Brad Hawkins, Author at Safernet

Solarwinds Cybercrime Gang Used 4 New Malware Strains in USAID Phishing Campaign

Post On: 28 August, 2021 By : Brad Hawkins

Malware research teams at Microsoft are on high alert this month, as it was revealed that a Russian hacking gang used four new malware strains in a recent phishing campaign in which they impersonated the United States Agency for International Development (USAID). Last week the Microsoft Threat Intelligence Center (MSTIC) reported that the group APT29, also known as Nobelium, had breached USAIDs’ Constant Contact account. With a legitimate account under their control, Nobelium could impersonate USAID flawlessly and engage in a phishing campaign that aimed to deliver malware to targets.

The phishing campaign involved sending emails to over 3,000 email accounts at more than 150 different organizations, including government agencies and organizations devoted to international development, humanitarian, and human rights work.

“This week we observed cyberattacks by the threat actor Nobelium targeting government agencies, think tanks, consultants, and non-governmental organizations. This wave of attacks targeted approximately 3,000 email accounts at more than 150 different organizations. While organizations in the United States received the largest share of attacks, targeted victims span at least 24 countries. At least a quarter of the targeted organizations were involved in international development, humanitarian, and human rights work.” the report said.

Microsoft also identified Nobelium in the report, the group behind last year’s SolarWinds attack.

“Nobelium, originating from Russia, is the same actor behind the attacks on SolarWinds customers in 2020. These attacks appear to be a continuation of multiple efforts by Nobelium to target government agencies involved in foreign policy as part of intelligence gathering efforts.”

Phishing Email From the USAID Constant Contact Account

Following the initial report, the MSTIC issued an additional report concerning the types of malware payloads involved in the campaign.

The four new malware strains include an HTML attachment named ‘EnvyScout‘, a downloader known as ‘BoomBox,’ a loader known as ‘NativeZone‘, and a shellcode downloader and launcher named ‘VaporRage.’

“The actor was able to distribute phishing emails that looked authentic but included a link that, when clicked, inserted a malicious file used to distribute a backdoor we call NativeZone.” the report stated.

Analysis of the 4 Malware Strains

Note: The Malware strains were analysed by the Microsoft Threat Intelligence Center (MSTIC) and BleepingComputer.

EnvyScout

NV.html, tracked by Microsoft as EnvyScout, can be best described as a malicious dropper capable of de-obfuscating and writing a malicious ISO file to disk. EnvyScout is chiefly delivered to targets of NOBELIUM by way of an attachment to spear-phishing emails.

Distributed as a file named NV.html, when opened, the HTML file will attempt to load an image from a file:// URL. When doing this, Windows may send the logged-in user’s Windows NTLM credentials to the remote site, which attackers can capture and brute-force to reveal the plain text password.

Microsoft states that the attachment is also used to convert an embedded text blob into a malicious ISO saved as NV.img to the local file system.

BoomBox

BOOM, tracked by Microsoft as “BoomBox”, can be best described as a malicious downloader. The downloader is responsible for downloading and executing the next-stage components of the infection. These components are downloaded from Dropbox (using a hardcoded Dropbox Bearer/Access token).

When executed, BoomBox ensures that a directory named NV is present in its current working directory; otherwise it terminates. If the directory is present, BoomBox displays the contents of the NV directory in a new Windows Explorer window (leaving it up to the user to open the PDF file).

After decrypting the downloaded files, BoomBox will save them as %AppData% MicrosoftNativeCacheNativeCacheSvc.dll and %AppData%SystemCertificatesCertPKIProvider.dll, and execute them using rundll32.exe.

NativeCacheSvc.dll is configured to launch automatically when a user logs into Windows and is used to launch CertPKIProvider.dll.

As a final stage, the BoomBox malware will gather information about the Windows domain, encrypts the collected data, and then sends it to a remote server under the attacker’s control.

“As the final reconnaissance step, if the system is domain-joined, BoomBox executes an LDAP query to gather data such as distinguished name, SAM account name, email, and display name of all domain users via the filter (&(objectClass=user)(objectCategory=person)),” Microsoft explains.

NativeZone

NativeCacheSvc.dll, tracked by Microsoft as “NativeZone” can best be described as a malicious loader responsible for utilizing rundll32.exe to load the malicious downloader component CertPKIProvider.dll.

The malicious functionality of NativeCacheSvc.dll is located inside a DLL export named configNativeCache.

As shown above, the export function executes rundll32.exe to load %AppData%\SystemCertificates\Lib\CertPKIProvider.dll by calling its export function named eglGetConfigs.

VaporRage

CertPKIProvider.dll, tracked by Microsoft as “VaporRage” can best be described as a shellcode downloader. This version of VaporRage contains 11 export functions including eglGetConfigs, which houses the malicious functionality of the DLL.

When launched, the malware will connect back to a remote command and control server, where it will register itself with the attackers and then repeatedly connect back to the remote site for a shellcode to download.

When shellcodes are downloaded, the malware will execute them to perform various malicious activities, including the deployment of Cobalt Strike beacons.

Protection

With regards to protection against Phishing attacks, here at SaferNet we often recommend that businesses and families educate their members on how to spot fraudulent emails. These 4 new Malware strains highlight a different scenario however – The email comes from a trusted account, which makes it much more difficult to discern. In times like these, it is important to have a tool that can tell the difference for you, like SaferNet.

SaferNet is the perfect solution to the cybersecurity issues that individuals, families, and businesses face today. It not only connects every device using a secure, 24/7 always on, military grade VPN, but it also stops outside cyberthreats, malware and viruses as well. On SaferNet, all users are protected anywhere in the world, all the time, on any cellular or Wi-Fi network. In addition to SaferNet’s VPN and cyber protection, it also offers a range of employee or parental/family internet controls including internet filtering, monitoring, scheduling, and blocking access to websites or even entire website categories

Typically, a business or family would need 3 separate services for a VPN, Malware Protection, and Internet Controls; SaferNet offers all 3 features in one service. SaferNet truly is an endpoint security presence that can be implemented in minutes around the world, on phones, laptops, tablets, and computers at an economical price point that caters to all sizes of businesses and families. SaferNet guarantees a smooth setup and installation process that takes only minutes, and an easily accessible control hub for you to monitor all your employee’s or family members devices; including activity, time spent online, and threats blocked.

BazaLoader Malware Hides in Bogus Movie-Streaming Site

Post On: 28 August, 2021 By : Brad Hawkins

BazaLoader Malware continues to find novel attack vectors in 2021, following on from call-center attacks covered earlier this year by SaferNet. BazaLoaders’ most recent offering comes in the form of a fake movie-streaming service called BravoMovies, with some questionable movies available. The site makes use of flashy graphics and interesting movie titles, but all that is available to download if BazaLoader

BazaLoader is a loader used to deploy ransomware or other malware types and steal sensitive data from victimized systems. Proofpoint has conducted the majority of research on BazaLoader, including with regards to the latest attack.

