mrmoor/cyber-threat-intelligence huggingface dataset:
Google manages a vulnerability rewards program (VRP), rewarding researchers millions of dollars for their contributions in securing our devices and platforms.
We also provide research grants to security researchers to help fund and support the research community.
This is all part of a larger strategy to keep Google products and users, as well as the Internet at large more secure.
Project Zero is also a critical component of this strategy, pushing transparency and more timely patching of vulnerabilities.
Finally, we also offer the leading tools to protect important civil society actors such as journalists, human rights workers, opposition party politicians, and campaign organizations – in other words, the users who are frequently targeted by surveillance tools.
Google developed Project Shield, a free protection against distributed denial of service (DDoS) attacks, to protect news media and human rights organization websites.
We recently expanded eligibility to protect Ukraine government organizations, and we are currently protecting over 200 Ukraine websites today.
To protect high risk user accounts, we offer the Advanced Protection Program (APP), which is our highest form of account security.
APP has a strong track record protecting users – since the program’s inception, there are no documented cases of an account compromise via phishing.
We believe it is time for government, industry and civil society to come together to change the incentive structure which has allowed these technologies to spread in secret.
The first step is to understand the scope of the problem.
We appreciate the Committee’s focus on this issue, and recommend the U.S. Intelligence Community prioritize identifying and analyzing threats from foreign commercial spyware providers as being on par with other major advanced threat actors.
The U.S. could also set an example to other governments by reviewing and disclosing its own historical use of these tools.
We welcome recent steps taken by the government in applying sanctions to the NSO Group and Candiru, and we believe other governments should consider expanding these restrictions.
Additionally, the U.S. government should consider a full ban on Federal procurement of commercial spyware technologies and contemplate imposing further sanctions to limit spyware vendors’ ability to operate in the U.S. and receive U.S. investment.
The harms from this industry are amply evident by this point, and we believe they outweigh any benefit to continued use.
Any one government’s ability to meaningfully impact this market is limited; only through a concerted international effort can this serious risk to online safety be mitigated.
Google is investing heavily as a company and as an industry to counter serious threats to our users.
In the modern world, we must be able to trust the devices we use every day and ensure that foreign adversaries do not have access to sophisticated exploits.
While we continue to fight these threats on a technical level, the providers of these capabilities operate openly in democratic countries.
Google is committed to leading the industry in detecting and disrupting these threats.
I thank the Committee for this attention on this critical issue.
Google’s Threat Analysis Group (TAG) continues to closely monitor the cybersecurity environment in Eastern Europe with regard to the war in Ukraine.
Many Russian government cyber assets have remained focused on Ukraine and related issues since the invasion began, while Russian APT activity outside of Ukraine largely remains the same.
TAG continues to disrupt campaigns from multiple sets of Russian government-backed attackers, some of which are detailed in our previous updates.
Similarly, Russian observed disinformation efforts are also focused on the war in Ukraine and TAG has disrupted coordinated influence operations from several actors including the Internet Research Agency and a Russian consulting firm as detailed in the TAG Bulletin.
Here is a deeper look at some campaign activity TAG has observed since our last update: Turla, a group publicly attributed to Russia’s Federal Security Service (FSB), recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment.
This is the first known instance of Turla distributing Android-related malware.
The apps were not distributed through the Google Play Store, but hosted on a domain controlled by the actor and disseminated via links on third party messaging services.
We believe there was no major impact on Android users and that the number of installs was miniscule.
The app is distributed under the guise of performing Denial of Service (DoS) attacks against a set of Russian websites.
However, the 'DoS' consists only of a single GET request to the target website, not enough to be effective.
The list of target websites for the app can be seen in the CyberChef recipe here.
During our investigation into the Turla CyberAzov apps, we identified another Android app first seen in the wild in March 2022 that also claimed to conduct DoS attacks against Russian websites.
In this case, the Android app name was stopwar.apk (com.ddos.stopwar) and was distributed from the website stopwar.pro.
