mrmoor/cyber-threat-intelligence huggingface dataset:
Figure 1: Tweety Chat’s interface (top), and code snippets showing the file types it steals (bottom) Romance in cyberespionage
The user list, chat room names, and content of the applications were stored in a remote server without any authentication.
The chat logs shed light on the social engineering used by the operators to persuade victims to install the cyberespionage malware on their Android devices.
The first user and chatroom were created on August 27, 2017, and were probably the app authors’ testing ground.
The succeeding users and chatrooms were created on October 31 and December 12 the latest.
A certain hayat22 and love piqued our interest.
hayat22, supposedly a female student, engaged in an online romance with a target whose handle was love, describing himself as living in South Asia working in garments manufacturing and wholesaling.
Over the course of their correspondence, love suggested using WhatsApp to communicate.
hayat22 declined, saying she felt safer using Tweety Chat.
love refused, but when hayat22 demurred and gave love an online cold shoulder, love tried installing Tweety Chat — and failed.
He claimed that he wasn’t able to install the app.
hayat22 quickly lost interest and stopped replying to him altogether.
She also sent him a screenshot to show what Tweety Chat looked like.
We’re not sure how love wound up in the chat room or how he met hayat22.
He was probably either using the Windows version of Secret Chat Point or its web interface, which explains why hayat22 was urging him to install Android Tweety Chat.
In an earlier chat group, an operator called Heena urged the members to install Secret Chat Point on other people’s mobile devices to get perks like credits or the ability to “go invisible”.
In another chat room called “Maira’s room”, a target of interest disclosed he was a government officer traveling back from a northern city near the country’s provincial capital.
A few days after, the operator stopped answering in the chat room, and her user account was deleted from the server.
Figure 2: ByeBye Shell’s interface showing Confucius’ campaigns  Figure 3: Screenshot showing a group chat where the moderator is urging users to install Tweety Chat  Figure 4: Screenshot showing Tweety Chat promoted in social media
A tangled web of malware
Confucius’ operations include deploying bespoke backdoors and stealing files from their victim’s systems with tailored file stealers, some of which bore resemblances to Patchwork’s.
The stolen files are then exfiltrated by abusing a cloud storage service.
Some of these file stealers specifically target files from USB devices, probably to overcome air-gapped environments.
Compared to Patchwork, whose Trojanized documents exploit at least five security flaws, Confucius’ backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882.
Their malware’s resemblance to that of Patchwork’s is also notable.
The use of an exploit for a security flaw disclosed in December 2017 and their recent activities suggest Confucius is keenly trailing their targets.
Confucius has a miscellany of backdoors: sctrls, ByeBye Shell, remote-access-c3, and sip_telephone, to name a few.
One of its file stealers, swissknife2, abuses a cloud storage service as a repository of exfiltrated files.
At the time of research, there were around 60 victims whose data were uploaded to Confucius-owned cloud storage account.
There were also a few thousand files in the account that were later deleted.
Our research, Deciphering Confucius: A Look at the Group’s Cyberespionage Operations, delves into the group’s operations, the social engineering methods and gamut of malware it uses, and the countermeasures that organizations can adopt to mitigate them.
The list of indicators of compromise, which includes Trend Micro’s corresponding detections and solutions, is in this appendix.
"A few weeks ago, British Airways was hit by the largest ever regulatory fine of its kind, after global customers visiting its website had their card data stolen.
The $228m penalty levied by the UK’s privacy watchdog reflects the seriousness of the attack and the carrier’s failure to protect its customer’s personal and financial information.
However, this incident has repercussions way beyond the UK airline and its customers.
It’s part of a new wave of attacks designed to implant “digital skimming” code on e-commerce sites, in order to siphon off your card details as they are entered in to pay for goods.
Although tens of thousands of websites have been caught out in this way, there are things you can do to stay safe—most notably by running Trend Micro Security.
But first, here’s more on what you need to know.
Data breaches are so often in the news headlines today, that you could be forgiven for becoming a little desensitized.
