Anomali Cyber Watch: APT Groups, Data Breach, Malspam, and More

<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: <b>APT10, Charming Kitten, China, Cycldek, Hancitor, Malspam, North Korea, Phishing, TA453,</b> and <b>Vulnerabilities</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.</p> <p><img src="https://cdn.filestackcontent.com/yyUXXtDSe8kWoZ2iE59Q"/><br/> <em>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</em></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://securelist.com/the-leap-of-a-cycldek-related-threat-actor/101243/" target="_blank">The Leap of a Cycldek-Related Threat Actor</a></h3> <p>(published: April 5, 2021)</p> <p>A new sophisticated Chinese campaign was observed between June 2020 and January 2021, targeting government, military and other critical industries in Vietnam, and, to lesser extent, in Central Asia and Thailand. This threat actor uses a "DLL side-loading triad" previously mastered by another Chinese group, LuckyMouse: a legitimate executable, a malicious DLL to be sideloaded by it, and an encoded payload, generally dropped from a self-extracting archive. But the code origins of the new malware used on different stages of this campaign point to a different Chinese-speaking group, Cycldek.<br/> <b>Analyst Comment:</b> Malware authors are always innovating new methods of communicating back to the control servers. Always practice Defense in Depth (do not rely on single security mechanisms - security measures should be layered, redundant, and failsafe).<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947232" target="_blank">[MITRE ATT&CK] DLL Side-Loading - T1073</a> | <a href="https://ui.threatstream.com/ttp/947164" target="_blank">[MITRE ATT&CK] File Deletion - T1107</a><br/> <b>Tags:</b> Chinese-speaking, Cycldek-related</p> </div> <div class="trending-threat-article"> <h3 id="article-2"><a href="https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/" target="_blank">Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool</a></h3> <p>(published: April 1, 2021)</p> <p>Hancitor is an information stealer and malware downloader used by a threat actor designated as MAN1, Moskalvzapoe or TA511. Initial infection includes target clicking malspam, then clicking on a link in an opened Google Docs page, and finally clicking to enable macros in the downloaded Word document. In recent months, this actor began using a network ping tool to help enumerate the Active Directory (AD) environment of infected hosts. It generates approximately 1.5 GB of Internet Control Message Protocol (ICMP) traffic.<br/> <b>Analyst Comment:</b> Organizations should use email security solutions to block malicious/spam emails. All email attachments should be scanned for malware before they reach the user's inbox. IPS rules need to be configured properly to identify any reconnaissance attempts e.g. port scan to get early indication of potential breach.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947275" target="_blank">[MITRE ATT&CK] Remote System Discovery - T1018</a> | <a href="https://ui.threatstream.com/ttp/947139" target="_blank">[MITRE ATT&CK] Remote Access Tools - T1219</a> | <a href="https://ui.threatstream.com/ttp/947170" target="_blank">[MITRE ATT&CK] Rundll32 - T1085</a> | <a href="https://ui.threatstream.com/ttp/947126" target="_blank">[MITRE ATT&CK] Standard Application Layer Protocol - T1071</a> | <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a><br/> <b>Tags:</b> Hancitor, Malspam, Cobalt Strike</p> </div> <div class="trending-threat-article"> <h3 id="article-3"><a href="https://blog.google/threat-analysis-group/update-campaign-targeting-security-researchers" target="_blank">Update on Campaign Targeting Security Researchers</a></h3> <p>(published: March 31, 2021)</p> <p>Threat Analysis Group (TAG) first discovered the campaign back in January. In mid-March, TAG analysts observed the North Korea-sponsored group had launched a fake security company, 'SecuriElite,' with its own website. The new website claims the company is an offensive security company located in Turkey that offers pen-tests, software security assessments and exploits.<br/> <b>Analyst Comment:</b> We recommend to block SecuriElite website and related email IDs. Also, send a notification to researchers and SecOPS teams in your company with Twitter and LinkedIn profiles related to this company asking them to report and block them.<br/> <b>Tags:</b> SecuriElite, North Korean threat group</p> </div> <div class="trending-threat-article"> <h3 id="article-4"><a href="https://blog.talosintelligence.com/2021/03/cheating-cheater-how-adversaries-are.html" target="_blank">Cheating The Cheater: How Adversaries are Using Backdoored Video Game Cheat Engines and Modding Tools</a></h3> <p>(published: March 31, 2021)</p> <p>A new cryptor used in several different malware campaigns hidden in seemingly legitimate files that users would usually download to install cheat codes into video games or other visual and game modifications. The cryptor uses Visual Basic 6 along with shellcode and process injection techniques. A malicious file packed with the VB6 cryptor in reality acts as a loader, for example, for information stealer XtremeRAT. These types of attacks are a return to form for classic virus campaigns - video game players are no strangers to trying to avoid malicious downloads while trying to change the way some games are presented.