The group's tactics, techniques and procedures (TTPs) for these campaigns have shifted slightly from including phishing links directly in the email, to also linking to PDFs and/or DOCs hosted on Google Drive and Microsoft One Drive.


Within these files is a link to an attacker controlled phishing domain.


These phishing domains have been blocked through Google Safe Browsing – a service that identifies unsafe websites across the web and notifies users and website owners of potential harm.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, has remained active during the course of the war and recently resumed targeting of Gmail accounts via credential phishing.


This campaign, targeting high risk individuals in Ukraine, contained links leading to compromised websites where the first stage phishing page was hosted.


If the user clicked continue, they would be redirected to an attacker controlled site that collected the users credentials.


In mid-April, TAG detected a Ghostwriter credential phishing campaign targeting Facebook users.


Recently observed Ghostwriter credential phishing domains and emails: Curious Gorge, a group TAG attributes to China's PLA SSF, has remained active against government, military, logistics and manufacturing organizations in Ukraine, Russia and Central Asia.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further exploitation.


The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.


While we are actively monitoring activity related to Ukraine and Russia, we continue to be just as vigilant in relation to other threat actors globally, to ensure that they do not take advantage of everyone’s focus on this region.


On any given day, Google's Threat Analysis Group (TAG) is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


Our team of analysts and security experts is focused on identifying and stopping issues like phishing campaigns, zero-day vulnerabilities and hacking against Google, our products and our users.


Today, we’re sharing recent findings on government-backed phishing, threats and disinformation, as well as a new bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns.


Last month, we sent 1,755 warnings to users whose accounts were targets of government-backed attackers.


Generally, 2020 has been dominated by COVID-19.


The pandemic has taken center stage in people’s everyday lives, in the international news media, and in the world of government-backed hacking.


Recently, we shared information on numerous COVID-themed attacks discovered and confirmed by our teams.


We continue to see attacks from groups like Charming Kitten on medical and healthcare professionals, including World Health Organization (WHO) employees.


And as others have reported, we’re seeing a resurgence in COVID-related hacking and phishing attempts from numerous commercial and government-backed attackers.


As one example, we've seen new activity from “hack-for-hire” firms, many based in India, that have been creating Gmail accounts spoofing the WHO.


The lures themselves encourage individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements, and link to attacker-hosted websites that bear a strong resemblance to the official WHO website.


The sites typically feature fake login pages that prompt potential victims to give up their Google account credentials, and occasionally encourage individuals to give up other personal information, such as their phone numbers.


To help protect users against these kinds of tracks, our Advanced Protection Program (APP) utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings.


APP was designed specifically for high-risk accounts.


Government-backed or state-sponsored groups have different goals in carrying out their attacks: Some are looking to collect intelligence or steal intellectual property; others are targeting dissidents or activists, or attempting to engage in coordinated influence operations and disinformation campaigns.


Our products are designed with robust built-in security features, like Gmail protections against phishing and Safe Browsing in Chrome, but we still dedicate significant resources to developing new tools and technology to help identify, track and stop this kind of activity.


In addition to our internal investigations, we work with law enforcement, industry partners, and third parties like specialized security firms to assess and share intelligence.


When we find attempts to conduct coordinated influence operations on our platforms, we work with our Trust & Safety teams to swiftly remove such content from our platforms and terminate these actors’ accounts.


We take steps to prevent possible future attempts by the same actors, and routinely exchange information and share our findings with others in the industry.


We’ve also shared occasional updates about this kind of activity, and today we’re introducing a more streamlined way of doing this via a new, quarterly bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns (foreign and domestic).


Our actions against coordinated influence operations from January, February and March can be found in the Q1 Bulletin.


Since March, we’ve removed more than a thousand YouTube channels that we believe to be part of a large campaign and that were behaving in a coordinated manner.


These channels were mostly uploading spammy, non-political content, but a small subset posted primarily Chinese-language political content similar to the findings of a recent Graphika report.


We’ll also share additional removal actions from April and May in the Q2 Bulletin.


Our hope is that this new bulletin helps others who are also working to track these groups, such as researchers studying this issue, and we hope these updates can help confirm findings from security firms and others in the industry.


We will also continue to share more detailed analysis of vulnerabilities we find, phishing and malware campaigns that we see, and other interesting or noteworthy trends across this space.


Cybercriminals have different motivations: for example, some malicious actors have disruptive political attacks as their objective, while others might be more inclined towards cyberespionage and gathering information on their victims.


Of course, financial gain remains a powerful cybercrime motivation — perhaps even the most common one.


Some malicious actors, such as ransomware operators, earn directly from their cyberattacks.


Others, however, prefer to act as “cybermercenaries,” selling their services to anyone willing to pay.


One of the most prolific cybermercenaries is Void Balaur, a Russian-speaking threat actor group that has launched attacks against different sectors and industries all over the world.


Although Void Balaur offers a wide range of services, the group’s bread and butter is cyberespionage and information theft, selling highly sensitive information on individuals in underground forums and websites such as Probiv.


The group primarily targets email accounts and mailboxes.


While it offers standard mailbox copies that was likely stolen with the help of credential phishing, Void Balaur also offers copies of mailboxes that have not been interacted with — for a higher price.


This option is particularly interesting since it would be extremely difficult under normal circumstances to gather the contents of a mailbox without any user interaction, which points to possibilities such as insider assistance or even the compromise of the email provider’s systems.


Figure 1.


Countries in which Void Balaur email targets were located      In addition, Void Balaur also offers their customers access to a large amount of private data, which includes information such as flight and travel data (passports and ticket purchases); criminal records; financial records and credit histories; pension funds; and even printouts of SMS messages.


It’s easy to see why the services of a cybermercenary like Void Balaur is in demand — these types of information can be very useful for a group or an individual who wants to launch an attack on specific targets.


Void Balaur’s high-profile targets


What makes Void Balaur’s attacks particularly noteworthy is the often-lofty status of its targets.


While the threat actor has been known to offer its services to a more general audience — as seen in its online advertisements in the underground — research from groups such as eQualit.ie and Amnesty International show that Void Balaur is likely also involved in attacks against higher profile victims, ranging from human rights activists and journalists to politicians and even presidential candidates.


One of the group’s more notable campaigns involved attacks that targeted the private email addresses of government officials and politicians in an Eastern European country in September 2021.


Living up to its cybermercenary label, Void Balaur does not limit itself to the geopolitical scene.


Organizations that have access to a large amount of private information are also frequent victims of the group.


These targets belong to different industries such as the telecommunications, retail, financial, medical, and even the biotech sectors.


Organizational leaders and employees that are heavily involved with the company’s core business are among the threat actor’s favored targets, since these individuals will likely have access to the kind of information the group seeks.


Curtailing cybermercenary attacks


Given what we’ve seen of cybermercenaries like Void Balaur, it is likely that these groups have access to a large number of tools and infrastructure that allows them to launch attacks even against prominent individuals and organizations.


However, this does not mean that practicing and implementing the right security safeguards will not help in defending against cybermercenary attacks.


The following security best practices can help both individuals and organizations thwart cybermercenary attacks (and cyberattacks in general):  Employ the services of a reputable provider that places high priority on security.


Consider using dedicated two-factor authentication apps or devices such as Yubikey instead of relying on SMS.


Use encryption systems for communication, especially when it involves sensitive information.


Encrypt the drives of all computers and other machines that are used to store sensitive information.


Practice good security hygiene by deleting old emails and messages to minimize the chances of an attacker gaining access to private information.


Learn more about the activities and targets of Void Balaur in our research paper, Void Balaur: Tracking a Cybermercenary’s Activities.


Tags  APT & Targeted Attacks | Cyber Crime | Research | Articles, News, Reports


The US Department of Energy (DOE) recently launched the Operational Technology (OT) Defender Fellowship.


In collaboration with DOE's Idaho National Laboratory (INL) and the Foundation for Defense of Democracies' (FDD) Center for Cyber and Technology Innovation (CTTI), the OT Defender Fellowship hopes to expand the knowledge of primary US front-line critical infrastructure defenders.


Sharing cybersecurity knowledge to the private sector


It will enable the program participants to engage with various cyber and national experts across the US government.


The program aims to also equip them with a better understanding of the strategies and tactics of the country's adversaries and how the US government cyber operations defend the nation.


The Fellowship aligns with the bipartisan recommendations of the congressionally mandated Cyberspace Solarium Commission (CSC).


King also explains that the CSC report supports operationalizing cybersecurity partnership with the private sector and remolding how the government works with the private sector.


King added that this DOE initiative will better protect the US from cyberattacks.


Tom Fanning, Chairman, President & CEO of Southern Company, says that national security greatly depends on the collaboration between private sector and the government.


They must also be nominated by their organization's leadership and commit to the requirements imposed by the program.


The participant must also be a US citizen and currently hold or be able to attain federal security clearance at the Secret or higher level, or be in a role that justifies application for Department of Homeland Security-sponsored private sector clearance.


For more information about the OT Defender Fellowship, visit https://inl.gov/otdefender/        Tags  Latest News | ICS OT | APT & Targeted Attacks | IoT | Articles, News, Reports


Since 2019, we have been tracking a threat campaign we dubbed as “Water Pamola.”


The campaign initially compromised e-commerce online shops in Japan, Australia, and European countries via spam emails with malicious attachments.


However, since early 2020, we’ve noticed some changes to Water Pamola’s activity.


Victims are now mainly located only in Japan.


Recent telemetry data indicates that the attacks are not being launched via spam anymore.


Instead, malicious scripts are being executed when the administrators look into customer orders in their online shop’s administration panel.


Figure 1.


The Water Pamola attack chain      After further searching, we noticed that an online store administrator asked about a strange online order that contains JavaScript code inserted into the field where the customer’s address or company name would normally be located.


This script is likely activated by exploiting a cross-site scripting (XSS) vulnerability in the said store’s administration portal.


Figure 2.


The question asked on a forum showing the payload related to Water Pamola.


The above is a screenshot of the text in a forum, which is translated by Google Translate as Problem, there is an order that seems to be a mischievous order.


The following characters are included in the address and company name.


The script connects to the Water Pamola’s server and downloads additional payloads.


