Administrative Office of the President, Afghanistan  imail.aop.gov.af  Redirect to web page “Observation Of Technology Use in Afghanistan Government Sector”  2020 Jan  mail-nscaf.myftp[.]org  Afghanistan National Security Council  mail.nsc.gov.af  Redirect to https://wikipedia.org/USB_Killer  2020 Jan  mail-nepalarmymilnp.duckdns[.]org  Nepali Army  mail.nepalarmy.mil.np  Redirect to PDF “EN Digital Nepal Framework V8.4 15 July 2019.pdf”  2020 Jan  mail-mofagovnp.hopto[.]org  Ministry of Foreign Affairs, Nepal  mail.mofa.gov.np  Redirect to PDF “national-security-vol-3-issue-1-essay-SSimkhada.pdf”  2020 Jan  webmail.mohe.gov-af[.]org  Ministry of Higher Education, Afghanistan  webmail.mohe.gov.af  Redirect to original mail server  2020 Feb     Ministry of Defense, Sri Lanka  mail.defence.lk  Login Error  2020 Feb  mail.moha.gov-np[.]org  Ministry of Home Affairs, Nepal  mail.moha.gov.np  Redirect to original mail server  2020 Feb  mail.nsc.gov-af[.]org  Afghanistan National Security Council  mail.nsc.gov.af  Redirect to original mail server  2020 Feb  mail.arg.gov-af[.]org  Presidential Palace, Afghanistan  mail.arg.gov.af  Redirect to original mail server  2020 Feb  mail.arg.gov-af[.]org  Presidential Palace, Afghanistan  mail.arg.gov.af  Redirect to original mail server  2020 Feb     Center for Education and Human Resource Development, Nepal  mail.doe.gov.np  Redirect to file “Para Basic Course Joining Instruction.docx”  2020 Mar  mail-nepalgovnp.duckdns[.]org  Government of Nepal  mail.nepal.gov.np  Redirect to original mail server  2020 Mar     Nepal Electricity Authority  mail.nea.org.np  Redirect to original mail server  2020 Mar  mail-nepalgovnp.duckdns[.]org  Government of Nepal  mail.nepal.gov.np  Redirect to file “central data form.pdf”  2020 Mar  mail-nepalarmymilnp.duckdns[.]org  Nepali Army  mail.nepalarmy.mil.np  Redirect to file “Corona Virus Preparedness and Response.pdf”  2020 Mar  mail-nepalpolicegov.hopto[.]org  Nepal Police  mail.nepalpolice.gov.np  Redirect to file “1987 Conducting training on COVID-19 and keeping it in readiness.pdf”  2020 Apr  mail-nrborg.hopto[.]org  Nepal Rastra Bank  mail.nrb.gov.np  Redirect to file ”fiu.pdf”  2020 May  mail-nepalarmymilnp.duckdns[.]org  Nepali Army  mail.nepalarmy.mil.np  Redirect to web news “India Should Realise China Has Nothing to Do With Nepal’s Stand on Lipulekh”  2020 Jun  mail-nepalarmymilnp.duckdns[.]org  Nepali Army  mail.nepalarmy.mil.np  Showing login failed message  2020 Jul     Qatar Charity  mail.qcharity.org  Redirect to original mail server  2020 Jul     Myanma Posts and Telecommunications  webmail.mpt.net.mm  Redirect to original mail server  2020 Aug  mail-ncporgnp.hopto[.]org  Nepal Communist Party  mail.ncp.org.np  Redirect to file “India reaction after new pak map.pdf”  2020 Aug  mail-nscaf.myftp[.]org  Afghanistan National Security Council  mail.nsc.gov.af  Redirect to 10[.]77[.]17[.]10/Software/03-Applications  2020 Sep  mail-mofgovnp.hopto[.]org                               Ministry of Finance, Nepal  mail.mof.gov.np  Redirect to file “1987 Covid.pdf”  2020 Sep  mail-ncporgnp.hopto[.]org  Nepal Communist Party  mail.ncp.org.np  Redirect to document “The spectre of a new Maoist conflict in Nepal”  2020 Sep  imail.aop.gov-af[.]org  Administrative Office of the President, Afghanistan  imail.aop.gov.af  Redirect to file “SOP of Military Uniform .pdf”  2020 Oct  mail-nepalpolicegovnp.duckdns[.]org  Nepal Police  mail.nepalpolice.gov.np  Redirect to file “2077-07-03 1239 Regarding investigation and action.pdf”  2020 Oct     Civil Aviation Authority of Nepal  mail.caanepal.gov.np  Redirect to original mail server  2020 Oct  mail-apfgovnp.ddns[.]net mail-apfgavnp.hopto[.]org  Armed Police Force, Nepal  mail.apf.gov.np  Redirect to original mail server  2020 Oct  mail-nscaf.myftp[.]org  Afghanistan National Security Council  mail.nsc.gov.af  Redirect to file “IT Services Request Form.pdf”  2020 Nov  mail-ntcnetnp.serveftp[.]com  Nepal Telecom  webmail.ntc.net.np  Redirect to original mail server  2020 Nov  mail-kmgcom.ddns[.]net  Kantipur Media Group  mail.kmg.com.np  Redirect to original mail server  2020 Nov     Federal Parliament of Nepal  mail.parliament.gov.np  Redirect to original mail server  2020 Nov     Public Procurement Monitoring Office, Nepal  mail.ppmo.gov.np  Redirect to original mail server  2020 Nov  mail-mfagovcn.hopto[.]org  Ministry of Foreign Affairs, China  mail.mfa.gov.cn  Redirect to file “Ambassador Yanchi Conversation with Nepali_Media.pdf”          Figure 8.


SideWinder’s phishing page disguised as a Nepalese Army OWA (Outlook Web Access) Page      Figure 9.


The lure document redirected from the phishing page that discusses Indian and Pakistani political map issues      Figure 10


We also identified multiple Android APK files on their server.


Figure 11.


Non-malicious applications “My First APP” and “Opinion Poll”     Another two applications were built from JavaPayload for Metasploit that will load extra code from the remote server configured in the sample.


These two samples appear to be debug versions as they have no activities or any other component except Metasploit.


Figure 13. Build from Metasploit and Request Permissions     We also identified a malicious version of the My First APP application that added Metasploit whose class names have been obfuscated.


Figure 14.


Malicious version of My First APP, which adds Metasploit     SideWinder has used malicious apps as part of its operation before.


Conclusion


As seen with their phishing attacks and their mobile device tools’ continuous development, SideWinder is very proactive in using trending topics like Covid-19 or various political issues as a social engineering technique to compromise their targets.


Indicator of Compromise Android Part IoCs  Indicator  Package name  Label  C2 server  Detection  0c182b51ff1dffaa384651e478155632c6e65820322774e416be20e6d49bb8f9  com.example.firstandoidapp


My First App  -     061b0379a12b88488db8540226e400e3f65fef9a4c1aa7744da9f17e1d93d78d  com.example.opinionpoll  OpinionPoll  -     fb6ac9d93fd47db3d32f6da6320344a125e96754a94babb9d9d12b6604a42536  com.metasploit.stage  MainActivity  https://185.225.19[.]46:4589  AndroidOS_Metasploit.HRX  468b74883536938ef3962655dfcc3ca4097ca9b5b687dfc1fef58d50e96dc248  com.metasploit.stage  MainActivity  tcp://185.225.19.46[:]4875   AndroidOS_Metasploit.HRX  a377e5f4bf461b86f938959256b7ab8b1b40bb9fd3cd45951c736a22366a8dd1  com.example.firstandoidapp  My First App  tcp://185.225.19.46[:]4875  AndroidOS_Metasploit.


HRX


Malicious documents and related payloads IoCs  Indicator  Description  Detection  TrendX  1CBEC920AFE2F978B8F84E0A4E6B757D400AEB96E8C0A221130060B196ECE010  docx  Trojan.W97M.CVE20170199.FAIL     7238F4E5EDBE0E5A2242D8780FB58C47E7D32BF2C4F860C88C511C30675D0857  RTF file  Trojan.W97M.SIDEWINDER.A     75C158CEA14E338C8D9D32ED988C7032DA9AE6D54F5B1126ED6A83F71B9E03BF  1.a JS file  Trojan.JS.SIDEWINDER.A  Downloader.JS.TRX.XXJSE9EFF018  AB6E8563214EEB747ABF77F9CC50796CC6A0C0562C6BEC720D7F2C978D34C412


Fake DUser.dll  Trojan.MSIL.SIDEWINDER.A     CBD5C68F5C4345B68F018D9E5810574E8036A2BC4D826BE5C8779E8019449957  Final payload  Trojan.Win32.SIDEWINDER.B     34446F7F60F730FCCA145155D10D1AFF0A1153B085836DF38313772CD03C8D70  RTF file  Trojan.W97M.CVE201711882.YQUOOWV     7238F4E5EDBE0E5A2242D8780FB58C47E7D32BF2C4F860C88C511C30675D0857  RTF file


Trojan.W97M.SIDEWINDER.A     AB7C1967BF1FEFDFFDE93626B78EB30994655AB02F59E0ADB0935E3E599A953F  RTF file  Trojan.W97M.SIDEWINDER.A     2548A819E4C597BA5958D2D18BAA544452948E5B00271570192CCD79ABE88E8D  1.a JS file  Trojan.JS.SIDEWINDER.A  Downloader.


1.a JS file  Trojan.JS.SIDEWINDER.A  Downloader.


