mrmoor/cyber-threat-intelligence huggingface dataset:
The attackers are relying on the recipient to follow the instruction in the email and click “Enable Content”.
You can see below what the spreadsheet looks like and the enable content button.
Clicking the “Enable Content” button is the key to the attack.
While it makes the text in the spreadsheet visible and so seems to solve the problem, it’s a trick: It’s really running a program that silently installs a program on the system.
This program gives the attackers complete control over the computer and can enable them to copy documents, usernames, passwords, account information and even take screenshots.
How you can protect yourself
There are several things that you can do to help protect against these latest Sofacy attacks and others like it.
With the public awareness of this particular decoy, it is highly likely that the Sofacy group will shift their attacks to spoof emails from a different organization to continue carrying out these attacks.
Additionally, this attack technique is not exclusive to the Sofacy Group.
Therefore, these suggested actions can protect not just against these known attacks but others like it.
An unexpected email message with an attachment that says you should “enable content” has a high likelihood of being malicious in some way.
If you get an email like this, you shouldn’t open the attachment and click “enable content”.
Instead, you should verify that the message and the attachment are legitimate by contacting the sender in some way other than replying to the email (because replying to the email may go back to the attackers who will, of course, say it’s legitimate).
Or, just delete the message and report it to your security team.
Palo Alto Networks Unit 42 regularly researches threats like these and provides information about them on our blog.
This Unit 42 blog post provides an update on the threat situation surrounding the Bad Rabbit ransomware attacks.
Attack Overview
Bad Rabbit is a ransomware attack that, at the time of this writing, appears to primarily be affecting countries in Eastern Europe.
While not spreading as widely as the Petya/NotPetya attacks, reports indicate that where Bad Rabbit has hit, it has caused severe disruption.
The Ukrainian CERT has issued an alert on Bad Rabbit.
As detailed below, Bad Rabbit gains initial entry by posing as an Adobe Flash update.
Once inside a network it spreads by harvesting credentials with the Mimikatz tool as well as using hard coded credentials.
Bad Rabbit is similar to Petya/NotPetya insofar as it encrypts the entire disk.
We are not aware of any reports of successful recovery after paying the ransom.
Because the initial attack vector is through bogus updates, Bad Rabbit attacks can be prevented by only getting Adobe Flash updates from the Adobe web site.
Reconnaissance  This attack does not appear to be targeted.
Therefore, there appears to be little reconnaissance as part of this attack.
According to ESET, the initial infection vector for Bad Rabbit is through a fake Adobe Flash update that is offered up from compromised websites.
Proofpoint researcher Darien Huss‏ has reported this fake update was hosted at 1dnscontrol[.]com.
Reports differ on whether this is delivered through social engineering that convinces the user to install the fake update or if it is delivered silently through unpatched vulnerabilities (i.e. “drive-by” installs).  Lateral Movement
Once inside a network, Bad Rabbit propagates itself to other systems.
Reports indicate that it harvests credentials using Mimikatz and Maarten van Dantzig reports it also uses common hardcoded credentials to spread.
Command and Control (C2)  At this time, we have no information on command and control for Bad Rabbit.
Conclusion  Bad Rabbit is not as widespread of an attack as Petya/NotPetya but is causing severe disruptions where it is occurring.
It is similar to Petya/NotPetya in terms of the impact of a successful attack.
However, it is a different attack with different malware.
We will update this blog with new information as it becomes available.
For information on how Palo Alto Networks products prevent Bad Rabbit, please see our Palo Alto Networks Protections Against Bad Rabbit Ransomware Attacks blog post.
As always if you have any questions, please come to the Threat & Vulnerability Discussions on our Live Community.
Version Summary  October 24, 2017 2:30 p.m. PT  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
Palo Alto Networks WildFire detected a new Android Trojan on May 7th, 2014 when a customer using our enterprise security platform downloaded the malicious application from the Google Play store.