Multiple threat actors use the downloader, which is written in C++, to load malware such as Ryuk and Conti ransomware. Proofpoint researchers said they’re confident that there’s a “strong overlap” between the distribution and post-exploitation activity of BazaLoader and the threat actors behind The Trick malware, also known as Trickbot.

The BravoMovies campaign uses an elaborate infection chain that’s in keeping with BazaLoader affiliates, who coax their victims into jumping through several hoops to trigger the malware payloads. It starts with an email telling recipients that their credit cards will be charged unless they cancel their subscription to the service – a subscription that they never signed up for, of course.

BravoMovies infection chain – Similar to the call center attacks

Some of the subject headers used to bait the trap:

Your trial period M0012064753012345 is going to be expired soon. Thankfully you made a decision to stick with us!
Demo stage is expired! Your account #M0272028060812345 will be automatically transferred to premium plan!

The email includes a phone number for the customer service line. This directs to the call center that has live humans standing by, reading to participate in the scheme. The apparent purpose of the call is to cancel the victim’s subscription to the bogus movie site. The site directs those who fall for the con to instead download a boobytrapped Excel spreadsheet that will spring macros that download BazaLoader.

The fake movie-streaming service looks just like a legitimate movie and TV streaming service, complete with fake movie titles as a landing page. In fact, the threat actors jerry-rigged fake posters. “The threat actors used fake movie posters obtained from various open-source resources including an advertising agency, the creative social network Behance, and the book ‘How to Steal a Dog’”, researchers said.

Proofpoint researchers wrote that BravoMovies has the charade down pat. The fake movie-streaming service looks just like a legitimate movie and TV streaming service, complete with fake movie titles as a landing page. In fact, the threat actors jerry-rigged fake posters. “The threat actors used fake movie posters obtained from various open-source resources including an advertising agency, the creative social network Behance, and the book ‘How to Steal a Dog’”, researchers said.

The call-center operators tell their targets to visit the BravoMovies site, to pull up the Frequently Asked Questions page and to follow the directions to unsubscribe via the “Subscribtion” page. Next, they’ll be instructed to download an Excel Sheet.

The Excel sheet contains the macros that will download BazaLoader if enabled. Proofpoint researchers haven’t yet observed the second-stage payload in this campaign, they said.

Sherrod DeGrippo, senior director of threat research and detection for Proofpoint, stated that for now, the BazaLoader threat actors are the most active when it comes to using call centers as part of an attack chain. “We have also observed The Trick [also known as Trickbot] delivered by similar campaigns,” she said via email. “Phone-based threats like “tech support scams” have existed for a few years, but these threats are separate from what we’re seeing in our data. It’s a novel way of inserting a different threat vector into the attack chain.”

It’s relatively new activity for the BazaLoader threat actors, DeGrippo continued: She described the method an emerging threat that’s become more prevalent since January 2021.

Proofpoint researchers first observed the BravoMovies campaign earlier this month. They noted that its complicated nature is successful in a counterintuitive way. Namely, this campaign “demonstrates an inversely proportional relationship between successful infection rates and asking people to complete complicated steps – the more steps required by the user, the less likely they are to complete the attack chain,” they explained. “However, despite being counterintuitive, the techniques used by the threat actors in this, and similar, campaigns help bypass fully automated threat detection systems.”

Proofpoint is forecasting that the threat actors behind BazaLoader and Trickbot will keep using these carefully crafted techniques in the future.

BazarLoader Malware Analysis

BazarLoader has been analysed in depth by cybersecurity researchers at AT&T Cybersecurity department.

The BazarLoader authors have produced an advanced module, with a significant amount of obfuscation. The BazarLoader uses multiple routines to hide API calls and embedded strings, which are then decrypted and resolved at runtime.

Once executed, the loader will allocate memory to store and decrypt its shellcode, which will be allocated to a NUMA node for faster execution. After allocation and decryption, the next instructions will jump to the shellcode that will be executed on the heap.

Next, BazaLoader will try to communicate with .bazar domain C2 servers. Once the C2 has been established, the loader will try to inject its payload into a system process using the process hollowing technique (T1093), which will create a suspended thread, unmap the destination image from memory, allocate new memory in the target process, copy the shellcode into the target process, set the thread context, and resume the process.

The malware uses the Windows API “VirtualAllocExNuma” function to allocate memory for its shellcode to be executed. The “VirtualAllocExNuma” function is used to allocate memory on a NUMA node, which allows for faster execution. The implementation can be seen In Figure 1 below. It is interesting to note that the “VirtualAllocExNuma” function is not commonly used in process injection.

API Resolution and Shellcode Decryption Routines

The BazarLoader authors have created dozens of decryption routines, and with almost each string including APIs, DLLs, and C2s there is a once per use unique decryption routine. The loader uses the same decryption technique described above to resolve the API calls it uses during execution.

For injection, the malware resolves APIs from the ntdll.dll after it loads from disk and checks that there are no inline hooks within its function, that could be created for example by AV software that tracks those API calls.

The load order of APIs called in the injection procedure is:

CreateProcessA (CREATE_SUSPENDED | CREATE_NEW_CONSOLE)
NtGetContextThread
NtReadVirtualMemory
NtUnmapViewOfSection
VirtualAllocExA
NtWriteVirtualMemory
NtSetContextThread
NtResumeThread

he obfuscated C2 servers are decrypted in the function shown below:

C2 Domains forgame[.]bazar and bestgame[.]bazar

Protection

Education is also the key to defense against attacks like these. Outwitting social engineering attempts is the only guaranteed way not to fall victim to campaigns like BazarLoader. For times when a dupe may be unclear, it’s important to have the tools necessary to back you up. One of these tools is SaferNet.

StrRAT Fake Ransomware RAT Proliferates Via Email

Post On: 28 August, 2021 By : Brad Hawkins

StrRAT has been discovered by Microsoft Security, embedded within malicious PDFs which download the Java-based Malware. StrRAT can steal credentials and change file names, though in reality, it doesn’t encrypt these files. Due to StrRAT being a Remote-Access-Trojan(RAT), it has the capabilities to take control of a system. What makes the strain unusual is its habit of presenting itself as Ransomware, when it has no such ability. The Microsoft Security Intelligence (MSI) team has outlined details of a “massive email campaign” delivering the StrRAT malware that they observed last week and reported in a series of tweets earlier this week.

“StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and takes remote control of infected systems—all typical behaviors of RATs” MSI researchers described in documentation posted on GitHub about the malware. The RAT also has a module to download an additional payload onto the infected machine based on command-and-control (C2) server command, they said.

StrRAT’s unique feature is that it boasts a “ransomware encryption/decryption module” that changes filenames in a way that would suggest that encryption is the next step. StrRAT appends the file name extension .crimson, but it does not actually encrypt the files.