1.a JS file  Trojan


.JS.SIDEWINDER.A


Downloader.JS.TRX.XXJSE9EFF018  940265867D5668956D64ADF9FC4B9C6CF9E7FCFCF5C21BA7BF0BEA77B5EDD047  Fake DUser.dll  Trojan.MSIL.SIDEWINDER.A     B22946CFEFE8646CB034F358C68CAAE5F30C1CF316CFFEAF77021C099E362C64  Fake DUser.dll  Trojan.MSIL.SIDEWINDER.A     89E392FA49C6A6AEB9056E3D2F38B07D0DD7AF230CD22E3B01C71F05A3AECA0B  Fake DUser.dll  Trojan.MSIL.SIDEWINDER.A     EB2D82DD0799196FCF631E15305676D737DC6E40FF588DCF123EDACD023F1C46  Final payload  Trojan.Win32.SIDEWINDER.B     7ECAEFCB46CDDEF1AE201B1042A62DD093594C179A6913A2DE47AB98148545DD  Final payload  Trojan.Win32.SIDEWINDER.B     799260B992C77E2E14F2D586665C570142D8425864455CAB5F2575015CD0B87A  Final payload  Trojan.Win32.SIDEWINDER.B      brep.cdn-edu[.]net  RTF delivery server     www.mfa.filesrvr[.]net  RTF delivery server     www.google.gov-pok[.]net  RTF delivery server     ap


-ms[.]net  C&C     cdn-sop[.]net  C&C     fqn-cloud[.]net  C&C     ms-trace[.]net  C&C     imail.aop.gov-af[.]org  Phishing Domain     mail-apfgavnp.hopto[.]org  Phishing Domain     mail-apfgovnp.ddns[.]net  Phishing Domain     mail-kmgcom.ddns[.]net  Phishing Domain     mail-mfagovcn.hopto[.]org  Phishing Domain     mail


-mofagovnp.hopto[.]org  Phishing Domain     mail-ncporgnp.hopto[.]org  Phishing Domain     mail-nepalarmymilnp.duckdns[.]org  Phishing Domain     mail-nepalgovnp.duckdns[.]org  Phishing Domain     mail-nepalpolicegov.hopto[.]org  Phishing Domain     mail-nepalpolicegovnp.duckdns[.]org  Phishing Domain     mail-nrborg.hopto[.]org  Phishing Domain     mail-nscaf.myftp[.]org  Phishing Domain     mail-ntcnetnp.serveftp[.]com  Phishing Domain     mail.arg.gov-af[.]org  Phishing Domain     mail.moha.gov-np[.]org  Phishing Domain     mail.nsc.gov-af[.]org  Phishing Domain     webmail.mohe.gov-af[.]org  Phishing Domain          Tags


Since late 2019, our team has disrupted financially motivated phishing campaigns targeting YouTubers with Cookie Theft malware.


The actors behind this campaign, which we attribute to a group of hackers recruited in a Russian-speaking forum, lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams.


In collaboration with YouTube, Gmail, Trust & Safety, CyberCrime Investigation Group and Safe Browsing teams, our protections have decreased the volume of related phishing emails on Gmail by 99.6% since May 2021.


We blocked 1.6M messages to targets, displayed ~62K Safe Browsing phishing page warnings, blocked 2.4K files, and successfully restored ~4K accounts.


Moreover, to protect our users, we have referred the below activity to the FBI for further investigation.


Cookie Theft, also known as “pass-the-cookie attack,” is a session hijacking technique that enables access to user accounts with session cookies stored in the browser.


The phishing typically started with a customized email introducing the company and its products.


Once the target agreed to the deal, a malware landing page disguised as a software download URL was sent via email or a PDF on Google Drive, and in a few cases, Google documents containing the phishing links.


During the pandemic, we also uncovered attackers posing as news providers with a “Covid19 news software.”


Because Google actively detects and disrupts phishing links sent via Gmail, the actors were observed driving targets to messaging apps like WhatsApp, Telegram or Discord.


Some commodity malware used included RedLine, Vidar, Predator The Thief, Nexus stealer, Azorult, Raccoon, Grand Stealer, Vikro Stealer, Masad (Google’s naming), and Kantal (Google’s naming) which shares code similarity with Vidar.


Open source malware like Sorano and AdamantiumThief were also observed.


A few were observed displaying a fake error message requiring user click-through to continue execution.


On account-trading markets, hijacked channels ranged from $3 USD to $4,000 USD depending on the number of subscribers.


Our recommendations: Additional resources: Avoid & Report Phishing Emails.


Related Malware hashes: Top Phishing Domains:


We have a long-standing policy to send you a warning if we detect that your account is a target of government-backed phishing or malware attempts.


On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


In this blog, we explore some of the most notable campaigns we’ve disrupted this year from a different government-backed attacker: APT35, an Iranian group, which regularly conducts phishing campaigns targeting high risk users.


In early 2021, APT35 compromised a website affiliated with a UK university to host a phishing kit.


Users were instructed to activate an invitation to a (fake) webinar by logging in.


The phishing kit will also ask for second-factor authentication codes sent to devices.


APT35 has relied on this technique since 2017 — targeting high-value accounts in government, academia, journalism, NGOs, foreign policy, and national security.


Credential phishing through a compromised website demonstrates these attackers will go to great lengths to appear legitimate – as they know it's difficult for users to detect this kind of attack.


In May 2020, we discovered that APT35 attempted to upload spyware to the Google Play Store.


Although Play Store users were protected, we are highlighting the app here as TAG has seen APT35 attempt to distribute this spyware on other platforms as recently as July 2021.


One of the most notable characteristics of APT35 is their impersonation of conference officials to conduct phishing attacks.


When they did, attackers sent them phishing links in follow-on correspondence.


Targets typically had to navigate through at least one redirect before landing on a phishing domain.


One of APT35’s novel techniques involves using Telegram for operator notifications.


The attackers embed javascript into phishing pages that notify them when the page has been loaded.


The attackers use this function to relay device-based data to the channel, so they can see details such as the IP, useragent, and locales of visitors to their phishing sites in real-time.


We warn users when we suspect a government-backed threat like APT35 is targeting them.


When a site identified by Safe Browsing as harmful appears in Google Search results, we show a warning next to it in the results.


Indicators from APT28 phishing campaign: service-reset-password-moderate-digital.rf[.]gd reset-service-identity-mail.42web[.]io digital-email-software.great-site[.]net  Indicators from APT35 campaigns:  Abused Google Properties: https://sites.google[.]com/view/ty85yt8tg8-download-rtih4ithr/ https://sites.google[.]com/view/user-id-568245/ https://sites.google[.]com/view/hhbejfdwdhwuhscbsb-xscvhdvbc/  Abused Dropbox Properties: https://www.dropbox[.]com/s/68y4vpfu8pc3imf/Iraq&Jewish.pdf


Phishing Domains: nco2[.]live summit-files[.]com filetransfer[.]club continuetogo[.]me accessverification[.]online customers-verification-identifier[.]site service-activity-session[.]online identifier-service-review[.]site recovery-activity-identification[.]site review-session-confirmation[.]site recovery-service-activity[.]site verify-service-activity[.]site service-manager-notifications[.]info


Android App: https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection  Android App C2: communication-shield[.]site cdsa[.]xyz


Understanding the techniques used by attackers helps us counter these threats effectively.


We believe this is a technique the attacker is using to evade detection rules.


Code signatures on Windows executables provide guarantees about the integrity of a signed executable, as well as information about the identity of the signer.


Since mid-August, OpenSUpdater samples have carried an invalid signature, and further investigation showed this was a deliberate attempt to evade detection.


Bytes: 30 0D 06 09 2A 86 48 86  F7 0D 01 01 0B 00 00


As shown in the following screenshot, the signature is considered to be valid by the Windows operating system.


Since first discovering this activity, OpenSUpdater's authors have tried other variations on invalid encodings to further evade detection.


The following are samples using this evasion: https://www.virustotal.com/gui/file/5094028a0afb4d4a3d8fa82b613c0e59d31450d6c75ed96ded02be1e9db8104f/detection


New variant: https://www.virustotal.com/gui/file/5c0ff7b23457078c9d0cbe186f1d05bfd573eb555baa1bf4a45e1b79c8c575db/detection


The four exploits were used as a part of three different campaigns.


The links led to attacker-controlled domains that mimicked legitimate websites related to the targeted users.


The information collected from the fingerprinting phase included screen resolution, timezone, languages, browser plugins, and available MIME types.


In our environment, we did not receive any payloads past this stage.


Related IOCs lragir[.]org armradio[.]org asbares[.]com armtimes[.]net armlur[.]org armenpress[.]org hraparak[.]org armtimes[.]org hetq[.]org


After a fingerprinting phase, similar to the one used with the Chrome exploit above, users were served an Internet Explorer 0-day.


We did not recover additional payloads in our environment.


During our investigation we discovered several documents uploaded to VirusTotal.


Related IOCs


Examples of related Office documents uploaded to VirusTotal: https://www.virustotal.com/gui/file/656d19186795280a068fcb97e7ef821b55ad3d620771d42ed98d22ee3c635e67/detection https://www.virustotal.com/gui/file/851bf4ab807fc9b29c9f6468c8c89a82b8f94e40474c6669f105bce91f278fdb/detection


Unique URLs serving CVE-2021-33742 Internet Explorer exploit: http://lioiamcount[.]com/IsnoMLgankYg6/EjlYIy7cdFZFeyFqE4IURS1 http://db-control-uplink[.]com/eFe1J00hISDe9Zw/gzHvIOlHpIXB http://kidone[.]xyz/VvE0yYArmvhyTl/GzV


Word documents with the following classid: {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} Related infrastructure: workaj[.]com wordzmncount[.]com Not all attacks require chaining multiple 0-day exploits to be successful.


(NOTE: This exploit is not connected to the other three we’ve discussed above.)


The victim would need to have a session open on these websites from Safari for cookies to be successfully exfiltrated.


There was no sandbox escape or implant delivered via this exploit.


The exploit targeted iOS versions 12.4 through 13.7.


Related IOCs supportcdn.web[.]app vegmobile[.]com 111.90.146[.]198


Increased Utilization


In the mid-to-late 2010s, more private companies have joined the marketplace selling these 0-day capabilities.


No longer do groups need to have the technical expertise, now they just need resources.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2021.


It was last updated on July 29, 2021.


JuneWe terminated 33 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


We terminated 15 YouTube channels as part of our investigation into coordinated influence operations linked to Ethiopia.


We received leads from Graphika that supported us in this investigation.


We terminated 123 YouTube channels as part of our investigation into coordinated influence operations linked to Russia.


We terminated 9 YouTube channels as part of our investigation into coordinated influence operations linked to China.


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Moldova.


We terminated 33 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2021.


It was last updated on April 20, 2021.