Taken together, this led us to believe that Water Pamola places orders with this embedded XSS script across many targeted online shops.


If they are vulnerable to this XSS attack, these will be loaded when the victim (i.e., an administrator at the targeted merchant) opens the order within their management panel.


We have collected many attack scripts they delivered to different targets.


The malicious behavior performed by the scripts includes page grabbing, credential phishing, web shell infection, and malware delivery.


This campaign appears to be financially motivated.


In at least one instance, a site that Water Pamola attacked later disclosed that they had suffered a data breach.


Their server was illegally accessed and personal information, which included names, credit card numbers, card expiration dates, and credit card security codes, were potentially leaked.


This breach might be associated with Water Pamola, and it hints that this campaign’s overall goal is to steal the credit card data (similar to Magecart campaigns).


Analysis of the XSS attack


As previously mentioned, Water Pamola sent online shopping orders appended with a malicious XSS script to attack e-commerce administrators.


It’s worth mentioning that they are not targeting a specific e-commerce framework, but e-commerce systems in general.


If the store’s e-commerce system is vulnerable to XSS attacks, the malicious script will be loaded and executed on the merchant’s management panel once someone (like a system administrator or store employee) opens the said order.


These scripts were managed with an XSS attack framework called “XSS.ME,” which helps attackers deal with their attack scripts and the stolen information.


The source code of this framework is shared across many Chinese public forums.


The basic attack script provided by the framework could report the victim’s location and browser cookies.


We observed that the scripts used during the attacks were customized.


The attackers delivered a variety of different XSS scripts, which could include one or more of the following behaviors: Page Grabber


The script sends an HTTP GET request to a specified URL address and forwards the received response to Water Pamola’s server.


This is usually used during an early stage of the attack to grab content from the victim’s management page.


Doing so allows the threat actor to understand the environment and design attack scripts appropriate to the victim’s environment.       Figure 3.


The script for grabbing page content and sending it back to the attacker     Credential Phishing


Some of the delivered scripts revealed that the campaign was trying to obtain administrator credentials for e-commerce websites using two different approaches.


The first way involves appending a fake login form to the page.


The script hooks the mouse click event.


If the victim enters the credential in the fake form and clicks anywhere on the page, the script will take the credentials, encode them using base64, replace some characters with custom substrings, and then upload these to Water Pamola’s server.       Figure 4.


The script to create and delete fake login form for credential phishing     The other approach involves showing an authorization error message and then redirecting the user to a phishing website that asks users to enter their credentials.


The subdomains of their phishing sites were configured to match the names of the targets’ domain, such as “{victim’s domain}[.]basic-authentication[.]live”.


Figure 5.


The script replaces the page content with an authorization error message and redirects users to the phishing website     Webshell/PHP backdoor injection


Some of the delivered malicious scripts attempt to install backdoors to the websites built with the EC-CUBE framework, which is popular in Japan.


The attack we found only works on Series 2 of EC-CUBE; the current version is Series 4, with Series 2 now under extended support.


There are three different approaches used to upload the backdoor.


The first method is uploading a PHP web shell file by calling the native API provided by the framework.


The name of the web shell file is hardcoded to be either “ec_ver.php,” “log3.php,” or “temp.php.”


The web shell can execute any PHP code sent by an HTTP POST request to the web shell.


Note the screenshot in Figure 6: The same web shell with the same “only_pcd” keyword is mentioned in this Chinese blog post.


The blog post describes a web shell with two components — a PHP script and an HTML uploading file — however,  the second one is not needed as the proper POST request can be created with any custom or third-party tool (e.g., Fiddler).      Figure 6.


The script for uploading the PHP web shell to an e-commerce website     The second method is modifying the page header to inject PHP code, which will then execute any PHP code, sent by the parameter “ec_ver2update” in the HTTP request.


Note that the PHP code below is obfuscated.


First, the $IDFX variable uses XOR operation (see character ^) to decode the string “create_function”, then the resulting base64 string is decoded to @eval($_REQUEST['ec_ver2update']); which is the backdoor’s code.


Figure 7.


The script for modifying the shop page header to inject a web shell


The third method is installing a malicious plugin embedded in a file named “MakePlugin.tar.gz” to the e-commerce framework.


The plugin has been designed to drop multiple PHP web shell files on the server.


Figure 8.


The script for uploading and installing the malicious plugin, “MakePlugin.tar.gz”      Figure 9.


The malicious plugin installs several files with web shells     Malware Delivery


In this case, the attack script will show an alert prompt with a message that reads “Your Flash version is too low, please install the latest version and try again!” and then redirects the victim to the fake Flash installer download website they control.


(Note that Flash has been declared end-of-life by Adobe since December 31, 2020.)  If the victim downloads and executes the installer downloaded from this page, the victim will be infected with a variant of Gh0stRat malware, previously also named Gh0stCringe or CineregRAT.


This RAT’s code is based on leaked Gh0st RAT source code; however, its traffic encryption is customized and it added some new features, like QQ number theft.


The Gh0st RAT samples related to this campaign are obfuscated executable files, which decrypt the main payload in memory and execute its main export function named “Shellex.”      Figure


The script showing the error message and redirect to the fake Flash installer      Figure 11.


The fake Flash installer download website     Analysis of the fake Flash installer


As described earlier, the XSS attack script redirects the victim to a fake Flash download site.


Clicking on the “Install now” button downloads a .ZIP archive, which contains several legitimate files as well as a few malicious ones, which are usually in form of DLL libraries.


These libraries will be sideloaded when the legitimate executable gets executed.


Figure 12.


The package of downloaded Flash installer


In this example, AdobeAirFlashInstaller.exe (legitimate file) sideloads xerces-c_2_1_0.dll (patched legitimate file), which then sideloads ulibs.dll (malicious file).


Ulibs.dll loads Adob.dll, which is a ZIP archive.


After extracting the content of the Adob.dll zip archive, two legitimate and signed executable files are present and executed, and a similar sideloading process happens once more.


Figure 13.


The package inside Adob.dll


Here, svchost.exe (renamed legitimate and signed Launcher.exe file from Tencent) sideloads Utility.dll (patched legitimate file).


This patched file contains one new section called .newimp (new import), which adds a new import item with a reference to the oplib.dll library.


This oplib.dll library is then sideloaded.


Figure 14.


Oplib.dll side-loading


This new import was very likely added manually by using a utility called Stud_PE.


This utility has a feature called “Import Adder,” while “.newimp” is the default name of a newly added section containing newly added imports.


Oplib.dll then loads a lib.DAT file from the windowsfiles directory, decodes and decrypts its contents (from a hexadecimal string; XOR 0x42), and loads it into the newly created svchost.exe process.


In addition, persistence via registry keys and Scheduled Tasks are configured.


Figure 15. XOR routine and svchost injection


At the end, the last payload of this infection chain is a variant of a Gh0st RAT.


Communication with C&C uses sockets and is encrypted with simple SUB 0x46, XOR 0x19 encryption.


Figure 16.


XOR routine that encrypts C&C communication      Figure 17.


A packetFlag “xy” was found inside this Gh0st RAT variant     This Gh0st RAT variant implements additional features for stealing QQ messenger user information, for example, a list of users on a given machine and their QQ messenger numbers.


The code below obtains QQ numbers that are currently logged on the machine, mentioned here.


Figure 18.


The code used to obtain user QQ numbers     Protecting e-commerce platforms from Water Pamola’s attacks Water Pamola attacked online merchants with an XSS script appended onto online shopping orders.


They also perpetrated social engineering attacks to phish credentials or prompt the download of a remote access tool.


Online shop administrators should be aware that potential attacks may come not only from spam but also from different — and unexpected — infection vectors.


We also recommend that administrators keep the versions of any e-commerce platforms in use by their websites up to date to prevent any potential vulnerabilities, including XSS attacks.


Organizations can benefit from having Trend Micro™ endpoint solutions such as Trend Micro Smart Protection Suites and Worry-Free™ Business Security.


These can protect users and businesses from threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs.


Indicators of compromise can be found in this appendix.


Tags  Endpoints | APT & Targeted Attacks | Research | Articles, News, Reports | Cyber Threats


A series of ongoing business email compromise (BEC) campaigns that uses spear-phishing schemes on Office 365 accounts has been seen targeting business executives of over 1,000 companies across the world since March 2020.


The recent campaigns target senior positions in the United States and Canada.


The fraudsters, whom we named “Water Nue,” primarily target accounts of financial executives to obtain credentials for further financial fraud.


The phishing emails redirect users to fake Office 365 login pages.


Once the credentials are obtained and accounts are successfully compromised, emails containing invoice documents with tampered banking information are sent to subordinates in an attempt to siphon money through fund transfer requests.


Tracking Water Nue’s activities


The threat actor behind this campaign is interesting for several reasons.


It appears that their technical capabilities are limited despite being able to successfully target high-level employees globally.


While their phishing tools are basic (i.e., no backdoors, trojans, and other malware), they made use of public cloud services to conduct their operations.


The use of cloud services allowed them to obfuscate their operations by hosting infrastructures in the services themselves, making their activities tougher to spot for forensics.


This tactic has become more commonplace among cybercriminals.


We first noticed the campaign from a large group of email domains used in phishing attempts.


We found that most of the recipients hold high corporate positions, particularly in the finance department.


In one of the first cases we encountered, the senior financial officer of a bank located in Africa purportedly sent a PDF invoice to a colleague, specifying a bank account in Hong Kong.


The email was sent from an IP address recorded on one of the phishing sites that the attacker tested its functionality on.


The campaign is ongoing, with the threat actor switching to new infrastructures when used domain names get reported or blacklisted in systems.


Water Nue Campaign Analysis


The attackers use cloud-based email distribution services like SendGrid to deliver emails with a clickable link that redirects targets to a fake Office 365 page.


(We have reached out to SendGrid and shared our findings with them.)


When the target user attempts to log in, credentials are recorded through a simple PHP script.


Figure 1. Water Nue attack scenario       Figure 2. Sample of recorded credentials


While the techniques aren’t new, the attack attempts appear to be successful, collecting over 800 credentials from company executives at the time of writing.


