mrmoor/cyber-threat-intelligence huggingface dataset:
We have not observed any Gmail accounts successfully compromised during these campaigns.
Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, recently introduced a new capability into their credential phishing campaigns.
In mid-March, a security researcher released a blog post detailing a 'Browser in the Browser' phishing technique.
While TAG has previously observed this technique being used by multiple government-backed actors, the media picked up on this blog post, publishing several stories highlighting this phishing capability.
Ghostwriter actors have quickly adopted this new technique, combining it with a previously observed technique, hosting credential phishing landing pages on compromised sites.
The new technique, displayed below, draws a login page that appears to be on the passport.i.ua domain, overtop of the page hosted on the compromised site.
Once a user provides credentials in the dialog, they are posted to an attacker controlled domain.
Recently observed Ghostwriter credential phishing domains:
On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609.
These groups' activity has been publicly tracked as Operation Dream Job and Operation AppleJeus.
However, other organizations and countries may have been targeted.
One of the campaigns has direct infrastructure overlap with a campaign targeting security researchers which we reported on last year.
The exploit was patched on February 14, 2022.
The earliest evidence we have of this exploit kit being actively deployed is January 4, 2022.
We suspect that these groups work for the same entity with a shared supply chain, hence the use of the same exploit kit, but each operate with a different mission set and deploy different techniques.
It is possible that other North Korean government-backed attackers have access to the same exploit kit.
In this blog, we will walk through the observed tactics, techniques and procedures, share relevant IOCs and analyze the exploit kit used by the attackers.
In line with our current disclosure policy, we are providing these details 30 days after the patch release.
The campaign, consistent with Operation Dream Job, targeted over 250 individuals working for 10 different news media, domain registrars, web hosting providers and software vendors.
The targets received emails claiming to come from recruiters at Disney, Google and Oracle with fake potential job opportunities.
The emails contained links spoofing legitimate job hunting websites like Indeed and ZipRecruiter.
Victims who clicked on the links would be served a hidden iframe that would trigger the exploit kit.
Attacker-Owned Fake Job Domains: Exploitation URLs:
Another North Korean group, whose activity has been publicly tracked as Operation AppleJeus, targeted over 85 users in cryptocurrency and fintech industries leveraging the same exploit kit.
This included compromising at least two legitimate fintech company websites and hosting hidden iframes to serve the exploit kit to visitors.
In other cases, we observed fake websites — already set up to distribute trojanized cryptocurrency applications — hosting iframes and pointing their visitors to the exploit kit.
Attacker-Owned Websites: Compromised Websites (Feb 7 - Feb 9): Exploitation URLs:
The attackers made use of an exploit kit that contained multiple stages and components in order to exploit targeted users.
The attackers placed links to the exploit kit within hidden iframes, which they embedded on both websites they owned as well as some websites they compromised.
The kit initially serves some heavily obfuscated javascript used to fingerprint the target system.
This script collected all available client information such as the user-agent, resolution, etc. and then sent it back to the exploitation server.
If a set of unknown requirements were met, the client would be served a Chrome RCE exploit and some additional javascript.
If the RCE was successful, the javascript would request the next stage referenced within the script as “SBX”, a common acronym for Sandbox Escape.
We unfortunately were unable to recover any of the stages that followed the initial RCE.
Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages.
These safeguards included: Although we recovered a Chrome RCE, we also found evidence where the attackers specifically checked for visitors using Safari on MacOS or Firefox (on any OS), and directed them to specific links on known exploitation servers.
We did not recover any responses from those URLs.
Example Exploit Kit:
The attackers made multiple attempts to use the exploit days after the vulnerability was patched on February 14, which stresses the importance of applying security updates as they become available.
We also sent all targeted Gmail and Workspace users government-backed attacker alerts notifying them of the activity.
We encourage any potential targets to enable Enhanced Safe Browsing for Chrome and ensure that all devices are updated.
TAG is committed to sharing our findings as a way of raising awareness with the security community, and with companies and individuals that might have been targeted or suffered from these activities.
We hope that improved understanding of the tactics and techniques will enhance threat hunting capability and lead to stronger user protections across industry.