To launch the campaign, attackers used compromised email accounts to send several different emails. Some of the messages use the subject line “Outgoing Payments.” Others refer to a specific payment supposedly made by the “Accounts Payable Department,” which is how the emails are signed.

The campaign includes several different emails that all use social engineering around payment receipts to encourage people to click on an attached file that appears to be a PDF but that actually has malicious intent.

One email informs the recipient that it includes an “Outgoing Payment” with a specific number – presumably, the attached PDF. Another addresses the message to a “Supplier” and appears to let the receiver know that “your payment has been released as per attached payment advice,” asking the recipient to verify adjustments made in the attached PDF.

In all of these cases, the attached file is not a PDF but instead connects to a malicious domain to download StrRAT. It then connects to the C2 server.

The version of the RAT that researchers observed was 1.5, which is “notably more obfuscated and modular than previous versions,” according to one of the tweets. However, it maintains the same backdoor functions as previous versions of StrRAT that researchers have observed. These include collecting browser passwords, running remote commands and PowerShell, and logging keystrokes, among others.

StrRAT Analysis

Note: The analysis for StrRAT has been carried out by Gdata Software.

The infection starts with a rather ordinary spam email that has a malicious attachment named NEW ORDER.jar.

The Email shows a relationship to the Jar file. It is not clear if the uploader of the email redacted the email body or if the threat actors didn’t want to take their time to add any content. It should be noted that Outlook prevents access to email attachments with .jar extension. In this case, researchers applied a registry change to display it.

The NEW ORDER.jar is a simple dropper. It retrieves a VBScriptfrom the resources, saves the script as bqhoonmpho.vbs to the home directory of the user and executes it using wscript.exe.

The VBScript has a large string in it and uses PowerShell to replace characters in this string. The resulting base64 string is subsequently decoded and executed by PowerShell.

The unpacked layer is again a VBScript. This script will copy the packed version of itself to %APPDATA%\edeKbMYRtr.vbs. It will also download a Java Runtime Environment and add it to the registry. That way it may be prepared to infect systems that don’t have Java installed. It even has a built-in check that runs javaw.exe with the -version parameter to verify that the JRE has the version 1.6, 1.7 or 1.8.

The email attachment already requires a Java Runtime Environment (JRE) on the system, which means the current infection chain misses the opportunity to work regardless of the JRE installation. If this VBScript is ever shipped with a different initial infection step, it may enable the RAT to work on more systems.

The RAT has a focus on stealing credentials of browsers and email clients, and passwords via keylogging. It supports the following browsers and email clients: Firefox, Internet Explorer, Chrome, Foxmail, Outlook, Thunderbird.

STRRAT also allows installation of RDPWrap. The file is downloaded from hxxp://wshsoft.company/multrdp(.)jpg. RDWrap is an open source tool that enables Remote Desktop Host support on Windows.

There is also a ransomware module.

The commands used for the ransomware component are rw-encrypt for “encrypting” files, rw-decrypt for “decrypting” files and show-msg for displaying the ransom note.

Ransomware “encrytion” and “decryption” methods are in the class strpayload.l.

However, the so called “encryption” only renames files by appending the .crimson extension. This might still work for extortion because such files cannot be opened anymore by double-clicking. Windows associates the correct program to open files via their extension. If the extension is removed, the files can be opened as usual.

There is no ransom note template in the client of the RAT. The attacker can display anything they like with the show-msg command. It is possible that the server provides ransom note templates.

Protection

StrRAT is yet another attack that relies on phishing and social engineering to succeed. The first line of defense against these attacks is education – learning how to spot fakes. These attacks are becoming more and more common, and it is important that business leaders and home owners use the right tools to protect themselves from evolving threats. One of these tools is SaferNet.

Insurance Firm AXA Crippled By Avaddon Ransomware Days After Ceasing Ransomware Insurance

Post On: 28 August, 2021 By : Brad Hawkins

Avaddon Ransomware has taken down several branches of insurance giant AXA. Branches in Thailand, Malaysia, Hong Kong, and the Philippines have fallen victim to the ransomware strain which has been stealing headlines in May. The Avaddon Ransomware group has claimed on their Dark Web leak site that they have stolen 3TB worth of sensitive data from AXA’s operations in Asia. Furthermore, the Avaddon Ransomware hackers are conducting an ongoing DDOS campaign against AXA’s global websites, making them inaccessible. Presumably, this will continue until the ransom is paid or the hackers otherwise stop their attacks.

Axa.com.hk still inaccessible days after the initial attack

There is a sense of irony in AXA getting hit – Less than a week before the attack, AXA stated that they would be dropping reimbursement for ransomware extortion payments when underwriting cyber-insurance policies in France.

The Avaddon ransomware gang first announced in January 2021 that they will launch DDoS attacks to take down victims’ sites or networks until they reach out and begin negotiating to pay the ransom.

The Avaddon gang also threatened AXA that the insurance company had about ten days to communicate and cooperate with them, after which they would leak AXA’s valuable documents.

The company has hired a forensic team to investigate the incident and said it notified business partners as well as regulators while it prepares to support all of the clients who may have been impacted.

The group claims to have obtained 3 TB of data belonging to AXA including:

customer medical reports (including those containing sexual health diagnosis)
customer claims
payments to customers
customers’ bank account scanned documents
material restricted to hospitals and doctors (private fraud investigations, agreements, denied reimbursements, contracts)
Identification documents such as National ID cards, passports, etc.

Avaddon is a Ransomware as a Service (RaaS) operation that asks affiliates to follow certain rules and pays each one of them with 65% of the ransom payments they bring in, with the operators getting a 35% share.

Avaddon are actively leaking documents until the ransom is paid, as seen by passport leaks on their website.

The Avaddon ransomware gang follows the same MO as other ransomware groups such as breaching the security of its target, exfiltrating data and locking the files on the victim’s system, and demand ransom payment for a decryption key.

Avaddon ransomware samples were first found and identified in February 2019, with Avaddon starting the recruitment of affiliates in June 2020 after the launch of a massive spam campaign that was targeting users worldwide.

The attacks comes days after SaferNet reported on a warning from the Federal Bureau of Investigation (FBI) and the Australian Cyber Security Centre (ACSC) on global attack campaign being carried out by the gang.

Ransomware attacks on organizations continue to grow and cause disruptions for many with attackers demanding exorbitant ransom payments.

AXA has not yet commented on the ransom amount demanded by the Avaddon Ransomware gang.

Avaddon Ransomware Analysis

The analysis of Avaddon Ransomware was provided by TrendMicro.

Avaddon Ransomware was initially detected as Ransom.Win32.AVADDON.YJAF-A. A trojan (detected as Trojan.JS.AVADDON.YJAF-A) downloads the ransomware from malicious sites and runs them on the system. This has been reported in a series of twitter posts by TMMalAnalyst.