We terminated 5 blogs as part of our investigation into coordinated influence operations linked to Morocco.


We terminated 5 YouTube channels as part of our investigation into coordinated influence operations linked to Brazil.


We terminated 6 YouTube channels as part of our investigation into coordinated influence operations linked to Kyrgyzstan.


We terminated 3 advertising accounts as part of our investigation into coordinated influence operations linked to Egypt.


We terminated 1 YouTube channel as part of our ongoing investigation into coordinated influence operations linked to Russia.


We terminated 5 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


We terminated 2 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


We received leads from FireEye that supported us in this investigation.


Since late 2019, our team has disrupted financially motivated phishing campaigns targeting YouTubers with Cookie Theft malware.


The actors behind this campaign, which we attribute to a group of hackers recruited in a Russian-speaking forum, lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams.


In collaboration with YouTube, Gmail, Trust & Safety, CyberCrime Investigation Group and Safe Browsing teams, our protections have decreased the volume of related phishing emails on Gmail by 99.6% since May 2021.


We blocked 1.6M messages to targets, displayed ~62K Safe Browsing phishing page warnings, blocked 2.4K files, and successfully restored ~4K accounts.


Moreover, to protect our users, we have referred the below activity to the FBI for further investigation.


Cookie Theft, also known as “pass-the-cookie attack,” is a session hijacking technique that enables access to user accounts with session cookies stored in the browser.


The phishing typically started with a customized email introducing the company and its products.


Once the target agreed to the deal, a malware landing page disguised as a software download URL was sent via email or a PDF on Google Drive, and in a few cases, Google documents containing the phishing links.


During the pandemic, we also uncovered attackers posing as news providers with a “Covid19 news software.”


Because Google actively detects and disrupts phishing links sent via Gmail, the actors were observed driving targets to messaging apps like WhatsApp, Telegram or Discord.


Some commodity malware used included RedLine, Vidar, Predator The Thief, Nexus stealer, Azorult, Raccoon, Grand Stealer, Vikro Stealer, Masad (Google’s naming), and Kantal (Google’s naming) which shares code similarity with Vidar.


Open source malware like Sorano and AdamantiumThief were also observed.


A few were observed displaying a fake error message requiring user click-through to continue execution.


On account-trading markets, hijacked channels ranged from $3 USD to $4,000 USD depending on the number of subscribers.


Our recommendations: Additional resources: Avoid & Report Phishing Emails.


Related Malware hashes: Top Phishing Domains:


We have a long-standing policy to send you a warning if we detect that your account is a target of government-backed phishing or malware attempts.


On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


In this blog, we explore some of the most notable campaigns we’ve disrupted this year from a different government-backed attacker: APT35, an Iranian group, which regularly conducts phishing campaigns targeting high risk users.


In early 2021, APT35 compromised a website affiliated with a UK university to host a phishing kit.


Users were instructed to activate an invitation to a (fake) webinar by logging in.


The phishing kit will also ask for second-factor authentication codes sent to devices.


APT35 has relied on this technique since 2017 — targeting high-value accounts in government, academia, journalism, NGOs, foreign policy, and national security.


Credential phishing through a compromised website demonstrates these attackers will go to great lengths to appear legitimate – as they know it's difficult for users to detect this kind of attack.


In May 2020, we discovered that APT35 attempted to upload spyware to the Google Play Store.


Although Play Store users were protected, we are highlighting the app here as TAG has seen APT35 attempt to distribute this spyware on other platforms as recently as July 2021.


One of the most notable characteristics of APT35 is their impersonation of conference officials to conduct phishing attacks.


When they did, attackers sent them phishing links in follow-on correspondence.


Targets typically had to navigate through at least one redirect before landing on a phishing domain.


One of APT35’s novel techniques involves using Telegram for operator notifications.


The attackers embed javascript into phishing pages that notify them when the page has been loaded.


The attackers use this function to relay device-based data to the channel, so they can see details such as the IP, useragent, and locales of visitors to their phishing sites in real-time.


We warn users when we suspect a government-backed threat like APT35 is targeting them.


When a site identified by Safe Browsing as harmful appears in Google Search results, we show a warning next to it in the results.


Indicators from APT28 phishing campaign: service-reset-password-moderate-digital.rf[.]gd reset-service-identity-mail.42web[.]io digital-email-software.great-site[.]net  Indicators from APT35 campaigns:  Abused Google Properties: https://sites.google[.]com/view/ty85yt8tg8-download-rtih4ithr/ https://sites.google[.]com/view/user-id-568245/ https://sites.google[.]com/view/hhbejfdwdhwuhscbsb-xscvhdvbc/  Abused Dropbox Properties: https://www.dropbox[.]com/s/68y4vpfu8pc3imf/Iraq&Jewish.pdf


Phishing Domains: nco2[.]live summit-files[.]com filetransfer[.]club continuetogo[.]me accessverification[.]online customers-verification-identifier[.]site service-activity-session[.]online identifier-service-review[.]site recovery-activity-identification[.]site review-session-confirmation[.]site recovery-service-activity[.]site verify-service-activity[.]site service-manager-notifications[.]info


Android App: https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection  Android App C2: communication-shield[.]site cdsa[.]xyz


Understanding the techniques used by attackers helps us counter these threats effectively.


We believe this is a technique the attacker is using to evade detection rules.


Code signatures on Windows executables provide guarantees about the integrity of a signed executable, as well as information about the identity of the signer.


Since mid-August, OpenSUpdater samples have carried an invalid signature, and further investigation showed this was a deliberate attempt to evade detection.


Bytes: 30 0D 06 09 2A 86 48 86  F7 0D 01 01 0B 00 00


As shown in the following screenshot, the signature is considered to be valid by the Windows operating system.


Since first discovering this activity, OpenSUpdater's authors have tried other variations on invalid encodings to further evade detection.


The following are samples using this evasion: https://www.virustotal.com/gui/file/5094028a0afb4d4a3d8fa82b613c0e59d31450d6c75ed96ded02be1e9db8104f/detection


New variant: https://www.virustotal.com/gui/file/5c0ff7b23457078c9d0cbe186f1d05bfd573eb555baa1bf4a45e1b79c8c575db/detection


The four exploits were used as a part of three different campaigns.


The links led to attacker-controlled domains that mimicked legitimate websites related to the targeted users.


The information collected from the fingerprinting phase included screen resolution, timezone, languages, browser plugins, and available MIME types.


In our environment, we did not receive any payloads past this stage.


Related IOCs lragir[.]org armradio[.]org asbares[.]com armtimes[.]net armlur[.]org armenpress[.]org hraparak[.]org armtimes[.]org hetq[.]org


After a fingerprinting phase, similar to the one used with the Chrome exploit above, users were served an Internet Explorer 0-day.


We did not recover additional payloads in our environment.


During our investigation we discovered several documents uploaded to VirusTotal.


Related IOCs


Examples of related Office documents uploaded to VirusTotal: https://www.virustotal.com/gui/file/656d19186795280a068fcb97e7ef821b55ad3d620771d42ed98d22ee3c635e67/detection https://www.virustotal.com/gui/file/851bf4ab807fc9b29c9f6468c8c89a82b8f94e40474c6669f105bce91f278fdb/detection


Unique URLs serving CVE-2021-33742 Internet Explorer exploit: http://lioiamcount[.]com/IsnoMLgankYg6/EjlYIy7cdFZFeyFqE4IURS1 http://db-control-uplink[.]com/eFe1J00hISDe9Zw/gzHvIOlHpIXB http://kidone[.]xyz/VvE0yYArmvhyTl/GzV


Word documents with the following classid: {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} Related infrastructure: workaj[.]com wordzmncount[.]com Not all attacks require chaining multiple 0-day exploits to be successful.


(NOTE: This exploit is not connected to the other three we’ve discussed above.)


The victim would need to have a session open on these websites from Safari for cookies to be successfully exfiltrated.


There was no sandbox escape or implant delivered via this exploit.


The exploit targeted iOS versions 12.4 through 13.7.


Related IOCs supportcdn.web[.]app vegmobile[.]com 111.90.146[.]198


Increased Utilization


In the mid-to-late 2010s, more private companies have joined the marketplace selling these 0-day capabilities.


No longer do groups need to have the technical expertise, now they just need resources.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2021.


It was last updated on July 29, 2021.


JuneWe terminated 33 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


We terminated 15 YouTube channels as part of our investigation into coordinated influence operations linked to Ethiopia.


We received leads from Graphika that supported us in this investigation.


We terminated 123 YouTube channels as part of our investigation into coordinated influence operations linked to Russia.


We terminated 9 YouTube channels as part of our investigation into coordinated influence operations linked to China.


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Moldova.


We terminated 33 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


We encourage anyone who discovers a Chrome vulnerability to report that activity through the Chrome Vulnerabilities Rewards Program submission process.


Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers.


In the video, they purported to show a successful working exploit that spawns a cmd.exe shell, but a careful review of the video shows the exploit is fake.


Within the Visual Studio Project would be source code for exploiting the vulnerability, as well as an additional DLL that would be executed through Visual Studio Build Events.


The DLL is custom malware that would immediately begin communicating with actor-controlled C2 domains.


In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog.


We encourage anyone who discovers a Chrome vulnerability to report that activity via the Chrome VRP submission process.


If you have communicated with any of these accounts or visited the actors’ blog, we suggest you review your systems for the IOCs provided below.


Host IOCs Registry Keys HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update File Paths C:\Windows\System32\Nwsapagent.sys C:\Windows\System32\helpsvc.sys C:\ProgramData\USOShared\uso.bin C:\ProgramData\VMware\vmnat-update.bin C:\ProgramData\VirtualBox\update.bin


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2020.


It was last updated on January 26, 2021.


We terminated 12 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


We received leads from Facebook that supported us in this investigation.


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Myanmar.


We terminated 35 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


We received leads from the FBI that supported us in this investigation.


We terminated 2 YouTube channels as part of our ongoing investigation into a coordinated influence operation linked to Iran.


We terminated 10 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


We terminated 22 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Indonesia.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


We terminated 9 YouTube channels as part of our investigation into a coordinated influence operation linked to Egypt.