This app is quite different from the Turla apps described above and written by a different developer.
It also downloads a list of targets from an external site, but unlike the Turla apps, it continually sends requests to the target websites until it is stopped by the user.
Based on our analysis, we believe that the StopWar app was developed by pro-Ukrainian developers and was the inspiration for what Turla actors based their fake CyberAzov DoS app off of.
Indicators: The Follina vulnerability (CVE-2022-30190), first disclosed in late May, received significant usage from both APT and cybercrime groups throughout June after it was patched by Microsoft.
Follina is a remote code execution (RCE) vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT).
Consistent with CERT-UA reporting, TAG observed multiple Russian GRU actors - APT28 and Sandworm - conduct campaigns exploiting the Follina vulnerability.
The Sandworm campaign used compromised government accounts to send links to Microsoft Office documents hosted on compromised domains, primarily targeting media organizations in Ukraine.
TAG has also observed an increasing number of financially motivated actors targeting Ukraine.
One recent campaign from a group tracked by CERT-UA as UAC-0098 delivered malicious documents with the Follina exploit in password-protected archives, impersonating the State Tax Service of Ukraine.
We assess this actor is a former initial ransomware access broker who previously worked with the Conti ransomware group distributing the IcedID banking trojan based on overlaps in infrastructure, tools used in previous campaigns, and a unique cryptor.
Ghostwriter/UNC1151, a threat actor attributed to Belarus, has remained active targeting accounts of webmail and social media networks of Polish users.
They continue to use the 'Browser in the Browser' phishing technique that TAG first observed and described in March.
An example of this technique, used to target Facebook users, can be seen in the screenshot below.
COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to send credential phishing emails to targets including government and defense officials, politicians, NGOs and think tanks, and journalists.
In addition to including phishing links directly in the email, the attackers also link to PDFs and/or DOCs, hosted on Google Drive and Microsoft One Drive, that contain a link to an attacker-controlled phishing domain.
These phishing domains have been blocked through Google Safe Browsing – a service that identifies unsafe websites across the web and notifies users and website owners of potential harm.
Recently observed COLDRIVER indicators: In another campaign tracked by CERT-UA as UAC-0056 we observed compromised email addresses of a Regional Prosecutor’s office of Ukraine leveraged to send malicious Microsoft Excel documents with VBA macros delivering Cobalt Strike.
In just two days, the volume observed and categorized as spam by Gmail exceeded 4,500 emails.
Last March it seemed the world came to a stand-still as the COVID-19 pandemic begin to rapidly spread.
While businesses, sporting events, and schools started shutting down, cybercriminals remained active as ever.
In 2020, the Trend Micro Zero Day Initiative™ (ZDI) published 1,453 advisories, the most ever in the history of the program.
More startling is the fact that 18.6% of all disclosures were published without a fix from the vendor—another record-breaking stat.
As ZDI predicted, 2021 continued to be a busy year.
In March 2021, Microsoft kicked off the patch cycle early after releasing an advisory regarding the mass exploitation of four zero-days vulnerabilities by a Chinese Hacking group, HAFNIUM, on the on-premises versions of the Microsoft Exchange Server.
In the following days of the attack, Trend Micro reported that at least 30,000 organizations were thought to have been attacked in the US, and 63,000 servers remained exposed to these exploits.
The vulnerability has been dubbed as ProxyLogon by the researchers at DEVCORE, who are credited with finding the bugs in the proxy architecture and the logon mechanism of Exchange.
DEVCORE reported two of the four zero-days (CVE-2021-26855 and CVE-2021-27065) to Microsoft Security Response Center (MSRC).
On March 2, Volexity reported in-the-wild exploitation of the vulnerabilities, to which DEVCORE confirmed that the exploit observed by Volexity was the one submitted to MSRC.