The ransomware is propagated through emails with an attachment named IMG{6 random number}.jpg.js.zip that contains a JavaScript file named IMG{6 random number}.jpg.js.

As seen in the preceding figure, the email body contains a single smiley. The emails for the Avaddon campaign also follow the footsteps of past malware campaigns that use particular subjects to spark the curiosity of the users, thus prompting them to open the message and download the attachment. Most of these emails have photo-related subjects, which might be particularly enticing for users at a time when gadgets with built-in cameras have now become widely available. These subjects include “Look at this photo!”, “You look good here”, “Is this you?” and similar enticing lines.

After the attachment is downloaded and ran, it uses a PowerShell command and the BITSAdmin command-line tool to download and run the ransomware payload. After this, the affected users will see that the ransomware has encrypted the files and appended them with the .avdn file extension. Users will see that their system desktop’s wallpaper has been automatically changed to an image that states that “all your files have been encrypted” and refers to the ransom note: “Instruction 270015-readme.html” (following the {Encrypted Directory}{random numbers}-readme.html format).

The ransom note gives instructions on how the affected user can recover the encrypted files.

This ransomware encrypts files found in the following folders:

Program Files\Microsoft\Exchange Server
Program Files (x86)\Microsoft\Exchange Server
Program Files\Microsoft SQL Server
Program Files (x86)\Microsoft SQL Server

It adds the following processes that deletes backup copies of the system, making it difficult to restore:

wmic.exe SHADOWCOPY /nointeractive
wbadmin DELETE SYSTEMSTATEBACKUP
wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
bcdedit.exe /set {default} recoveryenabled No
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
vssadmin.exe Delete Shadows /All /Quiet

It terminates services and processes, many of which are related to scanning, storing and retrieving files, and scheduling tasks.

Protection

The attack vector for Avaddon Ransomware is extremely common – A phishing email intended to trick the user into opening a file. It is important that business owners and family’s exercise caution when it comes to opening emails from unknown senders, and that employees and family members are educated to understand the risks of cybersecurity.

Sometimes phishing emails will be successful, no matter how well the human is trained to spot them. To avoid falling into this trap, use SaferNet.

Tulsa City Services Taken Down by Ransomware Attack

Post On: 28 August, 2021 By : Brad Hawkins

The city of Tusla, Oklahoma, has undergone a ransomware infection that has forced the city to take critical services offline to protect them from the spreading virus. The attack occurred last weekend when hackers deployed a ransomware attack on the city’s network which led to a disruption of services and the decision to take further services offline. “We identified malware on our servers, and as soon as we did that, in an abundance of caution, we shut all of our systems down.” Tulsa Mayor GT Bynum told local media KRMG in an interview. The incident did not affect 911 services, and many employees are back to work.

However, the shutdown is affecting the day-to-day lives of Tusla citizens still, days later. Residents are unable to access the online bill payment system to pay their utility bills. Animal welfare, park services, and development services are also offline. The Tusla City Fire Service is using temporary numbers during the outage. Websites for the City of Tulsa, the Tulsa City Council, Tulsa Police, and the Tulsa 311 websites are also down for maintenance.

The phone systems are currently up and running, which is currently the only way to conduct business with the City.

In a Facebook post, the police department stated that customer information was not compromised. This statement is uncertain – The majority of ransomware operations steal data before deploying the malware, so some data may have been compromised.

“The City of Tulsa is experiencing technical difficulties on many outward facing programs that help serve the citizens of Tulsa due to a ransomware attack. No customer information has been comprised, but residents will not be able to access City websites and there will be delays in network services,” says a post to the Tulsa Police Department’s Facebook page.

To help combat the increasing threat of ransomware, a Ransomware Task Force has been created to analyze the problem and provide recommended solutions to lawmakers.

These solutions range from mandatory disclosure of ransom payments to an internationally coordinated effort to help organizations prevent and respond to ransomware attacks.

Ransomware Attacks On Infrastructure & Cities

Attacks on critical infrastructure have also become a significant concern in light of last week’s cyberattack on the largest US fuel pipeline by the DarkSide ransomware gang. However, Tusla has become yet another city that has been targeted by malware.

“It’s apparently the city of Tulsa’s turn. Essentially, they’ve settled on a playbook that seems to work” Tyler Moore, Tandy Professor of Cyber Security at the University of Tulsa, said.

Moore said ransomware has been around for more than a decade and these attacks tend to come from Eastern Europe and Russia.

“When Bitcoin came along, they found an easy way to actually monetize that and target, you know, random cities in America,” Moore said.

Ransomware gangs scan thousands of computer networks at any given time, searching for vulnerabilities. The malware could spread by clicking on an email, but Moore said more often than not, attackers capitalize on a weakness.

“It’s actually kind of scary, but the victims are selected by their willingness to pay,” Moore said.

He said cities are targeted because many are insured. The list of attacks is growing from Baltimore to Atlanta, and even smaller towns like Okema a few months back. Victims have a decision to make: to pay or not to pay. Something that would’ve cost thousands four or five years ago, may cost hundreds of thousands today. Moore said most of the time it’s paid, especially if the data is super sensitive.

“That just encourages the gangs to go target the next group,” Moore said.

Moore said the problem is preventable.

“Invest in cyber hygiene, ensure that software’s up to date, you have adequate backups, that your backups are kept offline,” Moore said.

Moore said it’s an encouraging sign the City of Tulsa took several computer systems offline, suggesting those systems have not been directly impacted by the ransomware.

Protection

Attacks like these are preventable, as Moore stated. Reactive tools act when it is far too late, which is why the key to prevention is using proactive tools. One of these tools is SaferNet.

Morgan Stanley Customers Fear Identity Theft After Accellion Data Breach

Post On: 28 August, 2021 By : Brad Hawkins

Identity Theft fears are on the minds of Morgan Stanley customers, as the investment banking firm has reported a data breach after attackers stole personal information belonging to its customers by hacking into the Accellion FTA server of a third-party vendor. Morgan Stanley is one of the leading global financial services firms, operating in 41 countries. The company serves corporations, governments, institutions, and individuals.

Guidehouse, a third-party maintenance service to Morgan Stanley, notified the company in May 2021 that hackers had breached an Accellion FTA server to steal information belonging to Morgan Stanley stock plan participants. The server was breached using an exploit that was highlighted by Accellion in January. It is believed the server was running unpatched, hence the attack working.

Initially, it was believed that because the data was encrypted, there was no fear of alarm with regard to identity theft. However, the hackers obtained the decryption keys during the attack.

Morgan Stanley says that the documents stolen during this incident contained:

Stock plan participants’ names
Addresses
Dates of birth
Social security numbers
Corporate company names

The company added that the files stolen from Guidehouse’s FTA server did not contain passwords information or credentials that the threat actors could use to gain access to impacted Morgan Stanley customers’ financial accounts.

