ورش مجانية.zip 5e2642f33115c3505bb1d83b137e7f2b18e141930975636e6230cdd4292990dd PUA.Win32.RemoteUtilities.A Archive containing RemoteUtilities مکتالمنحالدراسیة.zip b2f429efdb1801892ec8a2bcdd00a44d6ee31df04721482a1927fc6df554cdcf PUA.Win32.ScreenConnect.P Archive containing ScreenConnect المنح الدرایةس.exe 3e4e179a7a6718eedf36608bd7130b62a5a464ac301a211c3c8e37c7e4b0b32b PUA.Win32.ScreenConnect.P ScreenConnect remote access software  Network  23.94.50.197:444 23.95.215.100:443 23.95.215.100:8080 87.236.212.184:443 87.236.212.184:8008      Tags  APT & Targeted Attacks | Articles, News, Reports |


Research


Updated on April 26, 2017, 01:39 PM (UTC-7) to add the accurate IP address.


In one of our previous blog entries, we covered how the threat actor known as Winnti was using GitHub to spread malware – a development that shows how the group is starting to evolve and use new attack methods beyond their previous tactics involving targeted attacks against gaming, pharmaceutical, and telecommunications companies.


Through this entry, in which we take a closer look at an individual who we believe might be connected to the Winnti group, we hope to give both ordinary users and organizations better insights into some of the tools – notably the server infrastructures- these kinds of threat actors use, as well as the scale in which they operate.


Searching Domain Registrations for Clues Threat actors typically register and use several domains in order to discretely lead their malware to their Command and Control (C&C) servers.


Registering a domain name always requires some form of identifying information: a physical or mailing address, an email address, and a phone number.


Of these, a valid email address holds the greatest importance because it is where the registrar sends the confirmation of a domain purchase to the new owner in addition to the information needed to control the domain.


Most fraudsters create one-time email addresses or use stolen email addresses, both of which are easy to create or obtain.


However, over time, it becomes tedious for fraudsters to constantly change information when registering new domains.


This is the point where they are likely to make mistakes and start reusing e-mail addresses.


A careful analysis of the domain registrations from this threat actor between 2014 and 2015 allowed us to identify one profile used to register several domains that were used as C&C servers for a particular malware family employed by the Winnti group.


In particular, we managed to gather details on an individual using the handle Hack520, who we believe is connected to Winnti.


Who is the Winnti group?


The group behind the Winnti malware (which we will call the Winnti group for brevity) sprung up as a band of traditional cyber crooks, comprising black hats whose technical skills were employed to perpetrate financial fraud.


Based on the use of domain names they registered, the group started out in the business of fake/rogue anti-virus products in 2007.


In 2009, the Winnti group shifted to targeting gaming companies in South Korea using a self-named data- and file-stealing malware.


The group, which was primarily motivated by profit, is noted for utilizing self-developed technically-proficient tools for their attacks.


They once attacked a game server to illicitly farm in-game currency (“gaming gold”, which also has real-world value) and stole source codes of online game projects.


The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier.


The Winnti group diversified its targets to include enterprises such as those in pharmaceutics and telecommunications.


The group has since earned infamy for being involved in malicious activities associated with targeted attacks, such as deploying spear-phishing campaigns and building a backdoor.


During the course of researching the Winnti group, we came across previously unreported malware samples that we attributed to the group based on the malware arsenal and the use of registered domains as attack infrastructure.


These samples led us to the discovery of additional C&C servers that provided us with more information than we initially expected.


A closer look at Hack520


Our initial investigation on the domains registered by Hack520 revealed that similar domains (listed below) were registered by another profile.


hack520[.]co[.]kr shaiya[.]kr zhu[.]kr shenqi[.]kr zhuxian[.]kr  Several of these domains are linked to variants of malware that were used by the Winnti threat actor.


Surprisingly enough, it does not take very long to get some information about Hack520: someone with this handle runs a blog and a Twitter account (with a handle close to Hack520) that is also directly linked to the blog.


Figure 1: Twitter account of Hack520


One interesting detail about Hack520 is his apparent love for pigs, as seen in his use of the word in his email addresses.


He also mentions his occupation as a “pig farmer” in online message boards.


In addition, Hack520’s tweets always show photos of the same animal, which is likely his pet pig.


The Twitter handle used by Hack520 indicates also an “est” portion.


This “est” reference could refer to a hacking group with its own message board on which hack520 also posts regularly.


In one particular forum post, Hack520 mentions that he was previously jailed for a period of 10 months in a blog post dated May 31, 2009.


Figure 2: Post from Hack520’s blog


A rough translation of this message is as follows: “Fxxk, when I am released, the server is offline, I can’t find the machine, the domain is expired, it is so bad.


I wasted 10 months, I have failed and lost my money.”


Hack520 seems to be very interested in hosting services and his profile fits that of a system administrator profile with some programming and hacking skills.


After further research, we were able to link Hack520 to different network administration activities, notably with a Virtual Private Server (VPS) hosting service.


The way Hack520 signs his messages in one hacker forum provides a clue pointing to this connection.


While one of his signatures uses his own blog domain, there is also a second signature which uses 93[.]gd, a domain that was found to have been actively selling VPS services in the past.


The email address admin@93[.]gd is linked to IP addresses owned by a certain user with the nickname “PIG GOD”—another reference to Hack520’s passion for pigs.


Among the IP addresses owned by Hack520 is a whole/22 IP Range which we dubbed as the “PIG RANGE”.


The IP range for “PIG GOD” is 43[.]255[.]188.0/22, which appears to be hosted in Hong Kong as seen in the information we found:  inetnum: 43[.]255[.]188[.]0 - 43[.]255[.]191[.]255 netname: PIG-HK description: PIG GOD country: HK admin-c: PG406-AP tech-c: PG406-AP person: pig god country: HK phone: +852-39437000 e-mail: admin@66[.]to nic-hdl: PG406-AP mnt-by: MAINT-RAIBOW-HK changed: admin@66[.]to 20160917 source: APNIC  The domain 66[.]to leads to another website that shows Hack520’s pet pig.


It also reveals direct links to secure[.]66[.]to and zhu[.]vn, both of which also belong to Hack520 and contains his personal blog.


Figure 3: Hack520’s pet pig


We were able to find additional links between Hack520’s “Pig network” and the Winnti group’s activities.


This includes hosting C&C domains that were used by Winnti such as mtrue.com, shenqi[.]kr and zhu[.]kr.


We also found a live service selling VPS hosting at secure[.]66[.]to.


The hosting services offered at secure[.]66[.]to are in fact hosting services rented to other companies worldwide.


The contents found in secure[.]66[.]to often lead to zhu[.]vn, which is Hack520’s domain for hosting his own private blog.


Figure 4: Screenshot of secure[.]66[.]to


We found roughly 500 domain names that lead or have led to the “Pig network” between 2015 to March 2017.


Most of these domains seem to have contained illegitimate content like pornography and online gambling.


We highly suspect the “Pig network” to have also been used as a bulletproof hosting service for cybercriminals who are unrelated to the Winnti group.


From what we’ve seen in Hack520’s blog, as well as the infrastructure deployed around it, it is quite safe to say that Hack520 is involved in aspects of the VPS service activity provided to groups like Winnti and other cybercriminals or threat actors.


What we’ve learned Threat actors like the Winnti group rarely ever stay static in terms of both tools and tactics.


As we’ve already previously discussed in our 2017 predictions, these groups will constantly evolve and employ unique and advanced attack techniques.


In addition, individuals like Hack520 prove that these threat actors are composed of varied individuals who have their own set of expertise.


All of these things point to threat actors and groups like Winnti will continue to try different methods of attack.


Threat actors are always looking to expand the strategies they use, thus security practices and solutions that work for less organized cybercriminals might not work for determined groups who are willing to spend time, resources and manpower to accomplish their goals.


As such, there is a need for everyone to be proactive when it comes to security, especially for organizations who are frequently the victims of targeted attacks.


By creating awareness and using the right solutions, both individuals and organizations can take the steps needed to defend against the malicious tactics used by threat actors like the Winnti group.         Tags  APT & Targeted Attacks | Research


This post is also available in:      日本語 (Japanese)  With elevated tensions in the Middle East region, there is significant attention being paid to the potential for cyber attacks emanating from Iran.


The following threat brief contains a summary of historical campaigns that are associated with Iranian activity and does not expose any new threat or attack that has occurred since the events of January 3rd, 2020.  Since 2010, it is thought that Iran has been highly active in cyber operations campaigns throughout the world.


A number of groups and campaigns have been named and published on by the private sector, but direct attribution to the nation-state of Iran is still largely lacking in many of these instances.


Most attribution published by the private sector has relied on tactical evidence surrounding targeting and possible motivations.


It is important to keep this in mind, while at the same time understanding that without additional evidence, the current attribution set is accepted industry-wide as fact.


Unit 42 has not gathered evidence to specifically attribute any of the accepted groups as originating from Iran, but also has not observed any evidence to counter any publicly made claims.


Overview of Iran-Linked Campaigns:


Some of the currently active groups or campaigns publicly attributed by the industry as originating from Iran are:  There appear to be two distinct motivators for these groups, espionage and destruction.


The majority of observed attack campaigns have been espionage related, with the associated groups appearing to seek continued access into a target organization or access to sensitive data.


A smaller number of highly focused destructive attacks have been observed over time, beginning with the original Shamoon attack in 2012, with additional iterations years after, and more recently with StoneDrill and ZeroCleare.


Overall, cyber attacks thought to be originating from Iran have been persistent and ongoing for the last decade.


The target radius for these groups have spanned across the globe, across all major industries.


Although perceived retaliatory actions may occur in the near future, even those actions are most likely in conjunction with ongoing attack campaigns and operations.


Iranian TTPs:


Behaviorally, several tactics and techniques have been observed across multiple groups and campaigns over time.


The following is a list of commonly observed tactics and techniques along with their associated ATT&CK IDs:


General Mitigations:


With this knowledge of common behaviors, some mitigations recommendations are:  Palo Alto Networks’ Customer Mitigations: Palo Alto Networks customers should adopt best practices and evaluate their security posture to protect against the threats outlined in this document as well as other threats that may impact their network and users.


https://attack.mitre.org/groups/G0049/  OilRig is a threat group Unit 42 named and discovered in May 2016.


