Blog
Anomali Cyber Watch: Hospital Ransoms Pay for Attacks on Defense, Nodaria Got Upgraded Go-Based Infostealer, TA866 Moved Screenshot Functionality to Standalone Tool
Anomali Threat Research
February 14, 2023
<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: <b>APT, Infostealers, Malicious packages, Malicious redirects, North Korea, Ransomware, Spearphishing,</b> and <b>Vulnerabilities</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.</p> <p><img src="https://cdn.filestackcontent.com/Oj0K3ld7S7CEuWoXeWre"/><br/> <b>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</b></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3><a href="https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_Ransomware_Attacks_on_CI_Fund_DPRK_Activities.PDF" target="_blank">#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities</a></h3> <p>(published: February 9, 2023)</p> <p>The US and South Korea issued a joint advisory on ongoing, North Korea-sponsored ransomware activity against healthcare and other critical infrastructure. The proceedings are used to fund North Korea’s objectives including further cyber attacks against the US and South Korean defense and defense industrial base sectors. For initial access, the attackers use a trojanized messenger (X-Popup) or various exploits including those targeting Apache log4j2 and SonicWall appliances. Despite having two custom ransomware crypters, Maui and H0lyGh0st, the attackers can portray themselves as a different ransomware group (REvil) and/or use publicly-available crypters, such as BitLocker, Deadbolt, ech0raix, GonnaCry, Hidden Tear, Jigsaw, LockBit 2.0, My Little Ransomware, NxRansomware, Ryuk, and YourRansom.<br/> <b>Analyst Comment:</b> Organizations in the healthcare sector should consider following the Cross-Sector Cybersecurity Performance Goals developed by the U.S. Cybersecurity and Infrastructure Security Agency and the U.S. National Institute of Standards and Technology. Follow the principle of least privilege by using standard user accounts on internal systems instead of administrative accounts. Turn off weak or unnecessary network device management interfaces.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/10038" target="_blank">[MITRE ATT&CK] T1583 - Acquire Infrastructure</a> | <a href="https://ui.threatstream.com/attackpattern/10043" target="_blank">[MITRE ATT&CK] T1583.003 - Acquire Infrastructure: Virtual Private Server</a> | <a href="https://ui.threatstream.com/attackpattern/10012" target="_blank">[MITRE ATT&CK] T1190 - Exploit Public-Facing Application</a> | <a href="https://ui.threatstream.com/attackpattern/10098" target="_blank">[MITRE ATT&CK] T1133 - External Remote Services</a> | <a href="https://ui.threatstream.com/attackpattern/9609" target="_blank">[MITRE ATT&CK] T1195 - Supply Chain Compromise</a> | <a href="https://ui.threatstream.com/attackpattern/9863" target="_blank">[MITRE ATT&CK] T1083 - File And Directory Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9604" target="_blank">[MITRE ATT&CK] T1021 - Remote Services</a> | <a href="https://ui.threatstream.com/attackpattern/3714" target="_blank">[MITRE ATT&CK] T1486: Data Encrypted for Impact</a><br/> <b>Tags:</b> malware-type:Ransomware, source-country:North Korea, source-country:DPRK, source-country:KP, target-industry:Healthcare, target-sector:Critical infrastructure, target-industry:Defense, target-industry:Defense Industrial Base, Log4Shell, SonicWall, CVE-2021-44228, CVE-2021-20038, CVE-2022-24990, X-Popup, malware:Maui, malware:H0lyGh0st, malware:BitLocker, malware:Deadbolt, malware:ech0raix, malware:GonnaCry, malware:Hidden Tear, malware:Jigsaw, malware:LockBit 2.0, malware:My Little Ransomware, malware:NxRansomware, malware:Ryuk, malware:YourRansom</p> </div> <div class="trending-threat-article"> <h3><a