Tag: ANDROID

The parasitic Water Labbu capitalizes on the social engineering schemes of other scammers, injecting malicious JavaScript code into their malicious decentralized application websites to steal cryptocurrency.

We discovered a threat actor we named Water Labbu that was targeting cryptocurrency scam websites. Typically, cryptocurrency scammers use social engineering techniques,  interacting with victims to gain their trust and then manipulating them into providing the permissions needed to transfer cryptocurrency assets.…

Read More

Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF.

This report details multiple campaigns conducted by the likely Chinese state-sponsored threat activity group TA413. The activity was identified through a combination of large-scale automated network traffic analytics and expert analysis.…

Read More
Scammers impersonating National Tax Agency to steal V-Preca Card details

During our routine threat-hunting exercise, Cyble Research & Intelligence Labs (CRIL) came across a Twitter post wherein a researcher mentioned a new phishing campaign imitating the page of the National Tax Agency, which targets Japanese users by tricking users into sharing sensitive information with Threat Actors (TAs).…

Read More

This post is also available in: 日本語 (Japanese)

Executive Summary

In early August, Unit 42 researchers discovered attacks leveraging several vulnerabilities in devices made by D-Link, a company that specializes in network and connectivity products. The vulnerabilities exploited include:

CVE-2015-2051: D-Link HNAP SOAPAction Header Command Execution Vulnerability CVE-2018-6530: D-Link SOAP Interface Remote Code Execution Vulnerability CVE-2022-26258: D-Link Remote Command Execution Vulnerability CVE-2022-28958: D-Link Remote Command Execution Vulnerability

If the devices are compromised, they will be fully controlled by attackers, who could utilize those devices to conduct further attacks such as distributed denial-of-service (DDoS) attacks.…

Read More

While conducting our routine threat hunting exercises, Cyble Research and Intelligence Labs (CRIL) came across instances of the PowerShell Empire command and control (C&C) infrastructure. The PowerShell Empire is a post-exploitation red teaming tool used for creating stagers that connect to C&C servers after an initial compromise through vectors such as phishing emails, exploiting public-facing IT systems, and watering hole attacks, etc.…

Read More

Earlier this year, [redacted] encountered a relatively new ransomware threat actor that called themselves BianLian. We observed the actor deploying custom malware that was written in the Go programming language, which posed some initial, but not insurmountable, reverse-engineering challenges. 

BianLian used subtle techniques to exploit, enumerate, and move laterally in victim networks to remain undetected and aggressively worked to counter Endpoint Detection & Response (EDR) protections during the encryption phase of their operations.…

Read More

Author:  Tomer Bar, VP Security Research, SafeBreach

SafeBreach Labs researchers are constantly monitoring the hacker underground, sourcing intelligence feeds, and conducting original research to uncover new threats and ensure our Hacker’s Playbook provides the most comprehensive collection of attacks. As part of this ongoing effort, we recently discovered a new targeted attack we believe is compelling for four main reasons: 

It appears to target Farsi-speaking code developers by using a Microsoft Word document that includes a Microsoft Dynamic Data Exchange (DDE) exploit.…
Read More

A malicious campaign spreading the information stealer, AgentTesla, began circulating mid-August. The bad actors behind the campaign are going after information about victims’ computers and login credentials stored in browsers.

Phishing emails, sent from spoofed email addresses, with a malicious attachment are being sent to businesses across South America and Europe.…

Read More

Recently, a simple and short email with a suspicious RTF attachment that had been sent to a telecommunications agency in South Asia caught the attention of FortiGuard Labs. The email was disguised as having come from a Pakistan government division and delivered the PivNoxy malware.

Affected Platforms: WindowsImpacted Parties: Windows usersImpact: Controls victim’s machine and collects sensitive informationSeverity Level: Medium

This blog describes how the attack works, suggests who the threat actor behind the operation might be, and details the techniques used by the attacker.…

Read More
Sophisticated XWorm RAT with Ransomware and HNVC Attack Capabilities

During a routine threat-hunting exercise, Cyble research labs discovered a dark web post where a malware developer was advertising a powerful Windows RAT.