We terminated 6 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


We terminated 1 YouTube channel as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


We terminated 1 blog as part of our investigation into coordinated influence operations linked to Argentina.


We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to France.


We terminated 34 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


We terminated 3,317 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


In June, we announced that we saw phishing attempts against the personal email accounts of staffers on the Biden and Trump campaigns by Chinese and Iranian APTs (Advanced Persistent Threats) respectively.


We haven’t seen any evidence of such attempts being successful.


The Iranian attacker group (APT35) and the Chinese attacker group (APT31) targeted campaign staffers’ personal emails with credential phishing emails and emails containing tracking links.


As part of our wider tracking of APT31 activity, we've also seen them deploy targeted malware campaigns.


Every malicious piece of this attack was hosted on legitimate services, making it harder for defenders to rely on network signals for detection.


In one example, attackers impersonated McAfee.


The targets would be prompted to install a legitimate version of McAfee anti-virus software from GitHub, while malware was simultaneously silently installed to the system.


This targeting is consistent with what others have subsequently reported.


Shortly after the U.S. Treasury sanctioned Ukrainian Parliament member Andrii Derkach for attempting to influence the U.S. electoral process, we removed 14 Google accounts that were linked to him.


As the course of the COVID-19 pandemic evolves, we’ve seen threat actors evolve their tactics as well.


In previous posts, we discussed targeting of health organizations as well as attacker efforts to impersonate the World Health Organization.


In the threat actor toolkit, different types of attacks are used for different purposes: Phishing campaigns can be used like a scalpel—targeting specific groups or individuals with personalized lures that are more likely to trick them into taking action (like clicking on a malware link), while DDoS attacks are more like a hatchet—disrupting or blocking a site or a service entirely.


While it’s less common to see DDoS attacks rather than phishing or hacking campaigns coming from government-backed threat groups, we’ve seen bigger players increase their capabilities in launching large-scale attacks in recent years.


For example in 2017, our Security Reliability Engineering team measured a record-breaking UDP amplification attack sourced out of several Chinese ISPs (ASNs 4134, 4837, 58453, and 9394), which remains the largest bandwidth attack of which we are aware.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2020.


It was last updated on October 16, 2020.


We terminated 299 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


We terminated 8 YouTube channels as part of our actions against a coordinated influence operation linked to Yemen.


We terminated 4 YouTube channels as part of our actions against a coordinated influence operation.


We terminated 1,628 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


Like previous websites we’ve seen set up by this actor, this website has a link to their PGP public key at the bottom of the page.


We encourage anyone who discovers a Chrome vulnerability to report that activity through the Chrome Vulnerabilities Rewards Program submission process.


Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers.


In the video, they purported to show a successful working exploit that spawns a cmd.exe shell, but a careful review of the video shows the exploit is fake.


Within the Visual Studio Project would be source code for exploiting the vulnerability, as well as an additional DLL that would be executed through Visual Studio Build Events.


The DLL is custom malware that would immediately begin communicating with actor-controlled C2 domains.


In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog.


We encourage anyone who discovers a Chrome vulnerability to report that activity via the Chrome VRP submission process.


If you have communicated with any of these accounts or visited the actors’ blog, we suggest you review your systems for the IOCs provided below.


Host IOCs Registry Keys HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update File Paths C:\Windows\System32\Nwsapagent.sys C:\Windows\System32\helpsvc.sys C:\ProgramData\USOShared\uso.bin C:\ProgramData\VMware\vmnat-update.bin C:\ProgramData\VirtualBox\update.bin


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2020.


It was last updated on January 26, 2021.


We terminated 12 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


We received leads from Facebook that supported us in this investigation.


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Myanmar.


We terminated 35 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


We received leads from the FBI that supported us in this investigation.


We terminated 2 YouTube channels as part of our ongoing investigation into a coordinated influence operation linked to Iran.


We terminated 10 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


We terminated 22 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Indonesia.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


We terminated 9 YouTube channels as part of our investigation into a coordinated influence operation linked to Egypt.


We terminated 6 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


We terminated 1 YouTube channel as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


We terminated 1 blog as part of our investigation into coordinated influence operations linked to Argentina.


We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to France.


We terminated 34 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


We terminated 3,317 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2022.


It was last updated on May 12, 2022.


We have also taken extraordinary measures beyond our actions against coordinated influence operations to protect users and stop the spread of misinformation and disinformation about the war in Ukraine online.


We use our research to continuously improve the safety and security of our products and share this intelligence with the community to benefit the internet as a whole.


As announced today, Google has taken action to disrupt the operations of Glupteba, a multi-component botnet targeting Windows computers.


The Glupteba malware family is primarily distributed through pay per install (PPI) networks and via traffic purchased from traffic distribution systems (TDS).


For a period of time, we observed thousands of instances of malicious Glupteba downloads per day.


The following image shows a webpage mimicking a software crack download which delivers a variant of Glupteba to users instead of the promised software.


While analyzing Glupteba binaries, our team identified a few containing a git repository URL: “git.voltronwork.com”.


This finding sparked an investigation that led us to identify, with high confidence, multiple online services offered by the individuals operating the Glupteba botnet.


This past year, TAG has been collaborating with Google’s CyberCrime Investigation Group to disrupt Glupteba activity involving Google services.


Parallel to the analysis, tracking, and technical disruption of this botnet, Google has filed a lawsuit against two individuals believed to be located in Russia for operating the Glupteba Botnet and its various criminal schemes.


To add resilience to their infrastructure, the operators have also implemented a backup mechanism using the Bitcoin blockchain.


Full details of Glupteba’s network protocol can be found in this report from 2020, the following Python script illustrates how one can decrypt an encrypted domain name:


Recent sha256 hashes of malware samples:


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2021.


It was last updated on February 7, 2022.


To protect our users, TAG routinely hunts for 0-day vulnerabilities exploited in-the-wild.


The watering hole served an XNU privilege escalation vulnerability (CVE-2021-30869) unpatched in macOS Catalina, which led to the installation of a previously unreported backdoor.


iOS Exploits


The iOS exploit chain used a framework based on Ironsquirrel to encrypt exploits delivered to the victim's browser.


We did not manage to get a complete iOS chain this time, just a partial one where CVE-2019-8506 was used to get code execution in Safari.


macOS Exploits


The landing page contained a simple HTML page loading two scripts—one for Capstone.js and another for the exploit chain.


The parameter rid is a global counter which records the number of exploitation attempts.


This number was in the 200s when we obtained the exploit chain.


The exploit chain combined an RCE in WebKit exploiting CVE-2021-1789 which was patched on Jan 5, 2021 before discovery of this campaign and a 0-day local privilege escalation in XNU (CVE-2021-30869) patched on Sept 23, 2021.


Loading a page with the WebKit RCE on the latest version of Safari (14.1), we learned the RCE was an n-day since it did not successfully trigger the exploit.


Capstone.js


It was interesting to see the use of Capstone.js, a port of the Capstone disassembly framework, in an exploit chain as Capstone is typically used for binary analysis.


Analyzing the Mach-O was reminiscent of a CTF reverse engineering challenge.


Then the extracted binary was heavily obfuscated with a relatively tedious encoding mechanism--each string is XOR encoded with a different key.


After downloading the payload, it removes the quarantine attribute of the file to bypass Gatekeeper.


It then elevated privileges to install the payload.


day or 0-day?


Before further analyzing how the exploit elevated privileges, we needed to figure out if we were dealing with an N-day or a 0-day vulnerability.


An N-day is a known vulnerability with a publicly available patch.


Threat actors have used N-days shortly after a patch is released to capitalize on the patching delay of their targets.


In contrast, a 0-day is a vulnerability with no available patch which makes it harder to defend against.


Despite the exploit being an executable instead of shellcode, it was not a standalone binary we could run in our virtual environment.


It still worked.


The exception indicates that Apple added generic protections in Big Sur which rendered this exploit useless.


This looked similar to an earlier in-the-wild iOS vulnerability analyzed by Ian Beer of Google Project Zero.


The payload seems to be a product of extensive software engineering.


It also has several components, some of which appear to be configured as modules.


For example, the payload we obtained contained a kernel module for capturing keystrokes.


Notable features for this backdoor include:  Our team is constantly working to secure our users and keep them safe from targeted attacks like this one.


Delivery URLs Javascript Sandbox escape / LPE Backdoor C2 This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2021.


It was last updated on October 29, 2021.


Updated on May 6, 2020, 7:20 Pacific Time with further details regarding directories targeted for encryption.


A new targeted attack has infected several organizations in Taiwan with a new ransomware family, which we have dubbed ColdLock.


The information we gathered indicates that this attack started hitting organizations in early May.


Analysis of the malware points to similarities between ColdLock and two previously known ransomware families, specifically Lockergoga, Freezing, and the EDA2 “educational” ransomware kit.


There have been no indications that this attack has hit any other organization outside of those targeted; we do not believe that this family is currently in widespread use.


Arrival Vector


We currently do not know the initial arrival vector of this threat into a potential victim’s network.


The payload arrives as a .NET executable (as a .DLL file), which has been packed/protected using the ConfuserEx packer.


It uses PowerShell reflective loading of .NET executables to run the said .DLL file:  Figure 1. Reflective loading of the .DLL file


It also contains two checks to verify if it’s running.


It will only run at or later than 12:10 PM on any given day; if it is earlier, it will sleep for 15 seconds until it is past the said time.


Figure 3.


Before it encrypts any file, the ransomware also performs certain preparatory routines.


Figure 4.


It also checks the Windows version running on the system.


If it is running Windows 10, it carries out several Windows 10-specific routines.


Windows Defender is disabled, as well as the ability to send feedback/malware samples to Microsoft.


Figure 5. Disabling Windows Defender


The actual encryption routine is slightly unusual.


Directory name should not contain any of the following strings: .git appdata cache image lib log logs microsoft reference res resource script setup skin temp theme third_party thirdparty    If all of the above conditions are met, it will encrypt all the files in the given directory except those with the following extensions:  .avi .dll .gif .iso .m2ts .mkv .mov .mp3 .msi .ocx .tmp .wmv


.odt


.one


.php .ppt


.pptx .pst .rar .sh .sql .txt .xls .xlsx .xml .zip


Figure 6.


