mrmoor/cyber-threat-intelligence huggingface dataset:
My First App  -     061b0379a12b88488db8540226e400e3f65fef9a4c1aa7744da9f17e1d93d78d  com.example.opinionpoll  OpinionPoll  -     fb6ac9d93fd47db3d32f6da6320344a125e96754a94babb9d9d12b6604a42536  com.metasploit.stage  MainActivity  https://185.225.19[.]46:4589  AndroidOS_Metasploit.HRX  468b74883536938ef3962655dfcc3ca4097ca9b5b687dfc1fef58d50e96dc248  com.metasploit.stage  MainActivity  tcp://185.225.19.46[:]4875   AndroidOS_Metasploit.HRX  a377e5f4bf461b86f938959256b7ab8b1b40bb9fd3cd45951c736a22366a8dd1  com.example.firstandoidapp  My First App  tcp://185.225.19.46[:]4875  AndroidOS_Metasploit.
HRX
Malicious documents and related payloads IoCs  Indicator  Description  Detection  TrendX  1CBEC920AFE2F978B8F84E0A4E6B757D400AEB96E8C0A221130060B196ECE010  docx  Trojan.W97M.CVE20170199.FAIL     7238F4E5EDBE0E5A2242D8780FB58C47E7D32BF2C4F860C88C511C30675D0857  RTF file  Trojan.W97M.SIDEWINDER.A     75C158CEA14E338C8D9D32ED988C7032DA9AE6D54F5B1126ED6A83F71B9E03BF  1.a JS file  Trojan.JS.SIDEWINDER.A  Downloader.JS.TRX.XXJSE9EFF018  AB6E8563214EEB747ABF77F9CC50796CC6A0C0562C6BEC720D7F2C978D34C412
Fake DUser.dll  Trojan.MSIL.SIDEWINDER.A     CBD5C68F5C4345B68F018D9E5810574E8036A2BC4D826BE5C8779E8019449957  Final payload  Trojan.Win32.SIDEWINDER.B     34446F7F60F730FCCA145155D10D1AFF0A1153B085836DF38313772CD03C8D70  RTF file  Trojan.W97M.CVE201711882.YQUOOWV     7238F4E5EDBE0E5A2242D8780FB58C47E7D32BF2C4F860C88C511C30675D0857  RTF file
Trojan.W97M.SIDEWINDER.A     AB7C1967BF1FEFDFFDE93626B78EB30994655AB02F59E0ADB0935E3E599A953F  RTF file  Trojan.W97M.SIDEWINDER.A     2548A819E4C597BA5958D2D18BAA544452948E5B00271570192CCD79ABE88E8D  1.a JS file  Trojan.JS.SIDEWINDER.A  Downloader.
JS.TRX.XXJSE9EFF018
ED5E1D6E914DE64A203F2F32AB95176FC7EFFF3A520915971D5FE748E79D611C
1.a JS file  Trojan.JS.SIDEWINDER.A  Downloader.
96BF8F579ACB8D9D0FF116D05FDADEF85953F11E5B2E703041FDAE0ABF5B75DC
1.a JS file  Trojan
.JS.SIDEWINDER.A
Downloader.JS.TRX.XXJSE9EFF018  940265867D5668956D64ADF9FC4B9C6CF9E7FCFCF5C21BA7BF0BEA77B5EDD047  Fake DUser.dll  Trojan.MSIL.SIDEWINDER.A     B22946CFEFE8646CB034F358C68CAAE5F30C1CF316CFFEAF77021C099E362C64  Fake DUser.dll  Trojan.MSIL.SIDEWINDER.A     89E392FA49C6A6AEB9056E3D2F38B07D0DD7AF230CD22E3B01C71F05A3AECA0B  Fake DUser.dll  Trojan.MSIL.SIDEWINDER.A     EB2D82DD0799196FCF631E15305676D737DC6E40FF588DCF123EDACD023F1C46  Final payload  Trojan.Win32.SIDEWINDER.B     7ECAEFCB46CDDEF1AE201B1042A62DD093594C179A6913A2DE47AB98148545DD  Final payload  Trojan.Win32.SIDEWINDER.B     799260B992C77E2E14F2D586665C570142D8425864455CAB5F2575015CD0B87A  Final payload  Trojan.Win32.SIDEWINDER.B      brep.cdn-edu[.]net  RTF delivery server     www.mfa.filesrvr[.]net  RTF delivery server     www.google.gov-pok[.]net  RTF delivery server     ap
-ms[.]net  C&C     cdn-sop[.]net  C&C     fqn-cloud[.]net  C&C     ms-trace[.]net  C&C     imail.aop.gov-af[.]org  Phishing Domain     mail-apfgavnp.hopto[.]org  Phishing Domain     mail-apfgovnp.ddns[.]net  Phishing Domain     mail-kmgcom.ddns[.]net  Phishing Domain     mail-mfagovcn.hopto[.]org  Phishing Domain     mail
-mofagovnp.hopto[.]org  Phishing Domain     mail-ncporgnp.hopto[.]org  Phishing Domain     mail-nepalarmymilnp.duckdns[.]org  Phishing Domain     mail-nepalgovnp.duckdns[.]org  Phishing Domain     mail-nepalpolicegov.hopto[.]org  Phishing Domain     mail-nepalpolicegovnp.duckdns[.]org  Phishing Domain     mail-nrborg.hopto[.]org  Phishing Domain     mail-nscaf.myftp[.]org  Phishing Domain     mail-ntcnetnp.serveftp[.]com  Phishing Domain     mail.arg.gov-af[.]org  Phishing Domain     mail.moha.gov-np[.]org  Phishing Domain     mail.nsc.gov-af[.]org  Phishing Domain     webmail.mohe.gov-af[.]org  Phishing Domain          Tags
This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2021.