From retailers like Target and Home Depot to government breaches at agencies including the Office of Personnel Management (OPM), and from financial organizations like Equifax to tech giants like Yahoo, billions of our personal records have been stolen by cyber-thieves over the past few years.
Yet in all of these cases, there has been little the customer could do about it.
That’s because the hackers target the organization directly.
They find ways to bypass its security controls and sneak inside the company networks to find what they’re looking for: usually databases full of customer data.
A new type of data breach
However, these new digital skimming attacks are different.
They involve a hacker deploying malicious code known as Magecart to an organization’s website.
This code is typically designed to stay hidden, under the radar of the company.
And it has a very specific purpose: to steal customer card details as they are entered into the site during payment.
In short, it’s the digital equivalent of those physical skimming devices that criminals insert into ATMs to steal card data as it’s entered: it’s highly effective and happens completely without the knowledge of the cardholder.
By using this method, the hackers get access to the full card details, which have a higher resale value on the cybercrime black market.
The problem (for them) with the more traditional types of attack targeting back-end databases, is that these organizations may store card data encrypted, or else minus the crucial CVV/CV2 code.
Magecart attacks get around that.
What sites are at risk?
Indeed, the Magecart attackers have proven over the past year that no website is safe from skimming attacks.
Whether it’s a big-name e-commerce brand like Newegg, a national airline, a global ticketing site (Ticketmaster), or even online campus stores serving nearly 200 universities in the US and Canada–as long as they accept online payments, they’re at risk.
Magecart is so effective that multiple groups are said to be using the code, a piece of malicious JavaScript, to infect websites around the world.
And they’re developing new tools and tactics all the time to improve their monetization.
These include:     Infecting third-party companies which supply code to other sites (e.g., those that provide online ad services).
Thus, with just one attack, the hackers can get their Magecart code onto potentially thousands of payment pages.
Using automated tools to scan the internet for companies that may be running unsecured servers, which they can then infect with Magecart.
Some 17,000 sites were recently compromised in this way.
In a separate attack, 962 online stores were hit in just 24 hours.
Developing new skimming code which is usable across as many different payment pages as possible.
The record is 57 different payment gateways, which makes the hackers’ job much easier as they can launch attack campaigns across the globe with the same tools            All this is bad news for online shoppers.
So how do you know that the site you’re entering card data into is safe?
What can you do to stay safe?
Unfortunately, there’s nothing obvious that differentiates a website infected with Magecart from any other site.
It will look completely normal and will allow you to pay in the usual manner.
The only difference is that, in the background, a tiny piece of code will be stealing your data and transferring it to the hackers.
So what can you do to protect yourself?
You could try to avoid smaller sites that may not have the same level of security as larger ones.
However, as we’ve seen, Magecart has hit big-name brands as well as less well-known companies.
Another option would be to use a browser plug-in like NoScript for Firefox that prevents JavaScript loading from other untrusted sites – although this won’t prevent you getting potentially stung if the well-known and trusted site you’re on is compromised
Payment systems like Apple Pay and Google Pay can offer more protection.
They use a one-time generated series of numbers for each transaction, so that if attackers get their hands on it, they won’t be able to use it in the future.
It goes without saying that you should keep a close eye on your card statements/bank account at all times – watching out even for small amounts that hackers may be making to test if your card is still active.
However, the most effective way to stay safe is to use Trend Micro Security.
How Trend Micro can help Trend Micro Security features two key mechanisms to help stop Magecart attacks:
It can detect whether the website you want to visit has been injected with skimming code, and block you from visiting the URL (via web reputation), as well as from going to malicious domains the skimming code has access to.
Cyber Crime | Expert Perspective | Cyber Threats
REvil
While the disappearance of REvil (aka Sodinokibi) in mid-2021 is filled with uncertainty, security researchers have found a Linux version of the REvil ransomware that they have dubbed as Revix.
After analyzing the samples, we found four different versions of the malware, all of which rely on an embedded JavaScript Observed Notation (JSON)-based configuration to set parameters before encrypting files.