“The protection of client data is of the utmost importance and is something we take very seriously,” a Morgan Stanley spokesperson told BleepingComputer. “We are in close contact with Guidehouse and are taking steps to mitigate potential risks to clients.”

While much of the information being leaked is trouble, SSNs in particular are the keys to identity theft.

While the attackers’ identity was not disclosed in Morgan Stanley’s data breach notification, a joint statement published by Accellion and Mandiant from February shed more light on the attacks, directly linking them to the FIN11 cybercrime group.

The Clop ransomware gang has also used an Accellion FTA zero-day vulnerability (disclosed in December 2020) to steal data from multiple companies.

Since the Accellion discovery in January, many corporations have been caught with exploits due to running legacy systems.

The Dangers of Identity Theft

Identity Theft can be absolutely devastating for an individual. Usually, in the world of malware, we know certain things can be harmed. Our devices may need to be replaced, we may lose access to accounts for a few days or even forever, we may even need to pay a ransom for access to our data. The point is, with most types of Malware, we can eventually rebuild, though it may take longer than we anticipate. The fallout from identity theft is much longer.

Once your stolen information is used once, it can take anywhere from a few days to six months for that one incident. But your information is out there for a very, very long time. This means you could end up dealing with identity theft for many years, even decades.

Identity Theft has been around for a very long time and predates our modern technology by thousands of years. There have always been individuals that try to impersonate others for their own gain, financial or otherwise. However, the internet’s birth and wide adoption have led to new attack vectors, dwarfing any possible past attempts.

Now more than ever do we have data tied into our personal identity. Email addresses, banking numbers, phone numbers, social security numbers, home addresses – All of these and more form a picture of us as lines in a database.

And when this information falls into the wrong hands, it can do a lot of damage. Bank accounts can be drained, and your credit rating can get rattled; you can end up with medical bills or even a criminal record. The list of potential mishaps that can arise from identity theft is endless.

To hackers, identity theft represents a lucrative stream of income, and they can very easily cover their tracks. After they have seized personal information, they sell it on the dark web. This information can be sold over time, repeatedly, meaning that if you notice your identity has been stolen and used, it can be used in several instances over a long period of years.

There are some guidelines from the US government in discovering if you are a victim of identity theft if it is not immediately obvious:

You stop receiving your regular bills and credit card statements.
You receive statements for accounts you never opened.
Debt collectors start calling you day and night about debts you’ve never heard of.
The IRS alleges you failed to report income for a company you never worked for.
You see withdrawals/charges on your bank or credit card statement that you didn’t make.
You try to file your taxes only to discover that someone else beat you to it.
You try to file your taxes and find someone claimed your child as a dependent already.
Your credit report includes lines of credit you never opened.
Your credit score fluctuates wildly and for no apparent reason.
The most obvious sign—you receive a notification that you’ve been the victim of a data breach.
If you are unsure, it is always best to check with the authorities on the US government’s identity theft website.

Protection

In some cases, a victim cannot be faulted for identity theft. For example, those affected by the data breach handed their information over to companies in good faith in the story above. Unfortunately, these companies, or more specifically the vendor, failed in protecting this information. However, many other times, business owners and families are singled out and targeted in their offices and homes.

For times like these, it is critical that you have the right tools to protect yourself. One of these tools is SaferNet.

Joker Malware App Begins New Onslaught On Google Play Store

Post On: 28 August, 2021 By : Brad Hawkins

The Joker malware app, which specializes in billing fraud, has made a return to the Google Play Store. Researchers noticed an uptick in the amount of malicious Android apps that hide Joker malware, which stows away as a trojan in other applications. Joker has been around since 2017, disguising itself within common, legitimate apps like camera apps, games, messengers, photo editors, translators and wallpapers. Once installed, Joker apps silently simulate clicks and intercept SMS messages to subscribe victims to unwanted, paid premium services controlled by the attackers – a type of billing fraud that researchers categorize as “fleeceware.”

The malware also steals SMS messages, contact lists, and device information. In the majority of cases, the victim is in the dark until a mobile bill arrives.

The Joker malware and its associated apps are usually found outside of the official Google Play store, however, they’ve been known to bypass Google’s protections since 2019 too. This is due to the malware developers making small changes to the apps, and so there have been periodic waves of Joker malware infestations inside the official store. This includes two large attacks last year. According to researchers at Zimperium, more than 1,800 Android applications infected with Joker have been removed from the Google Play store in the last four years.

In the latest wave, at least 1,000 new samples have been detected just since September, many of them finding their way into the official marketplace, researchers said.

“Malicious actors have routinely found new and unique ways to get this malware into both official and unofficial app stores,” according to a Zimperium analysis, posted Tuesday. “While they are never long for life in these repositories, the persistence highlights how mobile malware, just like traditional endpoint malware, does not disappear but continues to be modified and advanced in a constant cat-and-mouse game.”

Joker Malware Flowchart. Source: Zimperium

The hackers behind the latest rendition of Joker Malware, which emerged late last year, are taking advantage of legitimate developer techniques to “try and hide the actual intent of the payload from traditional, legacy-based mobile security toolsets,” according to Zimperium — which helps them evade both device-based security and app store protections.

One such method is using Flutter, an app development kit designed by Google that allows developers to craft native apps for mobile, web, and desktop from a single codebase. “Due to the commonality of Flutter, even malicious application code will look legitimate and clean, whereas many scanners are looking for disjointed code with errors or improper assemblies,” explained the researchers.

Researchers also noted that another method is used is the practice of embedding the payload as a .DEX file that can be obfuscated in different ways, such as being encrypted with a number, or hidden inside an image using steganography. Sometimes in the latter case, the image is hosted in legitimate cloud repositories or on a remote command-and-control (C2) server.

Furthermore, the hackers have been using URL shorteners and a combination of native libraries to decrypt an offline payload.

Researchers said that the new samples also take extra precautions to remain hidden after a trojanized app is installed.

“After successful installation, the application infected with Joker will run a scan using Google Play APIs to check the latest version of the app in Google Play Store,” they explained. “If there is no answer, the malware remains silent since it can be running on a dynamic analysis emulator. But if the version found in the store is older than the current version, the local malware payload is executed, infecting the mobile device. If the version in the store is newer than the current one, then the C2s are contacted to download an updated version of the payload.”

“Sadly, the Joker malware is no joke,” Saryu Nayyar, CEO at Gurucul, said via email. “And even more depressing, no dark knight is going to ride in to save users from these malicious apps. Users have to manually clean their devices of this pesky malware. The good news is that it appears the only damage is financial, and likely temporary. Users who have been subscribed to premium mobile services as a result of this malware can request refunds for said services since the affected applications are known.”

Josh Bohls, CEO and founder at Inkscreen, noted earlier in the year that Joker Malware is also a problem for companies, not just individuals.

