Collaborate Disseminate
More than 30 years after the end of the Cold War, digital infrastructures worldwide have become strategic national fronts with the same importance as the geographical frontiers of air, land, sea and space. To ensure viability in this fifth domain, cybe… Continue reading Operation PZChao: a possible return of the Iron Tiger APT
WordPress version 4.8.3, released Oct. 31, fixes a serious security issue that could result in SQL injection attacks. Details about the vulnerability are now public, so attacks could soon follow. “If you haven’t updated yet, stop right now and update,” Anthony Ferrara, VP of engineering at Lingo Live and the researcher who identified the flaw..
The post Update Your WordPress Website Now, Researcher Warns appeared first on Security Boulevard.
Continue reading Update Your WordPress Website Now, Researcher Warns
APT10 (MenuPass Group) is a Chinese cyber espionage group that
FireEye has tracked since 2009. They have historically targeted
construction and engineering, aerospace, and telecom firms, and
governments in the United States, Europe, and Japan. We believe that
the targeting of these industries has been in support of Chinese
national security goals, including acquiring valuable military and
intelligence information as well as the theft of confidential business
data to support Chinese corporations. Price Waterhouse Cooper and BAE
recently issued a joint
blog detailing extensive APT10 activity.
In June 2016, FireEye iSIGHT intelligence first reported that APT10
expanded their operations. The group was initially detected targeting
a Japanese university, and more widespread targeting in Japan was
subsequently uncovered. Further collaboration between FireEye as a
Service (FaaS), Mandiant and FireEye iSIGHT intelligence uncovered
additional victims worldwide, a new suite of tools and novel techniques.
Leveraging its global footprint, FireEye has detected APT10 activity
across six continents in 2016 and 2017. APT10 has targeted or
compromised manufacturing companies in India, Japan and Northern
Europe; a mining company in South America; and multiple IT service
providers worldwide. We believe these companies are a mix of final
targets and organizations that could provide a foothold in a final target.
APT10 unveiled new tools in its 2016/2017 activity. In addition to
the continued use of SOGU, the current wave of intrusions has involved
new tools we believe are unique to APT10. HAYMAKER and SNUGRIDE have
been used as first stage backdoors, while BUGJUICE and a customized
version of the open source QUASARRAT have been used as second stage
backdoors. These new pieces of malware show that APT10 is devoting
resources to capability development and innovation.
This recent APT10 activity has included both traditional spear
phishing and access to victim’s networks through service providers.
(For more information on infection via service providers see M-Trends
2016). APT10 spear phishes have been relatively unsophisticated,
leveraging .lnk files within archives, files with double extensions
(e.g. “[Redacted]_Group_Meeting_Document_20170222_doc_.exe) and in
some cases simply identically named decoy documents and malicious
launchers within the same archive.
In addition to the spear phishes, FireEye ISIGHT Intelligence has
observed APT10 accessing victims through global service providers.
Service providers have significant access to customer networks,
enabling an attacker who had compromised a service provider to move
laterally into the network of the service provider’s customer. In
addition, web traffic between a service provider’s customer and a
service provider is likely to be viewed as benign by network defenders
at the customer, allowing the attacker to exfiltrate data stealthily.
A notable instance of this observed by FireEye involved a SOGU
backdoor that was set to communicate with its C2 through a server
belonging to the victim’s service provider.
APT10 actors issued the following commands to a SOGU implant at a victim:
These commands included setting persistence on the victim’s system.
The actor then tested connectivity to an IP managed by the victim’s
service provider. Once connectivity to the service provider IP was
verified, the actor established the service provider IP as a proxy for
the victim’s SOGU backdoor. This effectively routes SOGU malware
traffic through the victim’s service provider, which likely indicates
a foothold on the service provider’s network. The tactic also serves
to mask malicious C2 and exfiltration traffic and make it appear innocuous.
