mrmoor/cyber-threat-intelligence huggingface dataset:
Indicators of compromise (IOCs) Threat actor-managed C&C URLs:  https://highstreetmuch[.]xyz/hug/gate[.]php https://takeusall[.]online/benzz/gate[.]PHP  MITRE ATT&CK® Matrix          Tags  Cloud | APT & Targeted Attacks | Research | Phishing | Articles, News, Reports
Waterbear, which has been around for several years, is a campaign that uses modular malware capable of including additional functions remotely.
It is associated with the cyberespionage group BlackTech, which mainly targets technology companies and government agencies in East Asia (specifically Taiwan, and in some instances, Japan and Hong Kong) and is responsible for some infamous campaigns such as PLEAD and Shrouded Crossbow.
However, in one of its recent campaigns, we’ve discovered a piece of Waterbear payload with a brand-new purpose: hiding its network behaviors from a specific security product by API hooking techniques.
And since the API hooking shellcode adopts a generic approach, a similar code snippet might be used to target other products in the future and make Waterbear harder to detect.
A closer look at Waterbear Waterbear employs a modular approach to its malware.
The evidence is that Waterbear frequently uses internal IPs as its own C&C servers (for instance, b9f3a3b9452a396c3ba0ce4a644dd2b7f494905e820e7b1c6dca2fdcce069361 uses an internal IP address of 10[.]0[.]0[.]211 as its C&C server).
The typical Waterbear infection chain  Figure 1.
A typical Waterbear infection chain
A Waterbear infection starts from a malicious DLL loader, as shown in Figure 1.
We have seen two  techniques of DLL loader triggering.
During our recent Waterbear investigation, we discovered that the DLL loader loaded two payloads.
The payloads performed functionalities we have never seen in other Waterbear campaigns.
Waterbear’s first-stage backdoor
This DLL name is hardcoded inside "mtxoci.dll" which is loaded by the MSDTC service during boot-up.
“mtxoci.dll” first tries to query the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value "OracleOciLib" exists.
During our investigation, we noticed that the value "OracleOciLib" was deleted from the victim's machine, as shown in Figure 2.
The image on the right showcases how the DLL on a victim's machine appears.
Because there is no "OracleOciLib" value, it loads the hardcoded DLL "ociw32.dll" instead, which triggers the malicious Waterbear DLL loader.
The decryption algorithm is RC4, which takes the hardcoded path to form the decryption key.
Offset 0xAC, Size 0x02: Port Offset 0xAE, Size 0x5A: Reserved bytes Table:
The function address table of the payload.
Table: The sizes of functions Table:
The API address table.
Table: The API hashes for dynamic API loading
In order to avoid in-memory scanning during runtime, the payload encrypts all of the function blocks before executing the actual malicious routine.
The purpose of this is to further avoid being detected by a certain cybersecurity solution.
The decryption-execution-encryption flow in the shellcode execution routine  Figure 5.
This time, the DLL loader loaded two payloads – the first payload performed functionalities we have not seen before: It injected codes into a specific security product to do API hooking in order to hide the backdoor from the product.
Meanwhile, the second payload is a typical Waterbear first-stage backdoor.
An unusual Waterbear infection chain
Regardless if the API hooking was performed or otherwise, the second backdoor would still be executed after having been successfully loaded.
API hooking to evade detection
In order to hide the behaviors of the first-stage backdoor (which is the second payload), the first payload uses API hooking techniques to avoid being detected by a specific security product and to make an interference in the result of the function execution.
The payload is composed of a two-stage shellcode.
The second-stage shellcode then performs API hooking inside the targeted process.
If the shared memory doesn't exist, it takes the PID embedded by the first-stage shellcode.
Therefore, the first-stage shellcode takes the PID of the Windows Service — which the first-stage shellcode and the succeeding backdoor both inject into — hides the target process, and embeds that PID into the second-stage shellcode.
Code that injects current PID into the second-stage shellcode Hooking "ZwOpenProcess" in ntdll.dll
The purpose of hooking “ZwOpenProcess” is to protect the specific process from being accessed by the security product.
Whenever “ZwOpenProcess” is called, the injected code will first check if the opened process hits any PIDs in the protected process ID list.
If yes, it modifies the process ID, which should open on another Windows Service PID.
First, it builds the hooked function and writes the function at the end of “ntdll.dll”.
This function includes two parts, as shown in Figure 9:  The PID checking procedure.
