mrmoor/cyber-threat-intelligence huggingface dataset:
If we test it using a sample binary, the following is generated:  Figure 5. Testing a sample binary using ConfuserEx There are two important aspects to this attribute: first, it is hardcoded as a string constant and second, its value is presented in clear text in the final binary as the following image shows.
The default attribute shown in clear text in the final binary We now have solid evidence that CyaX_Sharp was obfuscated using a modified version of ConfuserEx.
Next, let’s look for the attribute indicator, starting with the CyaX assembly used in the NotepadEx attack.
Cassandra Protector: CyaX
After inspection we noticed that this version of CyaX was similarly notable due to two characteristics.
First, the debug symbols paths were leaked -- suggesting a possible custom build which can be correlated with another modification applied to CyaX.  Figure 7.
The leaked debug symbols paths
The second indicator has to do with one of the methods of CyaX which was modified -- specifically the one injecting the binary in memory.
The following image shows the modified function name.
The modified method which was renamed to Kirkuk, which is also a name of a city in Iraq What other payloads are using KurdishCoder?
Analysis of some of the captured samples reveals the different payloads being used (as shown in the table below).
Note that this does not cover all the samples – it is possible that other payloads are being deployed as well.
Sample Payload KurdishCoderMainSample KurdishCoder_CyaX_Sharp CyaX_method_rename CustomIncreaseX phoenix_keylogger Yes Yes Kirkuk NotePadEx Njrat No Yes Kirkuk QuickTranslation Agent Tesla Yes Yes Kurd SandiwchGenerator Agent Tesla Yes Yes Kirkuk SimpleGame Remcos Yes Yes Kirkuk AnimalGames Hawkeye Rebord Keylogger Yes Yes Kurd   Table 1.
The different samples organized name, payload delivered and the fully-undetectable stages where the attribute “KurdishCoderProduction” is present
Cassandra Crypter
We think one of the possible sources of the customized ConfuserEx is the online service Cassandra Crypter, which offers two kinds of subscription plans: The Premium Plan and the Private Stub.
The Premium Plan requires payment and works automatically, while the Private Stub requires the user to contact the support from the service for further personalization.
Cassandra Crypter’s subscription plans
The combination of ConfuserEx and CyaX (Cassandra protector) seems to be unique and customized based on the indicators mentioned earlier.
While we don’t have definitive evidence that the use of these tools are part of a single campaign, we think the analyzed samples are related to a specific campaign.
Note that the KurdishCoder indicator was spotted also by the Italian Computer Emergency Response Team - Pubblica Amministrazione (CERT-PA), which they reported as a single incident.
As with Capesand, we will be monitoring the use of the tools mentioned in this blog entry for any future developments and updates.
Trend Micro Solutions
A proactive, multilayered approach to security is key against a wide range of threats— from the gateway, endpoints, networks, and servers.
Trend Micro™ endpoint security has vulnerability protection that shields endpoints from identified and unknown vulnerability exploits even before patches are even deployed.
Trend Micro’s endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security protect end users and businesses from these threats by detecting and blocking malicious files and all related malicious URLs.
Indicators of Compromise (IoCs)  Indicator Attribution Trend Micro Pattern Detection 068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73 AnimalGames Backdoor.
MSIL.BLADABINDI.QBR
07be156caac1157707ffe38266dc60abadc488226b4f41d67f23eac98dd917b0
CustomIncreaseX Backdoor.MSIL.BLADABINDI.QBR b00cc9a4292fc5cc4ae5371ea1615ec6e49ebaf061dc4eccde84a6f96d95747c NotePadEx Backdoor.MSIL.BLADABINDI.QBR 6755ce7a362ffecef805e4c54e1d5e201b6c6d561b997ebbd63a8d814ce6a53f QuickTranslation Backdoor.MSIL.BLADABINDI.QBR 8ff11efc1109073fdc49be93e1d100992314fd68ecdff2ba986107602ce75089 SandwichGenerator Backdoor.MSIL.BLADABINDI.QBR 02f2369b58fbb2ba1df2c799b73842880a4874c32c1514a0d8956133be026ade SimpleGame Backdoor.Win32.REMCOS.USMANEAGDZ
Tags  Mobile | APT & Targeted Attacks | Research
Spear Phishing is a specific attack technique that has become widely used in the past few years.