“These malicious applications can find their way into the enterprise when an infected device is enrolled in a company’s bring-your-own-device (BYOD) program, and suddenly you have a new threat vector,” he said via email. “We hope to see better app review processes by Apple and Google, and that consumer and business buyers continue to educate themselves on how to select appropriate mobile applications.”

Joker Malware Analysis

Note: This analysis of Joker Malware was carried out by CSIS Techblog.

In most of the apps the developers have inserted the Joker Malware initialization component into one or another advertisement framework. The little package of malicious code typically consists of:

• Target country checking via MCC
• Minimum C&C communication — just enough to report the infection and receive the encrypted configuration
• DEX decryption & loading
• A notification listener — when a new SMS message arrives, this listener captures it and sends out a broadcast for the Core (second stage) component to pick up.

Often, an app would contain a so-called “Splash” screen — an activity, which displays the app’s logo, while performing various initialization processes in the background. Some of the Joker apps use such activity for initialization as well.

The Joker Malware employs custom string obfuscation schemes for all of the configuration/payload/communication parsing procedures. The code listing below displays an example of an obfuscated MCC code list, (DEFAULT_COUNTRY_ISO) separated by the underscore symbol.

After the initialization is done, the malware will download an obfuscated and AES-encrypted configuration from the payload distribution C&C server. Joker Malware composes the AES key for the configuration string decryption using yet another string scheme, which would concatenate the app’s package name with MCC code string and shuffle the symbols around in a specific way.

The configuration string above contains the necessary information about the second stage code — the core component of the Joker. Being split by a 3-symbol delimiter, the configuration string above contains (ordered):
1. The URL for the Joker Core DEX file — this file is obfuscated
2. The de-obfuscation “keys” — indexes of the obfuscated read buffer
3. The initialization class name — the class, which implements the initialization method
4. The initialization method name — which method to call upon loading
5. The C&C URL
6. The campaign tag

The Loader downloads the DEX and starts the de-obfuscation routine. The said routine reads the DEX file in a buffer 128 bytes at a time. The de-obfuscation “keys” are the positional indexes for this buffer. For each iteration, the routine reads the bytes of the obfuscated buffer only between these positions and writes them into a file, producing a valid DEX file in the end.

This Joker malware kit stands out as a small and a silent one. It is using as little Java code as possible and thus generates as little footprint as possible. After all of the Loader’s MCC checks and payload loading — the Core component begins its work.

It is designed in a job-scheduler fashion, meaning that it periodically requests new commands from the C&C server. When found, it executes them in strict order and then reports the results, depending on the type of the given task. The below figure is an example of a command (truncated).

When Joker Malware receives such message, it proceeds to open the offer URL, injects the JavaScript commands one by one and waits for an authorization SMS (if any). When the SMS message arrives, the malware extracts the necessary authorization code using case-specific regular expressions. At other times, it simply sends a SMS message to a premium number, with a specific code from the offer page.

Whenever the Joker malware extracts a code from a SMS message — it also reports it to the C&C after the job is complete. Hypothetically, the botnet operator can craft a job, which would result in all incoming SMS messages being stolen.

The final important thing worth mentioning about the Joker Malware is the phone book contact list theft. The core component collects all numbers in the contact list and sends them over to the C&C in an encrypted form:

A total of 12 unique builds of the second stage payload were observed among the 24 infected apps. The version names come from the payload URLs and data inside the sample’s configuration class:

Protection

Rogue Military-Grade Pegasus Spyware Targets Journalists Globally

Post On: 28 August, 2021 By : Brad Hawkins

Pegasus Spyware has been discovered to be the culprit behind human rights violations after a sweeping probe into a data leak of more than 50,000 phone numbers revealed surveillance affecting heads of state, activists, journalists, and lawyers around the world. Pegasus was created by the Israeli company NSO Group who claims the software is “military-grade spyware”. The “Pegasus Projection” is a collaborative investigation by more than 80 journalists from a consortium of 17 media organizations in 10 countries coordinated by Forbidden Stories, a Paris-based media non-profit, along with the technical support of Amnesty International.

“The Pegasus Project lays bare how NSO’s spyware is a weapon of choice for repressive governments seeking to silence journalists, attack activists, and crush dissent, placing countless lives in peril,” Amnesty International’s Secretary-General, Agnès Callamard, said.

“These revelations blow apart any claims by NSO that such attacks are rare and down to rogue use of their technology. While the company claims its spyware is only used for legitimate criminal and terror investigations, it’s clear its technology facilitates systemic abuse. They paint a picture of legitimacy while profiting from widespread human rights violations,” Callamard added.

NSO Group is the creator of Pegasus Spyware, which when installed on victims’ iPhone and Android devices, enables an attacker to harvest emails, SMS messages, media, calendars, calls, and contact information, as well as chat content from messaging apps like WhatsApp, Telegram and Signal, and stealthily activate the phone’s microphone and camera.

The company is a surveillance vendor and sells to a number of governments worldwide. NSO Group calls itself “the world leader in precision cyber intelligence solutions for the sole use of vetted-and-approved, state-administered intelligence and law enforcement agencies.”

The list of numbers in the probe does not include names but is said to contain hundreds of business executives, religious figures, academics, NGO employees, union officials, and government officials, with the probe uncovering NSO Group clients in at least 11 countries, including Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the U.A.E.

The investigation has identified 180 journalists and over 600 politicians in over 50 countries. The timeline of the attacks spread over a seven-year period from 2014 up to as recently as July 2021. Rwanda, Morocco, India, and Hungary denied having used Pegasus Spyware to hack the phones of the individuals named in the list.

A forensic analysis of 67 mobile devices showed the intrusions involved the ongoing use of so-called “zero-click” exploits — which do not require any interaction from the target — dating all the way back to May 2018. Many “zero-click” exploits are carried out by leveraging multiple zero-day vulnerabilities in popular apps like iMessage. iMessage was one of the most targeted apps by Pegasus Spyware.

“All this indicates that NSO Group can break into the latest iPhones,” Citizen Lab’s Bill Marczak said in a series of tweets. “It also indicates that Apple has a MAJOR blinking red five-alarm-fire problem with iMessage security that their BlastDoor Framework (introduced in iOS 14 to make zero-click exploitation more difficult) ain’t solving.”

Of the tested smartphones, 23 devices had been successfully infected with Pegasus Spyware, and 15 exhibited signs of attempted penetration, the Washington Post said in an in-depth report.

“The coming week’s stories about the global hacking of phones identical to the one in your pocket, by for-profit companies, make it clear that export controls have failed as a means to regulate this industry,” U.S. whistleblower Edward Snowden tweeted. “Only a comprehensive moratorium on sales can remove the profit motive.”

This is not the first time Pegasus Spyware has been in the spotlight. In October 2019, Facebook-owned WhatsApp revealed that at least two dozen academics, lawyers, Dalit activists, and journalists in India were the target of unlawful surveillance by taking advantage of a then-unpatched vulnerability in the messaging service.