If yes, it replaces the PID to be opened with another Windows Service PID that has been written by the Waterbear loader in the beginning.
“ZwOpenProcess” after modification
The API hooking on “ZwOpenProcess” will only be triggered if "%temp%\KERNELBASE.dll" exists on the host.
The second part of API hooking hooks on “GetExtendedTcpTable.” “GetExtendedTcpTable” is used for retrieving a table that contains a list of TCP endpoints available to the application, and it is frequently used in some network-related commands, such as netstat.
The second function, “GetRTTAndHopCount,” acts as the place to put the injected hooking code.
The rest of the routine is all placed in “GetRTTAndHopCount.”
The code is shown in Figure 12.
In the end, it returns the modified table.
Rather than directly disabling these two functions, this method of using API hooking makes noticing malicious behaviors more difficult, especially since both functions still work and return results normally.
Although in this case, the affected process is specified in the first-stage shellcode, the API hooking logic is quite generic that the same piece of shellcode can be used to hook other vendors' products.
Since the API hooking shellcode adopts a generic approach, the similar code snippet might be used to target other products in the future and make the activities of Waterbear harder to detect.  Tactic  Technique ID Description  Execution Execution
Module Load
T1129   Dynamically loads the DLLs through the shellcode Execution through API T1106
Dynamically loads the APIs through the shellcode Persistence
Hooking T1179   Hooks security product’s commonly used APIs Privilege Escalation   Process Injection T1055 Injects the decrypts payload into svchost.exe process Hooking T1179   Hooks security products’ commonly used APIs Defense Evasion Binary Padding T1009 Adds junk data to evade anti-virus scan Disabling Security Tools T1089 Targets a specific security product’s process for injection purposes Deobfuscate/Decode Files or Information T1140 Uses TROJ_WATERBEAR to decrypt encrypted payload Execution Guardrails T1480 Targets specific software in the victim’s environment DLL
Side-Loading T1073   Uses modified legitimate DLL to load the malicious DLL Process Injection T1055 Injects the decrypted payload into svchost.exe process Exfiltration Exfiltration Over Command and Control Channel T1041
Possibly sends collected data to attackers via C&C channel   Indicators of Compromise (IoCs)  SHA256  Detection Name  649675baef92381ffcdfa42e8959015e83c1ab1c7bbfd64635ce5f6f65efd651 BKDR_WATERBEAR.ZTGF 3909e837f3a96736947e387a84bb57e57974db9b77fb1d8fa5d808a89f9a401b TROJ_WATERBEAR.ZTGD fcfdd079b5861c0192e559c80e8f393b16ba419186066a21aab0294327ea9e58 TROJ_WATERBEAR.ZTGJ 3f26a971e393d7f6ce7bf4416abdbfa1def843a0cf74d8b7bb841ca90f5c9ed9 TROJ_WATERBEAR.ZTGH abb91dfd95d11a232375d6b5cdf94b0f7afb9683fb7af3e50bcecdb2bd6cb035 TROJ_WATERBEAR.ZTGH bda6812c3bbba3c885584d234be353b0a2d1b1cbd29161deab0ef8814ac1e8e1 TROJ_WATERBEAR.ZTGI 53402b662679f0bfd08de3abb064930af40ff6c9ec95469ce8489f65796e36c3 TROJ_WATERBEAR.ZTGH f9f6bc637f59ef843bc939cb6be5000da5b9277b972904bf84586ea0a17a6000 TROJ_WATERBEAR.ZTGI 3442c076c8824d5da065616063a6520ee1d9385d327779b5465292ac978dec26 BKDR_WATERBEAR.ZTGD 7858171120792e5c98cfa75ccde7cba49e62a2aeb32ed62322aae0a80a50f1ea
TROJ64_WATERBEAR.ZTGI acb2abc7fb44c2fdea0b65706d1e8b4c0bfb20e4bd4dcee5b95b346a60c6bd31 BKDR_WATERBEARENC.ZTGF b9f3a3b9452a396c3ba0ce4a644dd2b7f494905e820e7b1c6dca2fdcce069361 BKDR64_WATERBEAR.ZTGD 7c0d2782a33debb65b488893705e71a001ea06c4eb4fe88571639ed71ac85cdd BKDR_WATERBEARENC.ZTGH c7c7b2270767aaa2d66018894a7425ba6192730b4fe2130d290cd46af5cc0b7b BKDR_WATERBEARENC.ZTGI 7532fe7a16ba1db4d5e8d47de04b292d94882920cb672e89a48d07e77ddd0138 BKDR_WATERBEARENC.ZTGI dea5c564c9d961ccf2ed535139fbfca4f1727373504f2972ac92acfaf21da831 BKDR_WATERBEARENC.ZTGI 05d0ab2fbeb7e0ba7547afb013d307d32588704daac9c12002a690e5c1cde3a4 BKDR64_WATERBEARENC.ZTGJ 39668008deb49a9b9a033fd01e0ea7c5243ad958afd82f79c1665fb73c7cfadf BKDR_WATERBEARENC.ZTGD              Tags  Malware | APT & Targeted Attacks | Endpoints | Research | Network
Updated May 17, 2021, 3:25 a.m. Eastern Time:
This article has been updated to add references to the DarkSide victim data.
