Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks

Posted on by Robert Falcone

As mentioned in our previous blog, we observed the Sofacy group using a new persistence mechanism that we call “Office Test” to load their Trojan each time the user opened Microsoft Office applications. Following the report, we received several questions regarding this persistence method, specifically how it works and which versions of Microsoft Office were affected. This blog will serve as a technical analysis of this persistence method that security professionals and network defenders can use for awareness, as we believe it is likely additional threat groups will begin using this technique.

We have added a malicious behavior tag named OfficeDllSideloading to AutoFocus for Palo Alto Networks customers to track the usage of this persistence method. Continue reading "Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks"

Andromeda Botnet Targets Italy in Recent Spam Campaigns

Posted on by Josh Grunzweig

Over the past month, Palo Alto Networks has observed two spam campaigns targeting users residing in Italy. The spam emails attempt to install the pervasive Andromeda malware onto victim machines. This malware has been around since 2011 and shows no signs of stopping. Compromised hosts cause a victim’s machine to be attached to the Andromeda botnet, giving attackers the ability to push plugins or additional malware onto these machines.
Continue reading "Andromeda Botnet Targets Italy in Recent Spam Campaigns"

Palo Alto Networks Researchers Discover Two Critical Internet Explorer Vulnerabilities

Posted on by Ryan Olson

Palo Alto Networks researchers discovered two new critical Internet Explorer (IE) vulnerabilities affecting IE versions 9, 10, and 11. Both are included in Microsoft’s July 2016 Security Bulletin, and documented in Microsoft Security Bulletin MS16-084.

In our continued commitment to the security research community, these vulnerabilities were disclosed to Microsoft through our participation in the Microsoft Active Protections Program (MAPP) program, which ensures the timely, responsible disclosure of new vulnerabilities and creation of protections from security vendors.

Continue reading "Palo Alto Networks Researchers Discover Two Critical Internet Explorer Vulnerabilities"

How to Track Actors Behind Keyloggers Using Embedded Credentials

Posted on by Jeff White

Mo' key loggers, mo' problems

This past year Unit 42 has seen a resurgence of keylogger activity and it seems like every week a new research blog comes out talking about one of four popular families: KeyBase, iSpy, HawkEye, or PredatorPain. These blogs usually delve into the technical workings of the threats, discuss their relationship to each other, and explain how they evolved from one another through new ownership or branding of the tools. The intent of this blog is not to rehash what has already been discussed, but instead to shift the focus to the actors behind these keylogger threats and show a practical technique for identification.

Continue reading "How to Track Actors Behind Keyloggers Using Embedded Credentials"

Investigating the LuminosityLink Remote Access Trojan Configuration

Posted on by Josh Grunzweig

In recent weeks, I’ve spent time investigating the LuminosityLink Remote Access Trojan’s (RAT) embedded configuration. For those unaware, LuminosityLink is a malware family costing $40 that purports to be a system administration utility. However, when executed, the malware leverages a very aggressive keylogger, as well as a number of other malicious features that allow an attacker to gain full control over a victim machine. Continue reading "Investigating the LuminosityLink Remote Access Trojan Configuration"

CryptoBit: Another Ransomware Family Gets an Update

Posted on by Brad Duncan

In April 2016, Panda Security reported yet another new family of ransomware named CryptoBit that spread through exploit kit (EK) traffic. In June 2016, we discovered an updated version of CryptoBit ransomware sent by Rig EK.

On June 23 and June 24, this particular campaign used a gate with the domain name realstatistics[.]info that pointed to Rig EK. If a vulnerable Windows host encountered this traffic, Rig EK delivered CryptoBit ransomware to infect the computer. Other sources use different terms for this ransomware, with some calling it "CriptoBit" or "Mobef" instead of Cryptobit. Continue reading "CryptoBit: Another Ransomware Family Gets an Update"

A Quick Update On Our LabyREnth CTF Challenge

Posted on by Richard Wartell

Congratulations to those who solved an introductory challenge hidden in our initial LabyREnth announcement!

Unit 42 CTF 1

If you decode the binary in the Palo Alto Networks logo on http://labyrenth.com, you get the following ascii message:

“For reals yall. Has anyone really been far as decided to use XOR even go want to do look more like? You've got to even have been kidding me with this PAN. I've been further even more decided to use even go need to do look more as anyone can for Rules and even more than Prizes have been the Overviews. Can you really be far from Ordering even as decided half as much to use Digits go wish for that?”

Continue reading "A Quick Update On Our LabyREnth CTF Challenge"

Recent MNKit Exploit Activity Reveals Some Common Threads

Posted on by Anthony Kasza

Unit 42 recently identified a variant of MNKit-weaponized documents being used to deliver LURK0 Gh0st, NetTraveler, and Saker payloads. The documents were delivered to targets involved with universities, NGOs, and political/human rights groups concerning Islam and South Asia. Reuse of this MNKit variant, sender email addresses, email subject lines, attachment filenames, command and control domains, XOR keys, and targeted recipients show a connection between the different payload families delivered.

MNKit is the name given to a builder that generates CVE-2012-0158 exploit documents. The documents are in MHTML format and install a malicious payload on the compromised host. We believe MNKit is privately shared between multiple attack groups, but is not widely available. Continue reading "Recent MNKit Exploit Activity Reveals Some Common Threads"

Prince of Persia – Game Over

Posted on by Tomer Bar

Summary

Unit 42 published a blog at the beginning of May titled "Prince of Persia," in which we described the discovery of a decade-long campaign using a formerly unknown malware family, Infy, that targeted government and industry interests worldwide.

