mrmoor/cyber-threat-intelligence huggingface dataset:
Indicators of CompromiseFiles with the following hashes were used in the first series of attacks:  cd8329f75b1393ead3e16c6c79ee1ab476e6487370481e5931feb63305f00983 – detected as VBS_KEYLOG.NYKW f46f0e8eed0361294200d64e87b3fb13f6a3797f99f5b588444534f27612a590 – archive file;
contents detected as VBS_KEYLOG.NYKW fd883a978dd6d95fa5c3b5e0a154e0e07b06e7cb6c685f1ca9f58c73122df24d – archive file; contents detected as VBS_KEYLOG.NYKW 7413c7c0317e49e49d595408f721c2ab2f120215374accf2f8133c9d9ad603fb – detected as WORM_DUNIHI.AUSHH 89427241e26748949c235fc43805c72960d9c2711fa72036c33137648bb475fa – detected as VBS_REMCOS.B
Files with the following hashes were used in the second series of attacks:  fb5b5906feab268f90789b15351b8a193fb5f445a3ae9afb1da8fb814ed80325 – detected as VBS_KEYLOG.NYKW 306f4f843c5a5a119a3385ad2b18c78a04fac618031ddecabf0633083a6c9a76 – detected as VBS_KEYLOG.NYKW 33709ca050fd0abc2aba38326996bf1c3b6d9b875228c9f15e624f9002c199a8 – detected as VBS_OBFUS.VUJ ff0f9057d3da7b3500f145ce24670c89a93cdb5cbe74946b17397fc466ddfbda – detected as VBS_AUTORUN.ASUHK 9b7cc8f4807df162f99f5fa592bc7cc5c6a756d9c0311c7b2529f19a0ac59c1a – archive file; contents detected as VBS_OBFUS.VUK 587e38fb11bd0c4021ce6965e92838521616ee4c5506ef0fa160452e9c71d5cf – detected as VBS_OBFUS.VUK         Tags  APT & Targeted Attacks | Malware | Research | Articles, News, Reports
We have seen it deployed against fewer than two dozen accounts located in Iran.
With so much diversity in the attack surface, it’s important to leverage security best practices to manage your cyber risk.
Get advice here: https://success.trendmicro.com
Pay close attention to unrecognized network traffic (both inbound and outbound) and watch for sophisticated new phishing attacks.
Where possible, reduce your attack surface.
Our research teams and threat hunters will work vigilantly to monitor and identify any new threat intelligence and will continue to share updates here: trendmicro.com/ukrainecrisis.
This blog has been revised to include new facts that have been released since the original posting.
Tags  Cloud | Cyber Crime | Exploits & Vulnerabilities | Expert Perspective | Phishing | Cyber Threats | APT & Targeted Attacks | Endpoints | Mobile | Articles, News, Reports
This is the second directive the TSA issued to the pipeline sector this 2021, building on the initial Security Directive released on May 2021 following the ransomware attack on Colonial Pipeline by DarkSide.
The following are samples using this evasion: https://www.virustotal.com/gui/file/5094028a0afb4d4a3d8fa82b613c0e59d31450d6c75ed96ded02be1e9db8104f/detection
New variant: https://www.virustotal.com/gui/file/5c0ff7b23457078c9d0cbe186f1d05bfd573eb555baa1bf4a45e1b79c8c575db/detection
The four exploits were used as a part of three different campaigns.
The links led to attacker-controlled domains that mimicked legitimate websites related to the targeted users.
The information collected from the fingerprinting phase included screen resolution, timezone, languages, browser plugins, and available MIME types.
In our environment, we did not receive any payloads past this stage.
Related IOCs lragir[.]org armradio[.]org asbares[.]com armtimes[.]net armlur[.]org armenpress[.]org hraparak[.]org armtimes[.]org hetq[.]org
After a fingerprinting phase, similar to the one used with the Chrome exploit above, users were served an Internet Explorer 0-day.
We did not recover additional payloads in our environment.
During our investigation we discovered several documents uploaded to VirusTotal.