&amp;nbsp; [Lightly edited transcript of the video above] Hi there, Mark Nunnikhoven from Trend Micro Research, I want to talk to you about the concept of lateral movement.
And the reason why I want to tackle this today is because I've had some conversations in the last few days that have really kind of hit that idea bulb that people don't truly understand how cybercriminals get away with their crimes in the organization.
Specifically how they launch their attacks
Now don't get me wrong, this isn't to blame on defenders.
This isn't to blame of the general public.
I'm going to go with Hollywood's to blame a little bit here, because we're watching movies in Hollywood inevitably…you know the hackers in their dark hat and with no lighting, underground, Lord knows where they find these places to hack from and they are attacking directly through.
You see a bunch of text go across the screen and they penetrate through the first firewall, through the second firewall in into the data.
[00:59] It makes for interesting cinema, just like the red code/green code in CSI Cyber, but it's not a reflection of reality and that's a real challenge.
Because a lot of people don't have the experience of working with cybersecurity, working in cybersecurity, so their only perception is what they see either through media—you know TV, movies, books—or if they happen to run into somebody at in the industry.
So there is an overwhelming amount of sort of information or misinformation.
Not even misinformation, just storytelling that tries to make it far more dramatic than it is.
The reality is that cybercriminals are out for profit.
We know this time and time again—yes a bunch of nation-state stuff does happen but the vast majority of you are unaffected by it same with there's a massive amount of script-kiddie just sort of scanning random people with random tools that are just seeing what they can get away with that and if you have solid, automated defenses that doesn't really impact you.
What does impact you is the vast majority of organized cybercriminals who are out to make a profit.
Trend Micro had a great series and continues to have a great series on the Underground, the Digital Underground that shows just how deep these profit motivations go.
This is very much a dark industry.
And with that in mind we come back to the concept of lateral movement.
[02:22] If an attacker breaches into your systems, whether they come in like a fourth of all attacks do via email whether they come in directly through a server compromise, which is about half of all breaches according to the Verizon data breach investigation report or one of the other methods that is commonly used…then they start to move around within your network.
That's lateral movement.
We talk about north/south traffic with the network, which is basically inside the network to outside of the network, so out to the the internet and back.
East/west is within the network itself.
Most defenses, traditional defenses worry about that north/south traffic.
Not enough worry about the east/west and it's breaking down finally.
We are getting rid of this hard perimeter.
"It's mine, I defend everything inside" …and realizing that this is actually how cybercriminals work.
Once they're inside they move around.
So we need to defend in-depth and have really great monitoring and protection tools within our networks because of this challenge of lateral movement.
[03:23] Let me give you a little easier to digest analogy.
Most of us in a home have a grocery list and maybe once a week—maybe twice–we head to the grocery store and we try to get everything we want off the list and then we come back.
That just makes sense.
You would never think of going, "Okay.
Number one of the list is ketchup.
I'm going to drive to the store to get ketchup.
I'm going to buy it and I'm going to come back home.
I'm going to look at item number two.
I need a loaf of bread.
I'm going to drive back to the store.
I'm going to buy a loaf of bread and I'm going to come back and we can go to item 3, and I'm going to go and I'm going to come back.
I'm going to..."
That's just ridiculous, right?
That's absolutely absurd and cybercrimals agree.
Once they've driven to the store.
They're going to buy everything that they need and everything that they see as an opportunity, right?
They are really susceptible to those end caps and impulse buys... and then they're going to leave.
This is how they attack our organizations.
We know that, because of the average time to detect a breach is around 197 days right now and that stat has fluctuated maybe plus or minus 15 days for the last decade.
We also know that it takes almost three…it takes two and a half to three months actually contain a breach once you discover it and the reason for all of this is lateral movement.
Once you're in as a cybercriminal, once you've made headway, once you gained a beachhead or a foothold within that network you're going to do everything you can to expand it because it's going to make you the most amount of money.
[04:55] What do you think?
Let us know in the comments below, hit us up on social @TrendMicro or you can reach me directly @marknca.
How are you handling lateral movement?
How are you trying to reduce it?
How are you looking for visibility across all of your systems?
Let's continue this conversation because when we talk we all get better and more secure online.