Whitelist/blacklist code


It generates the needed key and initialization vector (IV) using a salt and secret key; the former is embedded in the code while the latter is generated dynamically using the SHA-256 hash of a randomly generated 32-byte long string.


This is then encrypted using a hard-coded public RSA key and then embedded in the ransom note.


Figure 7.


AES encryption code  Figure 8.


Secret key generation


Txt


It does this by changing several registry settings.


Figure 10. Modified system wallpaper


Connections to other ransomware families


A more reasonable link to the Freezing ransomware family exists.


The code also shares similarities with the open-source EDA2 ransomware kit.


Trend Micro solutions Ransomware continues to be a lingering threat, something we mentioned in our last Annual Security Roundup after seeing that the number of ransomware cases we detected climbed from 55 million in 2018 to 61 million in 2019.


For zero-day vulnerabilities, take advantage of virtual patching.


Activate sandbox analysis.


Indicators of Compromise  SHA-256 hash Detection Name 08677a3dac3609d13dc4a2a6868ee2f6c1334f4579356d162b706a03839bb9ff Ransom.PS1.COLDLOCK.YPAE-A c5108344e8a6da617af1c4a7fd8924a64130b4c86fa0f6d6225bb75534a80a35 Ransom.MSIL.COLDLOCK.YPAE-A   All Trend Micro products using the latest VSAPI pattern (15.849.00 or later) are capable of successful detection of this malware.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2022.


It was last updated on May 12, 2022.


We have also taken extraordinary measures beyond our actions against coordinated influence operations to protect users and stop the spread of misinformation and disinformation about the war in Ukraine online.


We use our research to continuously improve the safety and security of our products and share this intelligence with the community to benefit the internet as a whole.


As announced today, Google has taken action to disrupt the operations of Glupteba, a multi-component botnet targeting Windows computers.


The Glupteba malware family is primarily distributed through pay per install (PPI) networks and via traffic purchased from traffic distribution systems (TDS).


For a period of time, we observed thousands of instances of malicious Glupteba downloads per day.


The following image shows a webpage mimicking a software crack download which delivers a variant of Glupteba to users instead of the promised software.


While analyzing Glupteba binaries, our team identified a few containing a git repository URL: “git.voltronwork.com”.


This finding sparked an investigation that led us to identify, with high confidence, multiple online services offered by the individuals operating the Glupteba botnet.


This past year, TAG has been collaborating with Google’s CyberCrime Investigation Group to disrupt Glupteba activity involving Google services.


Parallel to the analysis, tracking, and technical disruption of this botnet, Google has filed a lawsuit against two individuals believed to be located in Russia for operating the Glupteba Botnet and its various criminal schemes.


To add resilience to their infrastructure, the operators have also implemented a backup mechanism using the Bitcoin blockchain.


Full details of Glupteba’s network protocol can be found in this report from 2020, the following Python script illustrates how one can decrypt an encrypted domain name:


Recent sha256 hashes of malware samples:  This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2021.


It was last updated on February 7, 2022.


Although believed to have been active since 2011, TeamTNT stayed under the radar for many years before exploding onto the scene in 2020.


This is known as the principle of least privilege.


Implement private keys authentication for Secure Shell (SSH) on the client side for stronger access control security.


However, the scope of the attack remained unknown.


Figure 1: IRC bot dropping encoded shell script (detected as Backdoor.Linux.TSUNAMI.USELVBF21)      We begin by examining the dropped script from a new AWS-focused credential stealer.


An AWS instance, by default, does not have any identity access management (IAM) permissions attached; rather, these permissions must be defined by the AWS administrator.


AWS administrators should follow the principle of least privilege when attaching roles to an AWS instance.


Figure 4. Other binaries found on the open directory


If the group succeeds in running their malicious script on an AWS instance, the script uploads any credentials that it is able to retrieve from the instance metadata service.


During our research, we noticed over 4,000 infected instances.


Use private key authentication when you have SSH enabled inside your instance.


Network Security: cloud network layer IPS security Application Security: security for serverless functions, APIs, and applications Conformity: real-time security for cloud infrastructure — secure, optimize, comply  Indicators of Compromise (IOCs)  SHA-256  Detection  Description  9504b74906cf2c4aba515de463f20c02107a00575658e4637ac838278440d1ae  Backdoor.Linux.TSUNAMI.USELVBF21  IRC bot  3139a85a18e42bf60ba65deb3d691b5c088a0fac2b80a4d05f17a68eac3d4882  TrojanSpy.SH.AWSTEAL.A  Script       Tags  Cloud | APT & Targeted Attacks | Research | Articles, News, Reports


Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.


PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services.


Some of the cloud storage accounts used to deliver PLEAD are also used as drop off points for exfiltrated documents stolen by DRIGO.


PLEAD’s installers are disguised as documents using the right-to-left-override (RTLO) technique to obfuscate the malware’s filename.


We’ve also seen PLEAD use exploits for these vulnerabilities:   CVE-2015-5119, patched by Adobe last July, 2015 CVE-2012-0158, patched by Microsoft last April, 2012 CVE-2014-6352, patched by Microsoft last October, 2014 CVE-2017-0199, patched by Microsoft last April, 2017  PLEAD also dabbled with a short-lived, fileless version of their malware when it obtained an exploit for a Flash vulnerability (CVE-2015-5119) that was leaked during the Hacking Team breach.


Figure 1: How PLEAD utilizes compromised routers PLEAD actors use a router scanner tool to scan for vulnerable routers, after which the attackers will enable the router’s VPN feature then register a machine as virtual server.


This virtual server will be used either as a C&C server or an HTTP server that delivers PLEAD malware to their targets.


PLEAD also uses CVE-2017-7269, a buffer overflow vulnerability Microsoft Internet Information Services (IIS) 6.0 to compromise the victim’s server.


Figure 2:


One of the methods PLEAD operators use to distribute their malware PLEAD’s backdoor can:  Harvest saved credentials from browsers and email clients like Outlook List drives, processes, open windows, and files Open remote Shell Upload target file Execute applications via ShellExecute API Delete target file  PLEAD also uses the document-targeting exfiltration tool DRIGO, which mainly searches the infected machine for documents.


Shrouded Crossbow


This campaign, first observed in 2010, is believed to be operated by a well-funded group given how it appeared to have purchased the source code of the BIFROST backdoor, which the operators enhanced and created other tools from.


Shrouded Crossbow employs three BIFROST-derived backdoors: BIFROSE, KIVARS, and XBOW.


Like PLEAD, Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents.


BIFROSE, known for evading detection by communicating with its C&C servers via Tor protocol, also has a version targeting UNIX-based operating systems, which are usually used in servers, workstations, and mobile devices.


Waterbear similarly employs a modular approach to its malware.


The tactic it later adopted required prior knowledge of their targets’ environment.


All Roads Lead to BlackTech


C&C Server PLEAD Shrouded Crossbow Waterbear itaiwans[.]com Yes No Yes microsoftmse[.]com Yes Yes No 211[.]72[.]242[.]120 Yes Yes No


Table 1: C&C servers shared by PLEAD, Shrouded Crossbow, and Waterbear


Additionally, the IP 211[.]72 [.]242[.]120 is one of the hosts for the domain microsoftmse[.]com, which has been used by several KIVARS variants.


Joint Operations.


While it’s possible for separate groups to attack at the same time, we can construe at they are at least working together:    PLEAD


Shrouded Crossbow Samples from different groups using the same filename Loader component named after its target, i.e. {target name}.exe Loader component named after its target, i.e. {target name}.exe or {target name}64.exe Backdoors using the same C&C servers Connected to 211[.]72[.]242[.]120:53 Connected to 211[.]72[.]242[.]120:443 Timeline indicating arrival order Arrived two days after initial infection by SC Established presence two years prior, but re-infected at a recent time


Table 2: Incident where PLEAD and KIVARS attack the same target    PLEAD Shrouded Crossbow Waterbear Samples found in same machine vmdks.exe  cfbcjtqx.dll tpauto.dll Timeline of infection 3/16/2017 2/23/2017 3/8/2017   Table 3: Incidents where PLEAD, KIVARS, and Waterbear were used on the same target


PLEAD and KIVARS, for instance, share the use of RTLO techniques to disguise their installers as documents.


Similar Objectives.


Public security Schedule   Enterprises Need to be Proactive PLEAD, Shrouded Crossbow, and Waterbear


Network traffic analysis, deployment of firewalls and intrusion detection and prevention systems, network segmentation, and data categorization are just some of them.


An overview and analysis of the various malware used by PLEAD, Shrouded Crossbow, and Waterbear, along with their Indicators of Compromise (hashes, C&Cs), can be found in this technical brief.        Tags  Articles, News, Reports | APT & Targeted Attacks | Research


Evaluations conducted by MITRE Engenuity don’t generate any scores, rankings or ratings.


Security teams can leverage the MITRE ATT&CK framework to tell a story that helps simplify security communication across their organization.


A security professional can leverage MITRE ATT&CK to audit for coverage gaps to discover where they may be vulnerable to threats.


MITRE Engenuity ATT&CK Evaluations tests a solution’s ability to detect an adversary performing a targeted attack.


The simulated attackers sent a spear phishing email with a malicious attachment to the manager with the goal of tricking them into opening it, as this technique relies upon user execution.


When the manager opened the attachment, initial access was granted to the threat group.


Figure 1 - A Technique detection named "User Execution of Office Related Document" was generated when explorer.exe spawned winword.exe when the user clicked 2-list.rtf.


Maintaining Access:


The Leg Work


Now that the threat group has been granted access to the organization’s network, they must collect the necessary information needed to complete their objective.


Figure 2 - A Technique detection named "Clipboard Data or Screenshot Collection via PowerShell" was generated when powershell.exe executed CopyFromScreen().     The adversary uses privilege escalation, which commonly involves taking advantage of pre-existing system weaknesses, misconfigurations, and vulnerabilities to gain higher permissions.


Figure 3 - Workbench results pulling together a chain of attack involved Credential Dumping using Mimikatz Malware.