Figure 1 – Dark Web Post for XWorm

This post redirected us to the website of the malware developer, where multiple malicious tools are being sold.…

Read More

We found APT group Iron Tiger’s malware compromising chat application Mimi’s servers in a supply chain attack.

We noticed a server hosting both a HyperBro sample and a malicious Mach-O executable named “rshell.” HyperBro is a malware family used by Iron Tiger (also known as Emissary Panda, APT27, Bronze Union, and Luckymouse), an advanced persistent threat (APT) group that has been performing cyberespionage for almost a decade, and there have been no reports of this group associated with a tool for Mac operating systems (OS).…

Read More

In this intrusion from April 2022, the threat actors used BumbleBee as the initial access vector.

BumbleBee is a malware loader that was first reported by Google Threat Analysis Group in March 2022. Google TAG attributes this malware to an initial access broker (IAB) dubbed EXOTIC LILY, working with the cybercrime group FIN12/WIZARD SPIDER/DEV-0193.…

Read More
Info Stealer Targeting Browsers and Crypto Wallets

The popularity of Cryptocurrency has increased exponentially over the recent years as dealing with crypto has become relatively hassle-free and more accessible. The financial returns of crypto investments have attracted many investors to invest in crypto markets.

As the demand for crypto investment has increased over the years, we can also see a corresponding rise in the number of crypto wallets.…

Read More

This post is also available in: 日本語 (Japanese)

Executive Summary

HelloXD is a ransomware family performing double extortion attacks that surfaced in November 2021. During our research we observed multiple variants impacting Windows and Linux systems. Unlike other ransomware groups, this ransomware family doesn’t have an active leak site; instead it prefers to direct the impacted victim to negotiations through TOX chat and onion-based messenger instances.…

Read More
Introduction

LuoYu is a lesser-known threat actor that has been active since 2008. It primarily goes after targets located in China, such as foreign diplomatic organizations established in the country, members of the academic community, or companies from the defense, logistics and telecommunications sectors. In their initial disclosures on this threat actor, TeamT5 identified three malware families: SpyDealer, Demsty and WinDealer.…

Read More
Введение Общие сведения Анализ ВПО и инструментов MyKLoadClient Схема 1 Схема 2 Тестовый образец Полезная нагрузка Zupdax Полезная нагрузка Связь с Redsip Связи с Winnti и FF-RAT Связи с Bronze Union и TA428 Загрузчики Downloader.Climax.A Downloader.Climax.B RtlShare Дроппер rtlstat.dll Инжектор rtlmake.dll Полезная нагрузка rtlmain.dll (rtlmainx64.dll) Использование RtlShare PlugX Demo dropper BH_A006 Стадия 0.…
Read More

Over the last several years, the Cybereason Nocturnus Team has been tracking different APT groups operating in the Middle East region, including two main sub-groups of the Hamas cyberwarfare division: Molerats and APT-C-23. Both groups are Arabic-speaking and politically-motivated that operate on behalf of Hamas, the Palestinian Islamic-fundamentalist movement and a terrorist organization that has controlled the Gaza strip since 2006.…

Read More

一、  事件概要

2022年2月，奇安信病毒响应中心移动安全团队关注到自2021年6月起至今，一个来自南亚某国背景的APT组织主要针对巴基斯坦军方展开了有组织、有计划、针对性的军事间谍情报活动。经过短短9个月的攻击，该组织已影响数十名巴基斯坦军方人员。这部分受害人员主要为巴基斯坦国家的边防军（FC）和特种部队（SSG），尤其是俾路支省边防军（FC BLN）；此外还包含少量的联邦调查局（FIA）和警察（Police）。另攻击还影响了少量的尼泊尔人员，但我国国内用户不受其影响。