Since then, there has been opportunistic exploitation by various threat actors and ransomware groups (Dearcry, BlackKingdom) since majority of Outlook Web App portals are public and indexed by search engines like Google Search, Shodan, Binaryedge, Censys, Zoomeye etc.
According to Shodan, on March 4, there were more than 266,000 Exchange Servers vulnerable to the ProxyLogon vulnerability, a day after the patch was released.
Fig - Shodan Results
In lieu of these exploits, let’s take a look at how Trend Micro Vision One™ and Trend Micro Cloud One™ can provide protection against two of the four zero-days, CVE-2021-26855 and CVE-2021-27065.
Overview:
Two bugs are chained to achieve the remote code execution and for the attack to be successful, an attacker requires access to the Outlook Web App portal of the vulnerable Exchange Server, and a valid email address
CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability (pre-authenticated Server-Side Request Forgery [SSRF]) CVE-2021-27065: Microsoft Exchange Server Remote Code Execution Vulnerability (post-authenticated Arbitrary File Write)         Fig - MS Exchange Client Access Protocol Architecture     The Client Access services (Outlook Web App portal) proxies the incoming connections to the Backend services.
As per the Exchange documentation, clients don’t directly connect to the backend services.
But because of the SSRF vulnerability, attackers can query the internal backend services and APIs on the Exchange Server, bypassing the frontend proxy.
By abusing the SSRF, attackers can create session IDs and access tokens for privileged accounts with the context of the Exchange Control Panel, which can be used to write files with attacker-controlled content at a location on the target server, chosen by the attacker.
Since Exchange depends on Internet Information Services (IIS) webserver, an attacker can write ASPX webshells and run arbitrary commands as SYSTEM on the Exchange Server.  In January 2021, we came across extensive use of Chopper ASPX webshells in targeted attacks by malicious actors to establish persistence and a foothold on the public-facing Outlook Web App servers.   Trend Micro Cloud One™ – Workload Security Correlation:
Trend Micro Cloud One™ – Workload Security is a cloud-native solution that provides automated security via powerful APIs.
Security as code allows DevOps teams to bake security into their build pipeline to release continuously and frequently, so developers like yourself, can keep working without disruption from security.
Workload Security uses advanced security controls such as intrusion prevention system (IPS), deep packet inspection (DPI), and integrity monitoring to protect Exchange Servers from attackers that could exploit ProxyLogon.
The following detection rules safeguard a vulnerable Exchange Server from the CVEs reported:  Intrusion Prevention System detections:    1010854 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26855) 1010868 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065) 1010870 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065) – 1 1007170 - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1100) 1005934 - Identified Suspicious Command Injection Attack  Integrity Monitoring detections:  1010855 - Microsoft Exchange - HAFNIUM Targeted Vulnerabilities       1010854 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26855)      1007170 - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1100)      1010870 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065) - 1      1005934 - Identified Suspicious Command Injection Attack
IM Rules:      1010855 - Microsoft Exchange - HAFNIUM Targeted Vulnerabilities     Trend Micro Vision One™ Correlation:      Fig - Microsoft Exchange Server RCE Vulnerability (CVE-2021-26855 + CVE-2021-27065)     Trend Micro Vision One™ is a purpose-built, threat defense platform with extended detection and response (XDR) capabilities that work to prevent majority of attacks with automated protection.
The solution allows you to see more and respond faster by collecting and correlating data across email, endpoints, servers, cloud workloads, and networks.
Using the Trend Micro Vision One Workbench, you can easily see what threats were detected, attack techniques, and a prioritized list of risky devices and users.
With Trend Micro Vision One, we ran a public proof of concept (PoC) available online exploiting the ProxyLogon vulnerability.
The above image shows the vulnerability detected and all the assets related to the alert for further investigation.
Let’s take a deeper look:
Fig - Potential Chopper Webshell Detection
The Potential Chopper Webshell Execution model triggers when the web shell is already present on the machine and is being used as a backdoor to run commands as SYSTEM on the Exchange Server using China Chopper.  The metrics provided by this model should be investigated carefully, since the ProxyLogon zero-day vulnerability was exploited in-the-wild, before Microsoft addressed the issue publicly.