<br/> <b>Analyst Comment:</b> Gaming industry targeting is often underestimated, however, there is a lot of money in gaming. Threat actors can always pivot and use the compromised gaming machine for ransom or stealing banking information.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/947187" target="_blank">[MITRE ATT&CK] System Network Configuration Discovery - T1016</a><br/> <b>Tags:</b> Malware campaign, Video game mods, Mod developing</p> </div> <div class="trending-threat-article"> <h3 id="article-5"><a href="https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential" target="_blank">BadBlood: TA453 Targets US and Israeli Medical Research Personnel in Credential Phishing Campaigns</a></h3> <p>(published: March 30, 2021)</p> <p>Security researchers have linked a late-2020 phishing campaign aimed at stealing credentials from 25 senior professionals at medical research organizations in the United States and Israel to an advanced persistent threat group with links to Iran called TA453 (Charming Kitten, Phosphorus, Ajax). The campaign-dubbed BadBlood because of its medical focus and the history of tensions between Iran and Israel-aimed to steal credentials of professionals specializing in genetic, neurology and oncology research. "While this campaign may represent a shift in TA453 targeting overall, it is also possible it may be the result of a specific short-term intelligence collection requirement," the team wrote.<br/> <b>Analyst Comment:</b> Spearphishing emails represent a significant security risk because the sending email will often appear legitimate to the target; sometimes a target company email is compromised and used for such emails. Education is the best defense, inform your employees on what to expect for information requests from their managers and colleagues. Employees should also be aware of whom to contact when they suspect they are the target of a possible spear phishing attack.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947187" target="_blank">[MITRE ATT&CK] System Network Configuration Discovery - T1016</a><br/> <b>Tags:</b> TA543, Charming Kitten, BadBlood Campaign</p> </div> <div class="trending-threat-article"> <h3 id="article-6"><a href="https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/" target="_blank">APT10: Sophisticated Multi-Layered Loader Ecipekac Discovered in A41APT Campaign</a></h3> <p>(published: March 30, 2021)</p> <p>A41APT is a long-running campaign with activities detected from March 2019 to the end of December 2020. APT10 leveraged vulnerabilities in Pulse Connect Secure in order to hijack VPN sessions, or took advantage of system credentials that were stolen in previous operations. Ecipekac is a sophisticated multi-layer loader module used to deliver payloads such as SodaMaster.<br/> <b>Analyst Comment:</b> Defense-in-depth is an effective way to help mitigate potential APT activity. Defense-in-Depth involves the layering of defence mechanisms. This can include network and end-point security, social engineering training (such as training exercises to help detect phishing emails) for staff and robust threat intelligence capabilities.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a> | <a href="https://ui.threatstream.com/ttp/947207" target="_blank">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947231" target="_blank">[MITRE ATT&CK] Valid Accounts - T1078</a> | <a href="https://ui.threatstream.com/ttp/947094" target="_blank">[MITRE ATT&CK] External Remote Services - T1133</a> | <a href="https://ui.threatstream.com/ttp/947287" target="_blank">[MITRE ATT&CK] PowerShell - T1086</a> | <a href="https://ui.threatstream.com/ttp/947252" target="_blank">[MITRE ATT&CK] Query Registry - T1012</a> | <a href="https://ui.threatstream.com/ttp/947141" target="_blank">[MITRE ATT&CK] Masquerading - T1036</a> | <a href="https://ui.threatstream.com/ttp/947101" target="_blank">[MITRE ATT&CK] Code Signing - T1116</a> | <a href="https://ui.threatstream.com/ttp/947217" target="_blank">[MITRE ATT&CK] Exploitation of Remote Services - T1210</a><br/> <b>Tags:</b> APT10, A41APT campaign, Ecipekac loader, QuasarRAT</p> </div> <div class="trending-threat-article"> <h3 id="article-7"><a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/spectre-bypass-linux-vulnerabilities" target="_blank">Newly-Discovered Vulnerabilities Could Allow for Bypass of Spectre Mitigations in Linux</a></h3> <p>(published: March 29, 2021)</p> <p>Vulnerabilities could allow a malicious user to access data belonging to other users. If left unpatched, the vulnerabilities mean existing Spectre protections will not be sufficient to prevent some exploitation techniques. The vulnerabilities were discovered by Piotr Krysiuk, a security researcher on Symantec's Threat Hunter team.<br/> <b>Analyst Comment:</b> It is important that your company has patch-maintenance policies in place, particularly when there are Bring Your Own Device (BYOD) policies in use. Once a vulnerability has been reported on in open sources, threat actors will likely attempt to incorporate the exploitation of the vulnerability into their malicious operations. Patches should be reviewed and applied as soon as possible to prevent potential malicious activity<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947179" target="_blank">[MITRE ATT&CK] Redundant Access - T1108</a> | <a href="https://ui.threatstream.com/ttp/947233" target="_blank">[MITRE ATT&CK] Exploitation for Privilege Escalation - T1068</a><br/> <b>Tags:</b> CVE-2020-27170, CVE-2020-27171</p> </div>