Since then, we have extensively researched their campaigns and operations.


This threat group is extremely persistent and relies heavily on spear-phishing as their initial attack vector, but has also been associated with other more sophisticated attacks such credential harvesting campaigns and DNS hijacking.


In their spear-phishing attacks, OilRig preferred macro-enabled Microsoft Office (Word and Excel) documents to install their custom payloads that came in the form of portable executables (PE), PowerShell and VBScripts.


OilRig’s custom payloads frequently used DNS tunneling as a command and control (C2) channel.


Once gaining access to an end point, actors would use credential dumping tools, such as Mimikatz to gather credentials to legitimate accounts to then move laterally to other systems on the network.


When presented with a webserver, OilRig would install a webshell as another ingress point to maintain access to the network.


https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/  https://unit42.paloaltonetworks.com/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/  https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/  https://unit42.paloaltonetworks.com/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/  https://unit42.paloaltonetworks.com/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/  https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/  https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/  https://unit42.paloaltonetworks.com/unit42-oilrig-performs-tests-twoface-webshell/  https://unit42.paloaltonetworks.com/unit42-oilrig-deploys-alma-communicator-dns-tunneling-trojan/  https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/  https://unit42.paloaltonetworks.com/unit42-striking-oil-closer-look-adversary-infrastructure/  https://unit42.paloaltonetworks.com/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/  https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/  https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/  https://attack.mitre.org/groups/G0059/  The Magic Hound campaign targeted energy, government, and technology organizations with spear-phishing emails as a delivery mechanism. These emails delivered macro-enabled Microsoft Office documents and PE files within attachments. The documents and executables attached to emails would install a variety of tools from portable PE files, .NET Framework PE files, Meterpreter, IRC bots, an open sourced Meterpreter module called Magic Unicorn, and an open sourced Python RAT called Pupy.  The custom tools used in the Magic Hound campaign provided connections to other threat groups, such as the IRC Bot which was very similar to the Parastoo tool associated with the NEWSCASTER threat group.


Also, a Magic Hound C2 server was also used as a C2 server for a tool called MPKBot that had been associated with the Rocket Kitten threat group.


APT33 is a threat group thought to have strong interest in the aeronautics and energy sectors.


They use spear-phishing attacks with a domain masquerading technique to make the links in their emails appear legitimate.


They are known to use custom tools in conjunction with well-known publicly available backdoors that are sold in various hacking forums.


A recent report uncovered this threat group’s attack infrastructure, which leveraged commercial VPN providers in addition to compromised systems to use as proxies to further mask their origins.


This activity exemplified how this adversary group and other related groups will attack organizations outside of their mission objective to augment their own capabilities to complete their task.


The DarkHydrus threat group has targeted government entities and educational institutions with spear-phishing attacks and credential harvesting campaigns.


DarkHydrus is a more sophisticated group when compared to others operating in the region, as their toolset and TTPs show a higher skill level.


DarkHydrus has used custom tools in addition to publicly available red-teaming tools such as Phishery.


They have also been observed using Google Drive for their C2 channel.


The original Shamoon attack was launched in 2012 and targeted two specific organizations in the energy sector with the goal of rendering their respective computer systems inoperable by wiping their disks.


The attack package included a commercially available driver to execute the wiping tasks and also included a worming component which allowed the package to spread within a target organization in an automated manner.


The 2012 incident was one of the first large scale targeted destructive attacks that had been publicly shared.


Since the original 2012 attack, two other instances of Shamoon have been discovered, in 2016 as well as 2018.


In each instance, the primary capabilities and functionality remained largely the same.


https://unit42.paloaltonetworks.com/unit42-second-wave-shamoon-2-attacks-identified/  https://unit42.paloaltonetworks.com/unit42-shamoon-2-delivering-disttrack/  https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/  https://unit42.paloaltonetworks.com/shamoon-3-modified-open-source-wiper-contains-verse-from-the-quran/


MuddyWater is a group that emerged in 2017 and was initially thought to be part of the financially motivated criminal group commonly referred to as FIN7 due to the use of an open source tool that was used by both sets of activity.


Additional investigation revealed no other similarities in either tools or tactics, thus concluding that the MuddyWater activity was likely operated by a separate actor.


This group generally used spear-phishing with macro-enabled Office documents to deliver their payloads, which were either embedded directly in the macro, or hosted on a first stage C2 server.


These C2 servers were observed to be either third party file hosting sites or code sharing repositories such as GitHub.


A significant portion of MuddyWater’s toolset consisted of open sourced red-teaming tools such as Invoke-Obfuscation, Lazagne, Mimikatz, etc.  https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/  https://securelist.com/muddywater/88059/  https://www.clearskysec.com/muddywater2/  https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/


Assuming the highlighted groups are indeed Iranian in origin, their activity has been well documented and the various groups often times use very similar tactics and techniques to execute their attacks, such as the heavy use of spear-phishing and credential harvesting.


This activity has been persistent for the last decade, and it should be expected to continue or increase with recent geopolitical events.


However, across all of these groups as well as others that were not highlighted, another consistent theme has been the abuse of poorly implemented IT and security policies.


Enabling Multi-Factor Authentication (MFA) throughout an organization, properly segmenting networks, limited macro-enabled documents, and disallowing network activity to unknown domains are examples of relatively simple policies that could have assisted in the neutralization of these adversary groups’ malicious actions.


Unit 42 has consolidated the IOCs of the referenced groups in this report and stored them in our GitHub repository.


This dataset should not be considered comprehensive of all potential Iran-linked cyber operations, and may be subject to change without notice.


Link to IOCs on GitHub


Sign up to receive the latest news, cyber threat intelligence and research from us


Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This post is also available in:      日本語 (Japanese)  Palo Alto Networks Unit 42 threat intelligence team has just released new research that has uncovered a previously unknown second wave of Shamoon 2 attacks: Second Wave of Shamoon 2 Attacks Identified  Based on our analysis, these attacks were timed to occur on November 29, 2016, twelve days after the initial Shamoon 2 attacks that we wrote about previously.


Like the initial Shamoon 2 attacks, this second wave of Shamoon 2 attacks utilize the Disttrack wiper malware.


Disttrack is optimized to destroy systems by targeting their hard drives and to spread as widely as possible throughout a network it’s infiltrated.


And once again, the Disttrack malware was configured to operate without any command and control (C2) servers, essentially optimized for a one-way mission of data destruction.


But this second wave of Shamoon 2 attacks show evidence of potential new tactic.


Unit 42 analysis shows that the latest sample contains credentials for virtual desktop infrastructure (VDI) solutions, such as Huawei’s FusionCloud.


VDI solutions can provide protection against a destructive malware like Disttrack through the ability to load snapshots of wiped systems to recover from a wiper attack.


The presence of these credentials in the sample may suggest that attackers intended to increase the impact of their attack by not only wiping systems but also carrying out destructive activities against the VDI deployment, as well as any snapshots.


In essence, a manual destructive attack against the VDI deployment and snapshots coupled with the destructive attack by the malware could destroy an organizations’ systems and primary line of backup against such an attack.


The possible targeting of VDI solutions with legitimate credentials (either stolen or default) represents an escalation in tactics not only in this specific attack but other future attacks.


Security teams and administrators should be aware of and take immediate steps to evaluate this development and consider adding additional safeguards to protect credentials related to their VDI deployment.


Full technical details including associated indicators of compromise (IOCs) that can be used for more detailed analysis and protection, can be found the full report.  Palo Alto Networks customers are protected from the Disttrack payload used in this attack:  AutoFocus customers can monitor Disttrack activity using the Disttrack tag  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This post is also available in:      日本語 (Japanese)


On July 2, attackers reportedly launched attacks against users of the Kaseya VSA remote monitoring and management software as well as customers of multiple managed service providers (MSPs) that use the software.


They used access to the VSA software to deploy ransomware associated with the REvil/Sodinokibi ransomware-as-a-service group, according to reports.


Kaseya has stated that the attack was conducted by exploiting a vulnerability in its software, and said they are working on a patch.


The company has not released further information on the vulnerability.


Kaseya recommends that any organization using VSA shut the system down immediately.


CISA has also issued a bulletin asking organizations using the software to follow Kaseya guidance.


The full extent of the attack is currently unknown.


Kaseya states that fewer than 40 of its customers are impacted.


If those customers include MSPs, many more organizations could have been attacked with the ransomware.


Kaseya VSA’s functionality allows administrators to remotely manage systems.


If an MSP’s VSA system was compromised, that could allow an attacker to deploy malware into multiple networks managed by that MSP.


There has been much speculation about the nature of this attack on social media and other forums.


We have not been able to independently determine how these attacks were conducted.


Multiple sources have stated that the following three files were used to install and execute the ransomware attack on Windows systems:  agent.exe  | d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e mpsvc.dll | e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2 mpsvc.dll  | 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd  Palo Alto Networks WildFire, Threat Prevention and Cortex XDR detect and prevent REvil ransomware infections.


As more information becomes available on the nature of this attack, we will update this brief to provide additional details.   d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2  Source: Incident Overview and Technical Details, Kaseya  35.226.94[.]113 161.35.239[.]148 162.253.124[.]162  POST /dl.asp curl/7.69.1 GET /done.asp curl/7.69.1 POST /cgi-bin/KUpload.dll curl/7.69.1 GET /done.asp curl/7.69.1 POST /cgi-bin/KUpload.dll curl/7.69.1 POST /userFilterTableRpt.asp curl/7.69.1  Understanding REvil: The Ransomware Gang Behind the Kaseya Attack  Threat Assessment: GandCrab and REvil Ransomware  2021 Unit 42 Ransomware Threat Report  Breaking Down Ransomware Attacks  Ransomware’s New Trend: Exfiltration and Extortion  Updated July 6, 2021, at 3:06 p.m. PT.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


On any given day, Google's Threat Analysis Group (TAG) is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


Our team of analysts and security experts is focused on identifying and stopping issues like phishing campaigns, zero-day vulnerabilities and hacking against Google, our products and our users.


