mrmoor/cyber-threat-intelligence huggingface dataset:
If, however, these lines do not pass through this IF statement, an error would occur.
Network destination for template injection: 176[.]119[.]147[.]225 Network destination for VBS: 176[.]57[.]215[.]115  These IP addresses are from Russian hosting companies.
hxxp://{FQDN}/{computer name}_{hexadecimal volume serial number}/help_{day}_{month}[.]php  Conclusion Gameradon is not the first group to take advantage of the Covid-19 topic.
Be especially wary of unsolicited emails, that come from unknown senders.
Avoid activating macro for any attached Microsoft Office files, especially for emails that request macro activation using an image of the body of the opened file or those that don’t show anything.
Trend Micro™ Hosted Email Securityis a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.
Indicators of Compromise (IoCs)  DOCX file SHA256 Detection Name 0d90fe36866ee30eb5e4fd98583bc2fdb5b7da37e42692f390ac5f807a13f057 W97M_CVE20170199.ZYHC-A 036c2088cb48215f21d4f7d751d750b859d57018c04f6cadd45c0c4fee23a9f8 Trojan.W97M.CVE20170199.PG 19d03a25af5b71e859561ff8ccc0a073acb9c61b987bdb28395339f72baf46b4 Trojan.XML.PHISH.AE 62cf22f840fffd8d8781e52b492b03b4efc835571b48823b07535d52b182e861 W97M_CVE20170199.ZKHC-A 8310d39aa1cdd13ca82c769d61049310f8ddaea7cd2c3b940a8a3c248e5e7b06 Trojan.W97M.CVE20170199.PF 84e0b1d94a43c87de55c000e3acae17f4493a57badda3b27146ad8ed0f90c93e Trojan.W97M.CVE20170199.PG 85267e52016b6124e4e42f8b52e68475174c8a2bdf0bc0b501e058e2d388a819 Trojan.W97M.CVE20170199.PF b6a94f565d482906be7da4d801153eb4dab46d92f43be3e1d59ddd2c7f328109 Trojan.W97M.CVE20170199.PF cc775e3cf1a64effa55570715b73413c3ea3a6b47764a998b1272b5be059c25b Trojan.W97M.CVE20170199.PF      DOT file SHA256 Detection Name TrendX 00b761bce25594da4c760574d224589daf01086c5637042982767a13a2f61bea Mal_OLEMAL-4 Downloader.VBA.TRX.XXVBAF01FF007 250b09f87fe506fbc6cedf9dbfcb594f7795ed0e02f982b5837334f09e8a184b Mal_OLEMAL-4 4b3ae36b04d6aba70089cb2099e6bc1ba16d16ea24bbf09992f23260151b9faf Mal_OLEMAL-4 946405e2f26e1cc0bd22bc7e12d403da939f02e9c4d8ddd012f049cf4bf1fda9 Mal_OLEMAL-4 9cd5fa89d579a664c28da16064057096a5703773cef0a079f228f21a4b7fd5d2 Mal_OLEMAL-4 c089ccd376c9a4d5e5bdd553181ab4821d2c26fefc299cce7a4f023a660484d5 Mal_OLEMAL-4 e888b5e657b41d45ef0b2ed939e27ff9ea3a11c46946e31372cf26d92361c012 W97M_VBSDOWNLDR.ZKHC-A f577d2b97963b717981c01b535f257e03688ff4a918aa66352aa9cd31845b67d W97M_VBSDOWNLDR.ZYHC-A      SHA256 Detection Name TrendX 17161e0ab3907f637c2202a384de67fca49171c79b1b24db7c78a4680637e3d5 Trojan.X97M.CVE201711882.THCOCBO Downloader.VBA.TRX.XXVBAF01FF006 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923 TrojanSpy.Win32.FAREIT.UHBAZCLIZ N/A 315e297ac510f3f2a60176f9c12fcf92681bbad758135767ba805cdea830b9ee Trojan.X97M.CVE201711882.THCOCBO Downloader.VBA.TRX.XXVBAF01FF006 3e6166a6961bc7c23d316ea9bca87d8287a4044865c3e73064054e805ef5ca1a Backdoor.Win32.REMCOS.USMANEAGFG Troj.Win32.TRX.XXPE50FFF034 3f40d4a0d0fe1eea58fa1c71308431b5c2ce6e381cacc7291e501f4eed57bfd2 Trojan.MSIL.AGENTTESLA.THCOCBO N/A ab533d6ca0c2be8860a0f7fbfc7820ffd595edc63e540ff4c5991808da6a257d Trojan.X97M.CVE201711882.THCOCBO