href="https://www.reversinglabs.com/blog/open-source-malware-sows-havoc-on-supply-chain" target="_blank">Open-Source Repository Malware Sows Havoc</a></h3> <p>(published: February 9, 2023)</p> <p>In February 2023, ReversingLabs researchers detected a new supply-chain campaign dubbed Aabquerys. A small number of malicious npm packages were testing and using package name typosquatting (such as “aabquerys” instead of the legitimate “aabquery” package). These malicious packages were obfuscated using the JavaScript obfuscator. The infection chain included at least three levels: a typosquatted website prompting to download a trojan that in turn would execute a side-loading of a malicious DLL, ending with downloading and running of a remote access trojan generated with the Havoc command-and-control framework.<br/> <b>Analyst Comment:</b> The npm repository has removed these malicious packages, but it is difficult to prevent threat actors from adding new ones. Developers should monitor for the presence of obfuscated code and the use of known vulnerable components in the code they are incorporating into their projects. Pay attention to external communication and the correct spelling of package names and websites.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/9610" target="_blank">[MITRE ATT&CK] T1195.001 - Supply Chain Compromise: Compromise Software Dependencies And Development Tools</a> | <a href="https://ui.threatstream.com/attackpattern/10104" target="_blank">[MITRE ATT&CK] T1574.002 - Hijack Execution Flow: Dll Side-Loading</a> | <a href="https://ui.threatstream.com/attackpattern/9612" target="_blank">[MITRE ATT&CK] T1204 - User Execution</a> | <a href="https://ui.threatstream.com/attackpattern/9715" target="_blank">[MITRE ATT&CK] T1071.001 - Application Layer Protocol: Web Protocols</a> | <a href="https://ui.threatstream.com/attackpattern/9591" target="_blank">[MITRE ATT&CK] T1027 - Obfuscated Files Or Information</a><br/> <b>Tags:</b> campaign:Aabquerys, npm package, Typosquatting, Open-source, Javascript obfuscator, file-type:JS, file-type:EXE, InnoSetup, DLL side-loading, file-type:BIN, malware-type:RAT, malware:Havoc, malware-type:C2 framework, actor:C5pider, Windows</p> </div> <div class="trending-threat-article"> <h3><a href="https://blogs.blackberry.com/en/2023/02/newspenguin-a-previously-unknown-threat-actor-targets-pakistan-with-advanced-espionage-tool" target="_blank">NewsPenguin, a Previously Unknown Threat Actor, Targets Pakistan with Advanced Espionage Tool</a></h3> <p>(published: February 9, 2023)</p> <p>NewsPenguin, a previously-unknown, state-sponsored group without clear attribution targeted government, defense, and maritime sectors in Pakistan. In June and October 2022, the group has registered Windows Update typosquatting domains later used in the attack. NewsPenguin used spearphishing attachments purporting to be an exhibitor manual for February 2023 Pakistan International Maritime Expo & Conference that is organized by the Pakistan Navy and the Ministry of Maritime Affairs. The maldoc employs a remote template injection, asks to enable content, and executes a Visual Basic for Applications macro. The final payload is a Win32 executable with no name, dubbed Updates.exe. This agent is designed to discover and exfiltrate any file, and to download additional malware. It has multiple anti-sandbox checks: using GetTickCount, checking the hard drive size, requiring more than 10GB of RAM, and sleeping for 5 minutes between commands.<br/> <b>Analyst Comment:</b> Spearphishing emails represent a significant security risk because the sending email will often appear legitimate to the target. Education is the best defense, employees should also be aware of whom to contact when they suspect they are the target of a possible spearphishing attack. If an unknown document prompts to “Enable Editing” users should be advised against doing so unilaterally.