It has been five days since the shutdown prompted by the attack, but Colonial Pipeline is still unable to resume full operations.
Outages have already started affecting motorists.
To keep supplies intact for essential services, the US government has issued advisories against hoarding.
The FBI has confirmed that DarkSide, a cybercriminal group believed to have originated in Eastern Europe, is behind the attack.
The ransomware used by the group is a relatively new family that was first spotted in August 2020, but the group draws on experience from previous financially successful cybercrime enterprises.
Apart from locking Colonial Pipeline’s computer systems, DarkSide also stole over 100 GB of corporate data.
Even the DarkSide actors themselves admit that they just buy access to company networks — they have no idea how access was acquired.
The DarkSide ransomware DarkSide offers its RaaS to affiliates for a percentage of the profits.
August 2020: DarkSide introduces its ransomware.
November 2020:
The group invites other criminals to use its service.
A DarkSide data leak site is later discovered.
December 2020:
March 2021:
DarkSide releases version 2.0 of its ransomware with several updates.
May 2021:
DarkSide launches the Colonial Pipeline attack.
In our analysis of DarkSide samples, we saw that phishing, remote desktop protocol (RDP) abuse, and exploiting known vulnerabilities are the tactics used by the group to gain initial access.
Throughout the reconnaissance and gaining-entry phases, we saw these legitimate tools used for specific purposes:   PowerShell: for reconnaissance and persistence  Metasploit Framework: for reconnaissance Mimikatz: for reconnaissance BloodHound: for reconnaissance Cobalt Strike: for installation  For modern ransomware like DarkSide, gaining initial access no longer immediately leads to ransomware being dropped.
Lateral movement and privilege escalation Lateral movement is a key discovery phase in the modern ransomware process.
The group then continues its lateral movement through the system, eventually using the DC network share to deploy the ransomware to connected machines.
Some of the known lateral movement methods deployed by DarkSide use PSExec and RDP.
Exfiltration  As is common practice with double extortion ransomware, critical files are exfiltrated prior to the ransomware being launched.
This is the riskiest step so far in the ransomware execution process, as data exfiltration is more likely to be noticed by the victim organization’s security team.
It is the last step before the ransomware is dropped, and the attack often speeds up at this point to complete the process before it is stopped.
For exfiltration, we saw the following tools being used:   7-Zip: a utility used for archiving files in preparation for exfiltration  Rclone and Mega client: tools used for exfiltrating files to cloud storage PuTTy: an alternative application used for network file transfer  DarkSide uses several Tor-based leak sites to host stolen data.
The file-sharing services used by the group for data exfiltration include Mega and PrivatLab.
Execution and impact  The execution of the actual ransomware occurs next.
The DarkSide ransomware shares many similarities with REvil in this step of the process, including the structure of ransom notes and the use of PowerShell to execute a command that deletes shadow copies from the network.
In addition to PowerShell, which is used to install and operate the malware itself, the group reportedly uses Certutil and Bitsadmin to download the ransomware.
It uses two encryption methods, depending on whether the target operating system is Windows or Linux: A ChaCha20 stream cipher with RSA-4096 is used on Linux, and Salsa20 with RSA-1024 is used on Windows.
The following figure shows a sample ransom note from DarkSide.
A Darkside ransom note
It is interesting to note that DarkSide’s ransom note is similar to that of Babuk, which might indicate that these two families share a link.
DarkSide ransomware targets
Based on the group’s Tor leak sites, DarkSide determines whether to pursue targeting a potential victim organization by primarily looking at that organization’s financial records.