We’ve named the malware family Funtasy, based on the domain it uses for registering compromised phones to the premium SMS service.
The first version of Funtasy we detected is a fake television remote control application.
Figure 1: Funtasy Trojan Disguised as TV Remote Control App.
A developer using the ID “fun app” published the Trojan, and the remote control application they uploaded on April 21 is their most successful app so far, with between 10,000 and 50,000 downloads on the play store.
Based on the reviews, the application does not function very well as a remote, but in reality it doesn’t contain remote control capability.
There’s no mention of a premium SMS service in the description, but a review of the permissions reveals that the program will have complete access to SMS messages.
Figure 2: Remote control app requests complete control over your SMS messages.
After the user installs the remote application and opens it, they are presented with a terms of service screen.
This is the user’s only chance to realize that opening this application is going to cost them dearly.
Figure 3: Remote control app terms of service.
If you can’t read the fine print, I don’t blame you.
Here’s the text decoded from the application’s source code.
Servicio de suscripción para usuarios Movistar, Vodafone, Orange, Yoigo, R y Simyo para mayores de edad o menores con capacidad legal para contratar, prestados por (FUNTASY MOBILE S.L., operador titular ARGATEL SOLUTIONS SL, n. atención al cliente 902 303 803 ó inf@argatel.com, apartado de correos 167, 17001 Girona.
Coste por SMS recibido 1.46 euros/sms (IVA incluido) más el coste de navegación WAP, que dependerá del operador que tenga contratado.
Máximo 10 sms/semana.
El límite máximo de facturación del servicio puede variar en función de tu operador (18 a 30 euros/mes).
Baja automática para cancelar el servicio: envía BAJA al 797977.
This message is pretty straightforward, assuming the user actually reads it.
It explains that by opening the application the reader agrees to receive up to 10 SMS messages a week at a cost of 1.46 euros each.
The maximum cost per month should between 18 and 30 euros per month.
If the user would like to unsubscribe they can text “BAJA” to 797977.
Any user who reads this message and understands it is unlikely to agree, but Funtasy does not even wait for their agreement.
While the terms page is on the screen, in the background the Trojan checks to see if the phone is attached to a network with one of the following mobile network codes (MNC):  Each of these networks is Spanish, except for a single Australian network.
This data, along with an encoded version of the Terms of Service are stored as static strings in the Android package file.
Constants.java  After determining the phone is on one of the correct networks, the malware searches for the phone’s mobile number.
It does this in three ways:
Util.java  With the phone’s number captured, Funtasy then registers the mobile account with a premium SMS service by sending an HTTP POST request to the following URL.  The request is made without the users knowledge, they have no choice to select a number.
Of course, premium SMS services require that the user confirm that they want to sign up by sending incoming SMS message containing a PIN.
Funtasy  intercepts this message, parses out the PIN and sends it back to the registration server, completing the enrollment process.
IncomingSms.java  Of course, once users begin receiving the SMS messages, they are likely to unsubscribe from the service they never really wanted.
To prevent this, Funtasy blocks the incoming messages before they are displayed to the user and modifies the time stamp on each message to make them appear to have been received 15 days earlier.
This moves it to the back of the inbox there the victim is unlikely to ever see it.
Funtasy does this even when the victim uses alternative SMS managers, like Google Hangouts or GO SMS Pro.
After evaluating the remote control app and finding malicious behavior, we decided to evaluate all of the other applications published by “fun app”, and found 12 more which all contains the exact same behavior.  Figure 4:
Additional “fun app” applications, all contain the Funtasy Trojan.
Each of these applications is designed to appear like a legitimate application already in the app store.
To raise the ranking of these apps, the author appears to have given many of them five-star ratings.
Unfortunately for them, this gave us additional insight into their operation.
To rate and comment on applications, users must have a Google account.
One account using the name “Oscar Sanchez” gave high ratings and positive comments to many of the “fun app” applications.
