mrmoor/cyber-threat-intelligence huggingface dataset:
One of the most prolific cybermercenaries is Void Balaur, a Russian-speaking threat actor group that has launched attacks against different sectors and industries all over the world.
Although Void Balaur offers a wide range of services, the group’s bread and butter is cyberespionage and information theft, selling highly sensitive information on individuals in underground forums and websites such as Probiv.
The group primarily targets email accounts and mailboxes.
While it offers standard mailbox copies that was likely stolen with the help of credential phishing, Void Balaur also offers copies of mailboxes that have not been interacted with — for a higher price.
This option is particularly interesting since it would be extremely difficult under normal circumstances to gather the contents of a mailbox without any user interaction, which points to possibilities such as insider assistance or even the compromise of the email provider’s systems.
Countries in which Void Balaur email targets were located      In addition, Void Balaur also offers their customers access to a large amount of private data, which includes information such as flight and travel data (passports and ticket purchases); criminal records; financial records and credit histories; pension funds; and even printouts of SMS messages.
It’s easy to see why the services of a cybermercenary like Void Balaur is in demand — these types of information can be very useful for a group or an individual who wants to launch an attack on specific targets.
Void Balaur’s high-profile targets
What makes Void Balaur’s attacks particularly noteworthy is the often-lofty status of its targets.
While the threat actor has been known to offer its services to a more general audience — as seen in its online advertisements in the underground — research from groups such as eQualit.ie and Amnesty International show that Void Balaur is likely also involved in attacks against higher profile victims, ranging from human rights activists and journalists to politicians and even presidential candidates.
One of the group’s more notable campaigns involved attacks that targeted the private email addresses of government officials and politicians in an Eastern European country in September 2021.
Living up to its cybermercenary label, Void Balaur does not limit itself to the geopolitical scene.
Organizations that have access to a large amount of private information are also frequent victims of the group.
These targets belong to different industries such as the telecommunications, retail, financial, medical, and even the biotech sectors.
Organizational leaders and employees that are heavily involved with the company’s core business are among the threat actor’s favored targets, since these individuals will likely have access to the kind of information the group seeks.
Curtailing cybermercenary attacks
Given what we’ve seen of cybermercenaries like Void Balaur, it is likely that these groups have access to a large number of tools and infrastructure that allows them to launch attacks even against prominent individuals and organizations.
However, this does not mean that practicing and implementing the right security safeguards will not help in defending against cybermercenary attacks.
The following security best practices can help both individuals and organizations thwart cybermercenary attacks (and cyberattacks in general):  Employ the services of a reputable provider that places high priority on security.
Consider using dedicated two-factor authentication apps or devices such as Yubikey instead of relying on SMS.
Use encryption systems for communication, especially when it involves sensitive information.
Encrypt the drives of all computers and other machines that are used to store sensitive information.
Practice good security hygiene by deleting old emails and messages to minimize the chances of an attacker gaining access to private information.
Learn more about the activities and targets of Void Balaur in our research paper, Void Balaur: Tracking a Cybermercenary’s Activities.
The US Department of Energy (DOE) recently launched the Operational Technology (OT) Defender Fellowship.
In collaboration with DOE's Idaho National Laboratory (INL) and the Foundation for Defense of Democracies' (FDD) Center for Cyber and Technology Innovation (CTTI), the OT Defender Fellowship hopes to expand the knowledge of primary US front-line critical infrastructure defenders.
Sharing cybersecurity knowledge to the private sector
It will enable the program participants to engage with various cyber and national experts across the US government.
The program aims to also equip them with a better understanding of the strategies and tactics of the country's adversaries and how the US government cyber operations defend the nation.
The Fellowship aligns with the bipartisan recommendations of the congressionally mandated Cyberspace Solarium Commission (CSC).
King also explains that the CSC report supports operationalizing cybersecurity partnership with the private sector and remolding how the government works with the private sector.
King added that this DOE initiative will better protect the US from cyberattacks.