Today, we’re sharing recent findings on government-backed phishing, threats and disinformation, as well as a new bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns.


Last month, we sent 1,755 warnings to users whose accounts were targets of government-backed attackers.


Generally, 2020 has been dominated by COVID-19.


The pandemic has taken center stage in people’s everyday lives, in the international news media, and in the world of government-backed hacking.


Recently, we shared information on numerous COVID-themed attacks discovered and confirmed by our teams.


We continue to see attacks from groups like Charming Kitten on medical and healthcare professionals, including World Health Organization (WHO) employees.


And as others have reported, we’re seeing a resurgence in COVID-related hacking and phishing attempts from numerous commercial and government-backed attackers.


As one example, we've seen new activity from “hack-for-hire” firms, many based in India, that have been creating Gmail accounts spoofing the WHO.


The accounts have largely targeted business leaders in financial services, consulting, and healthcare corporations within numerous countries including, the U.S., Slovenia, Canada, India, Bahrain, Cyprus, and the UK.


The lures themselves encourage individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements, and link to attacker-hosted websites that bear a strong resemblance to the official WHO website.


The sites typically feature fake login pages that prompt potential victims to give up their Google account credentials, and occasionally encourage individuals to give up other personal information, such as their phone numbers.


To help protect users against these kinds of tracks, our Advanced Protection Program (APP) utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings.


APP was designed specifically for high-risk accounts.


Government-backed or state-sponsored groups have different goals in carrying out their attacks: Some are looking to collect intelligence or steal intellectual property; others are targeting dissidents or activists, or attempting to engage in coordinated influence operations and disinformation campaigns.


Our products are designed with robust built-in security features, like Gmail protections against phishing and Safe Browsing in Chrome, but we still dedicate significant resources to developing new tools and technology to help identify, track and stop this kind of activity.


In addition to our internal investigations, we work with law enforcement, industry partners, and third parties like specialized security firms to assess and share intelligence.


When we find attempts to conduct coordinated influence operations on our platforms, we work with our Trust & Safety teams to swiftly remove such content from our platforms and terminate these actors’ accounts.


We take steps to prevent possible future attempts by the same actors, and routinely exchange information and share our findings with others in the industry.


We’ve also shared occasional updates about this kind of activity, and today we’re introducing a more streamlined way of doing this via a new, quarterly bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns (foreign and domestic).


Our actions against coordinated influence operations from January, February and March can be found in the Q1 Bulletin.


Since March, we’ve removed more than a thousand YouTube channels that we believe to be part of a large campaign and that were behaving in a coordinated manner.


These channels were mostly uploading spammy, non-political content, but a small subset posted primarily Chinese-language political content similar to the findings of a recent Graphika report.


We’ll also share additional removal actions from April and May in the Q2 Bulletin.


Our hope is that this new bulletin helps others who are also working to track these groups, such as researchers studying this issue, and we hope these updates can help confirm findings from security firms and others in the industry.


We will also continue to share more detailed analysis of vulnerabilities we find, phishing and malware campaigns that we see, and other interesting or noteworthy trends across this space.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 of 2020.


It was last updated on May 27, 2020.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


The campaign was linked to the Iranian state-sponsored International Union of Virtual Media (IUVM) network, and was reproducing IUVM content covering Iran’s strikes into Iraq and U.S. policy on oil.


We received leads from Graphika that supported us in this investigation.


We terminated 1 advertising account and 82 YouTube channels as part of our actions against a coordinated influence operation linked to Egypt.


The campaign was sharing political content in Arabic supportive of Saudi Arabia, the UAE, Egypt, and Bahrain and critical of Iran and Qatar.


We found evidence of this campaign being tied to the digital marketing firm New Waves based in Cairo.


This campaign was consistent with similar findings reported by Facebook.


We terminated 3 advertising accounts, 1 AdSense account, and 11 YouTube channels as part of our actions against a coordinated influence operation linked to India.


The campaign was sharing messages in English supportive of Qatar.


We banned 1 Play developer and terminated 68 YouTube channels as part of our actions against a coordinated influence operation.


The campaign was posting political content in Arabic supportive of Turkey and critical of the UAE and Yemen.


This campaign was consistent with similar findings reported by Twitter.


We terminated 1 advertising account, 1 AdSense account, 17 YouTube channels and banned 1 Play developer as part of our actions against a coordinated influence operation linked to Egypt.


The campaign was posting political content in Arabic supportive of Saudi Arabia, the UAE, Egypt, and Bahrain and critical of Iran and Qatar.


We banned 1 Play developer and terminated 78 YouTube channels as part of our actions against a coordinated influence operation linked to Serbia.


The domestic campaign was posting pro-Serbian political content.


Google’s Threat Analysis Group (TAG) is a specialized team of security experts that works to identify, report, and stop government-backed phishing and hacking against Google and the people who use our products.


We work across Google products to identify new vulnerabilities and threats.


Today we’re sharing our latest findings and the threats we’re seeing in relation to COVID-19.


One notable campaign attempted to target personal accounts of U.S. government employees with phishing lures using American fast food franchises and COVID-19 messaging.


Some messages offered free meals and coupons in response to COVID-19, others suggested recipients visit sites disguised as online ordering and delivery options.


Once people clicked on the emails, they were presented with phishing pages designed to trick them into providing their Google account credentials.


The vast majority of these messages were sent to spam without any user ever seeing them, and we were able to preemptively block the domains using Safe Browsing.


We’re not aware of any user having their account compromised by this campaign, but as usual, we notify all targeted users with a “government-backed attacker” warning.


We’ve also seen attackers try to trick people into downloading malware by impersonating health organizations: Generally, we’re not seeing an overall rise in phishing attacks by government-backed groups; this is just a change in tactics.


In fact, we saw a slight decrease in overall volumes in March compared to January and February.


While it’s not unusual to see some fluctuations in these numbers, it could be that attackers, just like many other organizations, are experiencing productivity lags and issues due to global lockdowns and quarantine efforts.


When working to identify and prevent threats, we use a combination of internal investigative tools, information sharing with industry partners and law enforcement, as well as leads and intelligence from third-party researchers.


To help support this broader security researcher community, Google is providing more than $200,000 in grants as part of a new Vulnerability Research Grant COVID-19 fund for Google VRP researchers who help  identify various vulnerabilities.


As the world continues to respond to COVID-19, we expect to see new lures and schemes.


Our teams continue to track these and stop them before they reach people—and we’ll continue to share new and interesting findings.


Gamaredon is an advanced persistent threat (APT) group that has been active since 2013.


Their campaigns are generally known for targeting Ukrainian government institutions.


From late 2019 to February of this year, researchers published several reports on Gamaredon, tracking the group’s activities.


In March, we came across an email with a malware attachment that used the Gamaredon group’s tactics.


Some of the emails used the coronavirus pandemic as a topic to lure victims into opening emails and attachments.


These campaigns targeted victims in European countries and others.


A brief history of Gamaredon   In 2015, researchers from LookingGlass published the first report on Gamaredon.


According to that report, the early campaigns used Microsoft Word documents that, when inspected, showed that its most recent user went by the name of Armagedon (a misspelled “Armageddon”), which became the basis of the group’s namesake.


The report also described Gamaredon’s political beginnings, particularly its ties to the Ukrainian revolution in 2014.


Before the revolution they had targeted Ukrainian government officials, opposition party members, and journalists.


They moved on to Ukrainian government institutions after the revolution.


In 2018, CERT-UA published an advisory against the malware Pterodo, which the group allegedly used.


The group remained active, with several Gamaredon-related activities reported in February 2020.


In March, they were among the threat groups that were identified taking advantage of the coronavirus pandemic to trick targets.


Gamaredon and Covid-19-related cover emails  Figure 1.


The infection chain of the Gamaredon campaign


The case we found arrived through a targeted email that contained a document file (in docx format).


Opening document starts a template injection technique for loading the document template from the internet.


The downloaded document template contains the malicious macro codes, which executes a VBScript (VBS).


We found a mechanism for decrypting, executing, and downloading an additional payload from the C&C server.


During the time of the analysis however, the C&C server was not accessible, which made us unable to get additional payloads.


The attacks we found all arrived through targeted emails (MITRE ATT&CK framework ID T1193).


One of them even had the subject “Coronavirus (2019-nCoV).”


The use of socially relevant topics is a common practice for attackers who wish to make their emails and documents more tempting to open.


The email that used the coronavirus-related subject came with an attached document file.


Opening this file (MITRE ATT&CK framework ID T1204) executes the template injection method (MITRE ATT&CK framework ID T1221).


Figure 2. Code for downloading the document template with the malicious macro


The downloaded document template (in dot format) could differ slightly depending on each download.


However, its Exif info or metadata remains consistent and shares the following details:  Identification: Word 8.0


Language code: Russian System: Windows Author: АДМИН (“Administrator” in Russian) Code page: Windows Cyrillic      Figure 3.


A sample of malicious macro in the downloaded template document


As mentioned, the template contains malicious macro (MITRE ATT&CK framework ID T1064), which exports VBS (MITRE ATT&CK framework ID T1064) to execute itself.


More specifically it drops “%USERPROFILE%\Documents\MediaPlayer\PlayList.vbs,” which is hardcoded in the macro, and then executed in “wscript.exe //b %USERPROFILE%\Documents\MediaPlayer\PlayList.vbs.”  Figure 4.


A content sample for VBS dropped by malicious macro PlayList.vbs contains the obfuscated codes (MITRE ATT&CK framework ID T1140), which it executes after decrypting the obfuscations.


This particular behavior is a slight departure from previously reported attacks by Gamaredon, which did not use this technique.


Figure 5.


A sample of executed VBS Figure 5 shows a snippet of the VBS executed by the Execute function.


The routines it follows are enumerated below.