How accounts are targeted for phishing attacks


In a July email sent to a C-level executive, we learned that the base domain URL is U10450540[.]ct[.]sendgrid[.]net, with the final URL being *getting-panes[.]sfo2*.      Figure 3.


Email header “from” field shows New York and various email accounts indicating “Swiftme@{company domain names}”


“Swiftme” appears in the phishing email headers and is accompanied by account names with forged company email domains.


The displayed email header “from” and subject also pretend as a voicemail service.


“Swiftme” is possibly a nod to electronic or wire transfers and reveals the campaign’s purpose after harvesting credentials.


Figure 4.


Emails with different X-Mailers and headers are likely appended through tools that can confuse scan engines.


Here are some of the X-Mailers we observed:


X-Mailer: Mozilla/5.0 (Windows; U; Win98; de-AT; rv X-Mailer: Claws Mail 3.7.6 (GTK+ 2.22.0; x86_64-pc-linux-gnu)


X-Mailer: Mozilla 4.7 [en]C-CCK-MCD NSCPCD47 (Win98; I) X-Mailer: iPhone Mail (8A293)


X-Mailer: Opera7.22/Win32 M2 build 3221


X-Mailer: ZuckMail [version 1.00]


X-Mailer: CommuniGate Pro WebUser v5.3.2


Figure 5.


A phishing site imitates Office 365 login


The originating IP of Water Nue’s test/deployment machine was left in a clear text file in the phishing site’s server for collected credentials.


Figure 6.


Sitemap      Figure 7.


The landing page index.html has a dummy speech functio      Figure 8.


While the main collection function resides in app.js, command and control (C&C) location is embedded in JavaScript code      Figure 9.


jQuery method is used to post the target’s credentials to hosting site     The phishing pages record passwords inputted by site visitors.


Once the compromised credentials are used to successfully log in to accounts, fraudsters can identify themselves as executives.


They will then send a fraudulent wire transfer request to trick recipients into wiring money into the criminals’ accounts.


We found a BEC mail sample that was sent from the same IP.


The email in question is an invoice request that has a legitimate email header, which is a known tactic used in BEC scams.


Figure 10.


An email sample with the same originating IP      Figure 11.


A sample fake PDF invoice in a BEC email


How to defend against BEC and other phishing scams


Unlike other cybercriminal schemes, phishing and BEC scams can be tricky to detect as they are targeted toward specific recipients.


Attackers seek to compromise email accounts to gain access to financial and other sensitive information related to business operations.


Here are some tips on how to stay protected from email scams:


Educate and train employees.


Deflect company intrusions through InfoSec education.


All staff — from the CEO to rank-and-file employees — must learn about the different kinds of scams and what to do in case of any encounters (i.e., double-check with others and verify email details).


Confirm requests using other channels.


Exercise caution by following a verification system (e.g., multiple signoffs or additional verification protocols) among employees that work with sensitive information.


Scrutinize all emails.


Be wary of irregular emails with suspicious content such as dubious sender email, domain name, writing style, and urgent requests.


In the case discussed here, the attacker email itself does not include the typical malware payload of malicious attachments.


As a result, traditional security solutions won’t be able to protect accounts and systems from such attacks.


Users can also turn on mail inspection for sender “sendgrid[.]net” in the email gateway.


Trend Micro protects both small- to medium-sized businesses and enterprises against phishing- and BEC-related emails.


Using enhanced machine learning combined with expert rules


, Trend Micro™ Email Security solution analyzes both the header and the content of an email to stop BEC and other email threats.


For source verification and authentication, it uses Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-Based Message Authentication, Reporting and Conformance (DMARC).


The Trend Micro™ Cloud App Security solution enhances the security of Microsoft Office 365 and other cloud services through sandbox malware analysis for BEC and other advanced threats.


It uses Writing Style DNA to detect BEC impersonations and computer vision to find credential-stealing phishing sites.


It also protects cloud file sharing from threats and data loss by controlling sensitive data usage.


Indicators of compromise (IOCs) Threat actor-managed C&C URLs:  https://highstreetmuch[.]xyz/hug/gate[.]php https://takeusall[.]online/benzz/gate[.]PHP  MITRE ATT&CK® Matrix          Tags  Cloud | APT & Targeted Attacks | Research | Phishing | Articles, News, Reports


Waterbear, which has been around for several years, is a campaign that uses modular malware capable of including additional functions remotely.


It is associated with the cyberespionage group BlackTech, which mainly targets technology companies and government agencies in East Asia (specifically Taiwan, and in some instances, Japan and Hong Kong) and is responsible for some infamous campaigns such as PLEAD and Shrouded Crossbow.


However, in one of its recent campaigns, we’ve discovered a piece of Waterbear payload with a brand-new purpose: hiding its network behaviors from a specific security product by API hooking techniques.


And since the API hooking shellcode adopts a generic approach, a similar code snippet might be used to target other products in the future and make Waterbear harder to detect.


A closer look at Waterbear Waterbear employs a modular approach to its malware.


The evidence is that Waterbear frequently uses internal IPs as its own C&C servers (for instance, b9f3a3b9452a396c3ba0ce4a644dd2b7f494905e820e7b1c6dca2fdcce069361 uses an internal IP address of 10[.]0[.]0[.]211 as its C&C server).


The typical Waterbear infection chain  Figure 1.


A typical Waterbear infection chain


A Waterbear infection starts from a malicious DLL loader, as shown in Figure 1.


We have seen two  techniques of DLL loader triggering.


During our recent Waterbear investigation, we discovered that the DLL loader loaded two payloads.


The payloads performed functionalities we have never seen in other Waterbear campaigns.


Waterbear’s first-stage backdoor


This DLL name is hardcoded inside "mtxoci.dll" which is loaded by the MSDTC service during boot-up.


“mtxoci.dll” first tries to query the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value "OracleOciLib" exists.


During our investigation, we noticed that the value "OracleOciLib" was deleted from the victim's machine, as shown in Figure 2.


Figure 2.


The image on the right showcases how the DLL on a victim's machine appears.


Because there is no "OracleOciLib" value, it loads the hardcoded DLL "ociw32.dll" instead, which triggers the malicious Waterbear DLL loader.


The decryption algorithm is RC4, which takes the hardcoded path to form the decryption key.


Offset 0xAC, Size 0x02: Port Offset 0xAE, Size 0x5A: Reserved bytes Table:


The function address table of the payload.


Table: The sizes of functions Table:


The API address table.


Table: The API hashes for dynamic API loading


In order to avoid in-memory scanning during runtime, the payload encrypts all of the function blocks before executing the actual malicious routine.


The purpose of this is to further avoid being detected by a certain cybersecurity solution.


Figure 4.


The decryption-execution-encryption flow in the shellcode execution routine  Figure 5.


This time, the DLL loader loaded two payloads – the first payload performed functionalities we have not seen before: It injected codes into a specific security product to do API hooking in order to hide the backdoor from the product.


Meanwhile, the second payload is a typical Waterbear first-stage backdoor.


Figure 7.


An unusual Waterbear infection chain


Regardless if the API hooking was performed or otherwise, the second backdoor would still be executed after having been successfully loaded.


API hooking to evade detection


In order to hide the behaviors of the first-stage backdoor (which is the second payload), the first payload uses API hooking techniques to avoid being detected by a specific security product and to make an interference in the result of the function execution.


The payload is composed of a two-stage shellcode.


The second-stage shellcode then performs API hooking inside the targeted process.


If the shared memory doesn't exist, it takes the PID embedded by the first-stage shellcode.


Therefore, the first-stage shellcode takes the PID of the Windows Service — which the first-stage shellcode and the succeeding backdoor both inject into — hides the target process, and embeds that PID into the second-stage shellcode.


Figure 8.


Code that injects current PID into the second-stage shellcode Hooking "ZwOpenProcess" in ntdll.dll


The purpose of hooking “ZwOpenProcess” is to protect the specific process from being accessed by the security product.


Whenever “ZwOpenProcess” is called, the injected code will first check if the opened process hits any PIDs in the protected process ID list.


If yes, it modifies the process ID, which should open on another Windows Service PID.


First, it builds the hooked function and writes the function at the end of “ntdll.dll”.


This function includes two parts, as shown in Figure 9:  The PID checking procedure.


If yes, it replaces the PID to be opened with another Windows Service PID that has been written by the Waterbear loader in the beginning.


Figure 9.


Figure 10.


“ZwOpenProcess” after modification


The API hooking on “ZwOpenProcess” will only be triggered if "%temp%\KERNELBASE.dll" exists on the host.


The second part of API hooking hooks on “GetExtendedTcpTable.” “GetExtendedTcpTable” is used for retrieving a table that contains a list of TCP endpoints available to the application, and it is frequently used in some network-related commands, such as netstat.


The second function, “GetRTTAndHopCount,” acts as the place to put the injected hooking code.


The rest of the routine is all placed in “GetRTTAndHopCount.”


The code is shown in Figure 12.


Figure 12.


In the end, it returns the modified table.


Rather than directly disabling these two functions, this method of using API hooking makes noticing malicious behaviors more difficult, especially since both functions still work and return results normally.


Although in this case, the affected process is specified in the first-stage shellcode, the API hooking logic is quite generic that the same piece of shellcode can be used to hook other vendors' products.


