&nbsp; [Lightly edited transcript of the video above] Hi there, Mark Nunnikhoven from Trend Micro Research, I want to talk to you about the concept of lateral movement.


And the reason why I want to tackle this today is because I've had some conversations in the last few days that have really kind of hit that idea bulb that people don't truly understand how cybercriminals get away with their crimes in the organization.


Specifically how they launch their attacks


Now don't get me wrong, this isn't to blame on defenders.


This isn't to blame of the general public.


I'm going to go with Hollywood's to blame a little bit here, because we're watching movies in Hollywood inevitably…you know the hackers in their dark hat and with no lighting, underground, Lord knows where they find these places to hack from and they are attacking directly through.


You see a bunch of text go across the screen and they penetrate through the first firewall, through the second firewall in into the data.


That's not how it works at all.


That's ridiculous.


It's absurd.


[00:59] It makes for interesting cinema, just like the red code/green code in CSI Cyber, but it's not a reflection of reality and that's a real challenge.


Because a lot of people don't have the experience of working with cybersecurity, working in cybersecurity, so their only perception is what they see either through media—you know TV, movies, books—or if they happen to run into somebody at in the industry.


So there is an overwhelming amount of sort of information or misinformation.


Not even misinformation, just storytelling that tries to make it far more dramatic than it is.


The reality is that cybercriminals are out for profit.


We know this time and time again—yes a bunch of nation-state stuff does happen but the vast majority of you are unaffected by it same with there's a massive amount of script-kiddie just sort of scanning random people with random tools that are just seeing what they can get away with that and if you have solid, automated defenses that doesn't really impact you.


What does impact you is the vast majority of organized cybercriminals who are out to make a profit.


Trend Micro had a great series and continues to have a great series on the Underground, the Digital Underground that shows just how deep these profit motivations go.


This is very much a dark industry.


And with that in mind we come back to the concept of lateral movement.


[02:22] If an attacker breaches into your systems, whether they come in like a fourth of all attacks do via email whether they come in directly through a server compromise, which is about half of all breaches according to the Verizon data breach investigation report or one of the other methods that is commonly used…then they start to move around within your network.


That's lateral movement.


We talk about north/south traffic with the network, which is basically inside the network to outside of the network, so out to the the internet and back.


East/west is within the network itself.


Most defenses, traditional defenses worry about that north/south traffic.


Not enough worry about the east/west and it's breaking down finally.


We are getting rid of this hard perimeter.


"It's mine, I defend everything inside" …and realizing that this is actually how cybercriminals work.


Once they're inside they move around.


So we need to defend in-depth and have really great monitoring and protection tools within our networks because of this challenge of lateral movement.


[03:23] Let me give you a little easier to digest analogy.


Most of us in a home have a grocery list and maybe once a week—maybe twice–we head to the grocery store and we try to get everything we want off the list and then we come back.


That just makes sense.


That's how we do it.


Right?


You would never think of going, "Okay.


Number one of the list is ketchup.


I'm going to drive to the store to get ketchup.


I'm going to buy it and I'm going to come back home.


I'm going to look at item number two.


I need a loaf of bread.


I'm going to drive back to the store.


I'm going to buy a loaf of bread and I'm going to come back and we can go to item 3, and I'm going to go and I'm going to come back.


I'm going to..."


That's just ridiculous, right?


That's absolutely absurd and cybercrimals agree.


Once they've driven to the store.


They're going to buy everything that they need and everything that they see as an opportunity, right?


They are really susceptible to those end caps and impulse buys... and then they're going to leave.


This is how they attack our organizations.


We know that, because of the average time to detect a breach is around 197 days right now and that stat has fluctuated maybe plus or minus 15 days for the last decade.


We also know that it takes almost three…it takes two and a half to three months actually contain a breach once you discover it and the reason for all of this is lateral movement.


Once you're in as a cybercriminal, once you've made headway, once you gained a beachhead or a foothold within that network you're going to do everything you can to expand it because it's going to make you the most amount of money.


[04:55] What do you think?


Let us know in the comments below, hit us up on social @TrendMicro or you can reach me directly @marknca.


How are you handling lateral movement?


How are you trying to reduce it?


How are you looking for visibility across all of your systems?


Let's continue this conversation because when we talk we all get better and more secure online.


Tags  Cloud | APT & Targeted Attacks | Cyber Crime | Expert Perspective | Network | Articles, News, Reports


By Federico Maggi, Rainer Vosseler (Trend Micro Research), Mars Cheng, Patrick Kuo, Chizuru Toyama, Ta-Lun Yen (TXOne Networks), Erik Boasson (ADLINK), and Victor Mayoral Vilches (Alias Robotics)


Despite being unknown even to industry practitioners, the Data Distribution Service (DDS) protocol has been in use for more than a decade.


This middleware software technology is responsible for running billions of public and private devices and mechanisms currently in use.


DDS is integral in embedded systems that require real-time machine-to-machine communication, facilitating a reliable communication layer between sensors, controllers, and actuators.


This technology is situated at the beginning of the supply chain as a layer that connects, controls, and monitors applications, sensors, and actuators, aimed at maintaining interoperability and fault tolerance.


It is used in various critical sectors such as healthcare, transportation, industrial internet of things (IIoT), robotics, aeronautics, and the military, among others.


Given these factors, this makes the middleware technology an attractive target for attackers.


We analyzed this software and found multiple security vulnerabilities.


This blog lists 13 identified security gaps that were assigned new CVE IDs found in the six most common DDS implementations, mostly concerning deployment.


We also show a preview of the security gaps we found in the standard’s specification and a summary of our testing procedure.


For details on the known vulnerabilities, attack scenarios, and research methodology, read our full paper “A Security Analysis of the Data Distribution Service (DDS) Protocol.”


All the vulnerabilities found have been disclosed and patched or mitigated by their respective vendors.


New vulnerabilities


We studied six widely used DDS implementations, chosen based on executions’ number of users and customers in the critical sectors globally.


We also looked at each implementation’s real-time publish-subscribe (RTPS) packet, as DDS is dependent on its own lower layer standard protocol.


Notably, we also studied the Robot Operating System 2 (ROS 2) because it uses DDS as its default standard operating system (OS) middleware for all robotics and automation use cases.


Given the service’s position as a security and operations building block, all vulnerabilities that affect DDS also affect the rest of the software stack, such as RTPS and all ROS 2 instances.


Product Name


Developer HQ Region Open Source


Core Language Year Developed Fast-DDS eProsima EMEA Apache License 2.0 C++ 2014 Cyclone DDS Eclipse Foundation project, driven by ADLINK EMEA Eclipse Public License 2.0 and Eclipse Development License 1.0 C 2011 OpenDDS OCI NABU Custom C++ 2005 Connext DDS RTI NABU Extensions are open source C++ 2005 (NDDS – 1995) CoreDX DDS TwinOaks NABU Not open source C 2009 Gurum DDS GurumNetworks APAC Not open source C    Table 1.


A list of all DDS implementations analyzed for this research.


MITRE ATT&CK ICS Attack Surface Vector CVE Scope CVSS Weaknesses (CWE) T0804:


Brute Force I/O T0814: DoS T0827: Loss of Control T0880: Loss of Safety T0802: Automated Collection T0846: Remote System Discovery T0856: Spoof of Reporting Message


Network RTPS discovery packet CVE-2021-38425 Fast-DDS, ROS 2 7.5 CWE-406: Network amplification CVE-2021-38429 OpenDDS, ROS 2 7.5 CVE-2021-38487 Connext DDS, ROS 2 7.5 CVE-2021-43547 CoreDX DDS, ROS 2 7.5 Malformed RTPS packet CVE-2021-38447 OpenDDS, ROS 2 8.6 CWE-405:


Network amplification CVE-2021-38445 OpenDDS, ROS 2 7.0 CWE-130: Improper handling of length CVE-2021-38423 Gurum DDS, ROS 2 8.6 CWE-131: Incorrect calculation of buffer size CVE-2021-38435 Connext DDS, ROS 2 8.6 CVE-2021-38439 Gurum DDS, ROS 2 8.6 CWE-122:


Heap-based buffer overflow T0862: Supply Chain Compromise T0839: Module Firmware T0873: Project File Infection


Configuration XML file CVE-2021-38427 Connext DDS, ROS 2 6.6 CWE-121: Stack-based buffer overflow CVE-2021-38433 Connext DDS, ROS 2 6.6 CVE-2021-38443 Cyclone DDS, ROS 2 6.6 CWE-228: Improper handling of syntactically invalid structure CVE-2021-38441 Cyclone DDS, ROS 2 6.6 CWE-123:


Write-what-where condition  Table 2.


A summary of our findings across the main DDS implementations and standard specification.


When the security gaps on the network attack surface are exploited, it allows an attacker to perform spoofing, reconnaissance, automated data collection, and denial of service (DoS), affecting the control of an exposed system.


Meanwhile, the vulnerabilities we found on the configuration attack surface can be abused to affect the DDS developer or system integrator, potentially compromising the integrity of the software supply chain.


Vulnerabilities in the standard specification


The built-in RTPS discovery protocol is used in peer-to-peer networks to discover the locator of each participant (such as IP address and UDP/TCP port or offset in shared memory).


The “chatty” nature of this discovery protocol and the fact that it expects a reply from each contacted participant, paired with easy-to-spoof transport protocols such as the User Datagram Protocol (UDP), make RTPS vulnerable to network reflection and amplification.


Confidentiality and authenticity for this data is not protected even with DDS Security, making it possible for an attacker to spoof the information.      CVE ID


Scope


Partially Mitigated*


BAF Percentage of Attack Duration (Total experiment duration = 139s)  CVE-2021-38425 Fast-DDS, ROS 2 master branch 9.875 100.0 CVE-2021-38429 OpenDDS, ROS 2 >= 3.18.1 18.68 24.17 CVE-2021-38487


Connext DDS, ROS 2 >= 6.1.0 2.011 84.17 CVE-2021-43547 CoreDX DDS, ROS 2 > 5.9.1 32.82 18.14  Table 3.


The network reflection and amplification vulnerability with bandwidth amplification factor (BAF) is calculated as the ratio between outbound and reflected traffic.


Note: Implementations with less than 100% attack duration likely have a timeout mechanism.


(*) A full mitigation will require relevant changes in the RTPS specification.


The longest running node was based on Connext DDS (at 139 seconds), which we kept as a reference.


Table 3 shows that the BAF is greater than one, implying there are asymmetric network flows although the values are at the order of magnitude lower than modern amplification attacks (note that Memcached can reach 10,000 to 51,000 BAF).


However, the network bandwidth in embedded systems is also lower than, for example, what internet nodes can provide.


An attacker can abuse this built-in discovery feature for remote discovery and fingerprinting.


We sent RPTS discovery probes to the entire IPv4 space (except for the no-scan subnets) and received answers from 643 hosts (excluding obvious honeypots).


Notably, hosts never stopped sending traffic to us, even if we only sent them a single 288-byte packet.


This new network-reflection vulnerability that we found is not the only instance of a specification-level vulnerability.


Security researchers from different organizations have been documenting and creating attack scenarios abusing these vulnerabilities as early as 2015.


Conclusion


Proper supply chain management processes allow contextualization, tracking, and monitoring of new vulnerabilities within different downstream software using a specific library such as DDS.


In the case of this middleware technology, DDS is just one of the many critical libraries used in embedded applications that’s easy to lose track of.


Our paper, “A Security Analysis of the Data Distribution Service (DDS) Protocol,” includes short- and long-term mitigation best practices and recommendations, as well as a consideration for adopting a shift-left approach.


We also acknowledge the cooperation and engaging response that some vendors like ADLINK have adopted when we approached them with our findings.


As we encourage more DDS researchers, users, and implementors to keep on studying and promoting security awareness for the DDS ecosystem, we hope the level of engagement we received can serve as a model for the software industry.


Download our full paper here.


Tags  Exploits & Vulnerabilities | Research | Cyber Threats | ICS OT | APT & Targeted Attacks | Compliance & Risks | IoT | Articles, News, Reports


Android malware like ransomware exemplify how the platform can be lucrative for cybercriminals.


But there are also other threats stirring up as of late: attacks that spy on and steal data from specific targets, crossing over between desktops and mobile devices.


These were published on Google Play — but have since been taken down — and third-party app marketplaces.


We named these malicious apps AnubisSpy (ANDROIDOS_ANUBISSPY) as all the malware’s payload is a package called watchdog.


We construe AnubisSpy to be linked to the cyberespionage campaign Sphinx (APT-C-15) based on shared file structures and command-and-control (C&C) server as well as targets.


It’s also possible that while AnubisSpy’s operators may also be Sphinx’s, they could be running separate but similar campaigns.


What can AnubisSpy do?


AnubisSpy can steal messages (SMS), photos, videos, contacts, email accounts, calendar events, and browser histories (i.e., Chrome and Samsung Internet Browser).


It can also take screenshots and record audio, including calls.


It can spy on the victim through apps installed on the device, a list of which is in its configuration file that can be updated.


This includes Skype, WhatsApp, Facebook, and Twitter, among others.


After the data are collected, they are encrypted and sent to the (C&C) server.


AnubisSpy can also self-destruct to cover its tracks.


It can run commands and delete files on the device, as well as install and uninstall Android Application Packages (APKs).


AnubisSpy has several modules, each of which has a separate role.


AnubisSpy’s code is well constructed, indicating the developer/s’ know-how.


Below is a visualization of the modules: Figure 1: Structure of AnubisSpy’s modules


How is AnubisSpy related to Sphinx?


Sphinx reportedly uses the watering hole technique via social media sites to deliver its payloads — mainly a customized version of njRAT.


The Sphinx campaign operators cloaked the malware with icons of legitimate applications to dupe recipients into clicking them.


Sphinx was active between June 2014 and November 2015, but timestamps of the malware indicate the attacks started as early as 2011.


A simple WHOIS query of AnubisSpy’s C&C server showed it abused a legitimate managed hosting service provider in Belize.


We correlated the AnubisSpy variants to Sphinx’s desktop/PC-targeting malware through the following:  Shared C&C server, 86[.]105[.]18[.]107 Shared technique of decrypting JSON files, and similarity between the file structures of AnubisSpy and Sphinx’s malware Similar targets (highly concentrated in Middle Eastern countries)     Figure 2: Comparison of file structure in Sphinx’s desktop/PC-targeting malware (left) and AnubisSpy (right)


Our coordination with Google also revealed that these apps were installed across a handful of countries in the Middle East.


Was AnubisSpy actively distributed?


We analyzed seven apps that were actually AnubisSpy.


These were signed with the same fake Google certificates.


We found two more apps created by the same developer, but they had no espionage-related codes; we think they were made as experimental projects.


Based on hardcoded strings in the Agent Version, the malicious apps were developed as early as April 2015.


Timestamps indicate that the earliest sample was signed on June 2015; the latest variant was signed on May 2017.


AnubisSpy wasn’t only published on Google Play.


We also found versions of it in third-party app marketplaces, most likely as a way to expand the malware’s reach.


The apps mainly used Middle East-based news and sociopolitical themes as social engineering hooks and abused social media to further proliferate.


Versions of AnubisSpy posed as social news, promotional, healthcare, and entertainment apps.


What does AnubisSpy mean to the mobile landscape?


Persistent and furtive spyware is an underrated problem for the mobile platform.


While cyberespionage campaigns on mobile devices may be few and far between compared to ones for desktops or PCs, AnubisSpy proves that they do indeed occur, and may have been more active than initially thought.


Will mobile become cyberespionage’s main frontier?


It won’t be a surprise given mobile platform’s increasing ubiquity, especially in workplaces.


Beyond its effects, AnubisSpy also highlights the significance of proactively securing mobile devices, particularly if they’re on BYOD programs and used to access sensitive data.


Enforcing the principle of least privilege and implementing an app reputation system are just some of the best practices that can help mitigate threats.


We disclosed our findings to Google on October 12 and worked with Google on further analyzing the AnubisSpy-related apps.


Updates were also made to Google Play Protect to take appropriate action against those apps that have been verified as in violation of Google Play policy.


An in-depth technical analysis of AnubisSpy, along with indicators of compromise, is in this technical brief.


Trend Micro Solutions End users and enterprises can also benefit from multilayered mobile security solutions such as Trend Micro™ Mobile Security which is also available on Google Play.


For organizations, Trend Micro™ Mobile Security for Enterprise provides device, compliance and application management, data protection, and configuration provisioning, as well as protects devices from attacks that leverage vulnerabilities, preventing unauthorized access to apps, as well as detecting and blocking malware and fraudulent websites.


Trend Micro’s Mobile App Reputation Service (MARS) covers Android and iOS threats using leading sandbox and machine learning technologies.


It can protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerability.


Tags  Malware | APT & Targeted Attacks | Endpoints | Research |


Mobile


With additional insights from Philippe Z Lin Note: This article has been updated on March 17, 2022, 2:00 a.m. ET to include Asus’ security bulletin.


Cyclops Blink, an advanced modular botnet that is reportedly linked to the Sandworm or Voodoo Bear advanced persistent threat (APT) group, has recently been used to target WatchGuard Firebox devices according to an analysis performed by the UK’s National Cyber Security Centre (NCSC).


We acquired a variant of the Cyclops Blink malware family that targets Asus routers.


This report discusses the technical capabilities of this Cyclops Blink malware variant and includes a list of more than 150 current and historical command-and-control (C&C) servers of the Cyclops Blink botnet.


This list aims to aid cybersecurity defenders in searching for affected devices in their networks and starting the remediation process.


We have reached out to Asus regarding our investigation, and they have created a security bulletin that includes a security checklist to help prevent Cyclops Blink attacks, as well as a list of affected Asus products.


Our data also shows that although Cyclops Blink is a state-sponsored botnet, its C&C servers and bots affect WatchGuard Firebox and Asus devices that do not belong to critical organizations, or those that have an evident value on economic, political, or military espionage.


Hence, we believe that it is possible that the Cyclops Blink botnet’s main purpose is to build an infrastructure for further attacks on high-value targets.


Cyclops Blink has been around since at least June 2019, and a considerable number of its C&C servers and bots are active for up to about three years.


The Sandworm APT group has been attributed as creating both Cyclops Blink and the VPNFilter internet of things (IoT) botnet.


VPNFilter, first discovered in 2018, targeted router and storage devices.


It was also reported to have infected hundreds of thousands of devices.


In 2021, Trend Micro published a technical analysis of VPNFilter, which includes a discussion of how the botnet continues to affect infected systems two years after its discovery.


Sandworm was also responsible for many high-profile attacks, including the 2015 and 2016 attacks on the Ukrainian electrical grid, the 2017 NotPetya attack, the 2017 French presidential campaign, the 2018 Olympic Destroyer attack on the Winter Olympic Games, and a 2018 operation against the Organization for the Prohibition of Chemical Weapons (OPCW).  Cyclops Blink malware analysis  Cyclops Blink is a modular malware written in the C language.


In its core component, the first thing that the malware does is to check if its executable file name starts with "[k".


If it does not, it performs the following routine:   It redirects both stdout and stderr file descriptors to /dev/null.


It sets the default handlers for SIGTERM, SIGINT, SIGBUS, SIGPIPE, and SIGIO signals.


It reloads itself with a new "[ktest]" process name.


It then waits for 37 seconds before it sets up its hard-coded parameters.


These include the hard-coded C&C servers and the interval that should be used to communicate with the C&C servers.


It also creates a pipe for inter-process communication (IPC) by calling the pipe() function for getting two file descriptors for reading and writing data.


It also enables non-blocking I/O for the writing file descriptor by using ioctl().


After this, a new data packet will be created in memory, which will then be sent to a C&C server.


The details of this communication are covered later in this analysis.


For every hard-coded TCP port used to communicate with the C&C servers, the malware creates a rule in Netfilter — the Linux kernel firewall — using the iptc_insert_entry() function from libiptc1 to allow output communication to it.


The rules have the following parameters:  Protocol: TCP Chain: filter Table: OUTPUT Action: ACCEPT


Destination ports: 636, 994, and 995


For an unknown reason, the malware deletes the aforementioned rules and creates them again, this time using the iptables command via the system() function.


The commands are as follows:  iptables -D OUTPUT -p tcp --dport %d -j ACCEPT   iptables -I OUTPUT -p tcp --dport %d -j ACCEPT


The OpenSSL library is then initialized, and the core component proceeds to initialize the hard-coded modules.


Modules initialization


During this part, the core component initializes the modules.


Communication with the modules is performed via pipes.


For each hard-coded module, the malware creates two pipes before executing them in their own child processes.


Figure 1.


The function that initializes the modules      In Figure 1, we inferred the following mod_t structure:      Figure 2.


Inferred mod_t structure; the last member is unknown.


Parameters


The parameters are then initialized.


They consist of a 592-byte structure containing essential information sent to the modules via pipes.


This information includes:  A “<p: ” string header   The pipe of the core component   All C&C IP addresses and ports   The local IP address   An interval for C&C server communication   When the next packet to be sent to a C&C server is   The main process PID   A hard-coded ID (we saw 0xA08F078B, 0xBD0A5B36, and 0xA244E5E2)   The parameters are pushed to the modules, which are initialized at this point.    C&C communication


After obtaining data from the modules, the core component starts the encryption routines that will cipher the data before sending it to the C&C server.


Encryption Cyclops Blink encrypts data using OpenSSL functions that should be available in the infected device as they are dynamically loaded.


The data is encrypted using AES-256 in cipher block chaining (CBC) mode with a randomly generated 256-bit key and 128-bit initialization vector (IV).


It is then encrypted using a hard-coded RSA-2560 (320-bit) public key unique to each sample.


The malware authors decided to use the EVP_SealInit() function.


This function performs all of the aforementioned encryption steps, including the random AES key and IV generation.


The C&C server must have the corresponding RSA private key to decrypt the data.


After encryption, if the total packet length is greater than 98,303 bytes, the packet is sent.


Data transferring


To send data to the C&C server, the core component performs a TLS handshake with a randomly chosen C&C server at a random TCP port, both of which are from a hard-coded list.


After choosing an IP address and a TCP port pair, the core component creates a child process to perform the communication.


The child process will connect to the C&C server and write four bytes to the SSL socket.


These four bytes are the packet size that it wants to send.


Figure 3.


The child process writes four bytes to the SSL socket.


The server must reply with an exact four-byte answer, which is the victim's IPv4 address.


10 bytes are then written to the core component pipe.


The data follows a specific format.


For example:   Packet length Target module Command Data (victim's IPv4 address) 00 00 00 0a 00 07 c0 a8 00 01


The core component then receives more data from the C&C server.


This time, it expects an encrypted packet to be decrypted using the hard-coded RSA-2560 public key.


The malware expects a response where the first four bytes are the size of the packet followed by the encrypted data.


Figure 4.


Core component code that receives and decrypts data from the C&C server      If something is received, it is decrypted and written to the main pipe.


For decryption, the malware uses the RSA_public_decrypt() function, which decrypts data encrypted with a corresponding private key, leveraging the “reversibility” of the RSA encryption algorithm.


Finally, a variable containg the next time a packet should be sent is updated and all of the parameters are sent to the modules again.


This is because the core component can receive new parameters from the C&C servers.


Commands


The data received from the C&C servers comprises either commands to the core component itself or to one of its modules.


First, the core component sends the supported commands to the C&C server and then enters in a loop where it expects one of the commands.


If a command targets the core component, it can be one of the following:   Command ID Action 0 Terminates the program 1 Bypasses the data-sending interval and sends data to C&C servers immediately 2 Adds a new C&C server to the list in memory 3 Sets time to send the next packet to the C&C server 4 Sets time to send the next packet to the C&C server 5 Adds a new module (an ELF file should be received following the command)


6 Reloads the malware 7 Sets the local IP address parameter 8 Sets a new worker ID 9 Sets an unknown byte value 10 Resends configuration to all running modules  Modules Asus (0x38)  This module can read and write from the devices' flash memory.


The flash memory is used by these devices to store the operating system, configuration, and all files from the file system.


Our research was carried out on the RT-AC68U, but other Asus routers such as RT-AC56U might be affected as well.


It’s important to note, however, that since the malware is modular in nature, it can be easily recompiled to target any other device.


The samples we’ve obtained work in the conditions mentioned in this report, but the malware actors seem ready to target any other router model or brand.


In fact, this is what they have done with WatchGuard — it’s the same code, but it has been recompiled for the brand.  First, the module examines the content /proc/mtd file, which provides general information about the devices’ Memory Technology Device (MTD) subsystem.


The MTD provides an abstraction layer to access the device's flash memory.


The malware looks for the strings “linux” and “rootfs” and reads it using a printf()-like format:      Figure 5.


The module looks for “linux” and “rootfs” strings      The inferred mdt_data_t structure is as follows:      Figure 6.


The mtd_data_t structure      The data is read to this structure.


The content of /proc/mtd for an Asus RT-AC68U device is as follows:      Figure 7.


Typical /proc/


mtd


from an Asus RT-AC68U router


Therefore, for the case here, the malware would open /dev/mtd2, which is the partition where the Linux kernel image is stored.


Why the malware authors decided to read either “linux” or “rootfs” partition is unclear.


Based on our knowledge, they have quite different purposes.


While the first holds the operating system, the second stores programs’ critical files, such as executables, data, and libraries.


Cyclops Blink reads 80 bytes from the flash memory, writes it to the main pipe, and enters a loop to wait for a command to replace the partition content:      Figure 8.


Asus module main loop     If the data coming from the core component starts with “<p:”, it means that it is a parameter for this module and 80 bytes will be written to the flash memory, effectively replacing its content.


The writing is done by the j_save_data() function.


It does this by correctly erasing the NAND eraseblocks first via ioctl() calls, and then writing the new content to them, as the following image shows:      Figure 9.


Cyclops


Blink


Asus module code for writing to raw flash memory      As the flash memory content is permanent, this module can be used to establish persistence and survive factory resets.


Although it cannot be used as proof of attribution, the preceding code reminded us of a routine from the third-stage code of VPNFilter’s process called “dstr” that was intended to “brick” the infected device.


Apart from deleting many important files and even trying to delete the whole root file system, this particular VPNFilter stage also writes many 0xff bytes to the raw flash memory:


Figure 10. VPNFilter “dstr” third-stage code for writing to raw flash memory      System reconnaissance (0x08) This module is responsible for sending information from the infected device to the C&C server.


The following data is obtained from an infected device:    The Linux version, which the module gets by calling the uname() function and /etc/issue file   Information about the device’s memory consumption, which it gets by calling the sysinfo() function   The SSD storage information, which it gets by calling the statvfs() function  The content of the following files:  /etc/passwd /etc/group   /proc/mounts  /proc/partitions     Information about the network interfaces, which it gets by calling the if_nameindex() and iotctl() functions with the SIOCGIFHWADDR and SIOCGIFADDR commands.


File download (0x0f) This module can download files from the internet.


The DNS resolution is performed using DNS over HTTPS (DoH).


The malware sends an HTTP POST request to a Google DNS Server (8.8.8.8) using the following headers:      Figure 11.


HTTP POST request over SSL for DNS resolution      This module seems to be an earlier version of the same module (0x0f) that is used by the Cyclops Blink variant reported by NCSC.


The main differences between the modules are as follows:    This module does not have an upload feature.    The 0x1 bit in the control flags is used in this module to specify if the download should be done via HTTPS.  Infrastructure


We have been able to determine that the botnet of Cyclops Blink infected routers from both compromised WatchGuard devices and Asus routers.


These compromised devices periodically connect to C&C servers that are themselves hosted on compromised WatchGuard devices.


We have evidence that the routers of at least one vendor other than Asus and WatchGuard are connecting to Cyclops Blink C&Cs as well, but so far we have been unable to collect malware samples for this router brand.


The botnet of Cyclops Blink has been around for some time.


Using historical data of internet-wide scans and SSL certificate data, it is likely that Cyclops Blink dates back to at least June 2019.


Since June 2019, the actor has issued more than 50 SSL certificates that were used on WatchGuard C&Cs on various TCP ports (as far as we are aware, the following TCP ports were used: 636, 989, 990, 994, 995, 3269, and 8443).


In Appendix A, we have listed both the live and inactive C&Cs used by Cyclops Blink for the benefit of network defenders.


We have observed that some of the WatchGuard and Asus bots were never cleaned up because these routers still try to connect periodically to old C&Cs that were secured or taken offline.


Figure 12.


The timeline of several SSL certificates that were issued for Cyclops Blink C&Cs      Our investigation shows that there are more than 200 Cyclops Blink victims around the world.


It should be noted that these victims do not appear to be evidently valuable targets for either economic, military, or political espionage.


This is in line with the increasing number of brute-force attacks performed by other APT groups such as Pawn Storm, a group that has compromised numerous assets like email addresses and email servers of targets that are typically not aligned with Pawn Storm’s objectives.


Just like Pawn Storm, Sandworm is fishing with a wide net or looking to compromise assets on a larger scale.


Figure 13.


The number of months that Cyclops Blink C&Cs have been live; it is important to note that live C&Cs during the time of reporting have been included.


Conclusion and security recommendations


Over the past few years, IoT attacks have been escalating globally and internet routers have been one of the primary targets.


There are several reasons that these devices are favored by an attacker — the infrequency of patching, the lack of security software, and the limited visibility of defenders.


Combined, these allow for the possibility of what we refer to as "eternal botnets."


Once an IoT device is infected with malware, an attacker can have unrestricted internet access for downloading and deploying more stages of malware for reconnaissance, espionage, proxying, or anything else that the attacker wants to do.


The underlying operating systems for the majority of IoT devices is Linux, which is also used by many powerful systems tools.


This can allow attackers to add anything else that they might need to complete their attacks.


In the case of Cyclops Blink, we have seen devices that were compromised for over 30 months (about two and a half years) in a row and were being set up as stable C&C servers for other bots.


The NCSC report covered malware targeting a specific vendor, namely WatchGuard.


Based on our previous analysis of VPNFilter, we assumed that there were more vendors being attacked by this group.


The vendors that were targeted by VPNFilter were Asus, D-Link, Huawei, Linksys, MikroTik, Netgear, QNAP, TP-Link, Ubiquiti, UPVEL, and ZDE.


In the case of Cyclops Blink, we received samples targeting Asus routers that were not previously reported on.


The Asus version of the Cyclops Blink malware that we have analyzed showed some differences compared to the WatchGuard versions that have been previously discussed.


The samples that we have analyzed are compiled for ARM and are dynamically linked against uClibc.


They also contain a module that specifically targets Asus routers.


Asus is likely only one of the vendors that is currently being targeted by Cyclops Blink.


We have evidence that other routers are affected too, but as of reporting, we were not able to collect Cyclops Blink malware samples for routers other than WatchGuard and Asus.


Looking into the malware and the infrastructure being used by Cyclops Blinks actors gives us some clues about the other vendors that might be affected and how widespread this malware is.


By sharing this additional technical observation, we aim to help network defenders, as well as those likely to be targeted by APT groups (such as Sandworm), gain a more complete picture of the Cyclops Blink campaign.


Based on our observation, we strongly believe that there are more targeted devices from other vendors.


This malware is modular in nature and it is likely that each vendor has different modules and architectures that were thought out well by the Cyclops Blink actors.


Moreover, the purpose of this botnet is still unclear: Whether it is intended to be used for distributed denial-of-service (DDoS) attacks, espionage, or proxy networks remains to be seen.


But what is evident is that Cyclops Blink is an advanced piece of malware that focuses on persistence and the ability to survive domain sinkhole attempts and the takedown of its infrastructure.


The APT group behind this malware has learned from its VPNFilter campaigns and continues to attack IoT devices such as routers.


In the age of work-from-home (WFH) during the pandemic, it’s possible that espionage is part of the reason that IoT devices are still major targets for advanced attackers.


The more routers are compromised, the more sources of powerful data collection — and avenues for further attacks — become available to attackers.


Having a distributed infrastructure also makes it more difficult for cybersecurity teams to take down the whole attack.


This is also why, after more than two years, there are still live VPNFilter hosts out there.


Organizations can protect themselves from Cyclops Blink attacks by using strong passwords and re-examining their security measures.


It is also important to ensure that only the services that absolutely need to be exposed to the internet are exposed.


Access to these services should be limited, which can be achieved by configuring a virtual private network (VPN) that can access those services remotely.


It’s also important to set reminders to check if devices such as routers, cameras, network-attached storage (NAS) devices, and other IoT devices have been patched or otherwise.


If it is suspected that an organization’s devices have been infected with Cyclops Blink, it is best to get a new router.


Performing a factory reset might blank out an organization’s configuration, but not the underlying operating system that the attackers have modified.


If a particular vendor has firmware updates that can address a Cyclops Blink attack or any other weakness in the system, organizations should apply these as soon as possible.


However, in some cases, a device might be an end-of-life product and will no longer receive updates from its vendor.


In such cases, an average user would not have the ability to fix a Cyclops Blink infection.


While the Cyclops Blink malware variant that we analyzed in this report is complicated in nature, one thing proves to be unmistakable when it comes to the Sandworm group that created it: Sandworm is a persistent and sophisticated group whose motives are clearly at odds with those that would be expected from groups that are primarily financially motivated.


Sandworm’s previous high-profile victims and their attacks’ substantial impact on these organizations are particularly worrying — even more so for a group that quickly learns from past errors, comes back stronger time and time again, and for whom international repercussions seem minimal at best.


The indicators of compromise (IOCs) can be found in this appendix and the C&C server validation script can be accessed via this text file.


Tags  APT & Targeted Attacks | IoT | Research | Articles, News, Reports


The Brazilian Central Bank recently announced that 2017 was the first year in which people did more banking using mobile devices than on PCs.


There were 24.5 billion mobile banking transactions while there were 20.6 billion PC-based transactions.


But, mobile banking use is picking up around the globe.


What is it?


As more people move to mobile banking, we believe attackers will focus their attacks away from PC banking and towards mobile banking.


This means the risks of losing control of your accounts through mobile online banking are likely to increase.


And that means the money in your accounts is at risk.


Why should I care, what can it do to me?  Attackers are predictable: they follow people and money.


What can I do about it?


It’s time to take precautions and start good mobile banking security habits.


About  Threat Briefs are meant to help busy people understand real-world threats and how they can prevent them in their lives.


They’re put together by Palo Alto Networks Unit 42 threat research team and are meant for you to read and share with your family, friends, and coworkers so you can all be safer and get on with the business of your digital life.  Got a topic you want us to write about for you, your friends, or your family?


Email us at u42comms@paloaltonetworks.com.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


It’s quite odd (and probably underreported), however, to see it used as a vector for cyberespionage.


We stumbled upon the Confucius hacking group while delving into Patchwork’s cyberespionage operations, and found a number of similarities.


Code in their custom malware bore similarities, for instance.


Confucius targeted a particular set of individuals in South Asian countries, such as military personnel and businessmen, among others.


Are Patchwork and Confucius the same group?


The commands in their backdoors do resemble each other.


The config files have a similar, custom structure, and both groups have infrastructure overlap.


However, we construe them to be different groups, possibly within the same community, with different objectives and modi operandi.


While Patchwork may be more straightforward with its predominantly malware-based attacks, Confucius’ can be inferred to be more nuanced, relying heavily on social engineering.


Exploiting the human psyche with chat apps Probing Confucius’ infrastructure, we came across websites offering Windows and Android chat applications, most likely iterations of its predecessor, Simple Chat Point: Secret Chat Point, and Tweety Chat.


We are admittedly uncertain of the extent — and success — of their use, but it’s one of the ingredients of the group’s operations.


While the chat applications indeed have real chat features (although the communication is not anonymous, as advertised), they have backdoor routines and file-stealing behaviors that get triggered when specific words are sent to the app: collecting and harvesting all SMS messages, contacts, and accounts.


Tweety Chat’s Android version can record audio, too.


Its latest version can mute the device (i.e., take out the ringtone and vibration features) and sync call logs and SMSs.


We further tested Tweety Chat and saw red flags indicating their targets of interest: verification emails with a physical address whose postal code is assigned to a provincial capital that also appears (upon logging in) as a chat channel in Tweety Chat.


Figure 1: Tweety Chat’s interface (top), and code snippets showing the file types it steals (bottom) Romance in cyberespionage


The user list, chat room names, and content of the applications were stored in a remote server without any authentication.


The chat logs shed light on the social engineering used by the operators to persuade victims to install the cyberespionage malware on their Android devices.


The first user and chatroom were created on August 27, 2017, and were probably the app authors’ testing ground.


The succeeding users and chatrooms were created on October 31 and December 12 the latest.


A certain hayat22 and love piqued our interest.


hayat22, supposedly a female student, engaged in an online romance with a target whose handle was love, describing himself as living in South Asia working in garments manufacturing and wholesaling.


Over the course of their correspondence, love suggested using WhatsApp to communicate.


hayat22 declined, saying she felt safer using Tweety Chat.


love refused, but when hayat22 demurred and gave love an online cold shoulder, love tried installing Tweety Chat — and failed.


He claimed that he wasn’t able to install the app.


hayat22 quickly lost interest and stopped replying to him altogether.


She also sent him a screenshot to show what Tweety Chat looked like.


We’re not sure how love wound up in the chat room or how he met hayat22.


He was probably either using the Windows version of Secret Chat Point or its web interface, which explains why hayat22 was urging him to install Android Tweety Chat.


In an earlier chat group, an operator called Heena urged the members to install Secret Chat Point on other people’s mobile devices to get perks like credits or the ability to “go invisible”.


In another chat room called “Maira’s room”, a target of interest disclosed he was a government officer traveling back from a northern city near the country’s provincial capital.


A few days after, the operator stopped answering in the chat room, and her user account was deleted from the server.


Figure 2: ByeBye Shell’s interface showing Confucius’ campaigns  Figure 3: Screenshot showing a group chat where the moderator is urging users to install Tweety Chat  Figure 4: Screenshot showing Tweety Chat promoted in social media


A tangled web of malware


Confucius’ operations include deploying bespoke backdoors and stealing files from their victim’s systems with tailored file stealers, some of which bore resemblances to Patchwork’s.


The stolen files are then exfiltrated by abusing a cloud storage service.


Some of these file stealers specifically target files from USB devices, probably to overcome air-gapped environments.


Compared to Patchwork, whose Trojanized documents exploit at least five security flaws, Confucius’ backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882.


Their malware’s resemblance to that of Patchwork’s is also notable.


The use of an exploit for a security flaw disclosed in December 2017 and their recent activities suggest Confucius is keenly trailing their targets.


Confucius has a miscellany of backdoors: sctrls, ByeBye Shell, remote-access-c3, and sip_telephone, to name a few.


One of its file stealers, swissknife2, abuses a cloud storage service as a repository of exfiltrated files.


At the time of research, there were around 60 victims whose data were uploaded to Confucius-owned cloud storage account.


There were also a few thousand files in the account that were later deleted.


Our research, Deciphering Confucius: A Look at the Group’s Cyberespionage Operations, delves into the group’s operations, the social engineering methods and gamut of malware it uses, and the countermeasures that organizations can adopt to mitigate them.


The list of indicators of compromise, which includes Trend Micro’s corresponding detections and solutions, is in this appendix.


Tags  Malware | APT & Targeted Attacks | Endpoints | Research |


Mobile


"A few weeks ago, British Airways was hit by the largest ever regulatory fine of its kind, after global customers visiting its website had their card data stolen.


The $228m penalty levied by the UK’s privacy watchdog reflects the seriousness of the attack and the carrier’s failure to protect its customer’s personal and financial information.


However, this incident has repercussions way beyond the UK airline and its customers.


It’s part of a new wave of attacks designed to implant “digital skimming” code on e-commerce sites, in order to siphon off your card details as they are entered in to pay for goods.


Although tens of thousands of websites have been caught out in this way, there are things you can do to stay safe—most notably by running Trend Micro Security.


But first, here’s more on what you need to know.


The story so far


Data breaches are so often in the news headlines today, that you could be forgiven for becoming a little desensitized.


From retailers like Target and Home Depot to government breaches at agencies including the Office of Personnel Management (OPM), and from financial organizations like Equifax to tech giants like Yahoo, billions of our personal records have been stolen by cyber-thieves over the past few years.


Yet in all of these cases, there has been little the customer could do about it.


That’s because the hackers target the organization directly.


They find ways to bypass its security controls and sneak inside the company networks to find what they’re looking for: usually databases full of customer data.


A new type of data breach


However, these new digital skimming attacks are different.


In what way?


They involve a hacker deploying malicious code known as Magecart to an organization’s website.


This code is typically designed to stay hidden, under the radar of the company.


And it has a very specific purpose: to steal customer card details as they are entered into the site during payment.


In short, it’s the digital equivalent of those physical skimming devices that criminals insert into ATMs to steal card data as it’s entered: it’s highly effective and happens completely without the knowledge of the cardholder.


By using this method, the hackers get access to the full card details, which have a higher resale value on the cybercrime black market.


The problem (for them) with the more traditional types of attack targeting back-end databases, is that these organizations may store card data encrypted, or else minus the crucial CVV/CV2 code.


Magecart attacks get around that.


What sites are at risk?


Indeed, the Magecart attackers have proven over the past year that no website is safe from skimming attacks.


Whether it’s a big-name e-commerce brand like Newegg, a national airline, a global ticketing site (Ticketmaster), or even online campus stores serving nearly 200 universities in the US and Canada–as long as they accept online payments, they’re at risk.


Magecart is so effective that multiple groups are said to be using the code, a piece of malicious JavaScript, to infect websites around the world.


And they’re developing new tools and tactics all the time to improve their monetization.


These include:     Infecting third-party companies which supply code to other sites (e.g., those that provide online ad services).


Thus, with just one attack, the hackers can get their Magecart code onto potentially thousands of payment pages.


Using automated tools to scan the internet for companies that may be running unsecured servers, which they can then infect with Magecart.


Some 17,000 sites were recently compromised in this way.


In a separate attack, 962 online stores were hit in just 24 hours.


Developing new skimming code which is usable across as many different payment pages as possible.


The record is 57 different payment gateways, which makes the hackers’ job much easier as they can launch attack campaigns across the globe with the same tools            All this is bad news for online shoppers.


So how do you know that the site you’re entering card data into is safe?


What can you do to stay safe?


Unfortunately, there’s nothing obvious that differentiates a website infected with Magecart from any other site.


It will look completely normal and will allow you to pay in the usual manner.


The only difference is that, in the background, a tiny piece of code will be stealing your data and transferring it to the hackers.


So what can you do to protect yourself?


You could try to avoid smaller sites that may not have the same level of security as larger ones.


However, as we’ve seen, Magecart has hit big-name brands as well as less well-known companies.


Another option would be to use a browser plug-in like NoScript for Firefox that prevents JavaScript loading from other untrusted sites – although this won’t prevent you getting potentially stung if the well-known and trusted site you’re on is compromised


Payment systems like Apple Pay and Google Pay can offer more protection.


They use a one-time generated series of numbers for each transaction, so that if attackers get their hands on it, they won’t be able to use it in the future.


It goes without saying that you should keep a close eye on your card statements/bank account at all times – watching out even for small amounts that hackers may be making to test if your card is still active.


However, the most effective way to stay safe is to use Trend Micro Security.


How Trend Micro can help Trend Micro Security features two key mechanisms to help stop Magecart attacks:


It can detect whether the website you want to visit has been injected with skimming code, and block you from visiting the URL (via web reputation), as well as from going to malicious domains the skimming code has access to.


Cyber Crime | Expert Perspective | Cyber Threats


REvil


While the disappearance of REvil (aka Sodinokibi) in mid-2021 is filled with uncertainty, security researchers have found a Linux version of the REvil ransomware that they have dubbed as Revix.


After analyzing the samples, we found four different versions of the malware, all of which rely on an embedded JavaScript Observed Notation (JSON)-based configuration to set parameters before encrypting files.


Figure 1. Revix’s JSON-based configuration


Figure 2. Revix encrypting a QNAP NAS device      Figure 3.


Revix


StealthWorker


Figure 5. Infected Linux device connected to a C&C server


How to protect NAS devices


Here are some best practices to protect your systems against threats that leverage the gaps in your NAS devices:


Avoid connecting a NAS device directly to the internet.


Regularly change the credentials for accessing an NAS device.


On April 21st our WildFire analysis cloud detected a new Android Trojan, which is currently completely undetected in VirusTotal and uses a new combination of tactics to make money for the author.


Code analysis shows that this malware sample can defeat the existing multi-factor verification procedures of many popular game platforms or online payment systems, and impersonate the smartphone user in making the purchase.


The name is看片神器 which translates to “a super tool for watching videos” and the icon is a provocative photo.


Once launched, it contacts a command and control server hosted in China using an HTTP GET request to the following website to register the infection with the attacker: http://14.17.95.205:21910/my/service.php.


Figure 1.


UUDama uses a combination of machines and humans to quickly take CAPTCHA images submitted by Cardbuyer (or anyone else who will pay) and turn them into the expected text within 60 seconds.


To avoid having this request rejected by the server, the Trojan alters its user-agent string to appear as Internet Explorer 9 running on Windows 7.


Figure 4.


Figure 5.


Figure 6.


The complicated user verification procedure continues.


In Figure 8, we show the patterns for different types of SMS contents.


From here the attacker can sell the code to someone else for cash, or redeem it directly.  While in the example here Cardbuyer targeted the Tianxiafu service, all of the services listed above are targets already pre-defined in its source code.


Any service that uses SMS for authentication of information or proof that a user is authorizing a charge is vulnerable to Trojan attacks.


Join us Wednesday, April 30 at 3 p.m. EDT, for a new webinar, “Need to Defeat APTs?


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2022.


It was last updated on May 12, 2022.


We have also taken extraordinary measures beyond our actions against coordinated influence operations to protect users and stop the spread of misinformation and disinformation about the war in Ukraine online.


We use our research to continuously improve the safety and security of our products and share this intelligence with the community to benefit the internet as a whole.


As announced today, Google has taken action to disrupt the operations of Glupteba, a multi-component botnet targeting Windows computers.


The Glupteba malware family is primarily distributed through pay per install (PPI) networks and via traffic purchased from traffic distribution systems (TDS).


For a period of time, we observed thousands of instances of malicious Glupteba downloads per day.


The following image shows a webpage mimicking a software crack download which delivers a variant of Glupteba to users instead of the promised software.


While analyzing Glupteba binaries, our team identified a few containing a git repository URL: “git.voltronwork.com”.


This finding sparked an investigation that led us to identify, with high confidence, multiple online services offered by the individuals operating the Glupteba botnet.


This past year, TAG has been collaborating with Google’s CyberCrime Investigation Group to disrupt Glupteba activity involving Google services.


Parallel to the analysis, tracking, and technical disruption of this botnet, Google has filed a lawsuit against two individuals believed to be located in Russia for operating the Glupteba Botnet and its various criminal schemes.


To add resilience to their infrastructure, the operators have also implemented a backup mechanism using the Bitcoin blockchain.


Full details of Glupteba’s network protocol can be found in this report from 2020, the following Python script illustrates how one can decrypt an encrypted domain name:


Since mid-2021, we have been investigating a rather elusive threat actor called Earth Lusca that targets organizations globally via a campaign that uses traditional social engineering techniques such as spear phishing and watering holes.


Previous research into the group’s activities attributed it to other threat actors such as the Winnti group due to the use of malware such as Winnti, but despite some similarities, we consider Earth Lusca a separate threat actor (we do have evidence, however, that the group is part of the “Winnti cluster,” which is comprised of different groups with the same origin country and share aspects of their TTPs).


The first cluster is built using virtual private servers (VPS), rented from a service provider, that are used for the group’s watering hole and spear phishing operations, in addition to acting as a command-and-control (C&C) server for malware.


The second cluster is made up of compromised servers running old, open-source versions of Oracle GlassFish Server.


Figure 1.


An overview of Earth Lusca’s infrastructure      Social Engineering and Vulnerability Exploitation techniques


The group has three primary attack vectors, two of which involve social engineering.


The social engineering techniques can be broken down into spear phishing emails and watering hole websites.


Our telemetry data shows Earth Lusca sending spear phishing emails containing malicious links to one of their targets — a media company.


The user eventually downloads an archive file containing either a malicious LNK file or an executable — eventually leading to a Cobalt Strike loader.


In addition to spear phishing emails, Earth Lusca also made use of watering hole websites — they either compromised websites of their targets or set up fake web pages copied from legitimate websites and then injected malicious JavaScript code inside them.


This script was designed to show a social engineering message — typically a Flash update popup or a DNS error (note that Adobe discontinued Flash Player at the end of December 2020) that then instructed the visitor to download a malicious file that turned out to be a Cobalt Strike loader.


Figure 2. Fake installation pop-up     The third attack vector used by Earth Lusca is the exploitation of vulnerabilities that exist in the public-facing applications — such as Microsoft Exchange ProxyShell and Oracle GlassFish — of its targets.


Once these are accomplished, Earth Lusca is free to perform its post-exploitation routines that include installation of tools such as Cobalt Strike and Acunetix (we discuss the post-exploitation routines in detail in the technical brief).


Malware used by Earth Lusca Earth Lusca employs several malware and other hacking tools in its arsenal.


This post is also available in:      日本語 (Japanese)  Unit 42 released details about a new spear phishing campaign called FreeMilk that uses a relatively new attack technique that can be highly effective.


Phishing attacks are broad, leveraging email messages crafted around common, generalized topics in order to trick recipients into opening an email message and its attachments.


Attackers will cast a wide net, with no regard to who the victims are, hoping that a decent percentage of attacks are successful.


Spear phishing, like the name implies, is a more targeted form of phishing which incorporates a theme directly related to the target.


FreeMilk is an advanced spear phishing attack campaign that, instead of using a theme to lure targets into downloading a malicious attachment, hijacks an in-progress email conversation.


Simply explained:  Figure 1 Conversation Hijacking to Deliver Malware  Unit 42 observed this specific attack taking advantage of a vulnerability in Microsoft Office, which has a patch available.


Also, read about a data breach from IoT company Wyze that exposed information of 2.4 million customers.


Read on:


Cambridge Analytica Scandal: Facebook Hit with $1.6 Million Fine


The Cambridge Analytica scandal continues to haunt Facebook.


Why Running a Privileged Container in Docker is a Bad Idea


IoT Company Wyze Leaks Emails, Device Data of 2.4M


The new research expands on previous work into an attack vector known as Rowhammer, first detailed in 2014 Emotet Attack Causes Shutdown of Frankfurt’s IT Network


The city of Frankfurt, Germany, became the latest victim of Emotet after an infection forced it to close its IT network.


Greg Young, vice president of cybersecurity at Trend Micro, discusses BeyondProd’s value in this article.


How MITRE ATT&CK Assists in Threat Investigation


In this analysis, Trend Micro investigates an incident involving the MyKings botnet to show how the MITRE ATT&CK framework helps with threat investigation.


Share your thoughts in the comments below or follow me on Twitter to continue the conversation: @JonLClay.


Jon Clay, VP of Threat Intelligence: [00:00:00


Joining me again is my cohort in crime.


Ed Cabrera, Chief Cybersecurity Officer:


My name's Ed Cabrera.


I'm the Chief Cybersecurity Officer at Trend Micro.


It’s great to be here.


Jon:


But we didn't cover a number of areas that I thought we were going to cover, but we didn't.


So I thought you and I [00:01:00] could take time today and talk a little bit about cyber warfare, hybrid warfare.


Any initial thoughts around this?


Maybe explain to the audience what hybrid warfare or cyber warfare is.


Ed:


Well, yeah, absolutely.


And so, when we talk about in terms of cyber conflict, cyber war, it has usually been in the context of just [00:02:00] another element within that 360-degree dominance that they hope to achieve in any conflict of war.


Cyber is that one space such as air dominance, for example, right?


And cyberspace is just one of them now, but we're getting into this unique area which we anticipated…could cyber conflict be the main domain that is being acted upon?


We'll talk about it [00:03:00] here now, but I think when we talk in terms for, especially for here is like cyber conflict, cyber war, or hybrid, and the hybrid piece is just a definition of kinetic and cyber.


Right.


And you just have computers fighting it out.


No, absolutely.


So cyber is still critical as we become more hyper-connected.


As we approach ubiquitous computing, ubiquitous connectivity, cyber then becomes very relevant.


But as we’ve seen, it's an interesting concept because traditionally cyber has just been more of an information gathering or cyber espionage tool to aid any type of conflict.


Jon:


Well, I mean, it still serves a purpose if you're able to knock down the power or communication, the real two top tier critical infrastructure.


That's one of the first areas on either side they're looking to obtain dominance, is to knock out the command and control.


Oh, absolutely.


It's nothing new.


Information warfare, PSYOPs, psychology operations - you name it.


We don't need to [00:07:00] drop the pamphlets out of the plane anymore.


Ed: Exactly.


You don't need to – everybody's got a phone, right?


So, you're able to instantaneously provide some type of propaganda or misinformation around the globe.


They could have done a deep fake of Zelensky talking about something that could have caused panic inside the country.


Think about something like that happening.


That's what you're probably going to see in the future as well.


One other area that we didn't talk about that I thought was pretty interesting was around cyber mercenaries.


They’re regular citizens.


Ed:


Yeah, well, again, everything that we see in cyberspace is a direct analogy on the physical side.


Such as the term mercenary, right?


This just makes it unique.


They could be patriotic hackers, they could just be guns for hire or cyber guns for hire, so to speak.


Are they really just uniform soldiers behind keyboards?


So [00:10:00] it's an interesting thing that nobody really likes to talk about it.


Jon:


When you think as nation state, what should a nation state be looking at for the future?


Yeah, sure, absolutely.


Just like on the physical or kinetic side, we need to be very cognizant of our critical infrastructure.


But we really need to understand what is critical.


Obviously, this is where our focus needs to be, hands down.


These are the things that I think countries across the globe need to understand, especially here in Western countries, and especially NATO countries, understanding that they need to be shoring up, and almost like DHS says in their program, Shields Up, is really focused on being proactive and protecting those critical sectors.


Because again, that's where we're going to get our information if a conflict does come up.


Ed, this has been a great discussion.


Well, everybody, thanks for joining us again.


On episode four of #TrendTalksBizSec.


So, take care, have a great day.


Thanks Ed.


Have a good day.


[00:14:00] Additional Resources:


Link to Jon’s panel discussion in Davos: https://www.youtube.com/watch?v=GAZng8u9FXk


Ed’s social media: @Ed_E_Cabrera (Twitter), https://www.linkedin.com/in/ed-e-cabrera/ (LinkedIn)


To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild.


If the link was not active, the user was redirected directly to a legitimate website.


We assess that these campaigns delivered ALIEN, a simple Android malware in charge of loading PREDATOR, an Android implant described by CitizenLab in December 2021.


ALIEN lives inside multiple privileged processes and receives commands from PREDATOR over IPC.


We did not capture the subsequent stages, but assess the attackers did not have exploits for the current version of Chrome (91.0.4472) at that time, but instead used n-day exploits targeting Samsung Browser, which was running an older and vulnerable version of Chromium.


Related IOCs


We recovered the exploit used to escape the Chrome Sandbox, but not the initial RCE exploit.


We haven’t retrieved a copy of the exploit.


We would also like to thank Project Zero for their technical assistance in helping analyze these bugs.


We remain committed to updating the community as we uncover these campaigns.


We look forward to continuing our work in this space and advancing the safety and security of our users around the world.


NOTE: On May 20th, we updated our attribution to more precisely describe our findings.


Since our last update, TAG has observed a continuously growing number of threat actors using the war as a lure in phishing and malware campaigns.


As always, we continue to publish details surrounding the actions we take against coordinated influence operations in our quarterly TAG bulletin.


The data is then exfiltrated via email to a compromised email account.


Malware samples:


TAG would like to thank the Yahoo! Paranoids Advanced Cyber Threats Team for their collaboration in this investigation.


Recently observed Turla domains: COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts.


The group's tactics, techniques and procedures (TTPs) for these campaigns have shifted slightly from including phishing links directly in the email, to also linking to PDFs and/or DOCs hosted on Google Drive and Microsoft One Drive.


Within these files is a link to an attacker controlled phishing domain.


These phishing domains have been blocked through Google Safe Browsing – a service that identifies unsafe websites across the web and notifies users and website owners of potential harm.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, has remained active during the course of the war and recently resumed targeting of Gmail accounts via credential phishing.


This campaign, targeting high risk individuals in Ukraine, contained links leading to compromised websites where the first stage phishing page was hosted.


If the user clicked continue, they would be redirected to an attacker controlled site that collected the users credentials.


In mid-April, TAG detected a Ghostwriter credential phishing campaign targeting Facebook users.


Recently observed Ghostwriter credential phishing domains and emails: Curious Gorge, a group TAG attributes to China's PLA SSF, has remained active against government, military, logistics and manufacturing organizations in Ukraine, Russia and Central Asia.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further exploitation.


The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.


While we are actively monitoring activity related to Ukraine and Russia, we continue to be just as vigilant in relation to other threat actors globally, to ensure that they do not take advantage of everyone’s focus on this region.


TAG has also continued to observe multiple ransomware brokers continuing to operate in a business as usual sense.


Recently observed IPs used in Curious Gorge campaigns: COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor.


We have not observed any Gmail accounts successfully compromised during these campaigns.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, recently introduced a new capability into their credential phishing campaigns.


In mid-March, a security researcher released a blog post detailing a 'Browser in the Browser' phishing technique.


While TAG has previously observed this technique being used by multiple government-backed actors, the media picked up on this blog post, publishing several stories highlighting this phishing capability.


Ghostwriter actors have quickly adopted this new technique, combining it with a previously observed technique, hosting credential phishing landing pages on compromised sites.


The new technique, displayed below, draws a login page that appears to be on the passport.i.ua domain, overtop of the page hosted on the compromised site.


Recently observed Ghostwriter credential phishing domains:


The exploit was patched on February 14, 2022.


The earliest evidence we have of this exploit kit being actively deployed is January 4, 2022.


Victims who clicked on the links would be served a hidden iframe that would trigger the exploit kit.


Attacker-Owned Websites: Compromised Websites (Feb 7 - Feb 9): Exploitation URLs:


The attackers placed links to the exploit kit within hidden iframes, which they embedded on both websites they owned as well as some websites they compromised.


If the RCE was successful, the javascript would request the next stage referenced within the script as “SBX”, a common acronym for Sandbox Escape.


We unfortunately were unable to recover any of the stages that followed the initial RCE.


We did not recover any responses from those URLs.


Example Exploit Kit:


As part of our efforts to combat serious threat actors, we use results of our research to improve the safety and security of our products.


We hope that improved understanding of the tactics and techniques will enhance threat hunting capability and lead to stronger user protections across industry.


In early September 2021, Threat Analysis Group (TAG) observed a financially motivated threat actor we refer to as EXOTIC LILY, exploiting a 0day in Microsoft MSHTML (CVE-2021-40444).


Investigating this group's activity, we determined they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPIDER (CrowdStrike).


EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol.


Additionally and rather uniquely, they leverage legitimate file-sharing services like WeTransfer, TransferNow and OneDrive to deliver the payload, further evading detection mechanisms.


This level of human-interaction is rather unusual for cyber crime groups focused on mass scale operations.


EXOTIC LILY’s attack chain has remained relatively consistent throughout the time we’ve been tracking the group: One notable technique is the use of domain and identity spoofing as a way of gaining additional credibility with a targeted organization.


Using spoofed email accounts, attackers would then send spear phishing emails under the pretext of a business proposal, such as seeking to outsource a software development project or an information security service.


Distribution of the actor’s working hours suggest they might be working from a Central or an Eastern Europe timezone.


These samples have some indicators that suggest they were custom-built to be used by the group.


The loader can be recognized by its use of a unique user-agent “bumblebee” which both variants share.


The malware, hence dubbed BUMBLEBEE, uses WMI to collect various system details such as OS version, user name and domain name, which are then exfiltrated in JSON format to a C2.


At the time of the analysis, BUMBLEBEE was observed to fetch Cobalt Strike payloads.


EXOTIC LILY activities overlap with a group tracked as DEV-0413 (Microsoft) and were also described by Abnormal in their recent post.


We believe the shift to deliver BazarLoader, along with some other indicators such as a unique Cobalt Strike profile (described by RiskIQ) further confirms the existence of a relationship between EXOTIC LILY and actions of a Russian cyber crime group tracked as WIZARD SPIDER (CrowdStrike), FIN12 (Mandiant, FireEye) and DEV-0193 (Microsoft).


Recent domains used in email campaigns: BazarLoader ISO samples: Recent BUMBLEBEE ISO samples: Recent BUMBLEBEE C2:


Recently, FireEye published a blog titled “Operation Poisoned Hurricane” which detailed the use of PlugX malware variants signed with legitimate certificates that used Google Code project pages for command and control (C2).


We were able to uncover multiple additional samples exploiting the same technique as well as an additional Google Code account with multiple projects containing encoded commands.


The attacks against Palo Alto Networks customers, which took place between early June to early July, also targeted users in East Asia; in this case an international law firm’s regional office and a major university.


All of the attacks were detected by our WildFire platform.


Of note, three of the Google Code projects associated with the newly uncovered account were added during the past few days, indicating it is still in active use.  Below is a current screenshot of the newly uncovered Google Code account’s projects.


The encoded commands decode to the below IP addresses.


Interestingly, “/p/pthon”, which is the project page used by some of the newly discovered samples detailed later in this blog, is the only page with the encoded command not included in the summary and is instead in text only on the page itself.


Table 1  We discovered a total of seven samples, five of which were not in VirusTotal prior to our submission.


Table 2 contains details of a PlugX sample using the PixelPlus Co., Ltd certificate that is currently only detected by four AV vendors.


Interestingly, the IP resolved by the initial website hosting the PlugX malware also served as a C2 server for different malware in mid-December 2013 (MD5: ddd46ce5e5eaaa8e61ce11a121a79266).


Table 2


The PlugX sample in Table 3 also uses the legitimate PixelPlus Co., Ltd certificate and was also targeted against the university.


It is correctly identified by eleven AV vendors as PlugX malware.


The registrant information associated with the website hosting the malware is a domain reseller.


Table 3


We were able to uncover an additional two samples using the QTI International Inc certificate and Google Code pages.


Only three AV vendors correctly identified it as PlugX malware.


Table 4  The second sample using the QTI International Inc certificate also uses IP 211.233.89.182 for C2 but does not first connect to a Google Code page and is not PlugX.


Of note, the PlugX sample in Table 8 uses a different certificate but was downloaded from the same website.


It also uses the Google Code page “/p/tempzz” for C2, which was also listed in FireEye’s blog.


The website hosting the malware was registered 4 June 2014 via eNom, a well-known domain name registrar.


Table 5


Our team was able to further uncover three new samples using the Ssanyong Motor Co., Ltd certificate and Google Code C2 redirection.


The PlugX sample in Table 4 used the same Google Code page and redirect, but the QTI International Inc certificate.


The below PlugX sample was only detected as PlugX malware by two AV vendors.


Table 6


The PlugX sample in Table 7 also targeted the same university as all previous samples.


Eight AV vendors correctly identified it.


Table 7


It was downloaded from the same website as the sample in Table 5; however, it was targeted against an international law firm’s East Asian office, and uses a Google Code page identified in FireEye’s blog for C2, but an IP not listed in the blog post.


Additional investigation shows that the threat actor also sent spear-phishing emails embedded with malicious links to multiple individuals, including politicians and activists, who support movements in Tibet, the Uyghur region, or Hong Kong.


However, this is a separate series of attacks from their operation in Taiwan, which this report covers.


Figure 1.


The attack flow of Earth Wendigo’s operation      Figure 2.


An example of a spear-phishing email sent by Earth Wendigo to a democracy activist.


Initial Access


Propagation


The attack begins with a spear-phishing email that is appended with obfuscated JavaScript.


Appending their malicious script to the victim’s email signature to propagate the infection to their contacts.


Exploiting a webmail system’s cross-site scripting (XSS) vulnerability to allow their malicious JavaScript to be injected on the webmail page permanently.


The registered Service Worker script can hijack login credentials and modify the webmail page to add malicious scripts in case the attackers were unable to inject the XSS vulnerability mentioned above.


After the attackers gain a foothold into the system — either through XSS injection or Service Worker — the next (and final part) of the attack chain, the exfiltration of the mailbox, is initiated.


The victim will receive a spear-phishing email disguised as an advertisement with a discount coupon from an online shopping website — however, an obfuscated malicious JavaScript is embedded inside.


The email leverages the webmail system’s search suggestion function to trigger the webpage to execute their script instead of directly running the malicious script.


Figure 3. The spear-phishing email disguised as an advertisement for a shopping coupon      Figure 4.


However, these emails don’t look like phishing emails and seemed more like real email sent from normal users within the same organization.


Further investigation revealed that the attacker had modified the victims’ email signatures through malicious code injection.


We think the threat actor used this approach to attempt to infect the victim’s contacts for further propagation.


Figure 5. Malicious script appended on the victim’s email signature      Figure 6.


As soon as the user executes the malicious script in the email, a cookie stealer script will be delivered and launched on the browser.


The framework used to deliver and manage these XSS attack scripts is called “XSSER.ME” or “XSS Framework.” The stolen session keys and browser cookies are also sent to the framework to store in the database.   While a stolen session key may allow the attacker to log into their target’s webmail system without a password, note that this is not the Earth Wendigo operation's ultimate goal.       Figure 7.


The actor prepared two different infection methods.


The first involves injecting malicious code into the webpage via an XSS vulnerability on the webmail system.


The vulnerability, which exists inside the webmail system’s shortcut feature, allows users to create links on the webmail front page.


The attacker can add a shortcut with a crafted payload by exploiting the XSS vulnerability, which replaces part of the original script from the webmail system with malicious JavaScript code.


We have reported the vulnerability to the company that developed the webmail system, which informed us that the vulnerability had been fixed since January 2020.


Figure 8.


A shortcut containing malicious code that was added to the webmail system      Figure 9.


The query format used to trigger the XSS vulnerability     Service Worker script exploitation


By examining one of the malicious scripts from the Earth Wendigo campaign, we discovered that it uploaded the tampered Service Worker script to the webmail server disguised as an original script provided by the server.


It then registers the uploaded script to the user’s Service Worker before removing it from the server immediately after registration.


For requests sent to “/cgi-bin/start,” which is a page wrapper used to show the main webmail page, the Service Worker script will reply by sending another page to the victim.


This new page is almost similar to the original wrapper but injected with a script element meant to load malicious script from Earth Wendigo’s server.


Therefore, the victim also loads the malicious script with the replaced wrapper page whenever they access the webmail server with the malicious Service Worker enabled in the background.


We found that the returned script is a backdoor that gets its instructions from the WebSocket server.


Figure 13.


The email exfiltration flow with WebSocket backdoor      Figure 14.


The script used to establish WebSocket communication      Figure 15.


Additional Findings


Besides their attack on webmail servers, we also found multiple malware variants used by Earth Wendigo.


However, we don’t know what code they delivered because the server was already down when we were verifying the malware variants.


Figure 17.


The Python script decompiled from the malware


Conclusion


While Earth Wendigo uses typical spear-phishing techniques to initiate their attack, the threat actor also uses many atypical techniques to infiltrate the targeted organizations, such as the use of mail signature manipulation and Service Worker infection.


The impact of spear-phishing attacks can be minimized by following security best practices, which include refraining from opening emails sent by suspicious sources.


To avoid XSS attacks similar to what we described in this report, we recommend adapting Contant-Security-Policy (CSP) for websites.