Lateral Movement: Moving in for the Kill


Figure 4 - Workbench models showing correlated events ready for further investigation.


Trend Micro Vision One is great for this step.


We don’t just tell you these individual events have all occurred – we connect the dots for you, showing that they might be related and have similar indicators of compromise as a certain attack group or type.


Figure 6 - FIN7 evaluation environment with Trend Micro solution placement for both detection and prevention scenarios.


What Does it Mean for Me?


What else do I need to consider?


When evaluating the performance of vendors, it is important to consider the hierarchy of detection types.


Telemetry:


Data was processed that shows an event occurred related to the process being detected.


General:


A general detection indicates that something was deemed suspicious, but it was not assigned to a specific tactic or technique.


Technique: A detection on technique means the detection can be attributed to a specific adversarial action (e.g. credential dumping).


Figure 8 - Carbanak and FIN7 evaluation, 65 ATT&CK techniques across 11 ATT&CK tactics are in scope for this evaluation.


Trend Micro doesn’t leave that responsibility wholly on you.


Figure 9 -


For this specific test, Trend Micro performed exceptionally with the ability to block 90% of simulations automatically.


Another added element this year which deserves a special mention was the introduction of a Linux servers, where we detected all 14 techniques executed in the simulated attack scenario.


Check out the complete results and more information on Trend Micro Vision One here: https://resources.trendmicro.com/MITRE-Attack-Evaluations.html.


Articles, News, Reports


To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild.


If the link was not active, the user was redirected directly to a legitimate website.


We assess that these campaigns delivered ALIEN, a simple Android malware in charge of loading PREDATOR, an Android implant described by CitizenLab in December 2021.


ALIEN lives inside multiple privileged processes and receives commands from PREDATOR over IPC.


We did not capture the subsequent stages, but assess the attackers did not have exploits for the current version of Chrome (91.0.4472) at that time, but instead used n-day exploits targeting Samsung Browser, which was running an older and vulnerable version of Chromium.


Related IOCs


We recovered the exploit used to escape the Chrome Sandbox, but not the initial RCE exploit.


We haven’t retrieved a copy of the exploit.


We would also like to thank Project Zero for their technical assistance in helping analyze these bugs.


We remain committed to updating the community as we uncover these campaigns.


We look forward to continuing our work in this space and advancing the safety and security of our users around the world.


NOTE: On May 20th, we updated our attribution to more precisely describe our findings.


Since our last update, TAG has observed a continuously growing number of threat actors using the war as a lure in phishing and malware campaigns.


As always, we continue to publish details surrounding the actions we take against coordinated influence operations in our quarterly TAG bulletin.


The data is then exfiltrated via email to a compromised email account.


Malware samples:


TAG would like to thank the Yahoo! Paranoids Advanced Cyber Threats Team for their collaboration in this investigation.


Recently observed Turla domains: COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts.


The group's tactics, techniques and procedures (TTPs) for these campaigns have shifted slightly from including phishing links directly in the email, to also linking to PDFs and/or DOCs hosted on Google Drive and Microsoft One Drive.


Within these files is a link to an attacker controlled phishing domain.


These phishing domains have been blocked through Google Safe Browsing – a service that identifies unsafe websites across the web and notifies users and website owners of potential harm.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, has remained active during the course of the war and recently resumed targeting of Gmail accounts via credential phishing.


This campaign, targeting high risk individuals in Ukraine, contained links leading to compromised websites where the first stage phishing page was hosted.


If the user clicked continue, they would be redirected to an attacker controlled site that collected the users credentials.


There were no accounts compromised from this campaign and Google will alert all targeted users of these attempts through our monthly government-backed attacker warnings.


Both pages from this campaign are shown below.


In mid-April, TAG detected a Ghostwriter credential phishing campaign targeting Facebook users.


The targets, primarily located in Lithuania, were sent links to attacker controlled domains from a domain spoofing the Facebook security team.


Recently observed Ghostwriter credential phishing domains and emails: Curious Gorge, a group TAG attributes to China's PLA SSF, has remained active against government, military, logistics and manufacturing organizations in Ukraine, Russia and Central Asia.


In Russia, long running campaigns against multiple government organizations have continued, including the Ministry of Foreign Affairs.


Over the past week, TAG identified additional compromises impacting multiple Russian defense contractors and manufacturers and a Russian logistics company.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further exploitation.


We also send all targeted Gmail and Workspace users government-backed attacker alerts notifying them of the activity.


We encourage any potential targets to enable Google Account Level Enhanced Safe Browsing and ensure that all devices are updated.


The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.


We’ll continue to take action, identify bad actors and share relevant information with others across industry and governments, with the goal of bringing awareness to these issues, protecting users and preventing future attacks.


In early March, Google’s Threat Analysis Group (TAG) published an update on the cyber activity it was tracking with regard to the war in Ukraine.


Since our last update, TAG has observed a continuously growing number of threat actors using the war as a lure in phishing and malware campaigns.


Financially motivated and criminal actors are also using current events as a means for targeting users.


TAG has also continued to observe multiple ransomware brokers continuing to operate in a business as usual sense.


As always, we continue to publish details surrounding the actions we take against coordinated influence operations in our quarterly TAG bulletin.


We promptly identify and remove any such content, but have not observed any significant shifts from the normal levels of activity that occur in the region.


Here is a deeper look at the campaign activity TAG has observed over the past two weeks: Curious Gorge, a group TAG attributes to China's PLA SSF, has conducted campaigns against government and military organizations in Ukraine, Russia, Kazakhstan, and Mongolia.


While this activity largely does not impact Google products, we remain engaged and are providing notifications to victim organizations.


Recently observed IPs used in Curious Gorge campaigns: COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor.


However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.


These campaigns were sent using newly created Gmail accounts to non-Google accounts, so the success rate of these campaigns is unknown.


We have not observed any Gmail accounts successfully compromised during these campaigns.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, recently introduced a new capability into their credential phishing campaigns.


In mid-March, a security researcher released a blog post detailing a 'Browser in the Browser' phishing technique.


While TAG has previously observed this technique being used by multiple government-backed actors, the media picked up on this blog post, publishing several stories highlighting this phishing capability.


Ghostwriter actors have quickly adopted this new technique, combining it with a previously observed technique, hosting credential phishing landing pages on compromised sites.


The new technique, displayed below, draws a login page that appears to be on the passport.i.ua domain, overtop of the page hosted on the compromised site.


Once a user provides credentials in the dialog, they are posted to an attacker controlled domain.


Recently observed Ghostwriter credential phishing domains:


The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.


We’ll continue to take action, identify bad actors and share relevant information with others across industry and governments, with the goal of bringing awareness to these issues, protecting users and preventing future attacks.


Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days.


This week, learn about Trend Micro’s latest cloud security offering, Cloud One – Application Security.


Read on:


Leading Protection for Cloud-Based Applications from Trend Micro Trend Micro announced the availability of its Trend Micro Cloud One – Application Security, a cloud native security solution for modern applications and APIs.


Delivered as part of its industry-leading platform, Cloud One – Application Security provides code-level visibility and protection against the latest cyber threats.


The Internet of Things (IoT) Cybersecurity Improvement Act, passed by the House of Representatives in September and unanimously approved by the Senate last week, is a step toward warding off advanced threats and providing greater security in IoT devices.


The act aims to create “standards and guidelines” for the federal government to follow with the hopes that the requirements also make their way into private sector manufacturing.


Navigating Gray Clouds: The Importance of Visibility in Cloud Security


With 85% of businesses worldwide using the cloud, it has proven its imperative value, especially during the onslaught of the COVID-19 pandemic when remote work and reliance on the cloud for automation and scalability is the norm.


After migrating to the cloud, enterprises need to be aware of the visibility-related challenges and security risks associated with it.


In this blog, Trend Micro shares security recommendations for organizations to ensure stable security practices in a cloud-first world.


Apple Security Chief Maintains Innocence After Bribery Charges


A grand jury in California's Santa Clara County has indicted Thomas Moyer, Apple's head of global security, for bribery.


Moyer is accused of offering 200 iPads to the Santa County Sheriff's office in exchange for concealed carry permits for four Apple employees.


Weaponizing Open Source Software for Targeted Attacks


In this blog, Trend Micro researchers walk through a recent investigation that involved trojanized open-source software, which is tricky to spot because it takes on the façade of legitimate, non-malicious software, making it especially stealthy and useful for targeted attacks.


However, a closer investigation can reveal suspicious behavior that exposes their malicious intent.


Botnets Have Been Silently Mass-Scanning the Internet for Unsecured ENV Files Security firm Greynoise found that multiple threat actors, while drawing little attention to themselves, have spent the past two to three years mass-scanning the internet for ENV (environment) files that were accidentally uploaded and left exposed on web servers.


Frameworks like Docker, Node.js, Symfony, and Django use ENV files to store environment variables such as API tokens, passwords and database logins.


Analysis of Kinsing Malware's Use of Rootkit


With the constant evolution of shell scripts and Linux-based malicious backdoors and agents, it’s not surprising that the creators of Kinsing have kept in step.


In this blog post Trend Micro researchers discuss the malware variant’s current capabilities, including the addition of features intended to make it more difficult to detect in infected machines.


The Malware that Usually Installs Ransomware and You Need to Remove Right Away


This article lists the known malware strains that have been used over the past two years to install ransomware, all of which should serve as a "code red" moment for any organization.


Once any of these malware strains are detected, system administrators should drop everything, take systems offline, and audit and remove the malware as a top priority.


Published New White Paper: Practical Risk Assessments for Smart Factories


While cyberattacks that threaten smart factories cannot be ignored, it can be a struggle to decipher which security method is sufficient within your organization’s specific system, as well as where to start.


To design a secure system, risk assessment is required.


This new white paper is intended to simulate risk assessment practices using an example of a fictitious smart factory.


The risk assessment described in this document aims to assess and prioritize the risks of the entire smart factory environment, including IT.


Post-Breach, Peatix Data Reportedly Found on Instagram, Telegram


In a data breach notice to affected users, events application Peatix said it learned that user account data had been improperly accessed.


