mrmoor/cyber-threat-intelligence huggingface dataset:
Stealth was already a fixture in their operations.
During this time we developed URL-based signatures and used them to detect Lurk-related network traffic.
The signature pattern ^[A-Z0-9]{4}$ was particularly effective in detecting URL patterns employed by Lurk from 2011 to 2013.
Mid-2012 to mid-2014: Honing the Craft Lurk was most prolific during this period, with its series of URL redirection campaigns in Russia becoming more extensive.
Lurk also targeted programmatic advertising infrastructures to increase the scale of their operations.
When 2014 rolled in, Lurk started exhibiting some patterns similar with the Angler exploit kit.
Figure 1. Exploit loading sequence in ria[.]ru (February 2012) Figure 2. [bg].ru (February 2012) found redirecting victims to Lurk’s exploit kit Figure 3. Redirects to the Lurk landing page from adfox[.]ru banner network Figure 4. Malicious iframe content served by tks[.]ru (August 2013)
Lurk’s transition from simple web-browser-exploiting crooks to organized cybercriminals also stood out.
Serving criteria were often modified, malicious payloads were often updated.
While Lurk only exploited a certain set of browser vulnerabilities, the exploit code also often changed.
The initial bodiless payload was designed to be triggered by the exploit kit shellcode, which performed routine checks in the infected machine.
Acquiring additional modules of the group’s malware, for instance, was nearly impractical if the exploit URLs were loaded in a sandboxed environment.
Malicious content were also often distributed during lunchtime (Moscow’s timezone), and in very short intervals.
Lurk’s infrastructure also exhibited new capabilities.
The mechanisms of redirections were different for each intermediate victim.
vesti[.]ru utro[.]ua
womanhit[.]ru   Figure 5.
Lurk’s intermediate targets by year 2014 to 2016:
Going Global 2014 was a significant year in Lurk’s history.
Why not go global to turn in more profit?
By the second half of the year, Lurk’s geographical distribution drastically changed.
Lurk then launched a new URL pattern that served payloads round-the-clock, eschewing pre-filtering of IP address locations in favor of targeting global IP addresses.
It was delivered only if the victim’s source IP address (and time) met Lurk’s parameters—otherwise users received a 404 error response.
2016: Lurk’s Downfall Lurk’s active compromise of financial institutions led to a series of enquiries that culminated in the arrest of over 50 individuals involved in its operations across Russia.
The ripple effect led other cybercriminal groups to lie low for the rest of the year.
By then, Angler’s activities already ceased.
Unfortunately, Lurk is just one of the many cybercriminal groups looking to profit from organizations and end users.
Best Practices Lurk’s story demonstrates the aptitude of cybercriminals for honing in on specific victims and profiting from them.
This should be especially enforced for HTTP and HTTPS protocols that cybercriminals frequently leverage for their attacks.
Updated as of February 6, 2017, 10:05 PM (UTC-7): We updated to include observed systems from other countries that connected to IP addresses operated by Lurk.
Updated as of February 9, 2017, 1:44 AM (UTC-7): We updated to include the latest news about the arrests of suspected members of the group.        Tags  APT & Targeted Attacks | Malware | Endpoints | Research
According to a report by Bloomberg, JBS USA had shutdowns at its nine beef plants on Tuesday, May 31.
The company's meatpacking facilities across the US have also experienced some level of disruptions to operations, said an official with the United Food and Commercial Workers International Union.
The JBS cyber attack comes just three weeks after Colonial Pipeline, the US's largest pipeline system, was targeted in a ransomware attack.
Earlier in May, Ireland's Health Service Executive (HSE) was also hit by a ransomware attack, which continues to result in major issues.
Twenty days later, HSE continues to face IT system difficulties, causing delays in some of its services.
Executives and decision-makers must understand that cybersecurity is not just an IT issue but a major element that affects the entire organization and its operations.
The attacks have been traced back to January 6, 2021, when a new threat group subsequently labelled “Hafnium” by Microsoft began exploiting four zero-day bugs in Microsoft Exchange Server.
This could include deploying ransomware to victim organizations.
CISA ordered government agencies to patch now or disconnect their on-premises Exchange servers.
There is also a possible connection to the Chopper ASPX web shell research we published back in January 2021.
Am I impacted?
Whatever the source, former CISA boss Chris Krebs warns that SMBs, education sector organizations, and state and local governments may be disproportionately affected as these often have fewer resources to spend on security.