Subsequent to the publishing of this article, through cooperation with the parties responsible for the C2 domains, Unit 42 researchers successfully gained control of multiple C2 domains. This disabled the attacker’s access to their victims in this campaign, provided further insight into the targets currently victimized in this operation, and enabled the notification of affected parties. Continue reading "Prince of Persia – Game Over"

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

Posted on by Kaoru Hayashi

A recent, well-publicized attack on a Japanese business involved two malware families, PlugX and Elirks, that were found during the investigation. PlugX has been used in a number of attacks since first being discovered in 2012, and we have published several articles related to its use, including an analysis of an attack campaign targeting Japanese companies.

Elirks, less widely known than PlugX, is a basic backdoor Trojan, first discovered in 2010, that is primarily used to steal information from compromised systems. We mostly observe attacks using Elirks occurring in East Asia. One of the unique features of the malware is that it retrieves its C2 address by accessing a pre-determined microblog service or SNS. Attackers create accounts on those services and post encoded IP addresses or the domain names of real C2 servers in advance of distributing the backdoor. We have seen multiple Elirks variants using Japanese blog services for the last couple of years. Figure 1 shows embedded URL in an Elirks sample found in early 2016.

Continue reading "Tracking Elirks Variants in Japan: Similarities to Previous Attacks"

Extending AutoFocus Threat Intelligence With New Tag Types

Posted on by Mike Scott

In previous posts we have discussed how AutoFocus accelerates the analysis, hunting, and incident response workflows by providing full context for threat events seen on your network, as well as high-level visibility into how targeted a threat is against you or your industry peers.

This visibility into the threat landscape enables teams to move away from chasing alerts, instead prioritizing response activities for the most critical threats, and proactively implementing new defensive measures. The real power of AutoFocus is its ability to not only consolidate billions of indicators from WildFire customers around the globe, but more importantly to provide a platform for deriving intelligence and context around those indicators through crowd-sourced tags. AutoFocus customers can develop their own private tags for internal company use, or they can choose to share them publicly for the benefit of all AutoFocus users. And of course, all AutoFocus customers benefit from the expertise of Unit 42, our threat intelligence team, which is constantly monitoring the front lines and dark recesses of the web to identify new malware families and attack campaigns, publish research, and develop new tags. Continue reading "Extending AutoFocus Threat Intelligence With New Tag Types"

New Sofacy Attacks Against US Government Agency

Posted on by Robert Falcone

The Sofacy group, also known as APT28, is a well-known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted the United States government. The e-mail was sent from a potentially compromised account belonging to the Ministry of Foreign Affairs of another government entity and carried the Carberp variant of the Sofacy Trojan. The developer implemented a clever persistence mechanism in the Trojan, one which had not been observed in previous attacks. The focus of this blog will be on the attacks and the infrastructure associated with Sofacy using the new persistence mechanism as a correlation point. Continue reading "New Sofacy Attacks Against US Government Agency"

Using IDAPython to Make Your Life Easier: Part 6

Posted on by Josh Grunzweig

In Part 5 of our IDAPython blog series, we used IDAPython to extract embedded executables from malicious samples. For this sixth installment, I’d like to discuss using IDA in a very automated way. Specifically, let's address how we’re going to load files into IDA without spawning a GUI, automatically run an IDAPython script, and extract the results. Using this technique, we’ll be able to process many samples very quickly without needing to manually open each file in a new instance of IDA and run the IDAPython script.

Many may be surprised to learn that IDA can be executed purely on the command-line without spawning a GUI. In order to do so, the user must run the IDA executable with the ‘-A’ switch. This particular switch will instruct IDA to run in autonomous mode, ensuring that no windows or dialog boxes are presented to the user.

Continue reading "Using IDAPython to Make Your Life Easier: Part 6"

Understanding Angler Exploit Kit - Part 2: Examining Angler EK

Posted on by Brad Duncan

This is the second part of a two-part blog post for understanding Angler exploit kit (EK). The first part covered EKs in general. This blog focuses on the Angler EK.

Angler is currently one of the most advanced, effective, and popular exploit kits in the cyber criminal market. It generally uses the most recent exploits based on the latest vulnerabilities. Like most leading EKs, the authors behind Angler use Software as a Service (SaaS) as their business model, and Angler can be rented in the cyber underground for a few thousand dollars a month. Continue reading "Understanding Angler Exploit Kit - Part 2: Examining Angler EK"

Understanding Angler Exploit Kit - Part 1: Exploit Kit Fundamentals

Posted on by Brad Duncan

Generally speaking, criminal groups use two methods for widespread distribution of malware. The most common method is malicious spam (malspam). This is a fairly direct mechanism, usually through an email attachment or a link in the message to the malware. However, malspam requires some sort of action by the user to be successful (for example, opening an attached file).

The other method for widespread malware distribution is an exploit kit (EK). EKs are designed to work behind the scenes while a potential victim is browsing the web. An EK does not require any additional action by the end user.

EKs are a sophisticated delivery method. Malware distribution through an EK involves other components in the chain of events that lead to a malware infection. Continue reading "Understanding Angler Exploit Kit - Part 1: Exploit Kit Fundamentals"

Get the latest news, invites to events, and threat alerts

Default Heading

Read the article Right Arrow