mrmoor/cyber-threat-intelligence huggingface dataset:
Cybercriminals have recently been focusing their efforts on the retail industry, launching ransomware-based attacks that could prove disastrous for businesses if it disrupts their operations during important shopping seasons.
A ransomware attack on a retailer could mean thousands of lost sales opportunities in the short-term, and serious damage to reputation in the long-term.
Perception of an “unsafe” business could turn customers towards competitors who can offer a better and more secure shopping experience.
What are your thoughts on the ransomware attacks on retailers as we approach the busiest times of the year for retailers, including Black Friday, Cyber Monday and the holiday season?
Share them in the comments below or follow me on Twitter to continue the conversation: @JonLClay.
Tags  Cloud | Malware | Expert Perspective | APT & Targeted Attacks | IoT | Ransomware |
One of the secrets of Trend Micro’s long-lasting success is being constantly on the lookout for where the next security threats might come from.
That’s why we’re focusing a great deal of our research and development efforts right now on the intersection of IT and operational technology (OT).
This burgeoning world of connected IoT devices is particularly advanced in the manufacturing space, where huge gains are already being made.
But as great as these leaps forward are, so are the risks if technology systems aren’t properly secured.
That’s why we’re thrilled to be joining the ROS-Industrial Consortium (ROS-I) to help accelerate the secure development of robotic Industry 4.0 applications.
It’s yet another important step for our stated mission: to secure the connected world.
Why IIoT matters  Industrial IoT (IIoT) systems are already streamlining production processes, improving cost efficiencies, and helping to drive greater agility and innovation for manufacturers.
It’s no coincidence that the global market for such solutions will grow at nearly 17% CAGR over the next six years to exceed $263 billion by 2027.
But with new technology always comes new cyber risk.
As connectivity is introduced to industrial computing devices, the challenge is managing the threat from remote attackers.
System and software vulnerabilities could be probed to hijack devices, sabotage production processes and steal intellectual property.
Robots are a particular risk—not only because so much of modern manufacturing relies on them, but also because many of these machines rely on legacy technology dating back decades.
These custom, proprietary programming languages and unique ecosystems can make security complex, and lead to unpatched vulnerabilities which sophisticated attackers could exploit, with serious consequences.
Shaping the roadmap  ROS-I is an open-source project devoted to extending the capabilities of the Robot Operating Systems (ROS) into industrial hardware and applications.
The job of the ROS-I Consortium is to prioritize these capabilities, offer code quality standards and provide technical support and training.
As an associate member of the consortium, Trend Micro will now be able to participate in technical and strategic projects and help to shape the ROS-I roadmap.
In fact, we’ve already demonstrated our value to the organization in research last year, which uncovered design flaws and vulnerabilities in legacy programming languages used by some of its products.
That resulted in our collaboration to develop secure network guidelines for industrial robots using ROS.
Securing the future  Trend Micro also recently started looking at the security of the Data Distribution Service (DDS).
This protocol is used heavily by ROS2 and will therefore be another area in which we hope to deliver tremendous value to ROS-I and end-customers going forward.
Trend Micro is in many ways an unusual member of the consortium.
Most either use ROS/ROS2 in their products, for example as robot manufacturers, or they want to help develop the software.
We do neither, but we plan to work with the consortium to enhance security-by-design in ROS-I software.
In fact, Trend Micro is only the second cybersecurity specialist to join.
Securing IIoT systems is hard: it requires capabilities across the cloud, the network, and the devices themselves.
For more info, check out our Smart Factory solutions: https://www.trendmicro.com/en_us/business/solutions/iot/smart-factory.html.
Tags  APT & Targeted Attacks | IoT | Expert Perspective | Articles, News, Reports
Cloud computing is on a roll.
Gartner predicts that spending on public cloud services including IaaS, SaaS and PaaS will reach nearly $500bn this year and grow by over 21% to hit $600bn by 2023.
But security concerns persist.
Marketplaces like the one offered by AWS make it a lot easier to get the right security tools in the hands of those that need them most.
But finding the right cybersecurity partners can still be something of an operational challenge involving a mountain of manual work.
That’s why we’re delighted to be a launch partner for new AWS Marketplace feature.