It was last updated on July 29, 2021.
JuneWe terminated 33 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.
We terminated 15 YouTube channels as part of our investigation into coordinated influence operations linked to Ethiopia.
We terminated 123 YouTube channels as part of our investigation into coordinated influence operations linked to Russia.
We terminated 9 YouTube channels as part of our investigation into coordinated influence operations linked to China.
We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Moldova.
We terminated 33 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.
This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2021.
It was last updated on April 20, 2021.
We terminated 5 blogs as part of our investigation into coordinated influence operations linked to Morocco.
We terminated 5 YouTube channels as part of our investigation into coordinated influence operations linked to Brazil.
We terminated 6 YouTube channels as part of our investigation into coordinated influence operations linked to Kyrgyzstan.
We terminated 3 advertising accounts as part of our investigation into coordinated influence operations linked to Egypt.
We terminated 1 YouTube channel as part of our ongoing investigation into coordinated influence operations linked to Russia.
We terminated 5 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.
We terminated 2 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.
We received leads from FireEye that supported us in this investigation.
Delivery URLs Javascript Sandbox escape / LPE Backdoor C2 This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2021.
It was last updated on October 29, 2021.
Updated on May 6, 2020, 7:20 Pacific Time with further details regarding directories targeted for encryption.
A new targeted attack has infected several organizations in Taiwan with a new ransomware family, which we have dubbed ColdLock.
The information we gathered indicates that this attack started hitting organizations in early May.
Analysis of the malware points to similarities between ColdLock and two previously known ransomware families, specifically Lockergoga, Freezing, and the EDA2 “educational” ransomware kit.
There have been no indications that this attack has hit any other organization outside of those targeted; we do not believe that this family is currently in widespread use.
Arrival Vector
We currently do not know the initial arrival vector of this threat into a potential victim’s network.
The payload arrives as a .NET executable (as a .DLL file), which has been packed/protected using the ConfuserEx packer.
It uses PowerShell reflective loading of .NET executables to run the said .DLL file:  Figure 1. Reflective loading of the .DLL file
It also contains two checks to verify if it’s running.
It will only run at or later than 12:10 PM on any given day; if it is earlier, it will sleep for 15 seconds until it is past the said time.
Before it encrypts any file, the ransomware also performs certain preparatory routines.
It also checks the Windows version running on the system.
If it is running Windows 10, it carries out several Windows 10-specific routines.
Windows Defender is disabled, as well as the ability to send feedback/malware samples to Microsoft.
Figure 5. Disabling Windows Defender
The actual encryption routine is slightly unusual.
Directory name should not contain any of the following strings: .git appdata cache image lib log logs microsoft reference res resource script setup skin temp theme third_party thirdparty    If all of the above conditions are met, it will encrypt all the files in the given directory except those with the following extensions:  .avi .dll .gif .iso .m2ts .mkv .mov .mp3 .msi .ocx .tmp .wmv
.odt
.one
.php .ppt
.pptx .pst .rar .sh .sql .txt .xls .xlsx .xml .zip
Whitelist/blacklist code
It generates the needed key and initialization vector (IV) using a salt and secret key; the former is embedded in the code while the latter is generated dynamically using the SHA-256 hash of a randomly generated 32-byte long string.
This is then encrypted using a hard-coded public RSA key and then embedded in the ransom note.
