16-August-2022
Welcome to the weekly threat detection update report from Stamus Networks. Each week, you will receive this email with a summary of the updates.
Current Stamus Threat Intelligence (STI) release version: 519
This week, in addition to daily ruleset and IOC updates, we provided Stamus Security Platform customers with the following improved defense(s):
Note: a "method" as referenced below, is a discrete detection vector for a given threat.
The following detections were added to your Stamus Security Platform this past week:
APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3] MITRE
APT37 - malpedia |
The Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC) found a private-sector offensive actor (PSOA) using multiple Windows and Adobe 0-day exploits, including one for the recently patched CVE-2022-22047, in limited and targeted attacks against European and Central American customers. The PSOA, which MSTIC tracks as KNOTWEED, developed malware called Subzero which was used in these attacks. Microsoft
Mandiant further identified CHIMNEYSWEEP, a backdoor that uses either Telegram or actor-owned infrastructure for command-and-control and is capable of taking screenshots, listing and collecting files, spawning a reverse shell, and supports keylogging functionality. CHIMNEYSWEEP shares code with ROADSWEEP and based on observed decoy content has likely been used to target Farsi and Arabic speakers as far back as 2012. Mandiant
link is a command and control framework written in rust. link provides MacOS, Linux and Windows implants which may lack the necessary evasive tradecraft provided by other more mature command and control frameworks. github
LimeRat (or Lime Remote Administration Tool) is an open source malicious program that can operate as ransomware, a cryptocurrency miner, information stealer, keystroke logger, and computer worm. Pcrisk
LimeRat - malpedia |
This advanced custom Rat is mainly the work of a threat actor that targets Russian entities by using lures in archive file format and more recently Office documents leveraging the Follina vulnerability.
Based on a fake domain registered by the threat actors, we know that they tried to target a Russian aerospace and defense entity known as OAK. MITRE
Woody - MITRE - Encrypted Channel |
The following detections were updated this past week with changes to kill chain phase(s) or MITRE ATT&CK tactic(s)/technique(s):
APT38 is a financially-motivated threat group that is backed by the North Korean regime. The group mainly targets banks and financial institutions and has targeted more than 16 organizations in at least 13 countries since at least 2014.
North Korean group definitions are known to have significant overlap, and the name Lazarus Group is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea. Some organizations track North Korean clusters or groups such as Bluenoroff, APT37, and APT38 separately, while other organizations may track some activity associated with those group names by the name Lazarus Group. MITRE
The term info stealer is self-explanatory. This type of malware resides in an infected computer and gathers data in order to send it to the attacker. Typical targets are credentials used in online banking services, social media sites, emails, or FTP accounts.
Info stealers may use many methods of data acquisition. The most common are:
hooking browsers (and sometimes other applications) and stealing credentials that are typed by the user using web injection scripts that are adding extra fields to web forms and submitting information from them to a server owned by the attacker form grabbing (finding specific opened windows and stealing their content) keylogging stealing passwords saved in the system and cookies Modern info stealers are usually parts of botnets. Sometimes the target of attack and related events are configured remotely by the command sent from the Command and Control server (C&C). Malwarebytes
First analyzed in early 2014 [1] [2], the Blackmoon banking Trojan targets a user’s online banking credentials using a type of pharming that involves modifying or replacing the local Hosts file with one that redirects online banking domain lookups to an IP address controlled by the attacker. Blackmoon has been observed targeting primarily customers of South Korean online banking sites and services, and is usually distributed via drive-by download. Proofpoint
Malware actors often try to infect/add specific code to legitimate binaries in an effort to trojanize (generate segment-padded trojans) those binaries and take advantage of allowed executable on the system.
