mrmoor/cyber-threat-intelligence huggingface dataset:
One of the decoy documents, for instance, was about the “plan of disaster prevention in heisei 20” (Heisei is the current/modern era in Japan).  Figure 1: File properties of one of the decoy documents that REDBALDKNIGHT sends to Japanese targets  Figures 2: Sample of decoy documents used by REDBALDKNIGHT, employing socially engineered titles in their spear phishing emails such as “disaster prevention”
Attack ChainREDBALDKNIGHT’s attacks typically use spear phishing emails as an entry point.
Their attachments exploit a vulnerability in Ichitaro, as shown above.
Based on the hardcoded version number they divulged (Version:1.15.11.26TB Mini), we were able to source other versions of the backdoor (listed in the appendix).
Version v1.40 Mini uses the MPRESS packer, which provides some degree of protection against AV detection and reverse engineering.
How REDBALDKNIGHT Employs
SteganographyDaserf’s infection chain accordingly evolved, as shown below.
It has several methods for infecting its targets of interest: spear phishing emails, watering hole attacks, and exploiting a remote code execution vulnerability (CVE-2016-7836, patched last March 2017) in SKYSEA Client View, an IT asset management software widely used in Japan.
REDBALDKNIGHT’s use of steganography isn’t limited to Daserf.
Based on their pdb strings, they’re both components of another REDBALDKNIGHT-related threat, XXMM (TROJ_KVNDM), a downloader Trojan that can also act as a first-stage backdoor with its capability to open a shell.
While xxmm2_builder allows REDBALDKNIGHT to customize the settings of XXMM, xxmm2_ steganography is used to hide malicious code within an image file.
REDBALDKNIGHT’s tool can create, embed, and hide executables or configuration files within the image file with its tag and encrypted strings via steganography.
Additionally, we also found that the steganography algorithm (alternative base64 + RC4) between XXMM and Daserf were the same.
Figure 4: Code snippets showing Daserf’s decode function, which is the same as XXMM’s Figure 5: Steganography toolkit used by REDBALDKNIGHT for XXMM Figure 6:
Snapshots of Daserf’s steganographic code generated by their toolkit MitigationSteganography is a particularly useful technique in purposeful cyberattacks: the longer their malicious activities stay undetected, the more they can steal and exfiltrate data.
Safeguard the email gateway to defend against REDBALDKNIGHT’s spear phishing methods.
It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect threats like REDBALDKNIGHT’s attacks even without any engine or pattern update.
Due to the suspicious nature of this activity, we decided to investigate further.
The first thing we did was check the URL where the malicious APK file was hosted (https://egov[.]sy/mobile/egov[.]apk).
These benign versions of the application were created during the period from February 2020 until March 2021.
Although some antivirus vendors detect the identified malicious sample as Bahamut, we doubted the accuracy of this attribution to the Bahamut APT group.
Further investigation revealed several artifacts that could possibly link the malicious sample to the StrongPity APT group.
The malicious version of the application (fd1aac87399ad22234c503d8adb2ae9f0d950b6edf4456b1515a30100b5656a7) was created on May 2021(The timestamps within the file point to 2021-05-03 as the creation date, while the file was uploaded to VirusTotal on May 24, 2021).
The modified AndroidManifest.xml of the malicious app     Overview of the inserted code
Malicious code initialization
The receiver starts the malicious service.
The service is started when the device connectivity is changed.
The djdeeu class registers a broadcast receiver for CONNECTIVITY_CHANGE.
Architecture of the backdoor
It defines seven message types, shown in Figure 4.
Figure 4. Code showing the seven defined messages.
Each of the messages trigger a different behavior through the handler.
When this message is received, a periodic task for heartbeat message is set.
MSG_TRIG_ALARM_SYNC
When this message is received, a periodic task for sync message is set.
MSG_HEARTBEAT
MSG_SYNC Sync is a repeated behavior.
It uploads files, which were collected on infected devices, with a periodicity of 3000 seconds.
The handler for MSG_SYNC executes the following functionality: First, it enumerates all files under <DIR>/.android/.lib2.