N/A b78a3d21325d3db7470fbf1a6d254e23d349531fca4d7f458b33ca93c91e61cd Backdoor.Win32.REMCOS.USMANEAGFE Troj.Win32.TRX.XXPE50FFF034 c9c0180eba2a712f1aba1303b90cbf12c1117451ce13b68715931abc437b10cd TrojanSpy.Win32.FAREIT.UHBAZCLIZ Troj.Win32.TRX.XXPE50FFF034     C&C addresses  Bambinos[.]bounceme[.]net bbtt[.]site bbtt[.]space harpa[.]site harpa[.]space harpa[.]website himym[.]site kristoffer[.]hopto[.]org kristom[.]hopto[.]org miragena[.]site miragena[.]xyz papir[.]hopto[.]org sabdja[.]3utilities[.]com sakira[.]3utilities[.]com seliconos[.]3utilities[.]com solod[.]bounceme[.]net sonik[.]hopto[.]org tele[.]3utilities[.]com violina[.]website voyager[.]myftp[.]biz voyaget[.]myftp[.]biz  Mitre ATT&CK Framework         Tags  Malware | APT & Targeted Attacks | Research | Spam | Articles, News, Reports
Following our November update, today we’re sharing the latest insights to fight phishing, and for security teams, providing more details about our work identifying attacks against zero-day vulnerabilities.
In 2019, we sent almost 40,000 warnings, a nearly 25 percent drop from 2018.
We’ve detected a few emerging trends in recent months.
Upon reviewing phishing attempts since the beginning of this year, we’ve seen a rising number of attackers, including those from Iran and North Korea, impersonating news outlets or journalists.
For example, attackers impersonate a journalist to seed false stories with other reporters to spread disinformation.
The chart below details the Russian threat actor group SANDWORM’s targeting efforts (by sector) over the last three years.
In 2019, one in five accounts that received a warning was targeted multiple times by attackers.
APP provides the strongest protections available against phishing and account hijacking and is specifically designed for the highest-risk accounts.
Last year, TAG discovered that a single threat actor was capitalizing on five zero-day vulnerabilities.
The exploits were delivered via compromised legitimate websites (e.g. watering hole attacks), links to malicious websites, and email attachments in limited spear phishing campaigns.
The majority of targets we observed were from North Korea or individuals who worked on North Korea-related issues.
The vulnerabilities underlying these exploits included: Internet Explorer - CVE-2018-8653 Internet Explorer - CVE-2019-0676 Chrome - CVE-2019-5786 Windows Kernel - CVE-2019-0808 Internet Explorer - CVE-2019-1367 Internet Explorer - CVE-2019-1429
Exploiting CVE-2019-0676 enabled attackers to reveal presence or non-presence of files on the victim’s computer; this information was later used to decide whether or not a second stage exploit should be delivered.
The attack vector for CVE-2019-1367 was rather atypical as the exploit was delivered from an Office document abusing the online video embedding feature to load an external URL conducting the exploitation.
This APT group (also referred to as Operation C-Major, PROJECTM, Mythic Leopard, and Transparent Tribe) has been known to use social engineering and phishing lures as an entry point, after which, it deploys the Crimson RAT malware to steal information from its victims.