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/10001" target="_blank">[MITRE ATT&CK] T1566.001 - Phishing: Spearphishing Attachment</a> | <a href="https://ui.threatstream.com/attackpattern/9615" target="_blank">[MITRE ATT&CK] T1204.002 - User Execution: Malicious File</a> | <a href="https://ui.threatstream.com/attackpattern/9853" target="_blank">[MITRE ATT&CK] T1059.005 - Command and Scripting Interpreter: Visual Basic</a> | <a href="https://ui.threatstream.com/attackpattern/10029" target="_blank">[MITRE ATT&CK] T1059.003 - Command and Scripting Interpreter: Windows Command Shell</a> | <a href="https://ui.threatstream.com/attackpattern/9752" target="_blank">[MITRE ATT&CK] T1203 - Exploitation For Client Execution</a> | <a href="https://ui.threatstream.com/attackpattern/9800" target="_blank">[MITRE ATT&CK] T1047 - Windows Management Instrumentation</a> | <a href="https://ui.threatstream.com/attackpattern/3712" target="_blank">[MITRE ATT&CK] T1059.001: PowerShell</a> | <a href="https://ui.threatstream.com/attackpattern/9755" target="_blank">[MITRE ATT&CK] T1559.001 - Inter-Process Communication: Component Object Model</a> | <a href="https://ui.threatstream.com/attackpattern/9814" target="_blank">[MITRE ATT&CK] T1055 - Process Injection</a> | <a href="https://ui.threatstream.com/attackpattern/9915" target="_blank">[MITRE ATT&CK] T1055.002 - Process Injection: Portable Executable Injection</a> | <a href="https://ui.threatstream.com/attackpattern/9829" target="_blank">[MITRE ATT&CK] T1480 - Execution Guardrails</a> | <a href="https://ui.threatstream.com/attackpattern/9797" target="_blank">[MITRE ATT&CK] T1221 - Template Injection</a> | <a href="https://ui.threatstream.com/attackpattern/9591" target="_blank">[MITRE ATT&CK] T1027 - Obfuscated Files Or Information</a> | <a href="https://ui.threatstream.com/attackpattern/9838" target="_blank">[MITRE ATT&CK] T1140 - Deobfuscate/Decode Files Or Information</a> | <a href="https://ui.threatstream.com/attackpattern/9770" target="_blank">[MITRE ATT&CK] T1070.004 - Indicator Removal on Host: File Deletion</a> | <a href="https://ui.threatstream.com/attackpattern/3717" target="_blank">[MITRE ATT&CK] T1564.001: Hidden Files and Directories</a> | <a href="https://ui.threatstream.com/attackpattern/9797" target="_blank">[MITRE ATT&CK] T1221 - Template Injection</a> | <a href="https://ui.threatstream.com/attackpattern/3710" target="_blank">[MITRE ATT&CK] T1112: Modify Registry</a> | <a href="https://ui.threatstream.com/attackpattern/10081" target="_blank">[MITRE ATT&CK] T1036.005 - Masquerading: Match Legitimate Name Or Location</a> | <a href="https://ui.threatstream.com/attackpattern/9638" target="_blank">[MITRE ATT&CK] T1105 - Ingress Tool Transfer</a> | <a href="https://ui.threatstream.com/attackpattern/9715" target="_blank">[MITRE ATT&CK] T1071.001 - Application Layer Protocol: Web Protocols</a> | <a href="https://ui.threatstream.com/attackpattern/9622" target="_blank">[MITRE ATT&CK] T1132.001 - Data Encoding: Standard Encoding</a> | <a href="https://ui.threatstream.com/attackpattern/9717" target="_blank">[MITRE ATT&CK] T1573.001 - Encrypted Channel: Symmetric Cryptography</a> | <a href="https://ui.threatstream.com/attackpattern/9617" target="_blank">[MITRE ATT&CK] T1041 - Exfiltration Over C2 Channel</a> | <a href="https://ui.threatstream.com/attackpattern/9737" target="_blank">[MITRE ATT&CK] T1029 - Scheduled Transfer</a> | <a href="https://ui.threatstream.com/attackpattern/9863" target="_blank">[MITRE ATT&CK] T1083 - File And Directory Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9710" target="_blank">[MITRE ATT&CK] T1057 - Process Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/13021" target="_blank">[MITRE ATT&CK] Picus: The System Information Discovery Technique Explained - MITRE ATT&CK T1082</a> | <a href="https://ui.threatstream.com/attackpattern/10000" target="_blank">[MITRE ATT&CK] T1497.003 - Virtualization/Sandbox Evasion: Time Based Evasion</a><br/> <b>Tags:</b> actor:NewsPenguin, target-country:Pakistan, target-country:PK, PIMEC-23, VBA, Macros, DDNS, target-industry:Maritime, target-industry:Government, target-industry:Defense, file-type:RTF, file-type:BAT, file-type:DOTX, file-type:WSF, file-type:CRT, file-type:EXE, file-type:DLL, malware:Updates.exe, Windows</p> </div> <div class="trending-threat-article"> <h3><a href="https://blog.sucuri.net/2023/02/bogus-url-shorteners-redirect-thousands-of-hacked-sites-in-adsense-fraud-campaign.html" target="_blank">Bogus URL Shorteners Redirect Thousands of Hacked Sites in AdSense Fraud Campaign</a></h3> <p>(published: February 9, 2023)</p> <p>A new wave of Google AdSense Fraud has already abused over 2,600 compromised WordPress websites in 2023. The attackers were observed using over 70 new malicious domains masquerading as URL shorteners, some of them typosquatting reputable ones like Bitly (for example, bitly[.]best, b-i-t-l-y[.]co, and bit-ly[.]mobi). To make traffic appear as legitimate, they additionally redirect the traffic through Google or Bing search results URLs, or through Twitter short URLs.<br/> <b>Analyst Comment:</b> WordPress site administrators should keep their installations up-to-date, along with any additional plug-ins. Secure your wp-admin panels with 2FA or other access restrictions.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/9591" target="_blank">[MITRE ATT&CK] T1027 - Obfuscated Files Or Information</a> | <a href="https://ui.threatstream.com/attackpattern/9838" target="_blank">[MITRE ATT&CK] T1140 - Deobfuscate/Decode Files Or Information</a><br/> <b>Tags:</b> Google AdSense, AdSense Fraud, Compromised websites, Typosquatting, Malicious redirect, Pseudo-short URL domain, DDoS-Guard, WordPress</p> </div> <div class="trending-threat-article"> <h3><a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer" target="_blank">Graphiron: New Russian Information Stealing Malware Deployed Against Ukraine</a></h3> <p>(published: February 8, 2023)</p> <p>From October 2022 and into 2023, a new information stealing malware dubbed Graphiron has been used by the Russia-sponsored Nodaria (UAC-0056) group against targets in Ukraine. Similar to previous infostealers used by Nodaria, Graphiron is written in Go, uses PowerShell to steal credentials, and communicates via AES-encrypted channel using port 443. At the same time, with Graphiron the attackers added obfuscation and exfiltration functionality for screenshots and SSH keys.<br/> <b>Analyst Comment:</b> Network and host-based indicators associated with Graphiron and its downloader are available in the Anomali platform and customers are advised to block these on their infrastructure.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/12893" target="_blank">[MITRE ATT&CK] T1622 - Debugger Evasion</a> | <a href="https://ui.threatstream.com/attackpattern/9638" target="_blank">[MITRE ATT&CK] T1105 - Ingress Tool Transfer</a> | <a href="https://ui.threatstream.com/attackpattern/9838" target="_blank">[MITRE ATT&CK] T1140 - Deobfuscate/Decode Files Or Information</a> | <a href="https://ui.threatstream.com/attackpattern/9933" target="_blank">[MITRE ATT&CK] T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder</a> | <a href="https://ui.threatstream.com/attackpattern/9717" target="_blank">[MITRE ATT&CK] T1573.001 - Encrypted Channel: Symmetric Cryptography</a><br/> <b>Tags:</b> malware:Graphiron, malware-type:Infostealer, detection:Infostealer.Graphiron, detection:Downloader.Graphiron, malware-type:Downloader, actor:Nodaria, actor:UAC-0056, source-country:Russia, source-country:RU, target-country:Ukraine, target-country:UA, Cyberespionage, Golang, file-type:EXE, PowerShell, port:443, AES, Windows</p> </div> <div