mrmoor/cyber-threat-intelligence huggingface dataset:
The actors behind this campaign, which we attribute to a group of hackers recruited in a Russian-speaking forum, lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams.
In collaboration with YouTube, Gmail, Trust & Safety, CyberCrime Investigation Group and Safe Browsing teams, our protections have decreased the volume of related phishing emails on Gmail by 99.6% since May 2021.
We blocked 1.6M messages to targets, displayed ~62K Safe Browsing phishing page warnings, blocked 2.4K files, and successfully restored ~4K accounts.
With increased detection efforts, we’ve observed attackers shifting away from Gmail to other email providers (mostly email.cz, seznam.cz, post.cz and aol.com).
Moreover, to protect our users, we have referred the below activity to the FBI for further investigation.
In this blog, we share examples of the specific tactics, techniques and procedures (TTPs) used to lure victims, as well as some guidance on how users can further protect themselves.
Cookie Theft, also known as “pass-the-cookie attack,” is a session hijacking technique that enables access to user accounts with session cookies stored in the browser.
While the technique has been around for decades, its resurgence as a top security risk could be due to a wider adoption of multi-factor authentication (MFA) making it difficult to conduct abuse, and shifting attacker focus to social engineering tactics.
Many YouTube creators provide an email address on their channel for business opportunities.
In this case, the attackers sent forged business emails impersonating an existing company requesting a video advertisement collaboration.
The phishing typically started with a customized email introducing the company and its products.
Once the target agreed to the deal, a malware landing page disguised as a software download URL was sent via email or a PDF on Google Drive, and in a few cases, Google documents containing the phishing links.
Around 15,000 actor accounts were identified, most of which were created for this campaign specifically.
The attackers registered various domains associated with forged companies and built multiple websites for malware delivery.
To date, we’ve identified at least 1,011 domains created solely for this purpose.
Some of the websites impersonated legitimate software sites, such as Luminar, Cisco VPN, games on Steam, and some were generated using online templates.
During the pandemic, we also uncovered attackers posing as news providers with a “Covid19 news software.”
In one case, we observed a fake social media page copying content from an existing software company.
The following screenshot is an example of a fake page where the original URL is replaced with one leading to a cookie theft malware download.
Because Google actively detects and disrupts phishing links sent via Gmail, the actors were observed driving targets to messaging apps like WhatsApp, Telegram or Discord.
Once the target runs the fake software, a cookie stealing malware executes, taking browser cookies from the victim’s machine and uploading them to the actor's command & control servers.
Although this type of malware can be configured to be persistent on the victim's machine, these actors are running all malware in non-persistent mode as a smash-and-grab technique.
This is because if the malicious file is not detected when executed, there are less artifacts on an infected host and therefore security products fail to notify the user of a past compromise.
We have observed that actors use various types of malware based on personal preference, most of which are easily available on Github.
Some commodity malware used included RedLine, Vidar, Predator The Thief, Nexus stealer, Azorult, Raccoon, Grand Stealer, Vikro Stealer, Masad (Google’s naming), and Kantal (Google’s naming) which shares code similarity with Vidar.
Open source malware like Sorano and AdamantiumThief were also observed.
Related hashes are listed in the Technical Details section, at the end of this report.
Most of the observed malware was capable of stealing both user passwords and cookies.
Some of the samples employed several anti-sandboxing techniques including enlarged files, encrypted archive and download IP cloaking.
A few were observed displaying a fake error message requiring user click-through to continue execution.
A large number of hijacked channels were rebranded for cryptocurrency scam live-streaming.
The channel name, profile picture and content were all replaced with cryptocurrency branding to impersonate large tech or cryptocurrency exchange firms.
The attacker live-streamed videos promising cryptocurrency giveaways in exchange for an initial contribution.
On account-trading markets, hijacked channels ranged from $3 USD to $4,000 USD depending on the number of subscribers.
These campaigns were carried out by a number of hack-for-hire actors recruited on Russian-speaking forums via the following job description, offering two types of work: This recruitment model explains the highly customized social engineering, as well as the varied malware types given each actor's choice of preferred malware.
We are continuously improving our detection methods and investing in new tools and features that automatically identify and stop threats like this one.
Some of these improvements include: It is also important that users remain aware of these types of threats and take appropriate action to further protect themselves.
Our recommendations: Additional resources: Avoid & Report Phishing Emails.
Related Malware hashes: Top Phishing Domains:
We have a long-standing policy to send you a warning if we detect that your account is a target of government-backed phishing or malware attempts.