图1.1 受影响的国家分布情况图

该组织通常使用公开的社交平台找到关注的目标后，结合色情话术等聊天诱导目标用户安装指定的诱饵聊天攻击应用进行钓鱼攻击。此外，攻击者还曾在国外某知名应用商店平台发布该恶意聊天应用，但目前相关链接已无法访问。 截至本报告发布之时，我们已经截获的该组织所有攻击活动，都是通过Android平台进行的，尚未发现任何通过Windows平台进行的攻击。累计捕获恶意应用下载服务器8个，服务器上至少可以下载到5个不同的Android平台攻击样本。所有样本均为含有恶意代码的专用聊天软件。我们将所有这些捕获的恶意样本命名为VajraSpy。 综合攻击活动特征、样本编码方式、C2服务器架构方式等多方面线索分析显示，该组织具有南亚某地区性大国政府背景，但又与该地区活跃的其他APT组织，如响尾蛇SideWinder、蔓灵花Bitter、肚脑虫Donot等没有显著关联（仅与肚脑虫Donot存在少量相似性），具有很强的独立性和独立特征。因此，我们判定该组织为活跃在南亚地区的新APT组织。我们将其命名为金刚象，英文名为VajraEleph，组织编号APT–Q–43。金刚象是奇安信独立发现并率先披露的第15个APT组织。 二、  载荷投递 通过奇安信病毒响应中心移动安全团队与奇安信威胁情报平台（https://ti.qianxin.com/） 的联合追踪分析发现，金刚象组织最早的活动可以追溯到2021年6月。下图为我们截获的该组织最早的载荷服务器信息。

图2.1 发现的最早域名载荷服务器相关截图（采用NameSilo注册商域名）

该组织早期的攻击，通常会将攻击载荷下载地址的的“短链接”，通过WhatsApp等社交软件发送给攻击目标。后期，随着各大社交平台对相关链接进行封禁，该组织转为将短链接以图片方式向目标人进行投递。

载荷短链地址

对应实际下载地址

https://cutt.ly/qIrgCKo

https://appz.live/ichfghbtt/crazy.apk

https://bit.ly/3BrCxNU

https://appzshare.digital/coufgtdjvi/ZongChat(Beta).apk

https://bit.ly/39roCMd

https://apzshare.club/poahbcyskdh/cable.apk

https://rebrand.ly/Cable_v2

https://appzshare.club/poahbcyskdh/cable.apk

表1 已发现的载荷投递短链及其对应的实际下载地址

该组织采用的载荷域名服务器注册时间均不到一年，注册商主要是NameSilo和NameCheap。这与近期在南亚活跃的另一个高级攻击组织肚脑虫的活动相似。

图2.2 部分域名载荷服务器whois情况

三、 攻击目标

金刚象组织具有明显的军事情报窃取意图，主要针对巴基斯坦军方人员，影响已涉及数种部队的数十名军方人员。以下是我们从攻击者C2服务器上截获的，部分受害者手机被窃取的照片和资料。

图3.1 巴基斯坦边防军（FC ，Frontier Corps）人员被窃照片

图3.2 巴基斯坦俾路支省边防军（ FC BLN ，FC Balochistan）人员被窃照片

图3.3 俾路支省边防军人员被窃资料

图3.4 巴基斯坦特种部队（SSG ，Special Service Group）人员被窃照片

图3.5 巴基斯坦警察被窃照片

图3.6 巴基斯坦警察被窃资料

图3.7 巴基斯坦联邦调查局（FIA，Federal Investigation Agency）人员被窃照片

图3.8 关于陆军参谋长（COAS，Chief of Army Staff）的被窃资料

四、 技术分析

通过分析发现，目前金刚象组织投入的攻击RAT针对的都是Android平台。分析显示，该组织的RAT定制化程度较高，我们将其命名为VajraSpy。VajraSpy支持间谍活动的所有经典功能，并将窃取到的数据存储到指定的谷歌云存储空间中。

功能

对应的窃取后数据存储文件名称

窃取通话记录

logs.json

窃取通讯录

contacts.json

窃取短信

sms.json

窃取SD卡指定目录15种类型文件

files/文件名

窃取通知栏信息

noti/13位时间戳.json…

Read More
Executive Summary Deep Instinct’s Threat Research team has found a new, undocumented malware developed in Golang The malware is attributed to APT-C-23 (Arid Viper) Further research revealed additional, previously unseen second-stage payloads New Malware Variant Discovery: Arid Gopher