Upon further investigation, they found that usernames, email addresses, salted and hashed passwords, nicknames, preferred languages, countries and time zones had been compromised.


It’s unclear how many of its 5 million user base were affected or how the breach happened.


Not long after the breach occurred, the compromised data was spotted on ads posted on Instagram stories, Telegram channels and various hacking forums.


How a Ransomware Attack Could Affect Retailers


Cybercriminals have recently been focusing their efforts on the retail industry, launching ransomware-based attacks that could prove disastrous for businesses if it disrupts their operations during important shopping seasons.


A ransomware attack on a retailer could mean thousands of lost sales opportunities in the short-term, and serious damage to reputation in the long-term.


Perception of an “unsafe” business could turn customers towards competitors who can offer a better and more secure shopping experience.


What are your thoughts on the ransomware attacks on retailers as we approach the busiest times of the year for retailers, including Black Friday, Cyber Monday and the holiday season?


Share them in the comments below or follow me on Twitter to continue the conversation: @JonLClay.


Tags  Cloud | Malware | Expert Perspective | APT & Targeted Attacks | IoT | Ransomware |


Articles, News, Reports


One of the secrets of Trend Micro’s long-lasting success is being constantly on the lookout for where the next security threats might come from.


That’s why we’re focusing a great deal of our research and development efforts right now on the intersection of IT and operational technology (OT).


This burgeoning world of connected IoT devices is particularly advanced in the manufacturing space, where huge gains are already being made.


But as great as these leaps forward are, so are the risks if technology systems aren’t properly secured.


That’s why we’re thrilled to be joining the ROS-Industrial Consortium (ROS-I) to help accelerate the secure development of robotic Industry 4.0 applications.


It’s yet another important step for our stated mission: to secure the connected world.


Why IIoT matters  Industrial IoT (IIoT) systems are already streamlining production processes, improving cost efficiencies, and helping to drive greater agility and innovation for manufacturers.


It’s no coincidence that the global market for such solutions will grow at nearly 17% CAGR over the next six years to exceed $263 billion by 2027.


But with new technology always comes new cyber risk.


As connectivity is introduced to industrial computing devices, the challenge is managing the threat from remote attackers.


System and software vulnerabilities could be probed to hijack devices, sabotage production processes and steal intellectual property.


Robots are a particular risk—not only because so much of modern manufacturing relies on them, but also because many of these machines rely on legacy technology dating back decades.


These custom, proprietary programming languages and unique ecosystems can make security complex, and lead to unpatched vulnerabilities which sophisticated attackers could exploit, with serious consequences.


Shaping the roadmap  ROS-I is an open-source project devoted to extending the capabilities of the Robot Operating Systems (ROS) into industrial hardware and applications.


The job of the ROS-I Consortium is to prioritize these capabilities, offer code quality standards and provide technical support and training.


As an associate member of the consortium, Trend Micro will now be able to participate in technical and strategic projects and help to shape the ROS-I roadmap.


In fact, we’ve already demonstrated our value to the organization in research last year, which uncovered design flaws and vulnerabilities in legacy programming languages used by some of its products.


That resulted in our collaboration to develop secure network guidelines for industrial robots using ROS.


Securing the future  Trend Micro also recently started looking at the security of the Data Distribution Service (DDS).


This protocol is used heavily by ROS2 and will therefore be another area in which we hope to deliver tremendous value to ROS-I and end-customers going forward.


Trend Micro is in many ways an unusual member of the consortium.


Most either use ROS/ROS2 in their products, for example as robot manufacturers, or they want to help develop the software.


We do neither, but we plan to work with the consortium to enhance security-by-design in ROS-I software.


In fact, Trend Micro is only the second cybersecurity specialist to join.


Securing IIoT systems is hard: it requires capabilities across the cloud, the network, and the devices themselves.


For more info, check out our Smart Factory solutions: https://www.trendmicro.com/en_us/business/solutions/iot/smart-factory.html.


Tags  APT & Targeted Attacks | IoT | Expert Perspective | Articles, News, Reports


Cloud computing is on a roll.


Gartner predicts that spending on public cloud services including IaaS, SaaS and PaaS will reach nearly $500bn this year and grow by over 21% to hit $600bn by 2023.


But security concerns persist.


Marketplaces like the one offered by AWS make it a lot easier to get the right security tools in the hands of those that need them most.


But finding the right cybersecurity partners can still be something of an operational challenge involving a mountain of manual work.


That’s why we’re delighted to be a launch partner for new AWS Marketplace feature.


Marketplace Vendor Insights takes the pain out of due diligence by delivering the information prospective customers need—reducing friction and accelerating the journey to cloud security.


A tech tipping point We all know why global organizations are turning in their droves to cloud computing services and infrastructure.


For many, it was the pandemic that pushed them over a technology tipping point.


For others, digital transformation had been a priority for much longer, but the events of the past two years added a new sense of urgency.


Cloud investments are delivering innovative customer experiences, streamlining business processes and driving enterprise agility across the planet.


But such initiatives must be built on solid, secure foundations.


Trend Micro blocked 101% more cloud-based email threats in 2021 than the previous year.


We also know that threat actors are actively scanning for misconfigured cloud environments.


In-house skills shortages and the rapid pace of innovation from cloud service providers exacerbate this challenge.


The expansive use of open source code by DevOps teams adds another element of risk which requires urgent attention.


Climbing a mountain, the easy way IT leaders know that cloud security is a shared responsibility.


The challenge is often finding the right partners to align with their specific requirements.


Even though platforms like the AWS Marketplace have streamlined the process of procurement immeasurably for cloud builders, friction persists.


Security is a complex business, especially in the cloud, where many traditional rules associated with the on-premises world no longer apply.


That means customers have to ask prospective providers like Trend Micro a mountain of questions.


In fact, we receive extensive spreadsheets full of these questions several times a week.


They often contain hundreds of queries to process, which may have been written by lawyers who don’t fully understand the subject matter.


While buyers usually aim for lead times of weeks or months, the questionnaires themselves can get stuck in a bottleneck if forwarded first to IT service partners.


This is where AWS Marketplace Vendor Insights comes in.


It collects data from ISV partners like Trend Micro via two mechanisms:  ISVs upload compliance certificates, which are scanned and processed, with the salient information extracted by Marketplace Vendor Insights AWS technology is deployed to ISV production accounts to directly monitor and inspect configuration of technology resources and collect other critical information


The result is a win-win for ISVs like Trend Micro and security-minded AWS customers.


With Marketplace Vendor Insights, IT leaders can review compliance attestations and double click on more details about ISV security best practices directly from the AWS Marketplace.


It also enables buyers to view vendor information in the same way, allowing for true apples to apples comparison.


In so doing, it eliminates the need for endless back-and-forth communications between ISV and prospective customer.


It’s about standardizing and streamlining an important but cumbersome process to fast-track due diligence—ultimately enabling enterprises to extract value from platforms like Trend Micro Cloud One even quicker.


Tags  Cloud | Latest News | Data center | Compliance & Risks | APT & Targeted Attacks | Ransomware |


Articles, News, Reports


Tropic Trooper, a threat actor group that targets government, military, healthcare, transportation, and high-tech industries in Taiwan, the Philippines, and Hong Kong, has been active since 2011.


The group was reportedly using spear-phishing emails with weaponized attachments to exploit known vulnerabilities.


Primarily motivated by information theft and espionage, the group has also been seen adopting different strategies such as fine-tuning tools with new behaviors and going mobile with surveillanceware.


We found that Tropic Trooper’s latest activities center on targeting Taiwanese and the Philippine military’s physically isolated networks through a USBferry attack (the name derived from a sample found in a related research).


We also observed targets among military/navy agencies, government institutions, military hospitals, and even a national bank.


The group employs USBferry, a USB malware that performs different commands on specific targets, maintains stealth in environments, and steals critical data through USB storage.


We started tracking this particular campaign in 2018, and our analysis shows that it uses a fake executable decoy and a USB trojan strategy to steal information.


Based on data from the Trend Micro™ Smart Protection Network™ security infrastructure, USBferry attacks have been active since 2014.


We found the group was focused on stealing defense-, ocean-, and ship-related documents from target networks, which led us to believe that Tropic Trooper’s main purpose is to exfiltrate confidential information or intelligence.


Figure 1.


A sample scenario of the USBferry attack Tropic Trooper is well aware that military or government organizations may have more robust security in their physically isolated environments (i.e., the use of biometrics or USB use in a quarantined machine before an air-gapped environment).


The group then targets potentially unsecured related organizations that could serve as jumping-off points for attacks.


For instance, we observed Tropic Trooper move from a military hospital to the military’s physically isolated network.


For one thing, the USBferry malware already has at least three versions, with different variants and components, at the time of writing.


The malware tries to check if the target machine has a USB plug-in and copies the USBferry installer into the USB storage.


The activities vary in target environments; some execute commands, source target files or folder lists, and copy files from physically isolated hosts to compromised hosts, among other things.


Figure 2. USBferry malware’s first version, where the EXE file is the USBferry malware and the DLL file is trojan TROJ_YAHOYAH


This version also changes the malware location and its name to UF, an abbreviation for USBferry.


Figure 3.


USBferry malware’s second version combined into one file


Figure 4.


USBferry malware’s third version becomes resident in memory How USBferry targets air-gapped systems


In our technical brief, we broke down how Tropic Trooper has changed the way it uses the abovementioned USBferry versions in attacks.


Figure 5. USBferry malware using USB worm infection strategy


USBferry attack scenario, version UF1.0 20160226


The decoy file first drops a flash_en.inf DLL file, which is a USBferry loader, and tries to load the encrypted USBferry malware


The encrypted USBferry malware is embedded in the loader resource section, and the loader drops it into the C:\Users\Public\Documents\Flash folder and names it flash.dat


After the encrypted payload is loaded, the loader injects a malicious DLL into rundll32.exe.


The USBferry malware also loads a C&C configuration file and flash_en.dat, which is also located in the C:\Users\Public\Documents\Flash


The USBferry malware then tries to connect to the download site and uses a Windows command to collect/copy target host data


Some backdoors used by Tropic Trooper use injection to execute its routines, while others execute directly and run itself consistently.