So far in 2021, we’ve sent over 50,000 warnings, a nearly 33% increase from this time in 2020.
This spike is largely due to blocking an unusually large campaign from a Russian actor known as APT28 or Fancy Bear.
We intentionally send these warnings in batches to all users who may be at risk, rather than at the moment we detect the threat itself, so that attackers cannot track our defense strategies.
On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.
This means that there is typically more than one threat actor behind the warnings.
In this blog, we explore some of the most notable campaigns we’ve disrupted this year from a different government-backed attacker: APT35, an Iranian group, which regularly conducts phishing campaigns targeting high risk users.
This is the one of the groups we disrupted during the 2020 US election cycle for its targeting of campaign staffers.
For years, this group has hijacked accounts, deployed malware, and used novel techniques to conduct espionage aligned with the interests of the Iranian government.
In early 2021, APT35 compromised a website affiliated with a UK university to host a phishing kit.
Attackers sent email messages with links to this website to harvest credentials for platforms such as Gmail, Hotmail, and Yahoo.
Users were instructed to activate an invitation to a (fake) webinar by logging in.
The phishing kit will also ask for second-factor authentication codes sent to devices.
APT35 has relied on this technique since 2017 — targeting high-value accounts in government, academia, journalism, NGOs, foreign policy, and national security.
Credential phishing through a compromised website demonstrates these attackers will go to great lengths to appear legitimate – as they know it's difficult for users to detect this kind of attack.
In May 2020, we discovered that APT35 attempted to upload spyware to the Google Play Store.
The app was disguised as VPN software that, if installed, could steal sensitive information such as call logs, text messages, contacts, and location data from devices.
Google detected the app quickly and removed it from the Play Store before any users had a chance to install it.
Although Play Store users were protected, we are highlighting the app here as TAG has seen APT35 attempt to distribute this spyware on other platforms as recently as July 2021.
One of the most notable characteristics of APT35 is their impersonation of conference officials to conduct phishing attacks.
Attackers used the Munich Security and the Think-20 (T20) Italy conferences as lures in non-malicious first contact email messages to get users to respond.
When they did, attackers sent them phishing links in follow-on correspondence.
Targets typically had to navigate through at least one redirect before landing on a phishing domain.
Link shorteners and click trackers are heavily used for this purpose, and are oftentimes embedded within PDF files.
We’ve disrupted attacks using Google Drive, App Scripts, and Sites pages in these campaigns as APT35 tries to get around our defenses.
Services from Dropbox and Microsoft are also abused.
One of APT35’s novel techniques involves using Telegram for operator notifications.
The attackers embed javascript into phishing pages that notify them when the page has been loaded.
To send the notification, they use the Telegram API sendMessage function, which lets anyone use a Telegram bot to send a message to a public channel.
The attackers use this function to relay device-based data to the channel, so they can see details such as the IP, useragent, and locales of visitors to their phishing sites in real-time.
We reported the bot to Telegram and they have taken action to remove it.
We warn users when we suspect a government-backed threat like APT35 is targeting them.
Thousands of these warnings are sent every month, even in cases where the corresponding attack is blocked.
If you receive a warning it does not mean your account has been compromised, it means you have been identified as a target.
Workspace administrators are also notified regarding targeted accounts in their domain.
Users are encouraged to take these warnings seriously and consider enrolling in the Advanced Protection Program or enabling two-factor authentication if they haven't already.
We also block malicious domains using Google Safe Browsing – a service that Google's security team built to identify unsafe websites across the web and notify users and website owners of potential harm.
When a user of a Safe Browsing-enabled browser or app attempts to access unsafe content on the web, they’ll see a warning page explaining that the content they’re trying to access may be harmful.
When a site identified by Safe Browsing as harmful appears in Google Search results, we show a warning next to it in the results.
Threat Analysis Group will continue to identify bad actors and share relevant information with others in the industry, with the goal of bringing awareness to these issues, protecting you and fighting bad actors to prevent future attacks.
Indicators from APT28 phishing campaign: service-reset-password-moderate-digital.rf[.]gd reset-service-identity-mail.42web[.]io digital-email-software.great-site[.]net  Indicators from APT35 campaigns:  Abused Google Properties: https://sites.google[.]com/view/ty85yt8tg8-download-rtih4ithr/ https://sites.google[.]com/view/user-id-568245/ https://sites.google[.]com/view/hhbejfdwdhwuhscbsb-xscvhdvbc/  Abused Dropbox Properties: https://www.dropbox[.]com/s/68y4vpfu8pc3imf/Iraq&Jewish.pdf  Phishing Domains: nco2[.]live summit-files[.]com filetransfer[.]club continuetogo[.]me accessverification[.]online customers-verification-identifier[.]site service-activity-session[.]online identifier-service-review[.]site recovery-activity-identification[.]site review-session-confirmation[.]site recovery-service-activity[.]site verify-service-activity[.]site service-manager-notifications[.]info
Android App: https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection  Android App C2: communication-shield[.]site cdsa[.]xyz
To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild.