Our Threat Research team maintains a vigilant watch over the cyber threat landscape, hunting for malware as a normal course of operations.…

Read More
Executive Summary Our research attributes a decade of activity to a threat actor we call ModifiedElephant. ModifiedElephant is responsible for targeted attacks on human rights activists, human rights defenders, academics, and lawyers across India with the objective of planting incriminating digital evidence. ModifiedElephant has been operating since at least 2012, and has repeatedly targeted specific individuals.…
Read More

Recently, we’ve been researching several threat actors operating in South Asia: Transparent Tribe, SideCopy, etc., that deploy a range of remote access trojans (RATs). After a hunting session in our malware sample repositories and VirusTotal while looking into these actors, we gathered a small collection of VBA code samples that eventually allowed us to connect certain IOCs to individual threat actors based on the final payload, victimology and submission locations.…

Read More
Introduction

In our previous article “Mobile banking fraud: BRATA strikes again” we’ve described how threat actors (TAs) leverage the Android banking trojan BRATA to perpetrate fraud via unauthorized wire transfers.

In this article, we are presenting further insights, on how BRATA is evolving in terms of both new targets and new features, such as:

Capability to perform the device factory reset: it appears that TAs are leveraging this feature to erase any trace, right after an unauthorized wire transfer attempt.…
Read More

We investigated the most recent activities of APT36, also known as Earth Karkaddan, a politically motivated advanced persistent threat (APT) group, and discuss its use of CapraRAT, an Android RAT with clear similarities in design to the group’s favored Windows malware, Crimson RAT.

APT36, also known as Earth Karkaddan, a politically motivated advanced persistent threat (APT) group, has historically targeted Indian military and diplomatic resources.…

Read More

Donot Team (also known as APT-C-35 and SectorE02) is a threat actor operating since at least 2016 and known for targeting organizations and individuals in South Asia with Windows and Android malware. A recent report by Amnesty International links the group’s malware to an Indian cybersecurity company that may be selling the spyware or offering a hackers-for-hire service to governments of the region.…

Read More

Authored by: Wenfeng Yu

McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter, Telegram and PUBG game accounts. This malware hides in a game assistant tool called “DesiEsp” which is an assistant tool for PUBG game available on GitHub.…

Read More

Recently, the McAfee Mobile Research Team uncovered several new variants of the Android malware family BRATA being distributed in Google Play, ironically posing as app security scanners.

These malicious apps urge users to update Chrome, WhatsApp, or a PDF reader, yet instead of updating the app in question, they take full control of the device by abusing accessibility services.…

Read More
Researchers from Palo Alto Networks, has confirmed that Taomike, a Chinese mobile advertising company, has been distributing a malicious Software Development Kit (SDK) that allows Android developers for implementing in-app purchases (IAPs) for Android apps. The SDK, which can be downloaded for free via Taomike, steals all messages on infected phones and sends them to the Taomike controlled server.…
Read More

(PC-google images) Bitdefender Security Researcher, Liviu Arsene has recently revealed that a malware, identified as Android.Trojan.MKero.A has found its way into the highly legitimate apps in Android powered Google Play Store by successfully evading the Google Bouncer’s vetting algorithms. This can cause a lot of trouble for the vendors who provide paid premium services of their products as the malware can now make the services available for free.…
Read More
Photo Courtesy: Dr. Web Security researchers from Doctor Web, Russian anti-virus software developer, have detected another new Android Trojan, which is said to be distributed among users from china to spy on their victims. Previously, the researchers had found an Android Trojan, which spreads as a security certificate that tricks users into thinking it must be installed onto users device.…
Read More

Fake virus alert is the technique used by the Cyber criminals to trick users into thinking their system have a virus then tell them to install or buy fake applications, sometimes redirect them to spam websites.

A New fake virus alert spotted by Malware Bytes team says users that their device infected by a dangerous virus created by Chinese Hackers.…

Read More