Microsoft has since taken things a step further by creating patches for out-of-support versions of Exchange.
Overall, Microsoft released patches for 89 unique CVEs in March—14 of which were listed as Critical and 75 listed as Important in severity.
Fig - Microsoft Exchange Server Possible ASPX Web Shell     The above model triggers when a new web shell is created.
You can see the path and name of the web shell.
Fig - Potential Chopper Webshell Execution      Fig - Identified Suspicious China Chopper Webshell Communication      Fig - Possible Credential Dumping via Command Line
This model is triggered when an attacker fetches the credentials using a command-line from within the memory using Mimikatz.
Since the web shell runs as the SYSTEM user, an attacker can fetch the NT LAN Manager (NTLM) hashes of the logged-in users, create or delete accounts, and perform extensive post-exploitation activities on the Exchange Server.      Figure - Executing Mimikatz as SYSTEM using CC      Fig - System Owner User Discovery     The above event was triggered when we ran whoami from within the Chopper web shell.
Since requests to the ASPX web shell are handled by the privileged w3wp.exe, an IIS Worker Process in the configured IIS application pool (Microsoft Exchange App pool) runs the commands in the context of NT Authority\SYSTEM user.
RCA Diagrams:      Fig. Executing commands using Chopper CnC     Conclusion
There is no silver bullet when it comes to cybersecurity but using solutions that bake into your development pipeline to provide security as early as possible is better than scrambling for patches after deployment.
Quick and easy to deploy solutions like Trend Micro Cloud One and Trend Micro Vision One can provide you with SecOps-approved security from build-time to runtime without slowing you down.
Tags  Cloud | APT & Targeted Attacks | Expert Perspective | Exploits & Vulnerabilities | Articles, News, Reports
The U.S. should also consider ways to foster greater transparency in the marketplace, including setting heightened transparency requirements for the domestic surveillance industry.
Finally, we urge the United States to lead a diplomatic effort to work with the governments of the countries who harbor problematic vendors, as well as those who employ these tools, to build support for measures that limit harms caused by this industry.
As part of TAG's mission to counter serious threats to Google and our users, we've published analysis on a range of persistent threats including government-backed attackers, commercial surveillance vendors, and serious criminal operators.
Today, we're sharing intelligence on a segment of attackers we call hack-for-hire, whose niche focuses on compromising accounts and exfiltrating data as a service.
Both, however, enable attacks by those who would otherwise lack the capabilities to do so.
We have seen hack-for-hire groups target human rights and political activists, journalists, and other high-risk users around the world, putting their privacy, safety and security at risk.
They also conduct corporate espionage, handily obscuring their clients’ role.
To help users and defenders, we will provide examples of the hack-for-hire ecosystem from India, Russia, and the United Arab Emirates and context around their capabilities and persistence mechanisms.
The hack-for-hire landscape is fluid, both in how the attackers organize themselves and in the wide range of targets they pursue in a single campaign at the behest of disparate clients.
Some hack-for-hire attackers openly advertise their products and services to anyone willing to pay, while others operate more discreetly selling to a limited audience.
For example, TAG has observed Indian hack-for-hire firms work with third party private investigative services — intermediaries that reach out for services when a client requires them — and provide data exfiltrated from a successful operation.
This is detailed in depth in today’s Reuters investigation into the Indian hack-for-hire ecosystem.
We have also observed Indian hack-for-hire firms work with freelance actors not directly employed by the firms themselves.
The breadth of targets in hack-for-hire campaigns stands in contrast to many government-backed operations, which often have a clearer delineation of mission and targets.
A recent campaign from an Indian hack-for-hire operator was observed targeting an IT company in Cyprus, an education institution in Nigeria, a fintech company in the Balkans and a shopping company in Israel.