It then creates a zip file with the name <uniqueId>.zip (note that the unique ID is not a real device ID, the malware just calculates a  custom unique ID based on the device ID value), and writes the files into the compressed file.
MSG_COLLECT
The handler for this message collects data from the victim’s device.
A snippet of the file harvesting code      MSG_TRIG_ALARM_COLLECT
When this message is received, a periodic task for the “collect message” handler is set.
MSG_CONNECTIVITY
Modular Functionality of the backdoor
Code snippet showing the ltymcr(Helper Class) component      sadwoo:
A component used as PowerWakeLock.
phkyxc: A component used as WifiWakeLock.
tfsdne:
itxdrx(Net Manager): A component responsible for handling HTTP protocol communication.
Code from the itxdrx component      nhnhpi:
The component responsible for managing the C&C server.
This component includes definition of an initial C&C server.
Similar malicious samples
Date of submission  SHA256  Identified C&C servers  Additional Details  August 2, 2019  374d92f553c28e9dad1aa7f5d334a07dede1e5ad19c3766efde74290d0c49afb  upeg-system-app[.]com  Likely repacked from Kingoroot.
June 8, 2020  be9214a5804632004f7fd5b90fbac3e23f44bb7f0a252b8277dd7e9d8b8a52f3  networktopologymaps[.]com  Likely repacked from Snaptube, though It is not the same as 596257ef017b02ba6961869d78a2317500a45f00c76682a22bbdbd3391857b5d.  June 8, 2020  a9378a5469319faffc48f3aa70f5b352d5acb7d361c5177a9aac90d9c58bb628  networktopologymaps[.]com  Likely repacked from net[.]cybertik[.]wifi (the original app could be downloaded from the Yemeni website, cybertik[.]net).
June 13, 2021  596257ef017b02ba6961869d78a2317500a45f00c76682a22bbdbd3391857b5d  upeg-system-app[.]com  Likely repacked from Snaptube.
January 1, 2021  75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b  upn-sec3-msd[.]com  This is likely a testing sample because it provides buttons to test functions.
This shows that the actor is actively involved in the development of APK versions of the backdoor.
Table 1. Similar malicious samples found on VirusTotal     The sample 75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b  serves as the key attribution factor and is the main link to the StrongPity threat actor, because it communicates with a C&C server that was previously identified by several research teams as infrastructure used by the group.  Tools, tactics, and procedures on Windows
Just as we have seen with the Android apps, the StrongPity group favors repacking benign installers to produce trojanized versions of these applications.
Take, for example, the following sample:  48f67be806b4e823280f03ee5512ffd58deb6f37ecc80842265d4e8d2ca30055.
This dropped file is a clean WinRAR installer.
Figure 11. Code showing the creation of the directory
If we examine another StrongPity sample (12818a96211b7c47863b109be63e951075cf6a41652464a584dd2f26010f7535), the logic is similar — it drops a normal installer into the Temp directory and creates a directory for dropped malicious files.
Possible connections to StrongPity
We found several clues that link the malicious Android samples with the StrongPity threat actor.
The sample 74582c3d920332117541a9bbc6b8995fbe7e1aff communicates with the URL  https://www.upn-sec3-msd[.]com/ProxyServer/service/.
The domain name “upn-sec3-msd[.]com” was mentioned in another StrongPity report.
For example, the domain names used by StrongPity in 2020 have a domain naming pattern similar to the domains used by the identified Android samples.
The domain was acquired via the Porkbun network registrar.
This is similar to the domain hostoperationsystems[.]com, which was previously mentioned in the Talos report.
For example, one of the samples that we had examined earlier, gathers files with the following extensions:  .7z .asc .dgs .doc .docx .gpg .pdf .pgp .ppt .pptx .rar .rjv .rms .rtf .sft .tc .txt .xls .xlsx  As we previously mentioned, there are no public reports of the StrongPity threat actor using malicious Android applications in the attack.
StrongPity actively develops new malicious android apps
We believe that the StrongPity Threat actor is actively developing backdoors for Android.
Based on the additional functionalities that we identified in the fake Samsung security service application (75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b), we think that among the APK files that we had identified, the repackaged applications are bundled with the first version of the Android trojan, while the fake application could be a work in progress for the next version of the tool.