Marketplace Vendor Insights takes the pain out of due diligence by delivering the information prospective customers need—reducing friction and accelerating the journey to cloud security.
A tech tipping point We all know why global organizations are turning in their droves to cloud computing services and infrastructure.
For many, it was the pandemic that pushed them over a technology tipping point.
For others, digital transformation had been a priority for much longer, but the events of the past two years added a new sense of urgency.
Cloud investments are delivering innovative customer experiences, streamlining business processes and driving enterprise agility across the planet.
But such initiatives must be built on solid, secure foundations.
Trend Micro blocked 101% more cloud-based email threats in 2021 than the previous year.
We also know that threat actors are actively scanning for misconfigured cloud environments.
In-house skills shortages and the rapid pace of innovation from cloud service providers exacerbate this challenge.
The expansive use of open source code by DevOps teams adds another element of risk which requires urgent attention.
Climbing a mountain, the easy way IT leaders know that cloud security is a shared responsibility.
The challenge is often finding the right partners to align with their specific requirements.
Even though platforms like the AWS Marketplace have streamlined the process of procurement immeasurably for cloud builders, friction persists.
Security is a complex business, especially in the cloud, where many traditional rules associated with the on-premises world no longer apply.
That means customers have to ask prospective providers like Trend Micro a mountain of questions.
In fact, we receive extensive spreadsheets full of these questions several times a week.
They often contain hundreds of queries to process, which may have been written by lawyers who don’t fully understand the subject matter.
While buyers usually aim for lead times of weeks or months, the questionnaires themselves can get stuck in a bottleneck if forwarded first to IT service partners.
This is where AWS Marketplace Vendor Insights comes in.
It collects data from ISV partners like Trend Micro via two mechanisms:  ISVs upload compliance certificates, which are scanned and processed, with the salient information extracted by Marketplace Vendor Insights AWS technology is deployed to ISV production accounts to directly monitor and inspect configuration of technology resources and collect other critical information
The result is a win-win for ISVs like Trend Micro and security-minded AWS customers.
With Marketplace Vendor Insights, IT leaders can review compliance attestations and double click on more details about ISV security best practices directly from the AWS Marketplace.
It also enables buyers to view vendor information in the same way, allowing for true apples to apples comparison.
In so doing, it eliminates the need for endless back-and-forth communications between ISV and prospective customer.
It’s about standardizing and streamlining an important but cumbersome process to fast-track due diligence—ultimately enabling enterprises to extract value from platforms like Trend Micro Cloud One even quicker.
Tags  Cloud | Latest News | Data center | Compliance & Risks | APT & Targeted Attacks | Ransomware |
Tropic Trooper, a threat actor group that targets government, military, healthcare, transportation, and high-tech industries in Taiwan, the Philippines, and Hong Kong, has been active since 2011.
The group was reportedly using spear-phishing emails with weaponized attachments to exploit known vulnerabilities.
Primarily motivated by information theft and espionage, the group has also been seen adopting different strategies such as fine-tuning tools with new behaviors and going mobile with surveillanceware.
We found that Tropic Trooper’s latest activities center on targeting Taiwanese and the Philippine military’s physically isolated networks through a USBferry attack (the name derived from a sample found in a related research).
We also observed targets among military/navy agencies, government institutions, military hospitals, and even a national bank.
The group employs USBferry, a USB malware that performs different commands on specific targets, maintains stealth in environments, and steals critical data through USB storage.
We started tracking this particular campaign in 2018, and our analysis shows that it uses a fake executable decoy and a USB trojan strategy to steal information.
Based on data from the Trend Micro™ Smart Protection Network™ security infrastructure, USBferry attacks have been active since 2014.
We found the group was focused on stealing defense-, ocean-, and ship-related documents from target networks, which led us to believe that Tropic Trooper’s main purpose is to exfiltrate confidential information or intelligence.
A sample scenario of the USBferry attack Tropic Trooper is well aware that military or government organizations may have more robust security in their physically isolated environments (i.e., the use of biometrics or USB use in a quarantined machine before an air-gapped environment).
The group then targets potentially unsecured related organizations that could serve as jumping-off points for attacks.