In our new research blog “FreeMilk: A Highly Targeted Spear Phishing Campaign”, our Unit 42 research team has discovered an attack campaign that takes spear phishing targeting to the next level by hijacking in-progress email conversations.
While these are not broad attacks, they represent an escalation in attacker spear phishing techniques in a way that makes it even more important than ever to have a prevention framework in place.
Standard phishing attacks are broad attacks that use general email messages to carry out the attacks.
Standard phishing attacks aren’t personalized: they use very common themes or lures in a generalized way in conjunction with a large enough pool of targets.
The idea is that by chance some percentage of the phishing emails will look legitimate enough to the recipient to be successful.
Basically, standard phishing attacks rely on the law of averages for its success.
As such, it’s a suitable tactic when an attacker cares less about who falls for it than how many fall for it.
A good example of a generalized phishing campaign is the Blank Slate Campaign we wrote about in March 2017.
This attack campaign was so generalized that the attackers didn’t even bother with any theme or lure: they simply sent blank messages with malicious attachments for the recipient to open.
Spear phishing is a more refined and focused version of phishing.
Instead of using generalized themes or lures, spear phishing uses themes or lures that are in some way relevant or appropriate for the target recipient.
For example, a spear phishing attack could use email messages about military exercises sent to military or government targets like we saw with our recent research into CMSTAR Trojan attacks.
Because the malicious email has a context for the target, he or she is more likely to trust it and open the email message and any attachments.
Spear phishing focuses on the quality of the theme and lure where standard phishing focuses on quantity.
Spear phishing is a suitable tactic when an attacker cares about who falls for it.
Where a phishing attack campaign may send malicious emails out to thousands or tens of thousands of targets, a spear phishing campaign my send out just one malicious email to one target.
Sometimes, when that target is a high-value target this attack can also be referred to as ‘Whaling”.  In our new research, our Unit 42 research team has found an attack that takes the refining of spear phishing one step further.
Rather than simply using a theme or lure that is relevant to the target, the attackers behind these attacks use an email conversation that’s in progress to carry out their attack.
You can see an image of how this works below in Figure 1.  Figure 1 Conversation Hijacking to Deliver Malware  How this works is that two users, Alice (A) and Bob (B) are carrying on an email conversation.
A shown in the top figure, an attacker, Charlie (C), carries out an attack that enables him to gain complete control of Alice’s email account, most likely through some form of credential theft.
Once Charlie has access to Alice’s email account, he then finds email conversations between Alice and Bob, his ultimate target.
When he finds one that is still in progress, he crafts a malicious attack email that seems to be relevant to the ongoing email conversation and sends it to Bob as shown in the bottom figure.
If Charlie was successful in crafting the attack email to seem legitimate enough, Bob will open the email and any attachments and the attack will succeed.  Unlike phishing or even general spear phishing, this is a highly sophisticated, labor intensive, focused attack.
Carrying out a successful conversation hijacking spear phishing attack requires knowing someone that the ultimate target is communicating with, compromising that person’s account, identifying an ongoing email conversation with the ultimate target, crafting an email to appear part of that ongoing email conversation and finally sending it.
Even then there’s no guarantee of success since the target may somehow recognize the attack or have sufficient prevention controls in place to prevent the attack from succeeding.
Given all those points, this isn’t an attack that many of us need to worry about.
But those out there who are in positions that might make them a high value target do need to be concerned about this.
Whether you’re on the board of directors for an organization, a CEO/CFO/CSO, entrusted with important military or political information, are a journalist, or an activist/dissident, this is a kind of attack that you could face.
And like with all targeted attacks, you don’t have to be the ultimate target of the attack campaign to be a target: this is a tactic that can be used as part of a broader attack campaign.