Tags  Cloud | APT & Targeted Attacks | Cyber Crime | Expert Perspective | Network | Articles, News, Reports
By Federico Maggi, Rainer Vosseler (Trend Micro Research), Mars Cheng, Patrick Kuo, Chizuru Toyama, Ta-Lun Yen (TXOne Networks), Erik Boasson (ADLINK), and Victor Mayoral Vilches (Alias Robotics)
Despite being unknown even to industry practitioners, the Data Distribution Service (DDS) protocol has been in use for more than a decade.
This middleware software technology is responsible for running billions of public and private devices and mechanisms currently in use.
DDS is integral in embedded systems that require real-time machine-to-machine communication, facilitating a reliable communication layer between sensors, controllers, and actuators.
This technology is situated at the beginning of the supply chain as a layer that connects, controls, and monitors applications, sensors, and actuators, aimed at maintaining interoperability and fault tolerance.
It is used in various critical sectors such as healthcare, transportation, industrial internet of things (IIoT), robotics, aeronautics, and the military, among others.
Given these factors, this makes the middleware technology an attractive target for attackers.
We analyzed this software and found multiple security vulnerabilities.
This blog lists 13 identified security gaps that were assigned new CVE IDs found in the six most common DDS implementations, mostly concerning deployment.
We also show a preview of the security gaps we found in the standard’s specification and a summary of our testing procedure.
For details on the known vulnerabilities, attack scenarios, and research methodology, read our full paper “A Security Analysis of the Data Distribution Service (DDS) Protocol.”
All the vulnerabilities found have been disclosed and patched or mitigated by their respective vendors.
We studied six widely used DDS implementations, chosen based on executions’ number of users and customers in the critical sectors globally.
We also looked at each implementation’s real-time publish-subscribe (RTPS) packet, as DDS is dependent on its own lower layer standard protocol.
Notably, we also studied the Robot Operating System 2 (ROS 2) because it uses DDS as its default standard operating system (OS) middleware for all robotics and automation use cases.
Given the service’s position as a security and operations building block, all vulnerabilities that affect DDS also affect the rest of the software stack, such as RTPS and all ROS 2 instances.
Developer HQ Region Open Source
Core Language Year Developed Fast-DDS eProsima EMEA Apache License 2.0 C++ 2014 Cyclone DDS Eclipse Foundation project, driven by ADLINK EMEA Eclipse Public License 2.0 and Eclipse Development License 1.0 C 2011 OpenDDS OCI NABU Custom C++ 2005 Connext DDS RTI NABU Extensions are open source C++ 2005 (NDDS – 1995) CoreDX DDS TwinOaks NABU Not open source C 2009 Gurum DDS GurumNetworks APAC Not open source C    Table 1.
A list of all DDS implementations analyzed for this research.
MITRE ATT&CK ICS Attack Surface Vector CVE Scope CVSS Weaknesses (CWE) T0804:
Brute Force I/O T0814: DoS T0827: Loss of Control T0880: Loss of Safety T0802: Automated Collection T0846: Remote System Discovery T0856: Spoof of Reporting Message
Network RTPS discovery packet CVE-2021-38425 Fast-DDS, ROS 2 7.5 CWE-406: Network amplification CVE-2021-38429 OpenDDS, ROS 2 7.5 CVE-2021-38487 Connext DDS, ROS 2 7.5 CVE-2021-43547 CoreDX DDS, ROS 2 7.5 Malformed RTPS packet CVE-2021-38447 OpenDDS, ROS 2 8.6 CWE-405:
Network amplification CVE-2021-38445 OpenDDS, ROS 2 7.0 CWE-130: Improper handling of length CVE-2021-38423 Gurum DDS, ROS 2 8.6 CWE-131: Incorrect calculation of buffer size CVE-2021-38435 Connext DDS, ROS 2 8.6 CVE-2021-38439 Gurum DDS, ROS 2 8.6 CWE-122:
Heap-based buffer overflow T0862: Supply Chain Compromise T0839: Module Firmware T0873: Project File Infection
Configuration XML file CVE-2021-38427 Connext DDS, ROS 2 6.6 CWE-121: Stack-based buffer overflow CVE-2021-38433 Connext DDS, ROS 2 6.6 CVE-2021-38443 Cyclone DDS, ROS 2 6.6 CWE-228: Improper handling of syntactically invalid structure CVE-2021-38441 Cyclone DDS, ROS 2 6.6 CWE-123:
Write-what-where condition  Table 2.