Examples of related Office documents uploaded to VirusTotal: https://www.virustotal.com/gui/file/656d19186795280a068fcb97e7ef821b55ad3d620771d42ed98d22ee3c635e67/detection https://www.virustotal.com/gui/file/851bf4ab807fc9b29c9f6468c8c89a82b8f94e40474c6669f105bce91f278fdb/detection
Unique URLs serving ​​CVE-2021-33742 Internet Explorer exploit: http://lioiamcount[.]com/IsnoMLgankYg6/EjlYIy7cdFZFeyFqE4IURS1 http://db-control-uplink[.]com/eFe1J00hISDe9Zw/gzHvIOlHpIXB http://kidone[.]xyz/VvE0yYArmvhyTl/GzV
Word documents with the following classid: {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} Related infrastructure: workaj[.]com wordzmncount[.]com Not all attacks require chaining multiple 0-day exploits to be successful.
(NOTE: This exploit is not connected to the other three we’ve discussed above.)
The victim would need to have a session open on these websites from Safari for cookies to be successfully exfiltrated.
There was no sandbox escape or implant delivered via this exploit.
The exploit targeted iOS versions 12.4 through 13.7.
Related IOCs supportcdn.web[.]app vegmobile[.]com 111.90.146[.]198
Increased Utilization
In the mid-to-late 2010s, more private companies have joined the marketplace selling these 0-day capabilities.
No longer do groups need to have the technical expertise, now they just need resources.
This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2020.
It was last updated on January 26, 2021.
We terminated 12 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.
We received leads from Facebook that supported us in this investigation.
We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Myanmar.
We terminated 35 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.
We received leads from the FBI that supported us in this investigation.
We terminated 2 YouTube channels as part of our ongoing investigation into a coordinated influence operation linked to Iran.
We terminated 10 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.
We terminated 22 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Indonesia.
We terminated 9 YouTube channels as part of our investigation into a coordinated influence operation linked to Egypt.
We terminated 6 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.
We terminated 1 YouTube channel as part of our ongoing investigation into coordinated influence operations linked to Myanmar.
We terminated 1 blog as part of our investigation into coordinated influence operations linked to Argentina.
We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to France.
We terminated 34 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Myanmar.
We terminated 3,317 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.
In June, we announced that we saw phishing attempts against the personal email accounts of staffers on the Biden and Trump campaigns by Chinese and Iranian APTs (Advanced Persistent Threats) respectively.
We haven’t seen any evidence of such attempts being successful.
The Iranian attacker group (APT35) and the Chinese attacker group (APT31) targeted campaign staffers’ personal emails with credential phishing emails and emails containing tracking links.
As part of our wider tracking of APT31 activity, we've also seen them deploy targeted malware campaigns.
Every malicious piece of this attack was hosted on legitimate services, making it harder for defenders to rely on network signals for detection.
In one example, attackers impersonated McAfee.
The targets would be prompted to install a legitimate version of McAfee anti-virus software from GitHub, while malware was simultaneously silently installed to the system.
This targeting is consistent with what others have subsequently reported.
Shortly after the U.S. Treasury sanctioned Ukrainian Parliament member Andrii Derkach for attempting to influence the U.S. electoral process, we removed 14 Google accounts that were linked to him.
As the course of the COVID-19 pandemic evolves, we’ve seen threat actors evolve their tactics as well.
In previous posts, we discussed targeting of health organizations as well as attacker efforts to impersonate the World Health Organization.
In the threat actor toolkit, different types of attacks are used for different purposes: Phishing campaigns can be used like a scalpel—targeting specific groups or individuals with personalized lures that are more likely to trick them into taking action (like clicking on a malware link), while DDoS attacks are more like a hatchet—disrupting or blocking a site or a service entirely.
While it’s less common to see DDoS attacks rather than phishing or hacking campaigns coming from government-backed threat groups, we’ve seen bigger players increase their capabilities in launching large-scale attacks in recent years.
For example in 2017, our Security Reliability Engineering team measured a record-breaking UDP amplification attack sourced out of several Chinese ISPs (ASNs 4134, 4837, 58453, and 9394), which remains the largest bandwidth attack of which we are aware.
Through the Apex One with Endpoint Sensor (iES), we discovered one such incident wherein an attacker utilized sophisticated techniques in an attempt to exfiltrate sensitive information from a company.
Technical analysis Detection
We noticed the execution of schtasks.exe with the command line parameter “schtasks /create /tn <name> c:\programdata\<software name>\<file name>.bat /sc /once /st <time> /ru <user account>”.
The scheduled task was not created for persistence.
The batch file that was to be executed had a suspicious name that stood out.
This prompted us to dig deeper.
The image file of the process residing in the Windows directory that triggered the schtasks command was marked as normal.