Figure 1. Revix’s JSON-based configuration
Figure 2. Revix encrypting a QNAP NAS device      Figure 3.
Revix
StealthWorker
Figure 5. Infected Linux device connected to a C&C server
How to protect NAS devices
Here are some best practices to protect your systems against threats that leverage the gaps in your NAS devices:
Avoid connecting a NAS device directly to the internet.
Regularly change the credentials for accessing an NAS device.
On April 21st our WildFire analysis cloud detected a new Android Trojan, which is currently completely undetected in VirusTotal and uses a new combination of tactics to make money for the author.
Code analysis shows that this malware sample can defeat the existing multi-factor verification procedures of many popular game platforms or online payment systems, and impersonate the smartphone user in making the purchase.
The name is看片神器 which translates to “a super tool for watching videos” and the icon is a provocative photo.
Once launched, it contacts a command and control server hosted in China using an HTTP GET request to the following website to register the infection with the attacker: http://14.17.95.205:21910/my/service.php.
UUDama uses a combination of machines and humans to quickly take CAPTCHA images submitted by Cardbuyer (or anyone else who will pay) and turn them into the expected text within 60 seconds.
To avoid having this request rejected by the server, the Trojan alters its user-agent string to appear as Internet Explorer 9 running on Windows 7.
The complicated user verification procedure continues.
In Figure 8, we show the patterns for different types of SMS contents.
From here the attacker can sell the code to someone else for cash, or redeem it directly.  While in the example here Cardbuyer targeted the Tianxiafu service, all of the services listed above are targets already pre-defined in its source code.
Any service that uses SMS for authentication of information or proof that a user is authorizing a charge is vulnerable to Trojan attacks.
Join us Wednesday, April 30 at 3 p.m. EDT, for a new webinar, “Need to Defeat APTs?
We have also taken extraordinary measures beyond our actions against coordinated influence operations to protect users and stop the spread of misinformation and disinformation about the war in Ukraine online.
Since mid-2021, we have been investigating a rather elusive threat actor called Earth Lusca that targets organizations globally via a campaign that uses traditional social engineering techniques such as spear phishing and watering holes.
Previous research into the group’s activities attributed it to other threat actors such as the Winnti group due to the use of malware such as Winnti, but despite some similarities, we consider Earth Lusca a separate threat actor (we do have evidence, however, that the group is part of the “Winnti cluster,” which is comprised of different groups with the same origin country and share aspects of their TTPs).
The first cluster is built using virtual private servers (VPS), rented from a service provider, that are used for the group’s watering hole and spear phishing operations, in addition to acting as a command-and-control (C&C) server for malware.
The second cluster is made up of compromised servers running old, open-source versions of Oracle GlassFish Server.
An overview of Earth Lusca’s infrastructure      Social Engineering and Vulnerability Exploitation techniques
The group has three primary attack vectors, two of which involve social engineering.
The social engineering techniques can be broken down into spear phishing emails and watering hole websites.
Our telemetry data shows Earth Lusca sending spear phishing emails containing malicious links to one of their targets — a media company.
The user eventually downloads an archive file containing either a malicious LNK file or an executable — eventually leading to a Cobalt Strike loader.
In addition to spear phishing emails, Earth Lusca also made use of watering hole websites — they either compromised websites of their targets or set up fake web pages copied from legitimate websites and then injected malicious JavaScript code inside them.
This script was designed to show a social engineering message — typically a Flash update popup or a DNS error (note that Adobe discontinued Flash Player at the end of December 2020) that then instructed the visitor to download a malicious file that turned out to be a Cobalt Strike loader.
Figure 2. Fake installation pop-up     The third attack vector used by Earth Lusca is the exploitation of vulnerabilities that exist in the public-facing applications — such as Microsoft Exchange ProxyShell and Oracle GlassFish — of its targets.
Once these are accomplished, Earth Lusca is free to perform its post-exploitation routines that include installation of tools such as Cobalt Strike and Acunetix (we discuss the post-exploitation routines in detail in the technical brief).