In late 2021, we saw the group leverage CapraRAT, an Android RAT with clear similarities in design to the group’s favored Windows malware, Crimson RAT.
Looking into one of Earth Karkaddan’s recent campaigns Typically, Earth Karkaddan’s arrival methods include the use of spear-phishing emails and a USB worm that would then drop and execute a remote access trojan (RAT).      Figure 1. Earth Karkaddan’s attack chain
of a fake government-related spear-phishing email
Figure 3. An example of a coronavirus-related spear-phishing email attachment     Once the victim downloads the malicious macro, it will decrypt an embedded executable dropper that is hidden inside a text box, which will then be saved to a hardcoded path prior to it executing in the machine.      Figure 4. Malicious macro that decrypts an executable hidden inside a text box      Figure 5. Examples of encrypted Crimson RAT executables hidden inside text boxes     Once the executable file is executed, it will proceed to unzip a file named mdkhm.zip and then execute a Crimson RAT executable named dlrarhsiva.exe.
The dlrarhsiva.exe Crimson RAT executable
Earth Karkaddan actors are known to use the Crimson RAT malware in its campaigns to communicate with its command-and-control (C&C) server to download other malware or exfiltrate data.
Our analysis shows that the Crimson RAT malware is compiled as a .NET binary with minimal obfuscation.
A list of minimally obfuscated commands, function names, and variables from a Crimson RAT malware sample     Crimson RAT can steal credentials from browsers, collect antivirus information, capture screenshots, and list victim drives, processes, and directories.
Network traffic from a Crimson RAT malware sample     ObliqueRat Malware Analysis
Aside from the Crimson RAT malware, the Earth Karkaddan APT group is also known to use the ObliqueRat malware in its campaigns.
This malware is also commonly distributed in spear-phishing campaigns using social engineering tactics to lure victims into downloading another malicious document.
Initial spear-phishing document with a link to another malicious document     Once the victim clicks the link, it will download a document laced with a malicious macro.
Upon enabling the macro, it will then download the ObliqueRat malware that is hidden inside an image file.
The downloaded "1More-details.doc" contains malicious macros that will download and execute the ObliqueRat malware in a victim’s machine     The macros inside the file will then download a bitmap image (BMP) file where the ObliqueRAT malware is hidden, decode the downloaded BMP file, then create a persistence mechanism by creating a Startup URL which will automatically run the ObliqueRAT malware.
Malicious macro codes will download, decode, and execute the ObliqueRat malware     Figure 12 shows a summary of the ObliqueRat malware’s infection chain:      Figure 12.
ObliqueRat attack chain
Below is a list of backdoor commands that this particular ObliqueRAT malware variant can perform:  Command (v5.2)  Info  0  System information
Find certain files  RHT  Delete files
Note that in this specific campaign, both the Crimson RAT malware downloader document and the ObliqueRat malware downloader share the same download domain, which is sharingmymedia[.]com.
Crimson RAT and ObliqueRat spear-phishing email attachments that feature the same download domain     CapraRAT, One of Earth Karkaddan’s custom Android RAT
Aside from using spear-phishing emails and a USB worm as arrival vectors, Earth Karkaddan also uses Android RATs that could be deployed by means of malicious phishing links.
This is not particularly novel for the APT group — in 2018, it used StealthAgent (detected by Trend Micro as AndroidOS_SMongo.HRX), an Android spyware that can intercept phone calls and messages, track victims’ locations, and steal photos.
In 2020, Earth Karkaddan used an updated version of the AhMyth Android RAT to target Indian military and government personnel via a disguised porn app and a fraudulent national Covid-19 tracking app.
We observed this group using another Android RAT — TrendMicro has named this “CapraRat”— which is possibly a modified version of an open-source RAT called AndroRAT.
While analyzing this android RAT, we saw several similar capabilities to the CrimsonRat malware that the group usually uses to infect Windows systems.