Register the RUN key in the registry below, so that the VBS file is executed every time the machine starts (MITRE ATT&CK framework ID T1060)


Registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\MediaPlayer wscript.exe //b ％USERPROFILE%\Documents\MediaPlayer\PlayList.vbs


Connect with “hxxp:// kristom[.]hopto[.]org /{computer name}_{hexadecimal volume serious number}/help_05_03[.]php” (MITRE ATT&CK framework IDs T1043, T1071, T1082)


If the downloaded file size in the first step exceeds 10,485 bytes, then the file is saved as “%APPDATA%\\Microsoft\Windows\Cookies.txt” (MITRE ATT&CK framework ID T1105)


Use XOR for the file saved from the second step, where ASCII code converted from its own hexadecimal volume serial number is used as the key.


The decrypted result is saved as “%APPDATA%\\Microsoft\Windows\Cookies.exe” (T1001)


If the file size of “%APPDATA%\\Microsoft\Windows\Cookies.exe” exceeds 4,485 bytes, it is executed.


Both “%APPDATA%\\Microsoft\Windows\Cookies.txt” and “%APPDATA%\\Microsoft\Windows\Cookies.exe” are then deleted (MITRE ATT&CK framework ID T1107)  The observed routines of this VBS closely follow the other reports published on Gamaredon, such as the one from SentinelOne.


However, the macro generated VBS was obfuscated in this case, likely as an additional evasive tactic.


Interestingly, after decoding the VBS, we saw what appeared to be a programming mistake by the attacker.


Lines 53 and 54 in figure 6 are for closing those downloaded and decoded TXT and EXE files, which are variables defined right before the IF statement.


If, however, these lines do not pass through this IF statement, an error would occur.


It shows that this malware is not tested enough, and may still be under development.


Our analysis found several URLs of the network destinations for both template injection and VBS.


While resolving them to IP addresses to understand their attack bases, we also found that they were all linked to the following IP addresses.


Network destination for template injection: 176[.]119[.]147[.]225 Network destination for VBS: 176[.]57[.]215[.]115  These IP addresses are from Russian hosting companies.


Most likely, the attackers rented Virtual Private Server (VPS) as their attack base.


Their URL for VBS (shown below) likely includes the data when they conducted the attack.


hxxp://{FQDN}/{computer name}_{hexadecimal volume serial number}/help_{day}_{month}[.]php  Conclusion Gameradon is not the first group to take advantage of the Covid-19 topic.


Some cybercriminals have taken to indirect means of profiting, such as by targeting communication platforms that have increased in popularity after organizations shifted to work from home setups.


In this case, they used Covid-19 as a cover for their relatively typical APT routine.


We recommend these countermeasures to prevent similar APT attacks in the future:  Check the email sender, subject, and body for anything suspicious before downloading and opening email attachments.


Be especially wary of unsolicited emails, that come from unknown senders.


Check the file extension of the attached file and make sure it is the intended file format.


Avoid activating macro for any attached Microsoft Office files, especially for emails that request macro activation using an image of the body of the opened file or those that don’t show anything.


Watch out for spoofed domains embedded in emails before opening them.


Subtle changes to a popular URL can be one indicator of malicious content.


In addition to these actions, users can also implement a multi-layer approach and take advantage of these solutions.  Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security


protects users and businesses from similar threats by detecting malicious files and spammed messages as well as blocking all related malicious URLs.


Trend Micro Deep Discovery™ has an email inspection layer that can protect enterprises by detecting malicious attachments and URLs.


Trend Micro™ Hosted Email Securityis a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.


It protects Microsoft Exchange, Microsoft Office 365, Google Apps, and other hosted and on-premises email solutions.


Trend Micro™ OfficeScan™with XGen™ endpoint security infuses high-fidelity machine learning with other detection technologies and global threat intelligence for comprehensive protection against advanced malware.


The Trend MicroTMXDR solution effectively protects connected emails, endpoints, servers, cloud workloads, and networks.


Trend Micro XDR uses powerful AI and expert security analytics to correlate data, as well as deliver fewer yet higher-fidelity alerts for early threat detection.


In a single console, it provides a broader perspective of enterprise systems while at the same time giving a more focused and optimized set of alerts.


Indicators of Compromise (IoCs)  DOCX file SHA256 Detection Name 0d90fe36866ee30eb5e4fd98583bc2fdb5b7da37e42692f390ac5f807a13f057 W97M_CVE20170199.ZYHC-A 036c2088cb48215f21d4f7d751d750b859d57018c04f6cadd45c0c4fee23a9f8 Trojan.W97M.CVE20170199.PG 19d03a25af5b71e859561ff8ccc0a073acb9c61b987bdb28395339f72baf46b4 Trojan.XML.PHISH.AE 62cf22f840fffd8d8781e52b492b03b4efc835571b48823b07535d52b182e861 W97M_CVE20170199.ZKHC-A 8310d39aa1cdd13ca82c769d61049310f8ddaea7cd2c3b940a8a3c248e5e7b06 Trojan.W97M.CVE20170199.PF 84e0b1d94a43c87de55c000e3acae17f4493a57badda3b27146ad8ed0f90c93e Trojan.W97M.CVE20170199.PG 85267e52016b6124e4e42f8b52e68475174c8a2bdf0bc0b501e058e2d388a819 Trojan.W97M.CVE20170199.PF b6a94f565d482906be7da4d801153eb4dab46d92f43be3e1d59ddd2c7f328109 Trojan.W97M.CVE20170199.PF cc775e3cf1a64effa55570715b73413c3ea3a6b47764a998b1272b5be059c25b Trojan.W97M.CVE20170199.PF      DOT file SHA256 Detection Name TrendX 00b761bce25594da4c760574d224589daf01086c5637042982767a13a2f61bea Mal_OLEMAL-4 Downloader.VBA.TRX.XXVBAF01FF007 250b09f87fe506fbc6cedf9dbfcb594f7795ed0e02f982b5837334f09e8a184b Mal_OLEMAL-4 4b3ae36b04d6aba70089cb2099e6bc1ba16d16ea24bbf09992f23260151b9faf Mal_OLEMAL-4 946405e2f26e1cc0bd22bc7e12d403da939f02e9c4d8ddd012f049cf4bf1fda9 Mal_OLEMAL-4 9cd5fa89d579a664c28da16064057096a5703773cef0a079f228f21a4b7fd5d2 Mal_OLEMAL-4 c089ccd376c9a4d5e5bdd553181ab4821d2c26fefc299cce7a4f023a660484d5 Mal_OLEMAL-4 e888b5e657b41d45ef0b2ed939e27ff9ea3a11c46946e31372cf26d92361c012 W97M_VBSDOWNLDR.ZKHC-A f577d2b97963b717981c01b535f257e03688ff4a918aa66352aa9cd31845b67d W97M_VBSDOWNLDR.ZYHC-A      SHA256 Detection Name TrendX 17161e0ab3907f637c2202a384de67fca49171c79b1b24db7c78a4680637e3d5 Trojan.X97M.CVE201711882.THCOCBO Downloader.VBA.TRX.XXVBAF01FF006 29367502e16bf1e2b788705014d0142d8bcb7fcc6a47d56fb82d7e333454e923 TrojanSpy.Win32.FAREIT.UHBAZCLIZ N/A 315e297ac510f3f2a60176f9c12fcf92681bbad758135767ba805cdea830b9ee Trojan.X97M.CVE201711882.THCOCBO Downloader.VBA.TRX.XXVBAF01FF006 3e6166a6961bc7c23d316ea9bca87d8287a4044865c3e73064054e805ef5ca1a Backdoor.Win32.REMCOS.USMANEAGFG Troj.Win32.TRX.XXPE50FFF034 3f40d4a0d0fe1eea58fa1c71308431b5c2ce6e381cacc7291e501f4eed57bfd2 Trojan.MSIL.AGENTTESLA.THCOCBO N/A ab533d6ca0c2be8860a0f7fbfc7820ffd595edc63e540ff4c5991808da6a257d Trojan.X97M.CVE201711882.THCOCBO N/A b78a3d21325d3db7470fbf1a6d254e23d349531fca4d7f458b33ca93c91e61cd Backdoor.Win32.REMCOS.USMANEAGFE Troj.Win32.TRX.XXPE50FFF034 c9c0180eba2a712f1aba1303b90cbf12c1117451ce13b68715931abc437b10cd TrojanSpy.Win32.FAREIT.UHBAZCLIZ Troj.Win32.TRX.XXPE50FFF034     C&C addresses  Bambinos[.]bounceme[.]net bbtt[.]site bbtt[.]space harpa[.]site harpa[.]space harpa[.]website himym[.]site kristoffer[.]hopto[.]org kristom[.]hopto[.]org miragena[.]site miragena[.]xyz papir[.]hopto[.]org sabdja[.]3utilities[.]com sakira[.]3utilities[.]com seliconos[.]3utilities[.]com solod[.]bounceme[.]net sonik[.]hopto[.]org tele[.]3utilities[.]com violina[.]website voyager[.]myftp[.]biz voyaget[.]myftp[.]biz  Mitre ATT&CK Framework         Tags  Malware | APT & Targeted Attacks | Research | Spam | Articles, News, Reports


On any given day, Google's Threat Analysis Group (TAG) is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.


Our team of analysts and security experts is focused on identifying and stopping issues like phishing campaigns, zero-day vulnerabilities and hacking against Google, our products and our users.


Today, we’re sharing recent findings on government-backed phishing, threats and disinformation, as well as a new bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns.


Last month, we sent 1,755 warnings to users whose accounts were targets of government-backed attackers.


Generally, 2020 has been dominated by COVID-19.


The pandemic has taken center stage in people’s everyday lives, in the international news media, and in the world of government-backed hacking.


Recently, we shared information on numerous COVID-themed attacks discovered and confirmed by our teams.


We continue to see attacks from groups like Charming Kitten on medical and healthcare professionals, including World Health Organization (WHO) employees.


And as others have reported, we’re seeing a resurgence in COVID-related hacking and phishing attempts from numerous commercial and government-backed attackers.


As one example, we've seen new activity from “hack-for-hire” firms, many based in India, that have been creating Gmail accounts spoofing the WHO.


The accounts have largely targeted business leaders in financial services, consulting, and healthcare corporations within numerous countries including, the U.S., Slovenia, Canada, India, Bahrain, Cyprus, and the UK.


The lures themselves encourage individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements, and link to attacker-hosted websites that bear a strong resemblance to the official WHO website.