For instance, we observed Tropic Trooper move from a military hospital to the military’s physically isolated network.
For one thing, the USBferry malware already has at least three versions, with different variants and components, at the time of writing.
The malware tries to check if the target machine has a USB plug-in and copies the USBferry installer into the USB storage.
The activities vary in target environments; some execute commands, source target files or folder lists, and copy files from physically isolated hosts to compromised hosts, among other things.
Figure 2. USBferry malware’s first version, where the EXE file is the USBferry malware and the DLL file is trojan TROJ_YAHOYAH
This version also changes the malware location and its name to UF, an abbreviation for USBferry.
USBferry malware’s second version combined into one file
USBferry malware’s third version becomes resident in memory How USBferry targets air-gapped systems
In our technical brief, we broke down how Tropic Trooper has changed the way it uses the abovementioned USBferry versions in attacks.
Figure 5. USBferry malware using USB worm infection strategy
USBferry attack scenario, version UF1.0 20160226
The decoy file first drops a flash_en.inf DLL file, which is a USBferry loader, and tries to load the encrypted USBferry malware
The encrypted USBferry malware is embedded in the loader resource section, and the loader drops it into the C:\Users\Public\Documents\Flash folder and names it flash.dat
After the encrypted payload is loaded, the loader injects a malicious DLL into rundll32.exe.
The USBferry malware also loads a C&C configuration file and flash_en.dat, which is also located in the C:\Users\Public\Documents\Flash
The USBferry malware then tries to connect to the download site and uses a Windows command to collect/copy target host data
Some backdoors used by Tropic Trooper use injection to execute its routines, while others execute directly and run itself consistently.
The group also uses steganography to mask their backdoor routines and evade anti-malware and network perimeter detection.
Based on the malware version number, this backdoor’s first version was developed in or before 2011.
The backdoor version name, registered service name, and malware components’ filenames  Welcome To IDShell 1.0 20150310’s backdoor (detected as BKDR_IDSHELL.ZTFC-A) - The purpose of this backdoor, which has two types, including a steganography jpg version, is to recon the target machine.
Like other versions, it uses the DNS protocol to communicate with the backdoor controller.
The traffic is encrypted to evade detection.
The backdoor’s communication traffic
Welcome Server 2.0’s backdoor (detected as BKDR_TEBSHELL.ZTGK) – This is the latest version of the backdoor, available in 32-bit and 64-bit versions, which uses an invisible web shell for remote control and network security evasion.
Port scanning tools, which are available on the internet.
The overview provided above highlights how putting critical information in physically isolated networks is not a bulletproof solution for defending against cyberespionage.
Steganography isn’t just used to deliver encrypted payloads; it can also be used to transfer information to a C&C server.
Threat actors like Tropic Trooper can also use an invisible web shell to hide its C&C server location and make incident response tricky.
Enforce the principle of least privilege.
Read our technical brief, which discusses in full our analyses of Tropic Trooper’s recent activities, the USBferry malware, and IoCs.
Attack Chain Figure 1. Attack chain of Tropic Trooper’s operations
Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns:
Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802, security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE).
UserInstall.exe will abuse the BITSadmin command-line tool to create a job and launch sidebar.exe.
We also observed malicious documents that don’t need to download anything from the internet as the backdoor’s dropper is already embedded in the document.
Tropic Trooper uses exploit-laden Microsoft Office documents to deliver malware to targets.
Below is a screenshot of the document used in their latest campaigns: Figure 2.
Malicious document used by Tropic Trooper PDB Strings as Context Clues
PDB strings inside the MSI file
The first PDB string has a certain ss2/Projects/MsiWrapper (Project MsiWrapper) in it, which we found to be an open-source application that converts executable setup programs to MSI files.
Another interesting PDB string we found is - D:\Work\Project\VS\house\Apple\Apple_20180115\Release\InstallClient.pdb.
This is carried out to evade antivirus (AV) detection, because wab32res.dll is loaded by a benign file.
The installer drops three files into the Apple/Update directory Figure 5.
PDB strings inside the loader file
The backdoor, TClient (BKDR_TCLT.ZDFB), is so named from its own PDB string.
TClient is injected into dllhost.exe Malware Analysis  wab32res.dll (FakeRun loader) loads TClient.
