, save, and execute script files containing the commands.
Send the volume serial number of the C drive, which allows the attacker to identify the victim.
A partial code snippet of AutoHotkeyu32.ahk  Figure 5.
Further research uncovered other dropped files involved in this attack.
We have yet to conclude this attack's exact purpose.
For now, we can surmise that it has the makings of a potential targeted attack because of its cyber espionage capabilities, as well as the potential for delivering ransomware and coinminer.
Users should also take full advantage of their network defense solutions by enhancing settings, especially for macro malware attached emails.
Detection name Description EFE51C2453821310C7A34DCA3054021D0F6D453B7133C381D75E3140901EFD12 Military Financing.xlsm W2KM_HTV.ZKGD-A
Carries the malicious script and AutoHotkeyU32.ahk 43FBDA74A65668333727C6512562DB4F9E712CF1D5AD9DCA8F06AE51BB937BA2 hscreen.ahk TSPY_HTV.ZJGD-A Takes screen captures ACB3181D0408C908B2A434FC004BF24FB766D4CF68BF2978BC5653022F9F20BE AutoHotkeyU32.ahk BKDR_HTV.ZKGD-A Loads the malicious script BE6C6B0942AD441953B0ED0C4327B9DED8A94E836EACA070ACA3988BADB31858 hinfo.ahk TSPY_HTV.ZLGD-A Gets the computer name F64792324839F660B9BDFDA95501A568C076641CF08CE63C1DDBE29B45623AC0 htv.ahk
TROJ_HTV.ZJGD-A Downloads and executes TeamViewer   C&C 185[.]70[.]186[.]145
At the dawn of the Fourth of July weekend, Kaseya has been hit with a ransomware attack, as reported in the company’s own announcement.
Kaseya provides IT management software to mostly managed service providers (MSPs).
Thankfully Kaseya acted extremely quickly advising all Kaseya VSA on-premises users to shut down their servers until further instructions.
You don’t want to be one of the 50 who got hit by a ransomware.
For MSPs working with Trend Micro, we have a very positive news.
The ransomware was effectively blocked before the IOCs were added to our backend detection pattern.
You need to make sure your business is protected.
Act fast!
This offer ends September 30, 2021.
Just click the URL below for your region, sign up today for your free trial and allow us to help you protect your business.
This is an area we have invested in deeply for over a decade.
In the past, we’ve posted on issues like phishing campaigns, vulnerabilities and disinformation.
TAG tracks more than 270 targeted or government-backed groups from more than 50 countries.
We use the intelligence we gather to protect Google infrastructure as well as users targeted with malware or phishing.
We’ve had a long-standing policy to send users warnings if we detect that they are the subject of state-sponsored phishing attempts, and have posted periodically about these before.
From July to September 2019, we sent more than 12,000 warnings to users in 149 countries that they were targeted by government-backed attackers.
Over 90 percent of these users were targeted via “credential phishing emails” similar to the example below.
We encourage high-risk users—like journalists, human rights activists, and political campaigns—to enroll in our Advanced Protection Program (APP), which utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings.
APP is designed specifically for the highest-risk accounts.
In the simple phishing example below, an attacker has sent a phishing email with a security alert lure from “Goolge” suggesting the user secure their account.
Last week at CyberwarCon, we presented analysis about previously undisclosed campaigns from a Russia-nexus threat group called “Sandworm” (also known as “Iridium”).
Although much of Sandworm’s activity targeting Ukraine and their attacks against the 2018 Winter Olympics have been covered publicly, some campaigns have not been reported.
In December 2017, TAG discovered a series of campaigns from Sandworm attempting to deploy Android malware.
They then uploaded these modified apps to the Play Store using their own attacker-controlled developer accounts.
This application had approximately 1,000 total installs.
In November 2018, we saw evidence that Sandworm shifted from using attacker-controlled accounts to try and upload malicious apps to compromising legitimate developers.
Throughout November, Sandworm targeted software and mobile app developers in Ukraine via spear phishing emails with malicious attachments.
After compromising the developer, Sandworm built a backdoor in one of the legitimate apps and attempted to publish it on the Play Store.
The operations use inauthentic news outlets to disseminate messages promoting Russian interests in Africa.
