This post is also available in: 日本語 (Japanese)
Executive SummaryIn May 2021, Palo Alto Networks launched a proactive detector employing state-of-the-art methods to recognize malicious domains at the time …
Tag: SMS
Dubbed information stealer spotted stealing sensitive Data
Read More
Phishing sites are becoming an increasingly attractive target for Threat Actors (TAs) to lure victims into stealing sensitive information, and downloading other malware, …
Fake Windows Defender Alerts weaponized to target users
Read More
A tech support scam is an extensive fraud where the scammer offers a support service for any legitimate entity and lures the …
By Daksh Kapur · October 6, 2022
What is BazarCall?
As nicely defined in this article by Microsoft:
BazarCall campaigns forgo malicious links or attachments in email messages in favor …
Key Takeaways
Mexican digital rights organization R3D (Red en los Defensa de los Derechos Digitales) has identified Pegasus infections against journalists and a human rights defender taking place between 2019-2021.…
Read More
Executive Summary
The cyber mercenary group known as Void Balaur continues to expand their hack-for-hire campaigns into 2022 unphased by disruptions to their online advertising personas.
New targets include a…
Read More
Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF.
This report details multiple …
Application abuses Windows Defender Executable to perform DLL Sideloading
Read More
During a routine threat hunting exercise, Cyble Research and Intelligence Labs (CRIL) identified a fake Telegram website masquerading as a legitimate …
Scammers impersonating National Tax Agency to steal V-Preca Card details
Read More
During our routine threat-hunting exercise, Cyble Research & Intelligence Labs (CRIL) came across a Twitter post wherein a researcher mentioned …
While conducting our routine threat hunting exercises, Cyble Research and Intelligence Labs (CRIL) came across instances of the PowerShell Empire command and control (C&C) infrastructure. The PowerShell Empire is a …
Following the recent Twilio hack leading to the leakage of 2FA (OTP) codes, cybercriminals continue to upgrade their attack arsenal to orchestrate advanced phishing campaigns targeting users worldwide. Resecurity has …
Sophisticated XWorm RAT with Ransomware and HNVC Attack Capabilities
Read More
During a routine threat-hunting exercise, Cyble research labs discovered a dark web post where a malware developer was advertising a powerful …
We tracked the latest deployment of the group behind CopperStealer, this time stealing cryptocurrencies and users’ wallet account information via a malicious Chromium-based browser extension.
Update (8/12/2022 2:05AM EST): We …
Key points from our research:
Robin Banks is a phishing-as-a-service (PhaaS) platform, first seen in March 2022, selling ready-made phishing kits to cyber criminals aiming to gain access to the…
Key Findings
We discovered an extensive espionage campaign targeting Thai pro-democracy protesters, and activists calling for reforms to the monarchy.
We forensically confirmed that at least 30 individuals were infected…
Read More
During our routine threat hunting exercise, Cyble Research Labs came across a Twitter Post wherein the researcher mentioned an Android malware variant published on the Play Store. The variant in …
Introduction