The sites typically feature fake login pages that prompt potential victims to give up their Google account credentials, and occasionally encourage individuals to give up other personal information, such as their phone numbers.


To help protect users against these kinds of tracks, our Advanced Protection Program (APP) utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings.


APP was designed specifically for high-risk accounts.


Government-backed or state-sponsored groups have different goals in carrying out their attacks: Some are looking to collect intelligence or steal intellectual property; others are targeting dissidents or activists, or attempting to engage in coordinated influence operations and disinformation campaigns.


Our products are designed with robust built-in security features, like Gmail protections against phishing and Safe Browsing in Chrome, but we still dedicate significant resources to developing new tools and technology to help identify, track and stop this kind of activity.


In addition to our internal investigations, we work with law enforcement, industry partners, and third parties like specialized security firms to assess and share intelligence.


When we find attempts to conduct coordinated influence operations on our platforms, we work with our Trust & Safety teams to swiftly remove such content from our platforms and terminate these actors’ accounts.


We take steps to prevent possible future attempts by the same actors, and routinely exchange information and share our findings with others in the industry.


We’ve also shared occasional updates about this kind of activity, and today we’re introducing a more streamlined way of doing this via a new, quarterly bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns (foreign and domestic).


Our actions against coordinated influence operations from January, February and March can be found in the Q1 Bulletin.


Since March, we’ve removed more than a thousand YouTube channels that we believe to be part of a large campaign and that were behaving in a coordinated manner.


These channels were mostly uploading spammy, non-political content, but a small subset posted primarily Chinese-language political content similar to the findings of a recent Graphika report.


We’ll also share additional removal actions from April and May in the Q2 Bulletin.


Our hope is that this new bulletin helps others who are also working to track these groups, such as researchers studying this issue, and we hope these updates can help confirm findings from security firms and others in the industry.


We will also continue to share more detailed analysis of vulnerabilities we find, phishing and malware campaigns that we see, and other interesting or noteworthy trends across this space.


This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 of 2020.


It was last updated on May 27, 2020.


We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.


The campaign was linked to the Iranian state-sponsored International Union of Virtual Media (IUVM) network, and was reproducing IUVM content covering Iran’s strikes into Iraq and U.S. policy on oil.


We received leads from Graphika that supported us in this investigation.


We terminated 1 advertising account and 82 YouTube channels as part of our actions against a coordinated influence operation linked to Egypt.


The campaign was sharing political content in Arabic supportive of Saudi Arabia, the UAE, Egypt, and Bahrain and critical of Iran and Qatar.


We found evidence of this campaign being tied to the digital marketing firm New Waves based in Cairo.


This campaign was consistent with similar findings reported by Facebook.


We terminated 3 advertising accounts, 1 AdSense account, and 11 YouTube channels as part of our actions against a coordinated influence operation linked to India.


The campaign was sharing messages in English supportive of Qatar.


We banned 1 Play developer and terminated 68 YouTube channels as part of our actions against a coordinated influence operation.


The campaign was posting political content in Arabic supportive of Turkey and critical of the UAE and Yemen.


This campaign was consistent with similar findings reported by Twitter.


We terminated 1 advertising account, 1 AdSense account, 17 YouTube channels and banned 1 Play developer as part of our actions against a coordinated influence operation linked to Egypt.


The campaign was posting political content in Arabic supportive of Saudi Arabia, the UAE, Egypt, and Bahrain and critical of Iran and Qatar.


We banned 1 Play developer and terminated 78 YouTube channels as part of our actions against a coordinated influence operation linked to Serbia.


The domestic campaign was posting pro-Serbian political content.


Google’s Threat Analysis Group (TAG) is a specialized team of security experts that works to identify, report, and stop government-backed phishing and hacking against Google and the people who use our products.


We work across Google products to identify new vulnerabilities and threats.


Today we’re sharing our latest findings and the threats we’re seeing in relation to COVID-19.


One notable campaign attempted to target personal accounts of U.S. government employees with phishing lures using American fast food franchises and COVID-19 messaging.


Some messages offered free meals and coupons in response to COVID-19, others suggested recipients visit sites disguised as online ordering and delivery options.


Once people clicked on the emails, they were presented with phishing pages designed to trick them into providing their Google account credentials.


The vast majority of these messages were sent to spam without any user ever seeing them, and we were able to preemptively block the domains using Safe Browsing.


We’re not aware of any user having their account compromised by this campaign, but as usual, we notify all targeted users with a “government-backed attacker” warning.


We’ve also seen attackers try to trick people into downloading malware by impersonating health organizations: Generally, we’re not seeing an overall rise in phishing attacks by government-backed groups; this is just a change in tactics.


In fact, we saw a slight decrease in overall volumes in March compared to January and February.


While it’s not unusual to see some fluctuations in these numbers, it could be that attackers, just like many other organizations, are experiencing productivity lags and issues due to global lockdowns and quarantine efforts.


When working to identify and prevent threats, we use a combination of internal investigative tools, information sharing with industry partners and law enforcement, as well as leads and intelligence from third-party researchers.


To help support this broader security researcher community, Google is providing more than $200,000 in grants as part of a new Vulnerability Research Grant COVID-19 fund for Google VRP researchers who help  identify various vulnerabilities.


As the world continues to respond to COVID-19, we expect to see new lures and schemes.


Our teams continue to track these and stop them before they reach people—and we’ll continue to share new and interesting findings.


Google’s Threat Analysis Group (TAG) works to counter targeted and government-backed hacking against Google and the people who use our products.


Following our November update, today we’re sharing the latest insights to fight phishing, and for security teams, providing more details about our work identifying attacks against zero-day vulnerabilities.


We have a long-standing policy to send you a warning if we detect that your account is a target of government-backed phishing or malware attempts.


In 2019, we sent almost 40,000 warnings, a nearly 25 percent drop from 2018.


One reason for this decline is that our new protections are working—attackers' efforts have been slowed down and they’re more deliberate in their attempts, meaning attempts are happening less frequently as attackers adapt.


We’ve detected a few emerging trends in recent months.


Upon reviewing phishing attempts since the beginning of this year, we’ve seen a rising number of attackers, including those from Iran and North Korea, impersonating news outlets or journalists.


For example, attackers impersonate a journalist to seed false stories with other reporters to spread disinformation.


In other cases, attackers will send several benign emails to build a rapport with a journalist or foreign policy expert before sending a malicious attachment in a follow up email.


Government-backed attackers regularly target foreign policy experts for their research, access to the organizations they work with, and connection to fellow researchers or policymakers for subsequent attacks.


Government-backed attackers continue to consistently target geopolitical rivals, government officials, journalists, dissidents and activists.


The chart below details the Russian threat actor group SANDWORM’s targeting efforts (by sector) over the last three years.


In 2019, one in five accounts that received a warning was targeted multiple times by attackers.


If at first the attacker does not succeed, they’ll try again using a different lure, different account, or trying to compromise an associate of their target.


We’ve yet to see people successfully phished if they participate in Google’s Advanced Protection Program (APP), even if they are repeatedly targeted.


APP provides the strongest protections available against phishing and account hijacking and is specifically designed for the highest-risk accounts.


Zero-day vulnerabilities are unknown software flaws.


Until they’re identified and fixed, they can be exploited by attackers.


TAG actively hunts for these types of attacks because they are particularly dangerous and have a high rate of success, although they account for a small number of the overall total.


When we find an attack that takes advantage of  a zero-day vulnerability, we report the vulnerability to the vendor and give them seven days to patch or produce an advisory or we release an advisory ourselves.


We work across all platforms, and in 2019 TAG discovered zero-day vulnerabilities affecting Android, Chrome, iOS, Internet Explorer and Windows.


Most recently, TAG was acknowledged in January 2020 for our contribution in identifying CVE-2020-0674, a remote code execution vulnerability in Internet Explorer.


Last year, TAG discovered that a single threat actor was capitalizing on five zero-day vulnerabilities.


Finding this many zero-day exploits from the same actor in a relatively short time frame is rare.


The exploits were delivered via compromised legitimate websites (e.g. watering hole attacks), links to malicious websites, and email attachments in limited spear phishing campaigns.


The majority of targets we observed were from North Korea or individuals who worked on North Korea-related issues.


For security teams interested in learning more, here are additional details about the exploits and our work in 2019:


The vulnerabilities underlying these exploits included: Internet Explorer - CVE-2018-8653 Internet Explorer - CVE-2019-0676 Chrome - CVE-2019-5786 Windows Kernel - CVE-2019-0808 Internet Explorer - CVE-2019-1367 Internet Explorer - CVE-2019-1429


The following technical details are associated with the exploits and can be used for teams interested in conducting further research on these attacks: CVE-2018-8653, CVE-2019-1367 and CVE-2020-0674 are vulnerabilities inside jscript.dll, therefore all exploits enabled IE8 rendering and used JScript.Compact as JS engine.


In most Internet Explorer exploits, attackers abused the Enumerator object in order to gain remote code execution.


To escape from the Internet Explorer EPM sandbox, exploits used a technique consisting of replaying the same vulnerability inside svchost by abusing Web Proxy Auto-Discovery (WPad) Service.


Attackers abused this technique with CVE-2020-0674 on Firefox to escape the sandbox after exploiting CVE-2019-17026.


CVE-2019-0676 is a variant of CVE-2017-0022, CVE-2016-3298, CVE-2016-0162 and CVE-2016-3351 where the vulnerability resided inside the handling of “res://” URI scheme.


Exploiting CVE-2019-0676 enabled attackers to reveal presence or non-presence of files on the victim’s computer; this information was later used to decide whether or not a second stage exploit should be delivered.


The attack vector for CVE-2019-1367 was rather atypical as the exploit was delivered from an Office document abusing the online video embedding feature to load an external URL conducting the exploitation.


Our Threat Analyst Group will continue to identify bad actors and share relevant information with others in the industry.


Our goal is to bring awareness to these issues to protect you and fight bad actors to prevent future attacks.


In a future update, we’ll provide details on attackers using lures related to COVID-19 and expected behavior we’re observing (all within the normal range of attacker activity).