In 2021, we reported nine 0-days affecting Chrome, Android, Apple and Microsoft, leading to patches to protect users from these attacks.
This blog is a follow up to our July 2021 post on four 0-day vulnerabilities we discovered in 2021, and details campaigns targeting Android users with five distinct 0-day vulnerabilities: We assess with high confidence that these exploits were packaged by a single commercial surveillance company, Cytrox, and sold to different government-backed actors who used them in at least the three campaigns discussed below.
Consistent with findings from CitizenLab, we assess likely government-backed actors purchasing these exploits are operating (at least) in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain and Indonesia.
The 0-day exploits were used alongside n-day exploits as the developers took advantage of the time difference between when some critical bugs were patched but not flagged as security issues and when these patches were fully deployed across the Android ecosystem.
Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments with the technical expertise to develop and operationalize exploits.
Seven of the nine 0-days TAG discovered in 2021 fall into this category: developed by commercial providers and sold to and used by government-backed actors.
TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.
All three campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email.
The campaigns were limited — in each case, we assess the number of targets was in the tens of users.
Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website.
If the link was not active, the user was redirected directly to a legitimate website.
We've seen this technique used against journalists and other unidentified targets, and alerted those users when possible.
We assess that these campaigns delivered ALIEN, a simple Android malware in charge of loading PREDATOR, an Android implant described by CitizenLab in December 2021.
ALIEN lives inside multiple privileged processes and receives commands from PREDATOR over IPC.
These commands include recording audio, adding CA certificates, and hiding apps.
The first campaign, detected in August 2021, used Chrome on a Samsung Galaxy S21 and the web server immediately replied with a HTTP redirect (302) pointing to the following intent URL.
This URL abused a logic flaw and forced Chrome to load another URL in the Samsung Browser without user interaction or warnings.
We did not capture the subsequent stages, but assess the attackers did not have exploits for the current version of Chrome (91.0.4472) at that time, but instead used n-day exploits targeting Samsung Browser, which was running an older and vulnerable version of Chromium.
We assess with high confidence this vulnerability was sold by an exploit broker and probably abused by more than one surveillance vendor.
More technical details about this vulnerability are available in this RCA by Maddie Stone.
Related IOCs
In September 2021, TAG detected a campaign where the exploit chain was delivered to a fully up-to-date Samsung Galaxy S10 running the latest version of Chrome.
We recovered the exploit used to escape the Chrome Sandbox, but not the initial RCE exploit.
The sandbox escape was loaded directly as an ELF binary embedding libchrome.so and a custom libmojo_bridge.so was used to ease the communication with the Mojo IPCs.
This means the renderer exploit did not enable MojoJS bindings like we often see in public exploits.
Analysis of the exploit identified two different vulnerabilities in Chrome: After escaping the sandbox, the exploit downloaded another exploit in /data/data/com.android.chrome/p.so to elevate privileges and install the implant.
We haven’t retrieved a copy of the exploit.
In October 2021, we detected a full chain exploit from an up-to-date Samsung phone running the latest version of Chrome.
The chain included two 0-day exploits: Of note, CVE-2021-1048 was fixed in the Linux kernel in September 2020, over a year before this campaign.
The commit was not flagged as a security issue and therefore the patch was not backported in most Android kernels.
At the time of the exploit, all Samsung kernels were vulnerable; LTS kernels running on Pixel phones were recent enough and included the fix for this bug.
Unfortunately, this is not the first time we have seen this happen with exploits in the wild; the 2019 Bad Binder vulnerability is another example.
In both cases, the fix was not flagged as a security issue and thus not backported to all (or any) Android kernels.
Attackers are actively looking for and profiting from such slowly-fixed vulnerabilities.
We’d be remiss if we did not acknowledge the quick response and patching of these vulnerabilities by Google’s Chrome and Android teams.
We would also like to thank Project Zero for their technical assistance in helping analyze these bugs.
TAG continues to track more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.
We remain committed to updating the community as we uncover these campaigns.