For example, if you are the executive assistant for a CEO, you could be the target of an attack like this (“Bob” in our scenario above) so that you in turn are used to carry out an attack (“Alice” in our scenario above) against your CEO (who then becomes “Bob” in our scenario above).  Because of the nature of the attack, unless you verify each and every email you receive, it’s unlikely that you’ll necessarily be able to spot and thwart an attack.
In this case, your best means of protection lies in prevention.
And prevention here is really focused on two things.
First, keeping your systems and devices fully up-to-date with the latest software and security updates.
The specific attack our Unit 42 research team has seen using this technique relied on an attack against a vulnerability in Microsoft Office for which a patch is available.
If an attacker tried to carry this attack out against a target that was patched for this vulnerability, it would fail.
Second, using security on your systems, devices and networks that provides multiple layers of protection can help prevent attacks.  Conversation hijacking spear phishing isn’t a threat everyone faces, but for those who do it represents a significant escalation in terms of sophistication and social engineering of spear phishing attacks.
It also takes spear phishing attacks to a level that makes it nearly impossible to distinguish an attack email from a legitimate email.
And so technological prevention controls (patching, robust security) are even more for effective prevention.
Constant monitoring of threat groups is one of the ways that security researchers and law enforcement agencies are able defend systems against cybercrime.
Among these cybercriminals are financially motivated threat groups Carbanak and FIN7.
Although both names have at times been used to refer to the same group, organizations such as MITRE identifies them as two separate entities that wield the Carbanak backdoor in their attacks.
However, the groups use not just the Carbanak backdoor but also other types of malware such as Pillowmint, a point-of-sale malware, and Tirion, which is said to be geared to replace Carbanak.
MITRE also identifies different main targets for each group: While Carbanak focuses on banking institutions, FIN7 targets food, hospitality, and retail establishments.
This week, the results of this year's round of the MITRE Engenuity ATT&CK Evaluations were released, which focused on Carbanak+FIN7.
We also separately discussed how Trend Micro solutions deal with these threats.
For more background on what happens in attacks launched by Carbanak and FIN7, we pieced together information from our studies of these groups as well as information from ATT&CK tactics and techniques (a total of 65 techniques across 11 tactics) identified by MITRE to be related to these threat groups.
What happens in Carbanak and FIN7 attacks?
In our analysis of a related past campaign, we observed that attackers enter the system through spear phishing.
After gaining a foothold in the system, the dynamic data exchange (DDE) feature in Windows and legitimate cloud-based services will then be abused to deliver the malware or to establish command-and-control (C&C) communication.
After this, the Carbanak backdoor can then be used to log keystrokes and capture screenshots, steal and delete cookies, inject malicious code on sites, and monitor various traffic.
For lateral movement, the malware abuses remote and system administration tools.
To be more specific in terms of ATT&CK® techniques, Carbanak and FIN7 share a notable number of similarities.
However, some techniques are only used by one of them, as we discuss in the subsequent sections.
Figure 1. ATT&CK® tactics shared between Carbanak and FIN7      The following are the tactics and techniques that are employed by Carbanak and FIN7, as shared by MITRE.
Initial Access
Both groups use spear-phishing campaigns with attachments that are embedded with exploits as an entry point to the target system.
Successfully entering the system leads to the next step: executing the attack.
For code and behavior execution, both groups use a variety of techniques through native API, PowerShell, service execution, user execution, Windows Component Object Model (COM) and Distributed COM, and Windows Management Instrumentation (WMI).
Carbanak also abuses command-line interface and DDE client-server protocol.
On the other hand, FIN7 takes advantage of Mshta, a utility that can execute VBScript, and scheduled tasks to run malicious code on user systems.
Once the malicious behavior is executed, the attackers will attempt to keep their presence in a system.
To maintain persistence, the groups create new services.
They also add programs to a startup folder that can be referenced with a registry run key.
We detected a variant of the Carbanak malware that adds registry entries and keys as an autostart technique.
Credentials of existing valid accounts were also abused.
In the case of FIN7, the use of application shimming databases (which can allow developers to apply fixes to applications without rewriting code) and hooking processes that allow the modification of program behaviors are some of the techniques that can be applied.