The following table shows the types that the threat actor has defined.
Message types defined by the threat actor
However, we were not able to find any of these modules in the wild.
Version 2 has an ability to execute “su” command, if the device is rooted.
Version 2 uses SQLite to store collected data.
Furthermore, it no longer uses ZIP.
Typically, these websites would require its users to download the applications directly onto their devices.
In order to do so, these users would be required to enable installation of the applications from “unknown sources” on their devices.
Indicators of Compromise (IOCs) Files
SHA256  Description
Detection  fd1aac87399ad22234c503d8adb2ae9f0d950b6edf4456b1515a30100b5656a7
The trojanized version of the Syria eGov Application  AndroidOS_StrongPity.HRX  374d92f553c28e9dad1aa7f5d334a07dede1e5ad19c3766efde74290d0c49afb  Sample repackaged from Kingoroot  AndroidOS_StrongPity.HRX  a9378a5469319faffc48f3aa70f5b352d5acb7d361c5177a9aac90d9c58bb628                                                                                              Sample repackaged from net.cybertik.wifi  AndroidOS_StrongPity.HRX  be9214a5804632004f7fd5b90fbac3e23f44bb7f0a252b8277dd7e9d8b8a52f3  Repackaged from Snaptube  AndroidOS_StrongPity.HRX  596257ef017b02ba6961869d78a2317500a45f00c76682a22bbdbd3391857b5d  Repackaged from Snaptube  AndroidOS_StrongPity.HRX  75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b    Fake Samsung Security Service sample  AndroidOS_StrongPity.HRX    Network C&C Infrastructure  SHA256  Domain  Detection  fd1aac87399ad22234c503d8adb2ae9f0d950b6edf4456b1515a30100b5656a7  Internetwideband[.]com  AndroidOS_StrongPity.HRX  374d92f553c28e9dad1aa7f5d334a07dede1e5ad19c3766efde74290d0c49afb  upeg-system-app[.]com  AndroidOS_StrongPity.HRX  a9378a5469319faffc48f3aa70f5b352d5acb7d361c5177a9aac90d9c58bb628                                                                                              networktopologymaps[.]com  AndroidOS_StrongPity.HRX  be9214a5804632004f7fd5b90fbac3e23f44bb7f0a252b8277dd7e9d8b8a52f3  networktopologymaps[.]com  AndroidOS_StrongPity.HRX  596257ef017b02ba6961869d78a2317500a45f00c76682a22bbdbd3391857b5d  upeg-system-app[.]com  AndroidOS_StrongPity.HRX  75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b    upn-sec3-msd[.]com  AndroidOS_StrongPity.HRX           Tags  APT & Targeted Attacks | Research | Mobile | Articles, News, Reports
This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2020.
It was last updated on October 16, 2020.
We terminated 299 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.
We terminated 8 YouTube channels as part of our actions against a coordinated influence operation linked to Yemen.
We terminated 4 YouTube channels as part of our actions against a coordinated influence operation.
We terminated 1,628 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.
This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 of 2020.
It was last updated on August 5, 2020.
We terminated 7 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.
We terminated 186 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.
We terminated 1,098 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.
We terminated 1,312 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.
We terminated 17 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.
Vision One integrates with Palo Alto Networks Cortex™ XSOAR to drive automated response to incidents uncovered by Vision One.
Having the incident details available in the Cortex™ XSOAR platform enables analysts to execute a series of manual or automated actions through the Trend Micro Vision One™ platform in response to a potential threat.
Collect files Collects the specified file from an endpoint during an investigation Submit a file for sandbox analysis Submits a file to the Trend Micro Vision One sandbox for automated analysis Retrieve sandbox analysis report Retrieves the analysis report, IOCs, or artifacts available after automated analysis Quarantine email message
Delete email message Permanently deletes the specified email message from the user’s mailbox
Gather information on an endpoint Gathers information from the endpoint such as the current logged on user, operating system details, IP address, hostname, mac address
Terminate process Terminates the specified process if currently running on an endpoint Isolate endpoint Blocks all network activity on an endpoint while the system is being investigated
Restore endpoint connection Restores the network connectivity on an endpoint after investigation and/or remediation has occurred
Scenario: If credential dumping was detected on a host, the security operations team wanted to automate the collection of artifacts to be used during a subsequent investigation.