Tom Fanning, Chairman, President & CEO of Southern Company, says that national security greatly depends on the collaboration between private sector and the government.
They must also be nominated by their organization's leadership and commit to the requirements imposed by the program.
The participant must also be a US citizen and currently hold or be able to attain federal security clearance at the Secret or higher level, or be in a role that justifies application for Department of Homeland Security-sponsored private sector clearance.
For more information about the OT Defender Fellowship, visit https://inl.gov/otdefender/        Tags  Latest News | ICS OT | APT & Targeted Attacks | IoT | Articles, News, Reports
Since 2019, we have been tracking a threat campaign we dubbed as “Water Pamola.”
The campaign initially compromised e-commerce online shops in Japan, Australia, and European countries via spam emails with malicious attachments.
However, since early 2020, we’ve noticed some changes to Water Pamola’s activity.
Victims are now mainly located only in Japan.
Recent telemetry data indicates that the attacks are not being launched via spam anymore.
Instead, malicious scripts are being executed when the administrators look into customer orders in their online shop’s administration panel.
The Water Pamola attack chain      After further searching, we noticed that an online store administrator asked about a strange online order that contains JavaScript code inserted into the field where the customer’s address or company name would normally be located.
This script is likely activated by exploiting a cross-site scripting (XSS) vulnerability in the said store’s administration portal.
The question asked on a forum showing the payload related to Water Pamola.
The above is a screenshot of the text in a forum, which is translated by Google Translate as Problem, there is an order that seems to be a mischievous order.
The following characters are included in the address and company name.
The script connects to the Water Pamola’s server and downloads additional payloads.
Taken together, this led us to believe that Water Pamola places orders with this embedded XSS script across many targeted online shops.
If they are vulnerable to this XSS attack, these will be loaded when the victim (i.e., an administrator at the targeted merchant) opens the order within their management panel.
We have collected many attack scripts they delivered to different targets.
The malicious behavior performed by the scripts includes page grabbing, credential phishing, web shell infection, and malware delivery.
This campaign appears to be financially motivated.
In at least one instance, a site that Water Pamola attacked later disclosed that they had suffered a data breach.
Their server was illegally accessed and personal information, which included names, credit card numbers, card expiration dates, and credit card security codes, were potentially leaked.
This breach might be associated with Water Pamola, and it hints that this campaign’s overall goal is to steal the credit card data (similar to Magecart campaigns).
Analysis of the XSS attack
As previously mentioned, Water Pamola sent online shopping orders appended with a malicious XSS script to attack e-commerce administrators.
It’s worth mentioning that they are not targeting a specific e-commerce framework, but e-commerce systems in general.
If the store’s e-commerce system is vulnerable to XSS attacks, the malicious script will be loaded and executed on the merchant’s management panel once someone (like a system administrator or store employee) opens the said order.
These scripts were managed with an XSS attack framework called “XSS.ME,” which helps attackers deal with their attack scripts and the stolen information.
The source code of this framework is shared across many Chinese public forums.
The basic attack script provided by the framework could report the victim’s location and browser cookies.
We observed that the scripts used during the attacks were customized.
The attackers delivered a variety of different XSS scripts, which could include one or more of the following behaviors: Page Grabber
The script sends an HTTP GET request to a specified URL address and forwards the received response to Water Pamola’s server.
This is usually used during an early stage of the attack to grab content from the victim’s management page.
Doing so allows the threat actor to understand the environment and design attack scripts appropriate to the victim’s environment.       Figure 3.
The script for grabbing page content and sending it back to the attacker     Credential Phishing
Some of the delivered scripts revealed that the campaign was trying to obtain administrator credentials for e-commerce websites using two different approaches.
The first way involves appending a fake login form to the page.
The script hooks the mouse click event.
If the victim enters the credential in the fake form and clicks anywhere on the page, the script will take the credentials, encode them using base64, replace some characters with custom substrings, and then upload these to Water Pamola’s server.       Figure 4.