PlugX and  malicious BLOBs
Reversing the file revealed that it was the PlugX loader, a remote access tool (RAT) that has been historically used in attacks targeting government-related industries and organizations.
The relationship between the normal file used, the PlugX, and the malicious BLOB      Despite being around for quite some time, PlugX is still effective at evading detection.
Detection support for the BLOB is probably low.
Aside from this, changing the encryption mechanism or packer would result in a totally different BLOB.
It should be noted that we have also observed an increase use of BLOB files since 2020.
A closer look at PlugX svchost injection
This variant of PlugX (detected by Trend Micro as Backdoor.Win32.PLUGX.DYSGUT), including the code in the BLOB, launches an svchost.exe process and injects to it.
Usually, svchost is launched by services.exe, so the action done by PlugX could be used as a trigger for investigation.
Svchost injection is not new — in fact, Trickbot and other malware variants use this technique.
The difference between Trickbot and PlugX is that Trickbot is much easier to detect.
Trickbot’s binary, which is not whitelisted, does the injection; in PlugX’s case, a normal process that is possibly whitelisted, does the injection.
Our investigation shows that the attacker used other tools during the attack.
The tools used varied from network scanners to account harvesters.
To avoid this, the attacker chose a different approach.
For every tool that needs to be run, it creates three things:   The auxiliary tool file <filename>.bat file Cmd.exe with a schtasks.exe command to create a scheduled task to run the batch file above  Instead of directly launching the auxiliary tool, it makes use of a scheduled task that runs the batch file that, in turn, executes the tool.
The attacker’s usage of a tool can be divided into two separate events: the dropping of the tool by the svchost.exe process that runs the malicious code and the execution of the tool via the scheduled task.
If the creation of the tool, batch file, and scheduled task is disregarded, it would seem that there is no connection between PlugX and the execution of the auxiliary tool.
However, a deeper investigation proved otherwise.
Launching the auxiliary tool via the scheduled task     Scheduled tasks are usually associated with persistence or privilege escalation, which is not the case in this incident.
Having the scheduled task run only once removes the notion of persistence.
Meanwhile, having the same user account launch the PlugX process and the auxiliary tool shows that the scheduled task is not for privilege escalation.
However, the attacker was able to delete it before we were able to get our hands on the tools used for investigation purposes.
An analysis of these tools could be used to better understand what is happening or what has happened in the environment.
Whenever a tool is used, the attacker deletes it from the disk as soon as it has done its purpose – which usually does not last for more than 15 minutes.
Based on our investigation of this specific attack, we provide helpful tips for enterprises and organizations to spot PlugX and lateral movement in their environments.
Threat hunters can use this to possibly identify other machines that have PlugX installed: Using attributes that could identify the normal file, such as the hash and the digital signer, a sweeping task could be carried out to identify instances of the normal file.
Chances are, the normal file that loads the rest of PlugX uses a file name that is different from what it normally uses or is in a location where it is not usually found.
For example, Microsoft’s outlook.exe is usually found in the Program Files directory.
Finding such entries that stand out could help identify how wide the infection is.
How to spot lateral movement
In this particular attack, we observed that to perform lateral movement, the attacker mapped Windows admin shares and used remotely created scheduled tasks to launch malware.
Both events never or rarely happened in the victim’s environment.
The importance of looking into anomalous events
When identifying PlugX and lateral movement techniques utilized in attacks, it’s important to be able to determine anomalous events.
Keeping an eye on anomalous events could help detect incidents earlier.
HyperBro is a malware family used by Iron Tiger (also known as Emissary Panda, APT27, Bronze Union, and Luckymouse), an advanced persistent threat (APT) group that has been performing cyberespionage for almost a decade, and there have been no reports of this group associated with a tool for Mac operating systems (OS).
Further investigation showed that MiMi chat installers have been compromised to download and install HyperBro samples for the Windows platform and rshell samples for the Mac OS platform.
Infection vector MiMi (mimi = 秘密  = secret in Chinese) is an instant messaging application designed especially for Chinese users, with implementations for major desktop and mobile operating systems: Windows, macOS, Android, and iOS.
We already came across an abuse of this application during the Earth Berberoka investigation.
Also, we could not find anything malicious in the latest Windows installer.
In this case, we can see that it took an hour and a half for the attackers to modify the legitimate installer and add malicious code to it.
For older versions, it took the attackers one day to inject its modifications.