APT36, also known as Earth Karkaddan, a politically motivated advanced persistent threat (APT) group, has historically targeted Indian military and diplomatic resources.


This APT group (also referred to as Operation C-Major, PROJECTM, Mythic Leopard, and Transparent Tribe) has been known to use social engineering and phishing lures as an entry point, after which, it deploys the Crimson RAT malware to steal information from its victims.


In late 2021, we saw the group leverage CapraRAT, an Android RAT with clear similarities in design to the group’s favored Windows malware, Crimson RAT.


It is interesting to see the degree of crossover in terms of function names, commands, and capabilities between the tools, which we cover in more detail in our technical brief, “Earth Karkaddan APT.”


Our investigation is based on Trend Micro Smart Protection Network (SPN) data gathered from January 2020 to September 2021.


Looking into one of Earth Karkaddan’s recent campaigns Typically, Earth Karkaddan’s arrival methods include the use of spear-phishing emails and a USB worm that would then drop and execute a remote access trojan (RAT).      Figure 1. Earth Karkaddan’s attack chain


The malicious emails feature a variety of lures to deceive victims into downloading malware, including fraudulent government documents, honeytraps showing profiles of attractive women, and recently, coronavirus-themed information.         Figure 2. An example


of a fake government-related spear-phishing email


Figure 3. An example of a coronavirus-related spear-phishing email attachment     Once the victim downloads the malicious macro, it will decrypt an embedded executable dropper that is hidden inside a text box, which will then be saved to a hardcoded path prior to it executing in the machine.      Figure 4. Malicious macro that decrypts an executable hidden inside a text box      Figure 5. Examples of encrypted Crimson RAT executables hidden inside text boxes     Once the executable file is executed, it will proceed to unzip a file named mdkhm.zip and then execute a Crimson RAT executable named dlrarhsiva.exe.


Figure 6.


The dlrarhsiva.exe Crimson RAT executable


Earth Karkaddan actors are known to use the Crimson RAT malware in its campaigns to communicate with its command-and-control (C&C) server to download other malware or exfiltrate data.


Our analysis shows that the Crimson RAT malware is compiled as a .NET binary with minimal obfuscation.


This could indicate that the cybercriminal group behind this campaign is possibly not well-funded.


Figure 7.


A list of minimally obfuscated commands, function names, and variables from a Crimson RAT malware sample     Crimson RAT can steal credentials from browsers, collect antivirus information, capture screenshots, and list victim drives, processes, and directories.


We have observed how an infected host communicates with a Crimson RAT C&C server to send exfiltrated information including PC name, operating system (OS) information, and the location of the Crimson RAT malware inside the system.


Figure 8.


Network traffic from a Crimson RAT malware sample     ObliqueRat Malware Analysis


Aside from the Crimson RAT malware, the Earth Karkaddan APT group is also known to use the ObliqueRat malware in its campaigns.


This malware is also commonly distributed in spear-phishing campaigns using social engineering tactics to lure victims into downloading another malicious document.


In one of its most recent campaigns, the lure used was that of the Centre for Land Warfare Studies (CLAWS) in New Delhi, India.


Figure 9.


Initial spear-phishing document with a link to another malicious document     Once the victim clicks the link, it will download a document laced with a malicious macro.


Upon enabling the macro, it will then download the ObliqueRat malware that is hidden inside an image file.


Figure 10.


The downloaded "1More-details.doc" contains malicious macros that will download and execute the ObliqueRat malware in a victim’s machine     The macros inside the file will then download a bitmap image (BMP) file where the ObliqueRAT malware is hidden, decode the downloaded BMP file, then create a persistence mechanism by creating a Startup URL which will automatically run the ObliqueRAT malware.


Figure 11.


Malicious macro codes will download, decode, and execute the ObliqueRat malware     Figure 12 shows a summary of the ObliqueRat malware’s infection chain:      Figure 12.


ObliqueRat attack chain


Below is a list of backdoor commands that this particular ObliqueRAT malware variant can perform:  Command (v5.2)  Info  0  System information


1  List drive and drive type


3  Find certain files and file sizes  4  Send back zip files (specified filename)  4A/4E  Send back zip files  5  Find certain files and file sizes


Zip certain folder, send back to C&C, then delete it  7  Execute commands  8  Receive file from C&C  BACKED  Back up the file lgb  RNM  Rename file  TSK  List running processes  EXIT  Stop execution  RESTART  Restart connection to C&C


KILL  Kill certain processes  AUTO


Find certain files  RHT  Delete files


Note that in this specific campaign, both the Crimson RAT malware downloader document and the ObliqueRat malware downloader share the same download domain, which is sharingmymedia[.]com.


This indicates that both malware types were actively used in Earth Karkaddan APT campaigns.


Figure 13.


Crimson RAT and ObliqueRat spear-phishing email attachments that feature the same download domain     CapraRAT, One of Earth Karkaddan’s custom Android RAT


Aside from using spear-phishing emails and a USB worm as arrival vectors, Earth Karkaddan also uses Android RATs that could be deployed by means of malicious phishing links.


This is not particularly novel for the APT group — in 2018, it used StealthAgent (detected by Trend Micro as AndroidOS_SMongo.HRX), an Android spyware that can intercept phone calls and messages, track victims’ locations, and steal photos.


In 2020, Earth Karkaddan used an updated version of the AhMyth Android RAT to target Indian military and government personnel via a disguised porn app and a fraudulent national Covid-19 tracking app.


We observed this group using another Android RAT — TrendMicro has named this “CapraRat”— which is possibly a modified version of an open-source RAT called AndroRAT.


While analyzing this android RAT, we saw several similar capabilities to the CrimsonRat malware that the group usually uses to infect Windows systems.


We have been observing CapraRAT samples since 2017,  and one of the first samples we analyzed (SHA-256: d9979a41027fe790399edebe5ef8765f61e1eb1a4ee1d11690b4c2a0aa38ae42, detected by Trend Micro as as AndroidOS_Androrat.HRXD)


revealed some interesting things in that year: they used "com.example.appcode.appcode" as the APK package name and used a possible public certificate “74bd7b456d9e651fc84446f65041bef1207c408d,” which possibly meant the sample was used for testing, and they just started to use it for their campaigns during that year.


The C&C domain android[.]viral91[.]xyz, where the malware was connecting to also shows that it is very likely that the APT team uses subdomains to host or connect to Android malware.


In previous years, some CrimsonRAT samples were also found to be hosted on the viral91[.]xyz domain.


Figure 14. CrimsonRAT malware hosted in viral91[.]xyz     We were also able to source a phishing document, “csd_car_price_list_2017,” that is related to this domain and has been seen in the wild in 2017.


This file name is interesting as “csd” is likely to be associated to "Canteen Stores Department" in Pakistan, which is operated by the Pakistani Ministry of Defence.


This is a possible lure for the Indian targets to open the malicious attachment, also used in a similar attack in 2021.


Upon downloading this malicious app that possibly arrived via a malicious link, the user will need to grant permissions upon installation to allow the RAT access to stored information.


The malware can do the following on a compromised device:  Access the phone number Launch other apps’ installation packages Open the camera


Access the microphone and record audio clips


Access the unique identification number Access location information


Access phone call history


Access contact information


Once the Android RAT is executed, it will attempt to establish a connection to its C&C server, 209[.]127[.]19[.]241[:]10284.


We have observed that the Remote Desktop Protocol (RDP) certificate associated in this deployment, “WIN-P9NRMH5G6M8,” is a common string found in previously identified Earth Karkaddan C&C servers.


Figure 15. Decompiled code from CapraRAT connecting to its C&C server      Figure 16. CapraRAT config showing its C&C server and port information       Figure 17.


Backdoor commands found in CapraRAT     This APK file also has the ability to drop mp4 or APK files from asset directory.


Figure 18. CapraRAT APK file drops an mp4 file     The RAT also has a persistence mechanism that always keeps the app active.


It checks whether the service is still running every minute, and if it is not, the service will be launched again.


Figure 19.


CapraRAT’s persistence mechanism     Reducing risks:


How to defend against APT attacks Earth Karkaddan has been stealing information since 2016 by means of creative social engineering lures and file-stealing malware.


Users can adopt the following security best practices to thwart Earth Karkaddan attacks:


Be careful of opening unsolicited and unexpected emails, especially those that call for urgency Watch out for malicious email red flags, which include atypical sender domains and grammatical and spelling lapses


Avoid clicking on links or downloading attachments in emails, especially from unknown sources Block threats that arrive via email such as malicious links using hosted email security and antispam protection


Download apps only from trusted sources


Be wary of the scope of app permissions


Get multilayered mobile security solutions that can protect devices against online threats, malicious applications, and even data loss


The following security solutions can also protect users from email-based attacks:  Trend Micro™ Cloud App Security – Enhances the security of Microsoft Office 365 and other cloud services via computer vision and real-time scanning.


It also protects organizations from email-based threats.


Trend Micro™ Deep Discovery™ Email Inspector – Defends users through a combination of real-time scanning and advanced analysis techniques for known and unknown attacks.


Trend Micro™ Mobile Security for Enterprise suite – Provides device, compliance and application management, data protection, and configuration provisioning, as well as protects devices from attacks that exploit vulnerabilities, prevents unauthorized access to apps and detects and blocks malware and fraudulent websites.


Trend Micro’s Mobile App Reputation Service (MARS) – Covers Android and iOS threats using leading sandbox and machine learning technologies to protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerability.


Indicators of Compromise


A list of indicators can be found in this text file.


Tags  APT & Targeted Attacks | Articles, News, Reports


Update as of April 27, 2021, 7 A.M. E.T.:


We've updated the "Rootkits From a Public Repository" section and the appendix to include a second sample.


More than a year after Operation DRBControl, a campaign by a cyberespionage group that targets gambling and betting companies in Southeast Asia, we found evidence that the Iron Tiger threat actor is still interested in the gambling industry.


This blog details how Iron Tiger threat actors have updated their toolkit with an updated SysUpdate malware variant that now uses five files in its infection routine instead of the usual three.


We also provide details on Iron Tiger’s possible connections to other threat actors based on similar tactics, techniques, and procedures (TTPs) we’ve observed.