The script to create and delete fake login form for credential phishing     The other approach involves showing an authorization error message and then redirecting the user to a phishing website that asks users to enter their credentials.
The subdomains of their phishing sites were configured to match the names of the targets’ domain, such as “{victim’s domain}[.]basic-authentication[.]live”.
The script replaces the page content with an authorization error message and redirects users to the phishing website     Webshell/PHP backdoor injection
Some of the delivered malicious scripts attempt to install backdoors to the websites built with the EC-CUBE framework, which is popular in Japan.
The attack we found only works on Series 2 of EC-CUBE; the current version is Series 4, with Series 2 now under extended support.
There are three different approaches used to upload the backdoor.
The first method is uploading a PHP web shell file by calling the native API provided by the framework.
The name of the web shell file is hardcoded to be either “ec_ver.php,” “log3.php,” or “temp.php.”
The web shell can execute any PHP code sent by an HTTP POST request to the web shell.
Note the screenshot in Figure 6: The same web shell with the same “only_pcd” keyword is mentioned in this Chinese blog post.
The blog post describes a web shell with two components — a PHP script and an HTML uploading file — however,  the second one is not needed as the proper POST request can be created with any custom or third-party tool (e.g., Fiddler).      Figure 6.
The script for uploading the PHP web shell to an e-commerce website     The second method is modifying the page header to inject PHP code, which will then execute any PHP code, sent by the parameter “ec_ver2update” in the HTTP request.
Note that the PHP code below is obfuscated.
First, the $IDFX variable uses XOR operation (see character ^) to decode the string “create_function”, then the resulting base64 string is decoded to @eval($_REQUEST['ec_ver2update']); which is the backdoor’s code.
The script for modifying the shop page header to inject a web shell
The third method is installing a malicious plugin embedded in a file named “MakePlugin.tar.gz” to the e-commerce framework.
The plugin has been designed to drop multiple PHP web shell files on the server.
The script for uploading and installing the malicious plugin, “MakePlugin.tar.gz”      Figure 9.
The malicious plugin installs several files with web shells     Malware Delivery
In this case, the attack script will show an alert prompt with a message that reads “Your Flash version is too low, please install the latest version and try again!” and then redirects the victim to the fake Flash installer download website they control.
(Note that Flash has been declared end-of-life by Adobe since December 31, 2020.)  If the victim downloads and executes the installer downloaded from this page, the victim will be infected with a variant of Gh0stRat malware, previously also named Gh0stCringe or CineregRAT.
This RAT’s code is based on leaked Gh0st RAT source code; however, its traffic encryption is customized and it added some new features, like QQ number theft.
The Gh0st RAT samples related to this campaign are obfuscated executable files, which decrypt the main payload in memory and execute its main export function named “Shellex.”      Figure
The script showing the error message and redirect to the fake Flash installer      Figure 11.
The fake Flash installer download website     Analysis of the fake Flash installer
As described earlier, the XSS attack script redirects the victim to a fake Flash download site.
Clicking on the “Install now” button downloads a .ZIP archive, which contains several legitimate files as well as a few malicious ones, which are usually in form of DLL libraries.
These libraries will be sideloaded when the legitimate executable gets executed.
The package of downloaded Flash installer
In this example, AdobeAirFlashInstaller.exe (legitimate file) sideloads xerces-c_2_1_0.dll (patched legitimate file), which then sideloads ulibs.dll (malicious file).
Ulibs.dll loads Adob.dll, which is a ZIP archive.
After extracting the content of the Adob.dll zip archive, two legitimate and signed executable files are present and executed, and a similar sideloading process happens once more.
The package inside Adob.dll
Here, svchost.exe (renamed legitimate and signed Launcher.exe file from Tencent) sideloads Utility.dll (patched legitimate file).
This patched file contains one new section called .newimp (new import), which adds a new import item with a reference to the oplib.dll library.