Trend Micro Vision One™ is very effective at identifying the various techniques threat actors use to discover credentials.
However, since threat actors tend to cover their tracks quickly, by the time the security analyst is reviewing the incident, there is a chance that critical information may have been permanently deleted and is no longer readily accessible.          Instead of depending on a security analyst to review a credential dumping event and manually collecting artifacts for their investigation, Trend Micro wanted to automate the collection of this evidence as quickly as possible when a detection occurs.
The first step in our playbook is to check if the event is related to credential dumping.
After we have gathered the information, the next step is to collect the file from the endpoint using the command “trendmicro-visionone-collect-forensic-file”.
We need to request that a download link be generated for the collected files with the “trendmicro-visionone-download-information-for-collected-forensic-file”.
Once we have the download link, we can then use the Cortex™ XSOAR built-in command “http” to retrieve the file and save it to the War Room for this incident so that it can be downloaded and analyzed.          This is just one example use case that we have seen implemented to automate security operations by leveraging the integration between Trend Micro Vision One™ and Palo Alto Networks Cortex™ XSOAR.
Copyright © 2022.
Trend Micro Incorporated.
Cortex XSOAR is a trademark of Palo Alto Networks.
Email contents vary from COVID-19 vaccine policy to the humanitarian crisis in Ukraine.
Looking at the code of the page, we can see that only the WhatsApp download links are pointing to attacker controlled content for Android and iOS users.
The resulting application is signed with a certificate from a company named 3-1 Mobile SRL (Developer ID: 58UP7GFWAA).
The certificate satisfies all of the iOS code signing requirements on any iOS devices because the company was enrolled in the Apple Developer Enterprise Program.
The app is broken up into multiple parts.
It contains a generic privilege escalation exploit wrapper which is used by six different exploits.
It also contains a minimalist agent capable of exfiltrating interesting files from the device, such as the Whatsapp database.
In collaboration with TAG, Project Zero has published the technical analysis of CVE-2021-30983.
Installing the downloaded APK requires the victim to enable installation of applications from unknown sources.
Although the applications were never available in Google Play, we have notified the Android users of infected devices and implemented changes in Google Play Protect to protect all users.  Android Implant This analysis is based on fe95855691cada4493641bc4f01eb00c670c002166d6591fe38073dd0ea1d001 that was uploaded to VirusTotal on May 27.
The Android app disguises itself as a legitimate Samsung application via its icon: When the user launches the application, a webview is opened that displays a legitimate website related to the icon.
The configuration is encoded with a 105-byte XOR key.
This trend should be concerning to all Internet users.
While vulnerability research is an important contributor to online safety when that research is used to improve the security of products, vendors stockpiling zero-day vulnerabilities in secret poses a severe risk to the Internet especially if the vendor gets compromised.
AWS has responded to this customer request by offering partner CloudFormation Resource Types directly from the AWS Management Console.
CloudFormation now handles the details of automating that implementation, reducing the knowledge needed about the underlying mechanisms to automate that resource deployment.
Tags  Cloud | Malware | Cyber Crime | Exploits & Vulnerabilities | Phishing | Deep Web | Cyber Threats | APT & Targeted Attacks | Compliance & Risks | Articles, News, Reports | Security Strategies
While tracking the activities of the SideWinder group, which has become infamous for targeting the South Asia region and its surrounding countries, we identified a server used to deliver a malicious LNK file and host multiple credential phishing pages.
We learned that these pages were copied from their victims’ webmail login pages and subsequently modified for phishing.
We believe further activities are propagated via spear-phishing attacks.
After the gathered credentials are sent, some of the phishing pages will redirect victims to different documents or news pages.
Furthermore, it seems that these lures are distributed via phishing links.
We also found multiple Android APK files on their phishing server.
One of the normal applications, called “OpinionPoll,” is a survey app for gathering opinions regarding the Nepal-India political map dispute, which seems to be another political lure similar to the one they used in the spear-phishing portion.