Tackling the harmful practices of the commercial surveillance industry will require a robust, comprehensive approach that includes cooperation among threat intelligence teams, network defenders, academic researchers and technology platforms.
We look forward to continuing our work in this space and advancing the safety and security of our users around the world.
NOTE: On May 20th, we updated our attribution to more precisely describe our findings.
Google’s Threat Analysis Group (TAG) has been closely monitoring the cybersecurity activity in Eastern Europe with regard to the war in Ukraine.
Since our last update, TAG has observed a continuously growing number of threat actors using the war as a lure in phishing and malware campaigns.
Similar to other reports, we have also observed threat actors increasingly target critical infrastructure entities including oil and gas, telecommunications and manufacturing.
Financially motivated and criminal actors are also using current events as a means for targeting users.
As always, we continue to publish details surrounding the actions we take against coordinated influence operations in our quarterly TAG bulletin.
We promptly identify and remove any such content but have not observed any significant shifts from the normal levels of activity that occur in the region.
Here is a deeper look at the campaign activity TAG has observed and the actions the team has taken to protect our users over the past few weeks: APT28 or Fancy Bear, a threat actor attributed to Russia GRU, was observed targeting users in Ukraine with a new variant of malware.
The malware, distributed via email attachments inside of password protected zip files (ua_report.zip), is a .Net executable that when executed steals cookies and saved passwords from Chrome, Edge and Firefox browsers.
The data is then exfiltrated via email to a compromised email account.
Malware samples:
TAG would like to thank the Yahoo! Paranoids Advanced Cyber Threats Team for their collaboration in this investigation.
Turla, a group TAG attributes to Russia FSB, continues to run campaigns against the Baltics, targeting defense and cybersecurity organizations in the region.
Similar to recently observed activity, these campaigns were sent via email and contained a unique link per target that led to a DOCX file hosted on attacker controlled infrastructure.
When opened, the DOCX file would attempt to download a unique PNG file from the same attacker controlled domain.
Recently observed Turla domains: COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts.
The targets include government and defense officials, politicians, NGOs and think tanks, and journalists.
The group's tactics, techniques and procedures (TTPs) for these campaigns have shifted slightly from including phishing links directly in the email, to also linking to PDFs and/or DOCs hosted on Google Drive and Microsoft One Drive.
Within these files is a link to an attacker controlled phishing domain.
Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, has remained active during the course of the war and recently resumed targeting of Gmail accounts via credential phishing.
If the user clicked continue, they would be redirected to an attacker controlled site that collected the users credentials.
There were no accounts compromised from this campaign and Google will alert all targeted users of these attempts through our monthly government-backed attacker warnings.
Both pages from this campaign are shown below.
In mid-April, TAG detected a Ghostwriter credential phishing campaign targeting Facebook users.
The targets, primarily located in Lithuania, were sent links to attacker controlled domains from a domain spoofing the Facebook security team.
Recently observed Ghostwriter credential phishing domains and emails: Curious Gorge, a group TAG attributes to China's PLA SSF, has remained active against government, military, logistics and manufacturing organizations in Ukraine, Russia and Central Asia.
In Russia, long running campaigns against multiple government organizations have continued, including the Ministry of Foreign Affairs.
Over the past week, TAG identified additional compromises impacting multiple Russian defense contractors and manufacturers and a Russian logistics company.
Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further exploitation.
We also send all targeted Gmail and Workspace users government-backed attacker alerts notifying them of the activity.
We encourage any potential targets to enable Google Account Level Enhanced Safe Browsing and ensure that all devices are updated.
The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.
We’ll continue to take action, identify bad actors and share relevant information with others across industry and governments, with the goal of bringing awareness to these issues, protecting users and preventing future attacks.
In early March, Google’s Threat Analysis Group (TAG) published an update on the cyber activity it was tracking with regard to the war in Ukraine.
TAG has also continued to observe multiple ransomware brokers continuing to operate in a business as usual sense.
We promptly identify and remove any such content, but have not observed any significant shifts from the normal levels of activity that occur in the region.
Here is a deeper look at the campaign activity TAG has observed over the past two weeks: Curious Gorge, a group TAG attributes to China's PLA SSF, has conducted campaigns against government and military organizations in Ukraine, Russia, Kazakhstan, and Mongolia.
While this activity largely does not impact Google products, we remain engaged and are providing notifications to victim organizations.
Recently observed IPs used in Curious Gorge campaigns: COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor.
However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.
These campaigns were sent using newly created Gmail accounts to non-Google accounts, so the success rate of these campaigns is unknown.