A summary of our findings across the main DDS implementations and standard specification.
When the security gaps on the network attack surface are exploited, it allows an attacker to perform spoofing, reconnaissance, automated data collection, and denial of service (DoS), affecting the control of an exposed system.
Meanwhile, the vulnerabilities we found on the configuration attack surface can be abused to affect the DDS developer or system integrator, potentially compromising the integrity of the software supply chain.
Vulnerabilities in the standard specification
The built-in RTPS discovery protocol is used in peer-to-peer networks to discover the locator of each participant (such as IP address and UDP/TCP port or offset in shared memory).
The “chatty” nature of this discovery protocol and the fact that it expects a reply from each contacted participant, paired with easy-to-spoof transport protocols such as the User Datagram Protocol (UDP), make RTPS vulnerable to network reflection and amplification.
Confidentiality and authenticity for this data is not protected even with DDS Security, making it possible for an attacker to spoof the information.      CVE ID
Partially Mitigated*
BAF Percentage of Attack Duration (Total experiment duration = 139s)  CVE-2021-38425 Fast-DDS, ROS 2 master branch 9.875 100.0 CVE-2021-38429 OpenDDS, ROS 2 >= 3.18.1 18.68 24.17 CVE-2021-38487
Connext DDS, ROS 2 >= 6.1.0 2.011 84.17 CVE-2021-43547 CoreDX DDS, ROS 2 > 5.9.1 32.82 18.14  Table 3.
The network reflection and amplification vulnerability with bandwidth amplification factor (BAF) is calculated as the ratio between outbound and reflected traffic.
Note: Implementations with less than 100% attack duration likely have a timeout mechanism.
(*) A full mitigation will require relevant changes in the RTPS specification.
The longest running node was based on Connext DDS (at 139 seconds), which we kept as a reference.
Table 3 shows that the BAF is greater than one, implying there are asymmetric network flows although the values are at the order of magnitude lower than modern amplification attacks (note that Memcached can reach 10,000 to 51,000 BAF).
However, the network bandwidth in embedded systems is also lower than, for example, what internet nodes can provide.
An attacker can abuse this built-in discovery feature for remote discovery and fingerprinting.
We sent RPTS discovery probes to the entire IPv4 space (except for the no-scan subnets) and received answers from 643 hosts (excluding obvious honeypots).
Notably, hosts never stopped sending traffic to us, even if we only sent them a single 288-byte packet.
This new network-reflection vulnerability that we found is not the only instance of a specification-level vulnerability.
Security researchers from different organizations have been documenting and creating attack scenarios abusing these vulnerabilities as early as 2015.
Proper supply chain management processes allow contextualization, tracking, and monitoring of new vulnerabilities within different downstream software using a specific library such as DDS.
In the case of this middleware technology, DDS is just one of the many critical libraries used in embedded applications that’s easy to lose track of.
Our paper, “A Security Analysis of the Data Distribution Service (DDS) Protocol,” includes short- and long-term mitigation best practices and recommendations, as well as a consideration for adopting a shift-left approach.
We also acknowledge the cooperation and engaging response that some vendors like ADLINK have adopted when we approached them with our findings.
As we encourage more DDS researchers, users, and implementors to keep on studying and promoting security awareness for the DDS ecosystem, we hope the level of engagement we received can serve as a model for the software industry.
Download our full paper here.
Tags  Exploits & Vulnerabilities | Research | Cyber Threats | ICS OT | APT & Targeted Attacks | Compliance & Risks | IoT | Articles, News, Reports
Android malware like ransomware exemplify how the platform can be lucrative for cybercriminals.
But there are also other threats stirring up as of late: attacks that spy on and steal data from specific targets, crossing over between desktops and mobile devices.
These were published on Google Play — but have since been taken down — and third-party app marketplaces.