AES encryption code  Figure 8.
Secret key generation
It does this by changing several registry settings.
Figure 10. Modified system wallpaper
Connections to other ransomware families
A more reasonable link to the Freezing ransomware family exists.
The code also shares similarities with the open-source EDA2 ransomware kit.
Trend Micro solutions Ransomware continues to be a lingering threat, something we mentioned in our last Annual Security Roundup after seeing that the number of ransomware cases we detected climbed from 55 million in 2018 to 61 million in 2019.
For zero-day vulnerabilities, take advantage of virtual patching.
Activate sandbox analysis.
Indicators of Compromise  SHA-256 hash Detection Name 08677a3dac3609d13dc4a2a6868ee2f6c1334f4579356d162b706a03839bb9ff Ransom.PS1.COLDLOCK.YPAE-A c5108344e8a6da617af1c4a7fd8924a64130b4c86fa0f6d6225bb75534a80a35 Ransom.MSIL.COLDLOCK.YPAE-A   All Trend Micro products using the latest VSAPI pattern (15.849.00 or later) are capable of successful detection of this malware.
Recent sha256 hashes of malware samples:  This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2021.
Although believed to have been active since 2011, TeamTNT stayed under the radar for many years before exploding onto the scene in 2020.
This is known as the principle of least privilege.
Implement private keys authentication for Secure Shell (SSH) on the client side for stronger access control security.
However, the scope of the attack remained unknown.
Figure 1: IRC bot dropping encoded shell script (detected as Backdoor.Linux.TSUNAMI.USELVBF21)      We begin by examining the dropped script from a new AWS-focused credential stealer.
An AWS instance, by default, does not have any identity access management (IAM) permissions attached; rather, these permissions must be defined by the AWS administrator.
AWS administrators should follow the principle of least privilege when attaching roles to an AWS instance.
Figure 4. Other binaries found on the open directory
If the group succeeds in running their malicious script on an AWS instance, the script uploads any credentials that it is able to retrieve from the instance metadata service.
During our research, we noticed over 4,000 infected instances.
Use private key authentication when you have SSH enabled inside your instance.
Network Security: cloud network layer IPS security Application Security: security for serverless functions, APIs, and applications Conformity: real-time security for cloud infrastructure — secure, optimize, comply  Indicators of Compromise (IOCs)  SHA-256  Detection  Description  9504b74906cf2c4aba515de463f20c02107a00575658e4637ac838278440d1ae  Backdoor.Linux.TSUNAMI.USELVBF21  IRC bot  3139a85a18e42bf60ba65deb3d691b5c088a0fac2b80a4d05f17a68eac3d4882  TrojanSpy.SH.AWSTEAL.A  Script       Tags  Cloud | APT & Targeted Attacks | Research | Articles, News, Reports
Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.
PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services.
Some of the cloud storage accounts used to deliver PLEAD are also used as drop off points for exfiltrated documents stolen by DRIGO.
PLEAD’s installers are disguised as documents using the right-to-left-override (RTLO) technique to obfuscate the malware’s filename.
We’ve also seen PLEAD use exploits for these vulnerabilities:   CVE-2015-5119, patched by Adobe last July, 2015 CVE-2012-0158, patched by Microsoft last April, 2012 CVE-2014-6352, patched by Microsoft last October, 2014 CVE-2017-0199, patched by Microsoft last April, 2017  PLEAD also dabbled with a short-lived, fileless version of their malware when it obtained an exploit for a Flash vulnerability (CVE-2015-5119) that was leaked during the Hacking Team breach.
Figure 1: How PLEAD utilizes compromised routers PLEAD actors use a router scanner tool to scan for vulnerable routers, after which the attackers will enable the router’s VPN feature then register a machine as virtual server.
This virtual server will be used either as a C&C server or an HTTP server that delivers PLEAD malware to their targets.
PLEAD also uses CVE-2017-7269, a buffer overflow vulnerability Microsoft Internet Information Services (IIS) 6.0 to compromise the victim’s server.
Figure 2:
One of the methods PLEAD operators use to distribute their malware PLEAD’s backdoor can:  Harvest saved credentials from browsers and email clients like Outlook List drives, processes, open windows, and files Open remote Shell Upload target file Execute applications via ShellExecute API Delete target file  PLEAD also uses the document-targeting exfiltration tool DRIGO, which mainly searches the infected machine for documents.
Shrouded Crossbow
This campaign, first observed in 2010, is believed to be operated by a well-funded group given how it appeared to have purchased the source code of the BIFROST backdoor, which the operators enhanced and created other tools from.