Finally, we describe some of the rootkits that Iron Tiger is using, one of which is used to hide files at the kernel level, and has not been previously reported as being used by this threat actor.


A Look at the Iron Tiger Threat Group


In 2019, Talent-Jump, Inc., a security service and system integration company, discovered several malware variants in a gambling company during an incident response operation and sought our help for further investigation and analysis.


In 2020 and 2021, Talent-Jump found new samples for malware families that are attributed to the Iron Tiger threat actor, which is also referred to as LuckyMouse, EmissaryPanda, and APT27.


While investigating Operation DRBControl in 2019, we found several connections to multiple threat actors:  Iron Tiger, which uses the HyperBro trojan and some infrastructure links Winnti, which uses the same infrastructure and code-sharing links detailed in our paper Bronze President, a threat actor that targets non-governmental organizations (NGOs).


Back in 2019, we named a malware family, which we believed was new, as “Type 2.”


However, after the publication of our report, we learned that the Type 2 malware family described in our report was the same as the “RCSession” malware family that Dell Secureworks described in a blog that they published in December 2019.


After finding multiple tools belonging to the Iron Tiger threat actor (which we now track as Earth Smilodon), it is likely that the new malware families that we found during the Operation DRBControl investigation came from the same threat actor.


New Version of SysUpdate Malware      Figure 1.


The old and new SysUpdate infection chains      In December 2020, we found a sample that we identified as one belonging to the SysUpdate malware family, also named Soldier, FOCUSFJORD, and HyperSSL.


SysUpdate was first described by the NCC Group in 2018.


In the past, SysUpdate was loaded in memory by a known method involving three files:  One legitimate executable, sometimes signed, and vulnerable to dynamic-link library (DLL) sideloading One malicious DLL loaded by the legitimate file One binary file usually containing obfuscated code, unpacked in memory by the malicious DLL


An additional executable that serves as a launcher is loaded in memory, which then loads the final SysUpdate payload.


Based on our investigation, instead of the usual three files, the threat actor used five:  dlpumgr32.exe, a legitimate signed file that belongs to the DESlock+ product DLPPREM32.DLL, a malicious DLL sideloaded by dlpumgr32.exe that loads and decodes DLPPREM32.bin DLPPREM32.bin, a shellcode that decompresses and loads a launcher in memory data.res, an encrypted file decoded by the launcher and contains two SysUpdate versions: one for a 32-bit architecture and another for a 64-bit architecture config.res, an encrypted file decoded by the launcher and contains the SysUpdate configuration, such as the command-and-control (C&C) address


Analysis of the Updated Tool: The Launcher


In summary, the launcher acts as an installer — it will copy the malware to a fixed place and ensure that it runs during the next boot of the infected host.


In detail, this process involves multiple steps.


The launcher starts by instantiating the CLoadInfo object, which has the following structure:  Offset  Description  Hardcoded values in our sample  0  VTable of CLoadInfo class


4  Directory to copy all files  %PROGRAMDATA%\Test\  8  Name of the legitimate executable  dlpumgr32.exe  12  Name of the sideloaded DLL  DLPPREM32.DLL


16  Name of the shellcode  DLPPREM32.bin  20  Name of the encrypted payload  data.res  24  MD5 of the encrypted payload  e43e40416520dab5b4c44ac8af907078  28  Name of the encrypted configuration  config.res  32  Name of the registry key value  servTest  36  Name of the service DisplayName  Servdisplay   Table 1.


CLoadInfo object structure


The launcher’s behavior changes depending on the number of arguments passed to the executable.


It’s important to highlight that the change of behavior only depends on the number of arguments, and not the content:  No argument.


If there is no argument, a hardcoded directory will be created wherein all the files will be copied.


The CreationTime, LastWriteTime, and LastAccessTime will be updated according to the C:\Windows\system32\kernel32.dll file and their file attributes will be set to “hidden” and “system”.


Windows Management Instrumentation (WMI) will be used to run dlpumgr32.exe with arguments “-up -run -x” and it will exit the current process.


One argument.


It will skip the decoding of the configuration and persistence setup, and will perform the same behavior as one with three arguments.


Three arguments.


The launcher first decrypts the config.res file with a hardcoded Data Encryption Standard (DES) key.


It encodes it using another key and writes it to the registry key “Software\Classes\scConfig” (HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER hive, depending on the privileges of the process).


After decrypting the configuration, the config.res file is deleted.


Depending on the privileges of the process, the malware will add a value to the “Software\Microsoft\Windows\CurrentVersion\Run” key, or it will create a service that runs the malware at boot time


The launcher decrypts the data.res file with a different hardcoded DES key.


The result is a file with the following structure:     Size of the 32-bit shellcode  32-bit shellcode  Size of the 64-bit shellcode  64-bit shellcode   Table 2.


Structure of decrypted data.res file  Lastly, the launcher starts a suspended process with the command line “C:\Windows\system32\svchost.exe -k LocalServices,”and injects the appropriate shellcode into it (either 32- or 64-bit).


It will then resume the newly created process and exit the current process.


The following diagram summarizes the launch procedure:      Figure 2.


The launch procedure of the updated tool      The payload itself is a new version of SysUpdate.


Analysis of the Payload


The features of the updated SysUpdate payload look similar to its previous versions.


We observed that the C++ code is structured around classes, many of which have self-explanatory names.


Some of these classes, such as CCompress, CIOStreamIF, or CTcpSocket, have been present in the older versions of SysUpdate and compiled near the end of 2015.


Others have been in existence for many years, such as TPacket, SCM Client, SystemInfo, CMD5, CIOStream, and CInfo.


Some of them are newer and have been developed in 2020, such as ConfigReg, CWorkQueue, WindowsEvent, and CEncoder or cudp.


The sample we’ve analyzed contained many new and unique classes that featured a particular naming convention.


The names of classes are mostly self-explanatory, and the manner in which the classes have been organized is probably the result of a framework developed by our threat actor.


Some of the classes’ names


start with “H” (HControl, HSleep, and HTrans), “I” (IAgent, ITcpAgent, and IAgentListener), “T” (TCommon, TFileInfo, TFileRename, TFileUpload, TServicesInfo, TListUser, and TTransmit), “C” (CSSLAgent, CSocks5, and CTcpAgent) or “CM” (CMCapture, CMFile, CMPipeClient, CMPipeServer, CMProcess, CMServices, and CMShell)


The communication is made via a named pipe (in our case, it’s “\\.\pipe\testPipe”).


Multiple features that are expected of an espionage backdoor are present in the sample.


These include a screenshot feature, file management functions (such as search, delete, move, upload, and download), process and services management, and command execution.


It should be noted that we also found recent samples of the SysUpdate backdoor that do not implement these “new” classes.


This suggests that different groups (or subgroups of Iron Tiger) are also using this malware family in their attacks.


Pandora Backdoor


On two occasions (in March and October 2020), we found a kernel rootkit that had been deployed.


After analysis, it appears that this rootkit’s behavior is very similar to that of the NDISProxy driver and remote access trojan (RAT).


The version we found is slightly different — the driver isn’t digitally signed but instead utilizes a known exploit to bypass Windows Driver Signature Enforcement (DSE) protection and load the driver directly into the system.


We chose to call it “Pandora” based on the program database (PDB) path of the unpacked stage 2, which is “F:\Pandora\x\drv(32-64)\bin\src\drvx64.pdb.”


The rootkit has multiple stages before getting to the actual payload:


Stage 1  Grants system privileges via Windows services  Uses DLL sideloading technique to evade security solutions Starts and injects code to a new svchost process to prevent tracking  Stage 2  Utilizes a known vulnerability (CPU-Z CVE-2017-15303) that allows it to read and write into physical memory and read CPU control registers to turn the DSE off.


This is done in conjunction with the Process Monitor driver (procxp152.sys), both of which are dropped upon loading the rootkit, even if they are not originally installed in the machine.


Loads "drvx64.sys," a crafted Windows Presentation Foundation (WPF) driver  Stage 2 - Driver  Registers WPF callback and filters incoming traffic with a predefined token


Injects final payload into "lsass.exe"  Stage 3 - Final Payload  Installs itself as a Windows service


Sets a specific keyword for communication Exchanges messages and commands with the kernel driver Performs backdoor functions


Each backdoor has a different token that is encrypted in the registry.


If the incoming traffic contains a token and is in the HTTP format, the backdoor will intercept the traffic and process the command.


In the version that we’ve analyzed, the installer writes the token in the registry key.


We can’t trigger the backdoor without a current token, which makes the backdoor more difficult to find and analyze.


Sample  Token  Mutex  Semaphore  Pandora 20200310  FHHqw@nF4Jo0vPAU180IP5h9umnd4KFi  ENDnetfilter  234netfilter  Pandora 20201010  Qp$zo&FgPBjGhm(.LGi_&j~tmhMO08)  ENDdsfsfs  xwwadsfsfs   Table 3.


Pandora backdoor samples with different tokens Based on our analysis, the Pandora backdoor contains more public code repositories compared with previous versions.


Feature  Name  Repository  Driver memory injection  Blackbone  https://github.com/DarthTon/Blackbone  NDIS network filtering driver  WFP Sample  "WDK\Windows Filtering Platform Stream Edit Sample/C++/sys/stream_callout.c”


Parse HTTP packets  HTTP Parser  https://github.com/nodejs/http-parser


Turn off DSE  StryKer


Encrypted Communication   D3DES  https://gitlab.gnome.org/GNOME/gtk-vnc/-/blob/v0.1.0/src/d3des.c  Compression  QuickLZ  https://github.com/robottwo/quicklz   Table 4.


Pandora’s public code repositories Rootkits From a Public Repository


We found two different rootkits that are being used for hiding processes, files, and services.


Both of them were taken from a public Github repository whose authors are not associated with the threat actor.


Hidden.sys -  https://github.com/JKornev/hidden/tree/master/


The first sample was found in April 2020.


The driver was not signed and used the same DSE exploit that the Pandora backdoor uses for it to load.


The second sample was found in October 2020 and was signed by a legitimate certificate from Beijing Kingsoft Security Software Co., Ltd., a Chinese security software company.


The certificate has been valid since February 2020.


