Blog
Anomali Cyber Watch: TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations, Necro Python Bots Adds New Tricks, US Seizes Domains Used by APT29 and More
Anomali Threat Research
June 8, 2021
<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: <b>APT, APT29, FluBot, Necro Python, RoyalRoad, SharpPanda, TeaBot</b> and <b>Vulnerabilities</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.</p> <p><img src="https://cdn.filestackcontent.com/CsFNHafTWmLXRMzq6jDX"/><br/> <b>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</b></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/" target="_blank">TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations</a></h3> <p>(published: June 4, 2021)</p> <p>Researchers at Palo Alto have identified a malware repo belonging to TeamTNT, the prominent cloud focused threat group. The repo shows the expansion of TeamTNTs abilities, and includes scripts for scraping SSH keys, AWS IAM credentials and searching for config files that contain credentials. In addition to AWS credentials, TeamTNT are now also searching for Google Cloud credentials, which is the first instance of the group expanding to GCP.<br/> <b>Analyst Comment:</b> Any internal only cloud assets & SSH/Privileged access for customer facing cloud infrastructure should only be accessible via company VPN. This ensures attackers don’t get any admin access from over the internet even if keys or credentials are compromised. Customers should monitor compromised credentials in public leaks & reset the passwords immediately for those accounts.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947097" target="_blank">[MITRE ATT&CK] Permission Groups Discovery - T1069</a><br/> <b>Tags:</b> AWS, Cloud, Credential Harvesting, cryptojacking, Google Cloud, IAM, scraping, TeamTnT, Black-T, Peirates</p> </div> <div class="trending-threat-article"> <h3 id="article-2"><a href="https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.html" target="_blank">Necro Python Bots Adds New Tricks</a></h3> <p>(published: June 3, 2021)</p> <p>Researchers at Talos have identified updated functionality in the Necro Python bot. The core functionality is the same with a focus on Monero mining, however exploits to the latest vulnerabilities have been added. The main payloads are XMRig, traffic sniffing and DDoS attacks. Targeting small and home office routers, the bot uses python to support multiple platforms.<br/> <b>Analyst Comment:</b> Users should ensure they always apply the latest patches as the bot is looking to exploit unpatched vulnerabilities. Users need to change default passwords for home routers to ensure potential malware on your personal devices don’t spread to your corporate devices through router takeover.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947201" target="_blank">[MITRE ATT&CK] Scripting - T1064</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/947243" target="_blank">[MITRE ATT&CK] Input Capture - T1056</a> | <a href="https://ui.threatstream.com/ttp/947138" target="_blank">[MITRE ATT&CK] Exploit Public-Facing Application - T1190</a> | <a href="https://ui.threatstream.com/ttp/947139" target="_blank">[MITRE ATT&CK] Remote Access Tools - T1219</a><br/> <b>Tags:</b> Bot, botnet, Exploit, Monero, Necro Python, Python, Vulnerabilities, XMRig</p> </div> <div class="trending-threat-article"> <h3 id="article-3"><a href="https://www.bleepingcomputer.com/news/security/new-skinnyboy-malware-used-by-russian-hackers-to-breach-sensitive-orgs/" target="_blank">New SkinnyBoy Malware Used by Russian Hackers to Breach Sensitive Orgs</a></h3> <p>(published: June 3, 2021)</p> <p>Researchers from Cluster25 have identified a new malware that was used in a phishing campaign attributed to APT28 (Fancy Bear, Sofacy). In early March 2021 he campaign was observed targeting the defense industry, foreign ministries and militaries of NATO or NATO aligned countries. SkinnyBoy is intended to collect information about the victim and retrieve the next payload from the command and control (C2) server, it is used during the intermediary stage of an infection. It is delivered through phishing emails with a malicious Microsoft Word attachment containing a macro that extracts a DLL file acting as a downloader. Cluster25 believes the TTPs of this attack strongly implicate APT28.