Activity on Google services was limited, but we enforced across our products swiftly.
As organizations reeled from the Log4Shell vulnerability (CVE-2021-44228), cyberattacks aiming at open-source web servers, like Apache HTTP Server, were rapidly rising.
To protect enterprises against malicious activities, we need more than just timely patches.
Vulnerabilities of Apache HTTP Server have increased since 2017 Open-source web servers, especially Apache HTTP Server, have been heavily exploited in the past five years.
Compared to Nginx, another widely used open-source web server, Apache had the greatest increase in vulnerabilities over the past five years – particularly high-risk ones.
According to the Apache HTTP Server webpage, from 2012 to 2016 there were a total of 31 vulnerabilities found in the Apache HTTP Server.
However, from 2017 to 2021 the total vulnerabilities number surged to 57.
2021 alone accounted for 14 of those vulnerabilities, breaking a 17-year record high.
Before that, there were no vulnerabilities rated at this level.
Source: Apache HTTP Server Project
The most common types of attack include denial of service (DoS), path traversal, server-side request forgery (SSRF), and remote code execution (RCE).
Table 1: The 15 vulnerabilities weaponized since 2017  CVE ID cvss3 score Description CVE-2021-42013 9.8 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) CVE-2021-41773 7.5
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 CVE-2021-40438 9 mod_proxy SSRF CVE-2020-11984 9.8 mod_proxy_uwsgi buffer overflow CVE-2019-10098 6.1 mod_rewrite potential open redirect CVE-2019-10097 7.2 CVE-2019-10097 mod_remoteip Stack buffer overflow and NULL pointer dereference CVE-2019-0190 7.5 mod_ssl 2.4.37 remote DoS when used with OpenSSL 1.1.1 CVE-2018-8011 7.5 mod_md, DoS via Coredumps on specially crafted requests CVE-2018-1303 7.5 Possible out of bound read in mod_cache_socache CVE-2018-11763 5.9 DoS for HTTP/2 connections by continuous SETTINGS CVE-2017-9798 7.5 Use-after-free when using <Limit > with an unrecognized method in .htaccess ("OptionsBleed") CVE-2017-9788 9.1 Uninitialized memory reflection in mod_auth_digest CVE-2017-7668 9.8 ap_find_token()
Overread
CVE-2017-7659 7.5 mod_http2
Source: Apache HTTP Server Project, Trend Micro Inc., NVD CVE-2021-41773 and CVE-2021-42013, the two critical vulnerabilities, are perfect examples of how attackers exploit the vulnerabilities in the Apache HTTP Server.
As Trend Micro reported, these two are path traversal vulnerabilities that allow attackers to map URLs to files/directories outside of the webroot.
Schemes behind the attacks The attacks that target open-source web servers could lead to enormous threats.
Attackers can also install a phishing website on the victim server to gain access to any data that passes through it.
Major web service providers such as Slack, Linkedin, The New York Times, GrubHub, and more rely on Apache HTTP Server.
Furthermore, the complexity of the software supply chain nowadays exacerbates the abuse of open-source software vulnerabilities.
Cyber attackers could compromise software components of third-party suppliers by inserting malicious code inconspicuously.
Protect your web server against potential harm To mitigate the potential risk of attacks from open-source software, software composition analysis (SCA) has become an effective approach.
These tools can also check for legal issues regarding the use of open-source software with different licensing terms and conditions.
Assessing the criticality of those systems that contain those CVEs.
i.      Is a POC available ii.      Is it in the wild
Additional analysis and insights by Higashi Yuka and Chizuru Toyama REDBALDKNIGHT, also known as BRONZE BUTLER and Tick, is a cyberespionage group known to target Japanese organizations such as government agencies (including defense) as well as those in biotechnology, electronics manufacturing, and industrial chemistry.
Their campaigns employ the Daserf backdoor (detected by Trend Micro as BKDR_DASERF, otherwise known as Muirim and Nioupale) that has four main capabilities: execute shell commands, download and upload data, take screenshots, and log keystrokes.
Like many cyberespionage campaigns, REDBALDKNIGHT’s attacks are intermittent but drawn-out.
The specificity of their targets stems from the social engineering tactics used.