We have been observing CapraRAT samples since 2017,  and one of the first samples we analyzed (SHA-256: d9979a41027fe790399edebe5ef8765f61e1eb1a4ee1d11690b4c2a0aa38ae42, detected by Trend Micro as as AndroidOS_Androrat.HRXD)
revealed some interesting things in that year: they used "com.example.appcode.appcode" as the APK package name and used a possible public certificate “74bd7b456d9e651fc84446f65041bef1207c408d,” which possibly meant the sample was used for testing, and they just started to use it for their campaigns during that year.
In previous years, some CrimsonRAT samples were also found to be hosted on the viral91[.]xyz domain.
Figure 14. CrimsonRAT malware hosted in viral91[.]xyz     We were also able to source a phishing document, “csd_car_price_list_2017,” that is related to this domain and has been seen in the wild in 2017.
Access the unique identification number Access location information
Once the Android RAT is executed, it will attempt to establish a connection to its C&C server, 209[.]127[.]19[.]241[:]10284.
We have observed that the Remote Desktop Protocol (RDP) certificate associated in this deployment, “WIN-P9NRMH5G6M8,” is a common string found in previously identified Earth Karkaddan C&C servers.
Figure 15. Decompiled code from CapraRAT connecting to its C&C server      Figure 16. CapraRAT config showing its C&C server and port information       Figure 17.
Backdoor commands found in CapraRAT     This APK file also has the ability to drop mp4 or APK files from asset directory.
Figure 18. CapraRAT APK file drops an mp4 file     The RAT also has a persistence mechanism that always keeps the app active.
It checks whether the service is still running every minute, and if it is not, the service will be launched again.
CapraRAT’s persistence mechanism     Reducing risks:
Be wary of the scope of app permissions
Indicators of Compromise
Update as of April 27, 2021, 7 A.M. E.T.:
This blog details how Iron Tiger threat actors have updated their toolkit with an updated SysUpdate malware variant that now uses five files in its infection routine instead of the usual three.
A Look at the Iron Tiger Threat Group
In 2020 and 2021, Talent-Jump found new samples for malware families that are attributed to the Iron Tiger threat actor, which is also referred to as LuckyMouse, EmissaryPanda, and APT27.
While investigating Operation DRBControl in 2019, we found several connections to multiple threat actors:  Iron Tiger, which uses the HyperBro trojan and some infrastructure links Winnti, which uses the same infrastructure and code-sharing links detailed in our paper Bronze President, a threat actor that targets non-governmental organizations (NGOs).
However, after the publication of our report, we learned that the Type 2 malware family described in our report was the same as the “RCSession” malware family that Dell Secureworks described in a blog that they published in December 2019.
After finding multiple tools belonging to the Iron Tiger threat actor (which we now track as Earth Smilodon), it is likely that the new malware families that we found during the Operation DRBControl investigation came from the same threat actor.
New Version of SysUpdate Malware      Figure 1.
The old and new SysUpdate infection chains      In December 2020, we found a sample that we identified as one belonging to the SysUpdate malware family, also named Soldier, FOCUSFJORD, and HyperSSL.
SysUpdate was first described by the NCC Group in 2018.
An additional executable that serves as a launcher is loaded in memory, which then loads the final SysUpdate payload.
Based on our investigation, instead of the usual three files, the threat actor used five:  dlpumgr32.exe, a legitimate signed file that belongs to the DESlock+ product DLPPREM32.DLL, a malicious DLL sideloaded by dlpumgr32.exe that loads and decodes DLPPREM32.bin DLPPREM32.bin, a shellcode that decompresses and loads a launcher in memory data.res, an encrypted file decoded by the launcher and contains two SysUpdate versions: one for a 32-bit architecture and another for a 64-bit architecture config.res, an encrypted file decoded by the launcher and contains the SysUpdate configuration, such as the command-and-control (C&C) address
In detail, this process involves multiple steps.