It also uses this information to determine the amount of ransom to demand, with a typical ransom demand amounting to anywhere between US$200,000 and US$2 million.
Reports say that, based on the leak sites, there are at least 90 victims affected by DarkSide.
In total, more than 2 TB of stolen data is currently being hosted on DarkSide sites, and 100% of victims’ stolen files are leaked.
The actors behind Darkside have stated that they avoid targeting companies in certain industries, including healthcare, education, the public sector, and the nonprofit sector.
Organizations in manufacturing, finance, and critical infrastructure have been identified in Trend Micro data as targets.
Based on Trend Micro data, the US is by far DarkSide’s most targeted country, at more than 500 detections, followed by France, Belgium, and Canada.
As previously mentioned, DarkSide avoids victimizing companies in CIS countries.
Part of the ransomware execution code checks for the geolocation of potential victims to avoid companies in these countries, although the group would likely be aware of the location of a target organization long before the ransomware is executed.
That the group admittedly spares companies in CIS countries could be a clue to where DarkSide actors are residing.
It is possible that they do this to avoid law enforcement action from these countries, since the governments of some of these countries do not persecute criminal acts such as DarkSide’s if they are done on foreign targets.
After the Colonial Pipeline attack, DarkSide released a statement on one of its leak sites clarifying that the group did not wish to create problems for society and that its goal was simply to make money.
There is no way to verify this statement, but we know that the group is still quite active.
As previously mentioned, DarkSide actors announced that they had stolen data from three more victims since the Colonial Pipeline attack.
MITRE ATT&CK tactics and techniques
The following are the MITRE ATT&CK tactics and techniques associated with DarkSide.
Ransomware is an old but persistently evolving threat.
As demonstrated by the recent activities of DarkSide, modern ransomware has changed in many aspects: bigger targets, more advanced extortion techniques, and farther-reaching consequences beyond the victims themselves.
Ransomware actors are no longer content with simply locking companies out of their computers and asking for ransom.
Now they are digging deeper into their victims’ networks and looking for new ways to monetize their activities.
For example, a compromised cloud server can go through a complete attack life cycle, from the initial compromise to data exfiltration to resale or use for further monetization.
Compromised enterprise assets are a lucrative commodity on underground markets; cybercriminals are well aware of how to make money from attacking company servers.
In the Colonial Pipeline attack, DarkSide used double extortion.
But some ransomware actors have gone even further.
Jon Clay, Director of Global Threat Communications at Trend Micro, outlines the phases of ransomware:
Phase 1: Just ransomware.
Encrypt the files, drop the ransom note, and wait for the payment.
Phase 2: Double extortion.
Phase 1 + data exfiltration and threatening data release.
Maze was one of the first documented cases of this.
Phase 3: Triple extortion.
Phase 1 + Phase 2 + threatening DDoS.
SunCrypt, RagnarLocker, and Avaddon were among the first groups documented doing this.
Phase 4: Quadruple extortion.
Phase 1 (+ possibly Phase 2 or Phase 3) + directly emailing the victim’s customer base or having contracted call centers contact customers.
In fact, as detailed in security reports, DarkSide offers both the DDoS and call center options.
The group is making quadruple extortion available to its affiliates and showing a clear sign of innovation.
In cybercrime, there are no copyright or patent laws for tools and techniques.
Innovation is as much about quickly and completely copying others’ best practices as it is about coming up with new approaches.
Ransomware will only continue to evolve.
Organizations therefore need to take the time to put in place an incident response plan focused on the new model of ransomware attacks.
Unfortunately, some organizations may be putting cybersecurity on the back burner.
For example, some security experts noted that Colonial Pipeline was using a previously exploited vulnerable version of Microsoft Exchange, among other cybersecurity lapses.
A successful attack on a company providing critical services will have rippling effects that will harm multiple sectors of society, which is why protecting these services should be a top priority.
In a US Senate hearing on cybersecurity threats, Senator Rob Portman of Ohio described the strike on Colonial Pipeline as “potentially the most substantial and damaging attack on US critical infrastructure ever.”
This attack is a call to action for all organizations to harden their networks against attacks and improve their network visibility.
Trend Micro has a multilayered cybersecurity platform that can help improve your organization’s detection and response against the latest ransomware attacks and improve your organization’s visibility.
Visit the Trend Micro Vision One™ website for more information.