We named these malicious apps AnubisSpy (ANDROIDOS_ANUBISSPY) as all the malware’s payload is a package called watchdog.
We construe AnubisSpy to be linked to the cyberespionage campaign Sphinx (APT-C-15) based on shared file structures and command-and-control (C&C) server as well as targets.
It’s also possible that while AnubisSpy’s operators may also be Sphinx’s, they could be running separate but similar campaigns.
What can AnubisSpy do?
AnubisSpy can steal messages (SMS), photos, videos, contacts, email accounts, calendar events, and browser histories (i.e., Chrome and Samsung Internet Browser).
It can also take screenshots and record audio, including calls.
It can spy on the victim through apps installed on the device, a list of which is in its configuration file that can be updated.
This includes Skype, WhatsApp, Facebook, and Twitter, among others.
After the data are collected, they are encrypted and sent to the (C&C) server.
AnubisSpy can also self-destruct to cover its tracks.
It can run commands and delete files on the device, as well as install and uninstall Android Application Packages (APKs).
AnubisSpy has several modules, each of which has a separate role.
AnubisSpy’s code is well constructed, indicating the developer/s’ know-how.
Below is a visualization of the modules: Figure 1: Structure of AnubisSpy’s modules
How is AnubisSpy related to Sphinx?
Sphinx reportedly uses the watering hole technique via social media sites to deliver its payloads — mainly a customized version of njRAT.
The Sphinx campaign operators cloaked the malware with icons of legitimate applications to dupe recipients into clicking them.
Sphinx was active between June 2014 and November 2015, but timestamps of the malware indicate the attacks started as early as 2011.
A simple WHOIS query of AnubisSpy’s C&C server showed it abused a legitimate managed hosting service provider in Belize.
We correlated the AnubisSpy variants to Sphinx’s desktop/PC-targeting malware through the following:  Shared C&C server, 86[.]105[.]18[.]107 Shared technique of decrypting JSON files, and similarity between the file structures of AnubisSpy and Sphinx’s malware Similar targets (highly concentrated in Middle Eastern countries)     Figure 2: Comparison of file structure in Sphinx’s desktop/PC-targeting malware (left) and AnubisSpy (right)
Our coordination with Google also revealed that these apps were installed across a handful of countries in the Middle East.
Was AnubisSpy actively distributed?
We analyzed seven apps that were actually AnubisSpy.
These were signed with the same fake Google certificates.
We found two more apps created by the same developer, but they had no espionage-related codes; we think they were made as experimental projects.
Based on hardcoded strings in the Agent Version, the malicious apps were developed as early as April 2015.
Timestamps indicate that the earliest sample was signed on June 2015; the latest variant was signed on May 2017.
AnubisSpy wasn’t only published on Google Play.
We also found versions of it in third-party app marketplaces, most likely as a way to expand the malware’s reach.
The apps mainly used Middle East-based news and sociopolitical themes as social engineering hooks and abused social media to further proliferate.
Versions of AnubisSpy posed as social news, promotional, healthcare, and entertainment apps.
What does AnubisSpy mean to the mobile landscape?
Persistent and furtive spyware is an underrated problem for the mobile platform.
While cyberespionage campaigns on mobile devices may be few and far between compared to ones for desktops or PCs, AnubisSpy proves that they do indeed occur, and may have been more active than initially thought.
Will mobile become cyberespionage’s main frontier?
It won’t be a surprise given mobile platform’s increasing ubiquity, especially in workplaces.
Beyond its effects, AnubisSpy also highlights the significance of proactively securing mobile devices, particularly if they’re on BYOD programs and used to access sensitive data.
Enforcing the principle of least privilege and implementing an app reputation system are just some of the best practices that can help mitigate threats.
We disclosed our findings to Google on October 12 and worked with Google on further analyzing the AnubisSpy-related apps.
Updates were also made to Google Play Protect to take appropriate action against those apps that have been verified as in violation of Google Play policy.
An in-depth technical analysis of AnubisSpy, along with indicators of compromise, is in this technical brief.
Trend Micro Solutions End users and enterprises can also benefit from multilayered mobile security solutions such as Trend Micro™ Mobile Security which is also available on Google Play.