In computing, the Executable and Linkable Format[citation needed] (ELF, formerly named Extensible Linking Format), is a common standard file format for executable files, object code, shared libraries, and core dumps. First published in the specification for the application binary interface (ABI) of the Unix operating system version named System V Release 4 (SVR4), and later in the Tool Interface Standard, it was quickly accepted among different vendors of Unix systems. In 1999, it was chosen as the standard binary file format for Unix and Unix-like systems on x86 processors by the 86open project. Wikipedia
Malware of this family consists of Trojans that use anti-emulation, anti-debugging, and code obfuscation to prevent their analysis. Kaspersky
Lokibot is a malware designed to collect credentials and security tokens from an infected machine. Lokibot has also been used to establish backdoors in enterprise environments. MITRE
Malicious programs of this family request administrator rights and then make themselves invisible in the list of installed apps. This malware can intercept the user’s personal data, such as SMS messages, MMS messages, and USSD requests. The program can redirect incoming calls to the phone numbers of cybercriminals. Phone numbers, the texts of the messages to be intercepted, and cybercriminal phone numbers for redirecting calls are downloaded from the command-and-control server.
Programs of this family interfere with bank apps, such as the Commerzbank app or Google Play. When the user tries to open one of these legitimate apps, the malware replaces the genuine app window with a phishing window that asks for banking information. The user’s stolen data is sent to the cybercriminals. Kaspersky
Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC. Remote Access Trojans often mimic similar behaviors of keylogger applications by allowing the automated collection of keystrokes, usernames, passwords, screenshots, browser history, emails, chat lots, etc. Remote Access Trojans differ from keyloggers in that they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer. This backdoor into the victim machine can allow an attacker unfettered access, including the ability to monitor user behavior, change computer settings, browse and copy files, utilize the bandwidth (Internet connection) for possible criminal activity, access connected systems, and more. Malwarebytes
PlugX is a remote access tool (RAT) that uses modular plugins. It has been used by multiple threat groups. MITRE
Raccoon is a stealer and collects "passwords, cookies and autofill from all popular browsers (including FireFox x64), CC data, system information, almost all existing desktop wallets of cryptocurrencies". Malpedia
Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security.
Remcos has been observed being used in malware campaigns.
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. [1] Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware. [2] Rootkits have been seen for Windows, Linux, and Mac OS X systems. MITRE
It leverages compromised websites and performs some of the most creative fingerprinting checks we’ve seen, before delivering its payload (NetSupport RAT). Malwarebytes
The term info stealer is self-explanatory. This type of malware resides in an infected computer and gathers data in order to send it to the attacker. Typical targets are credentials used in online banking services, social media sites, emails, or FTP accounts.
Info stealers may use many methods of data acquisition. The most common are:
hooking browsers (and sometimes other applications) and stealing credentials that are typed by the user using web injection scripts that are adding extra fields to web forms and submitting information from them to a server owned by the attacker form grabbing (finding specific opened windows and stealing their content) keylogging stealing passwords saved in the system and cookies Modern info stealers are usually parts of botnets. Sometimes the target of attack and related events are configured remotely by the command sent from the Command and Control server (C&C). Malwarebytes
Again, the generic nature of this detection means that the Payloads performed by this group of trojans may be highly variable, and therefore difficult to describe specifically. This group of trojans has been observed to perform any, or all, of the following actions:
redirect Web traffic
- manipulate certain Windows or third-party applications including settings or configurations
- drop or install additional malicious programs
- download and run additional malicious programs
Please note that this list is not exhaustive.
Microsoft
A dropper is a kind of Trojan that has been designed to "install" some sort of malware (virus, backdoor, etc.) to a target system. The malware code can be contained within the dropper (single-stage) in such a way as to avoid detection by virus scanners or the dropper may download the malware to the target machine once activated (two stage). Wikipedia
The following threat detection(s) were improved this past week with new or updated threat methods.