The group also uses steganography to mask their backdoor routines and evade anti-malware and network perimeter detection.


Based on the malware version number, this backdoor’s first version was developed in or before 2011.


Figure 7.


The backdoor version name, registered service name, and malware components’ filenames  Welcome To IDShell 1.0 20150310’s backdoor (detected as BKDR_IDSHELL.ZTFC-A) - The purpose of this backdoor, which has two types, including a steganography jpg version, is to recon the target machine.


Like other versions, it uses the DNS protocol to communicate with the backdoor controller.


The traffic is encrypted to evade detection.


Figure 8.


The backdoor’s communication traffic


Hey!


Welcome Server 2.0’s backdoor (detected as BKDR_TEBSHELL.ZTGK) – This is the latest version of the backdoor, available in 32-bit and 64-bit versions, which uses an invisible web shell for remote control and network security evasion.


Figure 9.


Port scanning tools, which are available on the internet.


The overview provided above highlights how putting critical information in physically isolated networks is not a bulletproof solution for defending against cyberespionage.


Steganography isn’t just used to deliver encrypted payloads; it can also be used to transfer information to a C&C server.


Threat actors like Tropic Trooper can also use an invisible web shell to hide its C&C server location and make incident response tricky.


Enforce the principle of least privilege.


Read our technical brief, which discusses in full our analyses of Tropic Trooper’s recent activities, the USBferry malware, and IoCs.


Attack Chain Figure 1. Attack chain of Tropic Trooper’s operations


Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns:


Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802, security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE).


UserInstall.exe will abuse the BITSadmin command-line tool to create a job and launch sidebar.exe.


We also observed malicious documents that don’t need to download anything from the internet as the backdoor’s dropper is already embedded in the document.


Tropic Trooper uses exploit-laden Microsoft Office documents to deliver malware to targets.


Below is a screenshot of the document used in their latest campaigns: Figure 2.


Malicious document used by Tropic Trooper PDB Strings as Context Clues


Figure 3.


PDB strings inside the MSI file


The first PDB string has a certain ss2/Projects/MsiWrapper (Project MsiWrapper) in it, which we found to be an open-source application that converts executable setup programs to MSI files.


Another interesting PDB string we found is - D:\Work\Project\VS\house\Apple\Apple_20180115\Release\InstallClient.pdb.


This is carried out to evade antivirus (AV) detection, because wab32res.dll is loaded by a benign file.


Figure 4.


The installer drops three files into the Apple/Update directory Figure 5.


PDB strings inside the loader file


The backdoor, TClient (BKDR_TCLT.ZDFB), is so named from its own PDB string.


Figure 6.


TClient is injected into dllhost.exe Malware Analysis  wab32res.dll (FakeRun loader) loads TClient.


Figure 7.


The loader checking the sidebar process Figure 8.


The malicious loader injecting the backdoor into dllhost.exe Figure 9.


Comparison of TClient’s configuration format in 2016 (left, from other researchers) and 2018 (right) TClient will use SSL to connect to Tropic Trooper’s C&C server.


TClient is actually one of Tropic Trooper’s other backdoors.


TClient uses symmetric encryption to decrypt its configuration with one 16-byte key in 2018.


The image and table below illustrate TClient’s encrypted configuration that we decrypted (via Python code):  Figure 10.


Snapshot of code we used to decrypt TClient’s configuration Figure 11.


Encrypted backdoor configuration


Description Decryption Strings


Proxy: 0


Figure 12.


Decrypted backdoor configuration


Reverse analysis of TClient allowed us to determine how to decrypt the C&C information.


TClient will use custom SSL libraries to connect the C&C server.


Figure 13.


The TSSL project has 64-bit version.


TClient, for instance, uses DLL hijacking and injection that may not be as noticeable to others.


The vulnerabilities that Tropic Trooper’s campaigns have been patched last January, for instance.


Disable or secure the use of system administration tools such as PowerShell and other command-line tools that may be abused.


Nurture a culture of cybersecurity.


Spear-phishing emails, for instance, rely on baiting targets with socially engineered documents.


Indicators of Compromise (IoCs) Related Hashes (SHA-256): Detected as CVE-2018-0802.ZTFC:  1d128fd61c2c121d9f2e1628630833172427e5d486cdd4b6d567b7bdac13935e  BKDR_TCLT.ZDFB:  01087051f41df7bb030256c97497f69bc5b5551829da81b8db3f46ba622d8a69  BKDR64_TCLT.ZTFB:  6e900e5b6dc4f21a004c5b5908c81f055db0d7026b3c5e105708586f85d3e334  TROJ_SCLT.ZTFB:  49df4fec76a0ffaee5e4d933a734126c1a7b32d1c9cb5ab22a868e8bfc653245  TROJ_TCDROP.ZTFB:  b0f120b11f727f197353bc2c98d606ed08a06f14a1c012d3db6fe0a812df528a d65f809f7684b28a6fa2d9397582f350318027999be3acf1241ff44d4df36a3a 85d32cb3ae046a38254b953a00b37bb87047ec435edb0ce359a867447ee30f8b  TROJ_TCLT.ZDFB:  02281e26e89b61d84e2df66a0eeb729c5babd94607b1422505cd388843dd5456 fb9c9cbf6925de8c7b6ce8e7a8d5290e628be0b82a58f3e968426c0f734f38f6  URLs related to C&C communication:  qpoe[.]com wikaba[.]com tibetnews[.]today dns-stuff[.]com 2waky[.]com         Tags  Network | APT & Targeted Attacks | Research


The five individuals were reportedly connected to the hacking group known as APT41.


Justice officials say that the group's intrusions allowed the hackers to steal source code, customer account data, and personally identifiable information (PII).


This is not the first time that APT41 activities have been scrutinized — the group has been active for some time.


Just last May, Trend Micro connected the group to ransomware attacks on Taiwanese organizations.


The attack chain of ransomware incidents in Taiwan


The ransomware attack chain is outlined in Figure 1; however, we currently do not know the initial arrival vector of this threat into a potential victim's network.


After logging in to the active directory server, the threat actor modifies the active directory server group policy object — this includes a request that all domain account members create a scheduled task and execute the malware.


In the final step, the other subsidiary active directory servers and all the endpoint machines will download the scheduled task and execute the ransomware.         Figure.1 The attacker uses an Active Directory (AD) scheduled task to deploy the ransomware in the customer environment.


Scheduled tasks play a very important role in this incident.


The threat actors use a scheduled task command to spread and infect a victim's environment.


The screenshot in Figure 2 shows how the threat actor uses SMB and internal IIS Web Service to copy "lc.tmp" (the main ransomware loader in this incident) to other victims' host machines.


After that, the PowerShell command executes the main ransomware loader.


Figure 2.


How a scheduled task delivers the malware to a victim's environment


The loaders decrypted the next-stage payloads, which were either embedded inside itself or stored on the disk as separate files.


The next-stage payloads were CobaltStrike in this series of incidents.


More than just a single occurrence


Possible link to Chinese espionage


The C&C server 104[.]233[.]224[.]227 was hosted under a small hosting service with only 64 IPs under it.


To help defend users against APT41 specifically, we have developed an assessment tool that can scan endpoints for file-based indicators collected from global intelligence sources.


Indicators of Compromise  SHA 256                                          Malware Family 2367326f995cb911c72baadc33a3155f8f674600 NTDSDump 75e49120a0238749827196cebb7559a37a2422f8 COLDLOCK 5b9b7fb59f0613c32650e8a3b91067079bcb2fc2 COLDLOCK e7aa8f55148b4548ef1ab9744bc3d0e67588d5b7 COLDLOCK ad6783c349e98c2b4a8ce0b5c9207611309adca7 COBALTSTRIKE 29cc0ff619f54068ce0ab34e8ed3919d13fa5ee9 COLDLOCK 2051f0a253eced030539a10ebc3e6869b727b8a9 COLDLOCK a2046f17ec4f5517636ea331141a4b5423d534f0 COLDLOCK 03589dffe2ab72a0de5e9dce61b07e44a983d857 COBALTSTRIKE 9d6feb6e246557f57d17b8df2b6d07194ad66f66 COLDLOCK 28d172e374eebc29911f2152b470528fc695662e PWDDUMPER 574fb6a497c032f7b9df54bc4669d1eb58d78fb4 ASPSHELL  *One of the sources for this table is the original report from the U.S. Justice Department     Tags  Latest News | APT & Targeted Attacks | Endpoints | Cyber Crime | Network | Articles, News, Reports


Like previous websites we’ve seen set up by this actor, this website has a link to their PGP public key at the bottom of the page.


We encourage anyone who discovers a Chrome vulnerability to report that activity through the Chrome Vulnerabilities Rewards Program submission process.


Email:


Attacker Owned Domains:


To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild.


If the link was not active, the user was redirected directly to a legitimate website.


We assess that these campaigns delivered ALIEN, a simple Android malware in charge of loading PREDATOR, an Android implant described by CitizenLab in December 2021.


ALIEN lives inside multiple privileged processes and receives commands from PREDATOR over IPC.


We did not capture the subsequent stages, but assess the attackers did not have exploits for the current version of Chrome (91.0.4472) at that time, but instead used n-day exploits targeting Samsung Browser, which was running an older and vulnerable version of Chromium.


Related IOCs


We recovered the exploit used to escape the Chrome Sandbox, but not the initial RCE exploit.


We haven’t retrieved a copy of the exploit.


We would also like to thank Project Zero for their technical assistance in helping analyze these bugs.


We remain committed to updating the community as we uncover these campaigns.


We look forward to continuing our work in this space and advancing the safety and security of our users around the world.


NOTE: On May 20th, we updated our attribution to more precisely describe our findings.


Since our last update, TAG has observed a continuously growing number of threat actors using the war as a lure in phishing and malware campaigns.


As always, we continue to publish details surrounding the actions we take against coordinated influence operations in our quarterly TAG bulletin.


The data is then exfiltrated via email to a compromised email account.


Malware samples:


TAG would like to thank the Yahoo! Paranoids Advanced Cyber Threats Team for their collaboration in this investigation.


Recently observed Turla domains: COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts.