MSIL.SUNBURST.A 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 76640508b1e7759e548771a5359eaed353bf1eec


Backdoor.


MSIL.SUNBURST.A


d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600 1b476f58ca366b54f34d714ffce3fd73cc30db1a


Backdoor.MSIL.SUNBURST.A


The following domain names are associated with this campaign and are also blocked:  avsvmcloud[.]com databasegalore[.]com deftsecurity[.]com highdatabase[.]com incomeupdate[.]com panhardware[.]com thedoccloud[.]com zupertech[.]com         Tags  APT & Targeted Attacks | Research | Articles, News, Reports | Cyber Threats


In the second half of 2017 Pawn Storm, an extremely active espionage actor group, didn’t shy away from continuing their brazen attacks.


Usually, the group's attacks are not isolated incidents, and we can often relate them to earlier attacks by carefully looking at both technical indicators and motives.


Pawn Storm has been attacking political organizations in France, Germany, Montenegro, Turkey, Ukraine, and the United States since 2015.


We saw attacks against political organizations again in the second half of 2017.


These attacks don’t show much technical innovation over time, but they are well prepared, persistent, and often hard to defend against.


Pawn Storm has a large toolset full of social engineering tricks, malware and exploits, and therefore doesn’t need much innovation apart from occasionally using their own zero-days and quickly abusing software vulnerabilities shortly after a security patch is released.


In summer and fall of 2017, we observed Pawn Storm targeting several organizations with credential phishing and spear phishing attacks.


Pawn Storm’s modus operandi is quite consistent over the years, with some of their technical tricks being used repeatedly.


For example, tabnabbing was used against Yahoo! users in August and September 2017 in US politically themed email.


The method, which we first discussed in 2014, involves changing a browser tab to point to a phishing site after distracting the target.


We can often closely relate current and old Pawn Storm campaigns using data that spans more than four years, possibly because the actors in the group follow a script when setting up an attack.


This makes sense, as the sheer volume of their attacks requires careful administration, planning, and organization to succeed.


The screenshots below show two typical credential phishing emails that targeted specific organizations in October and November 2017.


One type of email is supposedly a message from the target’s Microsoft Exchange server about an expired password.


The other says there is a new file on the company’s OneDrive system.


Figure 1. A sample of a credential phishing email Pawn Storm sent in October and November 2017  Figure 2.


Second type of credential phishing email that was sent by Pawn Storm in November 2017.


The logo of the target organization has been removed from the screenshot and the color was changed as not to reveal the source.


While these emails might not seem to be advanced in nature, we’ve seen that credential loss is often the starting point of further attacks that include stealing sensitive data from email inboxes.


We have worked with one of the targets, an NGO in the Netherlands targeted twice, in late October and early November 2017.


We successfully prevented both attacks from causing any harm.


In one case we were able to warn the target within two hours after a dedicated credential phishing site was set up.


In an earlier attack, we were able to warn the organization 24 hours before the actual phishing emails were sent.


Olympic Wintersports Federations


We have seen several International Olympic Wintersport Federations, such as the European Ice Hockey Federation, the International Ski Federation, the International Biathlon Union, the International Bobsleigh and Skeleton Federation and the International Luge Federation, among the group’s targets in the second half of 2017.


This is noteworthy due to the timing correlation between several Russian Olympic players being banned for life in fall, 2017.


In 2016, Pawn Storm had some success in compromising WADA (the World Anti-Doping Agency) and TAS-CAS (the Court of Arbitration for Sport).


At that time, Pawn Storm sought active contact with mainstream media either directly or via proxies and had influence on what some of them published.


Political targets


In the week of the 2017 presidential elections in Iran, Pawn Storm set up a phishing site targeting chmail.ir webmail users.


We were able to collect evidence that credential phishing emails were sent to chmail.ir users on May 18, 2017, just one day before the presidential elections in Iran.


We have previously reported similar targeted activity against political organizations in France, Germany, Montenegro, Turkey, Ukraine, and the United States.


Beginning in June 2017, phishing sites were set up mimicking the ADFS (Active Directory Federation Services) of the U.S. Senate.


By looking at the digital fingerprints of these phishing sites and comparing them with a large data set that spans almost five years, we can uniquely relate them to a couple of Pawn Storm incidents in 2016 and 2017.


The real ADFS server of the U.S. Senate is not reachable on the open internet, however phishing of users’ credentials on an ADFS server that is behind a firewall still makes sense.


In case an actor already has a foothold in an organization after compromising one user account, credential phishing could help him get closer to high profile users of interest.


The future of politically motivated campaigns Rogue political influence campaigns are not likely to go away in the near future.


Political organizations have to be able to communicate openly with their voters, the press and the general public.


This makes them vulnerable to hacking and spear phishing.


On top of that, it's also relatively easy to influence public opinion via social media.


Social media platforms continue to form a substantial part of users’ online experience, and they let advertisers reach consumers with their message.


This makes social media algorithms susceptible to abuse by various actors with bad intentions.


Publishing stolen data together with spreading fake news and rumors on social media gives malicious actors powerful tools.


While a successful influence campaign might seem relatively easy to do, it needs a lot of planning, persistence, and resources to be successful.


Some of the basic tools and services, like ones used to spread fake news on social media, are already being offered as a service in the underground economy.


As we have mentioned in our overview paper on Pawn Storm, other actors may also start their own campaigns that aim to influence politics and issues of interest domestically and abroad.


Actors from developing countries will learn and probably adapt similar methods quickly in the near future.


In 2016, we published a report on C Major, an espionage group that primarily targets the Indian military.


By digging deeper into C Major’s activities, we found that this actor group not only attacks the Indian military, but also has dedicated botnets for compromised targets in Iranian universities, Afghanistan, and Pakistan.


Recently, we have witnessed C Major also showing some interest in compromising military and diplomatic targets in the West.


It is only a matter of time before actors like C Major begin attempting to influence public opinion in foreign countries, as well.


With the Olympics and several significant global elections taking place in 2018, we can be sure Pawn Storm’s activities will continue.


We at Trend Micro will keep monitoring their targeted activities, as well as activities of similar actors, as cyberpropaganda and digital extortion remain in use.


Indicators of Compromise (IoCs):  adfs[.]senate[.]group adfs-senate[.]email adfs-senate[.]services adfs.senate[.]qov[.]info chmail.ir[.]udelivered[.]tk webmail-ibsf[.]org fil-luge[.]com biathlovvorld[.]com mail-ibu[.]eu fisski[.]ca iihf[.]eu         Tags  Malware | APT & Targeted Attacks | Endpoints | Research | Phishing | Network


Google’s Threat Analysis Group tracks actors involved in disinformation campaigns, government backed hacking, and financially motivated abuse.


Since late 2019, our team has disrupted financially motivated phishing campaigns targeting YouTubers with Cookie Theft malware.


The actors behind this campaign, which we attribute to a group of hackers recruited in a Russian-speaking forum, lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams.


In collaboration with YouTube, Gmail, Trust & Safety, CyberCrime Investigation Group and Safe Browsing teams, our protections have decreased the volume of related phishing emails on Gmail by 99.6% since May 2021.


We blocked 1.6M messages to targets, displayed ~62K Safe Browsing phishing page warnings, blocked 2.4K files, and successfully restored ~4K accounts.


With increased detection efforts, we’ve observed attackers shifting away from Gmail to other email providers (mostly email.cz, seznam.cz, post.cz and aol.com).


Moreover, to protect our users, we have referred the below activity to the FBI for further investigation.


In this blog, we share examples of the specific tactics, techniques and procedures (TTPs) used to lure victims, as well as some guidance on how users can further protect themselves.


Cookie Theft, also known as “pass-the-cookie attack,” is a session hijacking technique that enables access to user accounts with session cookies stored in the browser.


While the technique has been around for decades, its resurgence as a top security risk could be due to a wider adoption of multi-factor authentication (MFA) making it difficult to conduct abuse, and shifting attacker focus to social engineering tactics.


Many YouTube creators provide an email address on their channel for business opportunities.


In this case, the attackers sent forged business emails impersonating an existing company requesting a video advertisement collaboration.


The phishing typically started with a customized email introducing the company and its products.


Once the target agreed to the deal, a malware landing page disguised as a software download URL was sent via email or a PDF on Google Drive, and in a few cases, Google documents containing the phishing links.


Around 15,000 actor accounts were identified, most of which were created for this campaign specifically.


The attackers registered various domains associated with forged companies and built multiple websites for malware delivery.


To date, we’ve identified at least 1,011 domains created solely for this purpose.


Some of the websites impersonated legitimate software sites, such as Luminar, Cisco VPN, games on Steam, and some were generated using online templates.


During the pandemic, we also uncovered attackers posing as news providers with a “Covid19 news software.”


In one case, we observed a fake social media page copying content from an existing software company.


The following screenshot is an example of a fake page where the original URL is replaced with one leading to a cookie theft malware download.


Because Google actively detects and disrupts phishing links sent via Gmail, the actors were observed driving targets to messaging apps like WhatsApp, Telegram or Discord.


Once the target runs the fake software, a cookie stealing malware executes, taking browser cookies from the victim’s machine and uploading them to the actor's command & control servers.


Although this type of malware can be configured to be persistent on the victim's machine, these actors are running all malware in non-persistent mode as a smash-and-grab technique.


This is because if the malicious file is not detected when executed, there are less artifacts on an infected host and therefore security products fail to notify the user of a past compromise.


We have observed that actors use various types of malware based on personal preference, most of which are easily available on Github.


Some commodity malware used included RedLine, Vidar, Predator The Thief, Nexus stealer, Azorult, Raccoon, Grand Stealer, Vikro Stealer, Masad (Google’s naming), and Kantal (Google’s naming) which shares code similarity with Vidar.


Open source malware like Sorano and AdamantiumThief were also observed.


Related hashes are listed in the Technical Details section, at the end of this report.


Most of the observed malware was capable of stealing both user passwords and cookies.


Some of the samples employed several anti-sandboxing techniques including enlarged files, encrypted archive and download IP cloaking.


A few were observed displaying a fake error message requiring user click-through to continue execution.


A large number of hijacked channels were rebranded for cryptocurrency scam live-streaming.


The channel name, profile picture and content were all replaced with cryptocurrency branding to impersonate large tech or cryptocurrency exchange firms.


The attacker live-streamed videos promising cryptocurrency giveaways in exchange for an initial contribution.


On account-trading markets, hijacked channels ranged from $3 USD to $4,000 USD depending on the number of subscribers.


These campaigns were carried out by a number of hack-for-hire actors recruited on Russian-speaking forums via the following job description, offering two types of work: This recruitment model explains the highly customized social engineering, as well as the varied malware types given each actor's choice of preferred malware.


We are continuously improving our detection methods and investing in new tools and features that automatically identify and stop threats like this one.


Some of these improvements include: It is also important that users remain aware of these types of threats and take appropriate action to further protect themselves.


Our recommendations: Additional resources: Avoid & Report Phishing Emails.


Related Malware hashes: Top Phishing Domains:


A defender who finds a simple remote access trojan (RAT) in the network won’t immediately think it was from an advanced persistent threat (APT) actor.


Likewise, brute force attacks on internet-facing services like email, Microsoft Autodiscover, SMB, LDAP, and SQL are so common that they may seem like background noise that can be ignored.


But in 2020, the notorious APT actor Pawn Storm used exactly these non-sophisticated attack methods to such an extent that their attacks may get lost in the noise.


In 2020 Pawn Storm spread simple Google Drive and IMAP Remote Access Trojans (RATs) to attack their usual targets, such as ministries of foreign affairs, embassies, the defense industry and the military.


The RATs were also sent to a wider net of targets including various industries around the world.


The group also performed widespread brute force attacks to steal credentials such as those of corporate email accounts, as evidenced by network probes we attribute to Pawn Storm and the loose way the actor abused compromised email accounts in malware and in sending spear-phishing emails.


Pawn Storm even hardcoded compromised military and government-related email addresses in their IMAP RAT malware to communicate with victims’ computers.


Recently, Norwegian authorities announced that Pawn Storm hacked the Norwegian parliament through brute force attacks.


As shown in incremental improvements, subsequent versions of the malware hint towards a learning curve of the malware author that is more typical for an inexperienced actor than for an advanced actor.


First, the RATs were so simple that they did not even take into account international keyboards.


This means it would be difficult for the attacker to enumerate the victims’ hard drives with files and folders that contain international characters.


This mistake was corrected swiftly, but it shows the relative inexperience of this particular Pawn Storm operator.


Later versions of the RAT malware started to use encryption, which could have been added right from the start.


The only secondary payload we observed was a simple keylogger that stores stolen information locally on the victims’ machines.


Attribution to Pawn Storm of these malware samples would be difficult with only the samples at hand.


Typically, a network defender would not attribute this kind of malware to an APT actor at all.


However, we have solid attribution for these samples based on our long-term monitoring of Pawn Storm’s activities.


Recap of recent Pawn Storm activities Compromising accounts of users from the Middle East Trend Micro has been closely and consistently monitoring the activities of Pawn Storm, and in March 2020, we released our latest research on the group.


In the aforementioned research paper, we shared that Pawn Storm heavily abuses compromised accounts — mainly in the Middle East — to send spear-phishing emails.


The abuse of compromised email accounts in the Middle East continued in 2020.


For example, in early December 2020 the group used a VPN service to connect to a compromised cloud server, then used the cloud server to connect to a commercial business email service provider.


The group then logged in to a compromised email account of a chicken farm in Oman, and then sent out credential phishing spam messages to high-profile targets around the world.


This shows that Pawn Storm is careful at obfuscating their tracks on multiple levels.


The abuse of various compromised email accounts in the Middle East started in May 2019 and continues today.


Since August 2020, they didn’t use these email addresses to only send spear-phishing emails, but also as a way to communicate with compromised systems in IMAP RATs.


Brute force attacks


We think that Pawn Storm compromises lots of email accounts through brute force attacks on internet-facing services like email, LDAP, Microsoft Autodiscover, SMB, and SQL.


For example, in May 2020, Pawn Storm scanned IP addresses worldwide, including IP addresses from the defense industry in Europe, on TCP port 445 and 1433, likely in an attempt to find vulnerable SMB and SQL servers or brute force credentials.


In August 2020, Pawn Storm also sent UDP probes to LDAP servers around the world from one of their dedicated IP addresses.


In 2020, Pawn Storm often tries to obfuscate these brute force attempts by routing their attack traffic over Tor and VPN servers.


Yet this is not always enough to hide these activities.


In a Microsoft article about brute-forcing Office365 credentials over Tor, Microsoft attributed the activities to Strontium, which is another name for Pawn Storm.


We wrote about related attacks in early 2020.


These brute force attacks started in 2019, and then we could firmly attribute them to Pawn Storm because we could cross-relate the extensive probing of Microsoft Autodiscover servers around the world with high-confidence indicators of the group’s more traditional attack methods (spear phishing and credential phishing).


To illustrate the simplicity of the malware in Pawn Storm’s recent spear-phishing attacks, we describe one example below:


Technical analysis of Google Drive RAT       Figure 1. Spear phishing email from Pawn Storm – collected in August 2020.


Starting from August 2020, Pawn Storm has sent several spear phishing emails with a malicious RAR attachment.


Among the earliest samples we received were two almost identical RAR files that contained a file called info.exe.


Both versions of the info.exe files are self-extracting archives (SFX) that extract and execute two files: decrypt.exe and gdrive.exe.


We have: c4a61b581890f575ba0586cf6d7d7d3e0c7603ca40915833d6746326685282b7


installing  decrypt.exe – 661d4a0d877bac9b813769a85c01bce274a77b29ccbd4b71e5b92df3c425b93b gdrive.exe – cbd9cb7b69f864ce8bae983ececb7cf8627f9c17fdaba74bd39baa5cdf605f79  3fd45b9b33ff5b6363ba0013178572723b0a912deb8235a951aa3f0aa3142509 installing  decrypt.exe – 661d4a0d877bac9b813769a85c01bce274a77b29ccbd4b71e5b92df3c425b93b gdrive.exe – 2060f1e108f5feb5790320c38931e3dc6c7224edf925bf6f1840351578bbf9cc  Decoy File


We noticed that the file decrypt.exe is a decoy file that will run once info.exe is executed.


The application will only show a message box wherein a user can type a password for decryption.


Checking the disassembly of this file reveals that it only shows another message box when a password is entered on the main application.


Figures 2-3.


The message box that decrypt.exe displays


After closing this application, the file gdrive.exe will be executed by the SFX archive.


The different versions of gdrive.exe are almost identical, with a minor addition to the file 2060f1e108f5feb5790320c38931e3dc6c7224edf925bf6f1840351578bbf9cc of base64 encoding on the victim’s id.


Figure 4. Drive.exe code snippet showing comp_id      Figure 5. Drive.exe code snippet showing comp_id and base64 encoding     Initial Run


The first thing this malware does is it copies itself to the startup directory for persistence.


It does this via cmd.exe with the following command:   move /Y  "{malware_location}"  "C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdrive.exe"  Every time the malware runs a command using cmd.exe, the standard output (STDOUT) of the executed command is piped and written to a Google Drive account with the following filename format:   {utcnow}_report_{victim’s id}       Figure 6.


Code snippet showing the execution of commands     The client key and token used to read and write the attacker’s Google Drive account is hardcoded on the malware itself.


Figures 7-8.


Code snippets showing client key and token     Sending back the information through Google Drive will allow the attacker to check if the machine that executed the malware was the intended victim they wanted to target.


Receiving commands and data exfiltration Every 20 minutes, the bot checks for a file in Google Drive.


If a file with a corresponding filename format exist (cmd_{victim’s id})


, it downloads that file and runs the contents as a batch file.      Figure 9. Code snippets


showing


waiting for commands


Again, the STDOUT of the commands will be written back to Google Drive as a result.


This works as a reverse shell back to the attacker with Google Drive as the Command and Control (C&C) server.


The command file that the bot received from Google Drive will also be deleted once it is downloaded.


Figure 10. Code snippets showing readFile     Using the “reverse shell” method mentioned above


, the attacker can exfiltrate data/documents using the following commands:  powershell -command "[Convert]::ToBase64String([IO.File]::ReadAllBytes('{filename}')       Figure 11.


Code snippets showing the exfiltration of data     The secondary payload with the filename Google Drivemonitor.exe (0b94e123f6586967819fa247cdd58779b1120ef93fa1ea1de70dffc898054a09) is a keylogger.


The collected keystrokes are stored in the same directory from which the malware was executed.


Figure 12.


Code snippets showing keylogs     This secondary payload does not have any function to upload the collected keystrokes back to the attacker.


However, since the main malware acts as a “reverse shell,” the attacker can retrieve the collected keystrokes at a later time.


Eventually, the threat actor added improvements to the malware, like encryption.


Later the actor started to use IMAP RATs as well.


Trend Micro solutions Trend Micro recommends Trend MicroTM XDR for extensive monitoring across the connected layers of email, endpoints, cloud workloads, and networks.


Powered by advanced AI and expert security analytics for correlating data, XDR allows earlier detection and response and lessens alert fatigue for IT security teams.


We also offer Trend Micro Managed XDR, a 24/7 service that harnesses the skills of our expert Managed Detection and Response analysts for expert threat monitoring, correlation, and analysis.


Indicators of compromise IP addresses  IP address  Description  Dates active  34.243.239[.]199  Connects to email servers of compromised accounts.


IP address possibly compromised by Pawn Storm.  October 29, 2020 – December 8, 2020  74.208.228[.]186  Connects to email servers of compromised accounts.


IP address possibly compromised by Pawn Storm.


October 15, 2020 – December 14, 2020  193.56.28[.]25  Scans TCP port 445 and 1433  May 21 – May 26, 2020  195.191.235[.]155  Scans UDP port 389   August 22, 2020   Files  SHA256  Filename  Description  Trend Micro Pattern Detection  Trend Micro Machine Learning Detection  c4a61b581890f575ba0586cf6d7d7d3e0c7603ca40915833d6746326685282b7  info.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FSX005  3fd45b9b33ff5b6363ba0013178572723b0a912deb8235a951aa3f0aa3142509  info.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FSX005  cbd9cb7b69f864ce8bae983ececb7cf8627f9c17fdaba74bd39baa5cdf605f79  gdrive.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FFF039  2060f1e108f5feb5790320c38931e3dc6c7224edf925bf6f1840351578bbf9cc  gdrive.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  Troj.Win32.TRX.XXPE50FFF039  f364729450cb91b2a4c4e378c08e555137028c63480a221bb70e7e179a03f5cc  gdrive.exe  Google Drive RAT  Trojan.MSIL.DRIVEOCEAN.A  N/A  e3894693eff6a2ae4fa8a8134b846c2acaf5649cd61e71b1139088d97e54236d  info.exe  IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FSX005  83fbd76d298253932aa3e3a9bc48c201fe0b7089f0a7803e68f41792c05c5279  decrypt_v2.4.exe  IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FSX005  fe00bd6fba209a347acf296887b10d2574c426fa962b6d4d94c34b384d15f0f1  email.exe


IMAP RAT  Trojan


MSIL.OCEANMAP.A


Troj.Win32.TRX.XXPE50FFF039  b61e0f68772f3557024325f3a05e4edb940dbbe380af00f3bdaaaeabda308e72  igmtSX.exe


IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj


.Win32.TRX.XXPE50FFF039  c8b6291fc7b6339d545cbfa99256e26de26fff5f928fef5157999d121fe46135


igmtSX.exe  IMAP RAT


Trojan.MSIL.OCEANMAP.A


Troj.Win32.TRX.XXPE50FFF039  50b000a7d61885591ba4ec9df1a0a223dbceb1ac2facafcef3d65c8cbbd64d46  email.exe


IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FFF039  3384a9ef3438bf5ec89f268000cc7c83f15e3cdf746d6a93945add300423f756  email.exe


email.exe  IMAP RAT


Troj.Win32.TRX.XXPE50FFF039  faf8db358e5d3dbe2eb9968d8b19f595f45991d938427124161f5ed45ac958d5  email.exe


IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FFF039  4c1b8d070885e92d61b72dc9424d9b260046f83daf00d93d3121df9ed669a5f9  email.exe


770206424b8def9f6817991e9a5e88dc5bee0adb54fc7ec470b53c847154c22b  email.exe


IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FFF039  6fb2facdb906fc647ab96135ce2ca7434476fb4f87c097b83fd1dd4e045d4e47  email.exe


IMAP RAT  Trojan.MSIL.OCEANMAP.A  Troj.Win32.TRX.XXPE50FFF039  31577308ac62fd29d3159118d1f552b28a56a9c039fef1d3337c9700a3773cbf


photos.exe  IMAP RAT


N/A  661d4a0d877bac9b813769a85c01bce274a77b29ccbd4b71e5b92df3c425b93b  decrypt.exe


decoy file  N/A


N/A  0b94e123f6586967819fa247cdd58779b1120ef93fa1ea1de70dffc898054a09  Google Drivemonitor.exe  keylogger


TrojanSpy


.MSIL.KEYLOGGR.WLDG  N/A       Tags  Articles, News, Reports | APT & Targeted Attacks | Research


The MuddyWater campaign was first sighted in 2017 when it targeted the Saudi government using an attack involving PowerShell scripts deployed via Microsoft Office Word macro.


In March 2018, we provided a detailed analysis of another campaign that bore the hallmarks of MuddyWater.


In May 2018, we found a new sample (Detected as W2KM_DLOADR.UHAOEEN) that may be related to this campaign.


Like the previous campaigns, these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell (PS) scripts leading to a backdoor payload.


One notable difference in the analyzed samples is that they do not directly download the Visual Basic Script(VBS) and PowerShell component files, and instead encode all the scripts on the document itself.


The scripts will then be decoded and dropped to execute the payload without needing to download the component files.


As mentioned earlier, our analysis of the sample revealed characteristics that likely connect it to the MuddyWater campaign, in particular:  The delivery method, which involves the use of a malicious document with an embedded macro as a lure for potential victims The obfuscation method for the macro scripts, which will result in an intended backdoor payload.


This method is commonly used in samples that were used in the MuddyWater campaign    Infection chain   Figure 1.


Comparison of the infection chains used in the previous and current campaigns Technical details


The sample we analyzed was a Word document used as a lure for unsuspecting victims.


However, unlike the samples from the previous campaigns, the lure document deals with a different subject matter.


Instead of using government or telecommunications-related documents, the new lure document presents itself as a reward or promotion, which could indicate that the targets are no longer limited to specific industries or organizations.


Figure 2.


Sample lure document used in the new campaign


The document is designed to trick users into enabling the macro to view its full content.


However, the macro's true purpose is to allow it to execute malicious routines without the user’s knowledge.


Once the macro is enabled, it will use the Document_Open() event to automatically execute the malicious routine if either a new document using the same template is opened or when the template itself is opened as a document0.


Figure 3.


Executing the malicious routine via Document_Open()


The malicious macro's code snippet uses three main functions, specifically:  The function contained in the RED box is the Document_Open() event, where all the sub-functions will be executed/called.


The code inside the GREEN box manipulates the images shown in the document's body.


The code inside the BLUE box constructs the main Powershell commands and scripts.


These will be executed to perform the main routine.


Figure 4.


A snippet of the malicious macro’s code, marked with colored boxes to show the different functions Decoding and deobfuscation


Analysis of the code revealed a PowerShell script capable of decoding the contents of the malicious document, which results in the execution of yet another encoded PowerShell script.


Figure 5.


The Powershell script contained in the sample's code  Figure 6.


The second encoded PowerShell script, which is executed after the first script is decoded This will then result in more readable PowerShell scripts capable of dropping various components in the %Application Data%\Microsoft\CLR\* directory.


The main PowerShell file invoker.ps1 uses these components to run the final payload, PRB-Backdoor, previously analyzed by other security researchers in May 2018.


Figure 7: The components dropped in the %Application Data%\Microsoft\CLR\* directory PRB-Backdoor is a backdoor that takes its name from the function used in the final PowerShell script payload, as seen in the figure below.  Figure 8.


The PS function from which PRB-Backdoor takes its name


The backdoor communicates with its Command-and-Control (C&C server), hxxp://outl00k[.]net, to send and receive the following commands:    Command  Details


PRB-CREATEALIVE Initializes connection with the C&C Server PRB-CREATEINTRODUCE


Registers


introduces the affected machine to the C&C server PRB-History


Gather browsing histories from different browsers and send it to the C&C server using the "sendfile" function PRB-PASSWORD Steals passwords listed or found in the browser histories PRB-READFILE Reads files PRB-WRITEFILE


Writes files PRB-Shell Executes shell commands PRB-Logger Calls the "Logger" function, used to record keyboard strokes PRB-Shot Triggers the SNAP function, used to capture  screenshots PRB-funcupdate Updates functions sysinfo Gathers system information Start_Dns Initializes DNS Session/Connection


If these samples are indeed related to MuddyWater, this means that the threat actors behind MuddyWater are continuously evolving their tools and techniques to make them more effective and persistent.


Countermeasures and Trend Micro Solutions


Given the use of lure documents designed with social engineering in mind, it is likely that the attackers use phishing or spam to target users who are unaware of these documents' malicious nature.


Awareness can effectively mitigate or stop these kinds of attacks from being successful.


The first step is to be able to identify phishing attacks and distinguish legitimate emails from malicious ones.


Telltale signs of social engineering include “too-good-to-be-true” offers and messages that lack context.


In general, users should always practice caution when it comes to email.


This includes avoiding clicking on links or downloading any documents unless certain that these are legitimate.


Trend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to today’s stealthy malware, and targeted attacks in real time.


It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect threats even without any engine or pattern update.


Trend Micro™ Hosted Email Security is a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.


Trend Micro™


Deep Discovery™ Email Inspector and InterScan™ Web Security prevent malware from ever reaching end users.


At the endpoint level, Trend Micro™ Smart Protection Suites deliver several capabilities that minimize the impact of these attacks.


These solutions are powered by the Trend Micro XGen™ security, which provides a cross-generational blend of threat defense techniques against a full range of threats for data centers, cloud environments, networks, and endpoints.


It features high-fidelity machine learning to secure the gateway and endpoint data and applications, and protects physical, virtual, and cloud workloads.


Indicators of Compromise (IoCs) Detected as W2KM_DLOADR.UHAOEEN - 240b7d2825183226af634d3801713b0e0f409eb3e1e48e1d36c96d2b03d8836b        Tags  APT & Targeted Attacks | Endpoints | Research | Articles, News, Reports | Network


We discovered a potential targeted attack that makes use of legitimate script engine AutoHotkey, in combination with malicious script files.


This file is distributed as an email attachment and disguised as a legitimate document with the filename “Military Financing.xlsm.”


The user would need to enable macro for it to open fully, which would use AutoHotkey in loading the malicious script file to avoid detection.


It will then enable the threat actors to steal certain information and even download TeamViewer to gain remote access to the system.


If the user enables macro to open the xlsm file, it will then drop the legitimate script engine AutoHotkey along with a malicious script file.


Once the AutoHotkey loads the malicious script file, it connects to its C&C server to download and execute additional script files in response to commands from the server.


In our observation, it lastly downloaded and executed TeamViewer to gain remote control over the system.


However, it can download and execute other script files depending on the command it receives from the C&C server.


Figure 1. Attack chain starting with the arrival of the email with the malicious attachment The Excel File


The attached excel file is titled “Foreign Military Financing (FMF),” named after a program of the U.S. Defense Security Cooperation Agency.


This cover was likely used to further push users to enable content so that they can access confidential information.


Figure 2.


Content of the Excel file


At first glance, the excel file seems to only have one filled sheet.


However, as can be seen in figure 2, it has another sheet inconspicuously named with a “ ” or a blank space.


Figure 3.


HEX strings in the second sheet originally “hidden” using white font Once the user enables macro for this file, it drops two files through the HEX strings written as binary text in two columns of the blank space sheet.


These HEX strings are originally written in white font, to make it appear as if the columns were blank.


These dropped files are:  Content of column X: 「C:\ProgramData\AutoHotkeyU32.exe」(legitimate AutoHotkey executable file) Content of column Y: 「C:\ProgramData\AutoHotkeyU32.ahk」(malicious script for AutoHotkey created by the attacker)  The malicious string and abuse of AutoHotkey


Depending on the script files, the AutoHotkey application can assign a hotkey or execute any process written in the script file.


In this case, the script file AutoHotkeyU32.ahk does not assign a hotkey but it does execute the following commands:


Create a link file in the startup folder for AutoHotkeyU32.exe, allowing the attack to persist even after a system restart.


Connect to the C&C server every 10 seconds to download, save, and execute script files containing the commands.


Send the volume serial number of the C drive, which allows the attacker to identify the victim.


Figure 4.


A partial code snippet of AutoHotkeyu32.ahk  Figure 5.


A sample C&C response


When the attacker sends a response similar to that shown in the figure 5 sample via the C&C, the script file converts the HEX strings into plain text, which translates to the URL “001::hxxp://185.70.186.145/7773/plug/hscreen.ahk.”


Then it downloads the ahk file (hscreen.ahk) from this URL, saves the file in “%temp%” folder using a random filename, and finally executes it by loading it through AutoHotkeyU32.exe.


The URL was no longer available at the time of writing.


Further research uncovered other dropped files involved in this attack.


These files allow the attackers to get the computer name and take screen captures.


More importantly, one of these files also enables the download of TeamViewer, a remote access tool that gives threat actors remote control over the system.


We have yet to conclude this attack's exact purpose.


For now, we can surmise that it has the makings of a potential targeted attack because of its cyber espionage capabilities, as well as the potential for delivering ransomware and coinminer.


Security recommendations


As we continue to monitor this attack users can re-asses their security measures against similar cases.


Against most attacks, users should implement a multilayer defense and have mitigation protocols in place to detect and address intrusions.


Users should also take full advantage of their network defense solutions by enhancing settings, especially for macro malware attached emails.


Such attacks highlight the need for caution before downloading files from unknown sources and enabling macro for files from unknown sources.


Microsoft provides several security notifications about enabling content.


Other best practices:  Consistently check the sender, title, and body for any suspicious details before downloading and opening an attached file.


Always check the extension of any attached file to see if it is consistent with the received email.


Before enabling content to open a file, check for red flags such as content that urges the user to enable macro, or content that appears blank.  Indicators of Compromise (IoCs)  SHA256


Filename


Detection name Description EFE51C2453821310C7A34DCA3054021D0F6D453B7133C381D75E3140901EFD12 Military Financing.xlsm W2KM_HTV.ZKGD-A


Carries the malicious script and AutoHotkeyU32.ahk 43FBDA74A65668333727C6512562DB4F9E712CF1D5AD9DCA8F06AE51BB937BA2 hscreen.ahk TSPY_HTV.ZJGD-A Takes screen captures ACB3181D0408C908B2A434FC004BF24FB766D4CF68BF2978BC5653022F9F20BE AutoHotkeyU32.ahk BKDR_HTV.ZKGD-A Loads the malicious script BE6C6B0942AD441953B0ED0C4327B9DED8A94E836EACA070ACA3988BADB31858 hinfo.ahk TSPY_HTV.ZLGD-A Gets the computer name F64792324839F660B9BDFDA95501A568C076641CF08CE63C1DDBE29B45623AC0 htv.ahk


TROJ_HTV.ZJGD-A Downloads and executes TeamViewer   C&C 185[.]70[.]186[.]145


Tags  APT & Targeted Attacks | Endpoints | Research


At the dawn of the Fourth of July weekend, Kaseya has been hit with a ransomware attack, as reported in the company’s own announcement.


Kaseya provides IT management software to mostly managed service providers (MSPs).


As a result, the attack not only impacted the MSPs, but also the customers that they served.


It even took a small town offline.


Thankfully Kaseya acted extremely quickly advising all Kaseya VSA on-premises users to shut down their servers until further instructions.


We believe this early directive hugely mitigated the impact of this attack.


Kaseya said the ransomware attack had “limited impact, with only approximately 50 of the more than 35,000 Kaseya customers being breached.


” But, as a MSP, customer’s trust is crucial which in turn will mean greater security scrutiny of the cybersecurity infrastructure you have in place.


You don’t want to be one of the 50 who got hit by a ransomware.


For MSPs working with Trend Micro, we have a very positive news.


Trend Micro Worry-Free endpoint security provides an effective first line of defense against the Kaseya ransomware through predictive machine learning and behavior monitoring capabilities.


The ransomware was effectively blocked before the IOCs were added to our backend detection pattern.


Trend Micro is also blocking several known malicious domain disease vectors associated with the ransomware campaign via Trend Micro Web Reputation Services (WRS).


The bottom line is that our layered approach is helping to prevent and protect our customers and our MSPs.


The Kaseya ransomware incident would definitely not be the last cyberattack toward MSPs as cybercriminals look to maximize their gains in the supply chain or infrastructure industries.


This is where we come in -- we want to help you to protect your house.


You need to make sure your business is protected.


We are offering all MSPs a free Not-For-Resale Worry-Free XDR License for internal use.


Worry-Free XDR includes cloud-based endpoint and email protection, EDR, and XDR.


In addition we will give you a 30-day use of a Security Operation Center as a Service solution and will allow you to receive:  Endpoint & Email security policy review and analysis Best Practice Configurations Assistance with enabling & configuring advanced XDR technologies 24x7 Monitoring and early threat containment Incident response services Remediation Assistance


Access


to Security Analysts


In the 30 days evaluation period, our security analysts will help you set up recommended policies or review your existing policies, monitor your endpoints and email accounts 24x7, conduct proactive incident investigation, mitigate the threat such as quarantine emails (if authorized by you in advance), and provide a detailed report if an incident happens.


It’s a great opportunity to try our industry leading endpoint and email extended detection and response (XDR) and Managed XDR.


Act fast!


This offer ends September 30, 2021.


Just click the URL below for your region, sign up today for your free trial and allow us to help you protect your business.


Americas Europe Australia and New Zealand


Tags  Cloud | Cyber Threats | APT & Targeted Attacks | Endpoints | Ransomware | Network | Security Strategies | Articles, News, Reports


To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild.


In 2021, we reported nine 0-days affecting Chrome, Android, Apple and Microsoft, leading to patches to protect users from these attacks.


This blog is a follow up to our July 2021 post on four 0-day vulnerabilities we discovered in 2021, and details campaigns targeting Android users with five distinct 0-day vulnerabilities: We assess with high confidence that these exploits were packaged by a single commercial surveillance company, Cytrox, and sold to different government-backed actors who used them in at least the three campaigns discussed below.


Consistent with findings from CitizenLab, we assess likely government-backed actors purchasing these exploits are operating (at least) in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain and Indonesia.


The 0-day exploits were used alongside n-day exploits as the developers took advantage of the time difference between when some critical bugs were patched but not flagged as security issues and when these patches were fully deployed across the Android ecosystem.


Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments with the technical expertise to develop and operationalize exploits.


Seven of the nine 0-days TAG discovered in 2021 fall into this category: developed by commercial providers and sold to and used by government-backed actors.


TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.


All three campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email.


The campaigns were limited — in each case, we assess the number of targets was in the tens of users.


Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website.


If the link was not active, the user was redirected directly to a legitimate website.


We've seen this technique used against journalists and other unidentified targets, and alerted those users when possible.


We assess that these campaigns delivered ALIEN, a simple Android malware in charge of loading PREDATOR, an Android implant described by CitizenLab in December 2021.


ALIEN lives inside multiple privileged processes and receives commands from PREDATOR over IPC.


These commands include recording audio, adding CA certificates, and hiding apps.


The first campaign, detected in August 2021, used Chrome on a Samsung Galaxy S21 and the web server immediately replied with a HTTP redirect (302) pointing to the following intent URL.


This URL abused a logic flaw and forced Chrome to load another URL in the Samsung Browser without user interaction or warnings.


We did not capture the subsequent stages, but assess the attackers did not have exploits for the current version of Chrome (91.0.4472) at that time, but instead used n-day exploits targeting Samsung Browser, which was running an older and vulnerable version of Chromium.


We assess with high confidence this vulnerability was sold by an exploit broker and probably abused by more than one surveillance vendor.


More technical details about this vulnerability are available in this RCA by Maddie Stone.


Related IOCs


In September 2021, TAG detected a campaign where the exploit chain was delivered to a fully up-to-date Samsung Galaxy S10 running the latest version of Chrome.


We recovered the exploit used to escape the Chrome Sandbox, but not the initial RCE exploit.


The sandbox escape was loaded directly as an ELF binary embedding libchrome.so and a custom libmojo_bridge.so was used to ease the communication with the Mojo IPCs.


This means the renderer exploit did not enable MojoJS bindings like we often see in public exploits.


Analysis of the exploit identified two different vulnerabilities in Chrome: After escaping the sandbox, the exploit downloaded another exploit in /data/data/com.android.chrome/p.so to elevate privileges and install the implant.


We haven’t retrieved a copy of the exploit.


In October 2021, we detected a full chain exploit from an up-to-date Samsung phone running the latest version of Chrome.


The chain included two 0-day exploits: Of note, CVE-2021-1048 was fixed in the Linux kernel in September 2020, over a year before this campaign.


The commit was not flagged as a security issue and therefore the patch was not backported in most Android kernels.


At the time of the exploit, all Samsung kernels were vulnerable; LTS kernels running on Pixel phones were recent enough and included the fix for this bug.


Unfortunately, this is not the first time we have seen this happen with exploits in the wild; the 2019 Bad Binder vulnerability is another example.


In both cases, the fix was not flagged as a security issue and thus not backported to all (or any) Android kernels.


Attackers are actively looking for and profiting from such slowly-fixed vulnerabilities.


We’d be remiss if we did not acknowledge the quick response and patching of these vulnerabilities by Google’s Chrome and Android teams.


We would also like to thank Project Zero for their technical assistance in helping analyze these bugs.


TAG continues to track more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.


We remain committed to updating the community as we uncover these campaigns.


Tackling the harmful practices of the commercial surveillance industry will require a robust, comprehensive approach that includes cooperation among threat intelligence teams, network defenders, academic researchers and technology platforms.


We look forward to continuing our work in this space and advancing the safety and security of our users around the world.


NOTE: On May 20th, we updated our attribution to more precisely describe our findings.


On any given day, Google's Threat Analysis Group (TAG) is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


Our team of analysts and security experts is focused on identifying and stopping issues like phishing campaigns, zero-day vulnerabilities and hacking against Google, our products and our users.


Today, we’re sharing recent findings on government-backed phishing, threats and disinformation, as well as a new bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns.


Last month, we sent 1,755 warnings to users whose accounts were targets of government-backed attackers.


Generally, 2020 has been dominated by COVID-19.


The pandemic has taken center stage in people’s everyday lives, in the international news media, and in the world of government-backed hacking.


Recently, we shared information on numerous COVID-themed attacks discovered and confirmed by our teams.


We continue to see attacks from groups like Charming Kitten on medical and healthcare professionals, including World Health Organization (WHO) employees.


And as others have reported, we’re seeing a resurgence in COVID-related hacking and phishing attempts from numerous commercial and government-backed attackers.


As one example, we've seen new activity from “hack-for-hire” firms, many based in India, that have been creating Gmail accounts spoofing the WHO.


The accounts have largely targeted business leaders in financial services, consulting, and healthcare corporations within numerous countries including, the U.S., Slovenia, Canada, India, Bahrain, Cyprus, and the UK.


The lures themselves encourage individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements, and link to attacker-hosted websites that bear a strong resemblance to the official WHO website.


The sites typically feature fake login pages that prompt potential victims to give up their Google account credentials, and occasionally encourage individuals to give up other personal information, such as their phone numbers.


To help protect users against these kinds of tracks, our Advanced Protection Program (APP) utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings.


APP was designed specifically for high-risk accounts.


Government-backed or state-sponsored groups have different goals in carrying out their attacks: Some are looking to collect intelligence or steal intellectual property; others are targeting dissidents or activists, or attempting to engage in coordinated influence operations and disinformation campaigns.


Our products are designed with robust built-in security features, like Gmail protections against phishing and Safe Browsing in Chrome, but we still dedicate significant resources to developing new tools and technology to help identify, track and stop this kind of activity.


In addition to our internal investigations, we work with law enforcement, industry partners, and third parties like specialized security firms to assess and share intelligence.


When we find attempts to conduct coordinated influence operations on our platforms, we work with our Trust & Safety teams to swiftly remove such content from our platforms and terminate these actors’ accounts.


We take steps to prevent possible future attempts by the same actors, and routinely exchange information and share our findings with others in the industry.


We’ve also shared occasional updates about this kind of activity, and today we’re introducing a more streamlined way of doing this via a new, quarterly bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns (foreign and domestic).


Our actions against coordinated influence operations from January, February and March can be found in the Q1 Bulletin.


Since March, we’ve removed more than a thousand YouTube channels that we believe to be part of a large campaign and that were behaving in a coordinated manner.


These channels were mostly uploading spammy, non-political content, but a small subset posted primarily Chinese-language political content similar to the findings of a recent Graphika report.


We’ll also share additional removal actions from April and May in the Q2 Bulletin.


Our hope is that this new bulletin helps others who are also working to track these groups, such as researchers studying this issue, and we hope these updates can help confirm findings from security firms and others in the industry.


We will also continue to share more detailed analysis of vulnerabilities we find, phishing and malware campaigns that we see, and other interesting or noteworthy trends across this space.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 of 2020.


It was last updated on May 27, 2020.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


The campaign was linked to the Iranian state-sponsored International Union of Virtual Media (IUVM) network, and was reproducing IUVM content covering Iran’s strikes into Iraq and U.S. policy on oil.


We received leads from Graphika that supported us in this investigation.


We terminated 1 advertising account and 82 YouTube channels as part of our actions against a coordinated influence operation linked to Egypt.


The campaign was sharing political content in Arabic supportive of Saudi Arabia, the UAE, Egypt, and Bahrain and critical of Iran and Qatar.


We found evidence of this campaign being tied to the digital marketing firm New Waves based in Cairo.


This campaign was consistent with similar findings reported by Facebook.


We terminated 3 advertising accounts, 1 AdSense account, and 11 YouTube channels as part of our actions against a coordinated influence operation linked to India.


The campaign was sharing messages in English supportive of Qatar.


We banned 1 Play developer and terminated 68 YouTube channels as part of our actions against a coordinated influence operation.


The campaign was posting political content in Arabic supportive of Turkey and critical of the UAE and Yemen.


This campaign was consistent with similar findings reported by Twitter.


We terminated 1 advertising account, 1 AdSense account, 17 YouTube channels and banned 1 Play developer as part of our actions against a coordinated influence operation linked to Egypt.


The campaign was posting political content in Arabic supportive of Saudi Arabia, the UAE, Egypt, and Bahrain and critical of Iran and Qatar.


We banned 1 Play developer and terminated 78 YouTube channels as part of our actions against a coordinated influence operation linked to Serbia.


The domestic campaign was posting pro-Serbian political content.


Google’s Threat Analysis Group (TAG) is a specialized team of security experts that works to identify, report, and stop government-backed phishing and hacking against Google and the people who use our products.


We work across Google products to identify new vulnerabilities and threats.


Today we’re sharing our latest findings and the threats we’re seeing in relation to COVID-19.


One notable campaign attempted to target personal accounts of U.S. government employees with phishing lures using American fast food franchises and COVID-19 messaging.


Some messages offered free meals and coupons in response to COVID-19, others suggested recipients visit sites disguised as online ordering and delivery options.


Once people clicked on the emails, they were presented with phishing pages designed to trick them into providing their Google account credentials.


The vast majority of these messages were sent to spam without any user ever seeing them, and we were able to preemptively block the domains using Safe Browsing.


We’re not aware of any user having their account compromised by this campaign, but as usual, we notify all targeted users with a “government-backed attacker” warning.


We’ve also seen attackers try to trick people into downloading malware by impersonating health organizations: Generally, we’re not seeing an overall rise in phishing attacks by government-backed groups; this is just a change in tactics.


In fact, we saw a slight decrease in overall volumes in March compared to January and February.


While it’s not unusual to see some fluctuations in these numbers, it could be that attackers, just like many other organizations, are experiencing productivity lags and issues due to global lockdowns and quarantine efforts.


When working to identify and prevent threats, we use a combination of internal investigative tools, information sharing with industry partners and law enforcement, as well as leads and intelligence from third-party researchers.


To help support this broader security researcher community, Google is providing more than $200,000 in grants as part of a new Vulnerability Research Grant COVID-19 fund for Google VRP researchers who help  identify various vulnerabilities.


As the world continues to respond to COVID-19, we expect to see new lures and schemes.


Our teams continue to track these and stop them before they reach people—and we’ll continue to share new and interesting findings.


Google’s Threat Analysis Group (TAG) works to counter targeted and government-backed hacking against Google and the people who use our products.


Following our November update, today we’re sharing the latest insights to fight phishing, and for security teams, providing more details about our work identifying attacks against zero-day vulnerabilities.


We have a long-standing policy to send you a warning if we detect that your account is a target of government-backed phishing or malware attempts.


In 2019, we sent almost 40,000 warnings, a nearly 25 percent drop from 2018.


One reason for this decline is that our new protections are working—attackers' efforts have been slowed down and they’re more deliberate in their attempts, meaning attempts are happening less frequently as attackers adapt.


We’ve detected a few emerging trends in recent months.


Upon reviewing phishing attempts since the beginning of this year, we’ve seen a rising number of attackers, including those from Iran and North Korea, impersonating news outlets or journalists.


For example, attackers impersonate a journalist to seed false stories with other reporters to spread disinformation.


In other cases, attackers will send several benign emails to build a rapport with a journalist or foreign policy expert before sending a malicious attachment in a follow up email.


Government-backed attackers regularly target foreign policy experts for their research, access to the organizations they work with, and connection to fellow researchers or policymakers for subsequent attacks.


Government-backed attackers continue to consistently target geopolitical rivals, government officials, journalists, dissidents and activists.


The chart below details the Russian threat actor group SANDWORM’s targeting efforts (by sector) over the last three years.


In 2019, one in five accounts that received a warning was targeted multiple times by attackers.


If at first the attacker does not succeed, they’ll try again using a different lure, different account, or trying to compromise an associate of their target.


We’ve yet to see people successfully phished if they participate in Google’s Advanced Protection Program (APP), even if they are repeatedly targeted.


APP provides the strongest protections available against phishing and account hijacking and is specifically designed for the highest-risk accounts.


Zero-day vulnerabilities are unknown software flaws.


Until they’re identified and fixed, they can be exploited by attackers.


TAG actively hunts for these types of attacks because they are particularly dangerous and have a high rate of success, although they account for a small number of the overall total.


When we find an attack that takes advantage of  a zero-day vulnerability, we report the vulnerability to the vendor and give them seven days to patch or produce an advisory or we release an advisory ourselves.


We work across all platforms, and in 2019 TAG discovered zero-day vulnerabilities affecting Android, Chrome, iOS, Internet Explorer and Windows.


Most recently, TAG was acknowledged in January 2020 for our contribution in identifying CVE-2020-0674, a remote code execution vulnerability in Internet Explorer.


Last year, TAG discovered that a single threat actor was capitalizing on five zero-day vulnerabilities.


Finding this many zero-day exploits from the same actor in a relatively short time frame is rare.


The exploits were delivered via compromised legitimate websites (e.g. watering hole attacks), links to malicious websites, and email attachments in limited spear phishing campaigns.


The majority of targets we observed were from North Korea or individuals who worked on North Korea-related issues.


For security teams interested in learning more, here are additional details about the exploits and our work in 2019:


The vulnerabilities underlying these exploits included: Internet Explorer - CVE-2018-8653 Internet Explorer - CVE-2019-0676 Chrome - CVE-2019-5786 Windows Kernel - CVE-2019-0808 Internet Explorer - CVE-2019-1367 Internet Explorer - CVE-2019-1429


The following technical details are associated with the exploits and can be used for teams interested in conducting further research on these attacks: CVE-2018-8653, CVE-2019-1367 and CVE-2020-0674 are vulnerabilities inside jscript.dll, therefore all exploits enabled IE8 rendering and used JScript.Compact as JS engine.


In most Internet Explorer exploits, attackers abused the Enumerator object in order to gain remote code execution.


To escape from the Internet Explorer EPM sandbox, exploits used a technique consisting of replaying the same vulnerability inside svchost by abusing Web Proxy Auto-Discovery (WPad) Service.


Attackers abused this technique with CVE-2020-0674 on Firefox to escape the sandbox after exploiting CVE-2019-17026.


CVE-2019-0676 is a variant of CVE-2017-0022, CVE-2016-3298, CVE-2016-0162 and CVE-2016-3351 where the vulnerability resided inside the handling of “res://” URI scheme.


Exploiting CVE-2019-0676 enabled attackers to reveal presence or non-presence of files on the victim’s computer; this information was later used to decide whether or not a second stage exploit should be delivered.


The attack vector for CVE-2019-1367 was rather atypical as the exploit was delivered from an Office document abusing the online video embedding feature to load an external URL conducting the exploitation.


Our Threat Analyst Group will continue to identify bad actors and share relevant information with others in the industry.


Our goal is to bring awareness to these issues to protect you and fight bad actors to prevent future attacks.


In a future update, we’ll provide details on attackers using lures related to COVID-19 and expected behavior we’re observing (all within the normal range of attacker activity).


Google's Threat Analysis Group (TAG) works to counter targeted and government-backed hacking against Google and our users.


This is an area we have invested in deeply for over a decade.


Our daily work involves detecting and defeating threats, and warning targeted users and customers about the world’s most sophisticated adversaries, spanning the full range of Google products including Gmail, Drive and YouTube.


In the past, we’ve posted on issues like phishing campaigns, vulnerabilities and disinformation.


Going forward, we’ll share more technical details and data about the threats we detect and how we counter them to advance the broader digital security discussion.


TAG tracks more than 270 targeted or government-backed groups from more than 50 countries.


These groups have many goals including intelligence collection, stealing intellectual property, targeting dissidents and activists, destructive cyber attacks, or spreading coordinated disinformation.


We use the intelligence we gather to protect Google infrastructure as well as users targeted with malware or phishing.


We’ve had a long-standing policy to send users warnings if we detect that they are the subject of state-sponsored phishing attempts, and have posted periodically about these before.


From July to September 2019, we sent more than 12,000 warnings to users in 149 countries that they were targeted by government-backed attackers.


This is consistent (+/-10%) with the number of warnings sent in the same period of 2018 and 2017.


Over 90 percent of these users were targeted via “credential phishing emails” similar to the example below.


These are usually attempts to obtain the target’s password or other account credentials to hijack their account.


We encourage high-risk users—like journalists, human rights activists, and political campaigns—to enroll in our Advanced Protection Program (APP), which utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings.


APP is designed specifically for the highest-risk accounts.


In the simple phishing example below, an attacker has sent a phishing email with a security alert lure from “Goolge” suggesting the user secure their account.


The user clicks the link, enters their password, and may also get asked for a security code if they have two-factor authentication enabled, allowing the attacker to access their account.


Last week at CyberwarCon, we presented analysis about previously undisclosed campaigns from a Russia-nexus threat group called “Sandworm” (also known as “Iridium”).


It’s a useful example of the type of detailed threat detection work that TAG does.


Although much of Sandworm’s activity targeting Ukraine and their attacks against the 2018 Winter Olympics have been covered publicly, some campaigns have not been reported.


In December 2017, TAG discovered a series of campaigns from Sandworm attempting to deploy Android malware.


The first campaign targeted users in South Korea, where Sandworm was modifying legitimate Android applications with malware.


They then uploaded these modified apps to the Play Store using their own attacker-controlled developer accounts.


During this campaign, Sandworm uploaded eight different apps to the Play Store, each with fewer than 10 total installs.


We also identified an earlier September 2017 Android campaign from Sandworm where they used similar tactics and deployed a fake version of the UKR.net email app on the Play Store.


This application had approximately 1,000 total installs.


We worked with our colleagues on the Google Play Protect Team to write detections for this malware family, and eliminate it.


In November 2018, we saw evidence that Sandworm shifted from using attacker-controlled accounts to try and upload malicious apps to compromising legitimate developers.


Throughout November, Sandworm targeted software and mobile app developers in Ukraine via spear phishing emails with malicious attachments.


In at least one case, they compromised an app developer with several published Play Store apps—one with more than 200,000 installs.


After compromising the developer, Sandworm built a backdoor in one of the legitimate apps and attempted to publish it on the Play Store.


They did this by adding their implant code into the application package, signing the package with the compromised developer’s key, and then uploading it to the Play Store.


However, the Google Play Protect team caught the attempt at the time of upload.


As a result, no users were infected and we were able to re-secure the developer’s account.


TAG is one part of Google and YouTube’s broader efforts to tackle coordinated influence operations that attempt to game our services.


We share relevant threat information on these campaigns with law enforcement and other tech companies.


Here are some examples that have been reported recently that TAG worked on: TAG recently took action against Russia-affiliated influence operations targeting several nations in Africa.


The operations use inauthentic news outlets to disseminate messages promoting Russian interests in Africa.


We have observed the use of local accounts and people to contribute to the operation, a tactic likely intended to make the content appear more genuine.


Targeted countries included the Central African Republic, Sudan, Madagascar, and South Africa, and languages used included English, French, and Arabic.


Activity on Google services was limited, but we enforced across our products swiftly.


We terminated the associated Google accounts and 15 YouTube channels, and we continue to monitor this space.


This discovery was consistent with recent observations and actions announced by Facebook.


Consistent with a recent Bellingcat report, TAG identified a campaign targeting the Indonesian provinces Papua and West Papua with messaging in opposition to the Free Papua Movement.


Google terminated one advertising account and 28 YouTube channels.


TAG works closely with other technology companies—including platforms and specialized security firms—to share intelligence and best practices.


We also share threat information with law enforcement.


And of course there are multiple teams at Google at work on these issues with whom we coordinate.


Going forward, our goal is to give more updates on the attacks that TAG detects and stops.


Our hope is that shining more light on these actors will be helpful to the security community, deter future attacks, and lead to better awareness and protections among high-risk targets.


As organizations reeled from the Log4Shell vulnerability (CVE-2021-44228), cyberattacks aiming at open-source web servers, like Apache HTTP Server, were rapidly rising.


Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution (RCE), access control bypass, denial of service (DoS), or even cyberjacking the victim servers to mine cryptocurrencies.


To protect enterprises against malicious activities, we need more than just timely patches.


Using software composition analysis (SCA) to discover issues in each layer of the software supply chain has become a must in 2022.


Vulnerabilities of Apache HTTP Server have increased since 2017 Open-source web servers, especially Apache HTTP Server, have been heavily exploited in the past five years.


Compared to Nginx, another widely used open-source web server, Apache had the greatest increase in vulnerabilities over the past five years – particularly high-risk ones.


According to the Apache HTTP Server webpage, from 2012 to 2016 there were a total of 31 vulnerabilities found in the Apache HTTP Server.


However, from 2017 to 2021 the total vulnerabilities number surged to 57.


2021 alone accounted for 14 of those vulnerabilities, breaking a 17-year record high.


Most importantly, two vulnerabilities found in 2H’2021 (CVE-2021-42013, CVE-2021-41773) were rated by Apache’s rating system as “Critical”.


Before that, there were no vulnerabilities rated at this level.


The “Critical” vulnerabilities have the potential to be exploited by a remote attacker to get Apache to execute arbitrary code.


They could also be exploited automatically by worms.


Source: Apache HTTP Server Project


Weaponized vulnerabilities lead to great risk


Not only has the number of total Apache HTTP Server vulnerabilities gone up, but so has the number of weaponized vulnerabilities.


Trend Micro detected that at least 15 of the 57 vulnerabilities found in the past five years were weaponized and used in malicious activities.


The most common types of attack include denial of service (DoS), path traversal, server-side request forgery (SSRF), and remote code execution (RCE).


Multiple vulnerabilities found in 2021 are proven to have been actively exploited.


Table 1: The 15 vulnerabilities weaponized since 2017  CVE ID cvss3 score Description CVE-2021-42013 9.8 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) CVE-2021-41773 7.5


Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 CVE-2021-40438 9 mod_proxy SSRF CVE-2020-11984 9.8 mod_proxy_uwsgi buffer overflow CVE-2019-10098 6.1 mod_rewrite potential open redirect CVE-2019-10097 7.2 CVE-2019-10097 mod_remoteip Stack buffer overflow and NULL pointer dereference CVE-2019-0190 7.5 mod_ssl 2.4.37 remote DoS when used with OpenSSL 1.1.1 CVE-2018-8011 7.5 mod_md, DoS via Coredumps on specially crafted requests CVE-2018-1303 7.5 Possible out of bound read in mod_cache_socache CVE-2018-11763 5.9 DoS for HTTP/2 connections by continuous SETTINGS CVE-2017-9798 7.5 Use-after-free when using <Limit > with an unrecognized method in .htaccess ("OptionsBleed") CVE-2017-9788 9.1 Uninitialized memory reflection in mod_auth_digest CVE-2017-7668 9.8 ap_find_token()


Buffer


Overread


CVE-2017-7659 7.5 mod_http2


Null Pointer Dereference CVE-2017-15715 8.1 <FilesMatch> bypass with a trailing newline in the file name


Source: Apache HTTP Server Project, Trend Micro Inc., NVD CVE-2021-41773 and CVE-2021-42013, the two critical vulnerabilities, are perfect examples of how attackers exploit the vulnerabilities in the Apache HTTP Server.


As Trend Micro reported, these two are path traversal vulnerabilities that allow attackers to map URLs to files/directories outside of the webroot.


In certain configurations where Common Gateway Interface (CGI) scripts are enabled for these paths, attackers can achieve RCE on the vulnerable server.


Both discovered in early October 2021, CVE-2021-41773 and CVE-2021-42013 were detected with more than four million exploits by the end of 2021.


Another Apache HTTP Server vulnerability, CVE-2021-40438, shows how great the impact can be when the vulnerability gets exploited.


CVE-2021-40438 is a vulnerability existing in the mod_proxy module and prone to SSRF.


This flaw allows a remote, unauthenticated attacker to make the httpd server forward requests to an arbitrary server.


The attacker could get, modify, or delete resources on other services that may be behind a firewall and inaccessible otherwise.


The impact of this flaw varies based on what services and resources are available on the httpd network.


CVE-2021-40438 has a huge impact on products from Cisco, IBM QRadar SIEM, Debian Linux, F5 Os, Red Hat and more.


On December 1, 2021, CISA added CVE-2021-40438 to its list of known exploited vulnerabilities.


Schemes behind the attacks The attacks that target open-source web servers could lead to enormous threats.


Once any web server vulnerability gets exploited and hacked, the victim server can be taken over and used for malicious activities.


The most common activities include using victim servers to send out spam mail or launching attacks against other servers at the cost of the victim server’s memory and bandwidth.


Attackers can also install a phishing website on the victim server to gain access to any data that passes through it.


However, the most popular utility of attacks in recent years is cryptojacking: hackers exploit the vulnerability and secretly use the victim server’s computing power to mine popular cryptocurrencies.


Trend Micro revealed how cyber actors used the vulnerabilities and abuse of GitHub and Netlify repositories to mine Monero.


For cybercriminals, Apache HTTP Server is always a favorite target: It serves 24.63% of the million busiest websites according to Netcraft stats.


Major web service providers such as Slack, Linkedin, The New York Times, GrubHub, and more rely on Apache HTTP Server.


For IT professionals, it’s challenging to patch such a vital service and not to harm user satisfaction.


Furthermore, the complexity of the software supply chain nowadays exacerbates the abuse of open-source software vulnerabilities.


Cyber attackers could compromise software components of third-party suppliers by inserting malicious code inconspicuously.


Compared to the traditional supply chain, the software supply chain requires more layers of verification to ensure its security.


Protect your web server against potential harm To mitigate the potential risk of attacks from open-source software, software composition analysis (SCA) has become an effective approach.


SCA identifies and lists all the parts and versions present in the code.


It also checks each specific service and looks for outdated or vulnerable libraries that may pose security risks to the application.


These tools can also check for legal issues regarding the use of open-source software with different licensing terms and conditions.


Trend Micro published a whitepaper on how to prevent supply chain attacks in the age of cloud computing in 2020 October.


Developing a risk-based approach to patch management can help organizations identify and prioritize which vulnerabilities they need to deal with now.


This approach consists of:  Continuously conducting exposure assessments to determine what CVEs – past and present – are in your environment at all times.


Assessing the criticality of those systems that contain those CVEs.


Conducting a continuous but simple risk assessment: Assessing the likelihood that those identified CVEs are or will be exploited in the wild against the impact of those CVEs used in an attack.


i.      Is a POC available ii.      Is it in the wild


If you struggle with patch management, you may look at virtual patching or IPS technology to help as these can be deployed to detect/block exploits of a vulnerability and allow you time to properly patch the vulnerability with the vendor’s patch.


Trend Micro’s Zero Day Initiative bug bounty program and our vulnerability research teams help us identify new vulnerabilities and develop virtual patches for our Cloud One, TippingPoint, Apex One, and Worry Free Services customers.


In some cases, we have virtual patches out months ahead of the vendor patch.


Malicious actors will continue to exploit vulnerable applications, operating systems, and devices in their efforts to attack organizations.


Improving your understanding of key applications like Apache can help you better understand where you can minimize your risk of attack.


Tags  APT & Targeted Attacks | Exploits & Vulnerabilities | Network | Security Strategies | Articles, News, Reports | Cyber Threats


Additional analysis and insights by Higashi Yuka and Chizuru Toyama REDBALDKNIGHT, also known as BRONZE BUTLER and Tick, is a cyberespionage group known to target Japanese organizations such as government agencies (including defense) as well as those in biotechnology, electronics manufacturing, and industrial chemistry.


Their campaigns employ the Daserf backdoor (detected by Trend Micro as BKDR_DASERF, otherwise known as Muirim and Nioupale) that has four main capabilities: execute shell commands, download and upload data, take screenshots, and log keystrokes.


Our recent telemetry, however, indicates that variants of Daserf were not only used to spy on and steal from Japanese and South Korean targets, but also against Russian, Singaporean, and Chinese enterprises.


We also found various versions of Daserf that employ different techniques and use steganography—embedding codes in unexpected mediums or locations (i.e., images)—to conceal themselves better.


Like many cyberespionage campaigns, REDBALDKNIGHT’s attacks are intermittent but drawn-out.


In fact, REDBALDKNIGHT has been zeroing in on Japanese organizations as early as 2008—at least based on the file properties of the decoy documents they’ve been sending to their targets.


The specificity of their targets stems from the social engineering tactics used.


The decoy documents they use in their attack chain are written in fluent Japanese, and particularly, created via the Japanese word processor Ichitaro.


One of the decoy documents, for instance, was about the “plan of disaster prevention in heisei 20” (Heisei is the current/modern era in Japan).  Figure 1: File properties of one of the decoy documents that REDBALDKNIGHT sends to Japanese targets  Figures 2: Sample of decoy documents used by REDBALDKNIGHT, employing socially engineered titles in their spear phishing emails such as “disaster prevention”


Attack ChainREDBALDKNIGHT’s attacks typically use spear phishing emails as an entry point.


Their attachments exploit a vulnerability in Ichitaro, as shown above.


These are decoy documents, often used by cyberespionage groups as a distraction while they execute their malware behind the scenes using lures such as “CPR” and “disaster prevention.”


Daserf will be installed and launched on the affected machine once the victim opens the document.


Daserf wasn’t well-known until security researchers publicly disclosed it last year, and whose beginnings they’ve traced as far back as 2011.


Based on the hardcoded version number they divulged (Version:1.15.11.26TB Mini), we were able to source other versions of the backdoor (listed in the appendix).


Fine-tuning DaserfOur analyses revealed Daserf regularly undergo technical improvements to keep itself under the radar against traditional anti-virus (AV) detection.


For instance, Daserf versions 1.50Z, 1.50F, 1.50D, 1.50C, 1.50A, 1.40D, and 1.40C use encrypted Windows application programming interfaces (APIs).


Version v1.40 Mini uses the MPRESS packer, which provides some degree of protection against AV detection and reverse engineering.


Daserf 1.72 and later versions use the alternative base64+RC4 to encrypt the feedback data, while others use different encryption such as 1.50Z, which uses the Ceasar cipher (which substitutes letters in plaintext with another that corresponds to a number of letters, either upwards or downwards).


More notably, REDBALDKNIGHT integrated steganography to conduct second-stage, command-and-control (C&C) communication and retrieve a second-stage backdoor.


This technique has been observed in Daserf v1.72 Mini and later versions.


Daserf’s use of steganography not only enables the backdoor to bypass firewalls (i.e., web application firewalls); the technique also allows the attackers to change second-stage C&C communication or backdoor faster and more conveniently.


How REDBALDKNIGHT Employs


SteganographyDaserf’s infection chain accordingly evolved, as shown below.


It has several methods for infecting its targets of interest: spear phishing emails, watering hole attacks, and exploiting a remote code execution vulnerability (CVE-2016-7836, patched last March 2017) in SKYSEA Client View, an IT asset management software widely used in Japan.


Figure 3: Daserf’s latest execution and infection flow


A downloader will be installed on ther victim’s machine and retrieve Daserf from a compromised site.


Daserf will then connect to another compromised site and download an image file (i.e., .JPG, .GIF).


The image is embedded in either the encrypted backdoor configurations or hacking tool.


After their decryption, Daserf will connect to its C&C and await further commands.


Daserf 1.72 and later versions incorporate steganographic techniques.


REDBALDKNIGHT’s use of steganography isn’t limited to Daserf.


We also found two of their toolkits employing the same technique—xxmm2_builder, and xxmm2_steganography.


Based on their pdb strings, they’re both components of another REDBALDKNIGHT-related threat, XXMM (TROJ_KVNDM), a downloader Trojan that can also act as a first-stage backdoor with its capability to open a shell.


While xxmm2_builder allows REDBALDKNIGHT to customize the settings of XXMM, xxmm2_ steganography is used to hide malicious code within an image file.


REDBALDKNIGHT’s tool can create, embed, and hide executables or configuration files within the image file with its tag and encrypted strings via steganography.


An encrypted string can be an executable file or a URL.


A threat actor will use/upload an existing image that the builder then injects with steganographic code.


Additionally, we also found that the steganography algorithm (alternative base64 + RC4) between XXMM and Daserf were the same.


Figure 4: Code snippets showing Daserf’s decode function, which is the same as XXMM’s Figure 5: Steganography toolkit used by REDBALDKNIGHT for XXMM Figure 6:


Snapshots of Daserf’s steganographic code generated by their toolkit MitigationSteganography is a particularly useful technique in purposeful cyberattacks: the longer their malicious activities stay undetected, the more they can steal and exfiltrate data.


And indeed, the routine is increasingly gaining cybercriminal traction, in varying degrees of proficiency—from exploit kits, malvertising campaigns, banking Trojans, and C&C communication to even ransomware.


In the case of REDBALDKNIGHT’s campaigns, the use of steganography is further compounded by their use of malware that can better evade detection and analysis.


REDBALDKNIGHT’s continuous campaigns—along with their diversity and scope—highlight the importance of defense in depth.


Organizations can mitigate these threats by enforcing the principle of least privilege to reduce their opportunities for lateral movement significantly.


Network segmentation and data categorization help in this regard.


Mechanisms like access control and blacklisting as well as intrusion detection and prevention systems help further secure the network while whitelisting (e.g., application control) and behavior monitoring help detect and block anomalous activities from suspicious or unknown files.


Safeguard the email gateway to defend against REDBALDKNIGHT’s spear phishing methods.


Disable unnecessary and outdated components or plug-ins, and ensure that the system administration tools are used securely, as they can be misused by threat actors.


And more crucially, keep the infrastructure and its applications up-to-date to reduce attack surface—from the gateways and networks to endpoints, and servers.


Trend Micro SolutionsTrend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to today’s stealthy malware and targeted attacks in real-time.


It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect threats like REDBALDKNIGHT’s attacks even without any engine or pattern update.


Trend Micro™ Deep Security™ and Vulnerability Protection provide virtual patching that protects endpoints from threats that abuses unpatched vulnerabilities.


OfficeScan’s Vulnerability Protection shield endpoints from identified and unknown vulnerability exploits even before patches are deployed.


Trend Micro’s suite of security solutions is powered by XGen™ security, which features high-fidelity machine learning to secure the gateway and endpoint data and applications.


XGen™ protects against today’s purpose-built threats that bypass traditional controls, exploit known, unknown, or undisclosed vulnerabilities, and either steal or encrypt personally-identifiable data.


A list of the Indicators of Compromise (hashes, C&Cs) related to this research is in this appendix.


Tags  APT & Targeted Attacks | Malware | Endpoints | Exploits & Vulnerabilities | Research | Articles, News, Reports


We recently conducted an investigation into a malicious Android malware sample, which we believe can be attributed to the StrongPity APT group, that was posted on the Syrian e-Gov website.


To the best of our knowledge, this is the first time that the group has been publicly observed using malicious Android applications as part of its attacks.


We first learned about the sample from a thread shared on the MalwareHunterTeam Twitter.


Based on the discussion thread, we learned that the shared sample is a trojanized version of the Syrian e-gov Android application that would steal contact lists and collect files with specific file extensions from its victim's device.


One response from the thread pointed out that the malicious APK was likely distributed using a "watering-hole"-like technique: the attacker allegedly had compromised the official Syrian E-Gov website and replaced the official Android application file with a trojanized version of the original app.


Due to the suspicious nature of this activity, we decided to investigate further.


This blog entry will discuss the group’s attack tactics, techniques, and procedures (TTPs) in relation to the Android malware and why these activities can be attributed to this threat actor.


Furthermore, we will also dive into the threat actor’s development progress and identify several other malicious Android malware samples produced by StrongPity.


Finally, we will briefly discuss related malware variants, including the second version of the Android trojan, which appears to be a work in progress and includes several testing features.


Initial investigation


The first thing we did was check the URL where the malicious APK file was hosted (https://egov[.]sy/mobile/egov[.]apk).


The version of the application that is downloadable from the site at the time of writing is a clean version of the Syrian e-gov Android application that is different from the malicious application previously discussed on Twitter.


This means that, at one point, the malicious version of the application was  deleted from the site.


At least six other samples with the same application name ("بوابتي") and matching package names (com.egov.app.*) can be identified on VirusTotal.


We verified all of these samples and concluded that all of them are benign.


These benign versions of the application were created during the period from February 2020 until March 2021.


We believe all of them are official apps from the Syrian E-Gov website.


The malicious sample, mentioned in the Twitter thread, is available on VirusTotal and as of the time of writing, has several positive detections.


Although some antivirus vendors detect the identified malicious sample as Bahamut, we doubted the accuracy of this attribution to the Bahamut APT group.


Further investigation revealed several artifacts that could possibly link the malicious sample to the StrongPity APT group.


Analysis of the malicious sample


The malicious version of the application (fd1aac87399ad22234c503d8adb2ae9f0d950b6edf4456b1515a30100b5656a7) was created on May 2021(The timestamps within the file point to 2021-05-03 as the creation date, while the file was uploaded to VirusTotal on May 24, 2021).


This application is signed with a different certificate and was produced by repackaging the original app from the Syrian government.


All of the original applications, on the other hand, are signed with another certificate.


Figure 1.


Comparison of the certificates used to sign the original (top) and the malicious applications(bottom)


The malicious application has the AndroidManifest.xml modified to include references to additional classes and request additional permissions on the device (seen in Figure 3).      Figure 2.


The modified AndroidManifest.xml of the malicious app     Overview of the inserted code


The threat actor added the following classes to this application; some of these classes (com.egov.app.NetworkStatusService, com.egov.app.Receiver) are referenced in the modified AndroidManifest.xml.


Figure 3.


The classes added to the malicious app are shown in the right part of the image.


The original classes are shown in the left.


Figure 3 shows that many of the other classes have randomly generated class and method names.


This naming pattern was likely produced by a software obfuscation tool.


Malicious code initialization


Two major additional components were added to the malicious version of the application: a service and a receiver.


The receiver starts the malicious service.


The malicious service is declared as an Android Service, which is an application component that can perform long-running tasks in the background.


This malicious service is declared with the class name "com.egov.app.NetworkStatusService", and is started by the Receiver class.


Our analysis of the Receiver configuration and code found multiple methods for starting the malicious NetworkStatusService service.


The service is started when the device connectivity is changed.


The djdeeu class registers a broadcast receiver for CONNECTIVITY_CHANGE.


The service can be started from launcher activity or other registered receivers.


The service can be started using the "Alarm" mechanism.


Once the malicious NetworkStatusService service is started, it executes its malicious functionality via a set of message handlers, which are responsible for handling specific messages.


Architecture of the backdoor


The sample uses the "Handler" mechanism to dispatch messages that trigger malicious behavior.


A custom enum structure is used to define the message types.


It defines seven message types, shown in Figure 4.


Figure 4. Code showing the seven defined messages.


Each of the messages trigger a different behavior through the handler.


The following is a quick summary of the purpose and behavior of each specific message: MSG_TRIG_ALARM_HEARTBEAT


When this message is received, a periodic task for heartbeat message is set.


When this message is received, a periodic task for sync message is set.


This message triggers the heartbeat function, which sends a request to the command-and-control (C&C) server and receives a response with an encrypted payload.


The encrypted payload is first saved into the directory <DIR>/.android/water.zip, after which the file water.zip is decrypted and the decrypted payload written to <DIR>/.android/e.zip.


Next, the file e.zip is decompressed into <DIR>/.android and the file with the name "config.properties" is accessed.


Finally, this file is read and parsed.


These properties are extracted and written as configuration settings to local shared preference, allowing the malware to change its behavior according to the configuration.


MSG_SYNC Sync is a repeated behavior.


It uploads files, which were collected on infected devices, with a periodicity of 3000 seconds.


The handler for MSG_SYNC executes the following functionality: First, it enumerates all files under <DIR>/.android/.lib2.


It then creates a zip file with the name <uniqueId>.zip (note that the unique ID is not a real device ID, the malware just calculates a  custom unique ID based on the device ID value), and writes the files into the compressed file.


Finally, it upload the zip file to the C&C server and deletes all files under <DIR>/.android/.lib2, as well as the compressed file <uniqueId>.zip.


The handler for this message collects data from the victim’s device.


First, it collects contact information, followed by information regarding available Wi-Fi networks.


It then searches through the device files and harvests all files that match pre-defined file extensions:  .asc .dgs .doc .docx .edf .gpg .jpeg .jpg .key .m2r .meo .pdf .pgp .pir .pkr .pub .rjv .rms .sem .sit .skr .sys .xls .xlsx       Figure 5.


A snippet of the file harvesting code      MSG_TRIG_ALARM_COLLECT


When this message is received, a periodic task for the “collect message” handler is set.


This message sends all the mentioned messages one by one.


Modular Functionality of the backdoor


This sample uses highly modular components to create a flexible architecture for component loading and unloading.


The functions onCreate and onDestroy show a common approach to loading and unloading a component.


Figure 6.


Code snippet showing the onCreate and onDestroy functions


The following are the components were used in the sample:  pekmek(Crypto Manager): Uses AES to decrypt and encrypt files and strings.


ltymcr(Helper Class): Contains many utility functions, such as a function to calculate unique id, parse config file, write/read shared preference, and define encryption keys.


Figure 7.


Code snippet showing the ltymcr(Helper Class) component      sadwoo:


A component used as PowerWakeLock.


phkyxc: A component used as WifiWakeLock.


tfsdne:


This is a wrapper used for C&C communication such as heartbeat and sync.


itxdrx(Net Manager): A component responsible for handling HTTP protocol communication.


Figure 8.


Code from the itxdrx component      nhnhpi:


The component responsible for managing the C&C server.


This component includes definition of an initial C&C server.


The initial value can be overridden.


The StrongPity backdoor has the ability to update (including deleting and adding) its C&C server address via configuration updates from the "heartbeat" command.


Figure 9.


The code that handles the addition and deletion of C&C servers     Investigation and attribution


When we learned how the threat actor repackages benign applications into trojanized variants, we decided to search for similar samples on VirusTotal.


We searched for other applications that were repackaged in a similar method and included similar malicious components.


Similar malicious samples


We found several other samples that were produced by the same threat actor.