Conclusion


Since the API hooking shellcode adopts a generic approach, the similar code snippet might be used to target other products in the future and make the activities of Waterbear harder to detect.  Tactic  Technique ID Description  Execution Execution


through


Module Load


T1129   Dynamically loads the DLLs through the shellcode Execution through API T1106


Dynamically loads the APIs through the shellcode Persistence


Hooking T1179   Hooks security product’s commonly used APIs Privilege Escalation   Process Injection T1055 Injects the decrypts payload into svchost.exe process Hooking T1179   Hooks security products’ commonly used APIs Defense Evasion Binary Padding T1009 Adds junk data to evade anti-virus scan Disabling Security Tools T1089 Targets a specific security product’s process for injection purposes Deobfuscate/Decode Files or Information T1140 Uses TROJ_WATERBEAR to decrypt encrypted payload Execution Guardrails T1480 Targets specific software in the victim’s environment DLL


Side-Loading T1073   Uses modified legitimate DLL to load the malicious DLL Process Injection T1055 Injects the decrypted payload into svchost.exe process Exfiltration Exfiltration Over Command and Control Channel T1041


Possibly sends collected data to attackers via C&C channel   Indicators of Compromise (IoCs)  SHA256  Detection Name  649675baef92381ffcdfa42e8959015e83c1ab1c7bbfd64635ce5f6f65efd651 BKDR_WATERBEAR.ZTGF 3909e837f3a96736947e387a84bb57e57974db9b77fb1d8fa5d808a89f9a401b TROJ_WATERBEAR.ZTGD fcfdd079b5861c0192e559c80e8f393b16ba419186066a21aab0294327ea9e58 TROJ_WATERBEAR.ZTGJ 3f26a971e393d7f6ce7bf4416abdbfa1def843a0cf74d8b7bb841ca90f5c9ed9 TROJ_WATERBEAR.ZTGH abb91dfd95d11a232375d6b5cdf94b0f7afb9683fb7af3e50bcecdb2bd6cb035 TROJ_WATERBEAR.ZTGH bda6812c3bbba3c885584d234be353b0a2d1b1cbd29161deab0ef8814ac1e8e1 TROJ_WATERBEAR.ZTGI 53402b662679f0bfd08de3abb064930af40ff6c9ec95469ce8489f65796e36c3 TROJ_WATERBEAR.ZTGH f9f6bc637f59ef843bc939cb6be5000da5b9277b972904bf84586ea0a17a6000 TROJ_WATERBEAR.ZTGI 3442c076c8824d5da065616063a6520ee1d9385d327779b5465292ac978dec26 BKDR_WATERBEAR.ZTGD 7858171120792e5c98cfa75ccde7cba49e62a2aeb32ed62322aae0a80a50f1ea


TROJ64_WATERBEAR.ZTGI acb2abc7fb44c2fdea0b65706d1e8b4c0bfb20e4bd4dcee5b95b346a60c6bd31 BKDR_WATERBEARENC.ZTGF b9f3a3b9452a396c3ba0ce4a644dd2b7f494905e820e7b1c6dca2fdcce069361 BKDR64_WATERBEAR.ZTGD 7c0d2782a33debb65b488893705e71a001ea06c4eb4fe88571639ed71ac85cdd BKDR_WATERBEARENC.ZTGH c7c7b2270767aaa2d66018894a7425ba6192730b4fe2130d290cd46af5cc0b7b BKDR_WATERBEARENC.ZTGI 7532fe7a16ba1db4d5e8d47de04b292d94882920cb672e89a48d07e77ddd0138 BKDR_WATERBEARENC.ZTGI dea5c564c9d961ccf2ed535139fbfca4f1727373504f2972ac92acfaf21da831 BKDR_WATERBEARENC.ZTGI 05d0ab2fbeb7e0ba7547afb013d307d32588704daac9c12002a690e5c1cde3a4 BKDR64_WATERBEARENC.ZTGJ 39668008deb49a9b9a033fd01e0ea7c5243ad958afd82f79c1665fb73c7cfadf BKDR_WATERBEARENC.ZTGD              Tags  Malware | APT & Targeted Attacks | Endpoints | Research | Network


Updated May 17, 2021, 3:25 a.m. Eastern Time:


This article has been updated to add references to the DarkSide victim data.


It has been five days since the shutdown prompted by the attack, but Colonial Pipeline is still unable to resume full operations.


Outages have already started affecting motorists.


To keep supplies intact for essential services, the US government has issued advisories against hoarding.


The FBI has confirmed that DarkSide, a cybercriminal group believed to have originated in Eastern Europe, is behind the attack.


The ransomware used by the group is a relatively new family that was first spotted in August 2020, but the group draws on experience from previous financially successful cybercrime enterprises.


Apart from locking Colonial Pipeline’s computer systems, DarkSide also stole over 100 GB of corporate data.


Even the DarkSide actors themselves admit that they just buy access to company networks — they have no idea how access was acquired.


The DarkSide ransomware DarkSide offers its RaaS to affiliates for a percentage of the profits.


August 2020: DarkSide introduces its ransomware.


November 2020:


The group invites other criminals to use its service.


A DarkSide data leak site is later discovered.


December 2020:


March 2021:


DarkSide releases version 2.0 of its ransomware with several updates.


May 2021:


DarkSide launches the Colonial Pipeline attack.


In our analysis of DarkSide samples, we saw that phishing, remote desktop protocol (RDP) abuse, and exploiting known vulnerabilities are the tactics used by the group to gain initial access.


Throughout the reconnaissance and gaining-entry phases, we saw these legitimate tools used for specific purposes:   PowerShell: for reconnaissance and persistence  Metasploit Framework: for reconnaissance Mimikatz: for reconnaissance BloodHound: for reconnaissance Cobalt Strike: for installation  For modern ransomware like DarkSide, gaining initial access no longer immediately leads to ransomware being dropped.


Lateral movement and privilege escalation Lateral movement is a key discovery phase in the modern ransomware process.


The group then continues its lateral movement through the system, eventually using the DC network share to deploy the ransomware to connected machines.


Some of the known lateral movement methods deployed by DarkSide use PSExec and RDP.


Exfiltration  As is common practice with double extortion ransomware, critical files are exfiltrated prior to the ransomware being launched.


This is the riskiest step so far in the ransomware execution process, as data exfiltration is more likely to be noticed by the victim organization’s security team.


It is the last step before the ransomware is dropped, and the attack often speeds up at this point to complete the process before it is stopped.


For exfiltration, we saw the following tools being used:   7-Zip: a utility used for archiving files in preparation for exfiltration  Rclone and Mega client: tools used for exfiltrating files to cloud storage PuTTy: an alternative application used for network file transfer  DarkSide uses several Tor-based leak sites to host stolen data.


The file-sharing services used by the group for data exfiltration include Mega and PrivatLab.


Execution and impact  The execution of the actual ransomware occurs next.


The DarkSide ransomware shares many similarities with REvil in this step of the process, including the structure of ransom notes and the use of PowerShell to execute a command that deletes shadow copies from the network.


In addition to PowerShell, which is used to install and operate the malware itself, the group reportedly uses Certutil and Bitsadmin to download the ransomware.


It uses two encryption methods, depending on whether the target operating system is Windows or Linux: A ChaCha20 stream cipher with RSA-4096 is used on Linux, and Salsa20 with RSA-1024 is used on Windows.


The following figure shows a sample ransom note from DarkSide.


Figure 1.


A Darkside ransom note


It is interesting to note that DarkSide’s ransom note is similar to that of Babuk, which might indicate that these two families share a link.


DarkSide ransomware targets


Based on the group’s Tor leak sites, DarkSide determines whether to pursue targeting a potential victim organization by primarily looking at that organization’s financial records.


It also uses this information to determine the amount of ransom to demand, with a typical ransom demand amounting to anywhere between US$200,000 and US$2 million.


Reports say that, based on the leak sites, there are at least 90 victims affected by DarkSide.


In total, more than 2 TB of stolen data is currently being hosted on DarkSide sites, and 100% of victims’ stolen files are leaked.


The actors behind Darkside have stated that they avoid targeting companies in certain industries, including healthcare, education, the public sector, and the nonprofit sector.


Organizations in manufacturing, finance, and critical infrastructure have been identified in Trend Micro data as targets.


Based on Trend Micro data, the US is by far DarkSide’s most targeted country, at more than 500 detections, followed by France, Belgium, and Canada.


As previously mentioned, DarkSide avoids victimizing companies in CIS countries.


Part of the ransomware execution code checks for the geolocation of potential victims to avoid companies in these countries, although the group would likely be aware of the location of a target organization long before the ransomware is executed.


That the group admittedly spares companies in CIS countries could be a clue to where DarkSide actors are residing.


It is possible that they do this to avoid law enforcement action from these countries, since the governments of some of these countries do not persecute criminal acts such as DarkSide’s if they are done on foreign targets.


After the Colonial Pipeline attack, DarkSide released a statement on one of its leak sites clarifying that the group did not wish to create problems for society and that its goal was simply to make money.


There is no way to verify this statement, but we know that the group is still quite active.


As previously mentioned, DarkSide actors announced that they had stolen data from three more victims since the Colonial Pipeline attack.


MITRE ATT&CK tactics and techniques


The following are the MITRE ATT&CK tactics and techniques associated with DarkSide.


Conclusion


Ransomware is an old but persistently evolving threat.


As demonstrated by the recent activities of DarkSide, modern ransomware has changed in many aspects: bigger targets, more advanced extortion techniques, and farther-reaching consequences beyond the victims themselves.


Ransomware actors are no longer content with simply locking companies out of their computers and asking for ransom.


Now they are digging deeper into their victims’ networks and looking for new ways to monetize their activities.


For example, a compromised cloud server can go through a complete attack life cycle, from the initial compromise to data exfiltration to resale or use for further monetization.


Compromised enterprise assets are a lucrative commodity on underground markets; cybercriminals are well aware of how to make money from attacking company servers.


In the Colonial Pipeline attack, DarkSide used double extortion.


But some ransomware actors have gone even further.


Jon Clay, Director of Global Threat Communications at Trend Micro, outlines the phases of ransomware:


Phase 1: Just ransomware.


Encrypt the files, drop the ransom note, and wait for the payment.


Phase 2: Double extortion.


Phase 1 + data exfiltration and threatening data release.


Maze was one of the first documented cases of this.


Phase 3: Triple extortion.


Phase 1 + Phase 2 + threatening DDoS.


SunCrypt, RagnarLocker, and Avaddon were among the first groups documented doing this.


Phase 4: Quadruple extortion.


Phase 1 (+ possibly Phase 2 or Phase 3) + directly emailing the victim’s customer base or having contracted call centers contact customers.


In fact, as detailed in security reports, DarkSide offers both the DDoS and call center options.


The group is making quadruple extortion available to its affiliates and showing a clear sign of innovation.


In cybercrime, there are no copyright or patent laws for tools and techniques.


Innovation is as much about quickly and completely copying others’ best practices as it is about coming up with new approaches.


Ransomware will only continue to evolve.


Organizations therefore need to take the time to put in place an incident response plan focused on the new model of ransomware attacks.