The loader checking the sidebar process Figure 8.
The malicious loader injecting the backdoor into dllhost.exe Figure 9.
Comparison of TClient’s configuration format in 2016 (left, from other researchers) and 2018 (right) TClient will use SSL to connect to Tropic Trooper’s C&C server.
TClient is actually one of Tropic Trooper’s other backdoors.
TClient uses symmetric encryption to decrypt its configuration with one 16-byte key in 2018.
The image and table below illustrate TClient’s encrypted configuration that we decrypted (via Python code):  Figure 10.
Snapshot of code we used to decrypt TClient’s configuration Figure 11.
Encrypted backdoor configuration
Description Decryption Strings
Proxy: 0
Decrypted backdoor configuration
Reverse analysis of TClient allowed us to determine how to decrypt the C&C information.
TClient will use custom SSL libraries to connect the C&C server.
The TSSL project has 64-bit version.
TClient, for instance, uses DLL hijacking and injection that may not be as noticeable to others.
The vulnerabilities that Tropic Trooper’s campaigns have been patched last January, for instance.
Disable or secure the use of system administration tools such as PowerShell and other command-line tools that may be abused.
Nurture a culture of cybersecurity.
Spear-phishing emails, for instance, rely on baiting targets with socially engineered documents.
Indicators of Compromise (IoCs) Related Hashes (SHA-256): Detected as CVE-2018-0802.ZTFC:  1d128fd61c2c121d9f2e1628630833172427e5d486cdd4b6d567b7bdac13935e  BKDR_TCLT.ZDFB:  01087051f41df7bb030256c97497f69bc5b5551829da81b8db3f46ba622d8a69  BKDR64_TCLT.ZTFB:  6e900e5b6dc4f21a004c5b5908c81f055db0d7026b3c5e105708586f85d3e334  TROJ_SCLT.ZTFB:  49df4fec76a0ffaee5e4d933a734126c1a7b32d1c9cb5ab22a868e8bfc653245  TROJ_TCDROP.ZTFB:  b0f120b11f727f197353bc2c98d606ed08a06f14a1c012d3db6fe0a812df528a d65f809f7684b28a6fa2d9397582f350318027999be3acf1241ff44d4df36a3a 85d32cb3ae046a38254b953a00b37bb87047ec435edb0ce359a867447ee30f8b  TROJ_TCLT.ZDFB:  02281e26e89b61d84e2df66a0eeb729c5babd94607b1422505cd388843dd5456 fb9c9cbf6925de8c7b6ce8e7a8d5290e628be0b82a58f3e968426c0f734f38f6  URLs related to C&C communication:  qpoe[.]com wikaba[.]com tibetnews[.]today dns-stuff[.]com 2waky[.]com         Tags  Network | APT & Targeted Attacks | Research
The five individuals were reportedly connected to the hacking group known as APT41.
Justice officials say that the group's intrusions allowed the hackers to steal source code, customer account data, and personally identifiable information (PII).
This is not the first time that APT41 activities have been scrutinized — the group has been active for some time.
Just last May, Trend Micro connected the group to ransomware attacks on Taiwanese organizations.
The attack chain of ransomware incidents in Taiwan
The ransomware attack chain is outlined in Figure 1; however, we currently do not know the initial arrival vector of this threat into a potential victim's network.
After logging in to the active directory server, the threat actor modifies the active directory server group policy object — this includes a request that all domain account members create a scheduled task and execute the malware.
In the final step, the other subsidiary active directory servers and all the endpoint machines will download the scheduled task and execute the ransomware.         Figure.1 The attacker uses an Active Directory (AD) scheduled task to deploy the ransomware in the customer environment.
Scheduled tasks play a very important role in this incident.
The threat actors use a scheduled task command to spread and infect a victim's environment.
The screenshot in Figure 2 shows how the threat actor uses SMB and internal IIS Web Service to copy "lc.tmp" (the main ransomware loader in this incident) to other victims' host machines.
After that, the PowerShell command executes the main ransomware loader.
How a scheduled task delivers the malware to a victim's environment
The loaders decrypted the next-stage payloads, which were either embedded inside itself or stored on the disk as separate files.