4  Directory to copy all files  %PROGRAMDATA%\Test\  8  Name of the legitimate executable  dlpumgr32.exe  12  Name of the sideloaded DLL  DLPPREM32.DLL
16  Name of the shellcode  DLPPREM32.bin  20  Name of the encrypted payload  data.res  24  MD5 of the encrypted payload  e43e40416520dab5b4c44ac8af907078  28  Name of the encrypted configuration  config.res  32  Name of the registry key value  servTest  36  Name of the service DisplayName  Servdisplay   Table 1.
The launcher’s behavior changes depending on the number of arguments passed to the executable.
Windows Management Instrumentation (WMI) will be used to run dlpumgr32.exe with arguments “-up -run -x” and it will exit the current process.
One argument.
Three arguments.
It encodes it using another key and writes it to the registry key “Software\Classes\scConfig” (HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER hive, depending on the privileges of the process).
After decrypting the configuration, the config.res file is deleted.
The launcher decrypts the data.res file with a different hardcoded DES key.
The result is a file with the following structure:     Size of the 32-bit shellcode  32-bit shellcode  Size of the 64-bit shellcode  64-bit shellcode   Table 2.
Structure of decrypted data.res file  Lastly, the launcher starts a suspended process with the command line “C:\Windows\system32\svchost.exe -k LocalServices,”and injects the appropriate shellcode into it (either 32- or 64-bit).
The following diagram summarizes the launch procedure:      Figure 2.
Analysis of the Payload
The features of the updated SysUpdate payload look similar to its previous versions.
Others have been in existence for many years, such as TPacket, SCM Client, SystemInfo, CMD5, CIOStream, and CInfo.
Some of the classes’ names
It should be noted that we also found recent samples of the SysUpdate backdoor that do not implement these “new” classes.
On two occasions (in March and October 2020), we found a kernel rootkit that had been deployed.
After analysis, it appears that this rootkit’s behavior is very similar to that of the NDISProxy driver and remote access trojan (RAT).
The rootkit has multiple stages before getting to the actual payload:
This is done in conjunction with the Process Monitor driver (procxp152.sys), both of which are dropped upon loading the rootkit, even if they are not originally installed in the machine.
Injects final payload into "lsass.exe"  Stage 3 - Final Payload  Installs itself as a Windows service
Each backdoor has a different token that is encrypted in the registry.
In the version that we’ve analyzed, the installer writes the token in the registry key.
Pandora backdoor samples with different tokens Based on our analysis, the Pandora backdoor contains more public code repositories compared with previous versions.
Feature  Name  Repository  Driver memory injection  Blackbone  https://github.com/DarthTon/Blackbone  NDIS network filtering driver  WFP Sample  "WDK\Windows Filtering Platform Stream Edit Sample/C++/sys/stream_callout.c”
Parse HTTP packets  HTTP Parser  https://github.com/nodejs/http-parser
https://github.com/hfiref0x/Stryker
Encrypted Communication   D3DES  https://gitlab.gnome.org/GNOME/gtk-vnc/-/blob/v0.1.0/src/d3des.c  Compression  QuickLZ  https://github.com/robottwo/quicklz   Table 4.
Pandora’s public code repositories Rootkits From a Public Repository
Hidden.sys -  https://github.com/JKornev/hidden/tree/master/
The certificate has been valid since February 2020.
Hidden Registry/Folder/File  Type  Value  REG  HKLM\SYSTEM\CurrentControlSet\services\HiddenService  REG  HKLM\SYSTEM\CurrentControlSet\services\servTest  REG  HKLM\SYSTEM\CurrentControlSet\services\TrkWkss  Folder  C:\programdata\vlc  File  C:\programdata\vlc\vlc.exe  Folder  C:\programdata\test  File  C:\programdata\test\dlpumgr32.exe  File  C:\windows\system32\drivers\Hidden.sys  File  C:\windows\system32\HiddenService.exe   Table 5.
The references to “Hidden” are related to the rootkit itself.
The “dlpumgr32.exe” and “servTest” lines are related to the new version of SysUpdate which we described earlier.