Since 2012, TAG has been tracking an interwoven set of Indian hack-for-hire actors, with many having previously worked for Indian offensive security providers Appin and Belltrox.
One cluster of this activity frequently targets government, healthcare, and telecom sectors in Saudi Arabia, the United Arab Emirates, and Bahrain with credential phishing campaigns.
These credential phishing campaigns have ranged from targeting specific government organizations to AWS accounts to Gmail accounts.
TAG has linked former employees of both Appin and Belltrox to Rebsec, a new firm that openly advertises corporate espionage as an offering on its company website.
While investigating a 2017 credential phishing campaign that targeted a prominent Russian anti-corruption journalist, we discovered the Russian attacker targeting other journalists, politicians across Europe, and various NGOs and non-profit organizations.
This hack-for-hire actor has been publicly referred to as 'Void Balaur'.
These campaigns were similar regardless of target, consisting of a credential phishing email with a link to an attacker-controlled phishing page.
The lures ranged from fake Gmail and other webmail provider notifications to messages spoofing Russian government organizations.
After the target account was compromised, the attacker generally maintained persistence by granting an OAuth token to a legitimate email application like Thunderbird or generating an App Password to access the account via IMAP.
Both OAuth tokens and App Passwords are revoked when a user changes their password.
During our early investigation, TAG discovered the attacker’s public website (no longer available) advertising account hacking capabilities for email and social media services.
The site claimed to have received positive reviews on Russian underground forums such as Dublikat and Probiv.cc.
Over the past five years, TAG has observed the group targeting accounts at major webmail providers like Gmail, Hotmail, and Yahoo! and regional webmail providers like abv.bg, mail.ru, inbox.lv, and UKR.net.
United Arab Emirates TAG is also tracking a hack-for-hire group now based in the United Arab Emirates that is mostly active in the Middle East and North Africa.
They have primarily targeted government, education, and political organizations including Middle East focused NGOs in Europe and the Palestinian political party Fatah.
Amnesty International has also reported on their campaigns.
The group commonly uses Google or OWA password reset lures to steal credentials from targets, often using the MailJet or SendGrid API to send phishing emails.
Unlike many hack-for-hire actors that use open source phishing frameworks like Evilginx or GoPhish, this group uses a custom phishing kit that utilizes Selenium, a self described 'suite of tools for automating web browsers.'
Previously described by Amnesty, this phishing kit has remained under active development over the past five years.
After compromising an account, the actor maintains persistence by granting themselves an OAuth token to a legitimate email app like Thunderbird, or by linking the victim Gmail account to an attacker-owned account on a third-party mail provider.
The attacker would then use a custom tool to download the mailbox contents via IMAP.
This group also has links to the original developers of H-Worm, also known as njRAT.
In 2014, Microsoft filed a civil suit against the developer, Mohammed Benabdellah, for the development and dissemination of H-Worm.
Benabdellah, who also goes by the moniker Houdini, has been actively involved in the day-to-day development and operational deployment of the credential phishing capabilities used by this group since its inception.
As part of our efforts to combat serious threat actors, we use results of our research to improve the safety and security of our products.
Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further harm.
We encourage any high risk user to enable Advanced Protection and Google Account Level Enhanced Safe Browsing and ensure that all devices are updated.
Additionally, our CyberCrime Investigation Group is sharing relevant details and indicators with law enforcement.
TAG is committed to sharing our findings as a way of raising awareness with the security community, and with companies and individuals that might have been targeted.
We hope that improved understanding of the tactics and techniques will enhance threat hunting capability and lead to stronger user protections across the industry.
With contributions from Winnona DeSombre UAE hack-for-hire Group Domains: Indian hack-for-hire Group Domains: Russian hack-for-hire Group Domains:
Google’s Threat Analysis Group tracks actors involved in disinformation campaigns, government backed hacking, and financially motivated abuse.
Since late 2019, our team has disrupted financially motivated phishing campaigns targeting YouTubers with Cookie Theft malware.