He also rated apps made by two additional publishers with the names "MilApps101" and "Milapps102."
Between the two of these developers they have produced five applications, and we’ve found that every one of them contains the Funtasy Trojan.
While the name “Oscar Sanchez” may be a pseudonym
, Whois data indicates it was also used to register the domain hosting the Funtasy Mobile premium SMS service.
In total we’ve found 18 different applications in the Google Play store that contain the Funtasy Trojan.
Each of these files also has the same internal class structure, which is represented by the tree structure below.
Figure 5: Funtasy internal class structure.
Researchers interested in investigating them further can find more information in the table below.
Using this Trojan the attacker could be generating up to 30 euros per month for over 67,000 infected mobile phones.
That adds up to 2 million euros per month, but the actual number is likely much lower.
Many of the users who downloaded the tool may not be using one of the targeted Spanish or Australian networks.
Figure 6: List of Android APK files infected with Funtasy Trojan
Users who want to defend against the Funtasy Trojan should not rely on traditional antivirus programs, as they do not currently detect this threat.
Common sense is the best defense against these types of abusive programs.
While many users breeze past the list of permissions required when installing new apps, readers of this blog should ask themselves, “Does my electronic bible need to read my SMS messages?”  Sign up to receive the latest news, cyber threat intelligence and research from us
Please enter your email address!
On July 22, Palo Alto Networks threat intelligence team, Unit 42, released our first report on the evolution of “Silver Spaniel” 419 scammers.
Of particular note is how these actors use a Remote Administration Tool (RAT) named NetWire (part of the NetWiredRC malware family).
This RAT gives a remote attacker complete control over a Windows, Mac OS X, or Linux system through a simple graphical user interface.
To better understand this RAT, our team reverse engineered the communication protocol that NetWire uses.
Today we have released a tool that decrypts NetWire traffic and outputs any commands issued by the attacker.
NetWire uses a custom, TCP-based protocol.
The producer of the NetWire WorldWiredLabs, states that the tool uses 256-bit AES encryption, which we found to be accurate.
The tool generates two encryption keys using a static password that the attacker chooses when creating the NetWire binary.
Each packet has the following structure:  < 4 Byte Little-Endian length > < 1 Byte Command >
< Data >
The shortest possible packet is the “HeartBeat” command, which NetWire generates every 10 seconds.
The initial packet from the client to the server shows a data and command length of 65 bytes (0x41 listed at the beginning of the packet) with a command byte of 0x03.  Within that data is a 32-byte seed value followed by a 16-byte initialization vector (IV) value.
The client then combines the 32-byte seed value with the static password in a predetermined fashion to form an AES key.
Upon receiving the initial packet, the server uses the seed value and password to generate the client’s session key.
It then generates its own 32-byte seed value to create it’s own session key and sends the seed value to the client.
The client combines this with the password and generates the same key.
At this point, the key exchange is complete and both client and server hold the same two keys, which they can use to encrypt and decrypt traffic.
With the two keys in place, the malware uses the AES algorithm to encrypt traffic using Output Feedback (OFB) mode (Picture courtesy of Wikipedia).  The output of the block cipher encryption is eXclusive OR’ed (XOR’d) with 16 bytes of ciphertext to decrypt.  Each subsequent block of ciphertext will use the previous encrypted data as the IV passed into the block cipher encryption function.
The malware has a full suite of possible commands, 76 to be exact.
Upon receipt of a command from the server, a single function is called to decrypt the payload data and execute the received instruction.
The value in the command byte determines which of the commands is run through a 76 way switch statement.
A complete list of the possible commands available in NetWire was documented by CIRCL in April.  The NetWire decoder uses data from a packet capture file to generate the client and server session keys then decode the remaining encrypted packets.
The user needs to know the IP of the infected client, the port used by malware and the encryption password to properly decode the traffic.
This password is set to “Password” by default, but can be retrieved from NetWire binaries if the attacker used something more secure.