The former has been utilized in a campaign involving the Pillowmint malware.
Some functions that are needed for the attack require admin privileges.
To elevate privileges, the groups bypass Windows User Account Control (UAC) mechanisms, new services, and valid accounts to elevate process privileges.
For the same purpose, on Linux systems, Carbanak attacks can use sudo, a program that permits users to execute the programs of a superuser.
FIN7 attacks can and inject code into processes and hijack the search order used to load DLL files.
Defense Evasion
After a series of malicious behavior, attackers need to remain stealthy and undetected by using security solutions that can remove threats out of the system.
For defense evasion, both groups create or acquire tools for code signing the malware, or deobfuscate or decode files or information by using malware functions or utilities in the system.
Both groups also employ masquerading to make features appear benign to security solutions, files or information obfuscation to make these files and information difficult to discover, software packing to conceal code, and process injection to evade process-based defense.
Carbanak also performs techniques for disabling security tools, deleting files that are left in malicious activity, and modifying registry to hide configuration information.
FIN7 utilizes guardrails to restrict execution and abused utilities that allow indirect command execution that can go past security restrictions.
The group also evades virtualization and sandboxes and injects malicious code into hollowed processes to dodge process-based defenses.
Credential Access
Some portions of the system are protected by credentials.
To steal these, both groups employed credential dumping and input capture.
The former involves credentials that are usually in the form of hash or clear text, while the latter involves API or web portals.
Carbanak also performs brute force tactics or takes advantage of credentials that are saved in web browsers.
On the other hand, FIN7 performs hooking.
For the discovery phase, the Carbanak and FIN7 campaigns gain more knowledge about the system by gathering listings of various information: open application windows, running processes, IP addresses and other network identifiers in remote systems, detailed hardware and system information, system network configuration and settings, and system owners and users.
Carbanak also collects information on accounts, files and directories, group permissions, and registries.
FIN7 gathers information on network shares.
The gathered information can aid in the next step: lateral movement.
Lateral Movement
The groups move through the network and identify key assets and data by logging in via RDP, copying files to upload adversary tools through remote file copy, and abusing Window admin shares.
In Carbanak attacks, the groups’ attacks can involve logging into services that accept remote connections and using stolen password hashes through the “pass the hash” method.
After moving through the network and identifying assets to target, the next step would be to gather key data.
At the collection phase, Carbanak and FIN7 campaigns harvest data from local system sources and through input and screen capture (as performed in a related campaign using the Tirion malware).
FIN7 attacks can stage collected data in a particular location in preparation for exfiltration.
In both Carbanak and FIN7 attacks, communication with users’ compromised systems is done through bypassing firewalls or network detection systems via commonly used ports, using connection proxies to avoid direct connections to the threat group’s infrastructure, employing the command-and-control channel to remotely copy files from an external system, blending in with existing network traffic by using standard application layer protocol, and taking advantage of standard cryptographic protocol to disguise command-and-control traffic.
Carbanak campaigns can also use legitimate programs and remote access software for command and control.
They also employ standard non-application layer protocols for communication.
In the final phase of the attack, the groups exfiltrate the stolen data into the normal communications channel via command-and-control channels.
For FIN7 attack routines, data can be compressed and/or encrypted before being exfiltrated.
ATT&CK® tactics and techniques for Linux were also shared by MITRE.
Continuous vigilance against threat groups is an important aspect of keeping up with — if not being one step ahead of — threats.
Solutions such as Trend Micro Vision One™️ provide visibility, correlated detection, and behavior monitoring across multiple layers: email, endpoints, servers, cloud workloads.
Tags  Endpoints | APT & Targeted Attacks | Research | Articles, News, Reports
On April 6, 2022, VMware published a security advisory mentioning eight vulnerabilities, including CVE-2022-22954 and CVE-2022-22960 impacting their products VMware Workspace ONE Access, Identity Manager and vRealize Automation.
On April 13, they updated their advisory with information that CVE-2022-22954 is being exploited in the wild.