APT10 is a threat to organizations worldwide. Their abuse of access
to service provider networks demonstrates that peripheral
organizations continue to be of interest to a malicious actor –
especially those seeking alternative angles of attack. We believe the
pace of APT10 operations may slow following the public disclosure by
the PwC/BAE
blog; however, we believe they will return to their large-scale
operations, potentially employing new tactics, techniques and procedures.
Researchers at Google and mobile cybersecurity firm Lookout discovered a malicious smartphone application allowing the customers of a “cyber arms dealers” named NSO Group to remotely spy on victims. A sophisticated piece of spyware is believed to be embedded in a cohort of different espionage apps, enabling the attacker to record a target’s keystrokes, exfiltrate data and listen in on conversations through the device’s compromised microphone. The malware-laden applications were not available in the Google Play store, leading researchers to believe that targeted downloads were camouflaged and sent to specific victims through phishing emails or SMS messages. The malware was found on a few dozen Android devices. Dubbed Chrysaor, researchers believe the code is related Pegasus, another highly complex piece of malware designed to infect Apple’s iOS. Lookout researchers first discovered Pegasus, another product of NSO Group, last year on a prominent Saudi human rights activist’s phone. “Individual victim identities […]
The post ‘Pegasus for Android’: Newly discovered spyware allows attacker to record conversations appeared first on Cyberscoop.
Researchers at Google and mobile cybersecurity firm Lookout discovered a malicious smartphone application allowing the customers of a “cyber arms dealers” named NSO Group to remotely spy on victims. A sophisticated piece of spyware is believed to be embedded in a cohort of different espionage apps, enabling the attacker to record a target’s keystrokes, exfiltrate data and listen in on conversations through the device’s compromised microphone. The malware-laden applications were not available in the Google Play store, leading researchers to believe that targeted downloads were camouflaged and sent to specific victims through phishing emails or SMS messages. The malware was found on a few dozen Android devices. Dubbed Chrysaor, researchers believe the code is related Pegasus, another highly complex piece of malware designed to infect Apple’s iOS. Lookout researchers first discovered Pegasus, another product of NSO Group, last year on a prominent Saudi human rights activist’s phone. “Individual victim identities […]
The post ‘Pegasus for Android’: Newly discovered spyware allows attacker to record conversations appeared first on Cyberscoop.
Kaspersky Lab released details about new wiper malware called StoneDrill that bears similarities to Shamoon2 and an APT outfit known as NewsBeef. Continue reading Destructive StoneDrill Wiper Malware On The Loose
Kaspersky Lab released details about new wiper malware called StoneDrill that bears similarities to Shamoon2 and an APT outfit known as NewsBeef. Continue reading Destructive StoneDrill Wiper Malware On The Loose
Today, RSA is publishing new research on a sophisticated software supply-chain attack – dubbed “Kingslayer”. RSA Research investigated the source of suspicious, observed beaconing thought to be associated with targeted malware. In the course of their investigation, RSA discovered a sophisticated software supply-chain attack involving a Trojan inserted in otherwise legitimate software; software that is…
The post Kingslayer – A Supply Chain Attack appeared first on Speaking of Security – The RSA Blog.
by Kent Backman and Kevin Stear, RSA Research Backstory If a sophisticated exploitation campaign is broad enough, it will attract the attention of multiple threat researchers. Such is the case of the malicious, multi-faceted exploitation campaign and botnet RSA Research has dubbed “Schoolbell.” In this blog, RSA will build on existing industry research and dig…
The post Schoolbell: Class is in Session appeared first on Speaking of Security – The RSA Blog.
by Kent Backman and Kevin Stear, RSA Research Backstory If a sophisticated exploitation campaign is broad enough, it will attract the attention of multiple threat researchers. Such is the case of the malicious, multi-faceted exploitation campaign and botnet RSA Research has dubbed “Schoolbell.” In this blog, RSA will build on existing industry research and dig…
The post Schoolbell: Class is in Session appeared first on Speaking of Security – The RSA Blog.