Shrouded Crossbow employs three BIFROST-derived backdoors: BIFROSE, KIVARS, and XBOW.
Like PLEAD, Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents.
BIFROSE, known for evading detection by communicating with its C&C servers via Tor protocol, also has a version targeting UNIX-based operating systems, which are usually used in servers, workstations, and mobile devices.
Waterbear similarly employs a modular approach to its malware.
The tactic it later adopted required prior knowledge of their targets’ environment.
All Roads Lead to BlackTech
C&C Server PLEAD Shrouded Crossbow Waterbear itaiwans[.]com Yes No Yes microsoftmse[.]com Yes Yes No 211[.]72[.]242[.]120 Yes Yes No
Table 1: C&C servers shared by PLEAD, Shrouded Crossbow, and Waterbear
Additionally, the IP 211[.]72 [.]242[.]120 is one of the hosts for the domain microsoftmse[.]com, which has been used by several KIVARS variants.
Joint Operations.
While it’s possible for separate groups to attack at the same time, we can construe at they are at least working together:    PLEAD
Shrouded Crossbow Samples from different groups using the same filename Loader component named after its target, i.e. {target name}.exe Loader component named after its target, i.e. {target name}.exe or {target name}64.exe Backdoors using the same C&C servers Connected to 211[.]72[.]242[.]120:53 Connected to 211[.]72[.]242[.]120:443 Timeline indicating arrival order Arrived two days after initial infection by SC Established presence two years prior, but re-infected at a recent time
Table 2: Incident where PLEAD and KIVARS attack the same target    PLEAD Shrouded Crossbow Waterbear Samples found in same machine vmdks.exe  cfbcjtqx.dll tpauto.dll Timeline of infection 3/16/2017 2/23/2017 3/8/2017   Table 3: Incidents where PLEAD, KIVARS, and Waterbear were used on the same target
PLEAD and KIVARS, for instance, share the use of RTLO techniques to disguise their installers as documents.
Similar Objectives.
Public security Schedule   Enterprises Need to be Proactive PLEAD, Shrouded Crossbow, and Waterbear
Network traffic analysis, deployment of firewalls and intrusion detection and prevention systems, network segmentation, and data categorization are just some of them.
An overview and analysis of the various malware used by PLEAD, Shrouded Crossbow, and Waterbear, along with their Indicators of Compromise (hashes, C&Cs), can be found in this technical brief.        Tags  Articles, News, Reports | APT & Targeted Attacks | Research
Evaluations conducted by MITRE Engenuity don’t generate any scores, rankings or ratings.
Security teams can leverage the MITRE ATT&CK framework to tell a story that helps simplify security communication across their organization.
A security professional can leverage MITRE ATT&CK to audit for coverage gaps to discover where they may be vulnerable to threats.
MITRE Engenuity ATT&CK Evaluations tests a solution’s ability to detect an adversary performing a targeted attack.
The simulated attackers sent a spear phishing email with a malicious attachment to the manager with the goal of tricking them into opening it, as this technique relies upon user execution.
When the manager opened the attachment, initial access was granted to the threat group.
Figure 1 - A Technique detection named "User Execution of Office Related Document" was generated when explorer.exe spawned winword.exe when the user clicked 2-list.rtf.
Maintaining Access:
The Leg Work
Now that the threat group has been granted access to the organization’s network, they must collect the necessary information needed to complete their objective.
Figure 2 - A Technique detection named "Clipboard Data or Screenshot Collection via PowerShell" was generated when powershell.exe executed CopyFromScreen().     The adversary uses privilege escalation, which commonly involves taking advantage of pre-existing system weaknesses, misconfigurations, and vulnerabilities to gain higher permissions.
Figure 3 - Workbench results pulling together a chain of attack involved Credential Dumping using Mimikatz Malware.
Lateral Movement: Moving in for the Kill
Figure 4 - Workbench models showing correlated events ready for further investigation.
Trend Micro Vision One is great for this step.
We don’t just tell you these individual events have all occurred – we connect the dots for you, showing that they might be related and have similar indicators of compromise as a certain attack group or type.
Figure 6 - FIN7 evaluation environment with Trend Micro solution placement for both detection and prevention scenarios.
What Does it Mean for Me?
What else do I need to consider?
When evaluating the performance of vendors, it is important to consider the hierarchy of detection types.
Telemetry:
Data was processed that shows an event occurred related to the process being detected.
General:
A general detection indicates that something was deemed suspicious, but it was not assigned to a specific tactic or technique.