We have communicated with Kingsoft Corporation Limited regarding this issue and they have confirmed that as of writing, the certificate has already been voided.


Figure 3. Hidden.sys properties and digital signature details


The tool is used to hide the threat actors’ tools and services.


The tool’s configuration was added to registry run keys on a victim’s computer.


Hidden Registry/Folder/File  Type  Value  REG  HKLM\SYSTEM\CurrentControlSet\services\HiddenService  REG  HKLM\SYSTEM\CurrentControlSet\services\servTest  REG  HKLM\SYSTEM\CurrentControlSet\services\TrkWkss  Folder  C:\programdata\vlc  File  C:\programdata\vlc\vlc.exe  Folder  C:\programdata\test  File  C:\programdata\test\dlpumgr32.exe  File  C:\windows\system32\drivers\Hidden.sys  File  C:\windows\system32\HiddenService.exe   Table 5.


The tool’s configuration


The references to “Hidden” are related to the rootkit itself.


The “dlpumgr32.exe” and “servTest” lines are related to the new version of SysUpdate which we described earlier.


We do not know which malware variant is being sideloaded by vlc.exe.


It is probably installed as a service named “TrkWkss.”


We found a SysUpdate sample compiled in November 2020 that abuses a DLL sideloading vulnerability in VLC (see IOC list).


This confirms that this threat actor is abusing this legitimate program to sideload its backdoors.


HyperBro Malware Family


The Iron Tiger APT group has used the HyperBro malware family since at least 2017.


It is the evolved version of HttpBrowser, which the group has been using since at least 2015.


We found earlier versions of this malware that were sideloaded by malicious DLL files that unpacked and loaded a binary file named “thumb.db” in memory.


All the requests were sent to the C&C server on port 443, with “/ajax” as the uniform resource identifier (URI).


While investigating Operation DRBControl, we found an updated version of this malware family that implements some new classes.


We provided a detailed analysis of this new HyperBro version in our research.


We also discovered that the binary file that’s being unpacked and loaded in memory by malicious DLL files is named “thumb.dat.”


We also saw that all requests sent to the C&C server were sent to the URI “/api/v2/ajax” on port 443.


Since we analyzed that single sample, we found several new samples that matched the newer behavior, some of which have been deployed in our gambling target.


However, we continue seeing samples that feature the “older” behaviors, which suggests that different groups — or possibly subgroups of Iron Tiger — are using this malware family.


Some of these samples match the target and behavior listed by ESET in their blog.


FRP Tool


We found the FRP tool being used on a Linux host, which is similar to Avast’s findings in a report that they published on the Iron Tiger threat actor.


The FRP tool that we analyzed was a modified version, which was possibly copied off of Github.


Type 1 Malware Family


We found three new samples of the Type 1 malware family that abuses Dropbox as a secondary C&C channel, which we described in our Operation DRBControl whitepaper.


Apart from a modification in the malware sample’s configuration (which happened after we published our paper), the differences with the versions that we analyzed in 2019 are minor.


The version numbering was at 11.0, while the last sample we analyzed in August 2019 was at version number 9.0.


This shows that the development is still active.


On the infrastructure side, we observed that the threat actor switched from using IP addresses hosted on the Google Cloud Platform (GCP) to IP addresses hosted on Microsoft Azure.


It should be noted that after our blog publication in February 2020, the threat actor compiled new Type 1 malware samples using a new configuration, which prevented us from closely monitoring their operations.


We believe that this was a direct reaction to our research, suggesting that the threat actor read our investigation.


It’s also important to note that the compilation timestamp of the sideloaded DLLs were set a few months in advance.


For example, the binaries that we found in March and April 2020 had an August 26, 2020 compilation date.


This is consistent with the behavior that we noticed during Operation DRBControl, wherein some binaries that have been found in mid-2019 had a compilation date of March 4, 2020.


This shows that the threat actors intended to confuse forensics investigators with incorrect timestamps, which is why it’s critical to analyze timestamps with caution during investigations.


Infection Vector


We could not confirm the primary infection vector.


However, traces of the exploitation of the Microsoft Exchange vulnerability CVE-2020-0688 were found.


Multiple infection vectors have been attributed to this threat actor in the past:  Watering holes


Weaponized documents exploiting the Dynamic Data Exchange (DDE) method Weaponized documents exploiting the CVE-2018-0798 vulnerability in Equation Editor Exploitation of the CVE-2019-0604 vulnerability in Sharepoint Supply chain attack that compromises a chat software installer, Able Desktop Exploitation of recent vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) in Microsoft Exchange Server


During our investigation, we found some old samples that fit in these categories but have not been reported.


They are unrelated to this campaign and can be found in our IOC list.


Targets


The closer look into Iron Tiger was prompted because of an incident response investigation involving a Philippine-based gambling company that the group targeted.


True to form, the Iron Tiger threat actor has targeted the same company for 18 months.


Aside from targeting the same company, Iron Tiger also targeted other countries and industries.


Over the past 18 months, we observed how the group targeted governments, banks, telecommunication providers, and even the energy sector in the Middle East and Southeast Asia.


Figure 3.


The countries that Iron Tiger has targeted in the past 18 months     Timeline


The following timeline shows different samples found in the same gambling company that Talent-Jump and Trend Micro investigated:   July 2019: Operation DRBControl starts October 2019: One HyperBro malware sample found March 2020:


New sample of Type 1 malware variant and a rootkit called Pandora found April 2020: One rootkit sample for hiding files processes, files, and services found October 2020:


New HyperBro and Pandora samples found December 2020:


One sample of the SysUpdate malware variant found January 2021:


Fast Reverse Proxy (FRP) Linux tool found  Conclusion


This investigation provides more insight into the evolution of Iron Tiger’s toolkit and shows the threat actor’s persistence after targeting the same company for 18 months, as well as expanding its target base to include other companies and sectors in different countries in the Middle East and Southeast Asia.


We detailed how Iron Tiger threat actors have updated their tools, adding new features, and slightly changing their tactics, techniques, and procedures (TTPs), notably by using a rootkit to hide its backdoors.


The different campaigns with different versions of the same tools concurrently being used suggest that there might be subgroups for this threat actor, or multiple groups with access to the builders of these tools.


We expect to see more cases involving four or five files instead of the usual “trident” in the future.


The indicators of compromise (IoCs) can be found in this appendix.


Tags  APT & Targeted Attacks | Articles, News, Reports | Research


Updated June 18, 2018, 10:05 AM to add new IoC information from IssueMakersLab's July investigation.


We updated it again at 4:30 PM to add a link to IssueMakersLab's website and to add new IoC information.


This research is done in cooperation with IssueMakersLab of South Korea.


Reconnaissance plays a vital role in criminal operations, and some groups go to great lengths to investigate their targets' systems.


A recent example is the Andariel Group, a known branch of the notorious Lazarus Group.


Last month we tracked new scouting techniques coming from Andariel, which were used mainly against South Korean targets.


Andariel has been quite active these past few months.


According to South Korean security researchers IssueMakersLab, the group used an ActiveX zero-day exploit for watering hole attacks on South Korean websites last May—they called this “Operation GoldenAxe”.


But more recently on June 21, we noticed that Andariel injected their script into four other compromised South Korean websites for reconnaissance purposes.


We found that the code of the new injected script is similar to the sample Andariel previously used in May.


However, the new script was trying to collect different ActiveX object information and targeted objects that it wasn’t attacking before.


In the earlier case, the group collected targeted ActiveX objects on users’ Internet Explorer browser before they used the zero-day exploit.


This was possibly part of their reconnaissance strategy, to find the right targets for their exploit.


Based on this, we believe it's likely that the new targeted ActiveX objects we found could be their next targets for a watering hole exploit attack.


To help prevent any damage, we decided to publish our findings before the group deploys the attack.


Figure 1. Watering hole reconnaissance flow Analysis of the Andariel techniques


On June 21, we found that the website of a Korean non-profit organization was compromised with an injected script that collected visitors’ information.


We also found the same script on three South Korean local government labor union websites.


This reconnaissance lasted until 27 June.


We already notified the websites about the compromise.


We believe that the injected script came from the Andariel group since the code has similar obfuscation and structure to the sample we previously found from them.


The script was used to collect information from visitors’ browser: browser type, system language, Flash Player version, Silverlight version, and multiple ActiveX objects.


The original script is from the PluginDetect Library, and it was also used by exploit kits to verify victims before an attack.


The verification process included sending collected information to another compromised website that hosted their PHP program and was designed to receive the information.  Figure 2.


Compromised website injected with malicious script that collects information Our colleagues from the IssueMakersLab team shared insights and information about the Andariel group, including that they attacked ActiveX vulnerabilities as far back as 2007.


The team monitoring Andariel found that the cybercriminal group injected a malicious script on a South Korean think tank website for reconnaissance in January 2017 and then switched to inject an ActiveX zero-day exploit in mid-April.


IssueMakersLab also listed the ActiveX objects that the Andariel group attacked.


During analysis, we noticed that the new injected script was trying to detect two additional ActiveX objects that were not on the previous list.


One is “DSDOWNCTRL.DSDownCtrlCtrl.1”, which is related to a DRM (Digital Rights Management) software from a South Korean Document Protection Security vendor.


Another is “WSACTIVEBRIDGEAX.WSActiveBridgeAXCtrl.1”, which is related to a South Korea-based voice conversion software company.


Many local governments and public institutions use these software.


We made a table to compare the information that the script samples collected in the previous case and this more recent case.


Collected Information from Old Script Sample (May 2018)   Collected Information from New Script Sample (June 2018)


Parameter Meaning Parameter Meaning w Website name w Website name r <?=$referer?> value r <?=$referer?> value o OS version o OS version lv HTTP Accept-Language lv HTTP Accept-Language bt Browser Information bt Browser Information bv Browser Information bv Browser Information bdv Browser Information bdv Browser Information fv Flash Version fv Flash Version silv Silverlight Version silv Silverlight Version ez EasyPayPlugin ActiveX Availability ez EasyPayPlugin ActiveX Availability ac ACUBEFILECTRL ActiveX Availability* - - - - mg MagicLoaderX ActiveX Availability - - nv