Indicators of Compromise  Indicator  Description  Detection  mail2000tw[.]com  Domain operated by Earth Wendigo     bf[.]mail2000tw[.]com  Domain operated by Earth Wendigo     admin[.]mail2000tw[.]com  Domain operated by Earth Wendigo     googletwtw[.]com  Domain operated by Earth Wendigo     bf[.]googletwtw[.]com  Domain operated by Earth Wendigo     ws[.]googletwtw[.]com  Domain operated by Earth Wendigo     admin[.]googletwtw[.]com  Domain operated by Earth Wendigo     anybodyopenfind[.]com  Domain operated by Earth Wendigo     support[.]anybodyopenfind[.]com  Domain operated by Earth Wendigo     supports[.]anybodyopenfind[.]com  Domain operated by Earth Wendigo     supportss[.]anybodyopenfind[.]com  Domain operated by Earth Wendigo     a61e84ac9b9d3009415c7982887dd7834ba2e7c8ea9098f33280d82b9a81f923  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  66cf12bb9b013c30f9db6484caa5d5d0a94683887cded2758886aae1cb5c1c65  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  4cdaca6b01f52092a1dd30fc68ee8f6d679ea6f7a21974e4a3eb8d14be6f5d74  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  f50a589f3b3ebcc326bab55d1ef271dcec372c25d65f381a409ea85929a34b49  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  e047aa878f9e7a55a80cc1b70d0ac9840251691e91ab6454562afbff427b0879  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  a1a6dc2a6c795fc315085d00aa7fdabd1f043b28c68d4f98d4152fe539f026f1  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  10d2158828b953ff1140376ceb79182486525fd14b98f743dafa317110c1b289  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  0e04a03afa5b66014457136fb4d437d51da9067dc88452f9ebd098d10c97c5b8  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  75f3f724a2bfda1e74e0de36ff6a12d3f2ea599a594845d7e6bc7c76429e0fa4  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  c3bc364409bb0c4453f6d80351477ff8a13a1acdc5735a9dff4ea4b3f5ad201c  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  5251087bb2a0c87ac60c13f2edb7c39fb1ea26984fcc07e4cf8b39db31ce2b08  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  7fa9a58163dd233065a86f9ed6857ed698fc6e454e6b428ea93f4f711279fb61  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  f568f823959be80a707e05791718c1c3c377da1b0db1865821c1cf7bc53b6084  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  a54d58d5a5812abaede3e2012ae757d378fb51c7d3974eaa3a3f34511161c1db  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  77c3d62cce21c2c348f825948042f7d36999e3be80db32ac98950e88db4140b1  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  c0dabb52c73173ea0b597ae4ad90d67c23c85110b06aa3c9e110a852ebe04420  Earth Wendigo Service Worker script  Trojan.JS.WENDIGOE.A  efe541889f3da7672398d7ad00b8243e94d13cc3254ed59cd547ad172c1aa4be  Earth Wendigo WebSocket JavaScript backdoor  Backdoor.JS.WENDIGOE.A  2411b7b9ada83f6586278e0ad36b42a98513c9047a272a5dcb4a2754ba8e6f1d  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.A  1de54855b15fc55b4a865723224119029e51b381a11fda5d05159c74f50cb7de  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.A  d935c9fe8e229f1dabcc0ceb02a9ce7130ae313dd18de0b1aca69741321a7d1b  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.B  50f23b6f4dff77ce4101242ebc3f12ea40156a409a7417ecf6564af344747b76  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    fab0c4e0992afe35c5e99bf9286db94313ffedc77d138e96af940423b2ca1cf2  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    4d9c63127befad0b65078ccd821a9cd6c1dccec3e204a253751e7213a2d39e39  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    25258044c838c6fc14a447573a4a94662170a7b83f08a8d76f96fbbec3ab08e2  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    13952e13d310fb5102fd4a90e4eafe6291bc97e09eba50fedbc2f8900c80165f  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    ccb7be5a5a73104106c669d7c58b13a55eb9db3b3b5a6d3097ac8b68f2555d39  Earth Wendigo Shellcode Loader  Trojan.Win64.WENDIGOE.A    40a251184bb680edadfa9778a37135227e4191163882ccf170835e0658b1e0ed  Earth Wendigo Shellcode Loader  Trojan.Win64.WENDIGOE.B    0d6c3cc46be2c2c951c24c695558be1e2338635176fa34e8b36b3e751ccdb0de  Cobalt Strike  Trojan.Win32.COBALT.SM       Tags  Articles, News, Reports | APT & Targeted Attacks | Research


Based on the number of “likes” the malware had generated, Faghani estimated that over 100,000 users had been infected with the malware.


Filmkan is very flexible, giving it more capability than simple interaction with social networks.


Our WildFire analysis cloud first picked up samples of this malware on January 22 and thus far we’ve collected 44 distinct samples the display the behavior described by Faghani.


After a few seconds the video tells the user they need to download an update for Flash player, which is the initial dropper executable.


The Filmkan dropper has a Flash icon to help make it appear as a legitimate update.  The author of Filmkan created the dropper using AutoHotkey (AHK), a legitimate tool for creating Windows applications using a custom scripting language.


Chrome extensions  allow developers to extend Google’s Chrome browser, typically by adding new functionality.


The current version of the script contains three primary functions.


When Faghani first published his analysis this component of the malware was forcing the user’s Facebook account to “like” specific posts on a community page titled Sabır.


Users should be suspicious of any message indicating that an update for Flash is available in Google Chrome, as Chrome contains an integrated Flash runtime that is updated by Google.


Organizations should block access to the following domains to prevent Filmkan from receiving updates from the attacker.


The Bash Uploader script allows its customers to send code coverage reports to the Codecov platform for analysis.


Organizations using Codecov’s Bash Uploader script, or one of the other impacted tools should carefully evaluate their exposure to this threat.


This post is also available in:      日本語 (Japanese)  Unit 42 continuously hunts for new and unique malware samples that match known advanced persistent threat (APT) patterns and tactics.


The sample contained a malicious payload associated with Brute Ratel C4 (BRc4), the newest red-teaming and adversarial attack simulation tool to hit the market.


Additionally, pivoting on the certificate and other artifacts, we identified a total of 41 malicious IP addresses, nine BRc4 samples, and an additional three organizations across North and South America who have been impacted by this tool so far.


This unique sample was packaged in a manner consistent with known APT29 techniques and their recent campaigns, which leveraged well-known cloud storage and online collaboration applications.


Attempts to execute the benign application from the ISO-mounted folder resulted in the loading of the malicious payload as a dependency through a technique known as DLL search order hijacking.


We encourage all security vendors to create protections to detect activity from this tool and all organizations to be on alert for activity from this tool.  Palo Alto Networks customers receive protections from the threats described in this blog through Threat Prevention, Cortex XDR and WildFire malware analysis.


Shellcode


Update Badger_x64.exe


Employment


At the time, its development was a part-time effort by a security engineer named Chetan Nayak (aka Paranoid Ninja) living in India.


That same month, he released Brute Ratel v0.9.0 (Checkmate), which is described as the “biggest release for Brute Ratel till date.”  However, of greater concern, the release description also specifically noted that “this release was built after reverse engineering several top tier EDR and Antivirus DLLs.”


In terms of features, BRc4 advertises the following capabilities:


The file in VirusTotal named Roshan_CV.iso (SHA256: 1FC7B0E1054D54CE8F1DE0CC95976081C7A85C7926C03172A3DDAA672690042C) appears to be a curriculum vitae (similar to a resume) of an individual named Roshan.


It was uploaded to VirusTotal on May 19, 2022, from Sri Lanka.


The following table shows a side-by-side comparison of Roshan_CV.ISO and that of a previously identified APT29 sample (Decret.ISO).


Figure 9 is a screenshot of the default Windows File Explorer; “show hidden files” is not checked.


In both images, the user is presented with a shortcut file (LNK file) that starts the malicious activity when double-clicked.


Figure 10 shows how the ISOs would appear when show hidden files” is enabled for viewing.


The flow of execution is the following:  Roshan_CV.ISO→Roshan-Bandar_CV_Dialog.LNK→cmd.exe→OneDriveUpdater.exe→version.dll→OneDrive.Update  Decret.ISO→Decret.LNK→cmd.exe→HPScan.exe→version.dll→HPScanApi.dll


The delivery of packaged ISO files is typically sent via spear phishing email campaigns or downloaded to the victim by a second-stage downloader.  While we lack insight into how this particular payload was delivered to a target environment, we observed connection attempts to the C2 server originating from three Sri Lankan IP addresses between May 19-20.


Version.dll is a modified version of a legitimate Microsoft file written in C++.


The implanted code begins when the DLL is loaded via DLL_PROCESS_ATTACH and performs the following at the DLLMain subroutine:  The technique outlined above uses process injection via undocumented Windows NTAPI calls.


The decrypted payload is now running within the runtimebroker.exe memory space.


The following is a snippet of code from version.dll that starts the execution of the in-memory decrypted payload.


The purpose of this is to copy the Brute Ratel C4 code (x64 assembly) onto the stack eight bytes at a time and eventually reassemble it into a memory space for execution – a DLL with a stripped MZ header.


When finished, the code performs the following.


This data includes the encrypted configuration settings for Brute Ratel C4.


The 16-byte RC4 decryption key is: bYXJm/3#M?:XyMBF


The decrypted configuration file is:  Each parameter is delineated with a pipe | character, and one of the values is the IP seen earlier of 174.129.157[.]251 and port of 443.


The IP 174.129.157[.]251 is hosted on Amazon AWS, and Palo Alto Networks Cortex Xpanse history shows the IP had TCP port 443 open from April 29, 2022, until May 23, 2022, with a self-signed SSL certificate impersonating Microsoft Security:


Once the SSL handshake to IP 174.129.157[.]251 is complete, the following data is sent via HTTP POST to the Brute Ratel C4 listener port.


Example of badger_x64.exe:


In this case, the sample is configured to communicate with IP 159.65.186[.]50 on TCP port 443.


After validating that badger_x64.exe and OneDrive.Update were both BRc4 payloads, we set to work analyzing the employment of this second sample.


Coincidentally, this happens to be one day after the Roshan_CV.ISO file was uploaded.


As noted above, the sample was configured to call home to 159.65.186[.]50 on port 443.


Palo Alto Networks Cortex Xpanse history shows that this port was open from May 21-June 18, 2022, with the same “Microsoft Security” self-signed SSL certificate seen above.


Evaluating netflow connections for 159.65.186[.]50 during this time window revealed several connections to ports 22, 443 and 8060 originating from a Ukrainian IP (213.200.56[.]105).


A deeper look at connections in and out of 213.200.56[.]105 further revealed several flows over UDP port 33445.


Examining additional connections to port 443 on 159.65.186[.]50, we identified several suspected victims including an Argentinian organization, an IP television provider providing North and South American content, and a major textile manufacturer in Mexico.


Coincidentally, recent attempts to browse the textile manufacturer’s website result in a 500 internal server error message.


Given the geographic dispersion of these victims, the upstream connection to a Ukrainian IP and several other factors, we believe it is highly unlikely that BRc4 was deployed in support of legitimate and sanctioned penetration testing activities.


Expanding our research beyond the two samples discussed above, we have also identified an additional seven samples of BRc4 dating back to February 2021.


The "Brute Ratel C4 Tool Command and Control Traffic Detections" signature is threat ID 86647.


We believe it is imperative that all security vendors create protections to detect BRc4 and that all organizations take proactive measures to defend against this tool.  Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance members.


Learn more about the Cyber Threat Alliance.