Unfortunately, some organizations may be putting cybersecurity on the back burner.


For example, some security experts noted that Colonial Pipeline was using a previously exploited vulnerable version of Microsoft Exchange, among other cybersecurity lapses.


A successful attack on a company providing critical services will have rippling effects that will harm multiple sectors of society, which is why protecting these services should be a top priority.


In a US Senate hearing on cybersecurity threats, Senator Rob Portman of Ohio described the strike on Colonial Pipeline as “potentially the most substantial and damaging attack on US critical infrastructure ever.”


This attack is a call to action for all organizations to harden their networks against attacks and improve their network visibility.


Trend Micro has a multilayered cybersecurity platform that can help improve your organization’s detection and response against the latest ransomware attacks and improve your organization’s visibility.


Visit the Trend Micro Vision One™ website for more information.


Detailed solutions can be found in our knowledge base article on DarkSide ransomware.


Tags  APT & Targeted Attacks | Ransomware | Research | Articles, News, Reports


We have been collectively saying in our industry for the last 15-20 years that a layered approach to your security stack is a “best practice,” but as with all best practices, these are ideals rather than reality for so many charged with protecting their organizations.


The vast majority of CISOs are saddled with legacy operating systems and applications, along with a lack of funding.


For many of those in the more mature sectors who struggle less with resources, such as financial and government, this ideal state has been achieved by buying a large number of feature products for each layer.


Then, add more and more people to each layer with the hope that they can effectively coordinate their layers to protect, detect, respond and recover from attacks.


Today’s Challenge


While this strategy has provided a small level of success, it’s not sustainable and definitely not an option for the remaining 90% of companies with resource challenges.


Further complicating the issue is the growing scope and scale of attacks today that are successfully targeting the seams between these layers.


There are many reasons why we are in this overloaded place, drowning in alerts and logs.


But, there is one cause that we can point to that has become especially problematic to the design and operations of security programs – the focus on the “kill chain.”


This focus can be effective to simplify and explain the progression of an attack through the different layers.


However, it doesn’t adequately address the reality of the non-linear nature of attacks.


It also misses the incredible importance of identifying tactics, techniques, and tools used by global threat actor groups today.


(Que the MITRE ATT&CK plug)


Until now.


ATT&CK “…is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.”


ATT&CK enables network defenders and cyber threat intelligence analysts to collaborate through an open community to continuously identify tactics, techniques and tools used by 90+ global threat actor groups to improve their protection and detection.


Today’s Protection


Other innovative trends that work hand in hand with ATT&CK is the move to XDR from EDR.


In the same way that the kill chain has become an outdated concept, so has the notion that EDR is sufficient to speed up detection and response by solely using the endpoint.


ATT&CK gives you the full picture of the threat, and XDR coordinates protection against the full picture of that threat.


While the endpoint is still critical, there are vast numbers of malicious artifacts that are siloed or missed at the network, cloud, and gateway.


XDR fills in those gaps.


Do you think the evolution of EDR to XDR will meet many of challenges we are seeing today?


Tweet us your thoughts at @TrendMicro.


Tags  Cloud | APT & Targeted Attacks | Expert Perspective | Articles, News, Reports | Cyber Threats


Determining who is behind a malware campaign can be a challenging endeavor.


Threat actors generally don’t leave easily identifiable signatures in software designed to disrupt or otherwise harm an adversary.


However, by comparing key pieces of information with known sources, it is possible to determine when a campaign was likely perpetrated by a certain group.


This is even more true when the group has existed for many years and has many pieces of evidence to compare.


Recently, we uncovered the Operation Earth Kitsune campaign and published a detailed analysis of its tactics, techniques, and procedures (TTPs).


While analyzing the technical details of this malware, which includes two new espionage backdoors, we noticed striking similarities to other malware attributed to the threat actor known as APT37, also known as Reaper or Group 123.


We hope our thorough analysis of Operation Earth Kitsune will help others with data points for attribution in the future.


By some accounts, this group has been active since 2012, so there are many examples attributed to them to compare.


It is important to note that previous analysis of suspected APT37 activities from different security vendors date from 2016, and the captured samples for the Operation Earth Kitsune have been developed recently.


Because of this, finding code similarity is unlikely.


However, we were able to match some code reuse in one of the espionage backdoor’s functionalities.


In that sense, we are emphasizing TTPs correlation in this case.


In other words, even when the new samples are developed, the attacker may have reused many of the operational techniques.


Another important consideration for attribution is that we have some historical background for Operation Earth Kitsune.


Previously, we uncovered two different campaigns in 2019 under the name of SLUB malware.


Operation Earth Kitsune is a continuation of those campaigns.


Consequently, some of the attribution indicators will span and include the previous SLUB malware campaigns.


The following sections describe the different correlations and are divided into two main categories:  Correlation related to the malware author developing environment Correlation associated with TTPs  Note that some leads are stronger than others; however, when combined, they suggest that the same threat actor behind malware previously attributed to APT37 is likely responsible for Operation Earth Kitsune.


Malware author’s developer environment


When determining attribution, the most interesting leads are the ones that can deduce information about the malware author’s working environment.


Sometimes, these leads can determine the preferred languages used in the developers’ environment.


There are also times when developers intentionally remove these associations and plant misleading information to avoid attribution.


That action by itself potentially introduces other leads that developers may forget to clean.


Operating system language version


During the analysis of the samples captured from the previous campaign related to SLUB in 2019, one of the samples, the SLUB loader exploiting CVE-2019-0803, contained a version resource section that included intentionally misleading planted data.


Figure 1 shows this:      Figure 1 Planted version information      This kind of misleading version data is quite common and does not have information relevant to attribution.


However, there is a secondary effect when the version resource is added to a binary.


For this, we are assuming this binary was compiled with a Visual Studio toolchain, which is indicated for various compiler identification tools.


When the version resource is compiled into the binary, a language ID is generated and created not in the resource payload but in the internal structure of the resource information that is not visible with Windows Explorer.


What is interesting is that this language ID is not determined by the Visual Studio current language.


Instead, it is determined by the operating system language at the time of the version resource inclusion.


Viewing this language ID requires the use of other tools.


Figure 2 shows the language ID for the SLUB dropper.


Figure 2. Language ID of the Version Resource


We found this type of OS language leak in prior samples attributed to APT37.


One of the previous malware families attributed to APT37 is known as Freenki.


Some Freenki samples had leaked the OS language ID through this same mechanism.


The image (Figure 3) taken from an analysis of Freenki shows that the same logic applies when the resource is compiled into the binary.


Figure 3. Freenki embedded resource


We assume there are multiple developers within APT37, and not all of them follow the same practices.


As such, not all samples may have the embedded resource that leaks the same OS language.


However, this commonality is just the first of many that lead us to believe the team attributed to the Freenki malware is the same team behind Operation Earth Kitsune.2 Leaked assert path and external blog references Sometimes, the malware authors know that releasing symbol information is dangerous from an attribution point of view since it can reveal information about the working environment.


That information often gets stripped from binaries.


However, that is not the only scenario where malware developers leak path information about their environment.


In some instances, malware projects require external libraries, and some libraries used the “assert()” mechanism to help the developers debug unexpected conditions.


In these cases, the compiler includes a path to the source code file along with those “assert()” calls.


These paths leak information about the third-party libraries’ installed paths.


In our case, the samples from the Operation Earth Kitsune implemented the Mattermost command and control (C2) communication and leaked a local path.


Figure 4 shows the leaked path.


Figure 4. Leaked assert() path     Public references to this path (the path to the c++ boost library) consist of Korean language blogs explaining how to set up a developer environment configuration using the same path.


We can also determine that this configuration was created manually because the default path installation does not support static compilation.


Here is a translation of the relevant section: “Well, in the end, I modified the project configuration file as below, but it doesn't seem like best practice.


There seems to be a neat way to do it, but I seek advice from experienced people.”


It is also important to note that the same paths leaked through all the SLUB samples.


This includes samples from the older SLUB campaign in 2019 and the new version that supports Mattermost.


Figure 5.


Public blog in the Korean Language     These two indicators reveal that the malware author used an “assert()” path and referenced an external blog in the same manner as previously analyzed malware.


TTPs Correlation


In our previous detailed analysis of Operation Earth Kitsune, one of the delivery architecture for the espionage backdoors is designed as shown in Figure 6.      Figure 6.


Delivery architecture


While this mechanism may sound quite common in other campaigns, what is interesting is the details they have in common with previous campaigns attributed to APT37.


In 2017, Palo Alto’s Unit 42 detailed their findings around the Freenki malware.


Even though this analysis was three years before Operation Earth Kitsune, the attackers appear to have reused the same TTPs for delivering the malware.


Figure 7 shows delivery PowerShell script sections for both campaigns.


Figure 7. PowerShell scripts downloading JPG files     The following TTPs are common in both campaigns related to the scripts in Figure 7:


Both have compromised websites where the malware samples are hosted and delivered to victim machines.


Both use PowerShell scripts to download and run the samples.


Both PowerShell scripts download multiple malware to the victim machine.


It appears the attacker is willing to implement multiple mechanisms for infecting the victim machine once it is compromised.


Both use different samples for the multiple malware downloaded.


Both use JPG as a delivering extension.


In both cases, at least one sample received command line arguments.


Another surprising similarity in the TTPs related to both campaigns is the path pointing to “udel_ok.ipp,”  as shown in Figure 7.


This is a JavaScript file that executes with wscript.exe.


Figure 8 shows the partial source code for this JavaScript.


Figure 8. Javascript executing the malware.


What got our attention is that the samples were renamed to be similar to the naming convention of Windows update files (i.e., “Windows-KB275122-x86.exe”).


While analyzing the samples that have been previously attributed to APT37, we noticed that the persistence mechanism in Operation Earth Kitsune uses the same naming convention to auto-start itself through the Windows run registry key.


We also found that older samples from the previous SLUB campaigns in 2019 used a similar naming convention.


Figure 9 shows that SLUB used “Windows-RT-KB-2937636.dll,” while Freenki used “Windows-KB275122-x86.exe.”      Figure 9 Naming convention for persistence.


