-Table 4112. Table References
+Table 4115. Table References
@@ -146531,7 +146659,7 @@ Throughout the multiple campaigns observed over the last 3 years, the actor has
Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks. Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.
-Table 4113. Table References
+Table 4116. Table References
@@ -146554,7 +146682,7 @@ Throughout the multiple campaigns observed over the last 3 years, the actor has
Recently, Palo Alto Networks researchers discovered an advanced Android malware we’ve named “SpyDealer” which exfiltrates private data from more than 40 apps and steals sensitive messages from communication apps by abusing the Android accessibility service feature. SpyDealer uses exploits from a commercial rooting app to gain root privilege, which enables the subsequent data theft.
-Table 4114. Table References
+Table 4117. Table References
@@ -146574,7 +146702,7 @@ Throughout the multiple campaigns observed over the last 3 years, the actor has
CowerSnail was compiled using Qt and linked with various libraries. This framework provides benefits such as cross-platform capability and transferability of the source code between different operating systems.
-Table 4115. Table References
+Table 4118. Table References
@@ -146617,7 +146745,7 @@ Throughout the multiple campaigns observed over the last 3 years, the actor has
-Table 4116. Table References
+Table 4119. Table References
@@ -146638,7 +146766,7 @@ Throughout the multiple campaigns observed over the last 3 years, the actor has
During our analysis, we extracted the commands executed by the TwoFace webshell from the server logs on the compromised server. Our analysis shows that the commands issued by the threat actor date back to June 2016; this suggests that the actor had access to this shell for almost an entire year. The commands issued show the actor was interested in gathering credentials from the compromised server using the Mimikatz tool. We also saw the attacker using the TwoFace webshell to move laterally through the network by copying itself and other webshells to other servers.
-Table 4117. Table References
+Table 4120. Table References
@@ -146658,7 +146786,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
Like TwoFace, the IntrudingDivisor webshell requires the threat actor to authenticate before issuing commands. To authenticate, the actor must provide two pieces of information, first an integer that is divisible by 5473 and a string whose MD5 hash is “9A26A0E7B88940DAA84FC4D5E6C61AD0”. Upon successful authentication, the webshell has a command handler that uses integers within the request to determine the command to execute - To complete
-Table 4118. Table References
+Table 4121. Table References
@@ -146678,7 +146806,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
Attacks that use completely fileless malware are a rare occurrence, so we thought it important to discuss a new trojan known as JS_POWMET (Detected by Trend Micro as JS_POWMET.DE), which arrives via an autostart registry procedure. By utilizing a completely fileless infection chain, the malware will be more difficult to analyze using a sandbox, making it more difficult for anti-malware engineers to examine.
-Table 4119. Table References
+Table 4122. Table References
@@ -146698,7 +146826,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
The main malware capabilities include a privilege escalation attempt using MS16–032 exploitation; a HTTP Proxy to intercept banking transactions; a backdoor to make it possible for the attacker to issue arbitrary remote commands and a C&C through a IRC channel. As it’s being identified as a Generic Trojan by most of VirusTotal (VT) engines, let s name it EngineBox— the core malware class I saw after reverse engineering it.
-Table 4120. Table References
+Table 4123. Table References
@@ -146728,7 +146856,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
-Table 4121. Table References
+Table 4124. Table References
@@ -146758,7 +146886,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
-Table 4122. Table References
+Table 4125. Table References
@@ -146788,7 +146916,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
-Table 4123. Table References
+Table 4126. Table References
@@ -146808,7 +146936,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
IoT_reaper is fairly large now and is actively expanding. For example, there are multiple C2s we are tracking, the most recently data (October 19) from just one C2 shows the number of unique active bot IP address is more than 10k per day. While at the same time, there are millions of potential vulnerable device IPs being queued into the c2 system waiting to be processed by an automatic loader that injects malicious code to the devices to expand the size of the botnet.
-Table 4124. Table References
+Table 4127. Table References
@@ -146828,7 +146956,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
FormBook is a data stealer and form grabber that has been advertised in various hacking forums since early 2016.
-Table 4125. Table References
+Table 4128. Table References
@@ -146861,7 +146989,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
-Table 4126. Table References
+Table 4129. Table References
@@ -146881,7 +147009,7 @@ During our analysis, we extracted the commands executed by the TwoFace webshell
The ALMA Communicator Trojan is a backdoor Trojan that uses DNS tunneling exclusively to receive commands from the adversary and to exfiltrate data. This Trojan specifically reads in a configuration from the cfg file that was initially created by the Clayslide delivery document. ALMA does not have an internal configuration, so the Trojan does not function without the cfg file created by the delivery document.
-Table 4127. Table References
+Table 4130. Table References
@@ -146912,7 +147040,7 @@ We saw that technique before in Carbanak, and other similar cases worldwide. The
-Table 4128. Table References
+Table 4131. Table References
@@ -146951,7 +147079,7 @@ We saw that technique before in Carbanak, and other similar cases worldwide. The
-Table 4129. Table References
+Table 4132. Table References
@@ -146981,7 +147109,7 @@ We saw that technique before in Carbanak, and other similar cases worldwide. The
-Table 4130. Table References
+Table 4133. Table References
@@ -147021,7 +147149,7 @@ We saw that technique before in Carbanak, and other similar cases worldwide. The
-Table 4131. Table References
+Table 4134. Table References
@@ -147060,7 +147188,7 @@ We saw that technique before in Carbanak, and other similar cases worldwide. The
-Table 4132. Table References
+Table 4135. Table References
@@ -147103,7 +147231,7 @@ We saw that technique before in Carbanak, and other similar cases worldwide. The
-Table 4133. Table References
+Table 4136. Table References
@@ -147133,7 +147261,7 @@ We saw that technique before in Carbanak, and other similar cases worldwide. The
-Table 4134. Table References
+Table 4137. Table References
@@ -147155,7 +147283,7 @@ The malware was first spotted online over the summer by Italian security researc
The initial version of this threat was loaded via an include call for the wp-vcd.php file —hence the malware’s name— and injected malicious code into WordPress core files such as functions.php and class.wp.php. This was not a massive campaign, but attacks continued throughout the recent months.
-Table 4135. Table References
+Table 4138. Table References
@@ -147178,7 +147306,7 @@ The initial version of this threat was loaded via an include call for the wp-vcd
malicious program for auto replacement of payment data in AWS CBR
-Table 4136. Table References
+Table 4139. Table References
@@ -147208,7 +147336,7 @@ The initial version of this threat was loaded via an include call for the wp-vcd
-Table 4137. Table References
+Table 4140. Table References
@@ -147244,7 +147372,7 @@ The initial version of this threat was loaded via an include call for the wp-vcd
-Table 4138. Table References
+Table 4141. Table References