This oplib.dll library is then sideloaded.
Oplib.dll side-loading
This new import was very likely added manually by using a utility called Stud_PE.
This utility has a feature called “Import Adder,” while “.newimp” is the default name of a newly added section containing newly added imports.
Oplib.dll then loads a lib.DAT file from the windowsfiles directory, decodes and decrypts its contents (from a hexadecimal string; XOR 0x42), and loads it into the newly created svchost.exe process.
In addition, persistence via registry keys and Scheduled Tasks are configured.
Figure 15. XOR routine and svchost injection
At the end, the last payload of this infection chain is a variant of a Gh0st RAT.
Communication with C&C uses sockets and is encrypted with simple SUB 0x46, XOR 0x19 encryption.
XOR routine that encrypts C&C communication      Figure 17.
A packetFlag “xy” was found inside this Gh0st RAT variant     This Gh0st RAT variant implements additional features for stealing QQ messenger user information, for example, a list of users on a given machine and their QQ messenger numbers.
The code below obtains QQ numbers that are currently logged on the machine, mentioned here.
The code used to obtain user QQ numbers     Protecting e-commerce platforms from Water Pamola’s attacks Water Pamola attacked online merchants with an XSS script appended onto online shopping orders.
They also perpetrated social engineering attacks to phish credentials or prompt the download of a remote access tool.
Online shop administrators should be aware that potential attacks may come not only from spam but also from different — and unexpected — infection vectors.
We also recommend that administrators keep the versions of any e-commerce platforms in use by their websites up to date to prevent any potential vulnerabilities, including XSS attacks.
Organizations can benefit from having Trend Micro™ endpoint solutions such as Trend Micro Smart Protection Suites and Worry-Free™ Business Security.
These can protect users and businesses from threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs.
Indicators of compromise can be found in this appendix.
Tags  Endpoints | APT & Targeted Attacks | Research | Articles, News, Reports | Cyber Threats
A series of ongoing business email compromise (BEC) campaigns that uses spear-phishing schemes on Office 365 accounts has been seen targeting business executives of over 1,000 companies across the world since March 2020.
The recent campaigns target senior positions in the United States and Canada.
The fraudsters, whom we named “Water Nue,” primarily target accounts of financial executives to obtain credentials for further financial fraud.
The phishing emails redirect users to fake Office 365 login pages.
Once the credentials are obtained and accounts are successfully compromised, emails containing invoice documents with tampered banking information are sent to subordinates in an attempt to siphon money through fund transfer requests.
Tracking Water Nue’s activities
The threat actor behind this campaign is interesting for several reasons.
It appears that their technical capabilities are limited despite being able to successfully target high-level employees globally.
While their phishing tools are basic (i.e., no backdoors, trojans, and other malware), they made use of public cloud services to conduct their operations.
The use of cloud services allowed them to obfuscate their operations by hosting infrastructures in the services themselves, making their activities tougher to spot for forensics.
This tactic has become more commonplace among cybercriminals.
We first noticed the campaign from a large group of email domains used in phishing attempts.
We found that most of the recipients hold high corporate positions, particularly in the finance department.
In one of the first cases we encountered, the senior financial officer of a bank located in Africa purportedly sent a PDF invoice to a colleague, specifying a bank account in Hong Kong.
The email was sent from an IP address recorded on one of the phishing sites that the attacker tested its functionality on.
The campaign is ongoing, with the threat actor switching to new infrastructures when used domain names get reported or blacklisted in systems.
Water Nue Campaign Analysis
The attackers use cloud-based email distribution services like SendGrid to deliver emails with a clickable link that redirects targets to a fake Office 365 page.
(We have reached out to SendGrid and shared our findings with them.)
When the target user attempts to log in, credentials are recorded through a simple PHP script.
Figure 1. Water Nue attack scenario       Figure 2. Sample of recorded credentials
While the techniques aren’t new, the attack attempts appear to be successful, collecting over 800 credentials from company executives at the time of writing.