class="trending-threat-article"> <h3><a href="https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me" target="_blank">Screentime: Sometimes It Feels Like Somebody's Watching Me</a></h3> <p>(published: February 8, 2023)</p> <p>In October 2022 - January 2023, a newly-identified threat group dubbed TA866 targeted a wide variety of mostly US companies. The group’s recent activity seems financially-motivated, but its earlier attacks going back to 2019 were focused on cyberespionage. The attack chain starts with a phishing email. It utilizes user agent profiling via a third-party traffic distribution system (404 TDS) and the group’s own domains. The target (email recipient) is facing a Publisher (.PUB) file with macros or a malicious JavaScript file. A malicious MSI package with the WasabiSeed installer inside it is being downloaded. WasabiSeed then downloads secondary MSI files, one of them is the custom Screenshotter screenshotting tool. Post-exploitation payloads involve custom AHK Bot and public Rhadamanthys Stealer. In 2019-2020, versions of AHK Bot included screenshotting and infostealing modules, but TA866 moved to standalone tools since.<br/> <b>Analyst Comment:</b> Phishing education training should bring awareness that attackers may utilize stolen email chains. Consider blocking macros from running in files downloaded from the Internet. Defense-in-depth approach should be used to stop sophisticated threats that evolve and utilize various techniques of defense evasion.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/10001" target="_blank">[MITRE ATT&CK] T1566.001 - Phishing: Spearphishing Attachment</a> | <a href="https://ui.threatstream.com/attackpattern/10028" target="_blank">[MITRE ATT&CK] T1566.002 - Phishing: Spearphishing Link</a> | <a href="https://ui.threatstream.com/attackpattern/9612" target="_blank">[MITRE ATT&CK] T1204 - User Execution</a> | <a href="https://ui.threatstream.com/attackpattern/9591" target="_blank">[MITRE ATT&CK] T1027 - Obfuscated Files Or Information</a> | <a href="https://ui.threatstream.com/attackpattern/10015" target="_blank">[MITRE ATT&CK] T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification</a> | <a href="https://ui.threatstream.com/attackpattern/9638" target="_blank">[MITRE ATT&CK] T1105 - Ingress Tool Transfer</a> | <a href="https://ui.threatstream.com/attackpattern/9671" target="_blank">[MITRE ATT&CK] T1113 - Screen Capture</a> | <a href="https://ui.threatstream.com/attackpattern/9715" target="_blank">[MITRE ATT&CK] T1071.001 - Application Layer Protocol: Web Protocols</a> | <a href="https://ui.threatstream.com/attackpattern/10025" target="_blank">[MITRE ATT&CK] T1555.003 - Credentials from Password Stores: Credentials From Web Browsers</a> | <a href="https://ui.threatstream.com/attackpattern/10031" target="_blank">[MITRE ATT&CK] T1539 - Steal Web Session Cookie</a> | <a href="https://ui.threatstream.com/attackpattern/3708" target="_blank">[MITRE ATT&CK] T1005: Data from Local System</a><br/> <b>Tags:</b> malware:Screentime, malware:WasabiSeed, malware-type:Downloader, malware:AHK Bot, malware:Rhadamanthys, malware-type:Infostealer, actor:TA866, 404 TDS, JavaScript, file-type:JS, file-type:VBS, file-type:LNK, file-type:PDF, file-type:PUB, Macros, Thread hijacking, Google Ads, JavaScript, AutoHotKey, Python, AutoIT, IrfanView, file-type:MSI, file-type:EXE, file-type:DLL, Active Directory, target-country:United States, target-country:US, target-country:Germany, target-country:DE, Windows</p> </div>
Discover More About Anomali
Get the latest news about Anomali's Security and IT Operations platform,
Propel your mission with amplified visibility, analytics, and AI.
Learn how Anomali can help you cost-effectively improve your security posture.