<br/> <b>Analyst Comment:</b> Defense-in-depth (layering of security mechanisms, redundancy, fail-safe defense processes) is the best way to ensure safety from APTs, including a focus on both network and host-based security. Prevention and detection capabilities should also be in place. Furthermore, all employees should be educated on the risks of spearphishing and how to identify such attempts.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947191" target="_blank">[MITRE ATT&CK] Command-Line Interface - T1059</a> | <a href="https://ui.threatstream.com/ttp/947205" target="_blank">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/947207" target="_blank">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a> | <a href="https://ui.threatstream.com/ttp/947195" target="_blank">[MITRE ATT&CK] File and Directory Discovery - T1083</a> | <a href="https://ui.threatstream.com/ttp/947135" target="_blank">[MITRE ATT&CK] Data from Local System - T1005</a> | <a href="https://ui.threatstream.com/ttp/947117" target="_blank">[MITRE ATT&CK] Automated Collection - T1119</a> | <a href="https://ui.threatstream.com/ttp/947126" target="_blank">[MITRE ATT&CK] Standard Application Layer Protocol - T1071</a> | <a href="https://ui.threatstream.com/ttp/947259" target="_blank">[MITRE ATT&CK] Data Encoding - T1132</a> | <a href="https://ui.threatstream.com/ttp/947193" target="_blank">[MITRE ATT&CK] Automated Exfiltration - T1020</a> | <a href="https://ui.threatstream.com/ttp/947210" target="_blank">[MITRE ATT&CK] Exfiltration Over Command and Control Channel - T1041</a><br/> <b>Tags:</b> Strontium, Fancy Bear, APT28, Sednit, Sofacy, Government, Military, EU & UK, North America, Russia, malware, APT, APT28, SkinnyBoy, NATO</p> </div> <div class="trending-threat-article"> <h3 id="article-4"><a href="https://research.checkpoint.com/2021/chinese-apt-group-targets-southeast-asian-government-with-previously-unknown-backdoor/" target="_blank">SharpPanda: Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor</a></h3> <p>(published: June 3, 2021)</p> <p>Researchers have discovered an ongoing surveillance campaign that incorporates a newly-identified backdoor into the final stage of the infection chain. The campaign has been attributed to a China-based APT group with moderate to high confidence that appears to have been active for at least three years. This spearphishing campaign begins with a targeted email to members of a Southeast Asian Government, with a malicious DOCX file that loads a remote template RTF weaponized with RoyalRoad.<br/> <b>Analyst Comment:</b> Email security and phishing awareness are critical aspects of a defense in depth program. High levels of caution should be applied to email attachments and links. Up to date endpoint protection and patching can also be very effective prevention methods.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947205" target="_blank">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/947244" target="_blank">[MITRE ATT&CK] Exploitation for Client Execution - T1203</a> | <a href="https://ui.threatstream.com/ttp/947191" target="_blank">[MITRE ATT&CK] Command-Line Interface - T1059</a> | <a href="https://ui.threatstream.com/ttp/947127" target="_blank">[MITRE ATT&CK] Scheduled Task - T1053</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/2336976" target="_blank">[MITRE ATT&CK] Template Injection - T1221</a> | <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a> | <a href="https://ui.threatstream.com/ttp/3297596" target="_blank">[MITRE ATT&CK] Software Discovery - T1518</a> | <a href="https://ui.threatstream.com/ttp/947207" target="_blank">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947252" target="_blank">[MITRE ATT&CK] Query Registry - T1012</a> | <a href="https://ui.threatstream.com/ttp/947120" target="_blank">[MITRE ATT&CK] System Service Discovery - T1007</a> | <a href="https://ui.threatstream.com/ttp/947241" target="_blank">[MITRE ATT&CK] Credentials in Files - T1081</a> | <a href="https://ui.threatstream.com/ttp/947149" target="_blank">[MITRE ATT&CK] Application Window Discovery - T1010</a> | <a href="https://ui.threatstream.com/ttp/947079" target="_blank">[MITRE ATT&CK] Screen Capture - T1113</a> | <a href="https://ui.threatstream.com/ttp/947135" target="_blank">[MITRE ATT&CK] Data from Local System - T1005</a> | <a href="https://ui.threatstream.com/ttp/947259" target="_blank">[MITRE ATT&CK] Data Encoding - T1132</a> | <a