How accounts are targeted for phishing attacks
In a July email sent to a C-level executive, we learned that the base domain URL is U10450540[.]ct[.]sendgrid[.]net, with the final URL being *getting-panes[.]sfo2*.      Figure 3.
Email header “from” field shows New York and various email accounts indicating “Swiftme@{company domain names}”
“Swiftme” appears in the phishing email headers and is accompanied by account names with forged company email domains.
The displayed email header “from” and subject also pretend as a voicemail service.
“Swiftme” is possibly a nod to electronic or wire transfers and reveals the campaign’s purpose after harvesting credentials.
Emails with different X-Mailers and headers are likely appended through tools that can confuse scan engines.
Here are some of the X-Mailers we observed:
X-Mailer: Mozilla/5.0 (Windows; U; Win98; de-AT; rv X-Mailer: Claws Mail 3.7.6 (GTK+ 2.22.0; x86_64-pc-linux-gnu)
X-Mailer: Mozilla 4.7 [en]C-CCK-MCD NSCPCD47 (Win98; I) X-Mailer: iPhone Mail (8A293)
X-Mailer: Opera7.22/Win32 M2 build 3221
X-Mailer: ZuckMail [version 1.00]
X-Mailer: CommuniGate Pro WebUser v5.3.2
A phishing site imitates Office 365 login
The originating IP of Water Nue’s test/deployment machine was left in a clear text file in the phishing site’s server for collected credentials.
Sitemap      Figure 7.
The landing page index.html has a dummy speech functio      Figure 8.
While the main collection function resides in app.js, command and control (C&C) location is embedded in JavaScript code      Figure 9.
jQuery method is used to post the target’s credentials to hosting site     The phishing pages record passwords inputted by site visitors.
Once the compromised credentials are used to successfully log in to accounts, fraudsters can identify themselves as executives.
They will then send a fraudulent wire transfer request to trick recipients into wiring money into the criminals’ accounts.
We found a BEC mail sample that was sent from the same IP.
The email in question is an invoice request that has a legitimate email header, which is a known tactic used in BEC scams.
An email sample with the same originating IP      Figure 11.
A sample fake PDF invoice in a BEC email
How to defend against BEC and other phishing scams
Unlike other cybercriminal schemes, phishing and BEC scams can be tricky to detect as they are targeted toward specific recipients.
Attackers seek to compromise email accounts to gain access to financial and other sensitive information related to business operations.
Here are some tips on how to stay protected from email scams:
Educate and train employees.
Deflect company intrusions through InfoSec education.
All staff — from the CEO to rank-and-file employees — must learn about the different kinds of scams and what to do in case of any encounters (i.e., double-check with others and verify email details).
Confirm requests using other channels.
Exercise caution by following a verification system (e.g., multiple signoffs or additional verification protocols) among employees that work with sensitive information.
Scrutinize all emails.
Be wary of irregular emails with suspicious content such as dubious sender email, domain name, writing style, and urgent requests.
In the case discussed here, the attacker email itself does not include the typical malware payload of malicious attachments.
As a result, traditional security solutions won’t be able to protect accounts and systems from such attacks.
Users can also turn on mail inspection for sender “sendgrid[.]net” in the email gateway.
Trend Micro protects both small- to medium-sized businesses and enterprises against phishing- and BEC-related emails.
Using enhanced machine learning combined with expert rules
, Trend Micro™ Email Security solution analyzes both the header and the content of an email to stop BEC and other email threats.
For source verification and authentication, it uses Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-Based Message Authentication, Reporting and Conformance (DMARC).
The Trend Micro™ Cloud App Security solution enhances the security of Microsoft Office 365 and other cloud services through sandbox malware analysis for BEC and other advanced threats.
It uses Writing Style DNA to detect BEC impersonations and computer vision to find credential-stealing phishing sites.
It also protects cloud file sharing from threats and data loss by controlling sensitive data usage.