We can see how the Freenki malware, previous SLUB campaigns, and Operation Earth Kitsune share many common TTPs in their delivery and persistence mechanisms.


However, these are not the only commonalities.


Again, on its own, this might not be coincidental.


However, our analysis shows further similarities that imply correlation.


GNUBoard compromised web sites


In the blog describing Operation Earth Kitsune, we noted sites using the GNUBoard Content Management System (CMS) had been compromised and were used to host malware.


The malware campaigns previously attributed to APT37 also extensively used the exploitation of web sites hosted with GNUBoard CMS.


While analyzing multiple samples, we found indicators of this strategy across the various campaigns.


Figure 10 shows an example attributed to APT37 and Operation Earth Kitsune as a comparison.


The SLUB campaign also exploited and used GNUBoard websites as part of the infrastructure.


Figure 10.


Websites created using GNUBoard CMS     Exfiltration commands


As mentioned in the previous report on Operation Earth Kitsune, one of the espionage backdoors, named agfSpy, received a “JSON” configuration with a list of native Windows commands to execute.


The output of those commands is exfiltrated back to the agfSpy command and control (C2) server.


While analyzing one malware previously attributed to APT37, it executed practically the same command sequences including the paths and extensions.


Even when the threat actor was not using the “JSON” format, the commands embedded in the various samples show a surprising amount of similarities.


Figure 11 shows a comparison of the exfiltration commands between malware previously attributed to APT37 and Operation Earth Kitsune.


Note the following similarities:  The usage of paths C:\Users and D:\ are similar The searching patterns are very similar The extension list is very similar


Note that we are comparting a sample from 2016 with agfSpy, which is from 2020.


It makes sense that new campaigns coming from the same authors/groups will add new extensions like “.xlsx” to support updated versions of Office documents.


It is also clear that the actual interest is on the “.hwp” extension for Korean Office document listing support during exfiltration.


Figure 11. Exfiltration command similarities.     Code sharing


When doing attribution, finding code sharing between different samples is one of the most desired discoveries.


However, in our case, this was difficult as we are comparing samples from 2016-2017 to those developed in 2020.


At the same time, practically all code for the SLUB malware was created from scratch.


Also, dneSpy and agfSpy are based on custom and newly developed code.


That makes it difficult to match code similarities, and that is why many of the indicators of code sharing are sparse across different samples.


However, one feature that is present in the previous malware attributed to APT37 and Operation Earth Kitsune is the screenshot capture.


We tried to find how this feature evolved across previous samples and the older SLUB samples.


During the analysis, we found a clear indication of code sharing for the screenshot functionality.


Figure 12 shows a comparison between the two samples.


While this code may have some related “internet code sharing post” origin, both samples share it.


They also have some changes that make sense, such as removing the error “failed to take…,” since this is not required for the malware functionality.


It is likely a late refactor to the code.


Figure 12.


Screenshot functionality comparison between SLUB and APT37     Working Hours


Analyzing the compile time of binaries between different samples can also provide a level of correlation between samples.


While malware authors can fake this, useful information can still be gleaned with enough samples.


In our case, we collected many samples across 2020, and we found that the compile dates and times follow a logical timeline according to the malicious activity.


Based on our analysis, we believe the malware author did not fake the compile times of the binaries.


Other public references also used the compiled binary time of samples attributed to APT37.


When compared to the compile times seen in Operation Earth Kitsune, there are several similarities.


The compile times that are listed on binaries provide an estimate of the threat actor's working hours and help approximate possible time zones where the malware was developed.


It is fair to assume that the developers work on daily working times.


When you have many samples to analyze, you can refine that expectation over time.


Figure 14 (below) shows a raw comparison across many samples using two time zones.


We can see how the UTC+9 time zone matches those previously attributed to APT37 and those from Operation Earth Kitsune.


These both equate to the daily working times for that time zone.


Figure 13.


Compile Time APT73 and Kitsune


During the capture of samples for Operation Earth Kitsune, we managed to dump information about the Mattermost server using its API and the token used by the malware itself.


Mattermost was being used as a C2 channel for the malware.


Part of the dumped information contained the action of the user with administration roles on the system.


That user was doing manual activities the majority of the time.


At the same time, we were able to locate the Mattermost server hosted in Greece, and that gave us the current time zone of the Mattermost server.


Having that reference, we plotted the actions of all users whose information we could obtain.


It is important to remember that, except for the administrator user, all other accounts were used as part of the malware deployment (SLUB malware).


Figure 15 shows a plot with “Y” representing the number of actions.


For example, an action for the SYSTEM_ADMIN could be to create a user, add a user to a channel, etc.


The “X” axis represents the hour of the day (in 24 hours).


No months are plotted, so this figure is like compressing all the activity across the full 2020-year in one day just to show the active hours in a day.


All the plots are located in UTC+9.


Figure 14.


Mattermost server activity.


Figure 15 shows that User_3 and User_4 have like random counts.


This is because those accounts are actually the ones the malware used during the infection logging activities to the Mattermost server.


However, the SYSTEM_ADMIN account has a different pattern because the actions are mostly due to manual administration activities.


Unsurprisingly, the SYSTEM_ADMIN hours perfectly line up with the daily working hours at UTC+9.


Conclusions


While no attribution is perfect, there are striking similarities between the malware attributed to APT37 and Operation Earth Kitsune.


Little can be gleaned from each individual piece, but when viewed as a whole, the group behind Operation Earth Kitsune is likely the same one behind the Freenki malware and other malware campaigns attributed to APT37.


This is somewhat surprising, considering Operation Earth Kitsune’s espionage tools were entirely fresh-developed.


We can summarize the correlated indicators in a general form as:  Use of Korean language in the system environment of the developers Reuse of multiple TTPs during operation deployments:     GNUBoard compromised web sites     Multiple malware samples deployed at the same time     A similar organization in the deployment architecture Reliance on public services and watering hole attacks to compromised victims Some code reuse, even when the samples are completely different otherwise Working hours for both matches


Exfiltration techniques and information interest are very similar if not fully matched  While it is always possible for another group to imitate the TTPs of a different group to confuse attribution, there does not seem to be any indication of that here.


Instead, what we see in SLUB and Operation Earth Kitsune is the evolution of an advanced threat actor over time: one that builds on what worked in the past to become more efficient in the present.


Tags  Articles, News, Reports | APT & Targeted Attacks | Research


Cybercriminals and malicious hackers have been shifting their tactics, techniques, and procedures (TTPs) to improve their ability to infiltrate an organization and stay under the radar of security professionals and solutions.


Moving to more targeted attack methods appears to be a mainstay among threat actors, which requires organizations to improve their visibility into the entire attack lifecycle.


Gone are the days in which these attacks only target the endpoint, and as such, an expanded connected threat defense is paramount.


Many organizations have been adopting EDR (Endpoint Detection & Response) as a way to obtain more data about attacks on the endpoint.


But as we’ve seen with even ransomware actors, the endpoint is being targeted less.


Rather, attacks are laterally moving within an organization to find critical systems that will allow them to increase their chance of the organization paying the ransom.


(See my recent webinar on trends in ransomware.)


This means the actors behind many financially motivated and targeted attacks will move across the network, and their tracks will be left in other areas of their network, not just on the endpoint.


Expanding EDR to include other areas is the definition of XDR.


The X could be network data, email or web data, data from cloud instances, and others.


This would allow an organization to get visibility into the entire attack lifecycle, including infiltration, lateral movement, and exfiltration.


This will improve the organization’s ability to prevent critical data exfiltration or the compromise of critical systems within their network.


The ability to do this requires a number of key components:   A security vendor who has solutions across the entire network, including cloud, gateway (email & web), network, server, endpoint (includes mobile), and IoT/IIoT Support for threat intelligence and data analytics.


This should be as automated as possible and should include 3rd party threat intelligence (i.e. CERT, ISAC, ISAO feeds) History of expertise in correlating multiple threat vectors and the use of AI and Machine Learning


This will require a major shift from traditional security practices, as many organizations have supported a best-of-breed approach, utilizing multiple vendors (some say 50-100 security applications on average within a large enterprise).


Instead, the future is moving to a more consolidated approach with fewer vendors.


Having multiple vendors for different areas of security results in silos and segmentation due to a lack of integration across the security industry, but XDR could bring a shift in this practice as they include more support for 3rd party intelligence feeds.


Trend Micro has been innovating for 30 years and our breadth of security products allows us to successfully build an XDR solution.


Also, our almost 15 years of investing in and building AI/Machine Learning technologies into our backend and frontend products will allow us to have the data analytics piece covered.


Lastly, we have an extensive array of global threat intelligence that will allow us to ensure we can proactively detect and protect our customers.


Stay tuned for more information about this topic in upcoming blogs.


Tags  Cloud | Malware | APT & Targeted Attacks | Cyber Crime | Expert Perspective


On March 8, President Biden signed an Executive Order to ban the sale of Russian oil, liquefied natural gas and coal to the United States.


With bipartisan support, the decision was made to deprive the Putin regime of the economic resources needed to wage war in Ukraine.


However, marking as it does an escalation in punitive actions directed at the Russian state, it may also put US companies more directly in the firing line of cyber-attacks from the east.


Leaders of the U.S. intelligence community expressed this same concern in their annual appearance on capitol hill on Tuesday.


The Director of National Intelligence Avril Haines said “Nevertheless, our analysts assess that Putin is unlikely to be deterred by such setbacks and instead may escalate, essentially doubling down.”


The good news is that best practice cybersecurity advice does not need to change.


If the security and intelligence community continues to come together to share what information we have on offensive Russian cyber activity, and customers have the right detection and response tools in place, organizations can maintain a strong defensive posture.


Waiting for the tipping point


To date, the scale of Russian state-sponsored and proxy cyber-attacks has not been as expected.


Yes, we’ve seen continuous DDoS attacks, a campaign of web defacements and various iterations of wiper malware.


But these efforts have been mainly targeted at Ukrainian organizations.


Reports suggest tens of thousands of cybersecurity professionals there have enlisted as volunteers to help the country’s efforts.


Hacking collective Anonymous has also claimed responsibility for multiple hacktivist attacks in Russia.