| Name of threat | New coverage | Total coverage | Last updated | ||||
|---|---|---|---|---|---|---|---|
| New Detection methods | Kill chain phases | Protocols involved | Detection methods | Kill chain phases | Protocols involved | ||
| APT37 | 14 | command and control, delivery | dns, http | 14 | command and control, delivery | dns, http | 2022-08-09 |
| APT38 | 8 | command and control | http, dns | 103 | command and control, delivery | dns, http, tcp, tls | 2022-08-09 |
| Banker Stealer | 3 | command and control | http, dns, tls | 182 | actions on objectives, command and control, delivery | dns, http, smtp, tcp, tls | 2022-08-09 |
| Blackmoon | 1 | command and control | http | 22 | command and control, delivery, installation | http, tcp-pkt | 2022-08-12 |
| CHIMNEYSWEEP | 10 | command and control | dns | 10 | command and control | dns | 2022-08-09 |
| ELF | 2 | command and control | tcp-pkt | 68 | command and control, delivery, installation | dns, http, tcp, tcp-pkt, tls, udp | 2022-08-09 |
| Knotweed | 6 | exploitation | tls, dns | 6 | exploitation | tls, dns | 2022-08-09 |
| Kryptik | 1 | command and control | http | 85 | actions on objectives, command and control, delivery | http, smtp, tcp, tcp-pkt, tls | 2022-08-13 |
| LimeRat | 2 | command and control | tcp, dns | 2 | command and control | tcp, dns | 2022-08-09 |
| Link | 2 | command and control | tls, http | 2 | command and control | tls, http | 2022-08-09 |
| Loki | 2 | command and control | http | 29 | actions on objectives, command and control, delivery | dns, http, tls | 2022-08-09 |
| Marcher | 17 | command and control | dns | 108 | actions on objectives, command and control, delivery | dns, http, tls | 2022-08-09 |
| NetSupport RAT | 4 | command and control | http, dns | 6 | command and control | dns, http, tls | 2022-08-10 |
| PlugX | 1 | command and control | http | 59 | command and control, delivery | dns, http, tcp, tcp-pkt, tls, udp | 2022-08-12 |
| Raccoon Stealer | 1 | delivery | http | 128 | actions on objectives, command and control, delivery | http, tls | 2022-08-12 |
| Remcos | 4 | command and control | tcp | 845 | command and control, delivery | dns, http, tcp, tcp-pkt | 2022-08-13 |
| Rootkit | 1 | command and control | dns | 25 | command and control, delivery | dns, http, tcp | 2022-08-10 |
| SocGholish | 22 | delivery, command and control | http, tcp, dns, tls | 64 | command and control, delivery, reconnaissance | dns, http, tcp, tls | 2022-08-13 |
| Stealer and Exfiltration | 4 | command and control, actions on objectives | http | 227 | actions on objectives, command and control, exploitation, installation | dns, ftp, http, smtp, tcp, tcp-pkt, tls | 2022-08-12 |
| Trojan Agent | 17 | command and control, installation, delivery | tcp, http | 359 | actions on objectives, command and control, delivery, installation | dns, http, ip, smtp, tcp, tcp-pkt, tcp-stream, udp | 2022-08-09 |
| Trojan Dropper | 1 | actions on objectives | http | 246 | actions on objectives, command and control, delivery, installation | dns, http, tcp, tls, udp | 2022-08-10 |
| Woody | 8 | command and control, delivery | dns, http | 8 | command and control, delivery | dns, http | 2022-08-09 |
Technical support
Join the conversation on Discord
Follow us Twitter
Follow us on LinkedIn
Subscribe to our YouTube channel
Stamus Networks website
ABOUT STAMUS NETWORKS
Stamus Networks believes in a world where defenders are heroes, and a future where those they protect remain safe. As organizations face threats from well-funded adversaries, we relentlessly pursue solutions that make the defender’s job easier and more impactful. The global leader in Suricata-based network security solutions, Stamus Networks helps enterprise security teams know more, respond sooner and mitigate their risk with insights gathered from cloud and on-premise network activity. Our Stamus Security Platform combines the best of intrusion detection (IDS), network security monitoring (NSM), and network detection and response (NDR) systems into a single solution that exposes serious and imminent threats to critical assets and empowers rapid response.
© 2014-2024 Stamus Networks, Inc. All rights Reserved.