The usage for the tool is show below.
At this time the tool works against the latest version of NetWire, 1.5c.
We hope this tool will be valuable to incident responders and others who are plagued by NetWire infections.
Unit 42 has recently been investigating a new malware family called Reaver.
While we have identified it as being active since late 2016, Reaver has been used sparingly, with only a small number of unique samples identified.
Its targets have been movements the Chinese government consider dangerous, also known as the “Five Poisons.”
We found that the Reaver malware family has shared command-and-control (C2) infrastructure overlap SunOrcal malware, and that these have been used concurrently since late 2016.
While investigating Reaver we recently also discovered a new variant of the SunOrcal malware family.
While the SunOrcal malware family has been confirmed to have been active since 2013, possibly even earlier, this new variant has been observed targeting regions outside of the typical target radius for this threat group, now expanding to include Vietnam and Myanmar.
Emails were sent to targets containing malicious attachments.
Targeting a Vietnamese speaking audience, one of the malicious documents mentions Donald Trump and the disputed South China Sea area.
This is a classic lure technique – including something the target will find interesting or important causing them to open the file and download the malware on to the victims’ system.
How to Defend Against it These malware attacks utilize email phishing, and relies on targets opening the malicious email attachment.
Security awareness is critical to avoid falling victim to such an attack.
General email best practices:  If you are unsure of the legitimacy of the email, contact the sender directly over the phone or by typing a trusted URL directly in your browser or saved bookmark.
Additionally, keeping your systems and devices updated with the most current operating system and web browser is a general security best practice, as well as enabling multi-factor authentication to prevent an attacker from abusing credentials should they successfully capture them
For a moment, put yourself in the shoes of a cyber criminal.
You’ve collected an array of tools (malware), built up your infrastructure (command and control (C2) servers) and you have a process to make money off your hard work.
You wake up on Monday morning and the domains your carefully built malware uses for command and control are shut down.
Some security researcher has taken control of them, completely halting your operation.
This would certainly be good news to anyone reading this blog, but for the criminal it’s a big setback and source of frustration.
These kinds of takedowns are the impetus for some of the most impressive developments in malware technology over the last decade.
Once attackers have infected a PC through some exploit or social engineering, one of their major challenges is keeping control of that system.
Antivirus programs running on the PC are trying eradicate the threat, the command and control domains and IPs are being added to denylist and blocked by networks around the world.
Many malware authors have taken to building complex mechanisms to ensure that their malware is resistant to these kind of blocks and takedowns.
Some of the more innovative mechanisms include:  These mechanisms are often only used when the primary (and simpler) C2 mechanism has been shut down, but their use makes shutting down a botnet much more challenging.
Last year we highlighted two malware families on this blog: CryptoWall 2.0 and Dyreza/Dyre.
CryptoWall is one of multiple ransomware families that generated income for the attacker by encrypting files on the infected PC with a private key that is in the control of the attacker.
The attacker then charges a ransom (normally around $500) to give up the key that will unlock the files.
In October, CryptoWall 2.0 began using the Tor anonymity network to serve web pages to infected users who wanted their encrypted files back.
In this case a legitimate service (Tor) was being abused by CryptoWall so it could avoid having its C2 servers shut down.
In the past few weeks we've seen another anonymity network, I2P, being abused by both the latest version of CryptoWall (3.0) and the Dyre banking Trojan.
While I2P is far less popular than Tor, it provides similar functionality to the user.
I2P is an overlay network on top of the Internet that creates encrypted links between nodes that are running the I2P software.
I2P users can access specific I2P services that are only accessible on I2P, or access Internet resources without exposing their IP address.  In the case of CryptoWall 3.0, the malware is attempting to access multiple .i2p resources only accessible through I2P, also known as “eepSites.”  The CryptoWall 3.0 uses I2P in the same way CryptoWall 2.0 used Tor, to give victims access to a decrypting service to get their files back.