However, following the Presidential EO this week, we could well see Russian APT groups or their proxies expand their targeting of U.S. critical infrastructure.


Oil and gas, banking and defense sectors are most likely to top of the list of targets.


What we can expect If this kind of escalation were to take place, it may begin through deployment of known destructive malware like IsaacWiper, HermeticWiper and WhisperKill onto already compromised targets or systems known to be vulnerable.


Follow-on phases would see the use of DDoS or other volumetric, availability-based attacks against systems that couldn’t be compromised in the first round of attacks.


Zero-day vulnerabilities held in reserve could be exploited during this phase.


Alongside the threat from Russian state hackers, Putin may call upon the “patriotic” reserves of the numerous cybercrime groups operating from within the country.


Already the Conti and Lockbit ransomware collectives have stated their support.


However, Conti was forced to equivocate its language after a Ukrainian researcher doxxed the group with a devastating leak of source code and other internal information.


Although they may not have a choice if called upon to support the Kremlin, this incident will certainly give many Russian ransomware actors a reason to think twice about joining the war effort.


Fighting back If the worst-case scenario does unfold and US organizations are attacked en masse, normal rules of best practice cybersecurity apply.


First comes continuous risk-based patching, multi-factor authentication, network monitoring, least privilege access, data encryption, phishing awareness training, and other cyber-hygiene steps.


But on top of that, organizations must have the detection and response tooling, ideally XDR, to correlate, prioritize and act on high fidelity alerts with speed and precision.


The security community, including government agencies, should quicken their pace in sharing actionable intelligence, in order to improve public and private organizations’ threat hunting and detection efforts.


Security operations (SecOPs) leaders may also want to:  Expand training and awareness for their users and partners; Collect telemetry from sources not traditionally aligned with cyber such as supply chain vendor management.


Increase attack surface enumeration across IoT, Industrial IoT, mobile and cloud; Expand or deploy a zero trust architecture framework and;  Fortify your backups


Tags  Expert Perspective | Web | Exploits & Vulnerabilities | Cyber Threats | APT & Targeted Attacks | Articles, News, Reports | Network


With additional analysis from Cyber Safety Solutions Team Developers constantly need to modify and rework their source codes when releasing new versions of applications or coding projects they create and maintain.


This is what makes GitHub—an online repository hosting service that provides version control management—popular.


In many ways, it’s like a social networking site for programmers and developers, one that provides a valuable platform for code management, sharing, collaboration, and integration.


GitHub is no stranger to misuse, however.


Open-source ransomware projects EDA2 and Hidden Tear—supposedly created for educational purposes—were hosted on GitHub, and have since spawned various offshoots that have been found targeting enterprises.


Tools that exploited vulnerabilities in Internet of Things (IoT) devices were also made available on GitHub.


Even the Limitless Keylogger, which was used in targeted attacks, was linked to a GitHub project.


Recently, the Winnti group, a threat actor with a past of traditional cybercrime -particularly with financial fraud, has been seen abusing GitHub by turning it into a conduit for the command and control (C&C) communications of their seemingly new backdoor (detected by Trend Micro as BKDR64_WINNTI.ONM).


Our research also showed that the group still uses some of the infamous PlugX malware variants—a staple in Winnti’s arsenal—to handle targeted attack operations via the GitHub account we identified.


Malware Analysis


The malware we analyzed is separated in two files: a loader, and the payload.


The loader, named loadperf.dll, is a modified version of its legitimate, similarly named counterpart—a Microsoft file which helps manipulate the performance registry.


An extra component has been added to its sections.


It copies itself on %WINDIR%\system32\wbem\ and replaces the original DLL.


It leverages the WMI performance adapter service (wmiAPSrv), a legitimate file in Windows that collects information related to system performance, to import the loader via services.exe.


The system also imports all related DLL files and includes the payload “loadoerf.ini”.


The infection chain includes an additional (albeit empty) function imported from loadoerf.ini, gzwrite64, which works as a fake Application Program Interface (API) that serves as the payload’s entry point.


Although gzwrite64 is imported by loadperf.dll, the payload’s main function is actually located in the DLLMain of “loadoerf.ini”.


Figure 1: Extra section .idata added to the original loadperf.dll  Figure 2: Extra imported function gzwrite64


The payload is a file named loadoerf.ini that contains decryption, run, and code injection functions.


When it is loaded by the system, DLLMain decrypts the payload via CryptUnprotectData.


Since the function highly depends on the actual “machine ID”, decryption on another machine that isn’t the original infected host is not viable, making malware analysis more difficult.


Figure 3: Part of the decryption function used in the payload


After decryption, partial code is run on the machine, which is then injected to svchost.exe (a key Windows component); payload is then loaded into memory.


Figure 4: Execution/infection flow of loadoerf.ini


How is GitHub abused?


Upon successful infection, the malware starts communicating with an HTML page from a repository stored in a GitHub project.


Figure 5: GitHub account hosting an HTML page used for C&C communication


Any malware threat analyst will immediately recognize Line 3 in the image above as a potential PlugX-encrypted line.


The beginning and end markers, DZKS and DZJS, are typical in PlugX. A closer look, however, shows that the decryption algorithm is different from PlugX.


In this case, decrypting them reveals references to its actual command and control (C&C) server: an IP address and a port number the malware will connect to.


Winnti currently uses different encryption algorithms to store those C&C references in the files they stored on Github.


Among them is an algorithm utilized by PlugX.


In fact, we found references to PlugX in the C&C strings we analyzed, indicating that the group may also be using the same backdoor in this particular campaign.


Although we were unable to find a PlugX sample through that particular GitHub, we surmise some PlugX variants in the wild use this GitHub repository to get their C&C information.


Nearly all the other algorithms used in this GitHub campaign are derived from the original PlugX algorithm:  PlugX style + shift string + Base64 PlugX style + shift string + Base64 + XOR PlugX style + Base64 + XOR  One algorithm is also built in mark strings + shift string + Base64 encoding.


Following Winnti's Trails The GitHub account used by the threat actor was created in May 2016.


It created one legitimate project/repository (mobile-phone-project) in June 2016, derived from another generic GitHub page.


The repository for Winnti’s C&C communications was created on August 2016.


We surmise that the GitHub account was not compromised, and instead created by Winnti.


By March 2017, the repository already contained 14 different HTML pages created at various times.


Timeline of the Campaign


We mapped Winnti’s activities for this campaign by analyzing the dates exposed in GitHub.


For each file, GitHub stores first-and-last commit timestamps; these enabled us to create a timeline of the first use of the group’s many C&C servers.


We monitored the period during which IP addresses were found connecting to Winnti’s C&C servers and found that they started their operations in the afternoon up to late evening.


The timetable resembles traditional working hours for cybercriminals, compared to those with less structure who prefer starting their days late, but also working until very late hours.


In fact, we only observed one instance of activity during the weekend, where a new HTML file was created.


The earliest activity we tracked on the GitHub account was from August 17, 2016, with the most recent in March 12, 2017.


Here is a timeline of when the C&C server’s IP addresses were first used, based on our monitoring: Figure 6: Timeline of the C&C server’s IP addresses C&C Servers


The GitHub account used by Winnti shows 12 different IP addresses, with various port numbers used for them.


All communication to these C&C servers are done on three different port numbers: 53 (DNS), 80 (HTTP), and 443 (HTTPS).


These are typical techniques PlugX and Winnti malware variants use to communicate between compromised machines and their C&C servers.


Nearly all the C&C servers are hosted in the U.S., while two are located in Japan.


C&C Server's IP Address Port Number 160[.]16[.]243[.]129 443 (HTTPS) 160[.]16[.]243[.]129 53 (DNS) 160[.]16[.]243[.]129 80 (HTTP) 174[.]139[.]203[.]18 443 (HTTPS) 174[.]139[.]203[.]18 53 (DNS) 174[.]139[.]203[.]20 53 (DNS) 174[.]139[.]203[.]22 443 (HTTPS) 174[.]139[.]203[.]22 53 (DNS) 174[.]139[.]203[.]27 53 (DNS) 174[.]139[.]203[.]34 53 (DNS) 174[.]139[.]62[.]58 80 (HTTP) 174[.]139[.]62[.]60 443 (HTTPS) 174[.]139[.]62[.]60 53 (DNS) 174[.]139[.]62[.]60 80 (HTTP) 174[.]139[.]62[.]61 443 (HTTPS) 61[.]195[.]98[.]245 443 (HTTPS) 61[.]195[.]98[.]245 53 (DNS) 61[.]195[.]98[.]245 80 (HTTP) 67[.]198[.]161[.]250 443 (HTTPS) 67[.]198[.]161[.]250 53 (DNS) 67[.]198[.]161[.]251 443 (HTTPS) 67[.]198[.]161[.]252 443 (HTTPS)   Figure 6: IP addresses used for C&C communication, and the port numbers they use


We have privately disclosed our findings to GitHub prior to this publication and are proactively working with them about this threat.


Conclusion


Abusing popular platforms like GitHub enables threat actors like Winnti to maintain network persistence between compromised computers and their servers, while staying under the radar.


Although Winnti may still be employing traditional malware, its use of a relatively unique tactic to stay ahead of the threat landscape’s curve reflects the increased sophistication that threat actors are projected to employ.


Related Hashes (SHA256) detected as BKDR64_WINNTI.ONM: 06b077e31a6f339c4f3b1f61ba9a6a6ba827afe52ed5bed6a6bf56bf18a279ba — cryptbase.dll 1e63a7186886deea6c4e5c2a329eab76a60be3a65bca1ba9ed6e71f9a46b7e9d – loadperf.dll 7c37ebb96c54d5d8ea232951ccf56cb1d029facdd6b730f80ca2ad566f6c5d9b – loadoerf.ini 9d04ef8708cf030b9688bf3e8287c1790023a76374e43bd332178e212420f9fb — wbemcomn.ini b1a0d0508ee932bbf91625330d2136f33344ed70cb25f7e64be0620d32c4b9e2 — cryptbase.ini e5273b72c853f12b77a11e9c08ae6432fabbb32238ac487af2fb959a6cc26089 — wbemcomn.dll        Tags  Malware | APT & Targeted Attacks | Endpoints | Research

Schau mal bitte drüber


We discovered a malware family called Maikspy — a multi-platform spyware that can steal users’ private data.