WhatsApp has since taken the company to court in the U.S., citing evidence that “the attackers used servers and Internet-hosting services that were previously associated with NSO.”

NSO has disputed the allegations, stating the investigation is “full of wrong assumptions and uncorroborated theories that raise serious doubts about the reliability and interests of the sources,” while stressing that it’s on a “life-saving mission” to “break up pedophilia rings, sex and drug-trafficking rings, locate missing and kidnapped children, locate survivors trapped under collapsed buildings, and protect airspace against disruptive penetration by dangerous drones.”

“After checking their claims, we firmly deny the false allegations made in their report,” the company added. “Their sources have supplied them with information which has no factual basis, as evident by the lack of supporting documentation for many of their claims. In fact, these allegations are so outrageous and far from reality, that NSO is considering a defamation lawsuit.”

Pegasus Spyware Analysis

Note: This Analysis was carried out by LookOut.

The attack is very simple in its delivery and silent in delivering its payload. The attack starts when the attacker sends a website URL (through SMS, email, social media, or any other message) to an identified target. The user only has to take one action–click on the link. Once the user clicks the link, the software silently carries out a series of exploits against the victim’s device to remotely jailbreak it so that the espionage software packages can be installed.

The user’s only indication that anything happened will be that the browser closes after the link is clicked. The espionage software contains malicious code, processes, and apps that are used to spy, collect data, and report back what the user does on the device. Pegasus spyware can access and exfiltrate messages, calls, emails, logs, and more from apps including, but not limited to:

In order to accomplish this, the spyware, once it jailbreaks the user’s phone, does not download malicious versions of these apps to the victim’s device in order to capture data, rather it compromises the original apps already installed on the device. This includes pre-installed apps such as Facetime and Calendar and those from the official App Store.

Usually, iOS security mechanisms prevent normal apps from spying on each other, but spying “hooks” can be installed on a jailbroken device. Pegasus Spyware takes advantage of both the remote jailbreak exploit and a technique called “hooking.” The hooking is accomplished by inserting Pegasus Spyware’s dynamic libraries into the legitimate processes running on the device. These dynamic libraries can be used to hook the apps using a framework called Cydia Mobile Substrate, known to the iOS jailbreak community, and which Pegasus Spyware uses as part of the exploit.

A user infected with pegasus spyware is under complete surveillance by the attacker because, in addition to the apps listed above, it also spies on:
• Phone calls
• Call logs
• SMS messages the victim sends or receives
• Audio and video communications that (in the words a founder of NSO Group) turns the phone into a “walkie-talkie”

Access to this content could be used to gain further access into other accounts owned by the target, such as banking, email, and other services he/she may use on or off the device. The attack is comprised of three separate stages that contain both the exploit code and the espionage software. The
stages are sequential; each stage is required to successfully decode, exploit, install, and run the subsequent stage. Each stage leverages one of the Trident vulnerabilities in order to run successfully.

STAGE 1 Delivery and WebKit vulnerability
STAGE 2 Jailbreak
STAGE 3 Espionage software

The third stage deploys a number of files deployed in a standard unix tarball (test222.tar), each of which has its own purpose:

• ca.crt – root TLS certificate that is added to keystore (see Appendix A)
• ccom.apple.itunesstored.2.csstore – Standalone javascript that is run from the command line at reboot and is used to run unsigned code and jailbreak the kernel on device reboot
• converter – injects dylib in a process by pid. It is a renamed version of the cynject from the Cydia open-source library
• libaudio.dylib – The base library for call recording
• libdata.dylib – A renamed version of the Cydia substrate open-source library
• libimo.dylib – imo.im sniffer library
• libvbcalls.dylib – Viber sniffer
• libwacalls.dylib – Whatsapp sniffer
• lw-install – Spawns all sniffing services
• systemd – Sends reports and files to server
• watchdog
• workerd – SIP module

The attack investigated works on iOS up to 9.3.4. The developers maintain a large table in their code that attacks all iOS versions from 7.0 up to and including iOS 9.3.3. While the code we investigated did not contain the appropriate values to initially work on iOS 9.3.4, the exploits we investigated would still work, and it is trivial for the attackers to update the table so that the attack will work on 9.3.4.

Protection

XLoader Malware Targets macOS and Windows Passwords

Post On: 28 August, 2021 By : Brad Hawkins

A notorious malware or stealing information from Windows systems has been modified and upgraded into a new strain named Xloader, which can now also hit macOS computers. Xloader Malware is being sold on a Dark Web forum as a botnet loader that can “recover” passwords from web browsers and some email clients (Chrome, Firefox, Opera, Edge, IE, Outlook,Thunderbird, Foxmail). It is considered MaaS (Malware-as-a-Service). Xloader is derived from Formbook, which gained a reputation as an info-stealer for Windows.

Xloader Malware emerged in February and its popularity skyrocketed. It is advertised by its creators as a cross-platform botnet with no dependencies.

The connection between the two strains was confirmed after a member of the hacking community reverse-engineered Xloader and discovered it had the same executable as Formbook.

The developers explained that the creators of Formbook contributed a lot to Xloader, and the two malware had similar functionality (steal login credentials, capture screenshots, log keystrokes, and execute malicious files).

Would-be hackers can rent the macOS version of Xloader Malware for $49 a month, and get access to a server that the seller provides. Because the authors keep a centralized c2 infrastructure, they can control how the malware is used. This kind of architecture has become more common in an age where malware authors are getting unwanted spotlight when their clients use the product recklessly.

The Windows version, which is more popular, sells for $59 a month, and $129 for three months.

The authors also provide a Java binder for free, which allows customers to create a standalone JAR file with the Mach-O and EXE binaries used by macOS and Windows.

Cybersecurity researchers at CheckPoint saw requests from 69 countries, indicating a significant spread across the globe, with more than half of the victims being in the United States.

Although Formbook is no longer advertised on underground forums, it continues to be a prevalent threat. It was part of at least 1,000 malware campaigns over the past three years and according to AnyRun’s malware trends, the info-stealer takes fourth place over the past 12 months, after Emotet.

Judging by how popular Formbook has been, XLoader is likely to even be more prevalent due to it having cross-platform capability.

CheckPoint researchers say that XLoader Malware is stealthy enough to make it difficult for a regular, non-technical user to spot it.

Yaniv Balmas, Head of Cyber Research at Check Point Software, says that XLoader Malware is “is far more mature and sophisticated than its predecessors [i.e. Formbook].”

macOS’s growing popularity exposed it to unwanted attention from cybercriminals, who are now seeing the OS as an attractive target.

“While there might be a gap between Windows and MacOS malware, the gap is slowly closing over time. The truth is that MacOS malware is becoming bigger and more dangerous”, Balmas said.

The researcher believes that more malware families will adapt and add macOS to the list of supported operating systems.