The Dyre banking Trojan has multiple C2 mechanisms, including encrypted HTTPS requests to a list of hard-coded IP addresses, a DGA generating 1,000 new domains each day as well as an I2P based plugin.
These many C2 mechanisms make Dyre much more difficult to fully take down than a simple single (or small group) of C2s.
the following IP address are known Dyre C2 servers.
It’s not possible to list all of the domains generated by the DGA, which is the main advantage of this mechanism.  To protect your network from the I2P communication used by both Dyre and CryptoWall 3.0, the easiest route is simply to identify I2P traffic and block it completely.
While there are certainly many legitimate reasons to use an anonymity network, many organizations should be wary of I2P (or Tor) traffic transiting their network.
Palo Alto Networks App-ID technology can identify I2P traffic as well 51 other tunneling applications.
In recent research, Palo Alto Networks found attackers were creating fake versions of some well-known and well-trusted websites – including Adobe, DropBox, Facebook, and others- and putting malicious links to these sites into phishing emails sent to unsuspecting victims.
Here we explain this type of attack and what you should do.
A method attackers use to target you using email that you might not know about.
Attackers can gain access to your personal and financial information.
They can also steal your computer’s processing power to mine for cryptocurrencies, which slows down your system.
How can I prevent it?
Avoid clicking on links that you get in email.
If you get an email and need to go to that website, type the address in your web browser yourself.
If the link is an email from someone you know, you can also contact them to find out if they meant to send it, and if it is safe to visit.
Attackers know that people will click on links in email.
Especially when you get an email from someone that looks like someone you trust.
Attackers send emails that appear to be from a person or company that you trust.
These emails contain malicious links that, when clicked on, lead you to an attacker’s page.
In addition to taking steps so the attacker’s page mimics a legitimate one,  attackers often mirror well known security images, like the lock symbol, to convince you that you are on a secure site.
Once you’re on the attacker’s page, the attackers may ask you for personal information (like usernames, passwords, and bank account information) or to install software, or both.
In recent research, we found attackers were using fake versions of some well-known and well-trusted sites:
They’re put together by Palo Alto Networks Unit 42 threat research team and are meant for you to read and share with your family, friends, and coworkers so you can all be safer and get on with the business of your digital life.
Got a topic you want us to write about for you, your friends, or your family?
In February, Microsoft awarded $100,000 to Yu Yang (@Tombkeeper) for reporting a new mitigation bypass technique as part of Microsoft’s Bounty Program.
Yu later demonstrated his research at CanSecWest in March.
In his slides, he mentioned that a "god mode" of Internet Explorer could be turned on by a one byte overwrite.
However, he had to heavily redact this information due to an agreement between himself and Microsoft.
After his slides were released, researchers began working to determine what the missing parts were.
And before long, Yuki Chen (@guhe120), a Chinese researcher, posted his answer.
Although the code was removed soon after posting, a copy was still maintained and used by Metasploit.
Following this code, another researcher posted his VB script version using more advanced techniques.
Yu Yang then pasted his shellcode that used similar methods to run arbitrary code, showing that the method Yuki Chen used is exactly the one that won Yu the $100,000 award.
The main idea of new exploitation technique is to alter a flag that is used to control the security setting of an ActiveX object.
If an attacker could modify it, then any script can be run, such as downloading and executing a PE file, without any notification or alert.
Further details were discussed in depth last month on Rapid7’s blog.
The most interesting aspect of this method is that it could bypass all existing mitigation techniques including DEP/ASLR/EMET, and it also defeats some academic methods such as Control Flow Integrity (CFI).
So this raises another question: If there are no mitigation functions, do we have any other ways to defend against attacks similar to this?
The first line of defense is the IPS.
Although an attacker can use a variety of obfuscation techniques for HTML, we are still able to extract some features to create signatures.
To address such an issue, we’ve created signatures 36442, 36468, and 36469 to provide coverage for the security flag overwrite.