Do not re
image any machines until after a forensic scan has been done to ensure you’ve preserved any IoCs.
This year’s evaluation saw vendors detect and respond to tactics, techniques, and procedures (TTPs) from two emulated adversary scenarios that are broadly defining modern ransomware today — Wizard Spider, a cybercriminal extortion gang, and Sandworm, a disruptive threat group focused on data destruction.
Critical evaluation categories include:  Analytic Coverage: Enriched detections to deliver greater context to investigation by adding ATT&CK TTP mapping, improving triage for analysts.
It tested against simulated breaches that included 109 total attack steps.
Detection: Delivered on 19/19 attack steps in the evaluation, for 100% detection.
The increase in efficiency simplifies investigations, optimizes SecOps productivity, and accelerates remediation to stop threat actors in their tracks before they have a chance to cause lasting damage.
We uncovered a recent activity involving the notorious online credit card skimming attack known as Magecart.
The attacker injected their skimming script into the shared JavaScript libraries used by online stores on the PrismWeb platform.
The amount of payment information that was stolen is still unknown.
We disclosed our findings to PrismRBS.
Figure 1. Mirrorthief attack chain  Figure 2.
On April 14, the attackers injected a script to the payment checkout libraries used by the PrismWeb platform.
The location of injected payment checkout libraries on affected online stores were:  hxxps://[online store domain]/innerweb/v4.0/include/js/checkout_payment[.]js hxxps://[online store domain]/innerweb/v3.1/include/js/checkout_payment[.]js  The injected script forged the Google Analytics script format, but loaded a different script from the attackers’ server.
The loaded script is the main script that steals the payment information.
Unlike many web skimmers, which are designed to collect information from many kinds of e-commerce payment pages in general, the skimmer that the Mirrorthief group used was designed specifically for PrismWeb’s payment page.
HTML Element ID Mirrorthief JSON Data Schema Information _cc_number aa
Credit card number _cc_expmonth bb Credit card expiration month _cc_expyear cc Credit card expiration year cc_type dd
Credit card CVN number cc_first_name ff First name of cardholder cc_last_name gg Last name of cardholder bill_to_phone hh Phone number for billing bill_to_country ii
Billing address (city) bill_to_zip nn
Billing address (zip code)   Table 1.
Comparing Magecart-wielding groups The Mirrorthief group made the injected script on the compromised libraries similar to legitimate Google Analytics script and registered their malicious domain (which also appears similar to the original Google Analytics domain) to disguise their activity.
Impersonating the Google Analytics service is a known tactic also used by Magecart Group 11, the group behind the Vision Direct breach.
When we checked Mirrorthief’s network infrastructure, we found that it did not have any overlap with any known cybercrime groups.
In addition, the skimmer Mirrorthief used in the attack is very different from the others since it’s specially designed to skim PrismWeb’s payment form.
Below is a table for comparison.
Group Encryption Algorithm JavaScript Library Magecart Group 11 AES Gibberish-AES ReactGet RSA JSEncrypt Mirrorthief AES Crypto-JS   Table 2. Comparison of encryption algorithms used by the different groups
Figure 5. Magecart Group 11 injection pattern  Figure 6.
ReactGet Group injection pattern  Figure 7.
Mirrorthief Group injection pattern
IT and security teams should restrict or disable outdated components, and habitually monitor websites and applications for any indicators of suspicious activity that could lead to data exfiltration, execution of unknown scripts, or unauthorized access and modification.
The following Trend Micro solutions, powered by XGen™ security, protect users and businesses by blocking the scripts and preventing access to the malicious domains:  Trend Micro™ Security Smart Protection Suites and Worry-Free™ Business Security Trend Micro Network Defense Hybrid Cloud Security  Indicators of Compromise (IoCs)  Indicator Attribution 30c8be0d9deb59d98f7e047579763559f2c2dd9a7b4477636afcbebaaebc7dc5 Mirrorthief skimming script hash (detected as Trojan.JS.MIRRORTHEIF.AA) cloudmetric-analytics[.]com Mirrorthief malicious domain hxxps://cloudmetric-analytics[.]com/ga[.]js
Mirrorthief
malicious URL hxxps://cloudmetric-analytics[.]com/analytics[.]js Mirrorthief malicious URL hxxps://cloudmetric-analytics[.]com/analytic[.]php?ccm_post= Mirrorthief malicious URL hxxps://g-analytics[.]com/libs/analytics[.]js Magecart Group 11 malicious URL hxxps://ebitbr[.]com/api[.]js ReactGet Group malicious URL
We found a new spyware family disguised as chat apps on a phishing website.
We first came across the threat in May on the site http://gooogle[.]press/, which was advertising a chat app called “Chatrious.”
The website became inactive for months after that encounter in May.
Trend Micro detects both of the threats as AndroidOS_CallerSpy.HRX.
It also receives commands from the C&C server to take screenshots, which it later sends to the server.
Scheduled jobs  Source Command alive_latest_files_watcher Starts latest_files_watcher job and keeps it alive enviorment_schedulers
environment record module keep_enviorment_scehdular_alive
Records environment remote_sync
Privacy database
The screenshot gets captured when a command is received from the C&C server.
Infrastructure analysis
The domain gooogle[.]press masquerades as Google to trick users into downloading the app.
Figure 6. Fake copyright info
Whois Lookup reveals that this domain was registered on February 11, 2019 at Namecheap.
However, we found that all the registrant data was untraceable.
Figure 7. gooogle[.]press registration info
We did catch four C&C IP addresses, all hosted on a legitimate service.
VirusTotal scan result
We also conclude that this is the initial phase of an attack based on the following reasons:  CallerSpy, as it is now, could prove uneven for a targeted attack.
We also found some debug code left in CallerSpy.
Indicators of Compromise (IoCs)  SHA-256 Package name Label 0c4b08bec1251b1ebc715a7ef1a712cdcb4d37ce0093d88f7fa73b0e05bf7b0e com.sas.gplayservices.accesibility GSERVICES 38acf26161a2c6429ee40d9b70d8419a9bd00eaa8740d221f943cea3229372dd com.sas.gservices.accesibility GSERVICES 3bf85d0aff5ddc0c57e43b879631ee692d98d01f5c964336471f1cdfe0d291f8 com.example.rat rat 7cb0eb93de496e2141b6e0541465ca71a84063867381085692885c75aa59cb1b com.pdf.searcher.dd Pdf Searcher 8ad18bd8f5d2f1fd9e00211170e8a540ddf7f51618588fab31b4ddd2b34b75e1 com.pdfd.researcher.resaq_ver1 Caller c8e1a702a27309c22728792c64aad4abc14ec2bfad1b30a4f27b8ebc6bcc68ff com.sas.gservices.accesibility GSERVICES   C&C servers  3.95.71.123:3000  18.206.105.66:3000  40.114.109.69:3000  52.21.5.241:2000  Phishing domain  http://gooogle[.]press/    MITRE ATT&CK Techniques  Tactic Technique ID Description Initial Access Masquerade as Legitimate Application T1444 Used to masquerade as a legitimate chat app Persistence Abuse Device Administrator Access to Prevent Removal T1401
Used to request device administrator privilege Persistence
Used to listen for the BOOT_COMPLETED broadcast Defense Evasion Suppress Application Icon T1508
Used to suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed Discovery File and Directory Discovery T1420
Used to enumerate external storage file system Discovery Location Tracking T1430 Used to track device’s location Collection Access Call Log T1433 Used to gather call log data Collection Access Contact List T1432 Used to gather contact list data
Collection Capture Audio T1429 Used to record audio information Collection Capture SMS Messages T1412 Used to collect SMS messages
Collection Data from Local System T1533 Used to collect files from the device, including documents, photos, and  media files
Collection Location Tracking T1430 Used to track device’s location
Collection Screen Capture T1513 Used to take screenshot on the device Exfiltration Standard Application Layer Protocol T1437 Used Standard HTTP Protocol Command and Control Uncommonly Used Port T1509 Used uncommon ports 2000, 3000
Mobile | Phishing
We recently discovered a new advanced persistent threat (APT) group that we have dubbed Earth Berberoka (aka GamblingPuppet).
Based on our analysis, this group targets gambling websites.
Our investigation has also uncovered that Earth Berberoka targets the Windows, Linux, and macOS platforms, and uses malware families that have been historically attributed to Chinese-speaking individuals.
This malware lineup includes tried-and-tested malware families that have been upgraded, such as PlugX and Gh0st RAT, and a brand-new multistage malware family that we have dubbed PuppetLoader.
We discuss the full technical details of Earth Berberoka’s malware families aimed at Linux and macOS as well as Windows, infection vectors, targets, and possible connections with other APT groups in our research paper “Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites.” Technical analysis
PuppetLoader
We discovered a new malware family that we have dubbed PuppetLoader.
In this stage, a blob of payload data is decrypted using a hard-coded key (2726c6aea9970bb95211304705b5f595) and what appears to be an RC4 (Rivest Cipher 4) algorithm.
However, the cipher’s “swap” operation in the pseudorandom generation part of the cipher code was improperly implemented.
It seems that this hard-coded key and flawed RC4 implementation were also used in a malware family named TigerPlug, probably because it spreads the PlugX malware.
Hijacking loaded module
After the payload is decrypted, it is loaded in the machine’s memory and is executed using a stealthy method: PuppetLoader starts by loading a legitimate DLL from the Windows\System32 directory.
This is done by hooking NTDLL APIs such as NtQueryAttributesFile, NtOpenFile, NtCreateSection, NtMapViewOfSection, NtQuerySection and ZwClose.
For its command-line parameters, PuppetLoader uses the same flawed RC4 implementation using the password “whk0q9ogev6ofg8d”.
These hijacking steps result in the following:
Figure 2. asycfilt.dll shown among loaded module names      lz32.dll is opened based on process monitoring tools.       Figure 3. lz32.dll shown among opened files      Only PuppetLoader’s dropper payload is loaded and none of the previously mentioned libraries is actually loaded.
Stage 2: Dropper
Table 1.
We believe that it serves as a marker that stage 2 has been completed.
It is interesting to note that there is a typographical error in “-InokeMethodParam.”
Stage 3: BasicLoader
Stage 5: Client.MainConsole
This is the main client binary written in C++, which is the last stage of PuppetLoader’s infection chain.
RemoteModuleCommandPacket
Uploaded file content FileManage_FolderContent_Packet Folder content VecProcessPacket Vector object with running processes InstallModulePacket BMP with encrypted module to be installed
The custom UDP packets recognized by the client
Install module Login callback Enumerate RDP sessions
oRAT
Another malware family that we obtained both Windows and macOS samples of during our investigation was oRAT.
The oRAT droppers that we found in our analysis were a MiMi chat application built using the Electron JS framework and a DMG (disk image) file.
We discuss the full details of both in our research paper.
The decrypted oRAT configuration     The configuration is decrypted using the AES-GCM (AES with Galois/Counter Mode) algorithm.
The control server is implemented by registering routes.
Requesting a URL therefore results in executing the corresponding code on an infected system.
We obtained oRAT samples that register these routes:   GET /agent/info GET /agent/ping POST /agent/upload GET /agent/download GET /agent/screenshot GET /agent/zip GET /agent/unzip GET /agent/kill-self GET /agent/portscan GET /agent/proxy GET /agent/ssh GET /agent/net  PuppetDownloaders (C++ downloaders)
During our investigation, we also saw malicious websites that distribute fake Adobe Flash Player updates that were actually delivering C++ downloaders.
The infection starts with an executable written in C++ that connects through a Winsock API to a domain or IP address in a specific port.
If the SMTemp.dat file exists, the Loader.dll file executes it.
During our investigation, we noted that the server hosting the second stage of the PuppetDownloaders malware payload was offline.
Figure 7.  XOR decryption routine
We dubbed these downloaders PuppetDownloaders since they are connected to the PuppetLoader malware family, as evidenced by our observations:  This malware and PuppetLoader both use the same string decryption routine that uses the same key.
This malware and PuppetLoader both use the same XOR key (2726c6aea9970bb95211304705b5f595) that is used to decrypt the embedded Loader.dll file.
This malware and PuppetLoader’s decrypted Loader.dlls share similar strings such as “[-] UnExist pwszModuleFunName:”.
This suggests that a common framework was used to compile both DLLs.
MFC socket downloaders
We also saw WinRAR self-extracting (SFX) files dropping downloaders written using the Microsoft Foundation Class Library (MFC) framework.
However, it is possible that multiple groups might be covertly sharing the source code for this malware.
This malware family sends a DWORD, a 32-bit unsigned integer, in the HELLO packet.
Gh0st RAT
We also saw at least three different variants of Gh0st RAT, another malware family that has been in the wild for more than 10 years, being used in Earth Berberoka’s campaign.
This malware family’s source code is public, which is why it has many variants.
One of the variants we analyzed had an interesting destructive feature: It replaces the master boot record (MBR) to display an explicit message (“I am virus ! F*ck you :-)”).
A 2017 Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) report also discussed how Gh0st RAT variants wiped the MBR and replaced it with messages that varied across different samples.
