It is exceptionally rare for a well-documented threat actor, previously implicated in very high-profile attacks, to stay completely under the radar for several years. Yet, in the last three years that is what APT group the Dukes (aka APT29 and Cozy Bear) has done. Despite being well known as one of the groups to hack the Democratic National Committee in the run-up to the 2016 US election, the Dukes has received little subsequent attention. The last documented campaign attributed to them is a phishing campaign against the Norwegian government that dates back to January 2017

REFERENCE:
https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf
TAG:
ADVERSARY:
MALWARE FAMILY:
MiniDuke
ATTACK IDS:
T1001 – Data ObfuscationT1005 – Data from Local SystemT1008 – Fallback ChannelsT1025 – Data from Removable MediaT1027 – Obfuscated Files or InformationT1035 – Service ExecutionT1039 – Data from Network Shared DriveT1041 – Exfiltration Over Command and Control ChannelT1045 – Software PackingT1049 – System Network Connections DiscoveryT1053 – Scheduled TaskT1057 – Process DiscoveryT1060 – Registry Run Keys / Startup FolderT1064 – ScriptingT1071 – Standard Application Layer ProtocolT1077 – Windows Admin SharesT1078 – Valid AccountsT1083 – File and Directory DiscoveryT1084 – Windows Management Instrumentation Event SubscriptionT1085 – Rundll32T1086 – PowerShellT1090 – Connection ProxyT1102 – Web ServiceT1106 – Execution through APIT1107 – File DeletionT1112 – Modify RegistryT1129 – Execution through Module LoadT1135 – Network Share DiscoveryT1140 – Deobfuscate/Decode Files or InformationT1193 – Spearphishing Attachment

In August 2019, FireEye released the “Double Dragon” report on our newest graduated threat group: APT41. A China-nexus dual espionage and financially-focused group, APT41 targets industries such as gaming, healthcare, high-tech, higher education, telecommunications, and travel services. This blog post is about the sophisticated passive backdoor we track as LOWKEY, mentioned in the APT41 report, and associated with ESETs recent Winnti Group related blog https://www.welivesecurity.com/2019/10/14/connecting-dots-exposing-arsenal-methods-winnti/ .

REFERENCES:
https://www.fireeye.com/blog/threat-research/2019/10/lowkey-hunting-for-the-missing-volume-serial-id.html
https://www.welivesecurity.com/2019/10/14/connecting-dots-exposing-arsenal-methods-winnti/
GROUP:
ADVERSARY:

In our September 5, 2019, Threat Insight post, “Seems Phishy: Back To School Lures Target University Students and Staff,” we discussed the seasonal uptick of phishing campaigns that are directed at university students and staff, usually between June and October of every year. Since our blog post, colleagues at Secureworks have provided further details on one actor we highlighted, tracked by Proofpoint as TA407, also known as Silent Librarian, Cobalt Dickens, and Mabna Institute. In this blog, we provide additional insight into the actor and their evolving TTPs in ongoing, academia-focused campaigns.

REFERENCE:
https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian
ADVERSARY:
INDUSTRY:
TARGETED COUNTRY:

The Anomali Threat Research Team has identified an ongoing campaign which it believes is being conducted by the China-based threat group, Mustang Panda. The team first revealed these findings on Wednesday, October 2, during Anomali Detect 19, the company’s annual user conference, in a session titled: “Mustang Panda Riding Across Country Lines.”

REFERENCE:
https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
ADVERSARY:
MALWARE FAMILY:
PlugX

Charming Kitten, an Iranian APT group, plays a role in the domain of cyber-attacks for the purpose of interfering with democratic procedures. On 4th of October 2019, Microsoft has announced that Phosphorus (known as Charming Kitten) attempted to attack email accounts that are associated with the following targets: U.S. presidential campaign, current and former U.S. government officials, journalists covering global politics, and prominent Iranians living outside Iran.

REFERENCE:
https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2.pdf
ADVERSARY:
INDUSTRY:
TARGETED COUNTRY:

By monitoring the campaign primarily targeting Japanese service providers, FortiGuard Labs was able to identify this campaign and what, to the best of our knowledge, is a new malware family. During our analysis, we also encountered other samples that were not completely developed and lacked some of the functionalities discussed in this blogpost, suggesting that the malware is currently under development and is being tested in the wild. The capabilities of this family are limited at the moment, but the fact that we were able to find different samples that showed significant improvement in the span of a few weeks shows that this family should not be underestimated.