Read More
Check Point Research uncovers a recent Iranian-based spear-phishing operation aimed against former Israeli officials, high-ranking military personnel, research fellows in research institutions, think tanks, and against Israeli citizens. The …
Photo by Sara Kurfeß on Unsplash
Read More
During the course of our work at Confiant, we see malicious activity on a daily basis. What matters the most for us is the …
Phishing has been a prominent cyber threat for decades, stealing the spotlight as the most prevalent attack vector for years, but the latest breed of attacks is more sophisticated and …
Over the last several years, the Cybereason Nocturnus Team has been tracking different APT groups operating in the Middle East region, including two main sub-groups of the Hamas cyberwarfare division: …
一、 事件概要
2022年2月，奇安信病毒响应中心移动安全团队关注到自2021年6月起至今，一个来自南亚某国背景的APT组织主要针对巴基斯坦军方展开了有组织、有计划、针对性的军事间谍情报活动。经过短短9个月的攻击，该组织已影响数十名巴基斯坦军方人员。这部分受害人员主要为巴基斯坦国家的边防军（FC）和特种部队（SSG），尤其是俾路支省边防军（FC BLN）；此外还包含少量的联邦调查局（FIA）和警察（Police）。另攻击还影响了少量的尼泊尔人员，但我国国内用户不受其影响。图1.1 受影响的国家分布情况图
该组织通常使用公开的社交平台找到关注的目标后，结合色情话术等聊天诱导目标用户安装指定的诱饵聊天攻击应用进行钓鱼攻击。此外，攻击者还曾在国外某知名应用商店平台发布该恶意聊天应用，但目前相关链接已无法访问。 截至本报告发布之时，我们已经截获的该组织所有攻击活动，都是通过Android平台进行的，尚未发现任何通过Windows平台进行的攻击。累计捕获恶意应用下载服务器8个，服务器上至少可以下载到5个不同的Android平台攻击样本。所有样本均为含有恶意代码的专用聊天软件。我们将所有这些捕获的恶意样本命名为VajraSpy。 综合攻击活动特征、样本编码方式、C2服务器架构方式等多方面线索分析显示，该组织具有南亚某地区性大国政府背景，但又与该地区活跃的其他APT组织，如响尾蛇SideWinder、蔓灵花Bitter、肚脑虫Donot等没有显著关联（仅与肚脑虫Donot存在少量相似性），具有很强的独立性和独立特征。因此，我们判定该组织为活跃在南亚地区的新APT组织。我们将其命名为金刚象，英文名为VajraEleph，组织编号APT–Q–43。金刚象是奇安信独立发现并率先披露的第15个APT组织。 二、 载荷投递 通过奇安信病毒响应中心移动安全团队与奇安信威胁情报平台（https://ti.qianxin.com/） 的联合追踪分析发现，金刚象组织最早的活动可以追溯到2021年6月。下图为我们截获的该组织最早的载荷服务器信息。图2.1 发现的最早域名载荷服务器相关截图（采用NameSilo注册商域名）
该组织早期的攻击，通常会将攻击载荷下载地址的的“短链接”，通过WhatsApp等社交软件发送给攻击目标。后期，随着各大社交平台对相关链接进行封禁，该组织转为将短链接以图片方式向目标人进行投递。载荷短链地址
对应实际下载地址
https://cutt.ly/qIrgCKo
https://appz.live/ichfghbtt/crazy.apk
https://bit.ly/3BrCxNU
https://appzshare.digital/coufgtdjvi/ZongChat(Beta).apk
https://bit.ly/39roCMd
https://apzshare.club/poahbcyskdh/cable.apk
https://rebrand.ly/Cable_v2
https://appzshare.club/poahbcyskdh/cable.apk
表1 已发现的载荷投递短链及其对应的实际下载地址
该组织采用的载荷域名服务器注册时间均不到一年，注册商主要是NameSilo和NameCheap。这与近期在南亚活跃的另一个高级攻击组织肚脑虫的活动相似。图2.2 部分域名载荷服务器whois情况
三、 攻击目标
金刚象组织具有明显的军事情报窃取意图，主要针对巴基斯坦军方人员，影响已涉及数种部队的数十名军方人员。以下是我们从攻击者C2服务器上截获的，部分受害者手机被窃取的照片和资料。图3.1 巴基斯坦边防军（FC ，Frontier Corps）人员被窃照片
图3.2 巴基斯坦俾路支省边防军（ FC BLN ，FC Balochistan）人员被窃照片
图3.3 俾路支省边防军人员被窃资料
图3.4 巴基斯坦特种部队（SSG ，Special Service Group）人员被窃照片
图3.5 巴基斯坦警察被窃照片…
Researchers from Palo Alto Networks, has confirmed that Taomike, a Chinese mobile advertising company, has been distributing a malicious Software Development Kit (SDK) that allows Android developers for implementing in-app…
Read More
If you are Android user and you have an app Talking Tom 3, Smart Touch, Privacy Lock then you should be vary.
FirmEye, a Security and cyber-attack firm tracked down …
(PC-google images)
Bitdefender Security Researcher, Liviu Arsene has recently revealed that a malware, identified as Android.Trojan.MKero.A has found its way into the highly legitimate apps in Android powered Google Play…
Read More
Photo Courtesy: Dr. Web
Security researchers from Doctor Web, Russian anti-virus software developer, have detected another new Android Trojan, which is said to be distributed among users from china to…
Read More