Malware used by Earth Lusca Earth Lusca employs several malware and other hacking tools in its arsenal.
This post is also available in:      日本語 (Japanese)  Unit 42 released details about a new spear phishing campaign called FreeMilk that uses a relatively new attack technique that can be highly effective.
Phishing attacks are broad, leveraging email messages crafted around common, generalized topics in order to trick recipients into opening an email message and its attachments.
Attackers will cast a wide net, with no regard to who the victims are, hoping that a decent percentage of attacks are successful.
Spear phishing, like the name implies, is a more targeted form of phishing which incorporates a theme directly related to the target.
FreeMilk is an advanced spear phishing attack campaign that, instead of using a theme to lure targets into downloading a malicious attachment, hijacks an in-progress email conversation.
Simply explained:  Figure 1 Conversation Hijacking to Deliver Malware  Unit 42 observed this specific attack taking advantage of a vulnerability in Microsoft Office, which has a patch available.
Also, read about a data breach from IoT company Wyze that exposed information of 2.4 million customers.
Read on:
Cambridge Analytica Scandal: Facebook Hit with $1.6 Million Fine
The Cambridge Analytica scandal continues to haunt Facebook.
Why Running a Privileged Container in Docker is a Bad Idea
IoT Company Wyze Leaks Emails, Device Data of 2.4M
The new research expands on previous work into an attack vector known as Rowhammer, first detailed in 2014 Emotet Attack Causes Shutdown of Frankfurt’s IT Network
The city of Frankfurt, Germany, became the latest victim of Emotet after an infection forced it to close its IT network.
Greg Young, vice president of cybersecurity at Trend Micro, discusses BeyondProd’s value in this article.
How MITRE ATT&CK Assists in Threat Investigation
In this analysis, Trend Micro investigates an incident involving the MyKings botnet to show how the MITRE ATT&CK framework helps with threat investigation.
Share your thoughts in the comments below or follow me on Twitter to continue the conversation: @JonLClay.
Jon Clay, VP of Threat Intelligence: [00:00:00
Joining me again is my cohort in crime.
Ed Cabrera, Chief Cybersecurity Officer:
My name's Ed Cabrera.
I'm the Chief Cybersecurity Officer at Trend Micro.
It’s great to be here.
Jon:
But we didn't cover a number of areas that I thought we were going to cover, but we didn't.
So I thought you and I [00:01:00] could take time today and talk a little bit about cyber warfare, hybrid warfare.
Any initial thoughts around this?
Maybe explain to the audience what hybrid warfare or cyber warfare is.
Ed:
Well, yeah, absolutely.
And so, when we talk about in terms of cyber conflict, cyber war, it has usually been in the context of just [00:02:00] another element within that 360-degree dominance that they hope to achieve in any conflict of war.
Cyber is that one space such as air dominance, for example, right?
And cyberspace is just one of them now, but we're getting into this unique area which we anticipated…could cyber conflict be the main domain that is being acted upon?
We'll talk about it [00:03:00] here now, but I think when we talk in terms for, especially for here is like cyber conflict, cyber war, or hybrid, and the hybrid piece is just a definition of kinetic and cyber.
And you just have computers fighting it out.
No, absolutely.
So cyber is still critical as we become more hyper-connected.
As we approach ubiquitous computing, ubiquitous connectivity, cyber then becomes very relevant.
But as we’ve seen, it's an interesting concept because traditionally cyber has just been more of an information gathering or cyber espionage tool to aid any type of conflict.
Well, I mean, it still serves a purpose if you're able to knock down the power or communication, the real two top tier critical infrastructure.
That's one of the first areas on either side they're looking to obtain dominance, is to knock out the command and control.
Information warfare, PSYOPs, psychology operations - you name it.
We don't need to [00:07:00] drop the pamphlets out of the plane anymore.
Ed: Exactly.
You don't need to – everybody's got a phone, right?
So, you're able to instantaneously provide some type of propaganda or misinformation around the globe.
They could have done a deep fake of Zelensky talking about something that could have caused panic inside the country.