We do not know which malware variant is being sideloaded by vlc.exe.
It is probably installed as a service named “TrkWkss.”
This confirms that this threat actor is abusing this legitimate program to sideload its backdoors.
HyperBro Malware Family
The Iron Tiger APT group has used the HyperBro malware family since at least 2017.
It is the evolved version of HttpBrowser, which the group has been using since at least 2015.
All the requests were sent to the C&C server on port 443, with “/ajax” as the uniform resource identifier (URI).
While investigating Operation DRBControl, we found an updated version of this malware family that implements some new classes.
We provided a detailed analysis of this new HyperBro version in our research.
However, we continue seeing samples that feature the “older” behaviors, which suggests that different groups — or possibly subgroups of Iron Tiger — are using this malware family.
FRP Tool
We found the FRP tool being used on a Linux host, which is similar to Avast’s findings in a report that they published on the Iron Tiger threat actor.
The FRP tool that we analyzed was a modified version, which was possibly copied off of Github.
We found three new samples of the Type 1 malware family that abuses Dropbox as a secondary C&C channel, which we described in our Operation DRBControl whitepaper.
This shows that the development is still active.
We believe that this was a direct reaction to our research, suggesting that the threat actor read our investigation.
This shows that the threat actors intended to confuse forensics investigators with incorrect timestamps, which is why it’s critical to analyze timestamps with caution during investigations.
Infection Vector
We could not confirm the primary infection vector.
However, traces of the exploitation of the Microsoft Exchange vulnerability CVE-2020-0688 were found.
Multiple infection vectors have been attributed to this threat actor in the past:  Watering holes
Weaponized documents exploiting the Dynamic Data Exchange (DDE) method Weaponized documents exploiting the CVE-2018-0798 vulnerability in Equation Editor Exploitation of the CVE-2019-0604 vulnerability in Sharepoint Supply chain attack that compromises a chat software installer, Able Desktop Exploitation of recent vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) in Microsoft Exchange Server
During our investigation, we found some old samples that fit in these categories but have not been reported.
The closer look into Iron Tiger was prompted because of an incident response investigation involving a Philippine-based gambling company that the group targeted.
The countries that Iron Tiger has targeted in the past 18 months     Timeline
New sample of Type 1 malware variant and a rootkit called Pandora found April 2020: One rootkit sample for hiding files processes, files, and services found October 2020:
New HyperBro and Pandora samples found December 2020:
One sample of the SysUpdate malware variant found January 2021:
Fast Reverse Proxy (FRP) Linux tool found  Conclusion
We detailed how Iron Tiger threat actors have updated their tools, adding new features, and slightly changing their tactics, techniques, and procedures (TTPs), notably by using a rootkit to hide its backdoors.
We expect to see more cases involving four or five files instead of the usual “trident” in the future.
Updated June 18, 2018, 10:05 AM to add new IoC information from IssueMakersLab's July investigation.
We updated it again at 4:30 PM to add a link to IssueMakersLab's website and to add new IoC information.
This research is done in cooperation with IssueMakersLab of South Korea.
Last month we tracked new scouting techniques coming from Andariel, which were used mainly against South Korean targets.
Andariel has been quite active these past few months.
But more recently on June 21, we noticed that Andariel injected their script into four other compromised South Korean websites for reconnaissance purposes.
This was possibly part of their reconnaissance strategy, to find the right targets for their exploit.
To help prevent any damage, we decided to publish our findings before the group deploys the attack.
Figure 1. Watering hole reconnaissance flow Analysis of the Andariel techniques
On June 21, we found that the website of a Korean non-profit organization was compromised with an injected script that collected visitors’ information.
This reconnaissance lasted until 27 June.
We already notified the websites about the compromise.
IssueMakersLab also listed the ActiveX objects that the Andariel group attacked.
Another is “WSACTIVEBRIDGEAX.WSActiveBridgeAXCtrl.1”, which is related to a South Korea-based voice conversion software company.