The spyware targets Windows and Android users, and first posed as an adult game named after a popular U.S.-based adult film actress.


Maikspy, which is an alias that combines the name of the adult film actress and spyware, has been around since 2016.


Our analysis of the latest Maikspy variants revealed that users contracted the spyware from hxxp://miakhalifagame[.]com/, a website that distributes malicious apps (including the 2016 adult game) and connects to its C&C server to upload data from infected devices and machines.


Multiple Twitter handles were found promoting the adult game called Virtual Girlfriend and sharing the malicious domain via short links.


Figure 1. Tweets that mention Virtual Girlfriend and the short link of hxxp://miakhalifagame[.]com/ Maikspy on the Android platform  Figure 2.


Infection chain of Maikspy Android variant


Based on the analysis of samples that were last seen in the wild in March 2018, the Maikspy variant (detected by Trend Micro as AndroidOS_MaikSpy.HRX) that runs on Android poses as Virtual Girlfriend to lure users into visiting the attackers’ malicious domain.


When users open the short link version of the domain shared on Twitter, a page that shows gender option buttons will appear followed by a page that will let users choose their “first girlfriend” and lead them to the download page.


Figure 3.


Virtual Girlfriend’s option buttons (first and second screen from the left) and download page (third screen)


When the downloaded APK file is installed and launched, it will send the infected device’s Unix timestamp to 0046769438867, a phone number containing Sweden’s code.


This is presumably used for the device’s ID registration:  Figure 4.


Code snippet of the device’s Unix timestamp being sent to 0046769438867 Subsequently, the Maikspy-carrying app will display "Error: 401. App not compatible.


Uninstalling


as an attempt to deceive the user into thinking that the app is already removed from the device.


However, the spyware just hides itself and runs in the background.


There, the malicious app first checks the required permissions and then proceeds with its routine:  Steal phone number Steal accounts Steal installed app list Steal contacts Steal SMS  The stolen information will be either written into .txt or .csv formats before being uploaded to the C&C server.


After fetching and uploading the abovementioned stolen data, the malicious app will check the command (CMD) from the C&C server every 60 seconds.


The following are the supported commands:  CMD Details startrecording Start recording the sound around the device stoprecording Stop recording uploaddata Upload /sdcard/DCIM,/sdcard/Downloads, /sdcard/Movies, /sdcard/Pictures, /sdcard/Documents files getnumber Get and upload phone number getclipboard Get and upload clipboard contents sms- Send SMS get- Get and upload dedicated files getcontacts Get and upload Contacts getinstalledapps


Get and upload installed APP list getmsgdata Get and upload received SMS getmsgdatasent Get and upload sent SMS getaccounts


Get and upload Accounts tree


Get and upload dedicated directory file list


In the first launch of Virtual Girlfriend, the malicious app will use a combination of the Unix timestamp, the device’s Bluetooth adapter name, and the name of user’s Twitter account as device identification name: Timestamp_BTAdapterName_TwitterAccount.


If the user doesn’t have the Twitter app, it will just be a null string (“”).


If the user has multiple Twitter accounts, the spyware will use the account where the user is logged in.


Figure 5.


Code snippet of the process where the Unix timestamp, the device’s Bluetooth adapter name, and the name of user’s Twitter account are combined to produce a device identification name


Additionally, the spyware will open hxxp://miakhalifagame[.]com/get_access2[.]php when first installed.


It will display the page below.


Figure 6.


The spyware displays the online dating scam website upon the installation of the malicious Virtual Girlfriend app What will be shown is the registration page of an online dating site, which will lure users into giving out their credit card information.


When users register, their credit cards will be charged.


This happens when the data is uploaded with the hidden iframe found in the bottom right part of the page (underlined in red).


As a result, the attackers behind the scheme will not only obtain the credit card information of the victim, but also steal any money charged to the credit card, so long as the user doesn’t request a chargeback.


Maikspy on the Windows platform  Figure 7.


Infection chain of Maikspy Windows variant  Figure 8.


These buttons greeted users who clicked the Twitter short link of hxxp://miakhalifagame[.]com/


In the case of the Windows variant (WORM_INFOKEY.A) of Maikspy last seen in April 2017, the user will be tricked into downloading a MiaKhalifa.rar file, which contains the files seen in the screenshot below:


Figure 9.


Content of the MiaKhalifa.rar file README.txt provides instructions teaching the user how to turn off the anti-virus software and how to turn on the network, which the attacker needs to steal and upload data to its C&C server.


Figure 10.


Content of README.txt register.bat is used to gain administrator privilege.


Figure 11.


Code snippet of register.bat Uninstall.exe is a copy of the open-source hacking tool Mimikatz (https://github[.]com/gentilkiwi/mimikatz).


It has the ability to extract plaintext passwords, hash, PIN code, and Kerberos tickets from memory.


Here, Uninstall.exe is used to get the Windows account and password, and then writes the result to C:\Users\%username%\AppData\local\password.txt.


Setup.exe is the core module used to steal data.


Like the Android Maikspy, it first sends a notification to its C&C server to register the device.


Figure 12.


Code snippet of notification being sent to the C&C server to register the device


After that, it fetches .jpg, .jpeg, .png, .txt, .wav, .html, .doc, .docx and .rtf files from the following directories: C:/Users/%username%/Desktop, C:/Users/%username%/Pictures, C:/Users/%username%/Documents, and C:/Users/%username%/Downloads.


File lists of the directories are also stolen.


Subsequently, it writes them into files before uploading it to the C&C server.


Figure 13.


Code snippets of the scanning, fetching, and uploading of .jpg, .jpeg, .png, .txt, .wav, .html, .doc, .docx and .rtf files (left).


It also steal information about the machine’s system i.e. default browser, OS version, Firefox version, Chrome version, IE version and Network configuration (right).


We also stumbled upon a Chrome extension plugin (VirtualGirlfriend.crx) that Windows users can contract upon visiting hxxp://miakhalifagame[.]com.


When the extension plugin (BREX_INFOSTEAL.A) is downloaded, the victims will be instructed how to load it into the browser.


After that, the malware will collect the username and password inputs from web pages and sends it to hxxps://miakhalifagame[.]com/testinn[.]php.


Figure 14.


Instructions given to the user on how to load the malicious Chrome extension  Figure 15.


Code snippet of the malicious extension plugin Connection between Round Year Fun and Maikspy


We looked into one of the Twitter accounts (seen in Figure 1) that promoted Virtual Girlfriend.


The name of the Twitter account is Round Year Fun (hxxps://twitter[.]com/RoundYear_Fun), and its homepage is full of tweets that promote games from hxxp://www[.]roundyearfun[.]org.


Figure 16.


Twitter homepage of Round Year Fun hxxp://www[.]roundyearfun[.]org is a portal that promotes games on Twitter.


As seen in the figure below, it also has other games aside from Virtual Girlfriend.


Upon checking the cached version of the page, we discovered that it was also used to distribute the adult game first used by the attackers behind Maikspy.


Figure 17.


Virtual Girlfriend in the list of games advertised by hxxp://www[.]roundyearfun[.]org  Figure 18.


The adult game first used by the attackers was also found in the list of games advertised by hxxp://www[.]roundyearfun[.]org Our analysis revealed that hxxp://www[.]roundyearfun[.]org was also used as a C&C address to save victims’ data.


The malware also shares the same certification with Virtual Girlfriend.


One of the samples was sourced from hxxp://roundyearfun[.]org/noavi/MiaKhalifa[.]apk.


Interestingly, we discovered an image that shows the logo of Round Year Fun, found at hxxp://miakhalifagame[.]com/img/ryf[.]jpg.


Figure 19. Round Year Fun logo found at Maikspy’s malicious domain


Based on these findings, it’s possible that the attackers behind Maikspy operate //www[.]roundyearfun[.]org/ and hxxp://miakhalifagame[.]com/.


Another thing that we discovered about the games offered by Round Year Fun is that if you authorize it to use your Twitter account, the author can use the account to promote games using automation tools.


The author used the other Twitter handle in Figure 1, rifusthegr8, to tweet about Virtual Girlfriend and retweet Round Year Fun’s own Twitter promotion of the game.


History of Maikspy from 2016 to 2018


The first variant of Maikspy appeared on the Windows platform in December 2016.


It disguised itself as the adult game named after an adult film actress.


It has the ability to update itself from hxxp://fakeomegle[.]com/, and steal .jpg, .jpeg, .png, .txt, .wav, .html, .doc, .docx and .rtf files located in the Desktop, Picture, Documents, and Downloads folders, as well as information about the machine’s Internet Explorer, Chrome, Firefox or default browsers, OS, and network configuration.


The spyware connects to 107[.]180[.]46[.]243.


Meanwhile, the first Android variant of this spyware family appeared in January 2017.


It was also under the guise of the previously mentioned adult game and still connects to the aforementioned C&C server.


It was capable of recording phone calls and stealing information such as the device’s location, SMS, contacts, WhatsApp database, and record sound around the affected device.


The next variant appeared quickly, and it added the following abilities to its routines: Steal information about the device’s clipboard, phone number, installed app list, and accounts.


Meanwhile, the ability to steal the WhatsApp database was removed.


It also changed its command format.


In March 2017, another new variant appeared with the ability to steal photos when users take them using the camera.


The code structure and package name also changed, as well as its C&C address: 198[.]12[.]155[.]84.


It was in April 2017 when the last Windows variant of Maikspy appeared with the following changes: The C&C server was changed to 198[.]12[.]155[.]84, password theft is added, as well as the theft of .doc, .docx, and .rtf files.


Between June and December 2017, the Android variant had the following alterations: C&C server was changed to 192[.]169[.]217[.]55, the ability to record phone calls was removed, and the C&C server was again changed to 198[.]12[.]149[.]13.


In January 2018, the Android variant’s app label changed to Virtual Girlfriend.


Two months later, the C&C server was changed to hxxp://miakhalifagame[.]com.


The attackers were found using the HTTP protocol to transfer data.


The ability to steal location and pictures was removed from its routine.


Relationship between variants and C&C servers used by Maikspy