href="https://ui.threatstream.com/ttp/947204" target="_blank">[MITRE ATT&CK] Multi-Stage Channels - T1104</a> | <a href="https://ui.threatstream.com/ttp/947126" target="_blank">[MITRE ATT&CK] Standard Application Layer Protocol - T1071</a> | <a href="https://ui.threatstream.com/ttp/947210" target="_blank">[MITRE ATT&CK] Exfiltration Over Command and Control Channel - T1041</a> | <a href="https://ui.threatstream.com/ttp/3297597" target="_blank">[MITRE ATT&CK] System Shutdown/Reboot - T1529</a><br/> <b>Tags:</b> SharpPanda, RoyalRoad, government, asia, VictoryDll</p> </div> <div class="trending-threat-article"> <h3 id="article-5"><a href="https://therecord.media/two-carbanak-hackers-sentenced-to-eight-years-in-prison-in-kazakhstan/" target="_blank">Two Carbanak Hackers Sentenced To Eight Years In Prison In Kazakhstan</a></h3> <p>(published: June 2, 2021)</p> <p>Two Carbanak members were sentenced in Kazakhstan to eight years in June 2021. They were found guilty of breaching the IT systems of two Kazakh banks between 2016 and 2017, from where they stole more than two billion tenges ($4.6 million USD). The stolen money was sent to 250 payment cards, which were subsequently sent to Europe. The funds cashed out through ATMs across Belgium, Czech Republic, France, Estonia, Germany, Lithuania, the Netherlands, Poland, Russia, Slovakia, Spain, Switzerland.<br/> <b>Analyst Comment:</b> Carbanak group attracted special attention last month after the DarkSide ransomware attack Colonial Pipeline. Carbanak were changing their tactics and attracting new affiliates with different intrusion and exfiltration techniques. Complex protection measures are needed that range from anti-phishing training to network monitoring and data loss prevention (DLP).<br/> <b>Tags:</b> Carbanak, banks, Financial sector, Kazakhstan</p> </div> <div class="trending-threat-article"> <h3 id="article-6"><a href="https://blog.morphisec.com/google-ppc-ads-deliver-redline-taurus-and-mini-redline-infostealers" target="_blank">Google PPC Ads Deliver Redline, Taurus, and mini-Redline Infostealers</a></h3> <p>(published: June 2, 2021)</p> <p>Researchers at Morphisec have identified info stealers being downloaded via pay-per-click ads in Google search results. The ads appear to be targeting specific IP ranges located in the US, with IPs outside the range being redirected to the legitimate download page. The malware are downloaded as AnyDesk, Dropbox and Telegram packages wrapped as ISO images and include infostealers: Taurus AutoIt, Mini Redline and Redline.<br/> <b>Analyst Comment:</b> Users should exercise caution when downloading anything from the internet, even from a seemingly legitimate source. Practicing defense-in-depth will also help reduce the impact, if a user does accidentally download a malicious file.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947145" target="_blank">[MITRE ATT&CK] Signed Binary Proxy Execution - T1218</a> | <a href="https://ui.threatstream.com/ttp/2402543" target="_blank">[MITRE ATT&CK] Virtualization/Sandbox Evasion - T1497</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a><br/> <b>Tags:</b> Google, InfoStealer, ISO images, Redline, Mini Redline, Taurus</p> </div> <div class="trending-threat-article"> <h3 id="article-7"><a href="https://www.bleepingcomputer.com/news/security/us-seizes-domains-used-by-apt29-in-recent-usaid-phishing-attacks/" target="_blank">US Seizes Domains Used by APT29 in Recent USAID Phishing Attacks</a></h3> <p>(published: June 2, 2021)</p> <p>The US Department of Justice has seized two domains used in recent phishing attacks impersonating the U.S. Agency for International Development that has been attributed to APT29 (Cozy Bear). The domains are theyardservice [.]com and worldhomeoutlet[.]com. Victims were targeted with phishing emails that prompted users to download HTML attachments that then installed Cobalt Strike beacon payloads.<br/> <b>Analyst Comment:</b> Ensure that your company's firewall blocks all entry points for unauthorized users, and maintain records of how normal traffic appears on your network. Therefore, it will be easier to spot unusual traffic and connections to and from your network to potentially identify malicious activity.