Technique: A detection on technique means the detection can be attributed to a specific adversarial action (e.g. credential dumping).
Figure 8 - Carbanak and FIN7 evaluation, 65 ATT&CK techniques across 11 ATT&CK tactics are in scope for this evaluation.
Trend Micro doesn’t leave that responsibility wholly on you.
Figure 9 -
For this specific test, Trend Micro performed exceptionally with the ability to block 90% of simulations automatically.
Another added element this year which deserves a special mention was the introduction of a Linux servers, where we detected all 14 techniques executed in the simulated attack scenario.
Check out the complete results and more information on Trend Micro Vision One here: https://resources.trendmicro.com/MITRE-Attack-Evaluations.html.
Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days.
This week, learn about Trend Micro’s latest cloud security offering, Cloud One – Application Security.
Leading Protection for Cloud-Based Applications from Trend Micro Trend Micro announced the availability of its Trend Micro Cloud One – Application Security, a cloud native security solution for modern applications and APIs.
Delivered as part of its industry-leading platform, Cloud One – Application Security provides code-level visibility and protection against the latest cyber threats.
The Internet of Things (IoT) Cybersecurity Improvement Act, passed by the House of Representatives in September and unanimously approved by the Senate last week, is a step toward warding off advanced threats and providing greater security in IoT devices.
The act aims to create “standards and guidelines” for the federal government to follow with the hopes that the requirements also make their way into private sector manufacturing.
Navigating Gray Clouds: The Importance of Visibility in Cloud Security
With 85% of businesses worldwide using the cloud, it has proven its imperative value, especially during the onslaught of the COVID-19 pandemic when remote work and reliance on the cloud for automation and scalability is the norm.
After migrating to the cloud, enterprises need to be aware of the visibility-related challenges and security risks associated with it.
In this blog, Trend Micro shares security recommendations for organizations to ensure stable security practices in a cloud-first world.
Apple Security Chief Maintains Innocence After Bribery Charges
A grand jury in California's Santa Clara County has indicted Thomas Moyer, Apple's head of global security, for bribery.
Moyer is accused of offering 200 iPads to the Santa County Sheriff's office in exchange for concealed carry permits for four Apple employees.
Weaponizing Open Source Software for Targeted Attacks
In this blog, Trend Micro researchers walk through a recent investigation that involved trojanized open-source software, which is tricky to spot because it takes on the façade of legitimate, non-malicious software, making it especially stealthy and useful for targeted attacks.
However, a closer investigation can reveal suspicious behavior that exposes their malicious intent.
Botnets Have Been Silently Mass-Scanning the Internet for Unsecured ENV Files Security firm Greynoise found that multiple threat actors, while drawing little attention to themselves, have spent the past two to three years mass-scanning the internet for ENV (environment) files that were accidentally uploaded and left exposed on web servers.
Frameworks like Docker, Node.js, Symfony, and Django use ENV files to store environment variables such as API tokens, passwords and database logins.
Analysis of Kinsing Malware's Use of Rootkit
With the constant evolution of shell scripts and Linux-based malicious backdoors and agents, it’s not surprising that the creators of Kinsing have kept in step.
In this blog post Trend Micro researchers discuss the malware variant’s current capabilities, including the addition of features intended to make it more difficult to detect in infected machines.
The Malware that Usually Installs Ransomware and You Need to Remove Right Away
This article lists the known malware strains that have been used over the past two years to install ransomware, all of which should serve as a "code red" moment for any organization.
Once any of these malware strains are detected, system administrators should drop everything, take systems offline, and audit and remove the malware as a top priority.
Published New White Paper: Practical Risk Assessments for Smart Factories
While cyberattacks that threaten smart factories cannot be ignored, it can be a struggle to decipher which security method is sufficient within your organization’s specific system, as well as where to start.
To design a secure system, risk assessment is required.
This new white paper is intended to simulate risk assessment practices using an example of a fictitious smart factory.
The risk assessment described in this document aims to assess and prioritize the risks of the entire smart factory environment, including IT.
Post-Breach, Peatix Data Reportedly Found on Instagram, Telegram
In a data breach notice to affected users, events application Peatix said it learned that user account data had been improperly accessed.
Upon further investigation, they found that usernames, email addresses, salted and hashed passwords, nicknames, preferred languages, countries and time zones had been compromised.
It’s unclear how many of its 5 million user base were affected or how the breach happened.
Not long after the breach occurred, the compromised data was spotted on ads posted on Instagram stories, Telegram channels and various hacking forums.
How a Ransomware Attack Could Affect Retailers