Once deobfuscated, we saw that the inserted code downloads rshell from the IP address 139[.]180[.]216[.]65 and executes it once run on the macOS platform.
After looking at previous versions of this installer, we found that the first compromised version was 2.3.0, built on May 26, 2022, while the previous version (2.2.10, published on May 6, 2022) was clean.
Figure 4. Malicious Javascript code inserted into 2.2.0.exe targeting Windows OS      Figure 5.
Malware analysis rshell
The OS information collection routine gathers the following information:  GUID: (randomly generated guid, stored in /tmp/guid) computer name: uname (nodename)
Cmd Init Start new shell Cmd close
Kill shell Cmd data
, another warning message about an unverified developer is displayed.
Figure 7. Unverified developer warning with the “Open” button noticeably missing
Afterward, one more warning about the unverified developer is displayed.
Unverified developer warning with the “Open” button enabled
HyperBro
The HyperBro malware family has been around since 2017 and has been extensively analyzed.
It was updated in mid-2019, which we described in detail in our Operation DRBControl paper.
The said company was formerly known as Kingsoft Internet Software Holdings Limited, wherein during our previous investigation on the group, we already found one HyperBro DLL signed by a certificate belonging to Kingsoft.
We found 13 different targets while following our sensors‘ data.
Interestingly, we found a sample from the Reptile rootkit framework in that same company, as well as network requests to a subdomain that belongs to Earth Berberoka’s infrastructure.
Threat actor modified version 2.2.0 of Windows MiMi chat installer to download and execute HyperBro backdoor May 2021:
First, the dlpprem32.dll file linked to HyperBro shares certain characteristics (specifically imphash, RICH header) with previous samples already attributed to the group.
Also, the file names involved in the decoding and loading of HyperBro are similar to those we witnessed during our investigation last year.
Second, one of the Linux rshell samples used the IP address 45[.]142[.]214[.]193 as its C&C.
In 2020, that IP address had a particular reverse DNS: nbaya0u2[.]example[.]com.
During our Operation DRBControl investigation, we found a HyperBro sample that had 138[.]124[.]180[.]108 as its C&C. This second IP address had nbaya0u1[.]example[.]com as its reverse DNS.
However, as the rshell sample was found in 2021, we initially did not find this correlation strong enough to attribute the rshellmalware family to Iron Tiger.
We also found some links to Earth Berberoka.
From one of the victims where we found an rshell sample, we also found a binary belonging to the Reptile rootkit framework, a rootkit identified as part of the arsenal of Earth Berberoka.
We also noticed network communications from this victim to a subdomain of Earth Berberoka, suggesting it could have been previously compromised by this threat actor.
One of the rshell samples had center[.]veryssl[.]org as the C&C.
Both findings suggest that those victims could be compromised by both threat actors, or that Earth Berberoka is actually a subgroup of Iron Tiger.
As a reminder, while investigating Earth Berberoka, we found multiple links to Iron Tiger that we detailed in our research.
Updated the detection names on January 25, 2018, 9:47 PM PDT
The malware known as RATANKBA is just one of the weapons in Lazarus’ arsenal.
We analyzed a new RATANKBA variant (BKDR_RATANKBA.ZAEL-A), discovered in June 2017, that uses a PowerShell script instead of its more traditional PE executable form—a version that other researchers also recently identified.
We identified a number of servers Lazarus used as a backend system for temporarily holding stolen data.
They could have also been performing exercises in preparation for an attack against similar targets.
Lazarus’ backend logs also record victim IP addresses.
Infection Flow  Figure 1.
RATANKBA Infection Flow RATANKBA is delivered to its victims using a variety of lure documents, including Microsoft Office documents, malicious CHM files, and different script downloaders.
These documents contain topics discussing either software development or digital currencies.
An example of a lure used in a RATANKBA attack can be seen below:  Figure 2. Malicious CHM file used as RATANKBA lure
This RATANKBA backdoor is what is used to communicate with RATANKBA’s Command-and-Control (C&C) server.
Killkill: Stops the backdoor’s activities interval: Changes the interval in which the backdoor retrieves jobs; the default interval is set at 120 seconds cmd: Executes shell commands exe:Reflectively injects a DLL downloaded from a specific URL
In addition to the backdoor’s modus operandi, the attackers will use a Microsoft WMI command-line tool to list the compromised system’s running processes, which are sent to the C&C server:  “C:\Windows\system32\cmd.exe” /c “wmic process get processid,commandline,sessionid | findstr SysWOW” “C:\Windows\system32\cmd.exe” /c “wmic process get processid,commandline,sessionid | findstr x86”    Technical Analysis
During our analysis, we collected a copy of the RATANKBA malware’s Lazarus Remote Controller tool.