Think about something like that happening.
That's what you're probably going to see in the future as well.
One other area that we didn't talk about that I thought was pretty interesting was around cyber mercenaries.
They’re regular citizens.
Yeah, well, again, everything that we see in cyberspace is a direct analogy on the physical side.
Such as the term mercenary, right?
This just makes it unique.
They could be patriotic hackers, they could just be guns for hire or cyber guns for hire, so to speak.
Are they really just uniform soldiers behind keyboards?
So [00:10:00] it's an interesting thing that nobody really likes to talk about it.
When you think as nation state, what should a nation state be looking at for the future?
Yeah, sure, absolutely.
Just like on the physical or kinetic side, we need to be very cognizant of our critical infrastructure.
But we really need to understand what is critical.
Obviously, this is where our focus needs to be, hands down.
These are the things that I think countries across the globe need to understand, especially here in Western countries, and especially NATO countries, understanding that they need to be shoring up, and almost like DHS says in their program, Shields Up, is really focused on being proactive and protecting those critical sectors.
Because again, that's where we're going to get our information if a conflict does come up.
Ed, this has been a great discussion.
Well, everybody, thanks for joining us again.
On episode four of #TrendTalksBizSec.
So, take care, have a great day.
[00:14:00] Additional Resources:
Link to Jon’s panel discussion in Davos: https://www.youtube.com/watch?v=GAZng8u9FXk
Ed’s social media: @Ed_E_Cabrera (Twitter), https://www.linkedin.com/in/ed-e-cabrera/ (LinkedIn)
This campaign, targeting high risk individuals in Ukraine, contained links leading to compromised websites where the first stage phishing page was hosted.
While we are actively monitoring activity related to Ukraine and Russia, we continue to be just as vigilant in relation to other threat actors globally, to ensure that they do not take advantage of everyone’s focus on this region.
In early September 2021, Threat Analysis Group (TAG) observed a financially motivated threat actor we refer to as EXOTIC LILY, exploiting a 0day in Microsoft MSHTML (CVE-2021-40444).
Investigating this group's activity, we determined they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPIDER (CrowdStrike).
EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol.
Additionally and rather uniquely, they leverage legitimate file-sharing services like WeTransfer, TransferNow and OneDrive to deliver the payload, further evading detection mechanisms.
This level of human-interaction is rather unusual for cyber crime groups focused on mass scale operations.
EXOTIC LILY’s attack chain has remained relatively consistent throughout the time we’ve been tracking the group: One notable technique is the use of domain and identity spoofing as a way of gaining additional credibility with a targeted organization.
Using spoofed email accounts, attackers would then send spear phishing emails under the pretext of a business proposal, such as seeking to outsource a software development project or an information security service.
Distribution of the actor’s working hours suggest they might be working from a Central or an Eastern Europe timezone.
These samples have some indicators that suggest they were custom-built to be used by the group.
The loader can be recognized by its use of a unique user-agent “bumblebee” which both variants share.
The malware, hence dubbed BUMBLEBEE, uses WMI to collect various system details such as OS version, user name and domain name, which are then exfiltrated in JSON format to a C2.
At the time of the analysis, BUMBLEBEE was observed to fetch Cobalt Strike payloads.
EXOTIC LILY activities overlap with a group tracked as DEV-0413 (Microsoft) and were also described by Abnormal in their recent post.
We believe the shift to deliver BazarLoader, along with some other indicators such as a unique Cobalt Strike profile (described by RiskIQ) further confirms the existence of a relationship between EXOTIC LILY and actions of a Russian cyber crime group tracked as WIZARD SPIDER (CrowdStrike), FIN12 (Mandiant, FireEye) and DEV-0193 (Microsoft).
Recent domains used in email campaigns: BazarLoader ISO samples: Recent BUMBLEBEE ISO samples: Recent BUMBLEBEE C2:
Recently, FireEye published a blog titled “Operation Poisoned Hurricane” which detailed the use of PlugX malware variants signed with legitimate certificates that used Google Code project pages for command and control (C2).