Detailed solutions can be found in our knowledge base article on DarkSide ransomware.
Tags  APT & Targeted Attacks | Ransomware | Research | Articles, News, Reports
We have been collectively saying in our industry for the last 15-20 years that a layered approach to your security stack is a “best practice,” but as with all best practices, these are ideals rather than reality for so many charged with protecting their organizations.
The vast majority of CISOs are saddled with legacy operating systems and applications, along with a lack of funding.
For many of those in the more mature sectors who struggle less with resources, such as financial and government, this ideal state has been achieved by buying a large number of feature products for each layer.
Then, add more and more people to each layer with the hope that they can effectively coordinate their layers to protect, detect, respond and recover from attacks.
Today’s Challenge
While this strategy has provided a small level of success, it’s not sustainable and definitely not an option for the remaining 90% of companies with resource challenges.
Further complicating the issue is the growing scope and scale of attacks today that are successfully targeting the seams between these layers.
There are many reasons why we are in this overloaded place, drowning in alerts and logs.
But, there is one cause that we can point to that has become especially problematic to the design and operations of security programs – the focus on the “kill chain.”
This focus can be effective to simplify and explain the progression of an attack through the different layers.
However, it doesn’t adequately address the reality of the non-linear nature of attacks.
It also misses the incredible importance of identifying tactics, techniques, and tools used by global threat actor groups today.
(Que the MITRE ATT&CK plug)
ATT&CK “…is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.”
ATT&CK enables network defenders and cyber threat intelligence analysts to collaborate through an open community to continuously identify tactics, techniques and tools used by 90+ global threat actor groups to improve their protection and detection.
Today’s Protection
Other innovative trends that work hand in hand with ATT&CK is the move to XDR from EDR.
In the same way that the kill chain has become an outdated concept, so has the notion that EDR is sufficient to speed up detection and response by solely using the endpoint.
ATT&CK gives you the full picture of the threat, and XDR coordinates protection against the full picture of that threat.
While the endpoint is still critical, there are vast numbers of malicious artifacts that are siloed or missed at the network, cloud, and gateway.
XDR fills in those gaps.
Do you think the evolution of EDR to XDR will meet many of challenges we are seeing today?
Tweet us your thoughts at @TrendMicro.
Tags  Cloud | APT & Targeted Attacks | Expert Perspective | Articles, News, Reports | Cyber Threats
Determining who is behind a malware campaign can be a challenging endeavor.
Threat actors generally don’t leave easily identifiable signatures in software designed to disrupt or otherwise harm an adversary.
However, by comparing key pieces of information with known sources, it is possible to determine when a campaign was likely perpetrated by a certain group.
This is even more true when the group has existed for many years and has many pieces of evidence to compare.
Recently, we uncovered the Operation Earth Kitsune campaign and published a detailed analysis of its tactics, techniques, and procedures (TTPs).
While analyzing the technical details of this malware, which includes two new espionage backdoors, we noticed striking similarities to other malware attributed to the threat actor known as APT37, also known as Reaper or Group 123.
We hope our thorough analysis of Operation Earth Kitsune will help others with data points for attribution in the future.
By some accounts, this group has been active since 2012, so there are many examples attributed to them to compare.
It is important to note that previous analysis of suspected APT37 activities from different security vendors date from 2016, and the captured samples for the Operation Earth Kitsune have been developed recently.
Because of this, finding code similarity is unlikely.
However, we were able to match some code reuse in one of the espionage backdoor’s functionalities.
In that sense, we are emphasizing TTPs correlation in this case.
In other words, even when the new samples are developed, the attacker may have reused many of the operational techniques.
Another important consideration for attribution is that we have some historical background for Operation Earth Kitsune.
Previously, we uncovered two different campaigns in 2019 under the name of SLUB malware.
Operation Earth Kitsune is a continuation of those campaigns.
Consequently, some of the attribution indicators will span and include the previous SLUB malware campaigns.
The following sections describe the different correlations and are divided into two main categories:  Correlation related to the malware author developing environment Correlation associated with TTPs  Note that some leads are stronger than others; however, when combined, they suggest that the same threat actor behind malware previously attributed to APT37 is likely responsible for Operation Earth Kitsune.
Malware author’s developer environment
When determining attribution, the most interesting leads are the ones that can deduce information about the malware author’s working environment.
Sometimes, these leads can determine the preferred languages used in the developers’ environment.