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947203" target="_blank">[MITRE ATT&CK] Web Service - T1102</a> | <a href="https://ui.threatstream.com/ttp/947126" target="_blank">[MITRE ATT&CK] Standard Application Layer Protocol - T1071</a><br/> <b>Tags:</b> APT29, Cobalt Strike, Cozy Bear, Domains, Russia, Phishing</p> </div> <div class="trending-threat-article"> <h3 id="article-8"><a href="https://threatpost.com/revil-ransomware-ground-down-jbs-sources/166597/" target="_blank">REvil Ransomware Ground Down JBS: Sources</a></h3> <p>(published: June 2, 2021)</p> <p>JBS Foods announced that they believe the recent ransomware attack that occurred in late May was launched from a criminal organization in Russia. The REvil gang, also known as Sodinokibi, is known for both audacious attacks on the world's biggest organizations, and demanding large ransoms payments from affected organizations. The White House has offered assistance to JBS, with the incident being investigated by the FBI and CISA.<br/> <b>Analyst Comment:</b> Educate your employees on the risks of opening attachments from unknown senders. Anti-spam and antivirus applications provided from trusted vendors should also be employed. Emails that are received from unknown senders should be carefully avoided, and attachments from such senders should not be opened.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/2402531" target="_blank">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a><br/> <b>Tags:</b> DarkSide, JBS, Sodinoki, REvil, Russia, Ransomware</p> </div> <div class="trending-threat-article"> <h3 id="article-9"><a href="https://labs.bitdefender.com/2021/06/threat-actors-use-mockups-of-popular-apps-to-spread-teabot-and-flubot-malware-on-android/" target="_blank">Threat Actors Use Mockups of Popular Apps to Spread Teabot and Flubot Malware on Android</a></h3> <p>(published: June 1, 2021)</p> <p>BitDefender researchers have identified the Android malwares TeaBot and Flubot being delivered through impersonation of legitimate Android apps. TeaBot is an Android RAT that has the ability to keylog, steal SMS, steal Google Authentication codes, carry out overlay attacks and take remote control of the device. In order to spread the malware, threat actors are taking the source code of legitimate apps and injecting malicious code before repacking. These apps include Kaspersky, VLC Media Player, PlutoTV among others.<br/> <b>Analyst Comment:</b> Mobile applications should only be downloaded from official locations such as the Google Play Store and the Apple App Store. Websites and documents that request additional software is needed in order to access, or properly view content should be properly avoided. Additionally, mobile security applications provided from trusted vendors are recommended. Furthermore, this story shows the potential of malicious applications bypassing the security measures of application stores and therefore it is crucial that all permissions of an applications be examined prior to download.<br/> <b>Tags:</b> Android Malware, Flubot, Keylogger, RAT, TeaBot</p> </div> <div class="trending-threat-article"> <h3 id="article-10"><a href="https://www.bleepingcomputer.com/news/security/critical-wordpress-plugin-zero-day-under-active-exploitation/" target="_blank">Critical WordPress Plugin Zero-day Under Active Exploitation</a></h3> <p>(published: June 1, 2021)</p> <p>A vulnerability in WordPress plugin Fancy Product Designer is being actively exploited by threat actors. Fancy Product Designer is a plugin that allows users to customize products with custom images and is installed in over 17,000 websites. The zero-day, which also affects WooCommerce, enables threat actors to deploy executable PHP files and lead to remote control with the purpose of stealing PII (Personally Identifiable Information).<br/> <b>Analyst Comment:</b> Users are advised to immediately install the latest Fancy Product Design patched version that was released on June 2.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/3297595" target="_blank">[MITRE ATT&CK] Server Software Component - T1505</a> | <a href="https://ui.threatstream.com/ttp/947276" target="_blank">[MITRE ATT&CK] Network Service Scanning - T1046</a><br/> <b>Tags:</b> PHP, Remote Code Execution, Vulnerability, Wordpress, Zero Day</p> </div>
Discover More About Anomali
Get the latest news about Anomali's Security and IT Operations platform,
Propel your mission with amplified visibility, analytics, and AI.
Learn how Anomali can help you cost-effectively improve your security posture.