The next-stage payloads were CobaltStrike in this series of incidents.
More than just a single occurrence
Possible link to Chinese espionage
The C&C server 104[.]233[.]224[.]227 was hosted under a small hosting service with only 64 IPs under it.
To help defend users against APT41 specifically, we have developed an assessment tool that can scan endpoints for file-based indicators collected from global intelligence sources.
Indicators of Compromise  SHA 256                                          Malware Family 2367326f995cb911c72baadc33a3155f8f674600 NTDSDump 75e49120a0238749827196cebb7559a37a2422f8 COLDLOCK 5b9b7fb59f0613c32650e8a3b91067079bcb2fc2 COLDLOCK e7aa8f55148b4548ef1ab9744bc3d0e67588d5b7 COLDLOCK ad6783c349e98c2b4a8ce0b5c9207611309adca7 COBALTSTRIKE 29cc0ff619f54068ce0ab34e8ed3919d13fa5ee9 COLDLOCK 2051f0a253eced030539a10ebc3e6869b727b8a9 COLDLOCK a2046f17ec4f5517636ea331141a4b5423d534f0 COLDLOCK 03589dffe2ab72a0de5e9dce61b07e44a983d857 COBALTSTRIKE 9d6feb6e246557f57d17b8df2b6d07194ad66f66 COLDLOCK 28d172e374eebc29911f2152b470528fc695662e PWDDUMPER 574fb6a497c032f7b9df54bc4669d1eb58d78fb4 ASPSHELL  *One of the sources for this table is the original report from the U.S. Justice Department     Tags  Latest News | APT & Targeted Attacks | Endpoints | Cyber Crime | Network | Articles, News, Reports
Attacker Owned Domains:
The pandemic has taken center stage in people’s everyday lives, in the international news media, and in the world of government-backed hacking.
Recently, we shared information on numerous COVID-themed attacks discovered and confirmed by our teams.
We continue to see attacks from groups like Charming Kitten on medical and healthcare professionals, including World Health Organization (WHO) employees.
As one example, we've seen new activity from “hack-for-hire” firms, many based in India, that have been creating Gmail accounts spoofing the WHO.
The lures themselves encourage individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements, and link to attacker-hosted websites that bear a strong resemblance to the official WHO website.
The sites typically feature fake login pages that prompt potential victims to give up their Google account credentials, and occasionally encourage individuals to give up other personal information, such as their phone numbers.
Government-backed or state-sponsored groups have different goals in carrying out their attacks: Some are looking to collect intelligence or steal intellectual property; others are targeting dissidents or activists, or attempting to engage in coordinated influence operations and disinformation campaigns.
In addition to our internal investigations, we work with law enforcement, industry partners, and third parties like specialized security firms to assess and share intelligence.
When we find attempts to conduct coordinated influence operations on our platforms, we work with our Trust & Safety teams to swiftly remove such content from our platforms and terminate these actors’ accounts.
We take steps to prevent possible future attempts by the same actors, and routinely exchange information and share our findings with others in the industry.
We’ve also shared occasional updates about this kind of activity, and today we’re introducing a more streamlined way of doing this via a new, quarterly bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns (foreign and domestic).
Our actions against coordinated influence operations from January, February and March can be found in the Q1 Bulletin.
Since March, we’ve removed more than a thousand YouTube channels that we believe to be part of a large campaign and that were behaving in a coordinated manner.
These channels were mostly uploading spammy, non-political content, but a small subset posted primarily Chinese-language political content similar to the findings of a recent Graphika report.
We’ll also share additional removal actions from April and May in the Q2 Bulletin.
Our hope is that this new bulletin helps others who are also working to track these groups, such as researchers studying this issue, and we hope these updates can help confirm findings from security firms and others in the industry.
Cybercriminals have different motivations: for example, some malicious actors have disruptive political attacks as their objective, while others might be more inclined towards cyberespionage and gathering information on their victims.
Of course, financial gain remains a powerful cybercrime motivation — perhaps even the most common one.
Some malicious actors, such as ransomware operators, earn directly from their cyberattacks.
Others, however, prefer to act as “cybermercenaries,” selling their services to anyone willing to pay.