Other Known Malware Families
We also found other legitimate tools being abused by Earth Berberoka and a malware family being used by the group in its campaign:  Quasar RAT – a Windows-based open-source RAT that has been used by APT groups for network exploitation
AsyncRAT – an open-source RAT that can be used to remotely monitor and control devices via an encrypted connection Trochilus – a stealthy RAT that can evade sandbox analysis and can be used in cyberespionage campaigns  Security recommendations
C2s 136.243.108.14 173.209.51.54 HYPERSCRAPE binaries 03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6 cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa
Microsoft Live DLL 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23 PDB E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\EmailDownloader\obj\Debug\EmailDownloader.pdb
E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\Mahdi\LiveLib\obj\Release\LiveLib.pdb
We identified a MacOS backdoor (detected by Trend Micro as  OSX_OCEANLOTUS.D) that we believe is the latest version of a threat used by OceanLotus (a.k.a. APT 32, APT-C-00, SeaLotus, and Cobalt Kitty).
The attackers behind OSX_OCEANLOTUS.D target MacOS computers which have the Perl programming language installed.
The MacOS backdoor was found in a malicious Word document presumably distributed via email.
Figure 1. Graphic used by the malicious document
Upon receiving the malicious document, the user is advised to enable macros.
In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code.
This is shown in the figure below.
Code snippet of the obfuscated document
It extracts theme0.xml file from the Word document.
theme0.xml is a Mach-O 32-bit executable with a  0xFEEDFACE signature that is also the dropper of the backdoor, which is the final payload.
theme0.xml is extracted to /tmp/system/word/theme/syslogd before it’s executed.
Figure 3. Deobfuscated Perl payload from the delivery document Dropper analysis
The main function of the dropper
Figure 5. Hardcoded RSA256 key showing the first 20 characters
The locations:
For regular user   path: ~/Library/Spelling/ processname: spellagentd
Subsequently, it implements the Loader::installLoader method, reading the hardcoded 64-bit Mach-O executable (magic value 0xFEEDFACF), and writing to the previously determined path and file.
The magic value 0xFEEDFACF that belongs to Mach-O Executable (64 bit) Methods GET_LAUNCHNAME and GET_LABELNAME will return the hardcoded name of the property list “.plist” for the root user (com.apple.screen.assistantd.plist) and for the regular user (com.apple.spell.agent.plist).
Property list with persistence settings launchctl load /Library/LaunchDaemons/filename.plist > /dev/nul or launchctl load ~/Library/LaunchAgents/ filename.plist > /dev/nul will then command the operating system to start the dropped backdoor file at login.
Backdoor analysis
Meanwhile, runHandle is responsible for the backdoor capabilities.
The main functions of the backdoor infoClient fills up the variables in HandlePP class.
The HandlePP::getClientID method uses the following environment variables:  Figure 11. Serial number  Figure 12.
Hardware UUID  Figure 13.
MAC address  Figure 14.
Randomly generated UUID
For the initial information packet, the backdoor also collects the following:  Figure 15.
Parser::inBytes method
If clientID equals the following sequence of bytes B4 B1 47 BC 52 28 28 73 1F 1A 01 6B FA 72 C0 73, then the scrambled version is computed using the third parameter (0x10), which is treated as a DWORD.
Each quadruple of bytes is XOR-ed with it, as shown in example below.
Parser::inByte method
Parser::inString method
Let’s say we want to scramble string ‘Mac OSX 10.12.’
The final 5-byte sequence looks like F3 00 00 00 92 0D.
The original string is then XOR’ed with the 5-byte sequence.
Scrambling ‘Mac OSX 10.12’ Encryption
Encoding the encryption key
However, this key is also scrambled with operation XOR 0x13 followed by ROL 6 operation applied to each byte.
Figure 20. Function for scrambling AES256 key in the outgoing packet
The highlighted bytes represent the scrambled computer info  Figure 22.
Randomly generated AES256 key  Figure 23. Scrambled AES256 key (0xC1 XOR 0x13 = 0xD2, 0xD2 ROL 6 = 0xB4) etc.)
Computer info encrypted with AES256 key  Figure 25.
Screenshot of the final payload to be sent to C&C server.
Other bytes are just randomly generated noise.
STRINGDATA::BROWSER_SESSION_ID
m_pixel_ratio)
STRINGDATA::RESOURCE_ID
The getCommand method
The figure below shows the example of two of several possible command codes.