Multiple writeups detailing exploitation scenarios for the aforementioned two vulnerabilities were published in the last week of April, finally followed by a CISA Alert on May 18.
The CISA Alert also calls out CVE-2022-22972 and CVE-2022-22973 – published on the same day and affecting the same products – as being highly likely to be exploited.
Unit 42 has observed numerous instances of CVE-2022-22954 being exploited in the wild.
In this blog post, we share context around this observed activity, along with how the Palo Alto Networks product suite can be leveraged to protect against it.
Timeline for VMware Vulnerabilities CVE-2022-22954 in the Wild Direct Downloads Mirai/Gafgyt Dropper Scripts or Variants Webshells Perl Shellbot Base64 Injections SSH Key Targeting CVE-2022-22960 in the Wild Conclusion Indicators of Compromise
2022-04-06:
Publication of VMware advisory VMSA-2022-0011 regarding CVE-2022-22954, CVE-2022-22955,CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960, CVE-2022-22961.
2022-04
-11:
Proofs of concept available on GitHub.
This is also the earliest date at which Unit 42 observed exploitation attempts and scanning activity.  2022-04-13: VMware advisory updated with knowledge of active exploitation of CVE-2022-22954 in the wild.
2022-05-18:
Publication of VMware advisory VMSA-2022-0014 regarding CVE-2022-22972, CVE-2022-22973.
Publication of CISA Alert.
As of this writing, no proofs of concept for exploitation of CVE-22972 or CVE-2022-22973 are known.
This post will be updated with new findings as they are discovered.
CVE-2022-22954, a remote code execution (RCE) vulnerability due to server-side template injection in VMware Workspace ONE Access and Identity Manager, is trivial to exploit with a single HTTP request to a vulnerable device.
The list below details the exploits Unit 42 observed targeting this vulnerability that we deemed worth highlighting.
The injected commands worth mentioning that intended to further download payloads to a vulnerable machine can be categorized into the following broad categories:  We observed several instances of CVE-2022-22954 being exploited to drop variants of the Mirai malware.
In most cases, the exploit was only used to drop the payload, however the payloads themself did not contain CVE-2022-22954 exploits for further propagation.
Instead, they were either non-specific Mirai variants or contained previously known exploits such as CVE-2017-17215.
The exception to this is Enemybot, a currently prevalent botnet built with bits of code from both Gafgyt and Mirai source code.
The exploits involving Enemybot eventually download Enemybot samples that themselves embed CVE-2022-22954 exploits for further exploitation and propagation.
We observed the vulnerability exploited to download webshells, including:  Certain injected commands result in the download of obfuscated Perl scripts.
Deobfuscating these scripts reveals they are versions of the known bot family “Stealth Shellbot” that reaches out to an IRC server to listen for commands to perform.
It has the ability to further make HTTP requests based on commands received.
This would mean infected machines could then be directed to further perform scanning and exploitation activity, in addition to directly executing shell commands received from the command and control (C2) server on the target machine.
A complete list of indicators of compromise (IoCs) can be found at the end of this post.
This last command downloads a shell script that ultimately downloads and executes an XMRig coinminer.
We also observed some instances of injected payloads that were either trying to read authorized keys on vulnerable machines or were writing into the authorized_keys file to add to the machine’s list of accepted keys.
Following is an example of such an attempt.
CVE-2022-22960 is a privilege escalation vulnerability in VMware Workspace ONE Access, Identity Manager and vRealize Automation instances, due to improper permissions in support scripts.
The vulnerability can be leveraged to run commands as a root user on a vulnerable instance.
More specifically, this flaw exists since the default user for these VMware products, horizon, has access to several sudo commands, some of which involve paths that can be overwritten as well.
Attackers can, therefore, leverage CVE-2022-22954 to remotely execute commands to overwrite specific paths.
If successful, CVE-2022-22960 can then be leveraged to execute these overwritten paths with root permissions using the sudo command.
Our research so far has shown one publicly known sample demonstrating exploitation of CVE-2022-22960 by overwriting the /usr/local/horizon/scripts/publishCaCert.hzn file.
The content of this exploit file can be observed below.