SideWinder has been very active in 2020.
Analysis of the malicious document
The use of malicious documents is one of SideWinder’s most common infection vectors.
An example of a downloaded ZIP file containing an LNK file that is used to download a malicious HTA file
All of these cases end up with either the downloading or dropping of files and then the execution of JavaScript code, which is a dropper used to install the main backdoor + stealer.
The downloaded RTF files exploit the CVE-2017-11882 vulnerability
It drops a file named 1.a (a JavaScript code), which drops the backdoor + stealer into a folder in ProgramData and directly executes it or creates a scheduled task to execute the dropped files at a later time.
A scheduled task with a command to execute the dropped backdoor + stealer
The content of the newly created folder contains a few files, including Rekeywiz (EFS REKEY wizard, FA86B5BC5343CA92C235304B8DCBCF4188C6BE7D4621C625564BEBD5326ED850), which is a legitimate Windows application.
This fake DLL library decrypts the main backdoor + stealer from the .tmp file in the same directory.
Figure 5. Algorithm for decrypting both main backdoor + stealer and configuration
The decrypted payload is the main backdoor .NET executable binary.
In Resources, the Default resource contains the encrypted configuration.
After decryption (using the same principle as with the main backdoor + stealer), the configuration reveals which file formats the attackers are targeting.
The decrypted configuration     The main functions of the backdoor + stealer are:  1) Downloading the .NET executable and running it 2) Collecting system information and uploading it to the command-and-control (C&C) server 3) Uploading selected files to the C&C server
The spear-phishing attack
We found several interesting dynamic DNS domains resolving to a server that was used to deliver SideWinder’s malicious documents.
For example, “mail-nepalgovnp[.]duckdns[.]org” was created to pretend to be the original Nepal government’s domain “mail[.]nepal[.]gov[.]np”.
Digging deeper, we found that it hosted several phishing pages.
These pages were copied from the webmail servers of various targets and then modified for spear-phishing attacks designed to steal login credentials.
Although it’s not clear to us how these phishing pages are delivered to the victims, finding the original webmail servers that they copied to make these phishing pages allows us to identify who they were targeting.
Analysis of the phishing pages revealed that most of them would redirect to the original webmail servers, which they copied after the victims sent out their login credentials.
These documents and news are probably interesting in some way to their targets and are used to make them click and log in to the phishing pages.
“India reaction after new pak map.pdf” – a document talking about India’s response to the new political map revealed by Pakistan in August.
The following table shows their targets, related phishing domains, and lure documents used in each of the phishing attacks.  Date  Phishing Domain  Targeted Organization  Targeted Mail server  Redirection after login  2019 Nov     Government of Nepal  mail.nepal.gov.np  Redirect to file “IMG_0002.pdf”  2019 Nov     Ministry of Defence, Nepal  mail.mod.gov.np  Redirect to original mail server  2019 Dec  mail-
mofagovnp.zapto[.]org
mail.mofa.gov.np
af[.]org
SideWinder’s phishing page disguised as a Nepalese Army OWA (Outlook Web Access) Page      Figure 9.
The lure document redirected from the phishing page that discusses Indian and Pakistani political map issues      Figure 10
We also identified multiple Android APK files on their server.
Non-malicious applications “My First APP” and “Opinion Poll”     Another two applications were built from JavaPayload for Metasploit that will load extra code from the remote server configured in the sample.
These two samples appear to be debug versions as they have no activities or any other component except Metasploit.
Figure 13. Build from Metasploit and Request Permissions     We also identified a malicious version of the My First APP application that added Metasploit whose class names have been obfuscated.
Malicious version of My First APP, which adds Metasploit     SideWinder has used malicious apps as part of its operation before.
As seen with their phishing attacks and their mobile device tools’ continuous development, SideWinder is very proactive in using trending topics like Covid-19 or various political issues as a social engineering technique to compromise their targets.
Indicator of Compromise Android Part IoCs  Indicator  Package name  Label  C2 server  Detection  0c182b51ff1dffaa384651e478155632c6e65820322774e416be20e6d49bb8f9  com.example.firstandoidapp