REFERENCE:
https://www.fortinet.com/blog/threat-research/funkybot-malware-targets-japan.html
TARGETED COUNTRY:
MALWARE FAMILY:
FunkyBot
ATTACK ID:
T1045 – Software Packing

Qbot, or Qakbot, is a banking trojan that has been seen in the wild for at least 10 years. Recent campaigns have been often delivered by exploit kits and weaponized documents delivered via context-aware phishing campaigns. Qbot has also been suspected of delivering MegaCortex ransomware. Many recent samples are observed to conduct worm-like behavior to spread across network shares or via SMB, and contain multiple levels of anti-analysis controls such as VM awareness and lengthy execution delays.

REFERENCE:
https://www.carbonblack.com/2019/09/26/cb-tau-threat-intelligence-notification-qbot-qakbot-attempts-to-evade-detection-by-overwriting-itself/
MALWARE FAMILIES:
ATTACK IDS:
T1045 – Software PackingT1053 – Scheduled TaskT1055 – Process InjectionT1057 – Process DiscoveryT1060 – Registry Run Keys / Startup FolderT1064 – ScriptingT1089 – Disabling Security ToolsT1110 – Brute ForceT1112 – Modify RegistryT1124 – System Time DiscoveryT1135 – Network Share DiscoveryT1187 – Forced AuthenticationT1497 – Virtualization/Sandbox Evasion

We found a new modular fileless botnet malware, which we named “Novter,” (also reported and known as “Nodersok” and “Divergent”) that the KovCoreG campaign has been distributing since March. We’ve been actively monitoring this threat since its emergence and early development, and saw it being frequently updated. KovCoreG, active since 2011, is a long-running campaign known for using the Kovter botnet malware, which was distributed mainly through malvertisements and exploit kits. Kovter has been involved in click fraud operations since 2015, using fraudulent ads that have reportedly cost businesses more than US$29 million. The botnet was taken down at the end of 2018 through concerted efforts by law enforcement and cybersecurity experts, including Trend Micro.

REFERENCE:
https://blog.trendmicro.com/trendlabs-security-intelligence/new-fileless-botnet-novter-distributed-by-kovcoreg-malvertising-campaign/
TAG:
GROUP:
ADVERSARY:

Over the course of the last two years, BlackBerry Cylance researchers uncovered a suspected Chinese advanced persistent threat (APT) group conducting attacks against technology companies located in south-east Asia. The threat actors deployed a version of the open-source PcShare backdoor modified and designed to operate when side-loaded by a legitimate NVIDIA application.

REFERENCE:
https://threatvector.cylance.com/en_us/home/pcshare-backdoor-attacks-targeting-windows-users-with-fakenarrator-malware.html
ADVERSARY:
INDUSTRY:
ATTACK IDS:
T1007 – System Service DiscoveryT1010 – Application Window DiscoveryT1012 – Query RegistryT1015 – Accessibility FeaturesT1032 – Standard Cryptographic ProtocolT1041 – Exfiltration Over Command and Control ChannelT1057 – Process DiscoveryT1060 – Registry Run Keys / Startup FolderT1073 – DLL Side-LoadingT1078 – Valid AccountsT1082 – System Information DiscoveryT1083 – File and Directory DiscoveryT1085 – Rundll32T1100 – Web ShellT1105 – Remote File CopyT1140 – Deobfuscate/Decode Files or Information

The FortiGuard SE Team discovered a particularly interesting targeted attack towards the end of August in Virus Total. The attack targeted a supplier for a distribution/logistics provider to a nation state. The email contained an attachment that appeared to have been sent by a company that manufactures and distributes electrical components and other parts, and has likely dealt at least once with the targeted organization via email.

REFERENCE:
https://www.fortinet.com/blog/threat-research/trickbot-or-treat-threat-analysis.html
TAG:
ADVERSARY:
ATTACK IDS:
T1193 – Spearphishing AttachmentT1195 – Supply Chain CompromiseT1086 – PowerShellT1158 – Hidden Files and Directories