Author: Securonix

The BlackBerry Research & Intelligence and Incident Response (IR) teams have found evidence correlating attacks by the Initial Access Broker (IAB) group Prophet Spider with exploitation of the Log4j vulnerability in VMware Horizon. This article highlights the recent indicators of compromise (IoCs) that we’ve observed.

Defenders concerned that they may have been a victim of these attacks can make use of these IoCs and detection methods to identify evidence of compromise within their environment.…

Read More
Introduction

Chaes is a banking trojan that operates solely in Brazil and was first reported in November 2020 by Cybereason. In Q4 2021, Avast observed an increase in Chaes’ activities, with infection attempts detected from more than 66,605 of our Brazilian customers. In our investigation, we found the malware is distributed through many compromised websites, including highly credible sites.…

Read More

Morphisec, through its breach prevention with Moving Target Defense technology, has identified a new, sophisticated campaign delivery which has been successfully evading the radar of many security vendors. Through a simple email phishing tactic with an html attachment, threat attackers are delivering AsyncRAT (a remote access trojan) designed to remotely monitor and control its infected computers through a secure, encrypted connection.…

Read More
Introduction

In our previous article “Mobile banking fraud: BRATA strikes again” we’ve described how threat actors (TAs) leverage the Android banking trojan BRATA to perpetrate fraud via unauthorized wire transfers.

In this article, we are presenting further insights, on how BRATA is evolving in terms of both new targets and new features, such as:

Capability to perform the device factory reset: it appears that TAs are leveraging this feature to erase any trace, right after an unauthorized wire transfer attempt.…
Read More

概述

奇安信红雨滴团队持续关注全球APT组织的攻击活动，其中包括海莲花（OceanLotus）APT组织。近期国外厂商Netskope发布了一篇关于mht格式文件（Web归档文件）通过携带的Office宏植入恶意软件的分析报告[1]，因为其中提及的样本采用的攻击手法与海莲花组织存在相似之处，报告认为此次攻击活动是海莲花组织所为。

经过红雨滴团队研究人员对此类样本的深入分析，发现攻击流程中也存在着一些不同于海莲花过往攻击活动的特点，因此不排除其他攻击团伙模仿海莲花的可能性。基于现有的公开信息，暂时还不能确定此次攻击活动背后团伙的具体身份。此外，我们注意到此类样本利用Glitch平台下发后续恶意软件，进一步发现它们与奇安信威胁情报中心去年12月披露的攻击样本[2]一脉相承。

本文将深入分析此次攻击活动涉及的样本，梳理与之关联的其他攻击活动，并与海莲花组织历史攻击手法进行比较，总结攻击活动中相似的地方以及独有的特征。此类攻击样本具有如下特点：

1. 宏代码会根据系统版本释放32位或64位恶意DLL，释放恶意DLL时会插入一段随机数据;

2. 宏代码和恶意DLL均进行了代码混淆；

3. 恶意DLL将收集的信息回传给Glitch平台托管的C2服务，然后下载经过7z压缩的后续恶意软件并执行。

样本信息

收集到的攻击样本信息如下

MD5

文件类型

文件名

0ee738b3837bebb5ce93be890a196d3e

RAR

HS.rar

11d36c3b57d63ed9e2e91495dcda3655

RAR

Tai_lieu.rar

204cb61fce8fc4ac912dcb3bcef910ad

RAR

TL-3525.rar

a7a30d88c84ff7abe373fa41c9f52422

RAR

Note.rar

b1475bdbe04659e62f3c94bfb4571394

RAR

CV.rar

b2eb3785e26c5f064b7d0c58bdd3abe0

RAR

List Product.rar

d8fa458192539d848ee7bb171ebed6bd

RAR

GiftProducts.rar

e7ce1874ab781c7a14019b6a6e206749

RAR

PaymentRequest.rar

eb6cf9da476c821f4871905547e6a2b4

RAR

DeliveryInformation.rar

f5ea39b70f747e34ae024308298f70ac

RAR

Document.rar…

Read More

We investigated the most recent activities of APT36, also known as Earth Karkaddan, a politically motivated advanced persistent threat (APT) group, and discuss its use of CapraRAT, an Android RAT with clear similarities in design to the group’s favored Windows malware, Crimson RAT.

APT36, also known as Earth Karkaddan, a politically motivated advanced persistent threat (APT) group, has historically targeted Indian military and diplomatic resources.…

Read More

TrickBot Bolsters Layered Defenses to Prevent Injection Research

Limor Kessem and Charlotte Hammond.

The cyber crime gang that operates the TrickBot Trojan, as well as other malware and ransomware attacks, has been escalating activity. As part of that escalation, malware injections have been fitted with added protection to keep researchers out and get through security controls.…

Read More

We found waves of Emotet spam campaigns using unconventional IP addresses to evade detection.

We observed Emotet spam campaigns using hexadecimal and octal representations of IP addresses, likely to evade detection via pattern matching. Both routines use social engineering techniques to trick users into enabling document macros and automate malware execution.…

Read More
Key Findings  Proofpoint identified a malware packer which researchers have dubbed DTPacker.  The payload decoding uses a fixed password containing former U.S. president Donald Trump’s name.   For several weeks the downloader variant used Liverpool Football Club themed download locations.  The malware is typically used to pack remote access trojans that can be used to steal information and load follow-on payloads such as ransomware.  …
Read More

01/13/2022

Executive Summary

Recorded Future analysts continue to monitor the activities of the FIN7 group as they adapt and expand their cybercrime operations. Gemini has conducted a more in-depth investigation into these types of attack after a Gemini source provided analysts with the file “sketch_jul31a.ino”, which was linked to FIN7’s BadUSB attacks.…

Read More
Introduction

In December 2021, the ThreatLabz research team identified several macro-based MS office files uploaded from Middle Eastern countries such as Jordan to OSINT sources such as VT. These files contained decoy themes related to geo-political conflicts between Israel and Palestine. Such themes have been used in previous attack campaigns waged by the Molerats APT.…

Read More

Donot Team (also known as APT-C-35 and SectorE02) is a threat actor operating since at least 2016 and known for targeting organizations and individuals in South Asia with Windows and Android malware. A recent report by Amnesty International links the group’s malware to an Indian cybersecurity company that may be selling the spyware or offering a hackers-for-hire service to governments of the region.…

Read More

In 2021, Kaspersky ICS CERT experts noticed a growing number of anomalous spyware attacks infecting ICS computers across the globe.

Although the malware used in these attacks belongs to well-known commodity spyware families, these attacks stand out from the mainstream due to a very limited number of targets in each attack and a very short lifetime of each malicious sample.…

Read More