XLoader Malware Analysis

Note: This Analysis was carried out by VMray. The analysis was focused on Formbook, but the code base is mostly identical.

XLoader Malware uses multiple techniques to evade automatic analysis and debugging. Combined with an evasive packer it has fairly comprehensive methods at its disposal. We can observe that the packer detects attached debuggers using CheckRemoteDebuggerPresent and IsDebuggerPresent function calls. It also tries to detect VirtualBox and VMware. If the checks pass the actual payload is extracted. Otherwise, the execution stops and the process exits before the explorer.exe injection.

Analysts often rename the sample to their hash values and such a hash is usually 32 characters or longer. One of the other evasions used by XLoader Malware is verifying that the length of the sample’s name is less than 32 characters.

To circumvent the behavior monitoring of sandboxes that relies on hooking, XLoader Malware uses a technique its author(s) referred to as Lagos Island method. These sandboxes typically establish hooks on functions exported by the native dll (ntdll.dll) to intercept the control flow and log the behavior.

Instead of using API functions exported by an already loaded ntdll, which can contain hooks, a new copy is manually mapped from the filesystem and its functions are used.

XLoader Malware uses a process started from a Windows built-in tool to hide itself. We notice the usual pattern it uses to achieve the migration. First, process #6 injects a section into explorer.exe using a combination of the function NtOpenProcess, NtCreateSection and NtMapViewOfSection.

Subsequently, the injected code is executed by hijacking the process #7 explorer.exe’s main thread. This injected code starts execution by creating a new process of C:\Windows\SysWOW64\netsh.exe which is a Windows tool. After finishing, process #6 uses the same injection method as with process #7, explorer.exe, to map itself and migrate into process #8 netsh.exe

XLoader Malware intercepts the Windows Messaging System by hooking API functions in the injected processes which allows it to monitor keystrokes.

Protection

Gallium and 2 Other Hacker Groups Target Major Telecom Companies

Post On: 27 August, 2021 By : Brad Hawkins

Gallium and 2 other hacking groups have been operating on behalf of the Chinese State by staging a series of attacks against five major telecommunications companies located in Southeast Asian countries. The attacks by Gallium and the others have been on-going since 2017.

“The goal of the attackers behind these intrusions was to gain and maintain continuous access to telecommunication providers and to facilitate cyber espionage by collecting sensitive information, compromising high-profile business assets such as the billing servers that contain Call Detail Record (CDR) data, as well as key network components such as the Domain Controllers, Web Servers and Microsoft Exchange servers,” Cybereason’s Lior Rochberger, Tom Fakterman, Daniel Frank, and Assaf Dahan revealed in a technical analysis published last week.

Gallium and the other groups collectively make up a group named “DeadRinger”. Aside from Gallium (aka Soft Cell), the group is also made up of Naikon APT (aka APT30 or Lotus Panda), and TG-3390 (aka APT27 or Emissary Panda).

Gallium and Naikon attacks were first observed in Q4 2020, while TG-3390 was first reported attacking the telecom companies in 2017. The three espionage operations are believed to have continued until at least the middle of 2021.

Researchers noted that Gallium is “highly adaptive” and called out their diligent efforts to stay under the radar and maintain persistence on the infected endpoints, while simultaneously shifting tactics and updating their defensive measures to compromise and backdoor unpatched Microsoft Exchange email servers using the ProxyLogon exploits that came to light earlier this March.

“Each phase of the operation demonstrates the attackers’ adaptiveness in how they responded to various mitigation efforts, changing infrastructure, toolsets, and techniques while attempting to become more stealthy,” the researchers noted.

Naikon was found to leverage a backdoor named “Nebulae” and a keylogger named “EnrollLoger”. Nebulae has been used by the group in several separate attacks this year.

Regardless of the attack chain, a successful compromise triggered a sequence of steps, enabling the threat actors to perform network reconnaissance, credential theft, lateral movement, and data exfiltration.

TG-3390 has been active the longest in this campaign, and primarily used a custom .NET-based OWA (Outlook Web Access) backdoor, which is used to pilfer credentials of users logging into Microsoft OWA services, granting the attackers the ability to access the environment stealthily.

There is some overlap in the tools used between the groups, especially with generic tools such as Minikatz.

“At this point, there is not enough information to determine with certainty the nature of this overlap — namely, whether these clusters represent the work of three different threat actors working independently, or whether these clusters represent the work of three different teams operating on behalf of a single threat actor,” the researchers said.

“A second hypothesis is that there are two or more Chinese threat actors with different agendas/tasks that are aware of each other’s work and potentially even working in tandem.”

History and Methodology of Gallium

Note: This Analysis was based on research from Microsoft and reporting by DarkReading

In 2018, researchers identified an advanced, persistent attack targeting telecommunications providers and using techniques associated with Chinese-affiliated threat actors. Researchers report the attackers, believed to be active since 2012, was attempting to steal data stored in Active Directory, compromise credentials, and access personally identifiable information, billing data, call records, email servers, and users’ geolocations. This threat was later identified as Gallium.

The bulk of Gallium’s activity, which primarily targeted telecommunication providers, was observed throughout 2018 into mid-2019, researchers with the Microsoft Threat Intelligence Center (MSTIC) reported today. While the group is still an active threat, they say, its activity levels have fallen in comparison to what they saw earlier in their research.

To gain access into a target network, Gallium detects and exploits Internet-facing services. The group has been spotted exploiting unpatched Web services; for example, WildFly/JBoss, for which exploits are widely accessible. While it’s often tough to determine a group’s reconnaissance methods, MSTIC says Gallium’s targeting of Internet-facing services is a sign the group uses open-source research and network scanning tools to pinpoint its new targets.

“MSTIC investigations indicate that Gallium modifies its tooling to the extent it evades antimalware detection rather than develop custom functionality,” researchers write in a blog post. “This behavior has been observed with Gallium across several operational areas.”

Gallium’s commonly used tools include Mimikatz, NBTScan, Netcat, WinRAR, and Windows Credential Editor. The group mostly relies on compromised domain credentials to move across a network; once they have credentials, attackers use PsExec to move from host to host.

Researchers point out Gallium does little to hide its intent and often uses common versions of malware and publicly available toolkits with slight modifications. The group has used the Poison Ivy RAT, which is widely accessible, and QuarkBandit, an altered version of Gh0st RAT. Poison Ivy RAT, Gh0st RAT, and the China Chopper Web shell are the foundation of its toolkit.

Gallium mostly uses dynamic DNS subdomains for its C2 infrastructure. Analysis shows the group tends to favor low-cost, low-effort operations, as indicated by its use of dynamic DNS providers instead of registered domains. Its domains have been seen hosted on infrastructure in mainland China, Hong Kong SAR, and Taiwan. Observed IP addresses seem to be exclusive to this group, have minimal or no legitimate activity, and are used in several operations.