Figure 3. RATANKBA communication diagram
The controller downloads the victim profiles from the server.
Below are the various functionalities of RATANKBA’s controller:
Deletes the downloaded victim profiles delete_con Deletes the connection log files if they were already downloaded
Kill: Posts a job to kill the backdoor inject Posts a job for DLL injection Interval Changes the sleep interval Cmd
RATANKBA main console interface
RATANKBA host manipulation console RATANKBA’s controllers use the “Nimo Software HTTP Retriever 1.0” user-agent string for its communication.
The shift from PE to Powershell makes it more difficult for antivirus solutions to detect.
The screenshot below shows the conversion from C/C++ code to Powershell, while the protocol remained unchanged.
Figure 6. C/C++ version of RATANKBA  Figure 7. Powershell version of RATANKBA Profile of the Attackers
While we do not have any knowledge of who the actual Lazarus attackers are, the data collected from the backend systems gives us some insights into the internet usage patterns of systems likely owned by Lazarus group members.
Figure 8. Empty cryptocurrency wallet of the attacker  Figure 9.
An attacker mining Ant Share Defending against RATANKBA
Trend Micro™ Deep Security™ provides virtual patching that protects endpoints from threats such as malicious redirections to malware-hosting URLs as well as those that exploit unpatched vulnerabilities.
A detailed timeline of the Lazarus group's operations can be seen here.
Indicators of Compromise (IoCs): Hashes detected as BKDR_RATANKBA.ZAEL-A  1768f2e9cea5f8c97007c6f822531c1c9043c151187c54ebfb289980ff63d666 6cac0be2120be7b3592fe4e1f7c86f4abc7b168d058e07dc8975bf1eafd7cb25 d844777dcafcde8622b9472b6cd442c50c3747579868a53a505ef2f5a4f0e26a db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471  f7f2dd674532056c0d67ef1fb7c8ae8dd0484768604b551ee9b6c4405008fe6b      Hashes detected as CHM_DLOADER.ZCEL-A  01b047e0f3b49f8ab6ebf6795bc72ba7f63d7acbc68f65f1f8f66e34de827e49 030b4525558f2c411f972d91b144870b388380b59372e1798926cc2958242863 10cbb5d0974af08b5d4aa9c753e274a81348da9f8bfcaa5193fad08b79650cda 650d7b814922b58b6580041cb0aa9d27dae7e94e6d899bbb3b4aa5f1047fca0f 6cb1e9850dd853880bbaf68ea23243bac9c430df576fa1e679d7f26d56785984 6d4415a2cbedc960c7c7055626c61842b3a3ca4718e2ac0e3d2ac0c7ef41b84d 772b9b873100375c9696d87724f8efa2c8c1484853d40b52c6dc6f7759f5db01 9d10911a7bbf26f58b5e39342540761885422b878617f864bfdb16195b7cd0f5 d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48    Hashes detected as JS_DLOADER.ZBEL-A   8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3    Hashes detected as X97M_DLOADR.ZBEL-A   972b598d709b66b35900dc21c5225e5f0d474f241fefa890b381089afd7d44ee    Hashes detected as VBS_DLOADR.ZAEL-A   4722138dda262a2dca5cbf9acd40f150759c006f56b7637769282dba54de0cab           Tags  Malware | APT & Targeted Attacks | Endpoints | Cyber Crime | Research | Network
A typical Lurk infection uses browser exploits to deliver non-persistent payloads to potential victims, probing their targets before deploying additional malware.
Nine more suspected members of the group were arrested by Russia's Ministry of Internal Affairs on February 8.
How did Lurk evolve from a clique of threat actors to a full-fledged cybercriminal group?
What other techniques were they known for—that other cybercriminals emulated?
Lurk’s web-based attacks were the first signs of their campaigns.
The group already implemented certain mechanisms to prevent AV detection.
Requests during a time period or from a source IP address that didn’t match their preferred distribution area, for instance, would yield a redirect to a third-party site such as Google.
Lurk compromised systems by exploiting web browser vulnerabilities via drive-by download attacks.
Malvertising and poisoning of content-serving application components, such as memcached cache poisoning, were also part of their traffic redirection methods.